wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "wpa.h"
  24 #include "drivers/driver.h"
  25 #include "ieee802_11_defs.h"
  26 #include "mlme.h"
  27
  28
  29 /* Timeouts and intervals in milliseconds */
  30 #define IEEE80211_AUTH_TIMEOUT (200)
  31 #define IEEE80211_AUTH_MAX_TRIES 3
  32 #define IEEE80211_ASSOC_TIMEOUT (200)
  33 #define IEEE80211_ASSOC_MAX_TRIES 3
  34 #define IEEE80211_MONITORING_INTERVAL (2000)
  35 #define IEEE80211_PROBE_INTERVAL (60000)
  36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  37 #define IEEE80211_SCAN_INTERVAL (2000)
  38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  40
  41 #define IEEE80211_PROBE_DELAY (33)
  42 #define IEEE80211_CHANNEL_TIME (33)
  43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  47
  48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  49
  50
  51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  52
  53
  54 struct ieee80211_sta_bss {
  55         struct ieee80211_sta_bss *next;
  56         struct ieee80211_sta_bss *hnext;
  57
  58         u8 bssid[ETH_ALEN];
  59         u8 ssid[MAX_SSID_LEN];
  60         size_t ssid_len;
  61         u16 capability; /* host byte order */
  62         int hw_mode;
  63         int channel;
  64         int freq;
  65         int rssi;
  66         u8 *ie;
  67         size_t ie_len;
  68         u8 *wpa_ie;
  69         size_t wpa_ie_len;
  70         u8 *rsn_ie;
  71         size_t rsn_ie_len;
  72         u8 *wmm_ie;
  73         size_t wmm_ie_len;
  74         u8 *mdie;
  75         size_t mdie_len;
  76 #define IEEE80211_MAX_SUPP_RATES 32
  77         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  78         size_t supp_rates_len;
  79         int beacon_int;
  80         u64 timestamp;
  81
  82         int probe_resp;
  83         struct os_time last_update;
  84 };
  85
  86
  87 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  88                                      const u8 *dst,
  89                                      const u8 *ssid, size_t ssid_len);
  90 static struct ieee80211_sta_bss *
  91 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  92 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  93 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  94 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  95 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  96
  97
  98 /* Parsed Information Elements */
  99 struct ieee802_11_elems {
 100         u8 *ssid;
 101         u8 ssid_len;
 102         u8 *supp_rates;
 103         u8 supp_rates_len;
 104         u8 *fh_params;
 105         u8 fh_params_len;
 106         u8 *ds_params;
 107         u8 ds_params_len;
 108         u8 *cf_params;
 109         u8 cf_params_len;
 110         u8 *tim;
 111         u8 tim_len;
 112         u8 *ibss_params;
 113         u8 ibss_params_len;
 114         u8 *challenge;
 115         u8 challenge_len;
 116         u8 *wpa;
 117         u8 wpa_len;
 118         u8 *rsn;
 119         u8 rsn_len;
 120         u8 *erp_info;
 121         u8 erp_info_len;
 122         u8 *ext_supp_rates;
 123         u8 ext_supp_rates_len;
 124         u8 *wmm_info;
 125         u8 wmm_info_len;
 126         u8 *wmm_param;
 127         u8 wmm_param_len;
 128         u8 *mdie;
 129         u8 mdie_len;
 130         u8 *ftie;
 131         u8 ftie_len;
 132         u8 *assoc_comeback;
 133         u8 assoc_comeback_len;
 134 };
 135
 136 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
 137
 138
 139 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 140                                        struct ieee802_11_elems *elems)
 141 {
 142         size_t left = len;
 143         u8 *pos = start;
 144         int unknown = 0;
 145
 146         os_memset(elems, 0, sizeof(*elems));
 147
 148         while (left >= 2) {
 149                 u8 id, elen;
 150
 151                 id = *pos++;
 152                 elen = *pos++;
 153                 left -= 2;
 154
 155                 if (elen > left) {
 156 #if 0
 157                         wpa_printf(MSG_MSGDUMP, "MLME: IEEE 802.11 element "
 158                                    "parse failed (id=%d elen=%d left=%d)",
 159                                    id, elen, left);
 160 #endif
 161                         return ParseFailed;
 162                 }
 163
 164                 switch (id) {
 165                 case WLAN_EID_SSID:
 166                         elems->ssid = pos;
 167                         elems->ssid_len = elen;
 168                         break;
 169                 case WLAN_EID_SUPP_RATES:
 170                         elems->supp_rates = pos;
 171                         elems->supp_rates_len = elen;
 172                         break;
 173                 case WLAN_EID_FH_PARAMS:
 174                         elems->fh_params = pos;
 175                         elems->fh_params_len = elen;
 176                         break;
 177                 case WLAN_EID_DS_PARAMS:
 178                         elems->ds_params = pos;
 179                         elems->ds_params_len = elen;
 180                         break;
 181                 case WLAN_EID_CF_PARAMS:
 182                         elems->cf_params = pos;
 183                         elems->cf_params_len = elen;
 184                         break;
 185                 case WLAN_EID_TIM:
 186                         elems->tim = pos;
 187                         elems->tim_len = elen;
 188                         break;
 189                 case WLAN_EID_IBSS_PARAMS:
 190                         elems->ibss_params = pos;
 191                         elems->ibss_params_len = elen;
 192                         break;
 193                 case WLAN_EID_CHALLENGE:
 194                         elems->challenge = pos;
 195                         elems->challenge_len = elen;
 196                         break;
 197                 case WLAN_EID_VENDOR_SPECIFIC:
 198                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 199                             pos[2] == 0xf2) {
 200                                 /* Microsoft OUI (00:50:F2) */
 201                                 if (pos[3] == 1) {
 202                                         /* OUI Type 1 - WPA IE */
 203                                         elems->wpa = pos;
 204                                         elems->wpa_len = elen;
 205                                 } else if (elen >= 5 && pos[3] == 2) {
 206                                         if (pos[4] == 0) {
 207                                                 elems->wmm_info = pos;
 208                                                 elems->wmm_info_len = elen;
 209                                         } else if (pos[4] == 1) {
 210                                                 elems->wmm_param = pos;
 211                                                 elems->wmm_param_len = elen;
 212                                         }
 213                                 }
 214                         }
 215                         break;
 216                 case WLAN_EID_RSN:
 217                         elems->rsn = pos;
 218                         elems->rsn_len = elen;
 219                         break;
 220                 case WLAN_EID_ERP_INFO:
 221                         elems->erp_info = pos;
 222                         elems->erp_info_len = elen;
 223                         break;
 224                 case WLAN_EID_EXT_SUPP_RATES:
 225                         elems->ext_supp_rates = pos;
 226                         elems->ext_supp_rates_len = elen;
 227                         break;
 228                 case WLAN_EID_MOBILITY_DOMAIN:
 229                         elems->mdie = pos;
 230                         elems->mdie_len = elen;
 231                         break;
 232                 case WLAN_EID_FAST_BSS_TRANSITION:
 233                         elems->ftie = pos;
 234                         elems->ftie_len = elen;
 235                         break;
 236                 case WLAN_EID_ASSOC_COMEBACK_TIME:
 237                         elems->assoc_comeback = pos;
 238                         elems->assoc_comeback_len = elen;
 239                         break;
 240                 default:
 241 #if 0
 242                         wpa_printf(MSG_MSGDUMP "MLME: IEEE 802.11 element "
 243                                    "parse ignored unknown element (id=%d "
 244                                    "elen=%d)", id, elen);
 245 #endif
 246                         unknown++;
 247                         break;
 248                 }
 249
 250                 left -= elen;
 251                 pos += elen;
 252         }
 253
 254         if (left)
 255                 return ParseFailed;
 256
 257         return unknown ? ParseUnknown : ParseOK;
 258 }
 259
 260
 261 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 262                                      wpa_hw_mode phymode, int chan,
 263                                      int freq)
 264 {
 265         size_t i;
 266         struct wpa_hw_modes *mode;
 267
 268         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 269                 mode = &wpa_s->mlme.modes[i];
 270                 if (mode->mode == phymode) {
 271                         wpa_s->mlme.curr_rates = mode->rates;
 272                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 273                         break;
 274                 }
 275         }
 276
 277         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 278 }
 279
 280
 281
 282 #if 0 /* FIX */
 283 static int ecw2cw(int ecw)
 284 {
 285         int cw = 1;
 286         while (ecw > 0) {
 287                 cw <<= 1;
 288                 ecw--;
 289         }
 290         return cw - 1;
 291 }
 292 #endif
 293
 294
 295 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 296                                      u8 *wmm_param, size_t wmm_param_len)
 297 {
 298         size_t left;
 299         int count;
 300         u8 *pos;
 301
 302         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 303                 return;
 304         count = wmm_param[6] & 0x0f;
 305         if (count == wpa_s->mlme.wmm_last_param_set)
 306                 return;
 307         wpa_s->mlme.wmm_last_param_set = count;
 308
 309         pos = wmm_param + 8;
 310         left = wmm_param_len - 8;
 311
 312 #if 0 /* FIX */
 313         wmm_acm = 0;
 314         for (; left >= 4; left -= 4, pos += 4) {
 315                 int aci = (pos[0] >> 5) & 0x03;
 316                 int acm = (pos[0] >> 4) & 0x01;
 317                 int queue;
 318
 319                 switch (aci) {
 320                 case 1:
 321                         queue = IEEE80211_TX_QUEUE_DATA3;
 322                         if (acm)
 323                                 wmm_acm |= BIT(1) | BIT(2);
 324                         break;
 325                 case 2:
 326                         queue = IEEE80211_TX_QUEUE_DATA1;
 327                         if (acm)
 328                                 wmm_acm |= BIT(4) | BIT(5);
 329                         break;
 330                 case 3:
 331                         queue = IEEE80211_TX_QUEUE_DATA0;
 332                         if (acm)
 333                                 wmm_acm |= BIT(6) | BIT(7);
 334                         break;
 335                 case 0:
 336                 default:
 337                         queue = IEEE80211_TX_QUEUE_DATA2;
 338                         if (acm)
 339                                 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
 340                         break;
 341                 }
 342
 343                 params.aifs = pos[0] & 0x0f;
 344                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 345                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 346                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 347                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 348                 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
 349                            "aifs=%d cWmin=%d cWmax=%d burst=%d",
 350                            queue, aci, acm, params.aifs, params.cw_min,
 351                            params.cw_max, params.burst_time);
 352                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 353                  * AC for now) */
 354                 if (local->hw->conf_tx(local->mdev, queue, &params)) {
 355                         wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
 356                                    "parameters for queue %d", queue);
 357                 }
 358         }
 359 #endif
 360 }
 361
 362
 363 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 364 {
 365         if (wpa_s->mlme.associated == assoc && !assoc)
 366                 return;
 367
 368         wpa_s->mlme.associated = assoc;
 369
 370         if (assoc) {
 371                 union wpa_event_data data;
 372                 os_memset(&data, 0, sizeof(data));
 373                 wpa_s->mlme.prev_bssid_set = 1;
 374                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 375                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 376                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 377                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 378                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 379                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 380         } else {
 381                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 382         }
 383         os_get_time(&wpa_s->mlme.last_probe);
 384 }
 385
 386
 387 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 388                             size_t len)
 389 {
 390         return wpa_drv_send_mlme(wpa_s, buf, len);
 391 }
 392
 393
 394 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 395                                 int transaction, u8 *extra, size_t extra_len,
 396                                 int encrypt)
 397 {
 398         u8 *buf;
 399         size_t len;
 400         struct ieee80211_mgmt *mgmt;
 401
 402         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 403         if (buf == NULL) {
 404                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 405                            "auth frame");
 406                 return;
 407         }
 408
 409         mgmt = (struct ieee80211_mgmt *) buf;
 410         len = 24 + 6;
 411         os_memset(mgmt, 0, 24 + 6);
 412         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 413                                            WLAN_FC_STYPE_AUTH);
 414         if (encrypt)
 415                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 416         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 417         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 418         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 419         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 420         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 421         wpa_s->mlme.auth_transaction = transaction + 1;
 422         mgmt->u.auth.status_code = host_to_le16(0);
 423         if (extra) {
 424                 os_memcpy(buf + len, extra, extra_len);
 425                 len += extra_len;
 426         }
 427
 428         ieee80211_sta_tx(wpa_s, buf, len);
 429         os_free(buf);
 430 }
 431
 432
 433 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 434 {
 435         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 436         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 437                                ieee80211_sta_timer, wpa_s, NULL);
 438 }
 439
 440
 441 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 442 {
 443         u8 *extra;
 444         size_t extra_len;
 445
 446         wpa_s->mlme.auth_tries++;
 447         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 448                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 449                            " timed out", MAC2STR(wpa_s->bssid));
 450                 return;
 451         }
 452
 453         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 454         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 455                    MAC2STR(wpa_s->bssid));
 456
 457         extra = NULL;
 458         extra_len = 0;
 459
 460 #ifdef CONFIG_IEEE80211R
 461         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 462              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 463             wpa_s->mlme.ft_ies) {
 464                 struct ieee80211_sta_bss *bss;
 465                 struct rsn_mdie *mdie = NULL;
 466                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 467                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 468                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 469                 if (mdie &&
 470                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 471                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 472                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 473                                    "over-the-air");
 474                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 475                         extra = wpa_s->mlme.ft_ies;
 476                         extra_len = wpa_s->mlme.ft_ies_len;
 477                 }
 478         }
 479 #endif /* CONFIG_IEEE80211R */
 480
 481         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 482
 483         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 484 }
 485
 486
 487 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 488 {
 489         struct ieee80211_mgmt *mgmt;
 490         u8 *pos, *ies, *buf;
 491         int i, len;
 492         u16 capab;
 493         struct ieee80211_sta_bss *bss;
 494         int wmm = 0;
 495         size_t blen, buflen;
 496
 497         if (wpa_s->mlme.curr_rates == NULL) {
 498                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 499                 return;
 500         }
 501
 502         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 503                 wpa_s->mlme.ssid_len;
 504 #ifdef CONFIG_IEEE80211R
 505         if (wpa_s->mlme.ft_ies)
 506                 buflen += wpa_s->mlme.ft_ies_len;
 507 #endif /* CONFIG_IEEE80211R */
 508         buf = os_malloc(buflen);
 509         if (buf == NULL) {
 510                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 511                            "assoc frame");
 512                 return;
 513         }
 514         blen = 0;
 515
 516         capab = wpa_s->mlme.capab;
 517         if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
 518                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 519                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 520         }
 521         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 522         if (bss) {
 523                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 524                         capab |= WLAN_CAPABILITY_PRIVACY;
 525                 if (bss->wmm_ie) {
 526                         wmm = 1;
 527                 }
 528         }
 529
 530         mgmt = (struct ieee80211_mgmt *) buf;
 531         blen += 24;
 532         os_memset(mgmt, 0, 24);
 533         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 534         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 535         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 536
 537         if (wpa_s->mlme.prev_bssid_set) {
 538                 blen += 10;
 539                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 540                                                    WLAN_FC_STYPE_REASSOC_REQ);
 541                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 542                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 543                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 544                           wpa_s->mlme.prev_bssid,
 545                           ETH_ALEN);
 546         } else {
 547                 blen += 4;
 548                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 549                                                    WLAN_FC_STYPE_ASSOC_REQ);
 550                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 551                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 552         }
 553
 554         /* SSID */
 555         ies = pos = buf + blen;
 556         blen += 2 + wpa_s->mlme.ssid_len;
 557         *pos++ = WLAN_EID_SSID;
 558         *pos++ = wpa_s->mlme.ssid_len;
 559         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 560
 561         len = wpa_s->mlme.num_curr_rates;
 562         if (len > 8)
 563                 len = 8;
 564         pos = buf + blen;
 565         blen += len + 2;
 566         *pos++ = WLAN_EID_SUPP_RATES;
 567         *pos++ = len;
 568         for (i = 0; i < len; i++) {
 569                 int rate = wpa_s->mlme.curr_rates[i].rate;
 570                 *pos++ = (u8) (rate / 5);
 571         }
 572
 573         if (wpa_s->mlme.num_curr_rates > len) {
 574                 pos = buf + blen;
 575                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 576                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 577                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 578                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 579                         int rate = wpa_s->mlme.curr_rates[i].rate;
 580                         *pos++ = (u8) (rate / 5);
 581                 }
 582         }
 583
 584         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 585                 pos = buf + blen;
 586                 blen += wpa_s->mlme.extra_ie_len;
 587                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 588         }
 589
 590 #ifdef CONFIG_IEEE80211R
 591         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 592              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 593             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 594             bss && bss->mdie &&
 595             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 596             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 597                 pos = buf + blen;
 598                 blen += 2 + sizeof(struct rsn_mdie);
 599                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 600                 *pos++ = sizeof(struct rsn_mdie);
 601                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 602                 pos += MOBILITY_DOMAIN_ID_LEN;
 603                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 604         }
 605
 606         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 607              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 608             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 609                 pos = buf + blen;
 610                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 611                 pos += wpa_s->mlme.ft_ies_len;
 612                 blen += wpa_s->mlme.ft_ies_len;
 613         }
 614 #endif /* CONFIG_IEEE80211R */
 615
 616         if (wmm && wpa_s->mlme.wmm_enabled) {
 617                 pos = buf + blen;
 618                 blen += 9;
 619                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 620                 *pos++ = 7; /* len */
 621                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 622                 *pos++ = 0x50;
 623                 *pos++ = 0xf2;
 624                 *pos++ = 2; /* WME */
 625                 *pos++ = 0; /* WME info */
 626                 *pos++ = 1; /* WME ver */
 627                 *pos++ = 0;
 628         }
 629
 630         os_free(wpa_s->mlme.assocreq_ies);
 631         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 632         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 633         if (wpa_s->mlme.assocreq_ies) {
 634                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 635                           wpa_s->mlme.assocreq_ies_len);
 636         }
 637
 638         ieee80211_sta_tx(wpa_s, buf, blen);
 639         os_free(buf);
 640 }
 641
 642
 643 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 644 {
 645         u8 *buf;
 646         size_t len;
 647         struct ieee80211_mgmt *mgmt;
 648
 649         buf = os_zalloc(sizeof(*mgmt));
 650         if (buf == NULL) {
 651                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 652                            "deauth frame");
 653                 return;
 654         }
 655
 656         mgmt = (struct ieee80211_mgmt *) buf;
 657         len = 24;
 658         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 659         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 660         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 661         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 662                                            WLAN_FC_STYPE_DEAUTH);
 663         len += 2;
 664         mgmt->u.deauth.reason_code = host_to_le16(reason);
 665
 666         ieee80211_sta_tx(wpa_s, buf, len);
 667         os_free(buf);
 668 }
 669
 670
 671 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 672 {
 673         u8 *buf;
 674         size_t len;
 675         struct ieee80211_mgmt *mgmt;
 676
 677         buf = os_zalloc(sizeof(*mgmt));
 678         if (buf == NULL) {
 679                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 680                            "disassoc frame");
 681                 return;
 682         }
 683
 684         mgmt = (struct ieee80211_mgmt *) buf;
 685         len = 24;
 686         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 687         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 688         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 689         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 690                                            WLAN_FC_STYPE_DISASSOC);
 691         len += 2;
 692         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 693
 694         ieee80211_sta_tx(wpa_s, buf, len);
 695         os_free(buf);
 696 }
 697
 698
 699 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 700 {
 701         struct ieee80211_sta_bss *bss;
 702         int res = 0;
 703
 704         if (wpa_s->mlme.mixed_cell ||
 705             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 706                 return 0;
 707
 708         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 709         if (bss == NULL)
 710                 return 0;
 711
 712         if (ieee80211_sta_wep_configured(wpa_s) !=
 713             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 714                 res = 1;
 715
 716         return res;
 717 }
 718
 719
 720 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 721 {
 722         wpa_s->mlme.assoc_tries++;
 723         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 724                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 725                            " timed out", MAC2STR(wpa_s->bssid));
 726                 return;
 727         }
 728
 729         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 730         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 731                    MAC2STR(wpa_s->bssid));
 732         if (ieee80211_privacy_mismatch(wpa_s)) {
 733                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 734                            "configuration and mixed-cell disabled - abort "
 735                            "association");
 736                 return;
 737         }
 738
 739         ieee80211_send_assoc(wpa_s);
 740
 741         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 742 }
 743
 744
 745 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 746 {
 747         int disassoc;
 748
 749         /* TODO: start monitoring current AP signal quality and number of
 750          * missed beacons. Scan other channels every now and then and search
 751          * for better APs. */
 752         /* TODO: remove expired BSSes */
 753
 754         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 755
 756 #if 0 /* FIX */
 757         sta = sta_info_get(local, wpa_s->bssid);
 758         if (sta == NULL) {
 759                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 760                            MAC2STR(wpa_s->bssid));
 761                 disassoc = 1;
 762         } else {
 763                 disassoc = 0;
 764                 if (time_after(jiffies,
 765                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 766                         if (wpa_s->mlme.probereq_poll) {
 767                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 768                                            "current AP " MACSTR " - assume "
 769                                            "out of range",
 770                                            MAC2STR(wpa_s->bssid));
 771                                 disassoc = 1;
 772                         } else {
 773                                 ieee80211_send_probe_req(
 774                                         wpa_s->bssid,
 775                                         wpa_s->mlme.scan_ssid,
 776                                         wpa_s->mlme.scan_ssid_len);
 777                                 wpa_s->mlme.probereq_poll = 1;
 778                         }
 779                 } else {
 780                         wpa_s->mlme.probereq_poll = 0;
 781                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 782                                        IEEE80211_PROBE_INTERVAL)) {
 783                                 wpa_s->mlme.last_probe = jiffies;
 784                                 ieee80211_send_probe_req(wpa_s->bssid,
 785                                                          wpa_s->mlme.ssid,
 786                                                          wpa_s->mlme.ssid_len);
 787                         }
 788                 }
 789                 sta_info_release(local, sta);
 790         }
 791 #else
 792         disassoc = 0;
 793 #endif
 794         if (disassoc) {
 795                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 796                 ieee80211_reschedule_timer(wpa_s,
 797                                            IEEE80211_MONITORING_INTERVAL +
 798                                            30000);
 799         } else {
 800                 ieee80211_reschedule_timer(wpa_s,
 801                                            IEEE80211_MONITORING_INTERVAL);
 802         }
 803 }
 804
 805
 806 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 807                                      const u8 *dst,
 808                                      const u8 *ssid, size_t ssid_len)
 809 {
 810         u8 *buf;
 811         size_t len;
 812         struct ieee80211_mgmt *mgmt;
 813         u8 *pos, *supp_rates;
 814         u8 *esupp_rates = NULL;
 815         int i;
 816
 817         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 818         if (buf == NULL) {
 819                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 820                            "probe request");
 821                 return;
 822         }
 823
 824         mgmt = (struct ieee80211_mgmt *) buf;
 825         len = 24;
 826         os_memset(mgmt, 0, 24);
 827         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 828                                            WLAN_FC_STYPE_PROBE_REQ);
 829         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 830         if (dst) {
 831                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 832                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 833         } else {
 834                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 835                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 836         }
 837         pos = buf + len;
 838         len += 2 + ssid_len;
 839         *pos++ = WLAN_EID_SSID;
 840         *pos++ = ssid_len;
 841         os_memcpy(pos, ssid, ssid_len);
 842
 843         supp_rates = buf + len;
 844         len += 2;
 845         supp_rates[0] = WLAN_EID_SUPP_RATES;
 846         supp_rates[1] = 0;
 847         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 848                 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 849                 if (esupp_rates) {
 850                         pos = buf + len;
 851                         len++;
 852                         esupp_rates[1]++;
 853                 } else if (supp_rates[1] == 8) {
 854                         esupp_rates = pos;
 855                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 856                         esupp_rates[1] = 1;
 857                         pos = &esupp_rates[2];
 858                         len += 3;
 859                 } else {
 860                         pos = buf + len;
 861                         len++;
 862                         supp_rates[1]++;
 863                 }
 864                 *pos++ = rate->rate / 5;
 865         }
 866
 867         if (wpa_s->mlme.extra_probe_ie) {
 868                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 869                           wpa_s->mlme.extra_probe_ie_len);
 870                 len += wpa_s->mlme.extra_probe_ie_len;
 871         }
 872
 873         ieee80211_sta_tx(wpa_s, buf, len);
 874         os_free(buf);
 875 }
 876
 877
 878 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 879 {
 880 #if 0 /* FIX */
 881         if (sdata == NULL || sdata->default_key == NULL ||
 882             sdata->default_key->alg != ALG_WEP)
 883                 return 0;
 884         return 1;
 885 #else
 886         return 0;
 887 #endif
 888 }
 889
 890
 891 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 892 {
 893         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 894         wpa_s->mlme.authenticated = 1;
 895         ieee80211_associate(wpa_s);
 896 }
 897
 898
 899 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 900                                      struct ieee80211_mgmt *mgmt,
 901                                      size_t len,
 902                                      struct ieee80211_rx_status *rx_status)
 903 {
 904         u8 *pos;
 905         struct ieee802_11_elems elems;
 906
 907         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 908         pos = mgmt->u.auth.variable;
 909         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 910             == ParseFailed) {
 911                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 912                 return;
 913         }
 914         if (elems.challenge == NULL) {
 915                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 916                            "auth frame");
 917                 return;
 918         }
 919         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 920                             elems.challenge_len + 2, 1);
 921 }
 922
 923
 924 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 925                                    struct ieee80211_mgmt *mgmt,
 926                                    size_t len,
 927                                    struct ieee80211_rx_status *rx_status)
 928 {
 929         struct wpa_ssid *ssid = wpa_s->current_ssid;
 930         u16 auth_alg, auth_transaction, status_code;
 931         int adhoc;
 932
 933         adhoc = ssid && ssid->mode == 1;
 934
 935         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 936                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 937                            "from " MACSTR ", but not in authenticate state - "
 938                            "ignored", MAC2STR(mgmt->sa));
 939                 return;
 940         }
 941
 942         if (len < 24 + 6) {
 943                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 944                            "frame received from " MACSTR " - ignored",
 945                            (unsigned long) len, MAC2STR(mgmt->sa));
 946                 return;
 947         }
 948
 949         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 950                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 951                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 952                            ") - ignored",
 953                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 954                 return;
 955         }
 956
 957         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 958                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 959                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 960                            ") - ignored",
 961                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 962                 return;
 963         }
 964
 965         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 966         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 967         status_code = le_to_host16(mgmt->u.auth.status_code);
 968
 969         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 970                    " (alg=%d transaction=%d status=%d)",
 971                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 972
 973         if (adhoc) {
 974                 /* IEEE 802.11 standard does not require authentication in IBSS
 975                  * networks and most implementations do not seem to use it.
 976                  * However, try to reply to authentication attempts if someone
 977                  * has actually implemented this.
 978                  * TODO: Could implement shared key authentication. */
 979                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 980                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 981                                    "authentication frame (alg=%d "
 982                                    "transaction=%d)",
 983                                    auth_alg, auth_transaction);
 984                         return;
 985                 }
 986                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 987         }
 988
 989         if (auth_alg != wpa_s->mlme.auth_alg ||
 990             auth_transaction != wpa_s->mlme.auth_transaction) {
 991                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 992                            "(alg=%d transaction=%d)",
 993                            auth_alg, auth_transaction);
 994                 return;
 995         }
 996
 997         if (status_code != WLAN_STATUS_SUCCESS) {
 998                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 999                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
1000                            status_code);
1001                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1002                         const int num_algs = 3;
1003                         u8 algs[num_algs];
1004                         int i, pos;
1005                         algs[0] = algs[1] = algs[2] = 0xff;
1006                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1007                                 algs[0] = WLAN_AUTH_OPEN;
1008                         if (wpa_s->mlme.auth_algs &
1009                             IEEE80211_AUTH_ALG_SHARED_KEY)
1010                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1011                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
1012                                 algs[2] = WLAN_AUTH_LEAP;
1013                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
1014                                 pos = 0;
1015                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
1016                                 pos = 1;
1017                         else
1018                                 pos = 2;
1019                         for (i = 0; i < num_algs; i++) {
1020                                 pos++;
1021                                 if (pos >= num_algs)
1022                                         pos = 0;
1023                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
1024                                     algs[pos] == 0xff)
1025                                         continue;
1026                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1027                                     !ieee80211_sta_wep_configured(wpa_s))
1028                                         continue;
1029                                 wpa_s->mlme.auth_alg = algs[pos];
1030                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
1031                                            "for next try",
1032                                            wpa_s->mlme.auth_alg);
1033                                 break;
1034                         }
1035                 }
1036                 return;
1037         }
1038
1039         switch (wpa_s->mlme.auth_alg) {
1040         case WLAN_AUTH_OPEN:
1041         case WLAN_AUTH_LEAP:
1042                 ieee80211_auth_completed(wpa_s);
1043                 break;
1044         case WLAN_AUTH_SHARED_KEY:
1045                 if (wpa_s->mlme.auth_transaction == 4)
1046                         ieee80211_auth_completed(wpa_s);
1047                 else
1048                         ieee80211_auth_challenge(wpa_s, mgmt, len,
1049                                                  rx_status);
1050                 break;
1051 #ifdef CONFIG_IEEE80211R
1052         case WLAN_AUTH_FT:
1053         {
1054                 union wpa_event_data data;
1055                 os_memset(&data, 0, sizeof(data));
1056                 data.ft_ies.ies = mgmt->u.auth.variable;
1057                 data.ft_ies.ies_len = len -
1058                         (mgmt->u.auth.variable - (u8 *) mgmt);
1059                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
1060                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1061                 ieee80211_auth_completed(wpa_s);
1062                 break;
1063         }
1064 #endif /* CONFIG_IEEE80211R */
1065         }
1066 }
1067
1068
1069 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
1070                                      struct ieee80211_mgmt *mgmt,
1071                                      size_t len,
1072                                      struct ieee80211_rx_status *rx_status)
1073 {
1074         u16 reason_code;
1075
1076         if (len < 24 + 2) {
1077                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
1078                            "frame received from " MACSTR " - ignored",
1079                            (unsigned long) len, MAC2STR(mgmt->sa));
1080                 return;
1081         }
1082
1083         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1084                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
1085                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1086                            ") - ignored",
1087                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1088                 return;
1089         }
1090
1091         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1092
1093         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
1094                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1095
1096         if (wpa_s->mlme.authenticated)
1097                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
1098
1099         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
1100             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
1101             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1102                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
1103                 ieee80211_reschedule_timer(wpa_s,
1104                                            IEEE80211_RETRY_AUTH_INTERVAL);
1105         }
1106
1107         ieee80211_set_associated(wpa_s, 0);
1108         wpa_s->mlme.authenticated = 0;
1109 }
1110
1111
1112 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
1113                                        struct ieee80211_mgmt *mgmt,
1114                                        size_t len,
1115                                        struct ieee80211_rx_status *rx_status)
1116 {
1117         u16 reason_code;
1118
1119         if (len < 24 + 2) {
1120                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
1121                            "frame received from " MACSTR " - ignored",
1122                            (unsigned long) len, MAC2STR(mgmt->sa));
1123                 return;
1124         }
1125
1126         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1127                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
1128                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1129                            ") - ignored",
1130                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1131                 return;
1132         }
1133
1134         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
1135
1136         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
1137                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1138
1139         if (wpa_s->mlme.associated)
1140                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
1141
1142         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1143                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
1144                 ieee80211_reschedule_timer(wpa_s,
1145                                            IEEE80211_RETRY_AUTH_INTERVAL);
1146         }
1147
1148         ieee80211_set_associated(wpa_s, 0);
1149 }
1150
1151
1152 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1153                                    struct ieee802_11_elems *elems)
1154 {
1155 #ifdef CONFIG_IEEE80211R
1156         const u8 *mobility_domain = NULL;
1157         const u8 *r0kh_id = NULL;
1158         size_t r0kh_id_len = 0;
1159         const u8 *r1kh_id = NULL;
1160         struct rsn_ftie *hdr;
1161         const u8 *pos, *end;
1162
1163         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1164                 mobility_domain = elems->mdie;
1165         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1166                 end = elems->ftie + elems->ftie_len;
1167                 hdr = (struct rsn_ftie *) elems->ftie;
1168                 pos = (const u8 *) (hdr + 1);
1169                 while (pos + 1 < end) {
1170                         if (pos + 2 + pos[1] > end)
1171                                 break;
1172                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1173                             pos[1] == FT_R1KH_ID_LEN)
1174                                 r1kh_id = pos + 2;
1175                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1176                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1177                                 r0kh_id = pos + 2;
1178                                 r0kh_id_len = pos[1];
1179                         }
1180                         pos += 2 + pos[1];
1181                 }
1182         }
1183         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1184                                     r0kh_id_len, r1kh_id);
1185 #else /* CONFIG_IEEE80211R */
1186         return 0;
1187 #endif /* CONFIG_IEEE80211R */
1188 }
1189
1190
1191 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1192                                          struct ieee80211_mgmt *mgmt,
1193                                          size_t len,
1194                                          struct ieee80211_rx_status *rx_status,
1195                                          int reassoc)
1196 {
1197         u8 rates[32];
1198         size_t rates_len;
1199         u16 capab_info, status_code, aid;
1200         struct ieee802_11_elems elems;
1201         u8 *pos;
1202
1203         /* AssocResp and ReassocResp have identical structure, so process both
1204          * of them in this function. */
1205
1206         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1207                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1208                            MACSTR ", but not in associate state - ignored",
1209                            MAC2STR(mgmt->sa));
1210                 return;
1211         }
1212
1213         if (len < 24 + 6) {
1214                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1215                            "frame received from " MACSTR " - ignored",
1216                            (unsigned long) len, MAC2STR(mgmt->sa));
1217                 return;
1218         }
1219
1220         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1221                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1222                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1223                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1224                 return;
1225         }
1226
1227         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1228         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1229         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1230         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1231                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1232                            "not set", aid);
1233         aid &= ~(BIT(15) | BIT(14));
1234
1235         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1236                    " (capab=0x%x status=%d aid=%d)",
1237                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1238                    capab_info, status_code, aid);
1239
1240         pos = mgmt->u.assoc_resp.variable;
1241         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1242             == ParseFailed) {
1243                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1244                 return;
1245         }
1246
1247         if (status_code != WLAN_STATUS_SUCCESS) {
1248                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1249                            status_code);
1250 #ifdef CONFIG_IEEE80211W
1251                 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1252                     elems.assoc_comeback && elems.assoc_comeback_len == 4) {
1253                         u32 tu, ms;
1254                         tu = WPA_GET_LE32(elems.assoc_comeback);
1255                         ms = tu * 1024 / 1000;
1256                         wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1257                                    "temporarily; comeback duration %u TU "
1258                                    "(%u ms)", tu, ms);
1259                         if (ms > IEEE80211_ASSOC_TIMEOUT) {
1260                                 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1261                                            "based on comeback duration");
1262                                 ieee80211_reschedule_timer(wpa_s, ms);
1263                         }
1264                 }
1265 #endif /* CONFIG_IEEE80211W */
1266                 return;
1267         }
1268
1269         if (elems.supp_rates == NULL) {
1270                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1271                            "AssocResp");
1272                 return;
1273         }
1274
1275         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1276                 if (!reassoc) {
1277                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1278                                    "association, not reassociation, response "
1279                                    "with FT");
1280                         return;
1281                 }
1282                 if (wpa_ft_validate_reassoc_resp(
1283                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1284                             mgmt->sa) < 0) {
1285                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1286                                    "Resp failed");
1287                         return;
1288                 }
1289         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1290                 return;
1291
1292         wpa_printf(MSG_DEBUG, "MLME: associated");
1293         wpa_s->mlme.aid = aid;
1294         wpa_s->mlme.ap_capab = capab_info;
1295
1296         os_free(wpa_s->mlme.assocresp_ies);
1297         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1298         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1299         if (wpa_s->mlme.assocresp_ies) {
1300                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1301                           wpa_s->mlme.assocresp_ies_len);
1302         }
1303
1304         ieee80211_set_associated(wpa_s, 1);
1305
1306         rates_len = elems.supp_rates_len;
1307         if (rates_len > sizeof(rates))
1308                 rates_len = sizeof(rates);
1309         os_memcpy(rates, elems.supp_rates, rates_len);
1310         if (elems.ext_supp_rates) {
1311                 size_t _len = elems.ext_supp_rates_len;
1312                 if (_len > sizeof(rates) - rates_len)
1313                         _len = sizeof(rates) - rates_len;
1314                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1315                 rates_len += _len;
1316         }
1317
1318         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1319                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1320                            "netstack");
1321         }
1322         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1323             0) {
1324                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1325                            "netstack");
1326         }
1327
1328         /* Remove STA entry before adding a new one just in case to avoid
1329          * problems with existing configuration (e.g., keys). */
1330         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1331         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1332                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1333                            "netstack");
1334         }
1335
1336 #if 0 /* FIX? */
1337         sta->assoc_ap = 1;
1338
1339         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1340                 sta->flags |= WLAN_STA_WME;
1341                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1342                                          elems.wmm_param_len);
1343         }
1344 #endif
1345
1346         ieee80211_associated(wpa_s);
1347 }
1348
1349
1350 /* Caller must hold local->sta_bss_lock */
1351 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1352                                      struct ieee80211_sta_bss *bss)
1353 {
1354         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1355         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1356 }
1357
1358
1359 /* Caller must hold local->sta_bss_lock */
1360 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1361                                      struct ieee80211_sta_bss *bss)
1362 {
1363         struct ieee80211_sta_bss *b, *prev = NULL;
1364         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1365         while (b) {
1366                 if (b == bss) {
1367                         if (prev == NULL) {
1368                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1369                                         = bss->hnext;
1370                         } else {
1371                                 prev->hnext = bss->hnext;
1372                         }
1373                         break;
1374                 }
1375                 prev = b;
1376                 b = b->hnext;
1377         }
1378 }
1379
1380
1381 static struct ieee80211_sta_bss *
1382 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1383 {
1384         struct ieee80211_sta_bss *bss;
1385
1386         bss = os_zalloc(sizeof(*bss));
1387         if (bss == NULL)
1388                 return NULL;
1389         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1390
1391         /* TODO: order by RSSI? */
1392         bss->next = wpa_s->mlme.sta_bss_list;
1393         wpa_s->mlme.sta_bss_list = bss;
1394         __ieee80211_bss_hash_add(wpa_s, bss);
1395         return bss;
1396 }
1397
1398
1399 static struct ieee80211_sta_bss *
1400 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1401 {
1402         struct ieee80211_sta_bss *bss;
1403
1404         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1405         while (bss) {
1406                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1407                         break;
1408                 bss = bss->hnext;
1409         }
1410         return bss;
1411 }
1412
1413
1414 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1415                                struct ieee80211_sta_bss *bss)
1416 {
1417         __ieee80211_bss_hash_del(wpa_s, bss);
1418         os_free(bss->ie);
1419         os_free(bss->wpa_ie);
1420         os_free(bss->rsn_ie);
1421         os_free(bss->wmm_ie);
1422         os_free(bss->mdie);
1423         os_free(bss);
1424 }
1425
1426
1427 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1428 {
1429         struct ieee80211_sta_bss *bss, *prev;
1430
1431         bss = wpa_s->mlme.sta_bss_list;
1432         wpa_s->mlme.sta_bss_list = NULL;
1433         while (bss) {
1434                 prev = bss;
1435                 bss = bss->next;
1436                 ieee80211_bss_free(wpa_s, prev);
1437         }
1438 }
1439
1440
1441 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1442                                struct ieee80211_mgmt *mgmt,
1443                                size_t len,
1444                                struct ieee80211_rx_status *rx_status,
1445                                int beacon)
1446 {
1447         struct ieee802_11_elems elems;
1448         size_t baselen;
1449         int channel, invalid = 0, clen;
1450         struct ieee80211_sta_bss *bss;
1451         u64 timestamp;
1452         u8 *pos, *ie_pos;
1453         size_t ie_len;
1454
1455         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1456                 return; /* ignore ProbeResp to foreign address */
1457
1458 #if 0
1459         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1460                    beacon ? "Beacon" : "Probe Response",
1461                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1462 #endif
1463
1464         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1465         if (baselen > len)
1466                 return;
1467
1468         pos = mgmt->u.beacon.timestamp;
1469         timestamp = WPA_GET_LE64(pos);
1470
1471 #if 0 /* FIX */
1472         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1473             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1474 #ifdef IEEE80211_IBSS_DEBUG
1475                 static unsigned long last_tsf_debug = 0;
1476                 u64 tsf;
1477                 if (local->hw->get_tsf)
1478                         tsf = local->hw->get_tsf(local->mdev);
1479                 else
1480                         tsf = -1LLU;
1481                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1482                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1483                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1484                                    "@%ld",
1485                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1486                                    tsf, timestamp, tsf - timestamp, jiffies);
1487                         last_tsf_debug = jiffies;
1488                 }
1489 #endif /* IEEE80211_IBSS_DEBUG */
1490         }
1491 #endif
1492
1493         ie_pos = mgmt->u.beacon.variable;
1494         ie_len = len - baselen;
1495         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems) == ParseFailed)
1496                 invalid = 1;
1497
1498 #if 0 /* FIX */
1499         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1500             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1501             (sta = sta_info_get(local, mgmt->sa))) {
1502                 struct ieee80211_rate *rates;
1503                 size_t num_rates;
1504                 u32 supp_rates, prev_rates;
1505                 int i, j, oper_mode;
1506
1507                 rates = local->curr_rates;
1508                 num_rates = local->num_curr_rates;
1509                 oper_mode = wpa_s->mlme.sta_scanning ?
1510                         local->scan_oper_phymode : local->conf.phymode;
1511                 for (i = 0; i < local->hw->num_modes; i++) {
1512                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1513                         if (oper_mode == mode->mode) {
1514                                 rates = mode->rates;
1515                                 num_rates = mode->num_rates;
1516                                 break;
1517                         }
1518                 }
1519
1520                 supp_rates = 0;
1521                 for (i = 0; i < elems.supp_rates_len +
1522                              elems.ext_supp_rates_len; i++) {
1523                         u8 rate = 0;
1524                         int own_rate;
1525                         if (i < elems.supp_rates_len)
1526                                 rate = elems.supp_rates[i];
1527                         else if (elems.ext_supp_rates)
1528                                 rate = elems.ext_supp_rates
1529                                         [i - elems.supp_rates_len];
1530                         own_rate = 5 * (rate & 0x7f);
1531                         if (oper_mode == MODE_ATHEROS_TURBO)
1532                                 own_rate *= 2;
1533                         for (j = 0; j < num_rates; j++)
1534                                 if (rates[j].rate == own_rate)
1535                                         supp_rates |= BIT(j);
1536                 }
1537
1538                 prev_rates = sta->supp_rates;
1539                 sta->supp_rates &= supp_rates;
1540                 if (sta->supp_rates == 0) {
1541                         /* No matching rates - this should not really happen.
1542                          * Make sure that at least one rate is marked
1543                          * supported to avoid issues with TX rate ctrl. */
1544                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1545                 }
1546                 if (sta->supp_rates != prev_rates) {
1547                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1548                                    "for " MACSTR " based on beacon info "
1549                                    "(0x%x & 0x%x -> 0x%x)",
1550                                    MAC2STR(sta->addr), prev_rates,
1551                                    supp_rates, sta->supp_rates);
1552                 }
1553                 sta_info_release(local, sta);
1554         }
1555 #endif
1556
1557         if (elems.ssid == NULL)
1558                 return;
1559
1560         if (elems.ds_params && elems.ds_params_len == 1)
1561                 channel = elems.ds_params[0];
1562         else
1563                 channel = rx_status->channel;
1564
1565         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1566         if (bss == NULL) {
1567                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1568                 if (bss == NULL)
1569                         return;
1570         } else {
1571 #if 0
1572                 /* TODO: order by RSSI? */
1573                 spin_lock_bh(&local->sta_bss_lock);
1574                 list_move_tail(&bss->list, &local->sta_bss_list);
1575                 spin_unlock_bh(&local->sta_bss_lock);
1576 #endif
1577         }
1578
1579         if (bss->probe_resp && beacon) {
1580                 /* Do not allow beacon to override data from Probe Response. */
1581                 return;
1582         }
1583
1584         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1585         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1586
1587         if (bss->ie == NULL || bss->ie_len < ie_len) {
1588                 os_free(bss->ie);
1589                 bss->ie = os_malloc(ie_len);
1590         }
1591         if (bss->ie) {
1592                 os_memcpy(bss->ie, ie_pos, ie_len);
1593                 bss->ie_len = ie_len;
1594         }
1595
1596         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1597                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1598                 bss->ssid_len = elems.ssid_len;
1599         }
1600
1601         bss->supp_rates_len = 0;
1602         if (elems.supp_rates) {
1603                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1604                 if (clen > elems.supp_rates_len)
1605                         clen = elems.supp_rates_len;
1606                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1607                           elems.supp_rates, clen);
1608                 bss->supp_rates_len += clen;
1609         }
1610         if (elems.ext_supp_rates) {
1611                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1612                 if (clen > elems.ext_supp_rates_len)
1613                         clen = elems.ext_supp_rates_len;
1614                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1615                           elems.ext_supp_rates, clen);
1616                 bss->supp_rates_len += clen;
1617         }
1618
1619         if (elems.wpa &&
1620             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1621              os_memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1622                 os_free(bss->wpa_ie);
1623                 bss->wpa_ie = os_malloc(elems.wpa_len + 2);
1624                 if (bss->wpa_ie) {
1625                         os_memcpy(bss->wpa_ie, elems.wpa - 2,
1626                                   elems.wpa_len + 2);
1627                         bss->wpa_ie_len = elems.wpa_len + 2;
1628                 } else
1629                         bss->wpa_ie_len = 0;
1630         } else if (!elems.wpa && bss->wpa_ie) {
1631                 os_free(bss->wpa_ie);
1632                 bss->wpa_ie = NULL;
1633                 bss->wpa_ie_len = 0;
1634         }
1635
1636         if (elems.rsn &&
1637             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1638              os_memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1639                 os_free(bss->rsn_ie);
1640                 bss->rsn_ie = os_malloc(elems.rsn_len + 2);
1641                 if (bss->rsn_ie) {
1642                         os_memcpy(bss->rsn_ie, elems.rsn - 2,
1643                                   elems.rsn_len + 2);
1644                         bss->rsn_ie_len = elems.rsn_len + 2;
1645                 } else
1646                         bss->rsn_ie_len = 0;
1647         } else if (!elems.rsn && bss->rsn_ie) {
1648                 os_free(bss->rsn_ie);
1649                 bss->rsn_ie = NULL;
1650                 bss->rsn_ie_len = 0;
1651         }
1652
1653         if (elems.wmm_param &&
1654             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1655              os_memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1656                 os_free(bss->wmm_ie);
1657                 bss->wmm_ie = os_malloc(elems.wmm_param_len + 2);
1658                 if (bss->wmm_ie) {
1659                         os_memcpy(bss->wmm_ie, elems.wmm_param - 2,
1660                                   elems.wmm_param_len + 2);
1661                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1662                 } else
1663                         bss->wmm_ie_len = 0;
1664         } else if (!elems.wmm_param && bss->wmm_ie) {
1665                 os_free(bss->wmm_ie);
1666                 bss->wmm_ie = NULL;
1667                 bss->wmm_ie_len = 0;
1668         }
1669
1670 #ifdef CONFIG_IEEE80211R
1671         if (elems.mdie &&
1672             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1673              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1674                 os_free(bss->mdie);
1675                 bss->mdie = os_malloc(elems.mdie_len + 2);
1676                 if (bss->mdie) {
1677                         os_memcpy(bss->mdie, elems.mdie - 2,
1678                                   elems.mdie_len + 2);
1679                         bss->mdie_len = elems.mdie_len + 2;
1680                 } else
1681                         bss->mdie_len = 0;
1682         } else if (!elems.mdie && bss->mdie) {
1683                 os_free(bss->mdie);
1684                 bss->mdie = NULL;
1685                 bss->mdie_len = 0;
1686         }
1687 #endif /* CONFIG_IEEE80211R */
1688
1689         bss->hw_mode = wpa_s->mlme.phymode;
1690         bss->channel = channel;
1691         bss->freq = wpa_s->mlme.freq;
1692         if (channel != wpa_s->mlme.channel &&
1693             (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1694              wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1695             channel >= 1 && channel <= 14) {
1696                 static const int freq_list[] = {
1697                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1698                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1699                 };
1700                 /* IEEE 802.11g/b mode can receive packets from neighboring
1701                  * channels, so map the channel into frequency. */
1702                 bss->freq = freq_list[channel - 1];
1703         }
1704         bss->timestamp = timestamp;
1705         os_get_time(&bss->last_update);
1706         bss->rssi = rx_status->ssi;
1707         if (!beacon)
1708                 bss->probe_resp++;
1709 }
1710
1711
1712 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1713                                          struct ieee80211_mgmt *mgmt,
1714                                          size_t len,
1715                                          struct ieee80211_rx_status *rx_status)
1716 {
1717         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1718 }
1719
1720
1721 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1722                                      struct ieee80211_mgmt *mgmt,
1723                                      size_t len,
1724                                      struct ieee80211_rx_status *rx_status)
1725 {
1726         int use_protection;
1727         size_t baselen;
1728         struct ieee802_11_elems elems;
1729
1730         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1731
1732         if (!wpa_s->mlme.associated ||
1733             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1734                 return;
1735
1736         /* Process beacon from the current BSS */
1737         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1738         if (baselen > len)
1739                 return;
1740
1741         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1742                                    &elems) == ParseFailed)
1743                 return;
1744
1745         use_protection = 0;
1746         if (elems.erp_info && elems.erp_info_len >= 1) {
1747                 use_protection =
1748                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1749         }
1750
1751         if (use_protection != !!wpa_s->mlme.use_protection) {
1752                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1753                            ")",
1754                            use_protection ? "enabled" : "disabled",
1755                            MAC2STR(wpa_s->bssid));
1756                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1757                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1758         }
1759
1760         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1761                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1762                                          elems.wmm_param_len);
1763         }
1764 }
1765
1766
1767 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1768                                         struct ieee80211_mgmt *mgmt,
1769                                         size_t len,
1770                                         struct ieee80211_rx_status *rx_status)
1771 {
1772         int tx_last_beacon, adhoc;
1773 #if 0 /* FIX */
1774         struct ieee80211_mgmt *resp;
1775 #endif
1776         u8 *pos, *end;
1777         struct wpa_ssid *ssid = wpa_s->current_ssid;
1778
1779         adhoc = ssid && ssid->mode == 1;
1780
1781         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1782             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1783                 return;
1784
1785 #if 0 /* FIX */
1786         if (local->hw->tx_last_beacon)
1787                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1788         else
1789 #endif
1790                 tx_last_beacon = 1;
1791
1792 #ifdef IEEE80211_IBSS_DEBUG
1793         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1794                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1795                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1796                    MAC2STR(mgmt->bssid), tx_last_beacon);
1797 #endif /* IEEE80211_IBSS_DEBUG */
1798
1799         if (!tx_last_beacon)
1800                 return;
1801
1802         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1803             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1804                 return;
1805
1806         end = ((u8 *) mgmt) + len;
1807         pos = mgmt->u.probe_req.variable;
1808         if (pos[0] != WLAN_EID_SSID ||
1809             pos + 2 + pos[1] > end) {
1810                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1811                            MACSTR, MAC2STR(mgmt->sa));
1812                 return;
1813         }
1814         if (pos[1] != 0 &&
1815             (pos[1] != wpa_s->mlme.ssid_len ||
1816              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1817         {
1818                 /* Ignore ProbeReq for foreign SSID */
1819                 return;
1820         }
1821
1822 #if 0 /* FIX */
1823         /* Reply with ProbeResp */
1824         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1825         if (skb == NULL)
1826                 return;
1827
1828         resp = (struct ieee80211_mgmt *) skb->data;
1829         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1830 #ifdef IEEE80211_IBSS_DEBUG
1831         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1832                    MAC2STR(resp->da));
1833 #endif /* IEEE80211_IBSS_DEBUG */
1834         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1835 #endif
1836 }
1837
1838
1839 #ifdef CONFIG_IEEE80211R
1840 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1841                                         struct ieee80211_mgmt *mgmt,
1842                                         size_t len,
1843                                         struct ieee80211_rx_status *rx_status)
1844 {
1845         union wpa_event_data data;
1846         u16 status;
1847         u8 *sta_addr, *target_ap_addr;
1848
1849         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1850                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1851                 return;
1852         }
1853
1854         /*
1855          * Only FT Action Response is needed for now since reservation
1856          * protocol is not supported.
1857          */
1858         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1859                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1860                            mgmt->u.action.u.ft_action_resp.action);
1861                 return;
1862         }
1863
1864         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1865         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1866         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1867         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1868                    " TargetAP " MACSTR " Status Code %d",
1869                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1870         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1871                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1872                            " in FT Action Response", MAC2STR(sta_addr));
1873                 return;
1874
1875         }
1876
1877         if (status) {
1878                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1879                            "failure (status code %d)", status);
1880                 /* TODO: report error to FT code(?) */
1881                 return;
1882         }
1883
1884         os_memset(&data, 0, sizeof(data));
1885         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1886         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1887                                      (u8 *) mgmt);
1888         data.ft_ies.ft_action = 1;
1889         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1890         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1891         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1892          * successfully */
1893         wpa_s->mlme.prev_bssid_set = 1;
1894         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1895         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1896         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1897         ieee80211_associate(wpa_s);
1898 }
1899 #endif /* CONFIG_IEEE80211R */
1900
1901
1902 #ifdef CONFIG_IEEE80211W
1903
1904 /* MLME-PING.response */
1905 static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
1906                                         const u8 *addr, const u8 *trans_id)
1907 {
1908         struct ieee80211_mgmt *mgmt;
1909         int res;
1910         size_t len;
1911
1912         mgmt = os_zalloc(sizeof(*mgmt));
1913         if (mgmt == NULL) {
1914                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1915                            "ping action frame");
1916                 return -1;
1917         }
1918
1919         len = 24;
1920         os_memcpy(mgmt->da, addr, ETH_ALEN);
1921         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1922         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1923         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1924                                            WLAN_FC_STYPE_ACTION);
1925         mgmt->u.action.category = WLAN_ACTION_PING;
1926         mgmt->u.action.u.ping_resp.action = WLAN_PING_RESPONSE;
1927         os_memcpy(mgmt->u.action.u.ping_resp.trans_id, trans_id,
1928                   WLAN_PING_TRANS_ID_LEN);
1929         len += 1 + sizeof(mgmt->u.action.u.ping_resp);
1930
1931         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1932         os_free(mgmt);
1933
1934         return res;
1935 }
1936
1937
1938 static void ieee80211_rx_mgmt_ping_action(
1939         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1940         struct ieee80211_rx_status *rx_status)
1941 {
1942         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ping_req)) {
1943                 wpa_printf(MSG_DEBUG, "MLME: Too short Ping Action frame");
1944                 return;
1945         }
1946
1947         if (mgmt->u.action.u.ping_req.action != WLAN_PING_REQUEST) {
1948                 wpa_printf(MSG_DEBUG, "MLME: Unexpected Ping Action %d",
1949                            mgmt->u.action.u.ping_req.action);
1950                 return;
1951         }
1952
1953         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1954                 wpa_printf(MSG_DEBUG, "MLME: Ignore ping from unknown source "
1955                            MACSTR, MAC2STR(mgmt->sa));
1956                 return;
1957         }
1958
1959         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1960                 wpa_printf(MSG_DEBUG, "MLME: Ignore ping request during "
1961                            "association process");
1962                 return;
1963         }
1964
1965         wpa_printf(MSG_DEBUG, "MLME: Replying to ping request");
1966         ieee80211_sta_send_ping_resp(wpa_s, mgmt->sa,
1967                                      mgmt->u.action.u.ping_req.trans_id);
1968 }
1969
1970 #endif /* CONFIG_IEEE80211W */
1971
1972
1973 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1974                                      struct ieee80211_mgmt *mgmt,
1975                                      size_t len,
1976                                      struct ieee80211_rx_status *rx_status)
1977 {
1978         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1979
1980         if (len < 25)
1981                 return;
1982
1983         switch (mgmt->u.action.category) {
1984 #ifdef CONFIG_IEEE80211R
1985         case WLAN_ACTION_FT:
1986                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1987                 break;
1988 #endif /* CONFIG_IEEE80211R */
1989 #ifdef CONFIG_IEEE80211W
1990         case WLAN_ACTION_PING:
1991                 ieee80211_rx_mgmt_ping_action(wpa_s, mgmt, len, rx_status);
1992                 break;
1993 #endif /* CONFIG_IEEE80211W */
1994         default:
1995                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1996                            mgmt->u.action.category);
1997                 break;
1998         }
1999 }
2000
2001
2002 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
2003                                   const u8 *buf, size_t len,
2004                                   struct ieee80211_rx_status *rx_status)
2005 {
2006         struct ieee80211_mgmt *mgmt;
2007         u16 fc;
2008
2009         if (len < 24)
2010                 return;
2011
2012         mgmt = (struct ieee80211_mgmt *) buf;
2013         fc = le_to_host16(mgmt->frame_control);
2014
2015         switch (WLAN_FC_GET_STYPE(fc)) {
2016         case WLAN_FC_STYPE_PROBE_REQ:
2017                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
2018                 break;
2019         case WLAN_FC_STYPE_PROBE_RESP:
2020                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
2021                 break;
2022         case WLAN_FC_STYPE_BEACON:
2023                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2024                 break;
2025         case WLAN_FC_STYPE_AUTH:
2026                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2027                 break;
2028         case WLAN_FC_STYPE_ASSOC_RESP:
2029                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2030                 break;
2031         case WLAN_FC_STYPE_REASSOC_RESP:
2032                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2033                 break;
2034         case WLAN_FC_STYPE_DEAUTH:
2035                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2036                 break;
2037         case WLAN_FC_STYPE_DISASSOC:
2038                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2039                 break;
2040         case WLAN_FC_STYPE_ACTION:
2041                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2042                 break;
2043         default:
2044                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2045                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2046                 break;
2047         }
2048 }
2049
2050
2051 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2052                                   const u8 *buf, size_t len,
2053                                   struct ieee80211_rx_status *rx_status)
2054 {
2055         struct ieee80211_mgmt *mgmt;
2056         u16 fc;
2057
2058         if (len < 24)
2059                 return;
2060
2061         mgmt = (struct ieee80211_mgmt *) buf;
2062         fc = le_to_host16(mgmt->frame_control);
2063
2064         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2065                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2066                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2067                                                      len, rx_status);
2068                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2069                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2070                 }
2071         }
2072 }
2073
2074
2075 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2076 {
2077         int active = 0;
2078
2079 #if 0 /* FIX */
2080         list_for_each(ptr, &local->sta_list) {
2081                 sta = list_entry(ptr, struct sta_info, list);
2082                 if (sta->dev == dev &&
2083                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2084                                jiffies)) {
2085                         active++;
2086                         break;
2087                 }
2088         }
2089 #endif
2090
2091         return active;
2092 }
2093
2094
2095 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2096 {
2097 #if 0 /* FIX */
2098         list_for_each_safe(ptr, n, &local->sta_list) {
2099                 sta = list_entry(ptr, struct sta_info, list);
2100                 if (time_after(jiffies, sta->last_rx +
2101                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2102                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2103                                    MACSTR, MAC2STR(sta->addr));
2104                         sta_info_free(local, sta, 1);
2105                 }
2106         }
2107 #endif
2108 }
2109
2110
2111 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2112 {
2113         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2114
2115         ieee80211_sta_expire(wpa_s);
2116         if (ieee80211_sta_active_ibss(wpa_s))
2117                 return;
2118
2119         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2120                    "other IBSS networks with same SSID (merge)");
2121         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2122 }
2123
2124
2125 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2126 {
2127         struct wpa_supplicant *wpa_s = eloop_ctx;
2128
2129         switch (wpa_s->mlme.state) {
2130         case IEEE80211_DISABLED:
2131                 break;
2132         case IEEE80211_AUTHENTICATE:
2133                 ieee80211_authenticate(wpa_s);
2134                 break;
2135         case IEEE80211_ASSOCIATE:
2136                 ieee80211_associate(wpa_s);
2137                 break;
2138         case IEEE80211_ASSOCIATED:
2139                 ieee80211_associated(wpa_s);
2140                 break;
2141         case IEEE80211_IBSS_SEARCH:
2142                 ieee80211_sta_find_ibss(wpa_s);
2143                 break;
2144         case IEEE80211_IBSS_JOINED:
2145                 ieee80211_sta_merge_ibss(wpa_s);
2146                 break;
2147         default:
2148                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2149                            wpa_s->mlme.state);
2150                 break;
2151         }
2152
2153         if (ieee80211_privacy_mismatch(wpa_s)) {
2154                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2155                            "and mixed-cell disabled - disassociate");
2156
2157                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2158                 ieee80211_set_associated(wpa_s, 0);
2159         }
2160 }
2161
2162
2163 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2164 {
2165         struct wpa_ssid *ssid = wpa_s->current_ssid;
2166         if (ssid && ssid->mode != 0)
2167                 return;
2168
2169 #if 0 /* FIX */
2170         if (local->hw->reset_tsf) {
2171                 /* Reset own TSF to allow time synchronization work. */
2172                 local->hw->reset_tsf(local->mdev);
2173         }
2174 #endif
2175
2176         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2177
2178
2179         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2180                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2181         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2182                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2183         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2184                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2185         else
2186                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2187         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2188                    wpa_s->mlme.auth_alg);
2189         wpa_s->mlme.auth_transaction = -1;
2190         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2191         ieee80211_authenticate(wpa_s);
2192 }
2193
2194
2195 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2196 {
2197 #if 0 /* FIX */
2198         int m, c;
2199
2200         for (m = 0; m < local->hw->num_modes; m++) {
2201                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2202                 if (mode->mode != local->conf.phymode)
2203                         continue;
2204                 for (c = 0; c < mode->num_channels; c++) {
2205                         struct ieee80211_channel *chan = &mode->channels[c];
2206                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2207                             chan->chan == local->conf.channel) {
2208                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2209                                         return 1;
2210                                 break;
2211                         }
2212                 }
2213         }
2214 #endif
2215
2216         return 0;
2217 }
2218
2219
2220 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2221                                    struct ieee80211_sta_bss *bss)
2222 {
2223         int res = 0, rates, done = 0;
2224         struct ieee80211_mgmt *mgmt;
2225 #if 0 /* FIX */
2226         struct ieee80211_tx_control control;
2227         struct ieee80211_rate *rate;
2228         struct rate_control_extra extra;
2229 #endif
2230         u8 *pos, *buf;
2231         size_t len;
2232
2233         /* Remove possible STA entries from other IBSS networks. */
2234 #if 0 /* FIX */
2235         sta_info_flush(local, NULL);
2236
2237         if (local->hw->reset_tsf) {
2238                 /* Reset own TSF to allow time synchronization work. */
2239                 local->hw->reset_tsf(local->mdev);
2240         }
2241 #endif
2242         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2243
2244 #if 0 /* FIX */
2245         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2246
2247         sdata->drop_unencrypted = bss->capability &
2248                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2249 #endif
2250
2251 #if 0 /* FIX */
2252         os_memset(&rq, 0, sizeof(rq));
2253         rq.m = bss->freq * 100000;
2254         rq.e = 1;
2255         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2256 #endif
2257
2258         if (!ieee80211_ibss_allowed(wpa_s)) {
2259 #if 0 /* FIX */
2260                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2261                            "(%d MHz)", local->conf.channel,
2262                            local->conf.freq);
2263 #endif
2264                 return -1;
2265         }
2266
2267         /* Set beacon template based on scan results */
2268         buf = os_malloc(400);
2269         len = 0;
2270         do {
2271                 if (buf == NULL)
2272                         break;
2273
2274                 mgmt = (struct ieee80211_mgmt *) buf;
2275                 len += 24 + sizeof(mgmt->u.beacon);
2276                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2277                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2278                                                    WLAN_FC_STYPE_BEACON);
2279                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2280                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2281                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2282 #if 0 /* FIX */
2283                 mgmt->u.beacon.beacon_int =
2284                         host_to_le16(local->conf.beacon_int);
2285 #endif
2286                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2287
2288                 pos = buf + len;
2289                 len += 2 + wpa_s->mlme.ssid_len;
2290                 *pos++ = WLAN_EID_SSID;
2291                 *pos++ = wpa_s->mlme.ssid_len;
2292                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2293
2294                 rates = bss->supp_rates_len;
2295                 if (rates > 8)
2296                         rates = 8;
2297                 pos = buf + len;
2298                 len += 2 + rates;
2299                 *pos++ = WLAN_EID_SUPP_RATES;
2300                 *pos++ = rates;
2301                 os_memcpy(pos, bss->supp_rates, rates);
2302
2303                 pos = buf + len;
2304                 len += 2 + 1;
2305                 *pos++ = WLAN_EID_DS_PARAMS;
2306                 *pos++ = 1;
2307                 *pos++ = bss->channel;
2308
2309                 pos = buf + len;
2310                 len += 2 + 2;
2311                 *pos++ = WLAN_EID_IBSS_PARAMS;
2312                 *pos++ = 2;
2313                 /* FIX: set ATIM window based on scan results */
2314                 *pos++ = 0;
2315                 *pos++ = 0;
2316
2317                 if (bss->supp_rates_len > 8) {
2318                         rates = bss->supp_rates_len - 8;
2319                         pos = buf + len;
2320                         len += 2 + rates;
2321                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2322                         *pos++ = rates;
2323                         os_memcpy(pos, &bss->supp_rates[8], rates);
2324                 }
2325
2326 #if 0 /* FIX */
2327                 os_memset(&control, 0, sizeof(control));
2328                 control.pkt_type = PKT_PROBE_RESP;
2329                 os_memset(&extra, 0, sizeof(extra));
2330                 extra.endidx = local->num_curr_rates;
2331                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2332                 if (rate == NULL) {
2333                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2334                                    "rate for IBSS beacon");
2335                         break;
2336                 }
2337                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2338                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2339                         rate->val2 : rate->val;
2340                 control.antenna_sel = local->conf.antenna_sel;
2341                 control.power_level = local->conf.power_level;
2342                 control.no_ack = 1;
2343                 control.retry_limit = 1;
2344                 control.rts_cts_duration = 0;
2345 #endif
2346
2347 #if 0 /* FIX */
2348                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2349                 if (wpa_s->mlme.probe_resp) {
2350                         mgmt = (struct ieee80211_mgmt *)
2351                                 wpa_s->mlme.probe_resp->data;
2352                         mgmt->frame_control =
2353                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2354                                              WLAN_FC_STYPE_PROBE_RESP);
2355                 } else {
2356                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2357                                    "ProbeResp template for IBSS");
2358                 }
2359
2360                 if (local->hw->beacon_update &&
2361                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2362                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2363                                    "template based on scan results");
2364                         skb = NULL;
2365                 }
2366
2367                 rates = 0;
2368                 for (i = 0; i < bss->supp_rates_len; i++) {
2369                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2370                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2371                                 rate *= 2;
2372                         for (j = 0; j < local->num_curr_rates; j++)
2373                                 if (local->curr_rates[j].rate == rate)
2374                                         rates |= BIT(j);
2375                 }
2376                 wpa_s->mlme.supp_rates_bits = rates;
2377 #endif
2378                 done = 1;
2379         } while (0);
2380
2381         os_free(buf);
2382         if (!done) {
2383                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2384                            "template");
2385         }
2386
2387         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2388         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2389
2390         return res;
2391 }
2392
2393
2394 #if 0 /* FIX */
2395 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2396 {
2397         struct ieee80211_sta_bss *bss;
2398         u8 bssid[ETH_ALEN], *pos;
2399         int i;
2400
2401 #if 0
2402         /* Easier testing, use fixed BSSID. */
2403         os_memset(bssid, 0xfe, ETH_ALEN);
2404 #else
2405         /* Generate random, not broadcast, locally administered BSSID. Mix in
2406          * own MAC address to make sure that devices that do not have proper
2407          * random number generator get different BSSID. */
2408         os_get_random(bssid, ETH_ALEN);
2409         for (i = 0; i < ETH_ALEN; i++)
2410                 bssid[i] ^= wpa_s->own_addr[i];
2411         bssid[0] &= ~0x01;
2412         bssid[0] |= 0x02;
2413 #endif
2414
2415         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2416                    MACSTR "", MAC2STR(bssid));
2417
2418         bss = ieee80211_bss_add(wpa_s, bssid);
2419         if (bss == NULL)
2420                 return -ENOMEM;
2421
2422 #if 0 /* FIX */
2423         if (local->conf.beacon_int == 0)
2424                 local->conf.beacon_int = 100;
2425         bss->beacon_int = local->conf.beacon_int;
2426         bss->hw_mode = local->conf.phymode;
2427         bss->channel = local->conf.channel;
2428         bss->freq = local->conf.freq;
2429 #endif
2430         os_get_time(&bss->last_update);
2431         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2432 #if 0 /* FIX */
2433         if (sdata->default_key) {
2434                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2435         } else
2436                 sdata->drop_unencrypted = 0;
2437         bss->supp_rates_len = local->num_curr_rates;
2438 #endif
2439         pos = bss->supp_rates;
2440 #if 0 /* FIX */
2441         for (i = 0; i < local->num_curr_rates; i++) {
2442                 int rate = local->curr_rates[i].rate;
2443                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2444                         rate /= 2;
2445                 *pos++ = (u8) (rate / 5);
2446         }
2447 #endif
2448
2449         return ieee80211_sta_join_ibss(wpa_s, bss);
2450 }
2451 #endif
2452
2453
2454 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2455 {
2456         struct ieee80211_sta_bss *bss;
2457         int found = 0;
2458         u8 bssid[ETH_ALEN];
2459         int active_ibss;
2460         struct os_time now;
2461
2462         if (wpa_s->mlme.ssid_len == 0)
2463                 return -EINVAL;
2464
2465         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2466 #ifdef IEEE80211_IBSS_DEBUG
2467         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2468                    active_ibss);
2469 #endif /* IEEE80211_IBSS_DEBUG */
2470         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2471                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2472                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2473                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2474                         continue;
2475 #ifdef IEEE80211_IBSS_DEBUG
2476                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2477                            MAC2STR(bss->bssid));
2478 #endif /* IEEE80211_IBSS_DEBUG */
2479                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2480                 found = 1;
2481                 if (active_ibss ||
2482                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2483                         break;
2484         }
2485
2486 #ifdef IEEE80211_IBSS_DEBUG
2487         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2488                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2489 #endif /* IEEE80211_IBSS_DEBUG */
2490         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2491             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2492                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2493                            " based on configured SSID",
2494                            MAC2STR(bssid));
2495                 return ieee80211_sta_join_ibss(wpa_s, bss);
2496         }
2497 #ifdef IEEE80211_IBSS_DEBUG
2498         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2499 #endif /* IEEE80211_IBSS_DEBUG */
2500
2501         /* Selected IBSS not found in current scan results - try to scan */
2502         os_get_time(&now);
2503 #if 0 /* FIX */
2504         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2505             !ieee80211_sta_active_ibss(wpa_s)) {
2506                 ieee80211_reschedule_timer(wpa_s,
2507                                            IEEE80211_IBSS_MERGE_INTERVAL);
2508         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2509                               IEEE80211_SCAN_INTERVAL)) {
2510                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2511                            "to join");
2512                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2513                                               wpa_s->mlme.ssid_len);
2514         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2515                 int interval = IEEE80211_SCAN_INTERVAL;
2516
2517                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2518                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2519                         if (wpa_s->mlme.create_ibss &&
2520                             ieee80211_ibss_allowed(wpa_s))
2521                                 return ieee80211_sta_create_ibss(wpa_s);
2522                         if (wpa_s->mlme.create_ibss) {
2523                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2524                                            "on the configured channel %d "
2525                                            "(%d MHz)",
2526                                            local->conf.channel,
2527                                            local->conf.freq);
2528                         }
2529
2530                         /* No IBSS found - decrease scan interval and continue
2531                          * scanning. */
2532                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2533                 }
2534
2535                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2536                 ieee80211_reschedule_timer(wpa_s, interval);
2537                 return 0;
2538         }
2539 #endif
2540
2541         return 0;
2542 }
2543
2544
2545 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2546                            size_t *len)
2547 {
2548         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2549         *len = wpa_s->mlme.ssid_len;
2550         return 0;
2551 }
2552
2553
2554 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2555                             struct wpa_driver_associate_params *params)
2556 {
2557         struct ieee80211_sta_bss *bss;
2558
2559         wpa_s->mlme.bssid_set = 0;
2560         wpa_s->mlme.freq = params->freq;
2561         if (params->bssid) {
2562                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2563                 if (!is_zero_ether_addr(params->bssid))
2564                         wpa_s->mlme.bssid_set = 1;
2565                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2566                 if (bss) {
2567                         wpa_s->mlme.phymode = bss->hw_mode;
2568                         wpa_s->mlme.channel = bss->channel;
2569                         wpa_s->mlme.freq = bss->freq;
2570                 }
2571         }
2572
2573 #if 0 /* FIX */
2574         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2575          * not defined. */
2576         if (local->hw->conf_tx) {
2577                 struct ieee80211_tx_queue_params qparam;
2578                 int i;
2579
2580                 os_memset(&qparam, 0, sizeof(qparam));
2581                 /* TODO: are these ok defaults for all hw_modes? */
2582                 qparam.aifs = 2;
2583                 qparam.cw_min =
2584                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2585                 qparam.cw_max = 1023;
2586                 qparam.burst_time = 0;
2587                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2588                 {
2589                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2590                                            &qparam);
2591                 }
2592                 /* IBSS uses different parameters for Beacon sending */
2593                 qparam.cw_min++;
2594                 qparam.cw_min *= 2;
2595                 qparam.cw_min--;
2596                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2597         }
2598 #endif
2599
2600         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2601             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2602                 wpa_s->mlme.prev_bssid_set = 0;
2603         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2604         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2605                   MAX_SSID_LEN - params->ssid_len);
2606         wpa_s->mlme.ssid_len = params->ssid_len;
2607         wpa_s->mlme.ssid_set = 1;
2608
2609         os_free(wpa_s->mlme.extra_ie);
2610         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2611                 wpa_s->mlme.extra_ie = NULL;
2612                 wpa_s->mlme.extra_ie_len = 0;
2613         } else {
2614                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2615                 if (wpa_s->mlme.extra_ie == NULL) {
2616                         wpa_s->mlme.extra_ie_len = 0;
2617                         return -1;
2618                 }
2619                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2620                           params->wpa_ie_len);
2621                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2622         }
2623
2624         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2625
2626         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2627                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2628
2629         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2630                 os_get_time(&wpa_s->mlme.ibss_join_req);
2631                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2632                 return ieee80211_sta_find_ibss(wpa_s);
2633         }
2634
2635         if (wpa_s->mlme.bssid_set)
2636                 ieee80211_sta_new_auth(wpa_s);
2637
2638         return 0;
2639 }
2640
2641
2642 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2643 {
2644         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2645         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2646         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2647 }
2648
2649
2650 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2651 {
2652         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2653         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2654         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2655         if (wpa_s->mlme.freq == 0)
2656                 return 0;
2657         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2658                                          wpa_s->mlme.channel,
2659                                          wpa_s->mlme.freq);
2660 }
2661
2662
2663 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2664 {
2665         size_t m;
2666         int c;
2667
2668         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2669                 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2670                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2671                         continue;
2672                 for (c = 0; c < mode->num_channels; c++) {
2673                         struct wpa_channel_data *chan = &mode->channels[c];
2674                         if (chan->flag & WPA_CHAN_W_SCAN &&
2675                             chan->chan == wpa_s->mlme.channel) {
2676                                 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2677                                         return 1;
2678                                 break;
2679                         }
2680                 }
2681         }
2682
2683         return 0;
2684 }
2685
2686
2687 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2688 {
2689         struct wpa_supplicant *wpa_s = eloop_ctx;
2690         struct wpa_hw_modes *mode;
2691         struct wpa_channel_data *chan;
2692         int skip = 0;
2693         int timeout = 0;
2694         struct wpa_ssid *ssid = wpa_s->current_ssid;
2695         int adhoc;
2696
2697         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2698                 return;
2699
2700         adhoc = ssid && ssid->mode == 1;
2701
2702         switch (wpa_s->mlme.scan_state) {
2703         case SCAN_SET_CHANNEL:
2704                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2705                 if (wpa_s->mlme.scan_hw_mode_idx >=
2706                     (int) wpa_s->mlme.num_modes ||
2707                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2708                      (int) wpa_s->mlme.num_modes
2709                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2710                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2711                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2712                                            "restore operational channel after "
2713                                            "scan");
2714                         }
2715                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2716                         wpa_s->mlme.sta_scanning = 0;
2717                         os_get_time(&wpa_s->mlme.last_scan_completed);
2718                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2719                         if (adhoc) {
2720                                 if (!wpa_s->mlme.bssid_set ||
2721                                     (wpa_s->mlme.state ==
2722                                      IEEE80211_IBSS_JOINED &&
2723                                      !ieee80211_sta_active_ibss(wpa_s)))
2724                                         ieee80211_sta_find_ibss(wpa_s);
2725                         }
2726                         return;
2727                 }
2728                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2729                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2730                 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2731                     (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2732                     (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2733                      mode->mode == WPA_MODE_IEEE80211B &&
2734                      wpa_s->mlme.scan_skip_11b))
2735                         skip = 1;
2736
2737                 if (!skip) {
2738                         wpa_printf(MSG_MSGDUMP,
2739                                    "MLME: scan channel %d (%d MHz)",
2740                                    chan->chan, chan->freq);
2741
2742                         wpa_s->mlme.channel = chan->chan;
2743                         wpa_s->mlme.freq = chan->freq;
2744                         wpa_s->mlme.phymode = mode->mode;
2745                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2746                                                       chan->chan, chan->freq))
2747                         {
2748                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2749                                            "channel %d (%d MHz) for scan",
2750                                            chan->chan, chan->freq);
2751                                 skip = 1;
2752                         }
2753                 }
2754
2755                 wpa_s->mlme.scan_channel_idx++;
2756                 if (wpa_s->mlme.scan_channel_idx >=
2757                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2758                     num_channels) {
2759                         wpa_s->mlme.scan_hw_mode_idx++;
2760                         wpa_s->mlme.scan_channel_idx = 0;
2761                 }
2762
2763                 if (skip) {
2764                         timeout = 0;
2765                         break;
2766                 }
2767
2768                 timeout = IEEE80211_PROBE_DELAY;
2769                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2770                 break;
2771         case SCAN_SEND_PROBE:
2772                 if (ieee80211_active_scan(wpa_s)) {
2773                         ieee80211_send_probe_req(wpa_s, NULL,
2774                                                  wpa_s->mlme.scan_ssid,
2775                                                  wpa_s->mlme.scan_ssid_len);
2776                         timeout = IEEE80211_CHANNEL_TIME;
2777                 } else {
2778                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2779                 }
2780                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2781                 break;
2782         }
2783
2784         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2785                                ieee80211_sta_scan_timer, wpa_s, NULL);
2786 }
2787
2788
2789 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2790                            size_t ssid_len)
2791 {
2792         if (ssid_len > MAX_SSID_LEN)
2793                 return -1;
2794
2795         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2796          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2797          * BSSID: MACAddress
2798          * SSID
2799          * ScanType: ACTIVE, PASSIVE
2800          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2801          *    a Probe frame during active scanning
2802          * ChannelList
2803          * MinChannelTime (>= ProbeDelay), in TU
2804          * MaxChannelTime: (>= MinChannelTime), in TU
2805          */
2806
2807          /* MLME-SCAN.confirm
2808           * BSSDescriptionSet
2809           * ResultCode: SUCCESS, INVALID_PARAMETERS
2810          */
2811
2812         /* TODO: if assoc, move to power save mode for the duration of the
2813          * scan */
2814
2815         if (wpa_s->mlme.sta_scanning)
2816                 return -1;
2817
2818         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2819
2820         ieee80211_sta_save_oper_chan(wpa_s);
2821
2822         wpa_s->mlme.sta_scanning = 1;
2823         /* TODO: stop TX queue? */
2824
2825         if (ssid) {
2826                 wpa_s->mlme.scan_ssid_len = ssid_len;
2827                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2828         } else
2829                 wpa_s->mlme.scan_ssid_len = 0;
2830         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2831                                         * supported */
2832         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2833         wpa_s->mlme.scan_hw_mode_idx = 0;
2834         wpa_s->mlme.scan_channel_idx = 0;
2835         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2836
2837         return 0;
2838 }
2839
2840
2841 struct wpa_scan_results *
2842 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2843 {
2844         size_t ap_num = 0;
2845         struct wpa_scan_results *res;
2846         struct wpa_scan_res *r;
2847         struct ieee80211_sta_bss *bss;
2848
2849         res = os_zalloc(sizeof(*res));
2850         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2851                 ap_num++;
2852         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2853         if (res->res == NULL) {
2854                 os_free(res);
2855                 return NULL;
2856         }
2857
2858         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2859                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2860                 if (r == NULL)
2861                         break;
2862                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2863                 r->freq = bss->freq;
2864                 r->beacon_int = bss->beacon_int;
2865                 r->caps = bss->capability;
2866                 r->level = bss->rssi;
2867                 r->tsf = bss->timestamp;
2868                 if (bss->ie) {
2869                         r->ie_len = bss->ie_len;
2870                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2871                 }
2872
2873                 res->res[res->num++] = r;
2874         }
2875
2876         return res;
2877 }
2878
2879
2880 #if 0 /* FIX */
2881 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2882                                          struct sk_buff *skb, u8 *bssid,
2883                                          u8 *addr)
2884 {
2885         struct ieee80211_local *local = dev->priv;
2886         struct list_head *ptr;
2887         struct sta_info *sta;
2888         struct wpa_supplicant *sta_dev = NULL;
2889
2890         /* TODO: Could consider removing the least recently used entry and
2891          * allow new one to be added. */
2892         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2893                 if (net_ratelimit()) {
2894                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2895                                    "STA entry " MACSTR, MAC2STR(addr));
2896                 }
2897                 return NULL;
2898         }
2899
2900         spin_lock_bh(&local->sub_if_lock);
2901         list_for_each(ptr, &local->sub_if_list) {
2902                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2903                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2904                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2905                         sta_dev = sdata->dev;
2906                         break;
2907                 }
2908         }
2909         spin_unlock_bh(&local->sub_if_lock);
2910
2911         if (sta_dev == NULL)
2912                 return NULL;
2913
2914         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2915                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2916
2917         sta = sta_info_add(wpa_s, addr);
2918         if (sta == NULL) {
2919                 return NULL;
2920         }
2921
2922         sta->dev = sta_dev;
2923         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2924
2925         rate_control_rate_init(local, sta);
2926
2927         return sta; /* caller will call sta_info_release() */
2928 }
2929 #endif
2930
2931
2932 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2933 {
2934         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2935
2936         ieee80211_send_deauth(wpa_s, reason);
2937         ieee80211_set_associated(wpa_s, 0);
2938         return 0;
2939 }
2940
2941
2942 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2943 {
2944         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2945
2946         if (!wpa_s->mlme.associated)
2947                 return -1;
2948
2949         ieee80211_send_disassoc(wpa_s, reason);
2950         ieee80211_set_associated(wpa_s, 0);
2951         return 0;
2952 }
2953
2954
2955 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2956                       struct ieee80211_rx_status *rx_status)
2957 {
2958         struct ieee80211_mgmt *mgmt;
2959         u16 fc;
2960         const u8 *pos;
2961
2962         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2963
2964         if (wpa_s->mlme.sta_scanning) {
2965                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2966                 return;
2967         }
2968
2969         if (len < 24)
2970                 return;
2971
2972         mgmt = (struct ieee80211_mgmt *) buf;
2973         fc = le_to_host16(mgmt->frame_control);
2974
2975         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2976                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2977         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2978                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2979                     WLAN_FC_FROMDS)
2980                         return;
2981                 /* mgmt->sa is actually BSSID for FromDS data frames */
2982                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2983                         return;
2984                 /* Skip IEEE 802.11 and LLC headers */
2985                 pos = buf + 24 + 6;
2986                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2987                         return;
2988                 pos += 2;
2989                 /* mgmt->bssid is actually BSSID for SA data frames */
2990                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2991                                         pos, buf + len - pos);
2992         }
2993 }
2994
2995
2996 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2997                                     size_t num_hw_features)
2998 {
2999         size_t i;
3000
3001         if (hw_features == NULL)
3002                 return;
3003
3004         for (i = 0; i < num_hw_features; i++) {
3005                 os_free(hw_features[i].channels);
3006                 os_free(hw_features[i].rates);
3007         }
3008
3009         os_free(hw_features);
3010 }
3011
3012
3013 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
3014 {
3015         u16 num_modes, flags;
3016
3017         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
3018                                                         &flags);
3019         if (wpa_s->mlme.modes == NULL) {
3020                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
3021                            "channels and rates from the driver");
3022                 return -1;
3023         }
3024
3025         wpa_s->mlme.num_modes = num_modes;
3026
3027         wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
3028         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
3029         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
3030
3031         return 0;
3032 }
3033
3034
3035 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3036 {
3037         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3038         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3039         os_free(wpa_s->mlme.extra_ie);
3040         wpa_s->mlme.extra_ie = NULL;
3041         os_free(wpa_s->mlme.extra_probe_ie);
3042         wpa_s->mlme.extra_probe_ie = NULL;
3043         os_free(wpa_s->mlme.assocreq_ies);
3044         wpa_s->mlme.assocreq_ies = NULL;
3045         os_free(wpa_s->mlme.assocresp_ies);
3046         wpa_s->mlme.assocresp_ies = NULL;
3047         ieee80211_bss_list_deinit(wpa_s);
3048         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3049                                        wpa_s->mlme.num_modes);
3050 #ifdef CONFIG_IEEE80211R
3051         os_free(wpa_s->mlme.ft_ies);
3052         wpa_s->mlme.ft_ies = NULL;
3053         wpa_s->mlme.ft_ies_len = 0;
3054 #endif /* CONFIG_IEEE80211R */
3055 }
3056
3057
3058 #ifdef CONFIG_IEEE80211R
3059
3060 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3061                                 const u8 *ies, size_t ies_len)
3062 {
3063         if (md == NULL) {
3064                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3065                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3066         } else {
3067                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3068                            MAC2STR(md));
3069                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3070         }
3071
3072         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3073         os_free(wpa_s->mlme.ft_ies);
3074         wpa_s->mlme.ft_ies = os_malloc(ies_len);
3075         if (wpa_s->mlme.ft_ies == NULL)
3076                 return -1;
3077         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3078         wpa_s->mlme.ft_ies_len = ies_len;
3079
3080         return 0;
3081 }
3082
3083
3084 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3085                                  const u8 *target_ap,
3086                                  const u8 *ies, size_t ies_len)
3087 {
3088         u8 *buf;
3089         size_t len;
3090         struct ieee80211_mgmt *mgmt;
3091         int res;
3092
3093         /*
3094          * Action frame payload:
3095          * Category[1] = 6 (Fast BSS Transition)
3096          * Action[1] = 1 (Fast BSS Transition Request)
3097          * STA Address
3098          * Target AP Address
3099          * FT IEs
3100          */
3101
3102         buf = os_zalloc(sizeof(*mgmt) + ies_len);
3103         if (buf == NULL) {
3104                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3105                            "FT action frame");
3106                 return -1;
3107         }
3108
3109         mgmt = (struct ieee80211_mgmt *) buf;
3110         len = 24;
3111         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3112         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3113         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3114         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3115                                            WLAN_FC_STYPE_ACTION);
3116         mgmt->u.action.category = WLAN_ACTION_FT;
3117         mgmt->u.action.u.ft_action_req.action = action;
3118         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3119                   ETH_ALEN);
3120         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3121                   ETH_ALEN);
3122         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3123         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3124
3125         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3126                    "Target AP=" MACSTR " body_len=%lu",
3127                    action, MAC2STR(target_ap), (unsigned long) ies_len);
3128
3129         res = ieee80211_sta_tx(wpa_s, buf, len);
3130         os_free(buf);
3131
3132         return res;
3133 }
3134
3135 #endif /* CONFIG_IEEE80211R */
3136
3137
3138 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3139                                    size_t ies_len)
3140 {
3141         os_free(wpa_s->mlme.extra_probe_ie);
3142         wpa_s->mlme.extra_probe_ie = NULL;
3143         wpa_s->mlme.extra_probe_ie_len = 0;
3144
3145         if (ies == NULL)
3146                 return 0;
3147
3148         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3149         if (wpa_s->mlme.extra_probe_ie == NULL)
3150                 return -1;
3151
3152         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3153         wpa_s->mlme.extra_probe_ie_len = ies_len;
3154
3155         return 0;
3156 }