src/ap/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #ifndef CONFIG_NATIVE_WINDOWS
  12
  13 #include "utils/common.h"
  14 #include "utils/eloop.h"
  15 #include "crypto/crypto.h"
  16 #include "crypto/sha256.h"
  17 #include "crypto/random.h"
  18 #include "common/ieee802_11_defs.h"
  19 #include "common/ieee802_11_common.h"
  20 #include "common/wpa_ctrl.h"
  21 #include "common/sae.h"
  22 #include "radius/radius.h"
  23 #include "radius/radius_client.h"
  24 #include "p2p/p2p.h"
  25 #include "wps/wps.h"
  26 #include "fst/fst.h"
  27 #include "hostapd.h"
  28 #include "beacon.h"
  29 #include "ieee802_11_auth.h"
  30 #include "sta_info.h"
  31 #include "ieee802_1x.h"
  32 #include "wpa_auth.h"
  33 #include "pmksa_cache_auth.h"
  34 #include "wmm.h"
  35 #include "ap_list.h"
  36 #include "accounting.h"
  37 #include "ap_config.h"
  38 #include "ap_mlme.h"
  39 #include "p2p_hostapd.h"
  40 #include "ap_drv_ops.h"
  41 #include "wnm_ap.h"
  42 #include "ieee802_11.h"
  43 #include "dfs.h"
  44
  45
  46 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  47 {
  48         u8 *pos = eid;
  49         int i, num, count;
  50
  51         if (hapd->iface->current_rates == NULL)
  52                 return eid;
  53
  54         *pos++ = WLAN_EID_SUPP_RATES;
  55         num = hapd->iface->num_rates;
  56         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  57                 num++;
  58         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
  59                 num++;
  60         if (num > 8) {
  61                 /* rest of the rates are encoded in Extended supported
  62                  * rates element */
  63                 num = 8;
  64         }
  65
  66         *pos++ = num;
  67         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  68              i++) {
  69                 count++;
  70                 *pos = hapd->iface->current_rates[i].rate / 5;
  71                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  72                         *pos |= 0x80;
  73                 pos++;
  74         }
  75
  76         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
  77                 count++;
  78                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
  79         }
  80
  81         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
  82                 count++;
  83                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
  84         }
  85
  86         return pos;
  87 }
  88
  89
  90 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  91 {
  92         u8 *pos = eid;
  93         int i, num, count;
  94
  95         if (hapd->iface->current_rates == NULL)
  96                 return eid;
  97
  98         num = hapd->iface->num_rates;
  99         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
 100                 num++;
 101         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
 102                 num++;
 103         if (num <= 8)
 104                 return eid;
 105         num -= 8;
 106
 107         *pos++ = WLAN_EID_EXT_SUPP_RATES;
 108         *pos++ = num;
 109         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
 110              i++) {
 111                 count++;
 112                 if (count <= 8)
 113                         continue; /* already in SuppRates IE */
 114                 *pos = hapd->iface->current_rates[i].rate / 5;
 115                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
 116                         *pos |= 0x80;
 117                 pos++;
 118         }
 119
 120         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
 121                 count++;
 122                 if (count > 8)
 123                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
 124         }
 125
 126         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
 127                 count++;
 128                 if (count > 8)
 129                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
 130         }
 131
 132         return pos;
 133 }
 134
 135
 136 u16 hostapd_own_capab_info(struct hostapd_data *hapd)
 137 {
 138         int capab = WLAN_CAPABILITY_ESS;
 139         int privacy;
 140         int dfs;
 141
 142         /* Check if any of configured channels require DFS */
 143         dfs = hostapd_is_dfs_required(hapd->iface);
 144         if (dfs < 0) {
 145                 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
 146                            dfs);
 147                 dfs = 0;
 148         }
 149
 150         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 151             hapd->iconf->preamble == SHORT_PREAMBLE)
 152                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 153
 154         privacy = hapd->conf->ssid.wep.keys_set;
 155
 156         if (hapd->conf->ieee802_1x &&
 157             (hapd->conf->default_wep_key_len ||
 158              hapd->conf->individual_wep_key_len))
 159                 privacy = 1;
 160
 161         if (hapd->conf->wpa)
 162                 privacy = 1;
 163
 164 #ifdef CONFIG_HS20
 165         if (hapd->conf->osen)
 166                 privacy = 1;
 167 #endif /* CONFIG_HS20 */
 168
 169         if (privacy)
 170                 capab |= WLAN_CAPABILITY_PRIVACY;
 171
 172         if (hapd->iface->current_mode &&
 173             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 174             hapd->iface->num_sta_no_short_slot_time == 0)
 175                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 176
 177         /*
 178          * Currently, Spectrum Management capability bit is set when directly
 179          * requested in configuration by spectrum_mgmt_required or when AP is
 180          * running on DFS channel.
 181          * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
 182          */
 183         if (hapd->iface->current_mode &&
 184             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
 185             (hapd->iconf->spectrum_mgmt_required || dfs))
 186                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 187
 188         if (hapd->conf->radio_measurements)
 189                 capab |= IEEE80211_CAP_RRM;
 190
 191         return capab;
 192 }
 193
 194
 195 #ifndef CONFIG_NO_RC4
 196 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 197                            u16 auth_transaction, const u8 *challenge,
 198                            int iswep)
 199 {
 200         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 201                        HOSTAPD_LEVEL_DEBUG,
 202                        "authentication (shared key, transaction %d)",
 203                        auth_transaction);
 204
 205         if (auth_transaction == 1) {
 206                 if (!sta->challenge) {
 207                         /* Generate a pseudo-random challenge */
 208                         u8 key[8];
 209                         struct os_time now;
 210                         int r;
 211                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 212                         if (sta->challenge == NULL)
 213                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 214
 215                         os_get_time(&now);
 216                         r = os_random();
 217                         os_memcpy(key, &now.sec, 4);
 218                         os_memcpy(key + 4, &r, 4);
 219                         rc4_skip(key, sizeof(key), 0,
 220                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 221                 }
 222                 return 0;
 223         }
 224
 225         if (auth_transaction != 3)
 226                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 227
 228         /* Transaction 3 */
 229         if (!iswep || !sta->challenge || !challenge ||
 230             os_memcmp_const(sta->challenge, challenge,
 231                             WLAN_AUTH_CHALLENGE_LEN)) {
 232                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 233                                HOSTAPD_LEVEL_INFO,
 234                                "shared key authentication - invalid "
 235                                "challenge-response");
 236                 return WLAN_STATUS_CHALLENGE_FAIL;
 237         }
 238
 239         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 240                        HOSTAPD_LEVEL_DEBUG,
 241                        "authentication OK (shared key)");
 242         sta->flags |= WLAN_STA_AUTH;
 243         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 244         os_free(sta->challenge);
 245         sta->challenge = NULL;
 246
 247         return 0;
 248 }
 249 #endif /* CONFIG_NO_RC4 */
 250
 251
 252 static void send_auth_reply(struct hostapd_data *hapd,
 253                             const u8 *dst, const u8 *bssid,
 254                             u16 auth_alg, u16 auth_transaction, u16 resp,
 255                             const u8 *ies, size_t ies_len)
 256 {
 257         struct ieee80211_mgmt *reply;
 258         u8 *buf;
 259         size_t rlen;
 260
 261         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 262         buf = os_zalloc(rlen);
 263         if (buf == NULL)
 264                 return;
 265
 266         reply = (struct ieee80211_mgmt *) buf;
 267         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 268                                             WLAN_FC_STYPE_AUTH);
 269         os_memcpy(reply->da, dst, ETH_ALEN);
 270         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 271         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 272
 273         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 274         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 275         reply->u.auth.status_code = host_to_le16(resp);
 276
 277         if (ies && ies_len)
 278                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 279
 280         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 281                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 282                    MAC2STR(dst), auth_alg, auth_transaction,
 283                    resp, (unsigned long) ies_len);
 284         if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
 285                 wpa_printf(MSG_INFO, "send_auth_reply: send");
 286
 287         os_free(buf);
 288 }
 289
 290
 291 #ifdef CONFIG_IEEE80211R
 292 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 293                                   u16 auth_transaction, u16 status,
 294                                   const u8 *ies, size_t ies_len)
 295 {
 296         struct hostapd_data *hapd = ctx;
 297         struct sta_info *sta;
 298
 299         send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction,
 300                         status, ies, ies_len);
 301
 302         if (status != WLAN_STATUS_SUCCESS)
 303                 return;
 304
 305         sta = ap_get_sta(hapd, dst);
 306         if (sta == NULL)
 307                 return;
 308
 309         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 310                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 311         sta->flags |= WLAN_STA_AUTH;
 312         mlme_authenticate_indication(hapd, sta);
 313 }
 314 #endif /* CONFIG_IEEE80211R */
 315
 316
 317 #ifdef CONFIG_SAE
 318
 319 #define dot11RSNASAERetransPeriod 40    /* msec */
 320 #define dot11RSNASAESync 5              /* attempts */
 321
 322
 323 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
 324                                              struct sta_info *sta, int update)
 325 {
 326         struct wpabuf *buf;
 327
 328         if (hapd->conf->ssid.wpa_passphrase == NULL) {
 329                 wpa_printf(MSG_DEBUG, "SAE: No password available");
 330                 return NULL;
 331         }
 332
 333         if (update &&
 334             sae_prepare_commit(hapd->own_addr, sta->addr,
 335                                (u8 *) hapd->conf->ssid.wpa_passphrase,
 336                                os_strlen(hapd->conf->ssid.wpa_passphrase),
 337                                sta->sae) < 0) {
 338                 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
 339                 return NULL;
 340         }
 341
 342         buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN);
 343         if (buf == NULL)
 344                 return NULL;
 345         sae_write_commit(sta->sae, buf, sta->sae->tmp ?
 346                          sta->sae->tmp->anti_clogging_token : NULL);
 347
 348         return buf;
 349 }
 350
 351
 352 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
 353                                               struct sta_info *sta)
 354 {
 355         struct wpabuf *buf;
 356
 357         buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
 358         if (buf == NULL)
 359                 return NULL;
 360
 361         sae_write_confirm(sta->sae, buf);
 362
 363         return buf;
 364 }
 365
 366
 367 static int auth_sae_send_commit(struct hostapd_data *hapd,
 368                                 struct sta_info *sta,
 369                                 const u8 *bssid, int update)
 370 {
 371         struct wpabuf *data;
 372
 373         data = auth_build_sae_commit(hapd, sta, update);
 374         if (data == NULL)
 375                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 376
 377         send_auth_reply(hapd, sta->addr, bssid,
 378                         WLAN_AUTH_SAE, 1, WLAN_STATUS_SUCCESS,
 379                         wpabuf_head(data), wpabuf_len(data));
 380
 381         wpabuf_free(data);
 382
 383         return WLAN_STATUS_SUCCESS;
 384 }
 385
 386
 387 static int auth_sae_send_confirm(struct hostapd_data *hapd,
 388                                  struct sta_info *sta,
 389                                  const u8 *bssid)
 390 {
 391         struct wpabuf *data;
 392
 393         data = auth_build_sae_confirm(hapd, sta);
 394         if (data == NULL)
 395                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 396
 397         send_auth_reply(hapd, sta->addr, bssid,
 398                         WLAN_AUTH_SAE, 2, WLAN_STATUS_SUCCESS,
 399                         wpabuf_head(data), wpabuf_len(data));
 400
 401         wpabuf_free(data);
 402
 403         return WLAN_STATUS_SUCCESS;
 404 }
 405
 406
 407 static int use_sae_anti_clogging(struct hostapd_data *hapd)
 408 {
 409         struct sta_info *sta;
 410         unsigned int open = 0;
 411
 412         if (hapd->conf->sae_anti_clogging_threshold == 0)
 413                 return 1;
 414
 415         for (sta = hapd->sta_list; sta; sta = sta->next) {
 416                 if (!sta->sae)
 417                         continue;
 418                 if (sta->sae->state != SAE_COMMITTED &&
 419                     sta->sae->state != SAE_CONFIRMED)
 420                         continue;
 421                 open++;
 422                 if (open >= hapd->conf->sae_anti_clogging_threshold)
 423                         return 1;
 424         }
 425
 426         return 0;
 427 }
 428
 429
 430 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
 431                            const u8 *token, size_t token_len)
 432 {
 433         u8 mac[SHA256_MAC_LEN];
 434
 435         if (token_len != SHA256_MAC_LEN)
 436                 return -1;
 437         if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 438                         addr, ETH_ALEN, mac) < 0 ||
 439             os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0)
 440                 return -1;
 441
 442         return 0;
 443 }
 444
 445
 446 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
 447                                             int group, const u8 *addr)
 448 {
 449         struct wpabuf *buf;
 450         u8 *token;
 451         struct os_reltime now;
 452
 453         os_get_reltime(&now);
 454         if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
 455             os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
 456                 if (random_get_bytes(hapd->sae_token_key,
 457                                      sizeof(hapd->sae_token_key)) < 0)
 458                         return NULL;
 459                 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
 460                             hapd->sae_token_key, sizeof(hapd->sae_token_key));
 461                 hapd->last_sae_token_key_update = now;
 462         }
 463
 464         buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
 465         if (buf == NULL)
 466                 return NULL;
 467
 468         wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
 469
 470         token = wpabuf_put(buf, SHA256_MAC_LEN);
 471         hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 472                     addr, ETH_ALEN, token);
 473
 474         return buf;
 475 }
 476
 477
 478 static int sae_check_big_sync(struct sta_info *sta)
 479 {
 480         if (sta->sae->sync > dot11RSNASAESync) {
 481                 sta->sae->state = SAE_NOTHING;
 482                 sta->sae->sync = 0;
 483                 return -1;
 484         }
 485         return 0;
 486 }
 487
 488
 489 static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
 490 {
 491         struct hostapd_data *hapd = eloop_ctx;
 492         struct sta_info *sta = eloop_data;
 493         int ret;
 494
 495         if (sae_check_big_sync(sta))
 496                 return;
 497         sta->sae->sync++;
 498
 499         switch (sta->sae->state) {
 500         case SAE_COMMITTED:
 501                 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
 502                 eloop_register_timeout(0, dot11RSNASAERetransPeriod * 1000,
 503                                        auth_sae_retransmit_timer, hapd, sta);
 504                 break;
 505         case SAE_CONFIRMED:
 506                 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
 507                 eloop_register_timeout(0, dot11RSNASAERetransPeriod * 1000,
 508                                        auth_sae_retransmit_timer, hapd, sta);
 509                 break;
 510         default:
 511                 ret = -1;
 512                 break;
 513         }
 514
 515         if (ret != WLAN_STATUS_SUCCESS)
 516                 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
 517 }
 518
 519
 520 void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
 521 {
 522         eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
 523 }
 524
 525
 526 static void sae_set_retransmit_timer(struct hostapd_data *hapd,
 527                                      struct sta_info *sta)
 528 {
 529         if (!(hapd->conf->mesh & MESH_ENABLED))
 530                 return;
 531
 532         eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
 533         eloop_register_timeout(0, dot11RSNASAERetransPeriod * 1000,
 534                                auth_sae_retransmit_timer, hapd, sta);
 535 }
 536
 537
 538 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
 539                        const u8 *bssid, u8 auth_transaction)
 540 {
 541         int ret;
 542
 543         if (auth_transaction != 1 && auth_transaction != 2)
 544                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 545
 546         switch (sta->sae->state) {
 547         case SAE_NOTHING:
 548                 if (auth_transaction == 1) {
 549                         ret = auth_sae_send_commit(hapd, sta, bssid, 1);
 550                         if (ret)
 551                                 return ret;
 552                         sta->sae->state = SAE_COMMITTED;
 553
 554                         if (sae_process_commit(sta->sae) < 0)
 555                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 556
 557                         /*
 558                          * In mesh case, both Commit and Confirm can be sent
 559                          * immediately. In infrastructure BSS, only a single
 560                          * Authentication frame (Commit) is expected from the AP
 561                          * here and the second one (Confirm) will be sent once
 562                          * the STA has sent its second Authentication frame
 563                          * (Confirm).
 564                          */
 565                         if (hapd->conf->mesh & MESH_ENABLED) {
 566                                 /*
 567                                  * Send both Commit and Confirm immediately
 568                                  * based on SAE finite state machine
 569                                  * Nothing -> Confirm transition.
 570                                  */
 571                                 ret = auth_sae_send_confirm(hapd, sta, bssid);
 572                                 if (ret)
 573                                         return ret;
 574                                 sta->sae->state = SAE_CONFIRMED;
 575                         } else {
 576                                 /*
 577                                  * For infrastructure BSS, send only the Commit
 578                                  * message now to get alternating sequence of
 579                                  * Authentication frames between the AP and STA.
 580                                  * Confirm will be sent in
 581                                  * Commited -> Confirmed/Accepted transition
 582                                  * when receiving Confirm from STA.
 583                                  */
 584                         }
 585                         sta->sae->sync = 0;
 586                         sae_set_retransmit_timer(hapd, sta);
 587                 } else {
 588                         hostapd_logger(hapd, sta->addr,
 589                                        HOSTAPD_MODULE_IEEE80211,
 590                                        HOSTAPD_LEVEL_DEBUG,
 591                                        "SAE confirm before commit");
 592                 }
 593                 break;
 594         case SAE_COMMITTED:
 595                 sae_clear_retransmit_timer(hapd, sta);
 596                 if (auth_transaction == 1) {
 597                         if (sae_process_commit(sta->sae) < 0)
 598                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 599
 600                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 601                         if (ret)
 602                                 return ret;
 603                         sta->sae->state = SAE_CONFIRMED;
 604                         sta->sae->sync = 0;
 605                         sae_set_retransmit_timer(hapd, sta);
 606                 } else if (hapd->conf->mesh & MESH_ENABLED) {
 607                         /*
 608                          * In mesh case, follow SAE finite state machine and
 609                          * send Commit now, if sync count allows.
 610                          */
 611                         if (sae_check_big_sync(sta))
 612                                 return WLAN_STATUS_SUCCESS;
 613                         sta->sae->sync++;
 614
 615                         ret = auth_sae_send_commit(hapd, sta, bssid, 0);
 616                         if (ret)
 617                                 return ret;
 618
 619                         sae_set_retransmit_timer(hapd, sta);
 620                 } else {
 621                         /*
 622                          * For instructure BSS, send the postponed Confirm from
 623                          * Nothing -> Confirmed transition that was reduced to
 624                          * Nothing -> Committed above.
 625                          */
 626                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 627                         if (ret)
 628                                 return ret;
 629
 630                         sta->sae->state = SAE_CONFIRMED;
 631
 632                         /*
 633                          * Since this was triggered on Confirm RX, run another
 634                          * step to get to Accepted without waiting for
 635                          * additional events.
 636                          */
 637                         return sae_sm_step(hapd, sta, bssid, auth_transaction);
 638                 }
 639                 break;
 640         case SAE_CONFIRMED:
 641                 sae_clear_retransmit_timer(hapd, sta);
 642                 if (auth_transaction == 1) {
 643                         if (sae_check_big_sync(sta))
 644                                 return WLAN_STATUS_SUCCESS;
 645                         sta->sae->sync++;
 646
 647                         ret = auth_sae_send_commit(hapd, sta, bssid, 1);
 648                         if (ret)
 649                                 return ret;
 650
 651                         if (sae_process_commit(sta->sae) < 0)
 652                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 653
 654                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 655                         if (ret)
 656                                 return ret;
 657
 658                         sae_set_retransmit_timer(hapd, sta);
 659                 } else {
 660                         sta->flags |= WLAN_STA_AUTH;
 661                         sta->auth_alg = WLAN_AUTH_SAE;
 662                         mlme_authenticate_indication(hapd, sta);
 663                         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 664                         sta->sae->state = SAE_ACCEPTED;
 665                         wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
 666                                                sta->sae->pmk);
 667                 }
 668                 break;
 669         case SAE_ACCEPTED:
 670                 if (auth_transaction == 1) {
 671                         wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
 672                                    ") doing reauthentication",
 673                                    MAC2STR(sta->addr));
 674                         ap_free_sta(hapd, sta);
 675                 } else {
 676                         if (sae_check_big_sync(sta))
 677                                 return WLAN_STATUS_SUCCESS;
 678                         sta->sae->sync++;
 679
 680                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 681                         sae_clear_temp_data(sta->sae);
 682                         if (ret)
 683                                 return ret;
 684                 }
 685                 break;
 686         default:
 687                 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
 688                            sta->sae->state);
 689                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 690         }
 691         return WLAN_STATUS_SUCCESS;
 692 }
 693
 694
 695 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
 696                             const struct ieee80211_mgmt *mgmt, size_t len,
 697                             u16 auth_transaction, u16 status_code)
 698 {
 699         u16 resp = WLAN_STATUS_SUCCESS;
 700         struct wpabuf *data = NULL;
 701
 702         if (!sta->sae) {
 703                 if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS)
 704                         return;
 705                 sta->sae = os_zalloc(sizeof(*sta->sae));
 706                 if (sta->sae == NULL)
 707                         return;
 708                 sta->sae->state = SAE_NOTHING;
 709                 sta->sae->sync = 0;
 710         }
 711
 712         if (auth_transaction == 1) {
 713                 const u8 *token = NULL, *pos, *end;
 714                 size_t token_len = 0;
 715                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 716                                HOSTAPD_LEVEL_DEBUG,
 717                                "start SAE authentication (RX commit, status=%u)",
 718                                status_code);
 719
 720                 if ((hapd->conf->mesh & MESH_ENABLED) &&
 721                     status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
 722                     sta->sae->tmp) {
 723                         pos = mgmt->u.auth.variable;
 724                         end = ((const u8 *) mgmt) + len;
 725                         if (pos + sizeof(le16) > end) {
 726                                 wpa_printf(MSG_ERROR,
 727                                            "SAE: Too short anti-clogging token request");
 728                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 729                                 goto reply;
 730                         }
 731                         resp = sae_group_allowed(sta->sae,
 732                                                  hapd->conf->sae_groups,
 733                                                  WPA_GET_LE16(pos));
 734                         if (resp != WLAN_STATUS_SUCCESS) {
 735                                 wpa_printf(MSG_ERROR,
 736                                            "SAE: Invalid group in anti-clogging token request");
 737                                 goto reply;
 738                         }
 739                         pos += sizeof(le16);
 740
 741                         wpabuf_free(sta->sae->tmp->anti_clogging_token);
 742                         sta->sae->tmp->anti_clogging_token =
 743                                 wpabuf_alloc_copy(pos, end - pos);
 744                         if (sta->sae->tmp->anti_clogging_token == NULL) {
 745                                 wpa_printf(MSG_ERROR,
 746                                            "SAE: Failed to alloc for anti-clogging token");
 747                                 return;
 748                         }
 749
 750                         /*
 751                          * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
 752                          * is 76, a new Commit Message shall be constructed
 753                          * with the Anti-Clogging Token from the received
 754                          * Authentication frame, and the commit-scalar and
 755                          * COMMIT-ELEMENT previously sent.
 756                          */
 757                         if (auth_sae_send_commit(hapd, sta, mgmt->bssid, 0)) {
 758                                 wpa_printf(MSG_ERROR,
 759                                            "SAE: Failed to send commit message");
 760                                 return;
 761                         }
 762                         sta->sae->state = SAE_COMMITTED;
 763                         sta->sae->sync = 0;
 764                         sae_set_retransmit_timer(hapd, sta);
 765                         return;
 766                 }
 767
 768                 if (status_code != WLAN_STATUS_SUCCESS)
 769                         return;
 770
 771                 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
 772                                         ((const u8 *) mgmt) + len -
 773                                         mgmt->u.auth.variable, &token,
 774                                         &token_len, hapd->conf->sae_groups);
 775                 if (resp == SAE_SILENTLY_DISCARD) {
 776                         wpa_printf(MSG_DEBUG,
 777                                    "SAE: Drop commit message from " MACSTR " due to reflection attack",
 778                                    MAC2STR(sta->addr));
 779                         return;
 780                 }
 781                 if (token && check_sae_token(hapd, sta->addr, token, token_len)
 782                     < 0) {
 783                         wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
 784                                    "incorrect token from " MACSTR,
 785                                    MAC2STR(sta->addr));
 786                         return;
 787                 }
 788
 789                 if (resp != WLAN_STATUS_SUCCESS)
 790                         goto reply;
 791
 792                 if (!token && use_sae_anti_clogging(hapd)) {
 793                         wpa_printf(MSG_DEBUG,
 794                                    "SAE: Request anti-clogging token from "
 795                                    MACSTR, MAC2STR(sta->addr));
 796                         data = auth_build_token_req(hapd, sta->sae->group,
 797                                                     sta->addr);
 798                         resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
 799                         if (hapd->conf->mesh & MESH_ENABLED)
 800                                 sta->sae->state = SAE_NOTHING;
 801                         goto reply;
 802                 }
 803
 804                 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
 805         } else if (auth_transaction == 2) {
 806                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 807                                HOSTAPD_LEVEL_DEBUG,
 808                                "SAE authentication (RX confirm, status=%u)",
 809                                status_code);
 810                 if (status_code != WLAN_STATUS_SUCCESS)
 811                         return;
 812                 if (sta->sae->state >= SAE_CONFIRMED ||
 813                     !(hapd->conf->mesh & MESH_ENABLED)) {
 814                         if (sae_check_confirm(sta->sae, mgmt->u.auth.variable,
 815                                               ((u8 *) mgmt) + len -
 816                                               mgmt->u.auth.variable) < 0) {
 817                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 818                                 goto reply;
 819                         }
 820                 }
 821                 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
 822         } else {
 823                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 824                                HOSTAPD_LEVEL_DEBUG,
 825                                "unexpected SAE authentication transaction %u (status=%u)",
 826                                auth_transaction, status_code);
 827                 if (status_code != WLAN_STATUS_SUCCESS)
 828                         return;
 829                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 830         }
 831
 832 reply:
 833         if (resp != WLAN_STATUS_SUCCESS) {
 834                 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
 835                                 auth_transaction, resp,
 836                                 data ? wpabuf_head(data) : (u8 *) "",
 837                                 data ? wpabuf_len(data) : 0);
 838         }
 839         wpabuf_free(data);
 840 }
 841
 842
 843 /**
 844  * auth_sae_init_committed - Send COMMIT and start SAE in committed state
 845  * @hapd: BSS data for the device initiating the authentication
 846  * @sta: the peer to which commit authentication frame is sent
 847  *
 848  * This function implements Init event handling (IEEE Std 802.11-2012,
 849  * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
 850  * sta->sae structure should be initialized appropriately via a call to
 851  * sae_prepare_commit().
 852  */
 853 int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
 854 {
 855         int ret;
 856
 857         if (!sta->sae || !sta->sae->tmp)
 858                 return -1;
 859
 860         if (sta->sae->state != SAE_NOTHING)
 861                 return -1;
 862
 863         ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
 864         if (ret)
 865                 return -1;
 866
 867         sta->sae->state = SAE_COMMITTED;
 868         sta->sae->sync = 0;
 869         sae_set_retransmit_timer(hapd, sta);
 870
 871         return 0;
 872 }
 873
 874 #endif /* CONFIG_SAE */
 875
 876
 877 static void handle_auth(struct hostapd_data *hapd,
 878                         const struct ieee80211_mgmt *mgmt, size_t len)
 879 {
 880         u16 auth_alg, auth_transaction, status_code;
 881         u16 resp = WLAN_STATUS_SUCCESS;
 882         struct sta_info *sta = NULL;
 883         int res;
 884         u16 fc;
 885         const u8 *challenge = NULL;
 886         u32 session_timeout, acct_interim_interval;
 887         int vlan_id = 0;
 888         struct hostapd_sta_wpa_psk_short *psk = NULL;
 889         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 890         size_t resp_ies_len = 0;
 891         char *identity = NULL;
 892         char *radius_cui = NULL;
 893         u16 seq_ctrl;
 894
 895         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 896                 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
 897                            (unsigned long) len);
 898                 return;
 899         }
 900
 901 #ifdef CONFIG_TESTING_OPTIONS
 902         if (hapd->iconf->ignore_auth_probability > 0.0 &&
 903             drand48() < hapd->iconf->ignore_auth_probability) {
 904                 wpa_printf(MSG_INFO,
 905                            "TESTING: ignoring auth frame from " MACSTR,
 906                            MAC2STR(mgmt->sa));
 907                 return;
 908         }
 909 #endif /* CONFIG_TESTING_OPTIONS */
 910
 911         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 912         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 913         status_code = le_to_host16(mgmt->u.auth.status_code);
 914         fc = le_to_host16(mgmt->frame_control);
 915         seq_ctrl = le_to_host16(mgmt->seq_ctrl);
 916
 917         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 918             2 + WLAN_AUTH_CHALLENGE_LEN &&
 919             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 920             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 921                 challenge = &mgmt->u.auth.variable[2];
 922
 923         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 924                    "auth_transaction=%d status_code=%d wep=%d%s "
 925                    "seq_ctrl=0x%x%s",
 926                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 927                    status_code, !!(fc & WLAN_FC_ISWEP),
 928                    challenge ? " challenge" : "",
 929                    seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
 930
 931 #ifdef CONFIG_NO_RC4
 932         if (auth_alg == WLAN_AUTH_SHARED_KEY) {
 933                 wpa_printf(MSG_INFO,
 934                            "Unsupported authentication algorithm (%d)",
 935                            auth_alg);
 936                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 937                 goto fail;
 938         }
 939 #endif /* CONFIG_NO_RC4 */
 940
 941         if (hapd->tkip_countermeasures) {
 942                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 943                 goto fail;
 944         }
 945
 946         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 947                auth_alg == WLAN_AUTH_OPEN) ||
 948 #ifdef CONFIG_IEEE80211R
 949               (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 950                auth_alg == WLAN_AUTH_FT) ||
 951 #endif /* CONFIG_IEEE80211R */
 952 #ifdef CONFIG_SAE
 953               (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
 954                auth_alg == WLAN_AUTH_SAE) ||
 955 #endif /* CONFIG_SAE */
 956               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 957                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 958                 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
 959                            auth_alg);
 960                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 961                 goto fail;
 962         }
 963
 964         if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
 965               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 966                 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
 967                            auth_transaction);
 968                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 969                 goto fail;
 970         }
 971
 972         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 973                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
 974                            MAC2STR(mgmt->sa));
 975                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 976                 goto fail;
 977         }
 978
 979         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 980                                       &session_timeout,
 981                                       &acct_interim_interval, &vlan_id,
 982                                       &psk, &identity, &radius_cui);
 983
 984         if (res == HOSTAPD_ACL_REJECT) {
 985                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
 986                            MAC2STR(mgmt->sa));
 987                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 988                 goto fail;
 989         }
 990         if (res == HOSTAPD_ACL_PENDING) {
 991                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 992                            " waiting for an external authentication",
 993                            MAC2STR(mgmt->sa));
 994                 /* Authentication code will re-send the authentication frame
 995                  * after it has received (and cached) information from the
 996                  * external source. */
 997                 return;
 998         }
 999
1000         sta = ap_get_sta(hapd, mgmt->sa);
1001         if (sta) {
1002                 if ((fc & WLAN_FC_RETRY) &&
1003                     sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1004                     sta->last_seq_ctrl == seq_ctrl &&
1005                     sta->last_subtype == WLAN_FC_STYPE_AUTH) {
1006                         hostapd_logger(hapd, sta->addr,
1007                                        HOSTAPD_MODULE_IEEE80211,
1008                                        HOSTAPD_LEVEL_DEBUG,
1009                                        "Drop repeated authentication frame seq_ctrl=0x%x",
1010                                        seq_ctrl);
1011                         return;
1012                 }
1013         } else {
1014 #ifdef CONFIG_MESH
1015                 if (hapd->conf->mesh & MESH_ENABLED) {
1016                         /* if the mesh peer is not available, we don't do auth.
1017                          */
1018                         wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1019                                    " not yet known - drop Authentiation frame",
1020                                    MAC2STR(mgmt->sa));
1021                         /*
1022                          * Save a copy of the frame so that it can be processed
1023                          * if a new peer entry is added shortly after this.
1024                          */
1025                         wpabuf_free(hapd->mesh_pending_auth);
1026                         hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
1027                         os_get_reltime(&hapd->mesh_pending_auth_time);
1028                         return;
1029                 }
1030 #endif /* CONFIG_MESH */
1031
1032                 sta = ap_sta_add(hapd, mgmt->sa);
1033                 if (!sta) {
1034                         resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1035                         goto fail;
1036                 }
1037         }
1038         sta->last_seq_ctrl = seq_ctrl;
1039         sta->last_subtype = WLAN_FC_STYPE_AUTH;
1040
1041         if (vlan_id > 0) {
1042                 if (!hostapd_vlan_id_valid(hapd->conf->vlan, vlan_id)) {
1043                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1044                                        HOSTAPD_LEVEL_INFO, "Invalid VLAN ID "
1045                                        "%d received from RADIUS server",
1046                                        vlan_id);
1047                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1048                         goto fail;
1049                 }
1050                 sta->vlan_id = vlan_id;
1051                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1052                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1053         }
1054
1055         hostapd_free_psk_list(sta->psk);
1056         if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1057                 sta->psk = psk;
1058                 psk = NULL;
1059         } else {
1060                 sta->psk = NULL;
1061         }
1062
1063         sta->identity = identity;
1064         identity = NULL;
1065         sta->radius_cui = radius_cui;
1066         radius_cui = NULL;
1067
1068         sta->flags &= ~WLAN_STA_PREAUTH;
1069         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
1070
1071         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
1072                 sta->acct_interim_interval = acct_interim_interval;
1073         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
1074                 ap_sta_session_timeout(hapd, sta, session_timeout);
1075         else
1076                 ap_sta_no_session_timeout(hapd, sta);
1077
1078         switch (auth_alg) {
1079         case WLAN_AUTH_OPEN:
1080                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1081                                HOSTAPD_LEVEL_DEBUG,
1082                                "authentication OK (open system)");
1083                 sta->flags |= WLAN_STA_AUTH;
1084                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1085                 sta->auth_alg = WLAN_AUTH_OPEN;
1086                 mlme_authenticate_indication(hapd, sta);
1087                 break;
1088 #ifndef CONFIG_NO_RC4
1089         case WLAN_AUTH_SHARED_KEY:
1090                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
1091                                        fc & WLAN_FC_ISWEP);
1092                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
1093                 mlme_authenticate_indication(hapd, sta);
1094                 if (sta->challenge && auth_transaction == 1) {
1095                         resp_ies[0] = WLAN_EID_CHALLENGE;
1096                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
1097                         os_memcpy(resp_ies + 2, sta->challenge,
1098                                   WLAN_AUTH_CHALLENGE_LEN);
1099                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
1100                 }
1101                 break;
1102 #endif /* CONFIG_NO_RC4 */
1103 #ifdef CONFIG_IEEE80211R
1104         case WLAN_AUTH_FT:
1105                 sta->auth_alg = WLAN_AUTH_FT;
1106                 if (sta->wpa_sm == NULL)
1107                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1108                                                         sta->addr, NULL);
1109                 if (sta->wpa_sm == NULL) {
1110                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
1111                                    "state machine");
1112                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1113                         goto fail;
1114                 }
1115                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
1116                                     auth_transaction, mgmt->u.auth.variable,
1117                                     len - IEEE80211_HDRLEN -
1118                                     sizeof(mgmt->u.auth),
1119                                     handle_auth_ft_finish, hapd);
1120                 /* handle_auth_ft_finish() callback will complete auth. */
1121                 return;
1122 #endif /* CONFIG_IEEE80211R */
1123 #ifdef CONFIG_SAE
1124         case WLAN_AUTH_SAE:
1125 #ifdef CONFIG_MESH
1126                 if (status_code == WLAN_STATUS_SUCCESS &&
1127                     hapd->conf->mesh & MESH_ENABLED) {
1128                         if (sta->wpa_sm == NULL)
1129                                 sta->wpa_sm =
1130                                         wpa_auth_sta_init(hapd->wpa_auth,
1131                                                           sta->addr, NULL);
1132                         if (sta->wpa_sm == NULL) {
1133                                 wpa_printf(MSG_DEBUG,
1134                                            "SAE: Failed to initialize WPA state machine");
1135                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1136                                 goto fail;
1137                         }
1138                 }
1139 #endif /* CONFIG_MESH */
1140                 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
1141                                 status_code);
1142                 return;
1143 #endif /* CONFIG_SAE */
1144         }
1145
1146  fail:
1147         os_free(identity);
1148         os_free(radius_cui);
1149         hostapd_free_psk_list(psk);
1150
1151         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
1152                         auth_transaction + 1, resp, resp_ies, resp_ies_len);
1153 }
1154
1155
1156 static int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
1157 {
1158         int i, j = 32, aid;
1159
1160         /* get a unique AID */
1161         if (sta->aid > 0) {
1162                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
1163                 return 0;
1164         }
1165
1166         for (i = 0; i < AID_WORDS; i++) {
1167                 if (hapd->sta_aid[i] == (u32) -1)
1168                         continue;
1169                 for (j = 0; j < 32; j++) {
1170                         if (!(hapd->sta_aid[i] & BIT(j)))
1171                                 break;
1172                 }
1173                 if (j < 32)
1174                         break;
1175         }
1176         if (j == 32)
1177                 return -1;
1178         aid = i * 32 + j + 1;
1179         if (aid > 2007)
1180                 return -1;
1181
1182         sta->aid = aid;
1183         hapd->sta_aid[i] |= BIT(j);
1184         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
1185         return 0;
1186 }
1187
1188
1189 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
1190                       const u8 *ssid_ie, size_t ssid_ie_len)
1191 {
1192         if (ssid_ie == NULL)
1193                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1194
1195         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
1196             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
1197                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1198                                HOSTAPD_LEVEL_INFO,
1199                                "Station tried to associate with unknown SSID "
1200                                "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
1201                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1202         }
1203
1204         return WLAN_STATUS_SUCCESS;
1205 }
1206
1207
1208 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
1209                      const u8 *wmm_ie, size_t wmm_ie_len)
1210 {
1211         sta->flags &= ~WLAN_STA_WMM;
1212         sta->qosinfo = 0;
1213         if (wmm_ie && hapd->conf->wmm_enabled) {
1214                 struct wmm_information_element *wmm;
1215
1216                 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
1217                         hostapd_logger(hapd, sta->addr,
1218                                        HOSTAPD_MODULE_WPA,
1219                                        HOSTAPD_LEVEL_DEBUG,
1220                                        "invalid WMM element in association "
1221                                        "request");
1222                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1223                 }
1224
1225                 sta->flags |= WLAN_STA_WMM;
1226                 wmm = (struct wmm_information_element *) wmm_ie;
1227                 sta->qosinfo = wmm->qos_info;
1228         }
1229         return WLAN_STATUS_SUCCESS;
1230 }
1231
1232
1233 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
1234                            struct ieee802_11_elems *elems)
1235 {
1236         if (!elems->supp_rates) {
1237                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1238                                HOSTAPD_LEVEL_DEBUG,
1239                                "No supported rates element in AssocReq");
1240                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1241         }
1242
1243         if (elems->supp_rates_len + elems->ext_supp_rates_len >
1244             sizeof(sta->supported_rates)) {
1245                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1246                                HOSTAPD_LEVEL_DEBUG,
1247                                "Invalid supported rates element length %d+%d",
1248                                elems->supp_rates_len,
1249                                elems->ext_supp_rates_len);
1250                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1251         }
1252
1253         sta->supported_rates_len = merge_byte_arrays(
1254                 sta->supported_rates, sizeof(sta->supported_rates),
1255                 elems->supp_rates, elems->supp_rates_len,
1256                 elems->ext_supp_rates, elems->ext_supp_rates_len);
1257
1258         return WLAN_STATUS_SUCCESS;
1259 }
1260
1261
1262 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
1263                            const u8 *ext_capab_ie, size_t ext_capab_ie_len)
1264 {
1265 #ifdef CONFIG_INTERWORKING
1266         /* check for QoS Map support */
1267         if (ext_capab_ie_len >= 5) {
1268                 if (ext_capab_ie[4] & 0x01)
1269                         sta->qos_map_enabled = 1;
1270         }
1271 #endif /* CONFIG_INTERWORKING */
1272
1273         return WLAN_STATUS_SUCCESS;
1274 }
1275
1276
1277 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
1278                            const u8 *ies, size_t ies_len, int reassoc)
1279 {
1280         struct ieee802_11_elems elems;
1281         u16 resp;
1282         const u8 *wpa_ie;
1283         size_t wpa_ie_len;
1284         const u8 *p2p_dev_addr = NULL;
1285
1286         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
1287                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1288                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
1289                                "association request");
1290                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1291         }
1292
1293         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
1294         if (resp != WLAN_STATUS_SUCCESS)
1295                 return resp;
1296         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
1297         if (resp != WLAN_STATUS_SUCCESS)
1298                 return resp;
1299         resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
1300         if (resp != WLAN_STATUS_SUCCESS)
1301                 return resp;
1302         resp = copy_supp_rates(hapd, sta, &elems);
1303         if (resp != WLAN_STATUS_SUCCESS)
1304                 return resp;
1305 #ifdef CONFIG_IEEE80211N
1306         resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
1307         if (resp != WLAN_STATUS_SUCCESS)
1308                 return resp;
1309         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
1310             !(sta->flags & WLAN_STA_HT)) {
1311                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1312                                HOSTAPD_LEVEL_INFO, "Station does not support "
1313                                "mandatory HT PHY - reject association");
1314                 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
1315         }
1316 #endif /* CONFIG_IEEE80211N */
1317
1318 #ifdef CONFIG_IEEE80211AC
1319         resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
1320         if (resp != WLAN_STATUS_SUCCESS)
1321                 return resp;
1322
1323         resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
1324         if (resp != WLAN_STATUS_SUCCESS)
1325                 return resp;
1326
1327         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
1328             !(sta->flags & WLAN_STA_VHT)) {
1329                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1330                                HOSTAPD_LEVEL_INFO, "Station does not support "
1331                                "mandatory VHT PHY - reject association");
1332                 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
1333         }
1334
1335         if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
1336                 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
1337                                            elems.vendor_vht_len);
1338                 if (resp != WLAN_STATUS_SUCCESS)
1339                         return resp;
1340         }
1341 #endif /* CONFIG_IEEE80211AC */
1342
1343 #ifdef CONFIG_P2P
1344         if (elems.p2p) {
1345                 wpabuf_free(sta->p2p_ie);
1346                 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1347                                                           P2P_IE_VENDOR_TYPE);
1348                 if (sta->p2p_ie)
1349                         p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
1350         } else {
1351                 wpabuf_free(sta->p2p_ie);
1352                 sta->p2p_ie = NULL;
1353         }
1354 #endif /* CONFIG_P2P */
1355
1356         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
1357                 wpa_ie = elems.rsn_ie;
1358                 wpa_ie_len = elems.rsn_ie_len;
1359         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
1360                    elems.wpa_ie) {
1361                 wpa_ie = elems.wpa_ie;
1362                 wpa_ie_len = elems.wpa_ie_len;
1363         } else {
1364                 wpa_ie = NULL;
1365                 wpa_ie_len = 0;
1366         }
1367
1368 #ifdef CONFIG_WPS
1369         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
1370         if (hapd->conf->wps_state && elems.wps_ie) {
1371                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
1372                            "Request - assume WPS is used");
1373                 sta->flags |= WLAN_STA_WPS;
1374                 wpabuf_free(sta->wps_ie);
1375                 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1376                                                           WPS_IE_VENDOR_TYPE);
1377                 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
1378                         wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
1379                         sta->flags |= WLAN_STA_WPS2;
1380                 }
1381                 wpa_ie = NULL;
1382                 wpa_ie_len = 0;
1383                 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
1384                         wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
1385                                    "(Re)Association Request - reject");
1386                         return WLAN_STATUS_INVALID_IE;
1387                 }
1388         } else if (hapd->conf->wps_state && wpa_ie == NULL) {
1389                 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
1390                            "(Re)Association Request - possible WPS use");
1391                 sta->flags |= WLAN_STA_MAYBE_WPS;
1392         } else
1393 #endif /* CONFIG_WPS */
1394         if (hapd->conf->wpa && wpa_ie == NULL) {
1395                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1396                                HOSTAPD_LEVEL_INFO,
1397                                "No WPA/RSN IE in association request");
1398                 return WLAN_STATUS_INVALID_IE;
1399         }
1400
1401         if (hapd->conf->wpa && wpa_ie) {
1402                 int res;
1403                 wpa_ie -= 2;
1404                 wpa_ie_len += 2;
1405                 if (sta->wpa_sm == NULL)
1406                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1407                                                         sta->addr,
1408                                                         p2p_dev_addr);
1409                 if (sta->wpa_sm == NULL) {
1410                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1411                                    "state machine");
1412                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1413                 }
1414                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1415                                           wpa_ie, wpa_ie_len,
1416                                           elems.mdie, elems.mdie_len);
1417                 if (res == WPA_INVALID_GROUP)
1418                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1419                 else if (res == WPA_INVALID_PAIRWISE)
1420                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1421                 else if (res == WPA_INVALID_AKMP)
1422                         resp = WLAN_STATUS_AKMP_NOT_VALID;
1423                 else if (res == WPA_ALLOC_FAIL)
1424                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1425 #ifdef CONFIG_IEEE80211W
1426                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1427                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1428                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1429                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1430 #endif /* CONFIG_IEEE80211W */
1431                 else if (res == WPA_INVALID_MDIE)
1432                         resp = WLAN_STATUS_INVALID_MDIE;
1433                 else if (res != WPA_IE_OK)
1434                         resp = WLAN_STATUS_INVALID_IE;
1435                 if (resp != WLAN_STATUS_SUCCESS)
1436                         return resp;
1437 #ifdef CONFIG_IEEE80211W
1438                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1439                     sta->sa_query_count > 0)
1440                         ap_check_sa_query_timeout(hapd, sta);
1441                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1442                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
1443                         /*
1444                          * STA has already been associated with MFP and SA
1445                          * Query timeout has not been reached. Reject the
1446                          * association attempt temporarily and start SA Query,
1447                          * if one is not pending.
1448                          */
1449
1450                         if (sta->sa_query_count == 0)
1451                                 ap_sta_start_sa_query(hapd, sta);
1452
1453                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
1454                 }
1455
1456                 if (wpa_auth_uses_mfp(sta->wpa_sm))
1457                         sta->flags |= WLAN_STA_MFP;
1458                 else
1459                         sta->flags &= ~WLAN_STA_MFP;
1460 #endif /* CONFIG_IEEE80211W */
1461
1462 #ifdef CONFIG_IEEE80211R
1463                 if (sta->auth_alg == WLAN_AUTH_FT) {
1464                         if (!reassoc) {
1465                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
1466                                            "to use association (not "
1467                                            "re-association) with FT auth_alg",
1468                                            MAC2STR(sta->addr));
1469                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1470                         }
1471
1472                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
1473                                                        ies_len);
1474                         if (resp != WLAN_STATUS_SUCCESS)
1475                                 return resp;
1476                 }
1477 #endif /* CONFIG_IEEE80211R */
1478
1479 #ifdef CONFIG_SAE
1480                 if (wpa_auth_uses_sae(sta->wpa_sm) &&
1481                     sta->auth_alg == WLAN_AUTH_OPEN) {
1482                         struct rsn_pmksa_cache_entry *sa;
1483                         sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1484                         if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
1485                                 wpa_printf(MSG_DEBUG,
1486                                            "SAE: No PMKSA cache entry found for "
1487                                            MACSTR, MAC2STR(sta->addr));
1488                                 return WLAN_STATUS_INVALID_PMKID;
1489                         }
1490                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR
1491                                    " using PMKSA caching", MAC2STR(sta->addr));
1492                 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
1493                            sta->auth_alg != WLAN_AUTH_SAE &&
1494                            !(sta->auth_alg == WLAN_AUTH_FT &&
1495                              wpa_auth_uses_ft_sae(sta->wpa_sm))) {
1496                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
1497                                    "SAE AKM after non-SAE auth_alg %u",
1498                                    MAC2STR(sta->addr), sta->auth_alg);
1499                         return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1500                 }
1501 #endif /* CONFIG_SAE */
1502
1503 #ifdef CONFIG_IEEE80211N
1504                 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
1505                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
1506                         hostapd_logger(hapd, sta->addr,
1507                                        HOSTAPD_MODULE_IEEE80211,
1508                                        HOSTAPD_LEVEL_INFO,
1509                                        "Station tried to use TKIP with HT "
1510                                        "association");
1511                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1512                 }
1513 #endif /* CONFIG_IEEE80211N */
1514 #ifdef CONFIG_HS20
1515         } else if (hapd->conf->osen) {
1516                 if (elems.osen == NULL) {
1517                         hostapd_logger(
1518                                 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1519                                 HOSTAPD_LEVEL_INFO,
1520                                 "No HS 2.0 OSEN element in association request");
1521                         return WLAN_STATUS_INVALID_IE;
1522                 }
1523
1524                 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
1525                 if (sta->wpa_sm == NULL)
1526                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1527                                                         sta->addr, NULL);
1528                 if (sta->wpa_sm == NULL) {
1529                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1530                                    "state machine");
1531                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1532                 }
1533                 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
1534                                       elems.osen - 2, elems.osen_len + 2) < 0)
1535                         return WLAN_STATUS_INVALID_IE;
1536 #endif /* CONFIG_HS20 */
1537         } else
1538                 wpa_auth_sta_no_wpa(sta->wpa_sm);
1539
1540 #ifdef CONFIG_P2P
1541         p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
1542 #endif /* CONFIG_P2P */
1543
1544 #ifdef CONFIG_HS20
1545         wpabuf_free(sta->hs20_ie);
1546         if (elems.hs20 && elems.hs20_len > 4) {
1547                 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
1548                                                  elems.hs20_len - 4);
1549         } else
1550                 sta->hs20_ie = NULL;
1551 #endif /* CONFIG_HS20 */
1552
1553 #ifdef CONFIG_FST
1554         wpabuf_free(sta->mb_ies);
1555         if (hapd->iface->fst)
1556                 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
1557         else
1558                 sta->mb_ies = NULL;
1559 #endif /* CONFIG_FST */
1560
1561         return WLAN_STATUS_SUCCESS;
1562 }
1563
1564
1565 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
1566                         u16 reason_code)
1567 {
1568         int send_len;
1569         struct ieee80211_mgmt reply;
1570
1571         os_memset(&reply, 0, sizeof(reply));
1572         reply.frame_control =
1573                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
1574         os_memcpy(reply.da, addr, ETH_ALEN);
1575         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
1576         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
1577
1578         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
1579         reply.u.deauth.reason_code = host_to_le16(reason_code);
1580
1581         if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
1582                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
1583                            strerror(errno));
1584 }
1585
1586
1587 static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1588                             u16 status_code, int reassoc, const u8 *ies,
1589                             size_t ies_len)
1590 {
1591         int send_len;
1592         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1593         struct ieee80211_mgmt *reply;
1594         u8 *p;
1595
1596         os_memset(buf, 0, sizeof(buf));
1597         reply = (struct ieee80211_mgmt *) buf;
1598         reply->frame_control =
1599                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1600                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1601                               WLAN_FC_STYPE_ASSOC_RESP));
1602         os_memcpy(reply->da, sta->addr, ETH_ALEN);
1603         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1604         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1605
1606         send_len = IEEE80211_HDRLEN;
1607         send_len += sizeof(reply->u.assoc_resp);
1608         reply->u.assoc_resp.capab_info =
1609                 host_to_le16(hostapd_own_capab_info(hapd));
1610         reply->u.assoc_resp.status_code = host_to_le16(status_code);
1611         reply->u.assoc_resp.aid = host_to_le16(sta->aid | BIT(14) | BIT(15));
1612         /* Supported rates */
1613         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1614         /* Extended supported rates */
1615         p = hostapd_eid_ext_supp_rates(hapd, p);
1616
1617 #ifdef CONFIG_IEEE80211R
1618         if (status_code == WLAN_STATUS_SUCCESS) {
1619                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1620                  * Transition Information, RSN, [RIC Response] */
1621                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1622                                                 buf + sizeof(buf) - p,
1623                                                 sta->auth_alg, ies, ies_len);
1624         }
1625 #endif /* CONFIG_IEEE80211R */
1626
1627 #ifdef CONFIG_IEEE80211W
1628         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1629                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1630 #endif /* CONFIG_IEEE80211W */
1631
1632 #ifdef CONFIG_IEEE80211N
1633         p = hostapd_eid_ht_capabilities(hapd, p);
1634         p = hostapd_eid_ht_operation(hapd, p);
1635 #endif /* CONFIG_IEEE80211N */
1636
1637 #ifdef CONFIG_IEEE80211AC
1638         if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
1639                 p = hostapd_eid_vht_capabilities(hapd, p);
1640                 p = hostapd_eid_vht_operation(hapd, p);
1641         }
1642 #endif /* CONFIG_IEEE80211AC */
1643
1644         p = hostapd_eid_ext_capab(hapd, p);
1645         p = hostapd_eid_bss_max_idle_period(hapd, p);
1646         if (sta->qos_map_enabled)
1647                 p = hostapd_eid_qos_map_set(hapd, p);
1648
1649 #ifdef CONFIG_FST
1650         if (hapd->iface->fst_ies) {
1651                 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
1652                           wpabuf_len(hapd->iface->fst_ies));
1653                 p += wpabuf_len(hapd->iface->fst_ies);
1654         }
1655 #endif /* CONFIG_FST */
1656
1657 #ifdef CONFIG_IEEE80211AC
1658         if (hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
1659                 p = hostapd_eid_vendor_vht(hapd, p);
1660 #endif /* CONFIG_IEEE80211AC */
1661
1662         if (sta->flags & WLAN_STA_WMM)
1663                 p = hostapd_eid_wmm(hapd, p);
1664
1665 #ifdef CONFIG_WPS
1666         if ((sta->flags & WLAN_STA_WPS) ||
1667             ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa)) {
1668                 struct wpabuf *wps = wps_build_assoc_resp_ie();
1669                 if (wps) {
1670                         os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
1671                         p += wpabuf_len(wps);
1672                         wpabuf_free(wps);
1673                 }
1674         }
1675 #endif /* CONFIG_WPS */
1676
1677 #ifdef CONFIG_P2P
1678         if (sta->p2p_ie) {
1679                 struct wpabuf *p2p_resp_ie;
1680                 enum p2p_status_code status;
1681                 switch (status_code) {
1682                 case WLAN_STATUS_SUCCESS:
1683                         status = P2P_SC_SUCCESS;
1684                         break;
1685                 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
1686                         status = P2P_SC_FAIL_LIMIT_REACHED;
1687                         break;
1688                 default:
1689                         status = P2P_SC_FAIL_INVALID_PARAMS;
1690                         break;
1691                 }
1692                 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
1693                 if (p2p_resp_ie) {
1694                         os_memcpy(p, wpabuf_head(p2p_resp_ie),
1695                                   wpabuf_len(p2p_resp_ie));
1696                         p += wpabuf_len(p2p_resp_ie);
1697                         wpabuf_free(p2p_resp_ie);
1698                 }
1699         }
1700 #endif /* CONFIG_P2P */
1701
1702 #ifdef CONFIG_P2P_MANAGER
1703         if (hapd->conf->p2p & P2P_MANAGE)
1704                 p = hostapd_eid_p2p_manage(hapd, p);
1705 #endif /* CONFIG_P2P_MANAGER */
1706
1707         send_len += p - reply->u.assoc_resp.variable;
1708
1709         if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0)
1710                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
1711                            strerror(errno));
1712 }
1713
1714
1715 static void handle_assoc(struct hostapd_data *hapd,
1716                          const struct ieee80211_mgmt *mgmt, size_t len,
1717                          int reassoc)
1718 {
1719         u16 capab_info, listen_interval, seq_ctrl, fc;
1720         u16 resp = WLAN_STATUS_SUCCESS;
1721         const u8 *pos;
1722         int left, i;
1723         struct sta_info *sta;
1724
1725         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1726                                       sizeof(mgmt->u.assoc_req))) {
1727                 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
1728                            reassoc, (unsigned long) len);
1729                 return;
1730         }
1731
1732 #ifdef CONFIG_TESTING_OPTIONS
1733         if (reassoc) {
1734                 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
1735                     drand48() < hapd->iconf->ignore_reassoc_probability) {
1736                         wpa_printf(MSG_INFO,
1737                                    "TESTING: ignoring reassoc request from "
1738                                    MACSTR, MAC2STR(mgmt->sa));
1739                         return;
1740                 }
1741         } else {
1742                 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
1743                     drand48() < hapd->iconf->ignore_assoc_probability) {
1744                         wpa_printf(MSG_INFO,
1745                                    "TESTING: ignoring assoc request from "
1746                                    MACSTR, MAC2STR(mgmt->sa));
1747                         return;
1748                 }
1749         }
1750 #endif /* CONFIG_TESTING_OPTIONS */
1751
1752         fc = le_to_host16(mgmt->frame_control);
1753         seq_ctrl = le_to_host16(mgmt->seq_ctrl);
1754
1755         if (reassoc) {
1756                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
1757                 listen_interval = le_to_host16(
1758                         mgmt->u.reassoc_req.listen_interval);
1759                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
1760                            " capab_info=0x%02x listen_interval=%d current_ap="
1761                            MACSTR " seq_ctrl=0x%x%s",
1762                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1763                            MAC2STR(mgmt->u.reassoc_req.current_ap),
1764                            seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1765                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
1766                 pos = mgmt->u.reassoc_req.variable;
1767         } else {
1768                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
1769                 listen_interval = le_to_host16(
1770                         mgmt->u.assoc_req.listen_interval);
1771                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
1772                            " capab_info=0x%02x listen_interval=%d "
1773                            "seq_ctrl=0x%x%s",
1774                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1775                            seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1776                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
1777                 pos = mgmt->u.assoc_req.variable;
1778         }
1779
1780         sta = ap_get_sta(hapd, mgmt->sa);
1781 #ifdef CONFIG_IEEE80211R
1782         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
1783             (sta->flags & WLAN_STA_AUTH) == 0) {
1784                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
1785                            "prior to authentication since it is using "
1786                            "over-the-DS FT", MAC2STR(mgmt->sa));
1787         } else
1788 #endif /* CONFIG_IEEE80211R */
1789         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
1790                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1791                                HOSTAPD_LEVEL_INFO, "Station tried to "
1792                                "associate before authentication "
1793                                "(aid=%d flags=0x%x)",
1794                                sta ? sta->aid : -1,
1795                                sta ? sta->flags : 0);
1796                 send_deauth(hapd, mgmt->sa,
1797                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
1798                 return;
1799         }
1800
1801         if ((fc & WLAN_FC_RETRY) &&
1802             sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1803             sta->last_seq_ctrl == seq_ctrl &&
1804             sta->last_subtype == reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
1805             WLAN_FC_STYPE_ASSOC_REQ) {
1806                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1807                                HOSTAPD_LEVEL_DEBUG,
1808                                "Drop repeated association frame seq_ctrl=0x%x",
1809                                seq_ctrl);
1810                 return;
1811         }
1812         sta->last_seq_ctrl = seq_ctrl;
1813         sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
1814                 WLAN_FC_STYPE_ASSOC_REQ;
1815
1816         if (hapd->tkip_countermeasures) {
1817                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
1818                 goto fail;
1819         }
1820
1821         if (listen_interval > hapd->conf->max_listen_interval) {
1822                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1823                                HOSTAPD_LEVEL_DEBUG,
1824                                "Too large Listen Interval (%d)",
1825                                listen_interval);
1826                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
1827                 goto fail;
1828         }
1829
1830         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
1831          * is used */
1832         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
1833         if (resp != WLAN_STATUS_SUCCESS)
1834                 goto fail;
1835
1836         if (hostapd_get_aid(hapd, sta) < 0) {
1837                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1838                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
1839                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1840                 goto fail;
1841         }
1842
1843         sta->capability = capab_info;
1844         sta->listen_interval = listen_interval;
1845
1846         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
1847                 sta->flags |= WLAN_STA_NONERP;
1848         for (i = 0; i < sta->supported_rates_len; i++) {
1849                 if ((sta->supported_rates[i] & 0x7f) > 22) {
1850                         sta->flags &= ~WLAN_STA_NONERP;
1851                         break;
1852                 }
1853         }
1854         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
1855                 sta->nonerp_set = 1;
1856                 hapd->iface->num_sta_non_erp++;
1857                 if (hapd->iface->num_sta_non_erp == 1)
1858                         ieee802_11_set_beacons(hapd->iface);
1859         }
1860
1861         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
1862             !sta->no_short_slot_time_set) {
1863                 sta->no_short_slot_time_set = 1;
1864                 hapd->iface->num_sta_no_short_slot_time++;
1865                 if (hapd->iface->current_mode->mode ==
1866                     HOSTAPD_MODE_IEEE80211G &&
1867                     hapd->iface->num_sta_no_short_slot_time == 1)
1868                         ieee802_11_set_beacons(hapd->iface);
1869         }
1870
1871         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
1872                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
1873         else
1874                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
1875
1876         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
1877             !sta->no_short_preamble_set) {
1878                 sta->no_short_preamble_set = 1;
1879                 hapd->iface->num_sta_no_short_preamble++;
1880                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
1881                     && hapd->iface->num_sta_no_short_preamble == 1)
1882                         ieee802_11_set_beacons(hapd->iface);
1883         }
1884
1885 #ifdef CONFIG_IEEE80211N
1886         update_ht_state(hapd, sta);
1887 #endif /* CONFIG_IEEE80211N */
1888
1889         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1890                        HOSTAPD_LEVEL_DEBUG,
1891                        "association OK (aid %d)", sta->aid);
1892         /* Station will be marked associated, after it acknowledges AssocResp
1893          */
1894         sta->flags |= WLAN_STA_ASSOC_REQ_OK;
1895
1896 #ifdef CONFIG_IEEE80211W
1897         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
1898                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
1899                            "SA Query procedure", reassoc ? "re" : "");
1900                 /* TODO: Send a protected Disassociate frame to the STA using
1901                  * the old key and Reason Code "Previous Authentication no
1902                  * longer valid". Make sure this is only sent protected since
1903                  * unprotected frame would be received by the STA that is now
1904                  * trying to associate.
1905                  */
1906         }
1907 #endif /* CONFIG_IEEE80211W */
1908
1909         /* Make sure that the previously registered inactivity timer will not
1910          * remove the STA immediately. */
1911         sta->timeout_next = STA_NULLFUNC;
1912
1913  fail:
1914         send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
1915 }
1916
1917
1918 static void handle_disassoc(struct hostapd_data *hapd,
1919                             const struct ieee80211_mgmt *mgmt, size_t len)
1920 {
1921         struct sta_info *sta;
1922
1923         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
1924                 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
1925                            (unsigned long) len);
1926                 return;
1927         }
1928
1929         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
1930                    MAC2STR(mgmt->sa),
1931                    le_to_host16(mgmt->u.disassoc.reason_code));
1932
1933         sta = ap_get_sta(hapd, mgmt->sa);
1934         if (sta == NULL) {
1935                 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
1936                            MAC2STR(mgmt->sa));
1937                 return;
1938         }
1939
1940         ap_sta_set_authorized(hapd, sta, 0);
1941         sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
1942         sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
1943         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
1944         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1945                        HOSTAPD_LEVEL_INFO, "disassociated");
1946         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1947         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1948         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
1949          * authenticated. */
1950         accounting_sta_stop(hapd, sta);
1951         ieee802_1x_free_station(sta);
1952         if (sta->ipaddr)
1953                 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
1954         ap_sta_ip6addr_del(hapd, sta);
1955         hostapd_drv_sta_remove(hapd, sta->addr);
1956
1957         if (sta->timeout_next == STA_NULLFUNC ||
1958             sta->timeout_next == STA_DISASSOC) {
1959                 sta->timeout_next = STA_DEAUTH;
1960                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1961                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
1962                                        hapd, sta);
1963         }
1964
1965         mlme_disassociate_indication(
1966                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
1967 }
1968
1969
1970 static void handle_deauth(struct hostapd_data *hapd,
1971                           const struct ieee80211_mgmt *mgmt, size_t len)
1972 {
1973         struct sta_info *sta;
1974
1975         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
1976                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
1977                         "payload (len=%lu)", (unsigned long) len);
1978                 return;
1979         }
1980
1981         wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
1982                 " reason_code=%d",
1983                 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
1984
1985         sta = ap_get_sta(hapd, mgmt->sa);
1986         if (sta == NULL) {
1987                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
1988                         "to deauthenticate, but it is not authenticated",
1989                         MAC2STR(mgmt->sa));
1990                 return;
1991         }
1992
1993         ap_sta_set_authorized(hapd, sta, 0);
1994         sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
1995         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
1996                         WLAN_STA_ASSOC_REQ_OK);
1997         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1998         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1999                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
2000         mlme_deauthenticate_indication(
2001                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
2002         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
2003         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
2004         ap_free_sta(hapd, sta);
2005 }
2006
2007
2008 static void handle_beacon(struct hostapd_data *hapd,
2009                           const struct ieee80211_mgmt *mgmt, size_t len,
2010                           struct hostapd_frame_info *fi)
2011 {
2012         struct ieee802_11_elems elems;
2013
2014         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
2015                 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
2016                            (unsigned long) len);
2017                 return;
2018         }
2019
2020         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
2021                                       len - (IEEE80211_HDRLEN +
2022                                              sizeof(mgmt->u.beacon)), &elems,
2023                                       0);
2024
2025         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
2026 }
2027
2028
2029 #ifdef CONFIG_IEEE80211W
2030
2031 static int hostapd_sa_query_action(struct hostapd_data *hapd,
2032                                    const struct ieee80211_mgmt *mgmt,
2033                                    size_t len)
2034 {
2035         const u8 *end;
2036
2037         end = mgmt->u.action.u.sa_query_resp.trans_id +
2038                 WLAN_SA_QUERY_TR_ID_LEN;
2039         if (((u8 *) mgmt) + len < end) {
2040                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
2041                            "frame (len=%lu)", (unsigned long) len);
2042                 return 0;
2043         }
2044
2045         ieee802_11_sa_query_action(hapd, mgmt->sa,
2046                                    mgmt->u.action.u.sa_query_resp.action,
2047                                    mgmt->u.action.u.sa_query_resp.trans_id);
2048         return 1;
2049 }
2050
2051
2052 static int robust_action_frame(u8 category)
2053 {
2054         return category != WLAN_ACTION_PUBLIC &&
2055                 category != WLAN_ACTION_HT;
2056 }
2057 #endif /* CONFIG_IEEE80211W */
2058
2059
2060 static int handle_action(struct hostapd_data *hapd,
2061                          const struct ieee80211_mgmt *mgmt, size_t len)
2062 {
2063         struct sta_info *sta;
2064         sta = ap_get_sta(hapd, mgmt->sa);
2065
2066         if (len < IEEE80211_HDRLEN + 1) {
2067                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2068                                HOSTAPD_LEVEL_DEBUG,
2069                                "handle_action - too short payload (len=%lu)",
2070                                (unsigned long) len);
2071                 return 0;
2072         }
2073
2074         if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
2075             (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
2076                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
2077                            "frame (category=%u) from unassociated STA " MACSTR,
2078                            MAC2STR(mgmt->sa), mgmt->u.action.category);
2079                 return 0;
2080         }
2081
2082 #ifdef CONFIG_IEEE80211W
2083         if (sta && (sta->flags & WLAN_STA_MFP) &&
2084             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
2085             robust_action_frame(mgmt->u.action.category)) {
2086                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2087                                HOSTAPD_LEVEL_DEBUG,
2088                                "Dropped unprotected Robust Action frame from "
2089                                "an MFP STA");
2090                 return 0;
2091         }
2092 #endif /* CONFIG_IEEE80211W */
2093
2094         if (sta) {
2095                 u16 fc = le_to_host16(mgmt->frame_control);
2096                 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
2097
2098                 if ((fc & WLAN_FC_RETRY) &&
2099                     sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2100                     sta->last_seq_ctrl == seq_ctrl &&
2101                     sta->last_subtype == WLAN_FC_STYPE_ACTION) {
2102                         hostapd_logger(hapd, sta->addr,
2103                                        HOSTAPD_MODULE_IEEE80211,
2104                                        HOSTAPD_LEVEL_DEBUG,
2105                                        "Drop repeated action frame seq_ctrl=0x%x",
2106                                        seq_ctrl);
2107                         return 1;
2108                 }
2109
2110                 sta->last_seq_ctrl = seq_ctrl;
2111                 sta->last_subtype = WLAN_FC_STYPE_ACTION;
2112         }
2113
2114         switch (mgmt->u.action.category) {
2115 #ifdef CONFIG_IEEE80211R
2116         case WLAN_ACTION_FT:
2117                 if (!sta ||
2118                     wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
2119                                      len - IEEE80211_HDRLEN))
2120                         break;
2121                 return 1;
2122 #endif /* CONFIG_IEEE80211R */
2123         case WLAN_ACTION_WMM:
2124                 hostapd_wmm_action(hapd, mgmt, len);
2125                 return 1;
2126 #ifdef CONFIG_IEEE80211W
2127         case WLAN_ACTION_SA_QUERY:
2128                 return hostapd_sa_query_action(hapd, mgmt, len);
2129 #endif /* CONFIG_IEEE80211W */
2130 #ifdef CONFIG_WNM
2131         case WLAN_ACTION_WNM:
2132                 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
2133                 return 1;
2134 #endif /* CONFIG_WNM */
2135 #ifdef CONFIG_FST
2136         case WLAN_ACTION_FST:
2137                 if (hapd->iface->fst)
2138                         fst_rx_action(hapd->iface->fst, mgmt, len);
2139                 else
2140                         wpa_printf(MSG_DEBUG,
2141                                    "FST: Ignore FST Action frame - no FST attached");
2142                 return 1;
2143 #endif /* CONFIG_FST */
2144         case WLAN_ACTION_PUBLIC:
2145         case WLAN_ACTION_PROTECTED_DUAL:
2146 #ifdef CONFIG_IEEE80211N
2147                 if (len >= IEEE80211_HDRLEN + 2 &&
2148                     mgmt->u.action.u.public_action.action ==
2149                     WLAN_PA_20_40_BSS_COEX) {
2150                         wpa_printf(MSG_DEBUG,
2151                                    "HT20/40 coex mgmt frame received from STA "
2152                                    MACSTR, MAC2STR(mgmt->sa));
2153                         hostapd_2040_coex_action(hapd, mgmt, len);
2154                 }
2155 #endif /* CONFIG_IEEE80211N */
2156                 if (hapd->public_action_cb) {
2157                         hapd->public_action_cb(hapd->public_action_cb_ctx,
2158                                                (u8 *) mgmt, len,
2159                                                hapd->iface->freq);
2160                 }
2161                 if (hapd->public_action_cb2) {
2162                         hapd->public_action_cb2(hapd->public_action_cb2_ctx,
2163                                                 (u8 *) mgmt, len,
2164                                                 hapd->iface->freq);
2165                 }
2166                 if (hapd->public_action_cb || hapd->public_action_cb2)
2167                         return 1;
2168                 break;
2169         case WLAN_ACTION_VENDOR_SPECIFIC:
2170                 if (hapd->vendor_action_cb) {
2171                         if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
2172                                                    (u8 *) mgmt, len,
2173                                                    hapd->iface->freq) == 0)
2174                                 return 1;
2175                 }
2176                 break;
2177         }
2178
2179         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2180                        HOSTAPD_LEVEL_DEBUG,
2181                        "handle_action - unknown action category %d or invalid "
2182                        "frame",
2183                        mgmt->u.action.category);
2184         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
2185             !(mgmt->sa[0] & 0x01)) {
2186                 struct ieee80211_mgmt *resp;
2187
2188                 /*
2189                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
2190                  * Return the Action frame to the source without change
2191                  * except that MSB of the Category set to 1.
2192                  */
2193                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
2194                            "frame back to sender");
2195                 resp = os_malloc(len);
2196                 if (resp == NULL)
2197                         return 0;
2198                 os_memcpy(resp, mgmt, len);
2199                 os_memcpy(resp->da, resp->sa, ETH_ALEN);
2200                 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
2201                 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
2202                 resp->u.action.category |= 0x80;
2203
2204                 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
2205                         wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
2206                                    "Action frame");
2207                 }
2208                 os_free(resp);
2209         }
2210
2211         return 1;
2212 }
2213
2214
2215 /**
2216  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
2217  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
2218  * sent to)
2219  * @buf: management frame data (starting from IEEE 802.11 header)
2220  * @len: length of frame data in octets
2221  * @fi: meta data about received frame (signal level, etc.)
2222  *
2223  * Process all incoming IEEE 802.11 management frames. This will be called for
2224  * each frame received from the kernel driver through wlan#ap interface. In
2225  * addition, it can be called to re-inserted pending frames (e.g., when using
2226  * external RADIUS server as an MAC ACL).
2227  */
2228 int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
2229                     struct hostapd_frame_info *fi)
2230 {
2231         struct ieee80211_mgmt *mgmt;
2232         int broadcast;
2233         u16 fc, stype;
2234         int ret = 0;
2235
2236         if (len < 24)
2237                 return 0;
2238
2239         mgmt = (struct ieee80211_mgmt *) buf;
2240         fc = le_to_host16(mgmt->frame_control);
2241         stype = WLAN_FC_GET_STYPE(fc);
2242
2243         if (stype == WLAN_FC_STYPE_BEACON) {
2244                 handle_beacon(hapd, mgmt, len, fi);
2245                 return 1;
2246         }
2247
2248         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
2249                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
2250                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
2251
2252         if (!broadcast &&
2253 #ifdef CONFIG_P2P
2254             /* Invitation responses can be sent with the peer MAC as BSSID */
2255             !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
2256               stype == WLAN_FC_STYPE_ACTION) &&
2257 #endif /* CONFIG_P2P */
2258 #ifdef CONFIG_MESH
2259             !(hapd->conf->mesh & MESH_ENABLED) &&
2260 #endif /* CONFIG_MESH */
2261             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
2262                 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
2263                            MAC2STR(mgmt->bssid));
2264                 return 0;
2265         }
2266
2267
2268         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
2269                 handle_probe_req(hapd, mgmt, len, fi->ssi_signal);
2270                 return 1;
2271         }
2272
2273         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
2274                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2275                                HOSTAPD_LEVEL_DEBUG,
2276                                "MGMT: DA=" MACSTR " not our address",
2277                                MAC2STR(mgmt->da));
2278                 return 0;
2279         }
2280
2281         switch (stype) {
2282         case WLAN_FC_STYPE_AUTH:
2283                 wpa_printf(MSG_DEBUG, "mgmt::auth");
2284                 handle_auth(hapd, mgmt, len);
2285                 ret = 1;
2286                 break;
2287         case WLAN_FC_STYPE_ASSOC_REQ:
2288                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
2289                 handle_assoc(hapd, mgmt, len, 0);
2290                 ret = 1;
2291                 break;
2292         case WLAN_FC_STYPE_REASSOC_REQ:
2293                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
2294                 handle_assoc(hapd, mgmt, len, 1);
2295                 ret = 1;
2296                 break;
2297         case WLAN_FC_STYPE_DISASSOC:
2298                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
2299                 handle_disassoc(hapd, mgmt, len);
2300                 ret = 1;
2301                 break;
2302         case WLAN_FC_STYPE_DEAUTH:
2303                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
2304                 handle_deauth(hapd, mgmt, len);
2305                 ret = 1;
2306                 break;
2307         case WLAN_FC_STYPE_ACTION:
2308                 wpa_printf(MSG_DEBUG, "mgmt::action");
2309                 ret = handle_action(hapd, mgmt, len);
2310                 break;
2311         default:
2312                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2313                                HOSTAPD_LEVEL_DEBUG,
2314                                "unknown mgmt frame subtype %d", stype);
2315                 break;
2316         }
2317
2318         return ret;
2319 }
2320
2321
2322 static void handle_auth_cb(struct hostapd_data *hapd,
2323                            const struct ieee80211_mgmt *mgmt,
2324                            size_t len, int ok)
2325 {
2326         u16 auth_alg, auth_transaction, status_code;
2327         struct sta_info *sta;
2328
2329         if (!ok) {
2330                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2331                                HOSTAPD_LEVEL_NOTICE,
2332                                "did not acknowledge authentication response");
2333                 return;
2334         }
2335
2336         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
2337                 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
2338                            (unsigned long) len);
2339                 return;
2340         }
2341
2342         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2343         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
2344         status_code = le_to_host16(mgmt->u.auth.status_code);
2345
2346         sta = ap_get_sta(hapd, mgmt->da);
2347         if (!sta) {
2348                 wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
2349                            MAC2STR(mgmt->da));
2350                 return;
2351         }
2352
2353         if (status_code == WLAN_STATUS_SUCCESS &&
2354             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
2355              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
2356                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2357                                HOSTAPD_LEVEL_INFO, "authenticated");
2358                 sta->flags |= WLAN_STA_AUTH;
2359         }
2360 }
2361
2362
2363 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
2364                                        struct sta_info *sta,
2365                                        char *ifname_wds)
2366 {
2367         int i;
2368         struct hostapd_ssid *ssid = &hapd->conf->ssid;
2369
2370         if (hapd->conf->ieee802_1x || hapd->conf->wpa)
2371                 return;
2372
2373         for (i = 0; i < 4; i++) {
2374                 if (ssid->wep.key[i] &&
2375                     hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
2376                                         i == ssid->wep.idx, NULL, 0,
2377                                         ssid->wep.key[i], ssid->wep.len[i])) {
2378                         wpa_printf(MSG_WARNING,
2379                                    "Could not set WEP keys for WDS interface; %s",
2380                                    ifname_wds);
2381                         break;
2382                 }
2383         }
2384 }
2385
2386
2387 static void handle_assoc_cb(struct hostapd_data *hapd,
2388                             const struct ieee80211_mgmt *mgmt,
2389                             size_t len, int reassoc, int ok)
2390 {
2391         u16 status;
2392         struct sta_info *sta;
2393         int new_assoc = 1;
2394         struct ieee80211_ht_capabilities ht_cap;
2395         struct ieee80211_vht_capabilities vht_cap;
2396
2397         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
2398                                       sizeof(mgmt->u.assoc_resp))) {
2399                 wpa_printf(MSG_INFO, "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
2400                            reassoc, (unsigned long) len);
2401                 return;
2402         }
2403
2404         sta = ap_get_sta(hapd, mgmt->da);
2405         if (!sta) {
2406                 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
2407                            MAC2STR(mgmt->da));
2408                 return;
2409         }
2410
2411         if (!ok) {
2412                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2413                                HOSTAPD_LEVEL_DEBUG,
2414                                "did not acknowledge association response");
2415                 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
2416                 return;
2417         }
2418
2419         if (reassoc)
2420                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
2421         else
2422                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
2423
2424         if (status != WLAN_STATUS_SUCCESS)
2425                 return;
2426
2427         /* Stop previous accounting session, if one is started, and allocate
2428          * new session id for the new session. */
2429         accounting_sta_stop(hapd, sta);
2430
2431         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2432                        HOSTAPD_LEVEL_INFO,
2433                        "associated (aid %d)",
2434                        sta->aid);
2435
2436         if (sta->flags & WLAN_STA_ASSOC)
2437                 new_assoc = 0;
2438         sta->flags |= WLAN_STA_ASSOC;
2439         sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
2440         if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen) ||
2441             sta->auth_alg == WLAN_AUTH_FT) {
2442                 /*
2443                  * Open, static WEP, or FT protocol; no separate authorization
2444                  * step.
2445                  */
2446                 ap_sta_set_authorized(hapd, sta, 1);
2447         }
2448
2449         if (reassoc)
2450                 mlme_reassociate_indication(hapd, sta);
2451         else
2452                 mlme_associate_indication(hapd, sta);
2453
2454 #ifdef CONFIG_IEEE80211W
2455         sta->sa_query_timed_out = 0;
2456 #endif /* CONFIG_IEEE80211W */
2457
2458         /*
2459          * Remove the STA entry in order to make sure the STA PS state gets
2460          * cleared and configuration gets updated in case of reassociation back
2461          * to the same AP.
2462          */
2463         hostapd_drv_sta_remove(hapd, sta->addr);
2464
2465 #ifdef CONFIG_IEEE80211N
2466         if (sta->flags & WLAN_STA_HT)
2467                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
2468 #endif /* CONFIG_IEEE80211N */
2469 #ifdef CONFIG_IEEE80211AC
2470         if (sta->flags & WLAN_STA_VHT)
2471                 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
2472 #endif /* CONFIG_IEEE80211AC */
2473
2474         if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
2475                             sta->supported_rates, sta->supported_rates_len,
2476                             sta->listen_interval,
2477                             sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
2478                             sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
2479                             sta->flags, sta->qosinfo, sta->vht_opmode)) {
2480                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2481                                HOSTAPD_LEVEL_NOTICE,
2482                                "Could not add STA to kernel driver");
2483
2484                 ap_sta_disconnect(hapd, sta, sta->addr,
2485                                   WLAN_REASON_DISASSOC_AP_BUSY);
2486
2487                 return;
2488         }
2489
2490         if (sta->flags & WLAN_STA_WDS) {
2491                 int ret;
2492                 char ifname_wds[IFNAMSIZ + 1];
2493
2494                 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
2495                                           sta->aid, 1);
2496                 if (!ret)
2497                         hostapd_set_wds_encryption(hapd, sta, ifname_wds);
2498         }
2499
2500         if (sta->eapol_sm == NULL) {
2501                 /*
2502                  * This STA does not use RADIUS server for EAP authentication,
2503                  * so bind it to the selected VLAN interface now, since the
2504                  * interface selection is not going to change anymore.
2505                  */
2506                 if (ap_sta_bind_vlan(hapd, sta) < 0)
2507                         return;
2508         } else if (sta->vlan_id) {
2509                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
2510                 if (ap_sta_bind_vlan(hapd, sta) < 0)
2511                         return;
2512         }
2513
2514         hostapd_set_sta_flags(hapd, sta);
2515
2516         if (sta->auth_alg == WLAN_AUTH_FT)
2517                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
2518         else
2519                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
2520         hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
2521
2522         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
2523 }
2524
2525
2526 static void handle_deauth_cb(struct hostapd_data *hapd,
2527                              const struct ieee80211_mgmt *mgmt,
2528                              size_t len, int ok)
2529 {
2530         struct sta_info *sta;
2531         if (mgmt->da[0] & 0x01)
2532                 return;
2533         sta = ap_get_sta(hapd, mgmt->da);
2534         if (!sta) {
2535                 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
2536                            " not found", MAC2STR(mgmt->da));
2537                 return;
2538         }
2539         if (ok)
2540                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
2541                            MAC2STR(sta->addr));
2542         else
2543                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2544                            "deauth", MAC2STR(sta->addr));
2545
2546         ap_sta_deauth_cb(hapd, sta);
2547 }
2548
2549
2550 static void handle_disassoc_cb(struct hostapd_data *hapd,
2551                                const struct ieee80211_mgmt *mgmt,
2552                                size_t len, int ok)
2553 {
2554         struct sta_info *sta;
2555         if (mgmt->da[0] & 0x01)
2556                 return;
2557         sta = ap_get_sta(hapd, mgmt->da);
2558         if (!sta) {
2559                 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
2560                            " not found", MAC2STR(mgmt->da));
2561                 return;
2562         }
2563         if (ok)
2564                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
2565                            MAC2STR(sta->addr));
2566         else
2567                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2568                            "disassoc", MAC2STR(sta->addr));
2569
2570         ap_sta_disassoc_cb(hapd, sta);
2571 }
2572
2573
2574 /**
2575  * ieee802_11_mgmt_cb - Process management frame TX status callback
2576  * @hapd: hostapd BSS data structure (the BSS from which the management frame
2577  * was sent from)
2578  * @buf: management frame data (starting from IEEE 802.11 header)
2579  * @len: length of frame data in octets
2580  * @stype: management frame subtype from frame control field
2581  * @ok: Whether the frame was ACK'ed
2582  */
2583 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
2584                         u16 stype, int ok)
2585 {
2586         const struct ieee80211_mgmt *mgmt;
2587         mgmt = (const struct ieee80211_mgmt *) buf;
2588
2589 #ifdef CONFIG_TESTING_OPTIONS
2590         if (hapd->ext_mgmt_frame_handling) {
2591                 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-TX-STATUS stype=%u ok=%d",
2592                         stype, ok);
2593                 return;
2594         }
2595 #endif /* CONFIG_TESTING_OPTIONS */
2596
2597         switch (stype) {
2598         case WLAN_FC_STYPE_AUTH:
2599                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
2600                 handle_auth_cb(hapd, mgmt, len, ok);
2601                 break;
2602         case WLAN_FC_STYPE_ASSOC_RESP:
2603                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
2604                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
2605                 break;
2606         case WLAN_FC_STYPE_REASSOC_RESP:
2607                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
2608                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
2609                 break;
2610         case WLAN_FC_STYPE_PROBE_RESP:
2611                 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb");
2612                 break;
2613         case WLAN_FC_STYPE_DEAUTH:
2614                 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
2615                 handle_deauth_cb(hapd, mgmt, len, ok);
2616                 break;
2617         case WLAN_FC_STYPE_DISASSOC:
2618                 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
2619                 handle_disassoc_cb(hapd, mgmt, len, ok);
2620                 break;
2621         case WLAN_FC_STYPE_ACTION:
2622                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
2623                 break;
2624         default:
2625                 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
2626                 break;
2627         }
2628 }
2629
2630
2631 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2632 {
2633         /* TODO */
2634         return 0;
2635 }
2636
2637
2638 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2639                            char *buf, size_t buflen)
2640 {
2641         /* TODO */
2642         return 0;
2643 }
2644
2645
2646 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
2647                        const u8 *buf, size_t len, int ack)
2648 {
2649         struct sta_info *sta;
2650         struct hostapd_iface *iface = hapd->iface;
2651
2652         sta = ap_get_sta(hapd, addr);
2653         if (sta == NULL && iface->num_bss > 1) {
2654                 size_t j;
2655                 for (j = 0; j < iface->num_bss; j++) {
2656                         hapd = iface->bss[j];
2657                         sta = ap_get_sta(hapd, addr);
2658                         if (sta)
2659                                 break;
2660                 }
2661         }
2662         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
2663                 return;
2664         if (sta->flags & WLAN_STA_PENDING_POLL) {
2665                 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
2666                            "activity poll", MAC2STR(sta->addr),
2667                            ack ? "ACKed" : "did not ACK");
2668                 if (ack)
2669                         sta->flags &= ~WLAN_STA_PENDING_POLL;
2670         }
2671
2672         ieee802_1x_tx_status(hapd, sta, buf, len, ack);
2673 }
2674
2675
2676 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
2677                              const u8 *data, size_t len, int ack)
2678 {
2679         struct sta_info *sta;
2680         struct hostapd_iface *iface = hapd->iface;
2681
2682         sta = ap_get_sta(hapd, dst);
2683         if (sta == NULL && iface->num_bss > 1) {
2684                 size_t j;
2685                 for (j = 0; j < iface->num_bss; j++) {
2686                         hapd = iface->bss[j];
2687                         sta = ap_get_sta(hapd, dst);
2688                         if (sta)
2689                                 break;
2690                 }
2691         }
2692         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
2693                 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
2694                            MACSTR " that is not currently associated",
2695                            MAC2STR(dst));
2696                 return;
2697         }
2698
2699         ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
2700 }
2701
2702
2703 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
2704 {
2705         struct sta_info *sta;
2706         struct hostapd_iface *iface = hapd->iface;
2707
2708         sta = ap_get_sta(hapd, addr);
2709         if (sta == NULL && iface->num_bss > 1) {
2710                 size_t j;
2711                 for (j = 0; j < iface->num_bss; j++) {
2712                         hapd = iface->bss[j];
2713                         sta = ap_get_sta(hapd, addr);
2714                         if (sta)
2715                                 break;
2716                 }
2717         }
2718         if (sta == NULL)
2719                 return;
2720         if (!(sta->flags & WLAN_STA_PENDING_POLL))
2721                 return;
2722
2723         wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
2724                    "activity poll", MAC2STR(sta->addr));
2725         sta->flags &= ~WLAN_STA_PENDING_POLL;
2726 }
2727
2728
2729 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
2730                                 int wds)
2731 {
2732         struct sta_info *sta;
2733
2734         sta = ap_get_sta(hapd, src);
2735         if (sta && (sta->flags & WLAN_STA_ASSOC)) {
2736                 if (!hapd->conf->wds_sta)
2737                         return;
2738
2739                 if (wds && !(sta->flags & WLAN_STA_WDS)) {
2740                         int ret;
2741                         char ifname_wds[IFNAMSIZ + 1];
2742
2743                         wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
2744                                    "STA " MACSTR " (aid %u)",
2745                                    MAC2STR(sta->addr), sta->aid);
2746                         sta->flags |= WLAN_STA_WDS;
2747                         ret = hostapd_set_wds_sta(hapd, ifname_wds,
2748                                                   sta->addr, sta->aid, 1);
2749                         if (!ret)
2750                                 hostapd_set_wds_encryption(hapd, sta,
2751                                                            ifname_wds);
2752                 }
2753                 return;
2754         }
2755
2756         wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
2757                    MACSTR, MAC2STR(src));
2758         if (src[0] & 0x01) {
2759                 /* Broadcast bit set in SA?! Ignore the frame silently. */
2760                 return;
2761         }
2762
2763         if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
2764                 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
2765                            "already been sent, but no TX status yet known - "
2766                            "ignore Class 3 frame issue with " MACSTR,
2767                            MAC2STR(src));
2768                 return;
2769         }
2770
2771         if (sta && (sta->flags & WLAN_STA_AUTH))
2772                 hostapd_drv_sta_disassoc(
2773                         hapd, src,
2774                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2775         else
2776                 hostapd_drv_sta_deauth(
2777                         hapd, src,
2778                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
2779 }
2780
2781
2782 #endif /* CONFIG_NATIVE_WINDOWS */