2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
9 #include "utils/includes.h"
11 #ifndef CONFIG_NATIVE_WINDOWS
13 #include "utils/common.h"
14 #include "utils/eloop.h"
15 #include "crypto/crypto.h"
16 #include "crypto/sha256.h"
17 #include "crypto/random.h"
18 #include "common/ieee802_11_defs.h"
19 #include "common/ieee802_11_common.h"
20 #include "common/wpa_ctrl.h"
21 #include "common/sae.h"
22 #include "radius/radius.h"
23 #include "radius/radius_client.h"
29 #include "ieee802_11_auth.h"
31 #include "ieee802_1x.h"
33 #include "pmksa_cache_auth.h"
36 #include "accounting.h"
37 #include "ap_config.h"
39 #include "p2p_hostapd.h"
40 #include "ap_drv_ops.h"
42 #include "hw_features.h"
43 #include "ieee802_11.h"
50 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
55 if (hapd->iface->current_rates == NULL)
58 *pos++ = WLAN_EID_SUPP_RATES;
59 num = hapd->iface->num_rates;
60 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
62 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
65 /* rest of the rates are encoded in Extended supported
71 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
74 *pos = hapd->iface->current_rates[i].rate / 5;
75 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
80 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
82 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
85 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
87 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
94 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
99 if (hapd->iface->current_rates == NULL)
102 num = hapd->iface->num_rates;
103 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
105 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
111 *pos++ = WLAN_EID_EXT_SUPP_RATES;
113 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
117 continue; /* already in SuppRates IE */
118 *pos = hapd->iface->current_rates[i].rate / 5;
119 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
124 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
127 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
130 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
133 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
140 u16 hostapd_own_capab_info(struct hostapd_data *hapd)
142 int capab = WLAN_CAPABILITY_ESS;
147 /* Check if any of configured channels require DFS */
148 dfs = hostapd_is_dfs_required(hapd->iface);
150 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
155 if (hapd->iface->num_sta_no_short_preamble == 0 &&
156 hapd->iconf->preamble == SHORT_PREAMBLE)
157 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
159 privacy = hapd->conf->ssid.wep.keys_set;
161 if (hapd->conf->ieee802_1x &&
162 (hapd->conf->default_wep_key_len ||
163 hapd->conf->individual_wep_key_len))
170 if (hapd->conf->osen)
172 #endif /* CONFIG_HS20 */
175 capab |= WLAN_CAPABILITY_PRIVACY;
177 if (hapd->iface->current_mode &&
178 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
179 hapd->iface->num_sta_no_short_slot_time == 0)
180 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
183 * Currently, Spectrum Management capability bit is set when directly
184 * requested in configuration by spectrum_mgmt_required or when AP is
185 * running on DFS channel.
186 * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
188 if (hapd->iface->current_mode &&
189 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
190 (hapd->iconf->spectrum_mgmt_required || dfs))
191 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
193 for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
194 if (hapd->conf->radio_measurements[i]) {
195 capab |= IEEE80211_CAP_RRM;
204 #ifndef CONFIG_NO_RC4
205 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
206 u16 auth_transaction, const u8 *challenge,
209 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
211 "authentication (shared key, transaction %d)",
214 if (auth_transaction == 1) {
215 if (!sta->challenge) {
216 /* Generate a pseudo-random challenge */
219 sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
220 if (sta->challenge == NULL)
221 return WLAN_STATUS_UNSPECIFIED_FAILURE;
223 if (os_get_random(key, sizeof(key)) < 0) {
224 os_free(sta->challenge);
225 sta->challenge = NULL;
226 return WLAN_STATUS_UNSPECIFIED_FAILURE;
229 rc4_skip(key, sizeof(key), 0,
230 sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
235 if (auth_transaction != 3)
236 return WLAN_STATUS_UNSPECIFIED_FAILURE;
239 if (!iswep || !sta->challenge || !challenge ||
240 os_memcmp_const(sta->challenge, challenge,
241 WLAN_AUTH_CHALLENGE_LEN)) {
242 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
244 "shared key authentication - invalid "
245 "challenge-response");
246 return WLAN_STATUS_CHALLENGE_FAIL;
249 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
251 "authentication OK (shared key)");
252 sta->flags |= WLAN_STA_AUTH;
253 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
254 os_free(sta->challenge);
255 sta->challenge = NULL;
259 #endif /* CONFIG_NO_RC4 */
262 static int send_auth_reply(struct hostapd_data *hapd,
263 const u8 *dst, const u8 *bssid,
264 u16 auth_alg, u16 auth_transaction, u16 resp,
265 const u8 *ies, size_t ies_len)
267 struct ieee80211_mgmt *reply;
270 int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
272 rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
273 buf = os_zalloc(rlen);
277 reply = (struct ieee80211_mgmt *) buf;
278 reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
280 os_memcpy(reply->da, dst, ETH_ALEN);
281 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
282 os_memcpy(reply->bssid, bssid, ETH_ALEN);
284 reply->u.auth.auth_alg = host_to_le16(auth_alg);
285 reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
286 reply->u.auth.status_code = host_to_le16(resp);
289 os_memcpy(reply->u.auth.variable, ies, ies_len);
291 wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
292 " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
293 MAC2STR(dst), auth_alg, auth_transaction,
294 resp, (unsigned long) ies_len);
295 if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
296 wpa_printf(MSG_INFO, "send_auth_reply: send failed");
298 reply_res = WLAN_STATUS_SUCCESS;
306 #ifdef CONFIG_IEEE80211R
307 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
308 u16 auth_transaction, u16 status,
309 const u8 *ies, size_t ies_len)
311 struct hostapd_data *hapd = ctx;
312 struct sta_info *sta;
315 reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT,
316 auth_transaction, status, ies, ies_len);
318 sta = ap_get_sta(hapd, dst);
322 if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
323 status != WLAN_STATUS_SUCCESS)) {
324 hostapd_drv_sta_remove(hapd, sta->addr);
325 sta->added_unassoc = 0;
329 if (status != WLAN_STATUS_SUCCESS)
332 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
333 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
334 sta->flags |= WLAN_STA_AUTH;
335 mlme_authenticate_indication(hapd, sta);
337 #endif /* CONFIG_IEEE80211R */
342 #define dot11RSNASAESync 5 /* attempts */
345 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
346 struct sta_info *sta, int update)
350 if (hapd->conf->ssid.wpa_passphrase == NULL) {
351 wpa_printf(MSG_DEBUG, "SAE: No password available");
356 sae_prepare_commit(hapd->own_addr, sta->addr,
357 (u8 *) hapd->conf->ssid.wpa_passphrase,
358 os_strlen(hapd->conf->ssid.wpa_passphrase),
360 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
364 buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN);
367 sae_write_commit(sta->sae, buf, sta->sae->tmp ?
368 sta->sae->tmp->anti_clogging_token : NULL);
374 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
375 struct sta_info *sta)
379 buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
383 sae_write_confirm(sta->sae, buf);
389 static int auth_sae_send_commit(struct hostapd_data *hapd,
390 struct sta_info *sta,
391 const u8 *bssid, int update)
396 data = auth_build_sae_commit(hapd, sta, update);
398 return WLAN_STATUS_UNSPECIFIED_FAILURE;
400 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1,
401 WLAN_STATUS_SUCCESS, wpabuf_head(data),
410 static int auth_sae_send_confirm(struct hostapd_data *hapd,
411 struct sta_info *sta,
417 data = auth_build_sae_confirm(hapd, sta);
419 return WLAN_STATUS_UNSPECIFIED_FAILURE;
421 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2,
422 WLAN_STATUS_SUCCESS, wpabuf_head(data),
431 static int use_sae_anti_clogging(struct hostapd_data *hapd)
433 struct sta_info *sta;
434 unsigned int open = 0;
436 if (hapd->conf->sae_anti_clogging_threshold == 0)
439 for (sta = hapd->sta_list; sta; sta = sta->next) {
442 if (sta->sae->state != SAE_COMMITTED &&
443 sta->sae->state != SAE_CONFIRMED)
446 if (open >= hapd->conf->sae_anti_clogging_threshold)
454 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
455 const u8 *token, size_t token_len)
457 u8 mac[SHA256_MAC_LEN];
459 if (token_len != SHA256_MAC_LEN)
461 if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
462 addr, ETH_ALEN, mac) < 0 ||
463 os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0)
470 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
471 int group, const u8 *addr)
475 struct os_reltime now;
477 os_get_reltime(&now);
478 if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
479 os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
480 if (random_get_bytes(hapd->sae_token_key,
481 sizeof(hapd->sae_token_key)) < 0)
483 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
484 hapd->sae_token_key, sizeof(hapd->sae_token_key));
485 hapd->last_sae_token_key_update = now;
488 buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
492 wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
494 token = wpabuf_put(buf, SHA256_MAC_LEN);
495 hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
496 addr, ETH_ALEN, token);
502 static int sae_check_big_sync(struct sta_info *sta)
504 if (sta->sae->sync > dot11RSNASAESync) {
505 sta->sae->state = SAE_NOTHING;
513 static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
515 struct hostapd_data *hapd = eloop_ctx;
516 struct sta_info *sta = eloop_data;
519 if (sae_check_big_sync(sta))
522 wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
523 " (sync=%d state=%d)",
524 MAC2STR(sta->addr), sta->sae->sync, sta->sae->state);
526 switch (sta->sae->state) {
528 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
529 eloop_register_timeout(0,
530 hapd->dot11RSNASAERetransPeriod * 1000,
531 auth_sae_retransmit_timer, hapd, sta);
534 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
535 eloop_register_timeout(0,
536 hapd->dot11RSNASAERetransPeriod * 1000,
537 auth_sae_retransmit_timer, hapd, sta);
544 if (ret != WLAN_STATUS_SUCCESS)
545 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
549 void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
551 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
555 static void sae_set_retransmit_timer(struct hostapd_data *hapd,
556 struct sta_info *sta)
558 if (!(hapd->conf->mesh & MESH_ENABLED))
561 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
562 eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
563 auth_sae_retransmit_timer, hapd, sta);
567 void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
569 sta->flags |= WLAN_STA_AUTH;
570 sta->auth_alg = WLAN_AUTH_SAE;
571 mlme_authenticate_indication(hapd, sta);
572 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
573 sta->sae->state = SAE_ACCEPTED;
574 wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
575 sta->sae->pmk, sta->sae->pmkid);
579 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
580 const u8 *bssid, u8 auth_transaction)
584 if (auth_transaction != 1 && auth_transaction != 2)
585 return WLAN_STATUS_UNSPECIFIED_FAILURE;
587 switch (sta->sae->state) {
589 if (auth_transaction == 1) {
590 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
593 sta->sae->state = SAE_COMMITTED;
595 if (sae_process_commit(sta->sae) < 0)
596 return WLAN_STATUS_UNSPECIFIED_FAILURE;
599 * In mesh case, both Commit and Confirm can be sent
600 * immediately. In infrastructure BSS, only a single
601 * Authentication frame (Commit) is expected from the AP
602 * here and the second one (Confirm) will be sent once
603 * the STA has sent its second Authentication frame
606 if (hapd->conf->mesh & MESH_ENABLED) {
608 * Send both Commit and Confirm immediately
609 * based on SAE finite state machine
610 * Nothing -> Confirm transition.
612 ret = auth_sae_send_confirm(hapd, sta, bssid);
615 sta->sae->state = SAE_CONFIRMED;
618 * For infrastructure BSS, send only the Commit
619 * message now to get alternating sequence of
620 * Authentication frames between the AP and STA.
621 * Confirm will be sent in
622 * Commited -> Confirmed/Accepted transition
623 * when receiving Confirm from STA.
627 sae_set_retransmit_timer(hapd, sta);
629 hostapd_logger(hapd, sta->addr,
630 HOSTAPD_MODULE_IEEE80211,
632 "SAE confirm before commit");
636 sae_clear_retransmit_timer(hapd, sta);
637 if (auth_transaction == 1) {
638 if (sae_process_commit(sta->sae) < 0)
639 return WLAN_STATUS_UNSPECIFIED_FAILURE;
641 ret = auth_sae_send_confirm(hapd, sta, bssid);
644 sta->sae->state = SAE_CONFIRMED;
646 sae_set_retransmit_timer(hapd, sta);
647 } else if (hapd->conf->mesh & MESH_ENABLED) {
649 * In mesh case, follow SAE finite state machine and
650 * send Commit now, if sync count allows.
652 if (sae_check_big_sync(sta))
653 return WLAN_STATUS_SUCCESS;
656 ret = auth_sae_send_commit(hapd, sta, bssid, 0);
660 sae_set_retransmit_timer(hapd, sta);
663 * For instructure BSS, send the postponed Confirm from
664 * Nothing -> Confirmed transition that was reduced to
665 * Nothing -> Committed above.
667 ret = auth_sae_send_confirm(hapd, sta, bssid);
671 sta->sae->state = SAE_CONFIRMED;
674 * Since this was triggered on Confirm RX, run another
675 * step to get to Accepted without waiting for
678 return sae_sm_step(hapd, sta, bssid, auth_transaction);
682 sae_clear_retransmit_timer(hapd, sta);
683 if (auth_transaction == 1) {
684 if (sae_check_big_sync(sta))
685 return WLAN_STATUS_SUCCESS;
688 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
692 if (sae_process_commit(sta->sae) < 0)
693 return WLAN_STATUS_UNSPECIFIED_FAILURE;
695 ret = auth_sae_send_confirm(hapd, sta, bssid);
699 sae_set_retransmit_timer(hapd, sta);
701 sae_accept_sta(hapd, sta);
705 if (auth_transaction == 1) {
706 wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
707 ") doing reauthentication",
709 ap_free_sta(hapd, sta);
710 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
712 if (sae_check_big_sync(sta))
713 return WLAN_STATUS_SUCCESS;
716 ret = auth_sae_send_confirm(hapd, sta, bssid);
717 sae_clear_temp_data(sta->sae);
723 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
725 return WLAN_STATUS_UNSPECIFIED_FAILURE;
727 return WLAN_STATUS_SUCCESS;
731 static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
733 struct sae_data *sae = sta->sae;
734 int i, *groups = hapd->conf->sae_groups;
736 if (sae->state != SAE_COMMITTED)
739 wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
741 for (i = 0; groups && groups[i] > 0; i++) {
742 if (sae->group == groups[i])
746 if (!groups || groups[i] <= 0) {
747 wpa_printf(MSG_DEBUG,
748 "SAE: Previously selected group not found from the current configuration");
754 if (groups[i] <= 0) {
755 wpa_printf(MSG_DEBUG,
756 "SAE: No alternative group enabled");
760 if (sae_set_group(sae, groups[i]) < 0)
765 wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
769 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
770 const struct ieee80211_mgmt *mgmt, size_t len,
771 u16 auth_transaction, u16 status_code)
773 int resp = WLAN_STATUS_SUCCESS;
774 struct wpabuf *data = NULL;
777 if (auth_transaction != 1 ||
778 status_code != WLAN_STATUS_SUCCESS) {
782 sta->sae = os_zalloc(sizeof(*sta->sae));
787 sta->sae->state = SAE_NOTHING;
791 if (sta->mesh_sae_pmksa_caching) {
792 wpa_printf(MSG_DEBUG,
793 "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
794 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
795 sta->mesh_sae_pmksa_caching = 0;
798 if (auth_transaction == 1) {
799 const u8 *token = NULL, *pos, *end;
800 size_t token_len = 0;
801 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
803 "start SAE authentication (RX commit, status=%u)",
806 if ((hapd->conf->mesh & MESH_ENABLED) &&
807 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
809 pos = mgmt->u.auth.variable;
810 end = ((const u8 *) mgmt) + len;
811 if (pos + sizeof(le16) > end) {
812 wpa_printf(MSG_ERROR,
813 "SAE: Too short anti-clogging token request");
814 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
817 resp = sae_group_allowed(sta->sae,
818 hapd->conf->sae_groups,
820 if (resp != WLAN_STATUS_SUCCESS) {
821 wpa_printf(MSG_ERROR,
822 "SAE: Invalid group in anti-clogging token request");
827 wpabuf_free(sta->sae->tmp->anti_clogging_token);
828 sta->sae->tmp->anti_clogging_token =
829 wpabuf_alloc_copy(pos, end - pos);
830 if (sta->sae->tmp->anti_clogging_token == NULL) {
831 wpa_printf(MSG_ERROR,
832 "SAE: Failed to alloc for anti-clogging token");
833 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
838 * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
839 * is 76, a new Commit Message shall be constructed
840 * with the Anti-Clogging Token from the received
841 * Authentication frame, and the commit-scalar and
842 * COMMIT-ELEMENT previously sent.
844 resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0);
845 if (resp != WLAN_STATUS_SUCCESS) {
846 wpa_printf(MSG_ERROR,
847 "SAE: Failed to send commit message");
850 sta->sae->state = SAE_COMMITTED;
852 sae_set_retransmit_timer(hapd, sta);
856 if ((hapd->conf->mesh & MESH_ENABLED) &&
858 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
860 wpa_printf(MSG_DEBUG,
861 "SAE: Peer did not accept our SAE group");
862 sae_pick_next_group(hapd, sta);
866 if (status_code != WLAN_STATUS_SUCCESS)
869 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
870 ((const u8 *) mgmt) + len -
871 mgmt->u.auth.variable, &token,
872 &token_len, hapd->conf->sae_groups);
873 if (resp == SAE_SILENTLY_DISCARD) {
874 wpa_printf(MSG_DEBUG,
875 "SAE: Drop commit message from " MACSTR " due to reflection attack",
879 if (token && check_sae_token(hapd, sta->addr, token, token_len)
881 wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
882 "incorrect token from " MACSTR,
884 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
888 if (resp != WLAN_STATUS_SUCCESS)
891 if (!token && use_sae_anti_clogging(hapd)) {
892 wpa_printf(MSG_DEBUG,
893 "SAE: Request anti-clogging token from "
894 MACSTR, MAC2STR(sta->addr));
895 data = auth_build_token_req(hapd, sta->sae->group,
897 resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
898 if (hapd->conf->mesh & MESH_ENABLED)
899 sta->sae->state = SAE_NOTHING;
903 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
904 } else if (auth_transaction == 2) {
905 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
907 "SAE authentication (RX confirm, status=%u)",
909 if (status_code != WLAN_STATUS_SUCCESS)
911 if (sta->sae->state >= SAE_CONFIRMED ||
912 !(hapd->conf->mesh & MESH_ENABLED)) {
913 if (sae_check_confirm(sta->sae, mgmt->u.auth.variable,
914 ((u8 *) mgmt) + len -
915 mgmt->u.auth.variable) < 0) {
916 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
920 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
922 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
924 "unexpected SAE authentication transaction %u (status=%u)",
925 auth_transaction, status_code);
926 if (status_code != WLAN_STATUS_SUCCESS)
928 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
932 if (resp != WLAN_STATUS_SUCCESS) {
933 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
934 auth_transaction, resp,
935 data ? wpabuf_head(data) : (u8 *) "",
936 data ? wpabuf_len(data) : 0);
940 if (sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
941 status_code != WLAN_STATUS_SUCCESS)) {
942 hostapd_drv_sta_remove(hapd, sta->addr);
943 sta->added_unassoc = 0;
950 * auth_sae_init_committed - Send COMMIT and start SAE in committed state
951 * @hapd: BSS data for the device initiating the authentication
952 * @sta: the peer to which commit authentication frame is sent
954 * This function implements Init event handling (IEEE Std 802.11-2012,
955 * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
956 * sta->sae structure should be initialized appropriately via a call to
957 * sae_prepare_commit().
959 int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
963 if (!sta->sae || !sta->sae->tmp)
966 if (sta->sae->state != SAE_NOTHING)
969 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
973 sta->sae->state = SAE_COMMITTED;
975 sae_set_retransmit_timer(hapd, sta);
980 #endif /* CONFIG_SAE */
983 static void handle_auth(struct hostapd_data *hapd,
984 const struct ieee80211_mgmt *mgmt, size_t len)
986 u16 auth_alg, auth_transaction, status_code;
987 u16 resp = WLAN_STATUS_SUCCESS;
988 struct sta_info *sta = NULL;
991 const u8 *challenge = NULL;
992 u32 session_timeout, acct_interim_interval;
993 struct vlan_description vlan_id;
994 struct hostapd_sta_wpa_psk_short *psk = NULL;
995 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
996 size_t resp_ies_len = 0;
997 char *identity = NULL;
998 char *radius_cui = NULL;
1001 os_memset(&vlan_id, 0, sizeof(vlan_id));
1003 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1004 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
1005 (unsigned long) len);
1009 #ifdef CONFIG_TESTING_OPTIONS
1010 if (hapd->iconf->ignore_auth_probability > 0.0 &&
1011 drand48() < hapd->iconf->ignore_auth_probability) {
1012 wpa_printf(MSG_INFO,
1013 "TESTING: ignoring auth frame from " MACSTR,
1017 #endif /* CONFIG_TESTING_OPTIONS */
1019 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1020 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1021 status_code = le_to_host16(mgmt->u.auth.status_code);
1022 fc = le_to_host16(mgmt->frame_control);
1023 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
1025 if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
1026 2 + WLAN_AUTH_CHALLENGE_LEN &&
1027 mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
1028 mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
1029 challenge = &mgmt->u.auth.variable[2];
1031 wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
1032 "auth_transaction=%d status_code=%d wep=%d%s "
1034 MAC2STR(mgmt->sa), auth_alg, auth_transaction,
1035 status_code, !!(fc & WLAN_FC_ISWEP),
1036 challenge ? " challenge" : "",
1037 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1039 #ifdef CONFIG_NO_RC4
1040 if (auth_alg == WLAN_AUTH_SHARED_KEY) {
1041 wpa_printf(MSG_INFO,
1042 "Unsupported authentication algorithm (%d)",
1044 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1047 #endif /* CONFIG_NO_RC4 */
1049 if (hapd->tkip_countermeasures) {
1050 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
1054 if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
1055 auth_alg == WLAN_AUTH_OPEN) ||
1056 #ifdef CONFIG_IEEE80211R
1057 (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
1058 auth_alg == WLAN_AUTH_FT) ||
1059 #endif /* CONFIG_IEEE80211R */
1061 (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1062 auth_alg == WLAN_AUTH_SAE) ||
1063 #endif /* CONFIG_SAE */
1064 ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
1065 auth_alg == WLAN_AUTH_SHARED_KEY))) {
1066 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
1068 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1072 if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
1073 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
1074 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
1076 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1080 if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
1081 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1083 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1087 if (hapd->conf->no_auth_if_seen_on) {
1088 struct hostapd_data *other;
1090 other = sta_track_seen_on(hapd->iface, mgmt->sa,
1091 hapd->conf->no_auth_if_seen_on);
1095 u8 op_class, channel, phytype;
1097 wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
1098 MACSTR " since STA has been seen on %s",
1099 hapd->conf->iface, MAC2STR(mgmt->sa),
1100 hapd->conf->no_auth_if_seen_on);
1102 resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
1104 *pos++ = WLAN_EID_NEIGHBOR_REPORT;
1106 os_memcpy(pos, other->own_addr, ETH_ALEN);
1108 info = 0; /* TODO: BSSID Information */
1109 WPA_PUT_LE32(pos, info);
1111 if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
1112 phytype = 8; /* dmg */
1113 else if (other->iconf->ieee80211ac)
1114 phytype = 9; /* vht */
1115 else if (other->iconf->ieee80211n)
1116 phytype = 7; /* ht */
1117 else if (other->iconf->hw_mode ==
1118 HOSTAPD_MODE_IEEE80211A)
1119 phytype = 4; /* ofdm */
1120 else if (other->iconf->hw_mode ==
1121 HOSTAPD_MODE_IEEE80211G)
1122 phytype = 6; /* erp */
1124 phytype = 5; /* hrdsss */
1125 if (ieee80211_freq_to_channel_ext(
1126 hostapd_hw_get_freq(other,
1127 other->iconf->channel),
1128 other->iconf->secondary_channel,
1129 other->iconf->ieee80211ac,
1130 &op_class, &channel) == NUM_HOSTAPD_MODES) {
1132 channel = other->iconf->channel;
1137 resp_ies_len = pos - &resp_ies[0];
1142 res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
1144 &acct_interim_interval, &vlan_id,
1145 &psk, &identity, &radius_cui);
1147 if (res == HOSTAPD_ACL_REJECT) {
1148 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1150 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1153 if (res == HOSTAPD_ACL_PENDING) {
1154 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
1155 " waiting for an external authentication",
1157 /* Authentication code will re-send the authentication frame
1158 * after it has received (and cached) information from the
1159 * external source. */
1163 sta = ap_get_sta(hapd, mgmt->sa);
1165 if ((fc & WLAN_FC_RETRY) &&
1166 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1167 sta->last_seq_ctrl == seq_ctrl &&
1168 sta->last_subtype == WLAN_FC_STYPE_AUTH) {
1169 hostapd_logger(hapd, sta->addr,
1170 HOSTAPD_MODULE_IEEE80211,
1171 HOSTAPD_LEVEL_DEBUG,
1172 "Drop repeated authentication frame seq_ctrl=0x%x",
1177 if ((hapd->conf->mesh & MESH_ENABLED) &&
1178 sta->plink_state == PLINK_BLOCKED) {
1179 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1180 " is blocked - drop Authentication frame",
1184 #endif /* CONFIG_MESH */
1187 if (hapd->conf->mesh & MESH_ENABLED) {
1188 /* if the mesh peer is not available, we don't do auth.
1190 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1191 " not yet known - drop Authentication frame",
1194 * Save a copy of the frame so that it can be processed
1195 * if a new peer entry is added shortly after this.
1197 wpabuf_free(hapd->mesh_pending_auth);
1198 hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
1199 os_get_reltime(&hapd->mesh_pending_auth_time);
1202 #endif /* CONFIG_MESH */
1204 sta = ap_sta_add(hapd, mgmt->sa);
1206 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1210 sta->last_seq_ctrl = seq_ctrl;
1211 sta->last_subtype = WLAN_FC_STYPE_AUTH;
1213 if (vlan_id.notempty &&
1214 !hostapd_vlan_valid(hapd->conf->vlan, &vlan_id)) {
1215 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1217 "Invalid VLAN %d%s received from RADIUS server",
1219 vlan_id.tagged[0] ? "+" : "");
1220 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1223 if (ap_sta_set_vlan(hapd, sta, &vlan_id) < 0) {
1224 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1228 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1229 HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1231 hostapd_free_psk_list(sta->psk);
1232 if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1239 sta->identity = identity;
1241 sta->radius_cui = radius_cui;
1244 sta->flags &= ~WLAN_STA_PREAUTH;
1245 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
1247 if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
1248 sta->acct_interim_interval = acct_interim_interval;
1249 if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
1250 ap_sta_session_timeout(hapd, sta, session_timeout);
1252 ap_sta_no_session_timeout(hapd, sta);
1255 * If the driver supports full AP client state, add a station to the
1256 * driver before sending authentication reply to make sure the driver
1257 * has resources, and not to go through the entire authentication and
1258 * association handshake, and fail it at the end.
1260 * If this is not the first transaction, in a multi-step authentication
1261 * algorithm, the station already exists in the driver
1262 * (sta->added_unassoc = 1) so skip it.
1264 * In mesh mode, the station was already added to the driver when the
1265 * NEW_PEER_CANDIDATE event is received.
1267 if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
1268 !(hapd->conf->mesh & MESH_ENABLED) &&
1269 !(sta->added_unassoc)) {
1271 * If a station that is already associated to the AP, is trying
1272 * to authenticate again, remove the STA entry, in order to make
1273 * sure the STA PS state gets cleared and configuration gets
1274 * updated. To handle this, station's added_unassoc flag is
1275 * cleared once the station has completed association.
1277 hostapd_drv_sta_remove(hapd, sta->addr);
1278 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
1279 WLAN_STA_AUTHORIZED);
1281 if (hostapd_sta_add(hapd, sta->addr, 0, 0, NULL, 0, 0,
1282 NULL, NULL, sta->flags, 0, 0, 0, 0)) {
1283 hostapd_logger(hapd, sta->addr,
1284 HOSTAPD_MODULE_IEEE80211,
1285 HOSTAPD_LEVEL_NOTICE,
1286 "Could not add STA to kernel driver");
1287 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1291 sta->added_unassoc = 1;
1295 case WLAN_AUTH_OPEN:
1296 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1297 HOSTAPD_LEVEL_DEBUG,
1298 "authentication OK (open system)");
1299 sta->flags |= WLAN_STA_AUTH;
1300 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1301 sta->auth_alg = WLAN_AUTH_OPEN;
1302 mlme_authenticate_indication(hapd, sta);
1304 #ifndef CONFIG_NO_RC4
1305 case WLAN_AUTH_SHARED_KEY:
1306 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
1307 fc & WLAN_FC_ISWEP);
1308 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
1309 mlme_authenticate_indication(hapd, sta);
1310 if (sta->challenge && auth_transaction == 1) {
1311 resp_ies[0] = WLAN_EID_CHALLENGE;
1312 resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
1313 os_memcpy(resp_ies + 2, sta->challenge,
1314 WLAN_AUTH_CHALLENGE_LEN);
1315 resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
1318 #endif /* CONFIG_NO_RC4 */
1319 #ifdef CONFIG_IEEE80211R
1321 sta->auth_alg = WLAN_AUTH_FT;
1322 if (sta->wpa_sm == NULL)
1323 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1325 if (sta->wpa_sm == NULL) {
1326 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
1328 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1331 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
1332 auth_transaction, mgmt->u.auth.variable,
1333 len - IEEE80211_HDRLEN -
1334 sizeof(mgmt->u.auth),
1335 handle_auth_ft_finish, hapd);
1336 /* handle_auth_ft_finish() callback will complete auth. */
1338 #endif /* CONFIG_IEEE80211R */
1342 if (status_code == WLAN_STATUS_SUCCESS &&
1343 hapd->conf->mesh & MESH_ENABLED) {
1344 if (sta->wpa_sm == NULL)
1346 wpa_auth_sta_init(hapd->wpa_auth,
1348 if (sta->wpa_sm == NULL) {
1349 wpa_printf(MSG_DEBUG,
1350 "SAE: Failed to initialize WPA state machine");
1351 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1355 #endif /* CONFIG_MESH */
1356 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
1359 #endif /* CONFIG_SAE */
1364 os_free(radius_cui);
1365 hostapd_free_psk_list(psk);
1367 reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
1368 auth_transaction + 1, resp, resp_ies,
1371 if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
1372 reply_res != WLAN_STATUS_SUCCESS)) {
1373 hostapd_drv_sta_remove(hapd, sta->addr);
1374 sta->added_unassoc = 0;
1379 int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
1383 /* get a unique AID */
1385 wpa_printf(MSG_DEBUG, " old AID %d", sta->aid);
1392 for (i = 0; i < AID_WORDS; i++) {
1393 if (hapd->sta_aid[i] == (u32) -1)
1395 for (j = 0; j < 32; j++) {
1396 if (!(hapd->sta_aid[i] & BIT(j)))
1404 aid = i * 32 + j + 1;
1409 hapd->sta_aid[i] |= BIT(j);
1410 wpa_printf(MSG_DEBUG, " new AID %d", sta->aid);
1415 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
1416 const u8 *ssid_ie, size_t ssid_ie_len)
1418 if (ssid_ie == NULL)
1419 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1421 if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
1422 os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
1423 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1425 "Station tried to associate with unknown SSID "
1426 "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
1427 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1430 return WLAN_STATUS_SUCCESS;
1434 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
1435 const u8 *wmm_ie, size_t wmm_ie_len)
1437 sta->flags &= ~WLAN_STA_WMM;
1439 if (wmm_ie && hapd->conf->wmm_enabled) {
1440 struct wmm_information_element *wmm;
1442 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
1443 hostapd_logger(hapd, sta->addr,
1445 HOSTAPD_LEVEL_DEBUG,
1446 "invalid WMM element in association "
1448 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1451 sta->flags |= WLAN_STA_WMM;
1452 wmm = (struct wmm_information_element *) wmm_ie;
1453 sta->qosinfo = wmm->qos_info;
1455 return WLAN_STATUS_SUCCESS;
1459 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
1460 struct ieee802_11_elems *elems)
1462 if (!elems->supp_rates) {
1463 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1464 HOSTAPD_LEVEL_DEBUG,
1465 "No supported rates element in AssocReq");
1466 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1469 if (elems->supp_rates_len + elems->ext_supp_rates_len >
1470 sizeof(sta->supported_rates)) {
1471 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1472 HOSTAPD_LEVEL_DEBUG,
1473 "Invalid supported rates element length %d+%d",
1474 elems->supp_rates_len,
1475 elems->ext_supp_rates_len);
1476 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1479 sta->supported_rates_len = merge_byte_arrays(
1480 sta->supported_rates, sizeof(sta->supported_rates),
1481 elems->supp_rates, elems->supp_rates_len,
1482 elems->ext_supp_rates, elems->ext_supp_rates_len);
1484 return WLAN_STATUS_SUCCESS;
1488 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
1489 const u8 *ext_capab_ie, size_t ext_capab_ie_len)
1491 #ifdef CONFIG_INTERWORKING
1492 /* check for QoS Map support */
1493 if (ext_capab_ie_len >= 5) {
1494 if (ext_capab_ie[4] & 0x01)
1495 sta->qos_map_enabled = 1;
1497 #endif /* CONFIG_INTERWORKING */
1499 if (ext_capab_ie_len > 0)
1500 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
1502 return WLAN_STATUS_SUCCESS;
1506 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
1507 const u8 *ies, size_t ies_len, int reassoc)
1509 struct ieee802_11_elems elems;
1513 const u8 *p2p_dev_addr = NULL;
1515 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
1516 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1517 HOSTAPD_LEVEL_INFO, "Station sent an invalid "
1518 "association request");
1519 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1522 resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
1523 if (resp != WLAN_STATUS_SUCCESS)
1525 resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
1526 if (resp != WLAN_STATUS_SUCCESS)
1528 resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
1529 if (resp != WLAN_STATUS_SUCCESS)
1531 resp = copy_supp_rates(hapd, sta, &elems);
1532 if (resp != WLAN_STATUS_SUCCESS)
1534 #ifdef CONFIG_IEEE80211N
1535 resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
1536 if (resp != WLAN_STATUS_SUCCESS)
1538 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
1539 !(sta->flags & WLAN_STA_HT)) {
1540 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1541 HOSTAPD_LEVEL_INFO, "Station does not support "
1542 "mandatory HT PHY - reject association");
1543 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
1545 #endif /* CONFIG_IEEE80211N */
1547 #ifdef CONFIG_IEEE80211AC
1548 if (hapd->iconf->ieee80211ac) {
1549 resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
1550 if (resp != WLAN_STATUS_SUCCESS)
1553 resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
1554 if (resp != WLAN_STATUS_SUCCESS)
1558 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
1559 !(sta->flags & WLAN_STA_VHT)) {
1560 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1561 HOSTAPD_LEVEL_INFO, "Station does not support "
1562 "mandatory VHT PHY - reject association");
1563 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
1566 if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
1567 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
1568 elems.vendor_vht_len);
1569 if (resp != WLAN_STATUS_SUCCESS)
1572 #endif /* CONFIG_IEEE80211AC */
1576 wpabuf_free(sta->p2p_ie);
1577 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1578 P2P_IE_VENDOR_TYPE);
1580 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
1582 wpabuf_free(sta->p2p_ie);
1585 #endif /* CONFIG_P2P */
1587 if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
1588 wpa_ie = elems.rsn_ie;
1589 wpa_ie_len = elems.rsn_ie_len;
1590 } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
1592 wpa_ie = elems.wpa_ie;
1593 wpa_ie_len = elems.wpa_ie_len;
1600 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
1601 if (hapd->conf->wps_state && elems.wps_ie) {
1602 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
1603 "Request - assume WPS is used");
1604 sta->flags |= WLAN_STA_WPS;
1605 wpabuf_free(sta->wps_ie);
1606 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1607 WPS_IE_VENDOR_TYPE);
1608 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
1609 wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
1610 sta->flags |= WLAN_STA_WPS2;
1614 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
1615 wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
1616 "(Re)Association Request - reject");
1617 return WLAN_STATUS_INVALID_IE;
1619 } else if (hapd->conf->wps_state && wpa_ie == NULL) {
1620 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
1621 "(Re)Association Request - possible WPS use");
1622 sta->flags |= WLAN_STA_MAYBE_WPS;
1624 #endif /* CONFIG_WPS */
1625 if (hapd->conf->wpa && wpa_ie == NULL) {
1626 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1628 "No WPA/RSN IE in association request");
1629 return WLAN_STATUS_INVALID_IE;
1632 if (hapd->conf->wpa && wpa_ie) {
1636 if (sta->wpa_sm == NULL)
1637 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1640 if (sta->wpa_sm == NULL) {
1641 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1643 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1645 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1647 elems.mdie, elems.mdie_len);
1648 if (res == WPA_INVALID_GROUP)
1649 resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1650 else if (res == WPA_INVALID_PAIRWISE)
1651 resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1652 else if (res == WPA_INVALID_AKMP)
1653 resp = WLAN_STATUS_AKMP_NOT_VALID;
1654 else if (res == WPA_ALLOC_FAIL)
1655 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1656 #ifdef CONFIG_IEEE80211W
1657 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1658 resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1659 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1660 resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1661 #endif /* CONFIG_IEEE80211W */
1662 else if (res == WPA_INVALID_MDIE)
1663 resp = WLAN_STATUS_INVALID_MDIE;
1664 else if (res != WPA_IE_OK)
1665 resp = WLAN_STATUS_INVALID_IE;
1666 if (resp != WLAN_STATUS_SUCCESS)
1668 #ifdef CONFIG_IEEE80211W
1669 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1670 sta->sa_query_count > 0)
1671 ap_check_sa_query_timeout(hapd, sta);
1672 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1673 (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
1675 * STA has already been associated with MFP and SA
1676 * Query timeout has not been reached. Reject the
1677 * association attempt temporarily and start SA Query,
1678 * if one is not pending.
1681 if (sta->sa_query_count == 0)
1682 ap_sta_start_sa_query(hapd, sta);
1684 return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
1687 if (wpa_auth_uses_mfp(sta->wpa_sm))
1688 sta->flags |= WLAN_STA_MFP;
1690 sta->flags &= ~WLAN_STA_MFP;
1691 #endif /* CONFIG_IEEE80211W */
1693 #ifdef CONFIG_IEEE80211R
1694 if (sta->auth_alg == WLAN_AUTH_FT) {
1696 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
1697 "to use association (not "
1698 "re-association) with FT auth_alg",
1699 MAC2STR(sta->addr));
1700 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1703 resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
1705 if (resp != WLAN_STATUS_SUCCESS)
1708 #endif /* CONFIG_IEEE80211R */
1711 if (wpa_auth_uses_sae(sta->wpa_sm) &&
1712 sta->auth_alg == WLAN_AUTH_OPEN) {
1713 struct rsn_pmksa_cache_entry *sa;
1714 sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1715 if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
1716 wpa_printf(MSG_DEBUG,
1717 "SAE: No PMKSA cache entry found for "
1718 MACSTR, MAC2STR(sta->addr));
1719 return WLAN_STATUS_INVALID_PMKID;
1721 wpa_printf(MSG_DEBUG, "SAE: " MACSTR
1722 " using PMKSA caching", MAC2STR(sta->addr));
1723 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
1724 sta->auth_alg != WLAN_AUTH_SAE &&
1725 !(sta->auth_alg == WLAN_AUTH_FT &&
1726 wpa_auth_uses_ft_sae(sta->wpa_sm))) {
1727 wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
1728 "SAE AKM after non-SAE auth_alg %u",
1729 MAC2STR(sta->addr), sta->auth_alg);
1730 return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1732 #endif /* CONFIG_SAE */
1734 #ifdef CONFIG_IEEE80211N
1735 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
1736 wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
1737 hostapd_logger(hapd, sta->addr,
1738 HOSTAPD_MODULE_IEEE80211,
1740 "Station tried to use TKIP with HT "
1742 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1744 #endif /* CONFIG_IEEE80211N */
1746 } else if (hapd->conf->osen) {
1747 if (elems.osen == NULL) {
1749 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1751 "No HS 2.0 OSEN element in association request");
1752 return WLAN_STATUS_INVALID_IE;
1755 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
1756 if (sta->wpa_sm == NULL)
1757 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1759 if (sta->wpa_sm == NULL) {
1760 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1762 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1764 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
1765 elems.osen - 2, elems.osen_len + 2) < 0)
1766 return WLAN_STATUS_INVALID_IE;
1767 #endif /* CONFIG_HS20 */
1769 wpa_auth_sta_no_wpa(sta->wpa_sm);
1772 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
1773 #endif /* CONFIG_P2P */
1776 wpabuf_free(sta->hs20_ie);
1777 if (elems.hs20 && elems.hs20_len > 4) {
1778 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
1779 elems.hs20_len - 4);
1781 sta->hs20_ie = NULL;
1782 #endif /* CONFIG_HS20 */
1785 wpabuf_free(sta->mb_ies);
1786 if (hapd->iface->fst)
1787 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
1790 #endif /* CONFIG_FST */
1793 mbo_ap_check_sta_assoc(hapd, sta, &elems);
1795 if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) &&
1796 elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) &&
1797 hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
1798 wpa_printf(MSG_INFO,
1799 "MBO: Reject WPA2 association without PMF");
1800 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1802 #endif /* CONFIG_MBO */
1804 ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
1805 elems.supp_op_classes_len);
1807 if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
1808 elems.rrm_enabled &&
1809 elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
1810 os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
1811 sizeof(sta->rrm_enabled_capa));
1813 return WLAN_STATUS_SUCCESS;
1817 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
1821 struct ieee80211_mgmt reply;
1823 os_memset(&reply, 0, sizeof(reply));
1824 reply.frame_control =
1825 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
1826 os_memcpy(reply.da, addr, ETH_ALEN);
1827 os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
1828 os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
1830 send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
1831 reply.u.deauth.reason_code = host_to_le16(reason_code);
1833 if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
1834 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
1839 static int add_associated_sta(struct hostapd_data *hapd,
1840 struct sta_info *sta)
1842 struct ieee80211_ht_capabilities ht_cap;
1843 struct ieee80211_vht_capabilities vht_cap;
1846 * Remove the STA entry to ensure the STA PS state gets cleared and
1847 * configuration gets updated. This is relevant for cases, such as
1848 * FT-over-the-DS, where a station re-associates back to the same AP but
1849 * skips the authentication flow, or if working with a driver that
1850 * does not support full AP client state.
1852 if (!sta->added_unassoc)
1853 hostapd_drv_sta_remove(hapd, sta->addr);
1855 #ifdef CONFIG_IEEE80211N
1856 if (sta->flags & WLAN_STA_HT)
1857 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
1858 #endif /* CONFIG_IEEE80211N */
1859 #ifdef CONFIG_IEEE80211AC
1860 if (sta->flags & WLAN_STA_VHT)
1861 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
1862 #endif /* CONFIG_IEEE80211AC */
1865 * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
1866 * will be set when the ACK frame for the (Re)Association Response frame
1867 * is processed (TX status driver event).
1869 if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
1870 sta->supported_rates, sta->supported_rates_len,
1871 sta->listen_interval,
1872 sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
1873 sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
1874 sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
1875 sta->vht_opmode, sta->p2p_ie ? 1 : 0,
1876 sta->added_unassoc)) {
1877 hostapd_logger(hapd, sta->addr,
1878 HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
1879 "Could not %s STA to kernel driver",
1880 sta->added_unassoc ? "set" : "add");
1882 if (sta->added_unassoc) {
1883 hostapd_drv_sta_remove(hapd, sta->addr);
1884 sta->added_unassoc = 0;
1890 sta->added_unassoc = 0;
1896 static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1897 u16 status_code, int reassoc, const u8 *ies,
1901 u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1902 struct ieee80211_mgmt *reply;
1905 os_memset(buf, 0, sizeof(buf));
1906 reply = (struct ieee80211_mgmt *) buf;
1907 reply->frame_control =
1908 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1909 (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1910 WLAN_FC_STYPE_ASSOC_RESP));
1911 os_memcpy(reply->da, sta->addr, ETH_ALEN);
1912 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1913 os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1915 send_len = IEEE80211_HDRLEN;
1916 send_len += sizeof(reply->u.assoc_resp);
1917 reply->u.assoc_resp.capab_info =
1918 host_to_le16(hostapd_own_capab_info(hapd));
1919 reply->u.assoc_resp.status_code = host_to_le16(status_code);
1920 reply->u.assoc_resp.aid = host_to_le16(sta->aid | BIT(14) | BIT(15));
1921 /* Supported rates */
1922 p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1923 /* Extended supported rates */
1924 p = hostapd_eid_ext_supp_rates(hapd, p);
1926 #ifdef CONFIG_IEEE80211R
1927 if (status_code == WLAN_STATUS_SUCCESS) {
1928 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1929 * Transition Information, RSN, [RIC Response] */
1930 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1931 buf + sizeof(buf) - p,
1932 sta->auth_alg, ies, ies_len);
1934 #endif /* CONFIG_IEEE80211R */
1936 #ifdef CONFIG_IEEE80211W
1937 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1938 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1939 #endif /* CONFIG_IEEE80211W */
1941 #ifdef CONFIG_IEEE80211N
1942 p = hostapd_eid_ht_capabilities(hapd, p);
1943 p = hostapd_eid_ht_operation(hapd, p);
1944 #endif /* CONFIG_IEEE80211N */
1946 #ifdef CONFIG_IEEE80211AC
1947 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
1948 u32 nsts = 0, sta_nsts;
1950 if (hapd->conf->use_sta_nsts && sta->vht_capabilities) {
1951 struct ieee80211_vht_capabilities *capa;
1953 nsts = (hapd->iface->conf->vht_capab >>
1954 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
1955 capa = sta->vht_capabilities;
1956 sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
1957 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
1959 if (nsts < sta_nsts)
1964 p = hostapd_eid_vht_capabilities(hapd, p, nsts);
1965 p = hostapd_eid_vht_operation(hapd, p);
1967 #endif /* CONFIG_IEEE80211AC */
1969 p = hostapd_eid_ext_capab(hapd, p);
1970 p = hostapd_eid_bss_max_idle_period(hapd, p);
1971 if (sta->qos_map_enabled)
1972 p = hostapd_eid_qos_map_set(hapd, p);
1975 if (hapd->iface->fst_ies) {
1976 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
1977 wpabuf_len(hapd->iface->fst_ies));
1978 p += wpabuf_len(hapd->iface->fst_ies);
1980 #endif /* CONFIG_FST */
1982 #ifdef CONFIG_IEEE80211AC
1983 if (hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
1984 p = hostapd_eid_vendor_vht(hapd, p);
1985 #endif /* CONFIG_IEEE80211AC */
1987 if (sta->flags & WLAN_STA_WMM)
1988 p = hostapd_eid_wmm(hapd, p);
1991 if ((sta->flags & WLAN_STA_WPS) ||
1992 ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa)) {
1993 struct wpabuf *wps = wps_build_assoc_resp_ie();
1995 os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
1996 p += wpabuf_len(wps);
2000 #endif /* CONFIG_WPS */
2003 if (sta->p2p_ie && hapd->p2p_group) {
2004 struct wpabuf *p2p_resp_ie;
2005 enum p2p_status_code status;
2006 switch (status_code) {
2007 case WLAN_STATUS_SUCCESS:
2008 status = P2P_SC_SUCCESS;
2010 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
2011 status = P2P_SC_FAIL_LIMIT_REACHED;
2014 status = P2P_SC_FAIL_INVALID_PARAMS;
2017 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
2019 os_memcpy(p, wpabuf_head(p2p_resp_ie),
2020 wpabuf_len(p2p_resp_ie));
2021 p += wpabuf_len(p2p_resp_ie);
2022 wpabuf_free(p2p_resp_ie);
2025 #endif /* CONFIG_P2P */
2027 #ifdef CONFIG_P2P_MANAGER
2028 if (hapd->conf->p2p & P2P_MANAGE)
2029 p = hostapd_eid_p2p_manage(hapd, p);
2030 #endif /* CONFIG_P2P_MANAGER */
2032 p = hostapd_eid_mbo(hapd, p, buf + sizeof(buf) - p);
2034 if (hapd->conf->assocresp_elements &&
2035 (size_t) (buf + sizeof(buf) - p) >=
2036 wpabuf_len(hapd->conf->assocresp_elements)) {
2037 os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
2038 wpabuf_len(hapd->conf->assocresp_elements));
2039 p += wpabuf_len(hapd->conf->assocresp_elements);
2042 send_len += p - reply->u.assoc_resp.variable;
2044 if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
2045 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
2047 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2050 return WLAN_STATUS_SUCCESS;
2054 static void handle_assoc(struct hostapd_data *hapd,
2055 const struct ieee80211_mgmt *mgmt, size_t len,
2058 u16 capab_info, listen_interval, seq_ctrl, fc;
2059 u16 resp = WLAN_STATUS_SUCCESS, reply_res;
2062 struct sta_info *sta;
2064 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
2065 sizeof(mgmt->u.assoc_req))) {
2066 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
2067 reassoc, (unsigned long) len);
2071 #ifdef CONFIG_TESTING_OPTIONS
2073 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
2074 drand48() < hapd->iconf->ignore_reassoc_probability) {
2075 wpa_printf(MSG_INFO,
2076 "TESTING: ignoring reassoc request from "
2077 MACSTR, MAC2STR(mgmt->sa));
2081 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
2082 drand48() < hapd->iconf->ignore_assoc_probability) {
2083 wpa_printf(MSG_INFO,
2084 "TESTING: ignoring assoc request from "
2085 MACSTR, MAC2STR(mgmt->sa));
2089 #endif /* CONFIG_TESTING_OPTIONS */
2091 fc = le_to_host16(mgmt->frame_control);
2092 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
2095 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
2096 listen_interval = le_to_host16(
2097 mgmt->u.reassoc_req.listen_interval);
2098 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
2099 " capab_info=0x%02x listen_interval=%d current_ap="
2100 MACSTR " seq_ctrl=0x%x%s",
2101 MAC2STR(mgmt->sa), capab_info, listen_interval,
2102 MAC2STR(mgmt->u.reassoc_req.current_ap),
2103 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
2104 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
2105 pos = mgmt->u.reassoc_req.variable;
2107 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
2108 listen_interval = le_to_host16(
2109 mgmt->u.assoc_req.listen_interval);
2110 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
2111 " capab_info=0x%02x listen_interval=%d "
2113 MAC2STR(mgmt->sa), capab_info, listen_interval,
2114 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
2115 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
2116 pos = mgmt->u.assoc_req.variable;
2119 sta = ap_get_sta(hapd, mgmt->sa);
2120 #ifdef CONFIG_IEEE80211R
2121 if (sta && sta->auth_alg == WLAN_AUTH_FT &&
2122 (sta->flags & WLAN_STA_AUTH) == 0) {
2123 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
2124 "prior to authentication since it is using "
2125 "over-the-DS FT", MAC2STR(mgmt->sa));
2128 * Mark station as authenticated, to avoid adding station
2129 * entry in the driver as associated and not authenticated
2131 sta->flags |= WLAN_STA_AUTH;
2133 #endif /* CONFIG_IEEE80211R */
2134 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
2135 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2136 HOSTAPD_LEVEL_INFO, "Station tried to "
2137 "associate before authentication "
2138 "(aid=%d flags=0x%x)",
2139 sta ? sta->aid : -1,
2140 sta ? sta->flags : 0);
2141 send_deauth(hapd, mgmt->sa,
2142 WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
2146 if ((fc & WLAN_FC_RETRY) &&
2147 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2148 sta->last_seq_ctrl == seq_ctrl &&
2149 sta->last_subtype == reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
2150 WLAN_FC_STYPE_ASSOC_REQ) {
2151 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2152 HOSTAPD_LEVEL_DEBUG,
2153 "Drop repeated association frame seq_ctrl=0x%x",
2157 sta->last_seq_ctrl = seq_ctrl;
2158 sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
2159 WLAN_FC_STYPE_ASSOC_REQ;
2161 if (hapd->tkip_countermeasures) {
2162 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
2166 if (listen_interval > hapd->conf->max_listen_interval) {
2167 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2168 HOSTAPD_LEVEL_DEBUG,
2169 "Too large Listen Interval (%d)",
2171 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
2176 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
2177 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2180 #endif /* CONFIG_MBO */
2183 * sta->capability is used in check_assoc_ies() for RRM enabled
2184 * capability element.
2186 sta->capability = capab_info;
2188 /* followed by SSID and Supported rates; and HT capabilities if 802.11n
2190 resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
2191 if (resp != WLAN_STATUS_SUCCESS)
2194 if (hostapd_get_aid(hapd, sta) < 0) {
2195 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2196 HOSTAPD_LEVEL_INFO, "No room for more AIDs");
2197 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2201 sta->listen_interval = listen_interval;
2203 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
2204 sta->flags |= WLAN_STA_NONERP;
2205 for (i = 0; i < sta->supported_rates_len; i++) {
2206 if ((sta->supported_rates[i] & 0x7f) > 22) {
2207 sta->flags &= ~WLAN_STA_NONERP;
2211 if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
2212 sta->nonerp_set = 1;
2213 hapd->iface->num_sta_non_erp++;
2214 if (hapd->iface->num_sta_non_erp == 1)
2215 ieee802_11_set_beacons(hapd->iface);
2218 if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
2219 !sta->no_short_slot_time_set) {
2220 sta->no_short_slot_time_set = 1;
2221 hapd->iface->num_sta_no_short_slot_time++;
2222 if (hapd->iface->current_mode->mode ==
2223 HOSTAPD_MODE_IEEE80211G &&
2224 hapd->iface->num_sta_no_short_slot_time == 1)
2225 ieee802_11_set_beacons(hapd->iface);
2228 if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2229 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
2231 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
2233 if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
2234 !sta->no_short_preamble_set) {
2235 sta->no_short_preamble_set = 1;
2236 hapd->iface->num_sta_no_short_preamble++;
2237 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
2238 && hapd->iface->num_sta_no_short_preamble == 1)
2239 ieee802_11_set_beacons(hapd->iface);
2242 #ifdef CONFIG_IEEE80211N
2243 update_ht_state(hapd, sta);
2244 #endif /* CONFIG_IEEE80211N */
2246 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2247 HOSTAPD_LEVEL_DEBUG,
2248 "association OK (aid %d)", sta->aid);
2249 /* Station will be marked associated, after it acknowledges AssocResp
2251 sta->flags |= WLAN_STA_ASSOC_REQ_OK;
2253 #ifdef CONFIG_IEEE80211W
2254 if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
2255 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
2256 "SA Query procedure", reassoc ? "re" : "");
2257 /* TODO: Send a protected Disassociate frame to the STA using
2258 * the old key and Reason Code "Previous Authentication no
2259 * longer valid". Make sure this is only sent protected since
2260 * unprotected frame would be received by the STA that is now
2261 * trying to associate.
2264 #endif /* CONFIG_IEEE80211W */
2266 /* Make sure that the previously registered inactivity timer will not
2267 * remove the STA immediately. */
2268 sta->timeout_next = STA_NULLFUNC;
2270 #ifdef CONFIG_TAXONOMY
2271 taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
2272 #endif /* CONFIG_TAXONOMY */
2276 * In case of a successful response, add the station to the driver.
2277 * Otherwise, the kernel may ignore Data frames before we process the
2278 * ACK frame (TX status). In case of a failure, this station will be
2281 * Note that this is not compliant with the IEEE 802.11 standard that
2282 * states that a non-AP station should transition into the
2283 * authenticated/associated state only after the station acknowledges
2284 * the (Re)Association Response frame. However, still do this as:
2286 * 1. In case the station does not acknowledge the (Re)Association
2287 * Response frame, it will be removed.
2288 * 2. Data frames will be dropped in the kernel until the station is
2289 * set into authorized state, and there are no significant known
2290 * issues with processing other non-Data Class 3 frames during this
2293 if (resp == WLAN_STATUS_SUCCESS && add_associated_sta(hapd, sta))
2294 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2296 reply_res = send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
2299 * Remove the station in case tranmission of a success response fails
2300 * (the STA was added associated to the driver) or if the station was
2301 * previously added unassociated.
2303 if ((reply_res != WLAN_STATUS_SUCCESS &&
2304 resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc) {
2305 hostapd_drv_sta_remove(hapd, sta->addr);
2306 sta->added_unassoc = 0;
2311 static void handle_disassoc(struct hostapd_data *hapd,
2312 const struct ieee80211_mgmt *mgmt, size_t len)
2314 struct sta_info *sta;
2316 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
2317 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
2318 (unsigned long) len);
2322 wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
2324 le_to_host16(mgmt->u.disassoc.reason_code));
2326 sta = ap_get_sta(hapd, mgmt->sa);
2328 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
2333 ap_sta_set_authorized(hapd, sta, 0);
2334 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
2335 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
2336 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
2337 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2338 HOSTAPD_LEVEL_INFO, "disassociated");
2339 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
2340 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
2341 /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
2343 accounting_sta_stop(hapd, sta);
2344 ieee802_1x_free_station(hapd, sta);
2346 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
2347 ap_sta_ip6addr_del(hapd, sta);
2348 hostapd_drv_sta_remove(hapd, sta->addr);
2349 sta->added_unassoc = 0;
2351 if (sta->timeout_next == STA_NULLFUNC ||
2352 sta->timeout_next == STA_DISASSOC) {
2353 sta->timeout_next = STA_DEAUTH;
2354 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
2355 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
2359 mlme_disassociate_indication(
2360 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
2364 static void handle_deauth(struct hostapd_data *hapd,
2365 const struct ieee80211_mgmt *mgmt, size_t len)
2367 struct sta_info *sta;
2369 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
2370 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
2371 "payload (len=%lu)", (unsigned long) len);
2375 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
2377 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
2379 sta = ap_get_sta(hapd, mgmt->sa);
2381 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
2382 "to deauthenticate, but it is not authenticated",
2387 ap_sta_set_authorized(hapd, sta, 0);
2388 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
2389 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
2390 WLAN_STA_ASSOC_REQ_OK);
2391 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
2392 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2393 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
2394 mlme_deauthenticate_indication(
2395 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
2396 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
2397 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
2398 ap_free_sta(hapd, sta);
2402 static void handle_beacon(struct hostapd_data *hapd,
2403 const struct ieee80211_mgmt *mgmt, size_t len,
2404 struct hostapd_frame_info *fi)
2406 struct ieee802_11_elems elems;
2408 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
2409 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
2410 (unsigned long) len);
2414 (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
2415 len - (IEEE80211_HDRLEN +
2416 sizeof(mgmt->u.beacon)), &elems,
2419 ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
2423 #ifdef CONFIG_IEEE80211W
2425 static int hostapd_sa_query_action(struct hostapd_data *hapd,
2426 const struct ieee80211_mgmt *mgmt,
2431 end = mgmt->u.action.u.sa_query_resp.trans_id +
2432 WLAN_SA_QUERY_TR_ID_LEN;
2433 if (((u8 *) mgmt) + len < end) {
2434 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
2435 "frame (len=%lu)", (unsigned long) len);
2439 ieee802_11_sa_query_action(hapd, mgmt->sa,
2440 mgmt->u.action.u.sa_query_resp.action,
2441 mgmt->u.action.u.sa_query_resp.trans_id);
2446 static int robust_action_frame(u8 category)
2448 return category != WLAN_ACTION_PUBLIC &&
2449 category != WLAN_ACTION_HT;
2451 #endif /* CONFIG_IEEE80211W */
2454 static int handle_action(struct hostapd_data *hapd,
2455 const struct ieee80211_mgmt *mgmt, size_t len)
2457 struct sta_info *sta;
2458 sta = ap_get_sta(hapd, mgmt->sa);
2460 if (len < IEEE80211_HDRLEN + 1) {
2461 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2462 HOSTAPD_LEVEL_DEBUG,
2463 "handle_action - too short payload (len=%lu)",
2464 (unsigned long) len);
2468 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
2469 (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
2470 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
2471 "frame (category=%u) from unassociated STA " MACSTR,
2472 MAC2STR(mgmt->sa), mgmt->u.action.category);
2476 #ifdef CONFIG_IEEE80211W
2477 if (sta && (sta->flags & WLAN_STA_MFP) &&
2478 !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
2479 robust_action_frame(mgmt->u.action.category)) {
2480 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2481 HOSTAPD_LEVEL_DEBUG,
2482 "Dropped unprotected Robust Action frame from "
2486 #endif /* CONFIG_IEEE80211W */
2489 u16 fc = le_to_host16(mgmt->frame_control);
2490 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
2492 if ((fc & WLAN_FC_RETRY) &&
2493 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2494 sta->last_seq_ctrl == seq_ctrl &&
2495 sta->last_subtype == WLAN_FC_STYPE_ACTION) {
2496 hostapd_logger(hapd, sta->addr,
2497 HOSTAPD_MODULE_IEEE80211,
2498 HOSTAPD_LEVEL_DEBUG,
2499 "Drop repeated action frame seq_ctrl=0x%x",
2504 sta->last_seq_ctrl = seq_ctrl;
2505 sta->last_subtype = WLAN_FC_STYPE_ACTION;
2508 switch (mgmt->u.action.category) {
2509 #ifdef CONFIG_IEEE80211R
2510 case WLAN_ACTION_FT:
2512 wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
2513 len - IEEE80211_HDRLEN))
2516 #endif /* CONFIG_IEEE80211R */
2517 case WLAN_ACTION_WMM:
2518 hostapd_wmm_action(hapd, mgmt, len);
2520 #ifdef CONFIG_IEEE80211W
2521 case WLAN_ACTION_SA_QUERY:
2522 return hostapd_sa_query_action(hapd, mgmt, len);
2523 #endif /* CONFIG_IEEE80211W */
2525 case WLAN_ACTION_WNM:
2526 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
2528 #endif /* CONFIG_WNM */
2530 case WLAN_ACTION_FST:
2531 if (hapd->iface->fst)
2532 fst_rx_action(hapd->iface->fst, mgmt, len);
2534 wpa_printf(MSG_DEBUG,
2535 "FST: Ignore FST Action frame - no FST attached");
2537 #endif /* CONFIG_FST */
2538 case WLAN_ACTION_PUBLIC:
2539 case WLAN_ACTION_PROTECTED_DUAL:
2540 #ifdef CONFIG_IEEE80211N
2541 if (len >= IEEE80211_HDRLEN + 2 &&
2542 mgmt->u.action.u.public_action.action ==
2543 WLAN_PA_20_40_BSS_COEX) {
2544 wpa_printf(MSG_DEBUG,
2545 "HT20/40 coex mgmt frame received from STA "
2546 MACSTR, MAC2STR(mgmt->sa));
2547 hostapd_2040_coex_action(hapd, mgmt, len);
2549 #endif /* CONFIG_IEEE80211N */
2550 if (hapd->public_action_cb) {
2551 hapd->public_action_cb(hapd->public_action_cb_ctx,
2555 if (hapd->public_action_cb2) {
2556 hapd->public_action_cb2(hapd->public_action_cb2_ctx,
2560 if (hapd->public_action_cb || hapd->public_action_cb2)
2563 case WLAN_ACTION_VENDOR_SPECIFIC:
2564 if (hapd->vendor_action_cb) {
2565 if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
2567 hapd->iface->freq) == 0)
2571 case WLAN_ACTION_RADIO_MEASUREMENT:
2572 hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
2576 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2577 HOSTAPD_LEVEL_DEBUG,
2578 "handle_action - unknown action category %d or invalid "
2580 mgmt->u.action.category);
2581 if (!is_multicast_ether_addr(mgmt->da) &&
2582 !(mgmt->u.action.category & 0x80) &&
2583 !is_multicast_ether_addr(mgmt->sa)) {
2584 struct ieee80211_mgmt *resp;
2587 * IEEE 802.11-REVma/D9.0 - 7.3.1.11
2588 * Return the Action frame to the source without change
2589 * except that MSB of the Category set to 1.
2591 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
2592 "frame back to sender");
2593 resp = os_malloc(len);
2596 os_memcpy(resp, mgmt, len);
2597 os_memcpy(resp->da, resp->sa, ETH_ALEN);
2598 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
2599 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
2600 resp->u.action.category |= 0x80;
2602 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
2603 wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
2614 * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
2615 * @hapd: hostapd BSS data structure (the BSS to which the management frame was
2617 * @buf: management frame data (starting from IEEE 802.11 header)
2618 * @len: length of frame data in octets
2619 * @fi: meta data about received frame (signal level, etc.)
2621 * Process all incoming IEEE 802.11 management frames. This will be called for
2622 * each frame received from the kernel driver through wlan#ap interface. In
2623 * addition, it can be called to re-inserted pending frames (e.g., when using
2624 * external RADIUS server as an MAC ACL).
2626 int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
2627 struct hostapd_frame_info *fi)
2629 struct ieee80211_mgmt *mgmt;
2636 mgmt = (struct ieee80211_mgmt *) buf;
2637 fc = le_to_host16(mgmt->frame_control);
2638 stype = WLAN_FC_GET_STYPE(fc);
2640 if (stype == WLAN_FC_STYPE_BEACON) {
2641 handle_beacon(hapd, mgmt, len, fi);
2645 if (!is_broadcast_ether_addr(mgmt->bssid) &&
2647 /* Invitation responses can be sent with the peer MAC as BSSID */
2648 !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
2649 stype == WLAN_FC_STYPE_ACTION) &&
2650 #endif /* CONFIG_P2P */
2652 !(hapd->conf->mesh & MESH_ENABLED) &&
2653 #endif /* CONFIG_MESH */
2654 os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
2655 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
2656 MAC2STR(mgmt->bssid));
2661 if (stype == WLAN_FC_STYPE_PROBE_REQ) {
2662 handle_probe_req(hapd, mgmt, len, fi->ssi_signal);
2666 if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
2667 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2668 HOSTAPD_LEVEL_DEBUG,
2669 "MGMT: DA=" MACSTR " not our address",
2674 if (hapd->iconf->track_sta_max_num)
2675 sta_track_add(hapd->iface, mgmt->sa);
2678 case WLAN_FC_STYPE_AUTH:
2679 wpa_printf(MSG_DEBUG, "mgmt::auth");
2680 handle_auth(hapd, mgmt, len);
2683 case WLAN_FC_STYPE_ASSOC_REQ:
2684 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
2685 handle_assoc(hapd, mgmt, len, 0);
2688 case WLAN_FC_STYPE_REASSOC_REQ:
2689 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
2690 handle_assoc(hapd, mgmt, len, 1);
2693 case WLAN_FC_STYPE_DISASSOC:
2694 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
2695 handle_disassoc(hapd, mgmt, len);
2698 case WLAN_FC_STYPE_DEAUTH:
2699 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
2700 handle_deauth(hapd, mgmt, len);
2703 case WLAN_FC_STYPE_ACTION:
2704 wpa_printf(MSG_DEBUG, "mgmt::action");
2705 ret = handle_action(hapd, mgmt, len);
2708 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2709 HOSTAPD_LEVEL_DEBUG,
2710 "unknown mgmt frame subtype %d", stype);
2718 static void handle_auth_cb(struct hostapd_data *hapd,
2719 const struct ieee80211_mgmt *mgmt,
2722 u16 auth_alg, auth_transaction, status_code;
2723 struct sta_info *sta;
2725 sta = ap_get_sta(hapd, mgmt->da);
2727 wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
2732 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2733 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
2734 status_code = le_to_host16(mgmt->u.auth.status_code);
2737 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2738 HOSTAPD_LEVEL_NOTICE,
2739 "did not acknowledge authentication response");
2743 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
2744 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
2745 (unsigned long) len);
2749 if (status_code == WLAN_STATUS_SUCCESS &&
2750 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
2751 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
2752 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2753 HOSTAPD_LEVEL_INFO, "authenticated");
2754 sta->flags |= WLAN_STA_AUTH;
2755 if (sta->added_unassoc)
2756 hostapd_set_sta_flags(hapd, sta);
2761 if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) {
2762 hostapd_drv_sta_remove(hapd, sta->addr);
2763 sta->added_unassoc = 0;
2768 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
2769 struct sta_info *sta,
2773 struct hostapd_ssid *ssid = &hapd->conf->ssid;
2775 if (hapd->conf->ieee802_1x || hapd->conf->wpa)
2778 for (i = 0; i < 4; i++) {
2779 if (ssid->wep.key[i] &&
2780 hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
2781 i == ssid->wep.idx, NULL, 0,
2782 ssid->wep.key[i], ssid->wep.len[i])) {
2783 wpa_printf(MSG_WARNING,
2784 "Could not set WEP keys for WDS interface; %s",
2792 static void handle_assoc_cb(struct hostapd_data *hapd,
2793 const struct ieee80211_mgmt *mgmt,
2794 size_t len, int reassoc, int ok)
2797 struct sta_info *sta;
2800 sta = ap_get_sta(hapd, mgmt->da);
2802 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
2807 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
2808 sizeof(mgmt->u.assoc_resp))) {
2809 wpa_printf(MSG_INFO,
2810 "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
2811 reassoc, (unsigned long) len);
2812 hostapd_drv_sta_remove(hapd, sta->addr);
2817 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
2819 status = le_to_host16(mgmt->u.assoc_resp.status_code);
2822 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2823 HOSTAPD_LEVEL_DEBUG,
2824 "did not acknowledge association response");
2825 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
2826 /* The STA is added only in case of SUCCESS */
2827 if (status == WLAN_STATUS_SUCCESS)
2828 hostapd_drv_sta_remove(hapd, sta->addr);
2833 if (status != WLAN_STATUS_SUCCESS)
2836 /* Stop previous accounting session, if one is started, and allocate
2837 * new session id for the new session. */
2838 accounting_sta_stop(hapd, sta);
2840 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2842 "associated (aid %d)",
2845 if (sta->flags & WLAN_STA_ASSOC)
2847 sta->flags |= WLAN_STA_ASSOC;
2848 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
2849 if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen) ||
2850 sta->auth_alg == WLAN_AUTH_FT) {
2852 * Open, static WEP, or FT protocol; no separate authorization
2855 ap_sta_set_authorized(hapd, sta, 1);
2859 mlme_reassociate_indication(hapd, sta);
2861 mlme_associate_indication(hapd, sta);
2863 #ifdef CONFIG_IEEE80211W
2864 sta->sa_query_timed_out = 0;
2865 #endif /* CONFIG_IEEE80211W */
2867 if (sta->flags & WLAN_STA_WDS) {
2869 char ifname_wds[IFNAMSIZ + 1];
2871 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
2874 hostapd_set_wds_encryption(hapd, sta, ifname_wds);
2877 if (sta->eapol_sm == NULL) {
2879 * This STA does not use RADIUS server for EAP authentication,
2880 * so bind it to the selected VLAN interface now, since the
2881 * interface selection is not going to change anymore.
2883 if (ap_sta_bind_vlan(hapd, sta) < 0)
2885 } else if (sta->vlan_id) {
2886 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
2887 if (ap_sta_bind_vlan(hapd, sta) < 0)
2891 hostapd_set_sta_flags(hapd, sta);
2893 if (sta->auth_alg == WLAN_AUTH_FT)
2894 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
2896 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
2897 hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
2898 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
2900 if (sta->pending_eapol_rx) {
2901 struct os_reltime now, age;
2903 os_get_reltime(&now);
2904 os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
2905 if (age.sec == 0 && age.usec < 200000) {
2906 wpa_printf(MSG_DEBUG,
2907 "Process pending EAPOL frame that was received from " MACSTR " just before association notification",
2908 MAC2STR(sta->addr));
2911 wpabuf_head(sta->pending_eapol_rx->buf),
2912 wpabuf_len(sta->pending_eapol_rx->buf));
2914 wpabuf_free(sta->pending_eapol_rx->buf);
2915 os_free(sta->pending_eapol_rx);
2916 sta->pending_eapol_rx = NULL;
2921 static void handle_deauth_cb(struct hostapd_data *hapd,
2922 const struct ieee80211_mgmt *mgmt,
2925 struct sta_info *sta;
2926 if (is_multicast_ether_addr(mgmt->da))
2928 sta = ap_get_sta(hapd, mgmt->da);
2930 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
2931 " not found", MAC2STR(mgmt->da));
2935 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
2936 MAC2STR(sta->addr));
2938 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2939 "deauth", MAC2STR(sta->addr));
2941 ap_sta_deauth_cb(hapd, sta);
2945 static void handle_disassoc_cb(struct hostapd_data *hapd,
2946 const struct ieee80211_mgmt *mgmt,
2949 struct sta_info *sta;
2950 if (is_multicast_ether_addr(mgmt->da))
2952 sta = ap_get_sta(hapd, mgmt->da);
2954 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
2955 " not found", MAC2STR(mgmt->da));
2959 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
2960 MAC2STR(sta->addr));
2962 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2963 "disassoc", MAC2STR(sta->addr));
2965 ap_sta_disassoc_cb(hapd, sta);
2970 * ieee802_11_mgmt_cb - Process management frame TX status callback
2971 * @hapd: hostapd BSS data structure (the BSS from which the management frame
2973 * @buf: management frame data (starting from IEEE 802.11 header)
2974 * @len: length of frame data in octets
2975 * @stype: management frame subtype from frame control field
2976 * @ok: Whether the frame was ACK'ed
2978 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
2981 const struct ieee80211_mgmt *mgmt;
2982 mgmt = (const struct ieee80211_mgmt *) buf;
2984 #ifdef CONFIG_TESTING_OPTIONS
2985 if (hapd->ext_mgmt_frame_handling) {
2986 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-TX-STATUS stype=%u ok=%d",
2990 #endif /* CONFIG_TESTING_OPTIONS */
2993 case WLAN_FC_STYPE_AUTH:
2994 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
2995 handle_auth_cb(hapd, mgmt, len, ok);
2997 case WLAN_FC_STYPE_ASSOC_RESP:
2998 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
2999 handle_assoc_cb(hapd, mgmt, len, 0, ok);
3001 case WLAN_FC_STYPE_REASSOC_RESP:
3002 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
3003 handle_assoc_cb(hapd, mgmt, len, 1, ok);
3005 case WLAN_FC_STYPE_PROBE_RESP:
3006 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok);
3008 case WLAN_FC_STYPE_DEAUTH:
3009 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
3010 handle_deauth_cb(hapd, mgmt, len, ok);
3012 case WLAN_FC_STYPE_DISASSOC:
3013 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
3014 handle_disassoc_cb(hapd, mgmt, len, ok);
3016 case WLAN_FC_STYPE_ACTION:
3017 wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok);
3020 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
3026 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
3033 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
3034 char *buf, size_t buflen)
3041 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
3042 const u8 *buf, size_t len, int ack)
3044 struct sta_info *sta;
3045 struct hostapd_iface *iface = hapd->iface;
3047 sta = ap_get_sta(hapd, addr);
3048 if (sta == NULL && iface->num_bss > 1) {
3050 for (j = 0; j < iface->num_bss; j++) {
3051 hapd = iface->bss[j];
3052 sta = ap_get_sta(hapd, addr);
3057 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
3059 if (sta->flags & WLAN_STA_PENDING_POLL) {
3060 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
3061 "activity poll", MAC2STR(sta->addr),
3062 ack ? "ACKed" : "did not ACK");
3064 sta->flags &= ~WLAN_STA_PENDING_POLL;
3067 ieee802_1x_tx_status(hapd, sta, buf, len, ack);
3071 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
3072 const u8 *data, size_t len, int ack)
3074 struct sta_info *sta;
3075 struct hostapd_iface *iface = hapd->iface;
3077 sta = ap_get_sta(hapd, dst);
3078 if (sta == NULL && iface->num_bss > 1) {
3080 for (j = 0; j < iface->num_bss; j++) {
3081 hapd = iface->bss[j];
3082 sta = ap_get_sta(hapd, dst);
3087 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
3088 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
3089 MACSTR " that is not currently associated",
3094 ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
3098 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
3100 struct sta_info *sta;
3101 struct hostapd_iface *iface = hapd->iface;
3103 sta = ap_get_sta(hapd, addr);
3104 if (sta == NULL && iface->num_bss > 1) {
3106 for (j = 0; j < iface->num_bss; j++) {
3107 hapd = iface->bss[j];
3108 sta = ap_get_sta(hapd, addr);
3115 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
3116 MAC2STR(sta->addr));
3117 if (!(sta->flags & WLAN_STA_PENDING_POLL))
3120 wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
3121 "activity poll", MAC2STR(sta->addr));
3122 sta->flags &= ~WLAN_STA_PENDING_POLL;
3126 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
3129 struct sta_info *sta;
3131 sta = ap_get_sta(hapd, src);
3132 if (sta && (sta->flags & WLAN_STA_ASSOC)) {
3133 if (!hapd->conf->wds_sta)
3136 if (wds && !(sta->flags & WLAN_STA_WDS)) {
3138 char ifname_wds[IFNAMSIZ + 1];
3140 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
3141 "STA " MACSTR " (aid %u)",
3142 MAC2STR(sta->addr), sta->aid);
3143 sta->flags |= WLAN_STA_WDS;
3144 ret = hostapd_set_wds_sta(hapd, ifname_wds,
3145 sta->addr, sta->aid, 1);
3147 hostapd_set_wds_encryption(hapd, sta,
3153 wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
3154 MACSTR, MAC2STR(src));
3155 if (is_multicast_ether_addr(src)) {
3156 /* Broadcast bit set in SA?! Ignore the frame silently. */
3160 if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
3161 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
3162 "already been sent, but no TX status yet known - "
3163 "ignore Class 3 frame issue with " MACSTR,
3168 if (sta && (sta->flags & WLAN_STA_AUTH))
3169 hostapd_drv_sta_disassoc(
3171 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
3173 hostapd_drv_sta_deauth(
3175 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
3179 #endif /* CONFIG_NATIVE_WINDOWS */