src/ap/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2014, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #ifndef CONFIG_NATIVE_WINDOWS
  12
  13 #include "utils/common.h"
  14 #include "utils/eloop.h"
  15 #include "crypto/crypto.h"
  16 #include "crypto/sha256.h"
  17 #include "crypto/random.h"
  18 #include "common/ieee802_11_defs.h"
  19 #include "common/ieee802_11_common.h"
  20 #include "common/wpa_ctrl.h"
  21 #include "common/sae.h"
  22 #include "radius/radius.h"
  23 #include "radius/radius_client.h"
  24 #include "p2p/p2p.h"
  25 #include "wps/wps.h"
  26 #include "fst/fst.h"
  27 #include "hostapd.h"
  28 #include "beacon.h"
  29 #include "ieee802_11_auth.h"
  30 #include "sta_info.h"
  31 #include "ieee802_1x.h"
  32 #include "wpa_auth.h"
  33 #include "pmksa_cache_auth.h"
  34 #include "wmm.h"
  35 #include "ap_list.h"
  36 #include "accounting.h"
  37 #include "ap_config.h"
  38 #include "ap_mlme.h"
  39 #include "p2p_hostapd.h"
  40 #include "ap_drv_ops.h"
  41 #include "wnm_ap.h"
  42 #include "hw_features.h"
  43 #include "ieee802_11.h"
  44 #include "dfs.h"
  45
  46
  47 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  48 {
  49         u8 *pos = eid;
  50         int i, num, count;
  51
  52         if (hapd->iface->current_rates == NULL)
  53                 return eid;
  54
  55         *pos++ = WLAN_EID_SUPP_RATES;
  56         num = hapd->iface->num_rates;
  57         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
  58                 num++;
  59         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
  60                 num++;
  61         if (num > 8) {
  62                 /* rest of the rates are encoded in Extended supported
  63                  * rates element */
  64                 num = 8;
  65         }
  66
  67         *pos++ = num;
  68         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  69              i++) {
  70                 count++;
  71                 *pos = hapd->iface->current_rates[i].rate / 5;
  72                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  73                         *pos |= 0x80;
  74                 pos++;
  75         }
  76
  77         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
  78                 count++;
  79                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
  80         }
  81
  82         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
  83                 count++;
  84                 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
  85         }
  86
  87         return pos;
  88 }
  89
  90
  91 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  92 {
  93         u8 *pos = eid;
  94         int i, num, count;
  95
  96         if (hapd->iface->current_rates == NULL)
  97                 return eid;
  98
  99         num = hapd->iface->num_rates;
 100         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
 101                 num++;
 102         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
 103                 num++;
 104         if (num <= 8)
 105                 return eid;
 106         num -= 8;
 107
 108         *pos++ = WLAN_EID_EXT_SUPP_RATES;
 109         *pos++ = num;
 110         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
 111              i++) {
 112                 count++;
 113                 if (count <= 8)
 114                         continue; /* already in SuppRates IE */
 115                 *pos = hapd->iface->current_rates[i].rate / 5;
 116                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
 117                         *pos |= 0x80;
 118                 pos++;
 119         }
 120
 121         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
 122                 count++;
 123                 if (count > 8)
 124                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
 125         }
 126
 127         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
 128                 count++;
 129                 if (count > 8)
 130                         *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
 131         }
 132
 133         return pos;
 134 }
 135
 136
 137 u16 hostapd_own_capab_info(struct hostapd_data *hapd)
 138 {
 139         int capab = WLAN_CAPABILITY_ESS;
 140         int privacy;
 141         int dfs;
 142
 143         /* Check if any of configured channels require DFS */
 144         dfs = hostapd_is_dfs_required(hapd->iface);
 145         if (dfs < 0) {
 146                 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
 147                            dfs);
 148                 dfs = 0;
 149         }
 150
 151         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 152             hapd->iconf->preamble == SHORT_PREAMBLE)
 153                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 154
 155         privacy = hapd->conf->ssid.wep.keys_set;
 156
 157         if (hapd->conf->ieee802_1x &&
 158             (hapd->conf->default_wep_key_len ||
 159              hapd->conf->individual_wep_key_len))
 160                 privacy = 1;
 161
 162         if (hapd->conf->wpa)
 163                 privacy = 1;
 164
 165 #ifdef CONFIG_HS20
 166         if (hapd->conf->osen)
 167                 privacy = 1;
 168 #endif /* CONFIG_HS20 */
 169
 170         if (privacy)
 171                 capab |= WLAN_CAPABILITY_PRIVACY;
 172
 173         if (hapd->iface->current_mode &&
 174             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 175             hapd->iface->num_sta_no_short_slot_time == 0)
 176                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 177
 178         /*
 179          * Currently, Spectrum Management capability bit is set when directly
 180          * requested in configuration by spectrum_mgmt_required or when AP is
 181          * running on DFS channel.
 182          * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
 183          */
 184         if (hapd->iface->current_mode &&
 185             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
 186             (hapd->iconf->spectrum_mgmt_required || dfs))
 187                 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 188
 189         if (hapd->conf->radio_measurements)
 190                 capab |= IEEE80211_CAP_RRM;
 191
 192         return capab;
 193 }
 194
 195
 196 #ifndef CONFIG_NO_RC4
 197 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 198                            u16 auth_transaction, const u8 *challenge,
 199                            int iswep)
 200 {
 201         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 202                        HOSTAPD_LEVEL_DEBUG,
 203                        "authentication (shared key, transaction %d)",
 204                        auth_transaction);
 205
 206         if (auth_transaction == 1) {
 207                 if (!sta->challenge) {
 208                         /* Generate a pseudo-random challenge */
 209                         u8 key[8];
 210
 211                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 212                         if (sta->challenge == NULL)
 213                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 214
 215                         if (os_get_random(key, sizeof(key)) < 0) {
 216                                 os_free(sta->challenge);
 217                                 sta->challenge = NULL;
 218                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 219                         }
 220
 221                         rc4_skip(key, sizeof(key), 0,
 222                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 223                 }
 224                 return 0;
 225         }
 226
 227         if (auth_transaction != 3)
 228                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 229
 230         /* Transaction 3 */
 231         if (!iswep || !sta->challenge || !challenge ||
 232             os_memcmp_const(sta->challenge, challenge,
 233                             WLAN_AUTH_CHALLENGE_LEN)) {
 234                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 235                                HOSTAPD_LEVEL_INFO,
 236                                "shared key authentication - invalid "
 237                                "challenge-response");
 238                 return WLAN_STATUS_CHALLENGE_FAIL;
 239         }
 240
 241         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 242                        HOSTAPD_LEVEL_DEBUG,
 243                        "authentication OK (shared key)");
 244         sta->flags |= WLAN_STA_AUTH;
 245         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 246         os_free(sta->challenge);
 247         sta->challenge = NULL;
 248
 249         return 0;
 250 }
 251 #endif /* CONFIG_NO_RC4 */
 252
 253
 254 static int send_auth_reply(struct hostapd_data *hapd,
 255                            const u8 *dst, const u8 *bssid,
 256                            u16 auth_alg, u16 auth_transaction, u16 resp,
 257                            const u8 *ies, size_t ies_len)
 258 {
 259         struct ieee80211_mgmt *reply;
 260         u8 *buf;
 261         size_t rlen;
 262         int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
 263
 264         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 265         buf = os_zalloc(rlen);
 266         if (buf == NULL)
 267                 return -1;
 268
 269         reply = (struct ieee80211_mgmt *) buf;
 270         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 271                                             WLAN_FC_STYPE_AUTH);
 272         os_memcpy(reply->da, dst, ETH_ALEN);
 273         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 274         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 275
 276         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 277         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 278         reply->u.auth.status_code = host_to_le16(resp);
 279
 280         if (ies && ies_len)
 281                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 282
 283         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 284                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 285                    MAC2STR(dst), auth_alg, auth_transaction,
 286                    resp, (unsigned long) ies_len);
 287         if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
 288                 wpa_printf(MSG_INFO, "send_auth_reply: send failed");
 289         else
 290                 reply_res = WLAN_STATUS_SUCCESS;
 291
 292         os_free(buf);
 293
 294         return reply_res;
 295 }
 296
 297
 298 #ifdef CONFIG_IEEE80211R
 299 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 300                                   u16 auth_transaction, u16 status,
 301                                   const u8 *ies, size_t ies_len)
 302 {
 303         struct hostapd_data *hapd = ctx;
 304         struct sta_info *sta;
 305         int reply_res;
 306
 307         reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT,
 308                                     auth_transaction, status, ies, ies_len);
 309
 310         sta = ap_get_sta(hapd, dst);
 311         if (sta == NULL)
 312                 return;
 313
 314         if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
 315                                    status != WLAN_STATUS_SUCCESS)) {
 316                 hostapd_drv_sta_remove(hapd, sta->addr);
 317                 sta->added_unassoc = 0;
 318                 return;
 319         }
 320
 321         if (status != WLAN_STATUS_SUCCESS)
 322                 return;
 323
 324         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 325                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 326         sta->flags |= WLAN_STA_AUTH;
 327         mlme_authenticate_indication(hapd, sta);
 328 }
 329 #endif /* CONFIG_IEEE80211R */
 330
 331
 332 #ifdef CONFIG_SAE
 333
 334 #define dot11RSNASAESync 5              /* attempts */
 335
 336
 337 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
 338                                              struct sta_info *sta, int update)
 339 {
 340         struct wpabuf *buf;
 341
 342         if (hapd->conf->ssid.wpa_passphrase == NULL) {
 343                 wpa_printf(MSG_DEBUG, "SAE: No password available");
 344                 return NULL;
 345         }
 346
 347         if (update &&
 348             sae_prepare_commit(hapd->own_addr, sta->addr,
 349                                (u8 *) hapd->conf->ssid.wpa_passphrase,
 350                                os_strlen(hapd->conf->ssid.wpa_passphrase),
 351                                sta->sae) < 0) {
 352                 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
 353                 return NULL;
 354         }
 355
 356         buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN);
 357         if (buf == NULL)
 358                 return NULL;
 359         sae_write_commit(sta->sae, buf, sta->sae->tmp ?
 360                          sta->sae->tmp->anti_clogging_token : NULL);
 361
 362         return buf;
 363 }
 364
 365
 366 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
 367                                               struct sta_info *sta)
 368 {
 369         struct wpabuf *buf;
 370
 371         buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
 372         if (buf == NULL)
 373                 return NULL;
 374
 375         sae_write_confirm(sta->sae, buf);
 376
 377         return buf;
 378 }
 379
 380
 381 static int auth_sae_send_commit(struct hostapd_data *hapd,
 382                                 struct sta_info *sta,
 383                                 const u8 *bssid, int update)
 384 {
 385         struct wpabuf *data;
 386         int reply_res;
 387
 388         data = auth_build_sae_commit(hapd, sta, update);
 389         if (data == NULL)
 390                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 391
 392         reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1,
 393                                     WLAN_STATUS_SUCCESS, wpabuf_head(data),
 394                                     wpabuf_len(data));
 395
 396         wpabuf_free(data);
 397
 398         return reply_res;
 399 }
 400
 401
 402 static int auth_sae_send_confirm(struct hostapd_data *hapd,
 403                                  struct sta_info *sta,
 404                                  const u8 *bssid)
 405 {
 406         struct wpabuf *data;
 407         int reply_res;
 408
 409         data = auth_build_sae_confirm(hapd, sta);
 410         if (data == NULL)
 411                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 412
 413         reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2,
 414                                     WLAN_STATUS_SUCCESS, wpabuf_head(data),
 415                                     wpabuf_len(data));
 416
 417         wpabuf_free(data);
 418
 419         return reply_res;
 420 }
 421
 422
 423 static int use_sae_anti_clogging(struct hostapd_data *hapd)
 424 {
 425         struct sta_info *sta;
 426         unsigned int open = 0;
 427
 428         if (hapd->conf->sae_anti_clogging_threshold == 0)
 429                 return 1;
 430
 431         for (sta = hapd->sta_list; sta; sta = sta->next) {
 432                 if (!sta->sae)
 433                         continue;
 434                 if (sta->sae->state != SAE_COMMITTED &&
 435                     sta->sae->state != SAE_CONFIRMED)
 436                         continue;
 437                 open++;
 438                 if (open >= hapd->conf->sae_anti_clogging_threshold)
 439                         return 1;
 440         }
 441
 442         return 0;
 443 }
 444
 445
 446 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
 447                            const u8 *token, size_t token_len)
 448 {
 449         u8 mac[SHA256_MAC_LEN];
 450
 451         if (token_len != SHA256_MAC_LEN)
 452                 return -1;
 453         if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 454                         addr, ETH_ALEN, mac) < 0 ||
 455             os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0)
 456                 return -1;
 457
 458         return 0;
 459 }
 460
 461
 462 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
 463                                             int group, const u8 *addr)
 464 {
 465         struct wpabuf *buf;
 466         u8 *token;
 467         struct os_reltime now;
 468
 469         os_get_reltime(&now);
 470         if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
 471             os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
 472                 if (random_get_bytes(hapd->sae_token_key,
 473                                      sizeof(hapd->sae_token_key)) < 0)
 474                         return NULL;
 475                 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
 476                             hapd->sae_token_key, sizeof(hapd->sae_token_key));
 477                 hapd->last_sae_token_key_update = now;
 478         }
 479
 480         buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
 481         if (buf == NULL)
 482                 return NULL;
 483
 484         wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
 485
 486         token = wpabuf_put(buf, SHA256_MAC_LEN);
 487         hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
 488                     addr, ETH_ALEN, token);
 489
 490         return buf;
 491 }
 492
 493
 494 static int sae_check_big_sync(struct sta_info *sta)
 495 {
 496         if (sta->sae->sync > dot11RSNASAESync) {
 497                 sta->sae->state = SAE_NOTHING;
 498                 sta->sae->sync = 0;
 499                 return -1;
 500         }
 501         return 0;
 502 }
 503
 504
 505 static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
 506 {
 507         struct hostapd_data *hapd = eloop_ctx;
 508         struct sta_info *sta = eloop_data;
 509         int ret;
 510
 511         if (sae_check_big_sync(sta))
 512                 return;
 513         sta->sae->sync++;
 514
 515         switch (sta->sae->state) {
 516         case SAE_COMMITTED:
 517                 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
 518                 eloop_register_timeout(0,
 519                                        hapd->dot11RSNASAERetransPeriod * 1000,
 520                                        auth_sae_retransmit_timer, hapd, sta);
 521                 break;
 522         case SAE_CONFIRMED:
 523                 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
 524                 eloop_register_timeout(0,
 525                                        hapd->dot11RSNASAERetransPeriod * 1000,
 526                                        auth_sae_retransmit_timer, hapd, sta);
 527                 break;
 528         default:
 529                 ret = -1;
 530                 break;
 531         }
 532
 533         if (ret != WLAN_STATUS_SUCCESS)
 534                 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
 535 }
 536
 537
 538 void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
 539 {
 540         eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
 541 }
 542
 543
 544 static void sae_set_retransmit_timer(struct hostapd_data *hapd,
 545                                      struct sta_info *sta)
 546 {
 547         if (!(hapd->conf->mesh & MESH_ENABLED))
 548                 return;
 549
 550         eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
 551         eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
 552                                auth_sae_retransmit_timer, hapd, sta);
 553 }
 554
 555
 556 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
 557                        const u8 *bssid, u8 auth_transaction)
 558 {
 559         int ret;
 560
 561         if (auth_transaction != 1 && auth_transaction != 2)
 562                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 563
 564         switch (sta->sae->state) {
 565         case SAE_NOTHING:
 566                 if (auth_transaction == 1) {
 567                         ret = auth_sae_send_commit(hapd, sta, bssid, 1);
 568                         if (ret)
 569                                 return ret;
 570                         sta->sae->state = SAE_COMMITTED;
 571
 572                         if (sae_process_commit(sta->sae) < 0)
 573                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 574
 575                         /*
 576                          * In mesh case, both Commit and Confirm can be sent
 577                          * immediately. In infrastructure BSS, only a single
 578                          * Authentication frame (Commit) is expected from the AP
 579                          * here and the second one (Confirm) will be sent once
 580                          * the STA has sent its second Authentication frame
 581                          * (Confirm).
 582                          */
 583                         if (hapd->conf->mesh & MESH_ENABLED) {
 584                                 /*
 585                                  * Send both Commit and Confirm immediately
 586                                  * based on SAE finite state machine
 587                                  * Nothing -> Confirm transition.
 588                                  */
 589                                 ret = auth_sae_send_confirm(hapd, sta, bssid);
 590                                 if (ret)
 591                                         return ret;
 592                                 sta->sae->state = SAE_CONFIRMED;
 593                         } else {
 594                                 /*
 595                                  * For infrastructure BSS, send only the Commit
 596                                  * message now to get alternating sequence of
 597                                  * Authentication frames between the AP and STA.
 598                                  * Confirm will be sent in
 599                                  * Commited -> Confirmed/Accepted transition
 600                                  * when receiving Confirm from STA.
 601                                  */
 602                         }
 603                         sta->sae->sync = 0;
 604                         sae_set_retransmit_timer(hapd, sta);
 605                 } else {
 606                         hostapd_logger(hapd, sta->addr,
 607                                        HOSTAPD_MODULE_IEEE80211,
 608                                        HOSTAPD_LEVEL_DEBUG,
 609                                        "SAE confirm before commit");
 610                 }
 611                 break;
 612         case SAE_COMMITTED:
 613                 sae_clear_retransmit_timer(hapd, sta);
 614                 if (auth_transaction == 1) {
 615                         if (sae_process_commit(sta->sae) < 0)
 616                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 617
 618                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 619                         if (ret)
 620                                 return ret;
 621                         sta->sae->state = SAE_CONFIRMED;
 622                         sta->sae->sync = 0;
 623                         sae_set_retransmit_timer(hapd, sta);
 624                 } else if (hapd->conf->mesh & MESH_ENABLED) {
 625                         /*
 626                          * In mesh case, follow SAE finite state machine and
 627                          * send Commit now, if sync count allows.
 628                          */
 629                         if (sae_check_big_sync(sta))
 630                                 return WLAN_STATUS_SUCCESS;
 631                         sta->sae->sync++;
 632
 633                         ret = auth_sae_send_commit(hapd, sta, bssid, 0);
 634                         if (ret)
 635                                 return ret;
 636
 637                         sae_set_retransmit_timer(hapd, sta);
 638                 } else {
 639                         /*
 640                          * For instructure BSS, send the postponed Confirm from
 641                          * Nothing -> Confirmed transition that was reduced to
 642                          * Nothing -> Committed above.
 643                          */
 644                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 645                         if (ret)
 646                                 return ret;
 647
 648                         sta->sae->state = SAE_CONFIRMED;
 649
 650                         /*
 651                          * Since this was triggered on Confirm RX, run another
 652                          * step to get to Accepted without waiting for
 653                          * additional events.
 654                          */
 655                         return sae_sm_step(hapd, sta, bssid, auth_transaction);
 656                 }
 657                 break;
 658         case SAE_CONFIRMED:
 659                 sae_clear_retransmit_timer(hapd, sta);
 660                 if (auth_transaction == 1) {
 661                         if (sae_check_big_sync(sta))
 662                                 return WLAN_STATUS_SUCCESS;
 663                         sta->sae->sync++;
 664
 665                         ret = auth_sae_send_commit(hapd, sta, bssid, 1);
 666                         if (ret)
 667                                 return ret;
 668
 669                         if (sae_process_commit(sta->sae) < 0)
 670                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 671
 672                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 673                         if (ret)
 674                                 return ret;
 675
 676                         sae_set_retransmit_timer(hapd, sta);
 677                 } else {
 678                         sta->flags |= WLAN_STA_AUTH;
 679                         sta->auth_alg = WLAN_AUTH_SAE;
 680                         mlme_authenticate_indication(hapd, sta);
 681                         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 682                         sta->sae->state = SAE_ACCEPTED;
 683                         wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
 684                                                sta->sae->pmk, sta->sae->pmkid);
 685                 }
 686                 break;
 687         case SAE_ACCEPTED:
 688                 if (auth_transaction == 1) {
 689                         wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
 690                                    ") doing reauthentication",
 691                                    MAC2STR(sta->addr));
 692                         ap_free_sta(hapd, sta);
 693                 } else {
 694                         if (sae_check_big_sync(sta))
 695                                 return WLAN_STATUS_SUCCESS;
 696                         sta->sae->sync++;
 697
 698                         ret = auth_sae_send_confirm(hapd, sta, bssid);
 699                         sae_clear_temp_data(sta->sae);
 700                         if (ret)
 701                                 return ret;
 702                 }
 703                 break;
 704         default:
 705                 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
 706                            sta->sae->state);
 707                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 708         }
 709         return WLAN_STATUS_SUCCESS;
 710 }
 711
 712
 713 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
 714                             const struct ieee80211_mgmt *mgmt, size_t len,
 715                             u16 auth_transaction, u16 status_code)
 716 {
 717         int resp = WLAN_STATUS_SUCCESS;
 718         struct wpabuf *data = NULL;
 719
 720         if (!sta->sae) {
 721                 if (auth_transaction != 1 ||
 722                     status_code != WLAN_STATUS_SUCCESS) {
 723                         resp = -1;
 724                         goto remove_sta;
 725                 }
 726                 sta->sae = os_zalloc(sizeof(*sta->sae));
 727                 if (!sta->sae) {
 728                         resp = -1;
 729                         goto remove_sta;
 730                 }
 731                 sta->sae->state = SAE_NOTHING;
 732                 sta->sae->sync = 0;
 733         }
 734
 735         if (auth_transaction == 1) {
 736                 const u8 *token = NULL, *pos, *end;
 737                 size_t token_len = 0;
 738                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 739                                HOSTAPD_LEVEL_DEBUG,
 740                                "start SAE authentication (RX commit, status=%u)",
 741                                status_code);
 742
 743                 if ((hapd->conf->mesh & MESH_ENABLED) &&
 744                     status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
 745                     sta->sae->tmp) {
 746                         pos = mgmt->u.auth.variable;
 747                         end = ((const u8 *) mgmt) + len;
 748                         if (pos + sizeof(le16) > end) {
 749                                 wpa_printf(MSG_ERROR,
 750                                            "SAE: Too short anti-clogging token request");
 751                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 752                                 goto reply;
 753                         }
 754                         resp = sae_group_allowed(sta->sae,
 755                                                  hapd->conf->sae_groups,
 756                                                  WPA_GET_LE16(pos));
 757                         if (resp != WLAN_STATUS_SUCCESS) {
 758                                 wpa_printf(MSG_ERROR,
 759                                            "SAE: Invalid group in anti-clogging token request");
 760                                 goto reply;
 761                         }
 762                         pos += sizeof(le16);
 763
 764                         wpabuf_free(sta->sae->tmp->anti_clogging_token);
 765                         sta->sae->tmp->anti_clogging_token =
 766                                 wpabuf_alloc_copy(pos, end - pos);
 767                         if (sta->sae->tmp->anti_clogging_token == NULL) {
 768                                 wpa_printf(MSG_ERROR,
 769                                            "SAE: Failed to alloc for anti-clogging token");
 770                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 771                                 goto remove_sta;
 772                         }
 773
 774                         /*
 775                          * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
 776                          * is 76, a new Commit Message shall be constructed
 777                          * with the Anti-Clogging Token from the received
 778                          * Authentication frame, and the commit-scalar and
 779                          * COMMIT-ELEMENT previously sent.
 780                          */
 781                         resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0);
 782                         if (resp != WLAN_STATUS_SUCCESS) {
 783                                 wpa_printf(MSG_ERROR,
 784                                            "SAE: Failed to send commit message");
 785                                 goto remove_sta;
 786                         }
 787                         sta->sae->state = SAE_COMMITTED;
 788                         sta->sae->sync = 0;
 789                         sae_set_retransmit_timer(hapd, sta);
 790                         return;
 791                 }
 792
 793                 if (status_code != WLAN_STATUS_SUCCESS)
 794                         goto remove_sta;
 795
 796                 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
 797                                         ((const u8 *) mgmt) + len -
 798                                         mgmt->u.auth.variable, &token,
 799                                         &token_len, hapd->conf->sae_groups);
 800                 if (resp == SAE_SILENTLY_DISCARD) {
 801                         wpa_printf(MSG_DEBUG,
 802                                    "SAE: Drop commit message from " MACSTR " due to reflection attack",
 803                                    MAC2STR(sta->addr));
 804                         goto remove_sta;
 805                 }
 806                 if (token && check_sae_token(hapd, sta->addr, token, token_len)
 807                     < 0) {
 808                         wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
 809                                    "incorrect token from " MACSTR,
 810                                    MAC2STR(sta->addr));
 811                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 812                         goto remove_sta;
 813                 }
 814
 815                 if (resp != WLAN_STATUS_SUCCESS)
 816                         goto reply;
 817
 818                 if (!token && use_sae_anti_clogging(hapd)) {
 819                         wpa_printf(MSG_DEBUG,
 820                                    "SAE: Request anti-clogging token from "
 821                                    MACSTR, MAC2STR(sta->addr));
 822                         data = auth_build_token_req(hapd, sta->sae->group,
 823                                                     sta->addr);
 824                         resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
 825                         if (hapd->conf->mesh & MESH_ENABLED)
 826                                 sta->sae->state = SAE_NOTHING;
 827                         goto reply;
 828                 }
 829
 830                 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
 831         } else if (auth_transaction == 2) {
 832                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 833                                HOSTAPD_LEVEL_DEBUG,
 834                                "SAE authentication (RX confirm, status=%u)",
 835                                status_code);
 836                 if (status_code != WLAN_STATUS_SUCCESS)
 837                         goto remove_sta;
 838                 if (sta->sae->state >= SAE_CONFIRMED ||
 839                     !(hapd->conf->mesh & MESH_ENABLED)) {
 840                         if (sae_check_confirm(sta->sae, mgmt->u.auth.variable,
 841                                               ((u8 *) mgmt) + len -
 842                                               mgmt->u.auth.variable) < 0) {
 843                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 844                                 goto reply;
 845                         }
 846                 }
 847                 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
 848         } else {
 849                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 850                                HOSTAPD_LEVEL_DEBUG,
 851                                "unexpected SAE authentication transaction %u (status=%u)",
 852                                auth_transaction, status_code);
 853                 if (status_code != WLAN_STATUS_SUCCESS)
 854                         goto remove_sta;
 855                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 856         }
 857
 858 reply:
 859         if (resp != WLAN_STATUS_SUCCESS) {
 860                 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
 861                                 auth_transaction, resp,
 862                                 data ? wpabuf_head(data) : (u8 *) "",
 863                                 data ? wpabuf_len(data) : 0);
 864         }
 865
 866 remove_sta:
 867         if (sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
 868                                    status_code != WLAN_STATUS_SUCCESS)) {
 869                 hostapd_drv_sta_remove(hapd, sta->addr);
 870                 sta->added_unassoc = 0;
 871         }
 872         wpabuf_free(data);
 873 }
 874
 875
 876 /**
 877  * auth_sae_init_committed - Send COMMIT and start SAE in committed state
 878  * @hapd: BSS data for the device initiating the authentication
 879  * @sta: the peer to which commit authentication frame is sent
 880  *
 881  * This function implements Init event handling (IEEE Std 802.11-2012,
 882  * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
 883  * sta->sae structure should be initialized appropriately via a call to
 884  * sae_prepare_commit().
 885  */
 886 int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
 887 {
 888         int ret;
 889
 890         if (!sta->sae || !sta->sae->tmp)
 891                 return -1;
 892
 893         if (sta->sae->state != SAE_NOTHING)
 894                 return -1;
 895
 896         ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
 897         if (ret)
 898                 return -1;
 899
 900         sta->sae->state = SAE_COMMITTED;
 901         sta->sae->sync = 0;
 902         sae_set_retransmit_timer(hapd, sta);
 903
 904         return 0;
 905 }
 906
 907 #endif /* CONFIG_SAE */
 908
 909
 910 static void handle_auth(struct hostapd_data *hapd,
 911                         const struct ieee80211_mgmt *mgmt, size_t len)
 912 {
 913         u16 auth_alg, auth_transaction, status_code;
 914         u16 resp = WLAN_STATUS_SUCCESS;
 915         struct sta_info *sta = NULL;
 916         int res, reply_res;
 917         u16 fc;
 918         const u8 *challenge = NULL;
 919         u32 session_timeout, acct_interim_interval;
 920         struct vlan_description vlan_id;
 921         struct hostapd_sta_wpa_psk_short *psk = NULL;
 922         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 923         size_t resp_ies_len = 0;
 924         char *identity = NULL;
 925         char *radius_cui = NULL;
 926         u16 seq_ctrl;
 927
 928         os_memset(&vlan_id, 0, sizeof(vlan_id));
 929
 930         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 931                 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
 932                            (unsigned long) len);
 933                 return;
 934         }
 935
 936 #ifdef CONFIG_TESTING_OPTIONS
 937         if (hapd->iconf->ignore_auth_probability > 0.0 &&
 938             drand48() < hapd->iconf->ignore_auth_probability) {
 939                 wpa_printf(MSG_INFO,
 940                            "TESTING: ignoring auth frame from " MACSTR,
 941                            MAC2STR(mgmt->sa));
 942                 return;
 943         }
 944 #endif /* CONFIG_TESTING_OPTIONS */
 945
 946         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 947         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 948         status_code = le_to_host16(mgmt->u.auth.status_code);
 949         fc = le_to_host16(mgmt->frame_control);
 950         seq_ctrl = le_to_host16(mgmt->seq_ctrl);
 951
 952         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 953             2 + WLAN_AUTH_CHALLENGE_LEN &&
 954             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 955             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 956                 challenge = &mgmt->u.auth.variable[2];
 957
 958         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 959                    "auth_transaction=%d status_code=%d wep=%d%s "
 960                    "seq_ctrl=0x%x%s",
 961                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 962                    status_code, !!(fc & WLAN_FC_ISWEP),
 963                    challenge ? " challenge" : "",
 964                    seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
 965
 966 #ifdef CONFIG_NO_RC4
 967         if (auth_alg == WLAN_AUTH_SHARED_KEY) {
 968                 wpa_printf(MSG_INFO,
 969                            "Unsupported authentication algorithm (%d)",
 970                            auth_alg);
 971                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 972                 goto fail;
 973         }
 974 #endif /* CONFIG_NO_RC4 */
 975
 976         if (hapd->tkip_countermeasures) {
 977                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 978                 goto fail;
 979         }
 980
 981         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 982                auth_alg == WLAN_AUTH_OPEN) ||
 983 #ifdef CONFIG_IEEE80211R
 984               (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
 985                auth_alg == WLAN_AUTH_FT) ||
 986 #endif /* CONFIG_IEEE80211R */
 987 #ifdef CONFIG_SAE
 988               (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
 989                auth_alg == WLAN_AUTH_SAE) ||
 990 #endif /* CONFIG_SAE */
 991               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 992                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 993                 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
 994                            auth_alg);
 995                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 996                 goto fail;
 997         }
 998
 999         if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
1000               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
1001                 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
1002                            auth_transaction);
1003                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1004                 goto fail;
1005         }
1006
1007         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
1008                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1009                            MAC2STR(mgmt->sa));
1010                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1011                 goto fail;
1012         }
1013
1014         if (hapd->conf->no_auth_if_seen_on) {
1015                 struct hostapd_data *other;
1016
1017                 other = sta_track_seen_on(hapd->iface, mgmt->sa,
1018                                           hapd->conf->no_auth_if_seen_on);
1019                 if (other) {
1020                         u8 *pos;
1021                         u32 info;
1022                         u8 op_class, channel, phytype;
1023
1024                         wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
1025                                    MACSTR " since STA has been seen on %s",
1026                                    hapd->conf->iface, MAC2STR(mgmt->sa),
1027                                    hapd->conf->no_auth_if_seen_on);
1028
1029                         resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
1030                         pos = &resp_ies[0];
1031                         *pos++ = WLAN_EID_NEIGHBOR_REPORT;
1032                         *pos++ = 13;
1033                         os_memcpy(pos, other->own_addr, ETH_ALEN);
1034                         pos += ETH_ALEN;
1035                         info = 0; /* TODO: BSSID Information */
1036                         WPA_PUT_LE32(pos, info);
1037                         pos += 4;
1038                         if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
1039                                 phytype = 8; /* dmg */
1040                         else if (other->iconf->ieee80211ac)
1041                                 phytype = 9; /* vht */
1042                         else if (other->iconf->ieee80211n)
1043                                 phytype = 7; /* ht */
1044                         else if (other->iconf->hw_mode ==
1045                                  HOSTAPD_MODE_IEEE80211A)
1046                                 phytype = 4; /* ofdm */
1047                         else if (other->iconf->hw_mode ==
1048                                  HOSTAPD_MODE_IEEE80211G)
1049                                 phytype = 6; /* erp */
1050                         else
1051                                 phytype = 5; /* hrdsss */
1052                         if (ieee80211_freq_to_channel_ext(
1053                                     hostapd_hw_get_freq(other,
1054                                                         other->iconf->channel),
1055                                     other->iconf->secondary_channel,
1056                                     other->iconf->ieee80211ac,
1057                                     &op_class, &channel) == NUM_HOSTAPD_MODES) {
1058                                 op_class = 0;
1059                                 channel = other->iconf->channel;
1060                         }
1061                         *pos++ = op_class;
1062                         *pos++ = channel;
1063                         *pos++ = phytype;
1064                         resp_ies_len = pos - &resp_ies[0];
1065                         goto fail;
1066                 }
1067         }
1068
1069         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
1070                                       &session_timeout,
1071                                       &acct_interim_interval, &vlan_id,
1072                                       &psk, &identity, &radius_cui);
1073
1074         if (res == HOSTAPD_ACL_REJECT) {
1075                 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1076                            MAC2STR(mgmt->sa));
1077                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1078                 goto fail;
1079         }
1080         if (res == HOSTAPD_ACL_PENDING) {
1081                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
1082                            " waiting for an external authentication",
1083                            MAC2STR(mgmt->sa));
1084                 /* Authentication code will re-send the authentication frame
1085                  * after it has received (and cached) information from the
1086                  * external source. */
1087                 return;
1088         }
1089
1090         sta = ap_get_sta(hapd, mgmt->sa);
1091         if (sta) {
1092                 if ((fc & WLAN_FC_RETRY) &&
1093                     sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1094                     sta->last_seq_ctrl == seq_ctrl &&
1095                     sta->last_subtype == WLAN_FC_STYPE_AUTH) {
1096                         hostapd_logger(hapd, sta->addr,
1097                                        HOSTAPD_MODULE_IEEE80211,
1098                                        HOSTAPD_LEVEL_DEBUG,
1099                                        "Drop repeated authentication frame seq_ctrl=0x%x",
1100                                        seq_ctrl);
1101                         return;
1102                 }
1103 #ifdef CONFIG_MESH
1104                 if ((hapd->conf->mesh & MESH_ENABLED) &&
1105                     sta->plink_state == PLINK_BLOCKED) {
1106                         wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1107                                    " is blocked - drop Authentication frame",
1108                                    MAC2STR(mgmt->sa));
1109                         return;
1110                 }
1111 #endif /* CONFIG_MESH */
1112         } else {
1113 #ifdef CONFIG_MESH
1114                 if (hapd->conf->mesh & MESH_ENABLED) {
1115                         /* if the mesh peer is not available, we don't do auth.
1116                          */
1117                         wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1118                                    " not yet known - drop Authentication frame",
1119                                    MAC2STR(mgmt->sa));
1120                         /*
1121                          * Save a copy of the frame so that it can be processed
1122                          * if a new peer entry is added shortly after this.
1123                          */
1124                         wpabuf_free(hapd->mesh_pending_auth);
1125                         hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
1126                         os_get_reltime(&hapd->mesh_pending_auth_time);
1127                         return;
1128                 }
1129 #endif /* CONFIG_MESH */
1130
1131                 sta = ap_sta_add(hapd, mgmt->sa);
1132                 if (!sta) {
1133                         resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1134                         goto fail;
1135                 }
1136         }
1137         sta->last_seq_ctrl = seq_ctrl;
1138         sta->last_subtype = WLAN_FC_STYPE_AUTH;
1139
1140         if (vlan_id.notempty &&
1141             !hostapd_vlan_valid(hapd->conf->vlan, &vlan_id)) {
1142                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1143                                HOSTAPD_LEVEL_INFO,
1144                                "Invalid VLAN %d%s received from RADIUS server",
1145                                vlan_id.untagged,
1146                                vlan_id.tagged[0] ? "+" : "");
1147                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1148                 goto fail;
1149         }
1150         if (ap_sta_set_vlan(hapd, sta, &vlan_id) < 0) {
1151                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1152                 goto fail;
1153         }
1154         if (sta->vlan_id)
1155                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1156                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1157
1158         hostapd_free_psk_list(sta->psk);
1159         if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1160                 sta->psk = psk;
1161                 psk = NULL;
1162         } else {
1163                 sta->psk = NULL;
1164         }
1165
1166         sta->identity = identity;
1167         identity = NULL;
1168         sta->radius_cui = radius_cui;
1169         radius_cui = NULL;
1170
1171         sta->flags &= ~WLAN_STA_PREAUTH;
1172         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
1173
1174         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
1175                 sta->acct_interim_interval = acct_interim_interval;
1176         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
1177                 ap_sta_session_timeout(hapd, sta, session_timeout);
1178         else
1179                 ap_sta_no_session_timeout(hapd, sta);
1180
1181         /*
1182          * If the driver supports full AP client state, add a station to the
1183          * driver before sending authentication reply to make sure the driver
1184          * has resources, and not to go through the entire authentication and
1185          * association handshake, and fail it at the end.
1186          *
1187          * If this is not the first transaction, in a multi-step authentication
1188          * algorithm, the station already exists in the driver
1189          * (sta->added_unassoc = 1) so skip it.
1190          *
1191          * In mesh mode, the station was already added to the driver when the
1192          * NEW_PEER_CANDIDATE event is received.
1193          */
1194         if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
1195             !(hapd->conf->mesh & MESH_ENABLED) &&
1196             !(sta->added_unassoc)) {
1197                 /*
1198                  * If a station that is already associated to the AP, is trying
1199                  * to authenticate again, remove the STA entry, in order to make
1200                  * sure the STA PS state gets cleared and configuration gets
1201                  * updated. To handle this, station's added_unassoc flag is
1202                  * cleared once the station has completed association.
1203                  */
1204                 hostapd_drv_sta_remove(hapd, sta->addr);
1205                 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
1206                                 WLAN_STA_AUTHORIZED);
1207
1208                 if (hostapd_sta_add(hapd, sta->addr, 0, 0, 0, 0, 0,
1209                                     NULL, NULL, sta->flags, 0, 0, 0)) {
1210                         hostapd_logger(hapd, sta->addr,
1211                                        HOSTAPD_MODULE_IEEE80211,
1212                                        HOSTAPD_LEVEL_NOTICE,
1213                                        "Could not add STA to kernel driver");
1214                         resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1215                         goto fail;
1216                 }
1217
1218                 sta->added_unassoc = 1;
1219         }
1220
1221         switch (auth_alg) {
1222         case WLAN_AUTH_OPEN:
1223                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1224                                HOSTAPD_LEVEL_DEBUG,
1225                                "authentication OK (open system)");
1226                 sta->flags |= WLAN_STA_AUTH;
1227                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1228                 sta->auth_alg = WLAN_AUTH_OPEN;
1229                 mlme_authenticate_indication(hapd, sta);
1230                 break;
1231 #ifndef CONFIG_NO_RC4
1232         case WLAN_AUTH_SHARED_KEY:
1233                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
1234                                        fc & WLAN_FC_ISWEP);
1235                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
1236                 mlme_authenticate_indication(hapd, sta);
1237                 if (sta->challenge && auth_transaction == 1) {
1238                         resp_ies[0] = WLAN_EID_CHALLENGE;
1239                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
1240                         os_memcpy(resp_ies + 2, sta->challenge,
1241                                   WLAN_AUTH_CHALLENGE_LEN);
1242                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
1243                 }
1244                 break;
1245 #endif /* CONFIG_NO_RC4 */
1246 #ifdef CONFIG_IEEE80211R
1247         case WLAN_AUTH_FT:
1248                 sta->auth_alg = WLAN_AUTH_FT;
1249                 if (sta->wpa_sm == NULL)
1250                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1251                                                         sta->addr, NULL);
1252                 if (sta->wpa_sm == NULL) {
1253                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
1254                                    "state machine");
1255                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1256                         goto fail;
1257                 }
1258                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
1259                                     auth_transaction, mgmt->u.auth.variable,
1260                                     len - IEEE80211_HDRLEN -
1261                                     sizeof(mgmt->u.auth),
1262                                     handle_auth_ft_finish, hapd);
1263                 /* handle_auth_ft_finish() callback will complete auth. */
1264                 return;
1265 #endif /* CONFIG_IEEE80211R */
1266 #ifdef CONFIG_SAE
1267         case WLAN_AUTH_SAE:
1268 #ifdef CONFIG_MESH
1269                 if (status_code == WLAN_STATUS_SUCCESS &&
1270                     hapd->conf->mesh & MESH_ENABLED) {
1271                         if (sta->wpa_sm == NULL)
1272                                 sta->wpa_sm =
1273                                         wpa_auth_sta_init(hapd->wpa_auth,
1274                                                           sta->addr, NULL);
1275                         if (sta->wpa_sm == NULL) {
1276                                 wpa_printf(MSG_DEBUG,
1277                                            "SAE: Failed to initialize WPA state machine");
1278                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1279                                 goto fail;
1280                         }
1281                 }
1282 #endif /* CONFIG_MESH */
1283                 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
1284                                 status_code);
1285                 return;
1286 #endif /* CONFIG_SAE */
1287         }
1288
1289  fail:
1290         os_free(identity);
1291         os_free(radius_cui);
1292         hostapd_free_psk_list(psk);
1293
1294         reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
1295                                     auth_transaction + 1, resp, resp_ies,
1296                                     resp_ies_len);
1297
1298         if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
1299                                           reply_res != WLAN_STATUS_SUCCESS)) {
1300                 hostapd_drv_sta_remove(hapd, sta->addr);
1301                 sta->added_unassoc = 0;
1302         }
1303 }
1304
1305
1306 int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
1307 {
1308         int i, j = 32, aid;
1309
1310         /* get a unique AID */
1311         if (sta->aid > 0) {
1312                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
1313                 return 0;
1314         }
1315
1316         for (i = 0; i < AID_WORDS; i++) {
1317                 if (hapd->sta_aid[i] == (u32) -1)
1318                         continue;
1319                 for (j = 0; j < 32; j++) {
1320                         if (!(hapd->sta_aid[i] & BIT(j)))
1321                                 break;
1322                 }
1323                 if (j < 32)
1324                         break;
1325         }
1326         if (j == 32)
1327                 return -1;
1328         aid = i * 32 + j + 1;
1329         if (aid > 2007)
1330                 return -1;
1331
1332         sta->aid = aid;
1333         hapd->sta_aid[i] |= BIT(j);
1334         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
1335         return 0;
1336 }
1337
1338
1339 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
1340                       const u8 *ssid_ie, size_t ssid_ie_len)
1341 {
1342         if (ssid_ie == NULL)
1343                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1344
1345         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
1346             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
1347                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1348                                HOSTAPD_LEVEL_INFO,
1349                                "Station tried to associate with unknown SSID "
1350                                "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
1351                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1352         }
1353
1354         return WLAN_STATUS_SUCCESS;
1355 }
1356
1357
1358 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
1359                      const u8 *wmm_ie, size_t wmm_ie_len)
1360 {
1361         sta->flags &= ~WLAN_STA_WMM;
1362         sta->qosinfo = 0;
1363         if (wmm_ie && hapd->conf->wmm_enabled) {
1364                 struct wmm_information_element *wmm;
1365
1366                 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
1367                         hostapd_logger(hapd, sta->addr,
1368                                        HOSTAPD_MODULE_WPA,
1369                                        HOSTAPD_LEVEL_DEBUG,
1370                                        "invalid WMM element in association "
1371                                        "request");
1372                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1373                 }
1374
1375                 sta->flags |= WLAN_STA_WMM;
1376                 wmm = (struct wmm_information_element *) wmm_ie;
1377                 sta->qosinfo = wmm->qos_info;
1378         }
1379         return WLAN_STATUS_SUCCESS;
1380 }
1381
1382
1383 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
1384                            struct ieee802_11_elems *elems)
1385 {
1386         if (!elems->supp_rates) {
1387                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1388                                HOSTAPD_LEVEL_DEBUG,
1389                                "No supported rates element in AssocReq");
1390                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1391         }
1392
1393         if (elems->supp_rates_len + elems->ext_supp_rates_len >
1394             sizeof(sta->supported_rates)) {
1395                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1396                                HOSTAPD_LEVEL_DEBUG,
1397                                "Invalid supported rates element length %d+%d",
1398                                elems->supp_rates_len,
1399                                elems->ext_supp_rates_len);
1400                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1401         }
1402
1403         sta->supported_rates_len = merge_byte_arrays(
1404                 sta->supported_rates, sizeof(sta->supported_rates),
1405                 elems->supp_rates, elems->supp_rates_len,
1406                 elems->ext_supp_rates, elems->ext_supp_rates_len);
1407
1408         return WLAN_STATUS_SUCCESS;
1409 }
1410
1411
1412 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
1413                            const u8 *ext_capab_ie, size_t ext_capab_ie_len)
1414 {
1415 #ifdef CONFIG_INTERWORKING
1416         /* check for QoS Map support */
1417         if (ext_capab_ie_len >= 5) {
1418                 if (ext_capab_ie[4] & 0x01)
1419                         sta->qos_map_enabled = 1;
1420         }
1421 #endif /* CONFIG_INTERWORKING */
1422
1423         if (ext_capab_ie_len > 0)
1424                 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
1425
1426         return WLAN_STATUS_SUCCESS;
1427 }
1428
1429
1430 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
1431                            const u8 *ies, size_t ies_len, int reassoc)
1432 {
1433         struct ieee802_11_elems elems;
1434         u16 resp;
1435         const u8 *wpa_ie;
1436         size_t wpa_ie_len;
1437         const u8 *p2p_dev_addr = NULL;
1438
1439         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
1440                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1441                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
1442                                "association request");
1443                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1444         }
1445
1446         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
1447         if (resp != WLAN_STATUS_SUCCESS)
1448                 return resp;
1449         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
1450         if (resp != WLAN_STATUS_SUCCESS)
1451                 return resp;
1452         resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
1453         if (resp != WLAN_STATUS_SUCCESS)
1454                 return resp;
1455         resp = copy_supp_rates(hapd, sta, &elems);
1456         if (resp != WLAN_STATUS_SUCCESS)
1457                 return resp;
1458 #ifdef CONFIG_IEEE80211N
1459         resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
1460         if (resp != WLAN_STATUS_SUCCESS)
1461                 return resp;
1462         if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
1463             !(sta->flags & WLAN_STA_HT)) {
1464                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1465                                HOSTAPD_LEVEL_INFO, "Station does not support "
1466                                "mandatory HT PHY - reject association");
1467                 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
1468         }
1469 #endif /* CONFIG_IEEE80211N */
1470
1471 #ifdef CONFIG_IEEE80211AC
1472         if (hapd->iconf->ieee80211ac) {
1473                 resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
1474                 if (resp != WLAN_STATUS_SUCCESS)
1475                         return resp;
1476
1477                 resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
1478                 if (resp != WLAN_STATUS_SUCCESS)
1479                         return resp;
1480         }
1481
1482         if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
1483             !(sta->flags & WLAN_STA_VHT)) {
1484                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1485                                HOSTAPD_LEVEL_INFO, "Station does not support "
1486                                "mandatory VHT PHY - reject association");
1487                 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
1488         }
1489
1490         if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
1491                 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
1492                                            elems.vendor_vht_len);
1493                 if (resp != WLAN_STATUS_SUCCESS)
1494                         return resp;
1495         }
1496 #endif /* CONFIG_IEEE80211AC */
1497
1498 #ifdef CONFIG_P2P
1499         if (elems.p2p) {
1500                 wpabuf_free(sta->p2p_ie);
1501                 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1502                                                           P2P_IE_VENDOR_TYPE);
1503                 if (sta->p2p_ie)
1504                         p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
1505         } else {
1506                 wpabuf_free(sta->p2p_ie);
1507                 sta->p2p_ie = NULL;
1508         }
1509 #endif /* CONFIG_P2P */
1510
1511         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
1512                 wpa_ie = elems.rsn_ie;
1513                 wpa_ie_len = elems.rsn_ie_len;
1514         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
1515                    elems.wpa_ie) {
1516                 wpa_ie = elems.wpa_ie;
1517                 wpa_ie_len = elems.wpa_ie_len;
1518         } else {
1519                 wpa_ie = NULL;
1520                 wpa_ie_len = 0;
1521         }
1522
1523 #ifdef CONFIG_WPS
1524         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
1525         if (hapd->conf->wps_state && elems.wps_ie) {
1526                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
1527                            "Request - assume WPS is used");
1528                 sta->flags |= WLAN_STA_WPS;
1529                 wpabuf_free(sta->wps_ie);
1530                 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
1531                                                           WPS_IE_VENDOR_TYPE);
1532                 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
1533                         wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
1534                         sta->flags |= WLAN_STA_WPS2;
1535                 }
1536                 wpa_ie = NULL;
1537                 wpa_ie_len = 0;
1538                 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
1539                         wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
1540                                    "(Re)Association Request - reject");
1541                         return WLAN_STATUS_INVALID_IE;
1542                 }
1543         } else if (hapd->conf->wps_state && wpa_ie == NULL) {
1544                 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
1545                            "(Re)Association Request - possible WPS use");
1546                 sta->flags |= WLAN_STA_MAYBE_WPS;
1547         } else
1548 #endif /* CONFIG_WPS */
1549         if (hapd->conf->wpa && wpa_ie == NULL) {
1550                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1551                                HOSTAPD_LEVEL_INFO,
1552                                "No WPA/RSN IE in association request");
1553                 return WLAN_STATUS_INVALID_IE;
1554         }
1555
1556         if (hapd->conf->wpa && wpa_ie) {
1557                 int res;
1558                 wpa_ie -= 2;
1559                 wpa_ie_len += 2;
1560                 if (sta->wpa_sm == NULL)
1561                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1562                                                         sta->addr,
1563                                                         p2p_dev_addr);
1564                 if (sta->wpa_sm == NULL) {
1565                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1566                                    "state machine");
1567                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1568                 }
1569                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1570                                           wpa_ie, wpa_ie_len,
1571                                           elems.mdie, elems.mdie_len);
1572                 if (res == WPA_INVALID_GROUP)
1573                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1574                 else if (res == WPA_INVALID_PAIRWISE)
1575                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1576                 else if (res == WPA_INVALID_AKMP)
1577                         resp = WLAN_STATUS_AKMP_NOT_VALID;
1578                 else if (res == WPA_ALLOC_FAIL)
1579                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1580 #ifdef CONFIG_IEEE80211W
1581                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1582                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1583                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1584                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1585 #endif /* CONFIG_IEEE80211W */
1586                 else if (res == WPA_INVALID_MDIE)
1587                         resp = WLAN_STATUS_INVALID_MDIE;
1588                 else if (res != WPA_IE_OK)
1589                         resp = WLAN_STATUS_INVALID_IE;
1590                 if (resp != WLAN_STATUS_SUCCESS)
1591                         return resp;
1592 #ifdef CONFIG_IEEE80211W
1593                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1594                     sta->sa_query_count > 0)
1595                         ap_check_sa_query_timeout(hapd, sta);
1596                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
1597                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
1598                         /*
1599                          * STA has already been associated with MFP and SA
1600                          * Query timeout has not been reached. Reject the
1601                          * association attempt temporarily and start SA Query,
1602                          * if one is not pending.
1603                          */
1604
1605                         if (sta->sa_query_count == 0)
1606                                 ap_sta_start_sa_query(hapd, sta);
1607
1608                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
1609                 }
1610
1611                 if (wpa_auth_uses_mfp(sta->wpa_sm))
1612                         sta->flags |= WLAN_STA_MFP;
1613                 else
1614                         sta->flags &= ~WLAN_STA_MFP;
1615 #endif /* CONFIG_IEEE80211W */
1616
1617 #ifdef CONFIG_IEEE80211R
1618                 if (sta->auth_alg == WLAN_AUTH_FT) {
1619                         if (!reassoc) {
1620                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
1621                                            "to use association (not "
1622                                            "re-association) with FT auth_alg",
1623                                            MAC2STR(sta->addr));
1624                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1625                         }
1626
1627                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
1628                                                        ies_len);
1629                         if (resp != WLAN_STATUS_SUCCESS)
1630                                 return resp;
1631                 }
1632 #endif /* CONFIG_IEEE80211R */
1633
1634 #ifdef CONFIG_SAE
1635                 if (wpa_auth_uses_sae(sta->wpa_sm) &&
1636                     sta->auth_alg == WLAN_AUTH_OPEN) {
1637                         struct rsn_pmksa_cache_entry *sa;
1638                         sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
1639                         if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
1640                                 wpa_printf(MSG_DEBUG,
1641                                            "SAE: No PMKSA cache entry found for "
1642                                            MACSTR, MAC2STR(sta->addr));
1643                                 return WLAN_STATUS_INVALID_PMKID;
1644                         }
1645                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR
1646                                    " using PMKSA caching", MAC2STR(sta->addr));
1647                 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
1648                            sta->auth_alg != WLAN_AUTH_SAE &&
1649                            !(sta->auth_alg == WLAN_AUTH_FT &&
1650                              wpa_auth_uses_ft_sae(sta->wpa_sm))) {
1651                         wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
1652                                    "SAE AKM after non-SAE auth_alg %u",
1653                                    MAC2STR(sta->addr), sta->auth_alg);
1654                         return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1655                 }
1656 #endif /* CONFIG_SAE */
1657
1658 #ifdef CONFIG_IEEE80211N
1659                 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
1660                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
1661                         hostapd_logger(hapd, sta->addr,
1662                                        HOSTAPD_MODULE_IEEE80211,
1663                                        HOSTAPD_LEVEL_INFO,
1664                                        "Station tried to use TKIP with HT "
1665                                        "association");
1666                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1667                 }
1668 #endif /* CONFIG_IEEE80211N */
1669 #ifdef CONFIG_HS20
1670         } else if (hapd->conf->osen) {
1671                 if (elems.osen == NULL) {
1672                         hostapd_logger(
1673                                 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1674                                 HOSTAPD_LEVEL_INFO,
1675                                 "No HS 2.0 OSEN element in association request");
1676                         return WLAN_STATUS_INVALID_IE;
1677                 }
1678
1679                 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
1680                 if (sta->wpa_sm == NULL)
1681                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1682                                                         sta->addr, NULL);
1683                 if (sta->wpa_sm == NULL) {
1684                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
1685                                    "state machine");
1686                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
1687                 }
1688                 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
1689                                       elems.osen - 2, elems.osen_len + 2) < 0)
1690                         return WLAN_STATUS_INVALID_IE;
1691 #endif /* CONFIG_HS20 */
1692         } else
1693                 wpa_auth_sta_no_wpa(sta->wpa_sm);
1694
1695 #ifdef CONFIG_P2P
1696         p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
1697 #endif /* CONFIG_P2P */
1698
1699 #ifdef CONFIG_HS20
1700         wpabuf_free(sta->hs20_ie);
1701         if (elems.hs20 && elems.hs20_len > 4) {
1702                 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
1703                                                  elems.hs20_len - 4);
1704         } else
1705                 sta->hs20_ie = NULL;
1706 #endif /* CONFIG_HS20 */
1707
1708 #ifdef CONFIG_FST
1709         wpabuf_free(sta->mb_ies);
1710         if (hapd->iface->fst)
1711                 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
1712         else
1713                 sta->mb_ies = NULL;
1714 #endif /* CONFIG_FST */
1715
1716         return WLAN_STATUS_SUCCESS;
1717 }
1718
1719
1720 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
1721                         u16 reason_code)
1722 {
1723         int send_len;
1724         struct ieee80211_mgmt reply;
1725
1726         os_memset(&reply, 0, sizeof(reply));
1727         reply.frame_control =
1728                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
1729         os_memcpy(reply.da, addr, ETH_ALEN);
1730         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
1731         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
1732
1733         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
1734         reply.u.deauth.reason_code = host_to_le16(reason_code);
1735
1736         if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
1737                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
1738                            strerror(errno));
1739 }
1740
1741
1742 static int add_associated_sta(struct hostapd_data *hapd,
1743                               struct sta_info *sta)
1744 {
1745         struct ieee80211_ht_capabilities ht_cap;
1746         struct ieee80211_vht_capabilities vht_cap;
1747
1748         /*
1749          * Remove the STA entry to ensure the STA PS state gets cleared and
1750          * configuration gets updated. This is relevant for cases, such as
1751          * FT-over-the-DS, where a station re-associates back to the same AP but
1752          * skips the authentication flow, or if working with a driver that
1753          * does not support full AP client state.
1754          */
1755         if (!sta->added_unassoc)
1756                 hostapd_drv_sta_remove(hapd, sta->addr);
1757
1758 #ifdef CONFIG_IEEE80211N
1759         if (sta->flags & WLAN_STA_HT)
1760                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
1761 #endif /* CONFIG_IEEE80211N */
1762 #ifdef CONFIG_IEEE80211AC
1763         if (sta->flags & WLAN_STA_VHT)
1764                 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
1765 #endif /* CONFIG_IEEE80211AC */
1766
1767         /*
1768          * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
1769          * will be set when the ACK frame for the (Re)Association Response frame
1770          * is processed (TX status driver event).
1771          */
1772         if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
1773                             sta->supported_rates, sta->supported_rates_len,
1774                             sta->listen_interval,
1775                             sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
1776                             sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
1777                             sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
1778                             sta->vht_opmode, sta->added_unassoc)) {
1779                 hostapd_logger(hapd, sta->addr,
1780                                HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
1781                                "Could not %s STA to kernel driver",
1782                                sta->added_unassoc ? "set" : "add");
1783
1784                 if (sta->added_unassoc) {
1785                         hostapd_drv_sta_remove(hapd, sta->addr);
1786                         sta->added_unassoc = 0;
1787                 }
1788
1789                 return -1;
1790         }
1791
1792         sta->added_unassoc = 0;
1793
1794         return 0;
1795 }
1796
1797
1798 static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
1799                            u16 status_code, int reassoc, const u8 *ies,
1800                            size_t ies_len)
1801 {
1802         int send_len;
1803         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
1804         struct ieee80211_mgmt *reply;
1805         u8 *p;
1806
1807         os_memset(buf, 0, sizeof(buf));
1808         reply = (struct ieee80211_mgmt *) buf;
1809         reply->frame_control =
1810                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1811                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
1812                               WLAN_FC_STYPE_ASSOC_RESP));
1813         os_memcpy(reply->da, sta->addr, ETH_ALEN);
1814         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
1815         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
1816
1817         send_len = IEEE80211_HDRLEN;
1818         send_len += sizeof(reply->u.assoc_resp);
1819         reply->u.assoc_resp.capab_info =
1820                 host_to_le16(hostapd_own_capab_info(hapd));
1821         reply->u.assoc_resp.status_code = host_to_le16(status_code);
1822         reply->u.assoc_resp.aid = host_to_le16(sta->aid | BIT(14) | BIT(15));
1823         /* Supported rates */
1824         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
1825         /* Extended supported rates */
1826         p = hostapd_eid_ext_supp_rates(hapd, p);
1827
1828 #ifdef CONFIG_IEEE80211R
1829         if (status_code == WLAN_STATUS_SUCCESS) {
1830                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
1831                  * Transition Information, RSN, [RIC Response] */
1832                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
1833                                                 buf + sizeof(buf) - p,
1834                                                 sta->auth_alg, ies, ies_len);
1835         }
1836 #endif /* CONFIG_IEEE80211R */
1837
1838 #ifdef CONFIG_IEEE80211W
1839         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
1840                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
1841 #endif /* CONFIG_IEEE80211W */
1842
1843 #ifdef CONFIG_IEEE80211N
1844         p = hostapd_eid_ht_capabilities(hapd, p);
1845         p = hostapd_eid_ht_operation(hapd, p);
1846 #endif /* CONFIG_IEEE80211N */
1847
1848 #ifdef CONFIG_IEEE80211AC
1849         if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
1850                 p = hostapd_eid_vht_capabilities(hapd, p);
1851                 p = hostapd_eid_vht_operation(hapd, p);
1852         }
1853 #endif /* CONFIG_IEEE80211AC */
1854
1855         p = hostapd_eid_ext_capab(hapd, p);
1856         p = hostapd_eid_bss_max_idle_period(hapd, p);
1857         if (sta->qos_map_enabled)
1858                 p = hostapd_eid_qos_map_set(hapd, p);
1859
1860 #ifdef CONFIG_FST
1861         if (hapd->iface->fst_ies) {
1862                 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
1863                           wpabuf_len(hapd->iface->fst_ies));
1864                 p += wpabuf_len(hapd->iface->fst_ies);
1865         }
1866 #endif /* CONFIG_FST */
1867
1868 #ifdef CONFIG_IEEE80211AC
1869         if (hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
1870                 p = hostapd_eid_vendor_vht(hapd, p);
1871 #endif /* CONFIG_IEEE80211AC */
1872
1873         if (sta->flags & WLAN_STA_WMM)
1874                 p = hostapd_eid_wmm(hapd, p);
1875
1876 #ifdef CONFIG_WPS
1877         if ((sta->flags & WLAN_STA_WPS) ||
1878             ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa)) {
1879                 struct wpabuf *wps = wps_build_assoc_resp_ie();
1880                 if (wps) {
1881                         os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
1882                         p += wpabuf_len(wps);
1883                         wpabuf_free(wps);
1884                 }
1885         }
1886 #endif /* CONFIG_WPS */
1887
1888 #ifdef CONFIG_P2P
1889         if (sta->p2p_ie && hapd->p2p_group) {
1890                 struct wpabuf *p2p_resp_ie;
1891                 enum p2p_status_code status;
1892                 switch (status_code) {
1893                 case WLAN_STATUS_SUCCESS:
1894                         status = P2P_SC_SUCCESS;
1895                         break;
1896                 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
1897                         status = P2P_SC_FAIL_LIMIT_REACHED;
1898                         break;
1899                 default:
1900                         status = P2P_SC_FAIL_INVALID_PARAMS;
1901                         break;
1902                 }
1903                 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
1904                 if (p2p_resp_ie) {
1905                         os_memcpy(p, wpabuf_head(p2p_resp_ie),
1906                                   wpabuf_len(p2p_resp_ie));
1907                         p += wpabuf_len(p2p_resp_ie);
1908                         wpabuf_free(p2p_resp_ie);
1909                 }
1910         }
1911 #endif /* CONFIG_P2P */
1912
1913 #ifdef CONFIG_P2P_MANAGER
1914         if (hapd->conf->p2p & P2P_MANAGE)
1915                 p = hostapd_eid_p2p_manage(hapd, p);
1916 #endif /* CONFIG_P2P_MANAGER */
1917
1918         send_len += p - reply->u.assoc_resp.variable;
1919
1920         if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
1921                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
1922                            strerror(errno));
1923                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1924         }
1925
1926         return WLAN_STATUS_SUCCESS;
1927 }
1928
1929
1930 static void handle_assoc(struct hostapd_data *hapd,
1931                          const struct ieee80211_mgmt *mgmt, size_t len,
1932                          int reassoc)
1933 {
1934         u16 capab_info, listen_interval, seq_ctrl, fc;
1935         u16 resp = WLAN_STATUS_SUCCESS, reply_res;
1936         const u8 *pos;
1937         int left, i;
1938         struct sta_info *sta;
1939
1940         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1941                                       sizeof(mgmt->u.assoc_req))) {
1942                 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
1943                            reassoc, (unsigned long) len);
1944                 return;
1945         }
1946
1947 #ifdef CONFIG_TESTING_OPTIONS
1948         if (reassoc) {
1949                 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
1950                     drand48() < hapd->iconf->ignore_reassoc_probability) {
1951                         wpa_printf(MSG_INFO,
1952                                    "TESTING: ignoring reassoc request from "
1953                                    MACSTR, MAC2STR(mgmt->sa));
1954                         return;
1955                 }
1956         } else {
1957                 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
1958                     drand48() < hapd->iconf->ignore_assoc_probability) {
1959                         wpa_printf(MSG_INFO,
1960                                    "TESTING: ignoring assoc request from "
1961                                    MACSTR, MAC2STR(mgmt->sa));
1962                         return;
1963                 }
1964         }
1965 #endif /* CONFIG_TESTING_OPTIONS */
1966
1967         fc = le_to_host16(mgmt->frame_control);
1968         seq_ctrl = le_to_host16(mgmt->seq_ctrl);
1969
1970         if (reassoc) {
1971                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
1972                 listen_interval = le_to_host16(
1973                         mgmt->u.reassoc_req.listen_interval);
1974                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
1975                            " capab_info=0x%02x listen_interval=%d current_ap="
1976                            MACSTR " seq_ctrl=0x%x%s",
1977                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1978                            MAC2STR(mgmt->u.reassoc_req.current_ap),
1979                            seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1980                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
1981                 pos = mgmt->u.reassoc_req.variable;
1982         } else {
1983                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
1984                 listen_interval = le_to_host16(
1985                         mgmt->u.assoc_req.listen_interval);
1986                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
1987                            " capab_info=0x%02x listen_interval=%d "
1988                            "seq_ctrl=0x%x%s",
1989                            MAC2STR(mgmt->sa), capab_info, listen_interval,
1990                            seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1991                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
1992                 pos = mgmt->u.assoc_req.variable;
1993         }
1994
1995         sta = ap_get_sta(hapd, mgmt->sa);
1996 #ifdef CONFIG_IEEE80211R
1997         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
1998             (sta->flags & WLAN_STA_AUTH) == 0) {
1999                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
2000                            "prior to authentication since it is using "
2001                            "over-the-DS FT", MAC2STR(mgmt->sa));
2002
2003                 /*
2004                  * Mark station as authenticated, to avoid adding station
2005                  * entry in the driver as associated and not authenticated
2006                  */
2007                 sta->flags |= WLAN_STA_AUTH;
2008         } else
2009 #endif /* CONFIG_IEEE80211R */
2010         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
2011                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2012                                HOSTAPD_LEVEL_INFO, "Station tried to "
2013                                "associate before authentication "
2014                                "(aid=%d flags=0x%x)",
2015                                sta ? sta->aid : -1,
2016                                sta ? sta->flags : 0);
2017                 send_deauth(hapd, mgmt->sa,
2018                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
2019                 return;
2020         }
2021
2022         if ((fc & WLAN_FC_RETRY) &&
2023             sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2024             sta->last_seq_ctrl == seq_ctrl &&
2025             sta->last_subtype == reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
2026             WLAN_FC_STYPE_ASSOC_REQ) {
2027                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2028                                HOSTAPD_LEVEL_DEBUG,
2029                                "Drop repeated association frame seq_ctrl=0x%x",
2030                                seq_ctrl);
2031                 return;
2032         }
2033         sta->last_seq_ctrl = seq_ctrl;
2034         sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
2035                 WLAN_FC_STYPE_ASSOC_REQ;
2036
2037         if (hapd->tkip_countermeasures) {
2038                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
2039                 goto fail;
2040         }
2041
2042         if (listen_interval > hapd->conf->max_listen_interval) {
2043                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2044                                HOSTAPD_LEVEL_DEBUG,
2045                                "Too large Listen Interval (%d)",
2046                                listen_interval);
2047                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
2048                 goto fail;
2049         }
2050
2051         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
2052          * is used */
2053         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
2054         if (resp != WLAN_STATUS_SUCCESS)
2055                 goto fail;
2056
2057         if (hostapd_get_aid(hapd, sta) < 0) {
2058                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2059                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
2060                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2061                 goto fail;
2062         }
2063
2064         sta->capability = capab_info;
2065         sta->listen_interval = listen_interval;
2066
2067         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
2068                 sta->flags |= WLAN_STA_NONERP;
2069         for (i = 0; i < sta->supported_rates_len; i++) {
2070                 if ((sta->supported_rates[i] & 0x7f) > 22) {
2071                         sta->flags &= ~WLAN_STA_NONERP;
2072                         break;
2073                 }
2074         }
2075         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
2076                 sta->nonerp_set = 1;
2077                 hapd->iface->num_sta_non_erp++;
2078                 if (hapd->iface->num_sta_non_erp == 1)
2079                         ieee802_11_set_beacons(hapd->iface);
2080         }
2081
2082         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
2083             !sta->no_short_slot_time_set) {
2084                 sta->no_short_slot_time_set = 1;
2085                 hapd->iface->num_sta_no_short_slot_time++;
2086                 if (hapd->iface->current_mode->mode ==
2087                     HOSTAPD_MODE_IEEE80211G &&
2088                     hapd->iface->num_sta_no_short_slot_time == 1)
2089                         ieee802_11_set_beacons(hapd->iface);
2090         }
2091
2092         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
2093                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
2094         else
2095                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
2096
2097         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
2098             !sta->no_short_preamble_set) {
2099                 sta->no_short_preamble_set = 1;
2100                 hapd->iface->num_sta_no_short_preamble++;
2101                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
2102                     && hapd->iface->num_sta_no_short_preamble == 1)
2103                         ieee802_11_set_beacons(hapd->iface);
2104         }
2105
2106 #ifdef CONFIG_IEEE80211N
2107         update_ht_state(hapd, sta);
2108 #endif /* CONFIG_IEEE80211N */
2109
2110         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2111                        HOSTAPD_LEVEL_DEBUG,
2112                        "association OK (aid %d)", sta->aid);
2113         /* Station will be marked associated, after it acknowledges AssocResp
2114          */
2115         sta->flags |= WLAN_STA_ASSOC_REQ_OK;
2116
2117 #ifdef CONFIG_IEEE80211W
2118         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
2119                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
2120                            "SA Query procedure", reassoc ? "re" : "");
2121                 /* TODO: Send a protected Disassociate frame to the STA using
2122                  * the old key and Reason Code "Previous Authentication no
2123                  * longer valid". Make sure this is only sent protected since
2124                  * unprotected frame would be received by the STA that is now
2125                  * trying to associate.
2126                  */
2127         }
2128 #endif /* CONFIG_IEEE80211W */
2129
2130         /* Make sure that the previously registered inactivity timer will not
2131          * remove the STA immediately. */
2132         sta->timeout_next = STA_NULLFUNC;
2133
2134  fail:
2135         /*
2136          * In case of a successful response, add the station to the driver.
2137          * Otherwise, the kernel may ignore Data frames before we process the
2138          * ACK frame (TX status). In case of a failure, this station will be
2139          * removed.
2140          *
2141          * Note that this is not compliant with the IEEE 802.11 standard that
2142          * states that a non-AP station should transition into the
2143          * authenticated/associated state only after the station acknowledges
2144          * the (Re)Association Response frame. However, still do this as:
2145          *
2146          * 1. In case the station does not acknowledge the (Re)Association
2147          *    Response frame, it will be removed.
2148          * 2. Data frames will be dropped in the kernel until the station is
2149          *    set into authorized state, and there are no significant known
2150          *    issues with processing other non-Data Class 3 frames during this
2151          *    window.
2152          */
2153         if (resp == WLAN_STATUS_SUCCESS && add_associated_sta(hapd, sta))
2154                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2155
2156         reply_res = send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
2157
2158         /*
2159          * Remove the station in case tranmission of a success response fails
2160          * (the STA was added associated to the driver) or if the station was
2161          * previously added unassociated.
2162          */
2163         if ((reply_res != WLAN_STATUS_SUCCESS &&
2164              resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc) {
2165                 hostapd_drv_sta_remove(hapd, sta->addr);
2166                 sta->added_unassoc = 0;
2167         }
2168 }
2169
2170
2171 static void handle_disassoc(struct hostapd_data *hapd,
2172                             const struct ieee80211_mgmt *mgmt, size_t len)
2173 {
2174         struct sta_info *sta;
2175
2176         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
2177                 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
2178                            (unsigned long) len);
2179                 return;
2180         }
2181
2182         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
2183                    MAC2STR(mgmt->sa),
2184                    le_to_host16(mgmt->u.disassoc.reason_code));
2185
2186         sta = ap_get_sta(hapd, mgmt->sa);
2187         if (sta == NULL) {
2188                 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
2189                            MAC2STR(mgmt->sa));
2190                 return;
2191         }
2192
2193         ap_sta_set_authorized(hapd, sta, 0);
2194         sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
2195         sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
2196         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
2197         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2198                        HOSTAPD_LEVEL_INFO, "disassociated");
2199         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
2200         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
2201         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
2202          * authenticated. */
2203         accounting_sta_stop(hapd, sta);
2204         ieee802_1x_free_station(hapd, sta);
2205         if (sta->ipaddr)
2206                 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
2207         ap_sta_ip6addr_del(hapd, sta);
2208         hostapd_drv_sta_remove(hapd, sta->addr);
2209         sta->added_unassoc = 0;
2210
2211         if (sta->timeout_next == STA_NULLFUNC ||
2212             sta->timeout_next == STA_DISASSOC) {
2213                 sta->timeout_next = STA_DEAUTH;
2214                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
2215                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
2216                                        hapd, sta);
2217         }
2218
2219         mlme_disassociate_indication(
2220                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
2221 }
2222
2223
2224 static void handle_deauth(struct hostapd_data *hapd,
2225                           const struct ieee80211_mgmt *mgmt, size_t len)
2226 {
2227         struct sta_info *sta;
2228
2229         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
2230                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
2231                         "payload (len=%lu)", (unsigned long) len);
2232                 return;
2233         }
2234
2235         wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
2236                 " reason_code=%d",
2237                 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
2238
2239         sta = ap_get_sta(hapd, mgmt->sa);
2240         if (sta == NULL) {
2241                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
2242                         "to deauthenticate, but it is not authenticated",
2243                         MAC2STR(mgmt->sa));
2244                 return;
2245         }
2246
2247         ap_sta_set_authorized(hapd, sta, 0);
2248         sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
2249         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
2250                         WLAN_STA_ASSOC_REQ_OK);
2251         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
2252         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2253                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
2254         mlme_deauthenticate_indication(
2255                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
2256         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
2257         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
2258         ap_free_sta(hapd, sta);
2259 }
2260
2261
2262 static void handle_beacon(struct hostapd_data *hapd,
2263                           const struct ieee80211_mgmt *mgmt, size_t len,
2264                           struct hostapd_frame_info *fi)
2265 {
2266         struct ieee802_11_elems elems;
2267
2268         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
2269                 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
2270                            (unsigned long) len);
2271                 return;
2272         }
2273
2274         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
2275                                       len - (IEEE80211_HDRLEN +
2276                                              sizeof(mgmt->u.beacon)), &elems,
2277                                       0);
2278
2279         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
2280 }
2281
2282
2283 #ifdef CONFIG_IEEE80211W
2284
2285 static int hostapd_sa_query_action(struct hostapd_data *hapd,
2286                                    const struct ieee80211_mgmt *mgmt,
2287                                    size_t len)
2288 {
2289         const u8 *end;
2290
2291         end = mgmt->u.action.u.sa_query_resp.trans_id +
2292                 WLAN_SA_QUERY_TR_ID_LEN;
2293         if (((u8 *) mgmt) + len < end) {
2294                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
2295                            "frame (len=%lu)", (unsigned long) len);
2296                 return 0;
2297         }
2298
2299         ieee802_11_sa_query_action(hapd, mgmt->sa,
2300                                    mgmt->u.action.u.sa_query_resp.action,
2301                                    mgmt->u.action.u.sa_query_resp.trans_id);
2302         return 1;
2303 }
2304
2305
2306 static int robust_action_frame(u8 category)
2307 {
2308         return category != WLAN_ACTION_PUBLIC &&
2309                 category != WLAN_ACTION_HT;
2310 }
2311 #endif /* CONFIG_IEEE80211W */
2312
2313
2314 static int handle_action(struct hostapd_data *hapd,
2315                          const struct ieee80211_mgmt *mgmt, size_t len)
2316 {
2317         struct sta_info *sta;
2318         sta = ap_get_sta(hapd, mgmt->sa);
2319
2320         if (len < IEEE80211_HDRLEN + 1) {
2321                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2322                                HOSTAPD_LEVEL_DEBUG,
2323                                "handle_action - too short payload (len=%lu)",
2324                                (unsigned long) len);
2325                 return 0;
2326         }
2327
2328         if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
2329             (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
2330                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
2331                            "frame (category=%u) from unassociated STA " MACSTR,
2332                            MAC2STR(mgmt->sa), mgmt->u.action.category);
2333                 return 0;
2334         }
2335
2336 #ifdef CONFIG_IEEE80211W
2337         if (sta && (sta->flags & WLAN_STA_MFP) &&
2338             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
2339             robust_action_frame(mgmt->u.action.category)) {
2340                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2341                                HOSTAPD_LEVEL_DEBUG,
2342                                "Dropped unprotected Robust Action frame from "
2343                                "an MFP STA");
2344                 return 0;
2345         }
2346 #endif /* CONFIG_IEEE80211W */
2347
2348         if (sta) {
2349                 u16 fc = le_to_host16(mgmt->frame_control);
2350                 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
2351
2352                 if ((fc & WLAN_FC_RETRY) &&
2353                     sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2354                     sta->last_seq_ctrl == seq_ctrl &&
2355                     sta->last_subtype == WLAN_FC_STYPE_ACTION) {
2356                         hostapd_logger(hapd, sta->addr,
2357                                        HOSTAPD_MODULE_IEEE80211,
2358                                        HOSTAPD_LEVEL_DEBUG,
2359                                        "Drop repeated action frame seq_ctrl=0x%x",
2360                                        seq_ctrl);
2361                         return 1;
2362                 }
2363
2364                 sta->last_seq_ctrl = seq_ctrl;
2365                 sta->last_subtype = WLAN_FC_STYPE_ACTION;
2366         }
2367
2368         switch (mgmt->u.action.category) {
2369 #ifdef CONFIG_IEEE80211R
2370         case WLAN_ACTION_FT:
2371                 if (!sta ||
2372                     wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
2373                                      len - IEEE80211_HDRLEN))
2374                         break;
2375                 return 1;
2376 #endif /* CONFIG_IEEE80211R */
2377         case WLAN_ACTION_WMM:
2378                 hostapd_wmm_action(hapd, mgmt, len);
2379                 return 1;
2380 #ifdef CONFIG_IEEE80211W
2381         case WLAN_ACTION_SA_QUERY:
2382                 return hostapd_sa_query_action(hapd, mgmt, len);
2383 #endif /* CONFIG_IEEE80211W */
2384 #ifdef CONFIG_WNM
2385         case WLAN_ACTION_WNM:
2386                 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
2387                 return 1;
2388 #endif /* CONFIG_WNM */
2389 #ifdef CONFIG_FST
2390         case WLAN_ACTION_FST:
2391                 if (hapd->iface->fst)
2392                         fst_rx_action(hapd->iface->fst, mgmt, len);
2393                 else
2394                         wpa_printf(MSG_DEBUG,
2395                                    "FST: Ignore FST Action frame - no FST attached");
2396                 return 1;
2397 #endif /* CONFIG_FST */
2398         case WLAN_ACTION_PUBLIC:
2399         case WLAN_ACTION_PROTECTED_DUAL:
2400 #ifdef CONFIG_IEEE80211N
2401                 if (len >= IEEE80211_HDRLEN + 2 &&
2402                     mgmt->u.action.u.public_action.action ==
2403                     WLAN_PA_20_40_BSS_COEX) {
2404                         wpa_printf(MSG_DEBUG,
2405                                    "HT20/40 coex mgmt frame received from STA "
2406                                    MACSTR, MAC2STR(mgmt->sa));
2407                         hostapd_2040_coex_action(hapd, mgmt, len);
2408                 }
2409 #endif /* CONFIG_IEEE80211N */
2410                 if (hapd->public_action_cb) {
2411                         hapd->public_action_cb(hapd->public_action_cb_ctx,
2412                                                (u8 *) mgmt, len,
2413                                                hapd->iface->freq);
2414                 }
2415                 if (hapd->public_action_cb2) {
2416                         hapd->public_action_cb2(hapd->public_action_cb2_ctx,
2417                                                 (u8 *) mgmt, len,
2418                                                 hapd->iface->freq);
2419                 }
2420                 if (hapd->public_action_cb || hapd->public_action_cb2)
2421                         return 1;
2422                 break;
2423         case WLAN_ACTION_VENDOR_SPECIFIC:
2424                 if (hapd->vendor_action_cb) {
2425                         if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
2426                                                    (u8 *) mgmt, len,
2427                                                    hapd->iface->freq) == 0)
2428                                 return 1;
2429                 }
2430                 break;
2431         }
2432
2433         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2434                        HOSTAPD_LEVEL_DEBUG,
2435                        "handle_action - unknown action category %d or invalid "
2436                        "frame",
2437                        mgmt->u.action.category);
2438         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
2439             !(mgmt->sa[0] & 0x01)) {
2440                 struct ieee80211_mgmt *resp;
2441
2442                 /*
2443                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
2444                  * Return the Action frame to the source without change
2445                  * except that MSB of the Category set to 1.
2446                  */
2447                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
2448                            "frame back to sender");
2449                 resp = os_malloc(len);
2450                 if (resp == NULL)
2451                         return 0;
2452                 os_memcpy(resp, mgmt, len);
2453                 os_memcpy(resp->da, resp->sa, ETH_ALEN);
2454                 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
2455                 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
2456                 resp->u.action.category |= 0x80;
2457
2458                 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
2459                         wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
2460                                    "Action frame");
2461                 }
2462                 os_free(resp);
2463         }
2464
2465         return 1;
2466 }
2467
2468
2469 /**
2470  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
2471  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
2472  * sent to)
2473  * @buf: management frame data (starting from IEEE 802.11 header)
2474  * @len: length of frame data in octets
2475  * @fi: meta data about received frame (signal level, etc.)
2476  *
2477  * Process all incoming IEEE 802.11 management frames. This will be called for
2478  * each frame received from the kernel driver through wlan#ap interface. In
2479  * addition, it can be called to re-inserted pending frames (e.g., when using
2480  * external RADIUS server as an MAC ACL).
2481  */
2482 int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
2483                     struct hostapd_frame_info *fi)
2484 {
2485         struct ieee80211_mgmt *mgmt;
2486         int broadcast;
2487         u16 fc, stype;
2488         int ret = 0;
2489
2490         if (len < 24)
2491                 return 0;
2492
2493         mgmt = (struct ieee80211_mgmt *) buf;
2494         fc = le_to_host16(mgmt->frame_control);
2495         stype = WLAN_FC_GET_STYPE(fc);
2496
2497         if (stype == WLAN_FC_STYPE_BEACON) {
2498                 handle_beacon(hapd, mgmt, len, fi);
2499                 return 1;
2500         }
2501
2502         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
2503                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
2504                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
2505
2506         if (!broadcast &&
2507 #ifdef CONFIG_P2P
2508             /* Invitation responses can be sent with the peer MAC as BSSID */
2509             !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
2510               stype == WLAN_FC_STYPE_ACTION) &&
2511 #endif /* CONFIG_P2P */
2512 #ifdef CONFIG_MESH
2513             !(hapd->conf->mesh & MESH_ENABLED) &&
2514 #endif /* CONFIG_MESH */
2515             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
2516                 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
2517                            MAC2STR(mgmt->bssid));
2518                 return 0;
2519         }
2520
2521
2522         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
2523                 handle_probe_req(hapd, mgmt, len, fi->ssi_signal);
2524                 return 1;
2525         }
2526
2527         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
2528                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2529                                HOSTAPD_LEVEL_DEBUG,
2530                                "MGMT: DA=" MACSTR " not our address",
2531                                MAC2STR(mgmt->da));
2532                 return 0;
2533         }
2534
2535         if (hapd->iconf->track_sta_max_num)
2536                 sta_track_add(hapd->iface, mgmt->sa);
2537
2538         switch (stype) {
2539         case WLAN_FC_STYPE_AUTH:
2540                 wpa_printf(MSG_DEBUG, "mgmt::auth");
2541                 handle_auth(hapd, mgmt, len);
2542                 ret = 1;
2543                 break;
2544         case WLAN_FC_STYPE_ASSOC_REQ:
2545                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
2546                 handle_assoc(hapd, mgmt, len, 0);
2547                 ret = 1;
2548                 break;
2549         case WLAN_FC_STYPE_REASSOC_REQ:
2550                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
2551                 handle_assoc(hapd, mgmt, len, 1);
2552                 ret = 1;
2553                 break;
2554         case WLAN_FC_STYPE_DISASSOC:
2555                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
2556                 handle_disassoc(hapd, mgmt, len);
2557                 ret = 1;
2558                 break;
2559         case WLAN_FC_STYPE_DEAUTH:
2560                 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
2561                 handle_deauth(hapd, mgmt, len);
2562                 ret = 1;
2563                 break;
2564         case WLAN_FC_STYPE_ACTION:
2565                 wpa_printf(MSG_DEBUG, "mgmt::action");
2566                 ret = handle_action(hapd, mgmt, len);
2567                 break;
2568         default:
2569                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
2570                                HOSTAPD_LEVEL_DEBUG,
2571                                "unknown mgmt frame subtype %d", stype);
2572                 break;
2573         }
2574
2575         return ret;
2576 }
2577
2578
2579 static void handle_auth_cb(struct hostapd_data *hapd,
2580                            const struct ieee80211_mgmt *mgmt,
2581                            size_t len, int ok)
2582 {
2583         u16 auth_alg, auth_transaction, status_code;
2584         struct sta_info *sta;
2585
2586         sta = ap_get_sta(hapd, mgmt->da);
2587         if (!sta) {
2588                 wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
2589                            MAC2STR(mgmt->da));
2590                 return;
2591         }
2592
2593         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2594         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
2595         status_code = le_to_host16(mgmt->u.auth.status_code);
2596
2597         if (!ok) {
2598                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2599                                HOSTAPD_LEVEL_NOTICE,
2600                                "did not acknowledge authentication response");
2601                 goto fail;
2602         }
2603
2604         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
2605                 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
2606                            (unsigned long) len);
2607                 goto fail;
2608         }
2609
2610         if (status_code == WLAN_STATUS_SUCCESS &&
2611             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
2612              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
2613                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2614                                HOSTAPD_LEVEL_INFO, "authenticated");
2615                 sta->flags |= WLAN_STA_AUTH;
2616                 if (sta->added_unassoc)
2617                         hostapd_set_sta_flags(hapd, sta);
2618                 return;
2619         }
2620
2621 fail:
2622         if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) {
2623                 hostapd_drv_sta_remove(hapd, sta->addr);
2624                 sta->added_unassoc = 0;
2625         }
2626 }
2627
2628
2629 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
2630                                        struct sta_info *sta,
2631                                        char *ifname_wds)
2632 {
2633         int i;
2634         struct hostapd_ssid *ssid = &hapd->conf->ssid;
2635
2636         if (hapd->conf->ieee802_1x || hapd->conf->wpa)
2637                 return;
2638
2639         for (i = 0; i < 4; i++) {
2640                 if (ssid->wep.key[i] &&
2641                     hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
2642                                         i == ssid->wep.idx, NULL, 0,
2643                                         ssid->wep.key[i], ssid->wep.len[i])) {
2644                         wpa_printf(MSG_WARNING,
2645                                    "Could not set WEP keys for WDS interface; %s",
2646                                    ifname_wds);
2647                         break;
2648                 }
2649         }
2650 }
2651
2652
2653 static void handle_assoc_cb(struct hostapd_data *hapd,
2654                             const struct ieee80211_mgmt *mgmt,
2655                             size_t len, int reassoc, int ok)
2656 {
2657         u16 status;
2658         struct sta_info *sta;
2659         int new_assoc = 1;
2660
2661         sta = ap_get_sta(hapd, mgmt->da);
2662         if (!sta) {
2663                 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
2664                            MAC2STR(mgmt->da));
2665                 return;
2666         }
2667
2668         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
2669                                       sizeof(mgmt->u.assoc_resp))) {
2670                 wpa_printf(MSG_INFO,
2671                            "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
2672                            reassoc, (unsigned long) len);
2673                 hostapd_drv_sta_remove(hapd, sta->addr);
2674                 return;
2675         }
2676
2677         if (reassoc)
2678                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
2679         else
2680                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
2681
2682         if (!ok) {
2683                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
2684                                HOSTAPD_LEVEL_DEBUG,
2685                                "did not acknowledge association response");
2686                 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
2687                 /* The STA is added only in case of SUCCESS */
2688                 if (status == WLAN_STATUS_SUCCESS)
2689                         hostapd_drv_sta_remove(hapd, sta->addr);
2690
2691                 return;
2692         }
2693
2694         if (status != WLAN_STATUS_SUCCESS)
2695                 return;
2696
2697         /* Stop previous accounting session, if one is started, and allocate
2698          * new session id for the new session. */
2699         accounting_sta_stop(hapd, sta);
2700
2701         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2702                        HOSTAPD_LEVEL_INFO,
2703                        "associated (aid %d)",
2704                        sta->aid);
2705
2706         if (sta->flags & WLAN_STA_ASSOC)
2707                 new_assoc = 0;
2708         sta->flags |= WLAN_STA_ASSOC;
2709         sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
2710         if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa && !hapd->conf->osen) ||
2711             sta->auth_alg == WLAN_AUTH_FT) {
2712                 /*
2713                  * Open, static WEP, or FT protocol; no separate authorization
2714                  * step.
2715                  */
2716                 ap_sta_set_authorized(hapd, sta, 1);
2717         }
2718
2719         if (reassoc)
2720                 mlme_reassociate_indication(hapd, sta);
2721         else
2722                 mlme_associate_indication(hapd, sta);
2723
2724 #ifdef CONFIG_IEEE80211W
2725         sta->sa_query_timed_out = 0;
2726 #endif /* CONFIG_IEEE80211W */
2727
2728         if (sta->flags & WLAN_STA_WDS) {
2729                 int ret;
2730                 char ifname_wds[IFNAMSIZ + 1];
2731
2732                 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
2733                                           sta->aid, 1);
2734                 if (!ret)
2735                         hostapd_set_wds_encryption(hapd, sta, ifname_wds);
2736         }
2737
2738         if (sta->eapol_sm == NULL) {
2739                 /*
2740                  * This STA does not use RADIUS server for EAP authentication,
2741                  * so bind it to the selected VLAN interface now, since the
2742                  * interface selection is not going to change anymore.
2743                  */
2744                 if (ap_sta_bind_vlan(hapd, sta) < 0)
2745                         return;
2746         } else if (sta->vlan_id) {
2747                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
2748                 if (ap_sta_bind_vlan(hapd, sta) < 0)
2749                         return;
2750         }
2751
2752         hostapd_set_sta_flags(hapd, sta);
2753
2754         if (sta->auth_alg == WLAN_AUTH_FT)
2755                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
2756         else
2757                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
2758         hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
2759         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
2760 }
2761
2762
2763 static void handle_deauth_cb(struct hostapd_data *hapd,
2764                              const struct ieee80211_mgmt *mgmt,
2765                              size_t len, int ok)
2766 {
2767         struct sta_info *sta;
2768         if (mgmt->da[0] & 0x01)
2769                 return;
2770         sta = ap_get_sta(hapd, mgmt->da);
2771         if (!sta) {
2772                 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
2773                            " not found", MAC2STR(mgmt->da));
2774                 return;
2775         }
2776         if (ok)
2777                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
2778                            MAC2STR(sta->addr));
2779         else
2780                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2781                            "deauth", MAC2STR(sta->addr));
2782
2783         ap_sta_deauth_cb(hapd, sta);
2784 }
2785
2786
2787 static void handle_disassoc_cb(struct hostapd_data *hapd,
2788                                const struct ieee80211_mgmt *mgmt,
2789                                size_t len, int ok)
2790 {
2791         struct sta_info *sta;
2792         if (mgmt->da[0] & 0x01)
2793                 return;
2794         sta = ap_get_sta(hapd, mgmt->da);
2795         if (!sta) {
2796                 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
2797                            " not found", MAC2STR(mgmt->da));
2798                 return;
2799         }
2800         if (ok)
2801                 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
2802                            MAC2STR(sta->addr));
2803         else
2804                 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
2805                            "disassoc", MAC2STR(sta->addr));
2806
2807         ap_sta_disassoc_cb(hapd, sta);
2808 }
2809
2810
2811 /**
2812  * ieee802_11_mgmt_cb - Process management frame TX status callback
2813  * @hapd: hostapd BSS data structure (the BSS from which the management frame
2814  * was sent from)
2815  * @buf: management frame data (starting from IEEE 802.11 header)
2816  * @len: length of frame data in octets
2817  * @stype: management frame subtype from frame control field
2818  * @ok: Whether the frame was ACK'ed
2819  */
2820 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
2821                         u16 stype, int ok)
2822 {
2823         const struct ieee80211_mgmt *mgmt;
2824         mgmt = (const struct ieee80211_mgmt *) buf;
2825
2826 #ifdef CONFIG_TESTING_OPTIONS
2827         if (hapd->ext_mgmt_frame_handling) {
2828                 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-TX-STATUS stype=%u ok=%d",
2829                         stype, ok);
2830                 return;
2831         }
2832 #endif /* CONFIG_TESTING_OPTIONS */
2833
2834         switch (stype) {
2835         case WLAN_FC_STYPE_AUTH:
2836                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
2837                 handle_auth_cb(hapd, mgmt, len, ok);
2838                 break;
2839         case WLAN_FC_STYPE_ASSOC_RESP:
2840                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
2841                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
2842                 break;
2843         case WLAN_FC_STYPE_REASSOC_RESP:
2844                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
2845                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
2846                 break;
2847         case WLAN_FC_STYPE_PROBE_RESP:
2848                 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb");
2849                 break;
2850         case WLAN_FC_STYPE_DEAUTH:
2851                 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
2852                 handle_deauth_cb(hapd, mgmt, len, ok);
2853                 break;
2854         case WLAN_FC_STYPE_DISASSOC:
2855                 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
2856                 handle_disassoc_cb(hapd, mgmt, len, ok);
2857                 break;
2858         case WLAN_FC_STYPE_ACTION:
2859                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
2860                 break;
2861         default:
2862                 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
2863                 break;
2864         }
2865 }
2866
2867
2868 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
2869 {
2870         /* TODO */
2871         return 0;
2872 }
2873
2874
2875 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
2876                            char *buf, size_t buflen)
2877 {
2878         /* TODO */
2879         return 0;
2880 }
2881
2882
2883 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
2884                        const u8 *buf, size_t len, int ack)
2885 {
2886         struct sta_info *sta;
2887         struct hostapd_iface *iface = hapd->iface;
2888
2889         sta = ap_get_sta(hapd, addr);
2890         if (sta == NULL && iface->num_bss > 1) {
2891                 size_t j;
2892                 for (j = 0; j < iface->num_bss; j++) {
2893                         hapd = iface->bss[j];
2894                         sta = ap_get_sta(hapd, addr);
2895                         if (sta)
2896                                 break;
2897                 }
2898         }
2899         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
2900                 return;
2901         if (sta->flags & WLAN_STA_PENDING_POLL) {
2902                 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
2903                            "activity poll", MAC2STR(sta->addr),
2904                            ack ? "ACKed" : "did not ACK");
2905                 if (ack)
2906                         sta->flags &= ~WLAN_STA_PENDING_POLL;
2907         }
2908
2909         ieee802_1x_tx_status(hapd, sta, buf, len, ack);
2910 }
2911
2912
2913 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
2914                              const u8 *data, size_t len, int ack)
2915 {
2916         struct sta_info *sta;
2917         struct hostapd_iface *iface = hapd->iface;
2918
2919         sta = ap_get_sta(hapd, dst);
2920         if (sta == NULL && iface->num_bss > 1) {
2921                 size_t j;
2922                 for (j = 0; j < iface->num_bss; j++) {
2923                         hapd = iface->bss[j];
2924                         sta = ap_get_sta(hapd, dst);
2925                         if (sta)
2926                                 break;
2927                 }
2928         }
2929         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
2930                 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
2931                            MACSTR " that is not currently associated",
2932                            MAC2STR(dst));
2933                 return;
2934         }
2935
2936         ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
2937 }
2938
2939
2940 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
2941 {
2942         struct sta_info *sta;
2943         struct hostapd_iface *iface = hapd->iface;
2944
2945         sta = ap_get_sta(hapd, addr);
2946         if (sta == NULL && iface->num_bss > 1) {
2947                 size_t j;
2948                 for (j = 0; j < iface->num_bss; j++) {
2949                         hapd = iface->bss[j];
2950                         sta = ap_get_sta(hapd, addr);
2951                         if (sta)
2952                                 break;
2953                 }
2954         }
2955         if (sta == NULL)
2956                 return;
2957         if (!(sta->flags & WLAN_STA_PENDING_POLL))
2958                 return;
2959
2960         wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
2961                    "activity poll", MAC2STR(sta->addr));
2962         sta->flags &= ~WLAN_STA_PENDING_POLL;
2963 }
2964
2965
2966 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
2967                                 int wds)
2968 {
2969         struct sta_info *sta;
2970
2971         sta = ap_get_sta(hapd, src);
2972         if (sta && (sta->flags & WLAN_STA_ASSOC)) {
2973                 if (!hapd->conf->wds_sta)
2974                         return;
2975
2976                 if (wds && !(sta->flags & WLAN_STA_WDS)) {
2977                         int ret;
2978                         char ifname_wds[IFNAMSIZ + 1];
2979
2980                         wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
2981                                    "STA " MACSTR " (aid %u)",
2982                                    MAC2STR(sta->addr), sta->aid);
2983                         sta->flags |= WLAN_STA_WDS;
2984                         ret = hostapd_set_wds_sta(hapd, ifname_wds,
2985                                                   sta->addr, sta->aid, 1);
2986                         if (!ret)
2987                                 hostapd_set_wds_encryption(hapd, sta,
2988                                                            ifname_wds);
2989                 }
2990                 return;
2991         }
2992
2993         wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
2994                    MACSTR, MAC2STR(src));
2995         if (src[0] & 0x01) {
2996                 /* Broadcast bit set in SA?! Ignore the frame silently. */
2997                 return;
2998         }
2999
3000         if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
3001                 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
3002                            "already been sent, but no TX status yet known - "
3003                            "ignore Class 3 frame issue with " MACSTR,
3004                            MAC2STR(src));
3005                 return;
3006         }
3007
3008         if (sta && (sta->flags & WLAN_STA_AUTH))
3009                 hostapd_drv_sta_disassoc(
3010                         hapd, src,
3011                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
3012         else
3013                 hostapd_drv_sta_deauth(
3014                         hapd, src,
3015                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
3016 }
3017
3018
3019 #endif /* CONFIG_NATIVE_WINDOWS */