wpa_supplicant/mesh_mpm.c

   1 /*
   2  * WPA Supplicant - Basic mesh peer management
   3  * Copyright (c) 2013-2014, cozybit, Inc.  All rights reserved.
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "utils/eloop.h"
  13 #include "common/ieee802_11_defs.h"
  14 #include "ap/hostapd.h"
  15 #include "ap/sta_info.h"
  16 #include "ap/ieee802_11.h"
  17 #include "ap/wpa_auth.h"
  18 #include "wpa_supplicant_i.h"
  19 #include "driver_i.h"
  20 #include "mesh_mpm.h"
  21 #include "mesh_rsn.h"
  22
  23 struct mesh_peer_mgmt_ie {
  24         const u8 *proto_id; /* Mesh Peering Protocol Identifier (2 octets) */
  25         const u8 *llid; /* Local Link ID (2 octets) */
  26         const u8 *plid; /* Peer Link ID (conditional, 2 octets) */
  27         const u8 *reason; /* Reason Code (conditional, 2 octets) */
  28         const u8 *chosen_pmk; /* Chosen PMK (optional, 16 octets) */
  29 };
  30
  31 static void plink_timer(void *eloop_ctx, void *user_data);
  32
  33
  34 enum plink_event {
  35         PLINK_UNDEFINED,
  36         OPN_ACPT,
  37         OPN_RJCT,
  38         OPN_IGNR,
  39         CNF_ACPT,
  40         CNF_RJCT,
  41         CNF_IGNR,
  42         CLS_ACPT,
  43         CLS_IGNR
  44 };
  45
  46 static const char * const mplstate[] = {
  47         [0] = "UNINITIALIZED",
  48         [PLINK_LISTEN] = "LISTEN",
  49         [PLINK_OPEN_SENT] = "OPEN_SENT",
  50         [PLINK_OPEN_RCVD] = "OPEN_RCVD",
  51         [PLINK_CNF_RCVD] = "CNF_RCVD",
  52         [PLINK_ESTAB] = "ESTAB",
  53         [PLINK_HOLDING] = "HOLDING",
  54         [PLINK_BLOCKED] = "BLOCKED"
  55 };
  56
  57 static const char * const mplevent[] = {
  58         [PLINK_UNDEFINED] = "UNDEFINED",
  59         [OPN_ACPT] = "OPN_ACPT",
  60         [OPN_RJCT] = "OPN_RJCT",
  61         [OPN_IGNR] = "OPN_IGNR",
  62         [CNF_ACPT] = "CNF_ACPT",
  63         [CNF_RJCT] = "CNF_RJCT",
  64         [CNF_IGNR] = "CNF_IGNR",
  65         [CLS_ACPT] = "CLS_ACPT",
  66         [CLS_IGNR] = "CLS_IGNR"
  67 };
  68
  69
  70 static int mesh_mpm_parse_peer_mgmt(struct wpa_supplicant *wpa_s,
  71                                     u8 action_field,
  72                                     const u8 *ie, size_t len,
  73                                     struct mesh_peer_mgmt_ie *mpm_ie)
  74 {
  75         os_memset(mpm_ie, 0, sizeof(*mpm_ie));
  76
  77         /* Remove optional Chosen PMK field at end */
  78         if (len >= SAE_PMKID_LEN) {
  79                 mpm_ie->chosen_pmk = ie + len - SAE_PMKID_LEN;
  80                 len -= SAE_PMKID_LEN;
  81         }
  82
  83         if ((action_field == PLINK_OPEN && len != 4) ||
  84             (action_field == PLINK_CONFIRM && len != 6) ||
  85             (action_field == PLINK_CLOSE && len != 6 && len != 8)) {
  86                 wpa_msg(wpa_s, MSG_DEBUG, "MPM: Invalid peer mgmt ie");
  87                 return -1;
  88         }
  89
  90         /* required fields */
  91         if (len < 4)
  92                 return -1;
  93         mpm_ie->proto_id = ie;
  94         mpm_ie->llid = ie + 2;
  95         ie += 4;
  96         len -= 4;
  97
  98         /* close reason is always present at end for close */
  99         if (action_field == PLINK_CLOSE) {
 100                 if (len < 2)
 101                         return -1;
 102                 mpm_ie->reason = ie + len - 2;
 103                 len -= 2;
 104         }
 105
 106         /* Peer Link ID, present for confirm, and possibly close */
 107         if (len >= 2)
 108                 mpm_ie->plid = ie;
 109
 110         return 0;
 111 }
 112
 113
 114 static int plink_free_count(struct hostapd_data *hapd)
 115 {
 116         if (hapd->max_plinks > hapd->num_plinks)
 117                 return hapd->max_plinks - hapd->num_plinks;
 118         return 0;
 119 }
 120
 121
 122 static u16 copy_supp_rates(struct wpa_supplicant *wpa_s,
 123                            struct sta_info *sta,
 124                            struct ieee802_11_elems *elems)
 125 {
 126         if (!elems->supp_rates) {
 127                 wpa_msg(wpa_s, MSG_ERROR, "no supported rates from " MACSTR,
 128                         MAC2STR(sta->addr));
 129                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 130         }
 131
 132         if (elems->supp_rates_len + elems->ext_supp_rates_len >
 133             sizeof(sta->supported_rates)) {
 134                 wpa_msg(wpa_s, MSG_ERROR,
 135                         "Invalid supported rates element length " MACSTR
 136                         " %d+%d", MAC2STR(sta->addr), elems->supp_rates_len,
 137                         elems->ext_supp_rates_len);
 138                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 139         }
 140
 141         sta->supported_rates_len = merge_byte_arrays(
 142                 sta->supported_rates, sizeof(sta->supported_rates),
 143                 elems->supp_rates, elems->supp_rates_len,
 144                 elems->ext_supp_rates, elems->ext_supp_rates_len);
 145
 146         return WLAN_STATUS_SUCCESS;
 147 }
 148
 149
 150 /* return true if elems from a neighbor match this MBSS */
 151 static Boolean matches_local(struct wpa_supplicant *wpa_s,
 152                              struct ieee802_11_elems *elems)
 153 {
 154         struct mesh_conf *mconf = wpa_s->ifmsh->mconf;
 155
 156         if (elems->mesh_config_len < 5)
 157                 return FALSE;
 158
 159         return (mconf->meshid_len == elems->mesh_id_len &&
 160                 os_memcmp(mconf->meshid, elems->mesh_id,
 161                           elems->mesh_id_len) == 0 &&
 162                 mconf->mesh_pp_id == elems->mesh_config[0] &&
 163                 mconf->mesh_pm_id == elems->mesh_config[1] &&
 164                 mconf->mesh_cc_id == elems->mesh_config[2] &&
 165                 mconf->mesh_sp_id == elems->mesh_config[3] &&
 166                 mconf->mesh_auth_id == elems->mesh_config[4]);
 167 }
 168
 169
 170 /* check if local link id is already used with another peer */
 171 static Boolean llid_in_use(struct wpa_supplicant *wpa_s, u16 llid)
 172 {
 173         struct sta_info *sta;
 174         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 175
 176         for (sta = hapd->sta_list; sta; sta = sta->next) {
 177                 if (sta->my_lid == llid)
 178                         return TRUE;
 179         }
 180
 181         return FALSE;
 182 }
 183
 184
 185 /* generate an llid for a link and set to initial state */
 186 static void mesh_mpm_init_link(struct wpa_supplicant *wpa_s,
 187                                struct sta_info *sta)
 188 {
 189         u16 llid;
 190
 191         do {
 192                 if (os_get_random((u8 *) &llid, sizeof(llid)) < 0)
 193                         continue;
 194         } while (!llid || llid_in_use(wpa_s, llid));
 195
 196         sta->my_lid = llid;
 197         sta->peer_lid = 0;
 198
 199         /*
 200          * We do not use wpa_mesh_set_plink_state() here because there is no
 201          * entry in kernel yet.
 202          */
 203         sta->plink_state = PLINK_LISTEN;
 204 }
 205
 206
 207 static void mesh_mpm_send_plink_action(struct wpa_supplicant *wpa_s,
 208                                        struct sta_info *sta,
 209                                        enum plink_action_field type,
 210                                        u16 close_reason)
 211 {
 212         struct wpabuf *buf;
 213         struct hostapd_iface *ifmsh = wpa_s->ifmsh;
 214         struct hostapd_data *bss = ifmsh->bss[0];
 215         struct mesh_conf *conf = ifmsh->mconf;
 216         u8 supp_rates[2 + 2 + 32];
 217         u8 *pos, *cat;
 218         u8 ie_len, add_plid = 0;
 219         int ret;
 220         int ampe = conf->security & MESH_CONF_SEC_AMPE;
 221         size_t buf_len;
 222
 223         if (!sta)
 224                 return;
 225
 226         buf_len = 2 +      /* capability info */
 227                   2 +      /* AID */
 228                   2 + 8 +  /* supported rates */
 229                   2 + (32 - 8) +
 230                   2 + 32 + /* mesh ID */
 231                   2 + 7 +  /* mesh config */
 232                   2 + 23 + /* peering management */
 233                   2 + 96 + /* AMPE */
 234                   2 + 16;  /* MIC */
 235 #ifdef CONFIG_IEEE80211N
 236         if (type != PLINK_CLOSE && wpa_s->mesh_ht_enabled) {
 237                 buf_len += 2 + 26 + /* HT capabilities */
 238                            2 + 22;  /* HT operation */
 239         }
 240 #endif /* CONFIG_IEEE80211N */
 241 #ifdef CONFIG_IEEE80211AC
 242         if (type != PLINK_CLOSE && wpa_s->mesh_vht_enabled) {
 243                 buf_len += 2 + 12 + /* VHT Capabilities */
 244                            2 + 5;  /* VHT Operation */
 245         }
 246 #endif /* CONFIG_IEEE80211AC */
 247         if (type != PLINK_CLOSE)
 248                 buf_len += conf->rsn_ie_len; /* RSN IE */
 249
 250         buf = wpabuf_alloc(buf_len);
 251         if (!buf)
 252                 return;
 253
 254         cat = wpabuf_mhead_u8(buf);
 255         wpabuf_put_u8(buf, WLAN_ACTION_SELF_PROTECTED);
 256         wpabuf_put_u8(buf, type);
 257
 258         if (type != PLINK_CLOSE) {
 259                 u8 info;
 260
 261                 /* capability info */
 262                 wpabuf_put_le16(buf, ampe ? IEEE80211_CAP_PRIVACY : 0);
 263
 264                 /* aid */
 265                 if (type == PLINK_CONFIRM)
 266                         wpabuf_put_le16(buf, sta->aid);
 267
 268                 /* IE: supp + ext. supp rates */
 269                 pos = hostapd_eid_supp_rates(bss, supp_rates);
 270                 pos = hostapd_eid_ext_supp_rates(bss, pos);
 271                 wpabuf_put_data(buf, supp_rates, pos - supp_rates);
 272
 273                 /* IE: RSN IE */
 274                 wpabuf_put_data(buf, conf->rsn_ie, conf->rsn_ie_len);
 275
 276                 /* IE: Mesh ID */
 277                 wpabuf_put_u8(buf, WLAN_EID_MESH_ID);
 278                 wpabuf_put_u8(buf, conf->meshid_len);
 279                 wpabuf_put_data(buf, conf->meshid, conf->meshid_len);
 280
 281                 /* IE: mesh conf */
 282                 wpabuf_put_u8(buf, WLAN_EID_MESH_CONFIG);
 283                 wpabuf_put_u8(buf, 7);
 284                 wpabuf_put_u8(buf, conf->mesh_pp_id);
 285                 wpabuf_put_u8(buf, conf->mesh_pm_id);
 286                 wpabuf_put_u8(buf, conf->mesh_cc_id);
 287                 wpabuf_put_u8(buf, conf->mesh_sp_id);
 288                 wpabuf_put_u8(buf, conf->mesh_auth_id);
 289                 info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1;
 290                 /* TODO: Add Connected to Mesh Gate/AS subfields */
 291                 wpabuf_put_u8(buf, info);
 292                 /* always forwarding & accepting plinks for now */
 293                 wpabuf_put_u8(buf, MESH_CAP_ACCEPT_ADDITIONAL_PEER |
 294                               MESH_CAP_FORWARDING);
 295         } else {        /* Peer closing frame */
 296                 /* IE: Mesh ID */
 297                 wpabuf_put_u8(buf, WLAN_EID_MESH_ID);
 298                 wpabuf_put_u8(buf, conf->meshid_len);
 299                 wpabuf_put_data(buf, conf->meshid, conf->meshid_len);
 300         }
 301
 302         /* IE: Mesh Peering Management element */
 303         ie_len = 4;
 304         if (ampe)
 305                 ie_len += PMKID_LEN;
 306         switch (type) {
 307         case PLINK_OPEN:
 308                 break;
 309         case PLINK_CONFIRM:
 310                 ie_len += 2;
 311                 add_plid = 1;
 312                 break;
 313         case PLINK_CLOSE:
 314                 ie_len += 2;
 315                 add_plid = 1;
 316                 ie_len += 2; /* reason code */
 317                 break;
 318         }
 319
 320         wpabuf_put_u8(buf, WLAN_EID_PEER_MGMT);
 321         wpabuf_put_u8(buf, ie_len);
 322         /* peering protocol */
 323         if (ampe)
 324                 wpabuf_put_le16(buf, 1);
 325         else
 326                 wpabuf_put_le16(buf, 0);
 327         wpabuf_put_le16(buf, sta->my_lid);
 328         if (add_plid)
 329                 wpabuf_put_le16(buf, sta->peer_lid);
 330         if (type == PLINK_CLOSE)
 331                 wpabuf_put_le16(buf, close_reason);
 332         if (ampe) {
 333                 if (sta->sae == NULL) {
 334                         wpa_msg(wpa_s, MSG_INFO, "Mesh MPM: no SAE session");
 335                         goto fail;
 336                 }
 337                 mesh_rsn_get_pmkid(wpa_s->mesh_rsn, sta,
 338                                    wpabuf_put(buf, PMKID_LEN));
 339         }
 340
 341 #ifdef CONFIG_IEEE80211N
 342         if (type != PLINK_CLOSE && wpa_s->mesh_ht_enabled) {
 343                 u8 ht_capa_oper[2 + 26 + 2 + 22];
 344
 345                 pos = hostapd_eid_ht_capabilities(bss, ht_capa_oper);
 346                 pos = hostapd_eid_ht_operation(bss, pos);
 347                 wpabuf_put_data(buf, ht_capa_oper, pos - ht_capa_oper);
 348         }
 349 #endif /* CONFIG_IEEE80211N */
 350 #ifdef CONFIG_IEEE80211AC
 351         if (type != PLINK_CLOSE && wpa_s->mesh_vht_enabled) {
 352                 u8 vht_capa_oper[2 + 12 + 2 + 5];
 353
 354                 pos = hostapd_eid_vht_capabilities(bss, vht_capa_oper);
 355                 pos = hostapd_eid_vht_operation(bss, pos);
 356                 wpabuf_put_data(buf, vht_capa_oper, pos - vht_capa_oper);
 357         }
 358 #endif /* CONFIG_IEEE80211AC */
 359
 360         if (ampe && mesh_rsn_protect_frame(wpa_s->mesh_rsn, sta, cat, buf)) {
 361                 wpa_msg(wpa_s, MSG_INFO,
 362                         "Mesh MPM: failed to add AMPE and MIC IE");
 363                 goto fail;
 364         }
 365
 366         wpa_msg(wpa_s, MSG_DEBUG, "Mesh MPM: Sending peering frame type %d to "
 367                 MACSTR " (my_lid=0x%x peer_lid=0x%x)",
 368                 type, MAC2STR(sta->addr), sta->my_lid, sta->peer_lid);
 369         ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0,
 370                                   sta->addr, wpa_s->own_addr, wpa_s->own_addr,
 371                                   wpabuf_head(buf), wpabuf_len(buf), 0);
 372         if (ret < 0)
 373                 wpa_msg(wpa_s, MSG_INFO,
 374                         "Mesh MPM: failed to send peering frame");
 375
 376 fail:
 377         wpabuf_free(buf);
 378 }
 379
 380
 381 /* configure peering state in ours and driver's station entry */
 382 void wpa_mesh_set_plink_state(struct wpa_supplicant *wpa_s,
 383                               struct sta_info *sta,
 384                               enum mesh_plink_state state)
 385 {
 386         struct hostapd_sta_add_params params;
 387         int ret;
 388
 389         wpa_msg(wpa_s, MSG_DEBUG, "MPM set " MACSTR " from %s into %s",
 390                 MAC2STR(sta->addr), mplstate[sta->plink_state],
 391                 mplstate[state]);
 392         sta->plink_state = state;
 393
 394         os_memset(&params, 0, sizeof(params));
 395         params.addr = sta->addr;
 396         params.plink_state = state;
 397         params.set = 1;
 398
 399         ret = wpa_drv_sta_add(wpa_s, &params);
 400         if (ret) {
 401                 wpa_msg(wpa_s, MSG_ERROR, "Driver failed to set " MACSTR
 402                         ": %d", MAC2STR(sta->addr), ret);
 403         }
 404 }
 405
 406
 407 static void mesh_mpm_fsm_restart(struct wpa_supplicant *wpa_s,
 408                                  struct sta_info *sta)
 409 {
 410         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 411
 412         eloop_cancel_timeout(plink_timer, wpa_s, sta);
 413
 414         ap_free_sta(hapd, sta);
 415 }
 416
 417
 418 static void plink_timer(void *eloop_ctx, void *user_data)
 419 {
 420         struct wpa_supplicant *wpa_s = eloop_ctx;
 421         struct sta_info *sta = user_data;
 422         u16 reason = 0;
 423         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 424         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 425
 426         switch (sta->plink_state) {
 427         case PLINK_OPEN_RCVD:
 428         case PLINK_OPEN_SENT:
 429                 /* retry timer */
 430                 if (sta->mpm_retries < conf->dot11MeshMaxRetries) {
 431                         eloop_register_timeout(
 432                                 conf->dot11MeshRetryTimeout / 1000,
 433                                 (conf->dot11MeshRetryTimeout % 1000) * 1000,
 434                                 plink_timer, wpa_s, sta);
 435                         mesh_mpm_send_plink_action(wpa_s, sta, PLINK_OPEN, 0);
 436                         sta->mpm_retries++;
 437                         break;
 438                 }
 439                 reason = WLAN_REASON_MESH_MAX_RETRIES;
 440                 /* fall through on else */
 441
 442         case PLINK_CNF_RCVD:
 443                 /* confirm timer */
 444                 if (!reason)
 445                         reason = WLAN_REASON_MESH_CONFIRM_TIMEOUT;
 446                 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 447                 eloop_register_timeout(conf->dot11MeshHoldingTimeout / 1000,
 448                         (conf->dot11MeshHoldingTimeout % 1000) * 1000,
 449                         plink_timer, wpa_s, sta);
 450                 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CLOSE, reason);
 451                 break;
 452         case PLINK_HOLDING:
 453                 /* holding timer */
 454
 455                 if (sta->mesh_sae_pmksa_caching) {
 456                         wpa_printf(MSG_DEBUG, "MPM: Peer " MACSTR
 457                                    " looks like it does not support mesh SAE PMKSA caching, so remove the cached entry for it",
 458                                    MAC2STR(sta->addr));
 459                         wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
 460                 }
 461                 mesh_mpm_fsm_restart(wpa_s, sta);
 462                 break;
 463         default:
 464                 break;
 465         }
 466 }
 467
 468
 469 /* initiate peering with station */
 470 static void
 471 mesh_mpm_plink_open(struct wpa_supplicant *wpa_s, struct sta_info *sta,
 472                     enum mesh_plink_state next_state)
 473 {
 474         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 475
 476         eloop_cancel_timeout(plink_timer, wpa_s, sta);
 477         eloop_register_timeout(conf->dot11MeshRetryTimeout / 1000,
 478                                (conf->dot11MeshRetryTimeout % 1000) * 1000,
 479                                plink_timer, wpa_s, sta);
 480         mesh_mpm_send_plink_action(wpa_s, sta, PLINK_OPEN, 0);
 481         wpa_mesh_set_plink_state(wpa_s, sta, next_state);
 482 }
 483
 484
 485 static int mesh_mpm_plink_close(struct hostapd_data *hapd, struct sta_info *sta,
 486                                 void *ctx)
 487 {
 488         struct wpa_supplicant *wpa_s = ctx;
 489         int reason = WLAN_REASON_MESH_PEERING_CANCELLED;
 490
 491         if (sta) {
 492                 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 493                 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CLOSE, reason);
 494                 wpa_printf(MSG_DEBUG, "MPM closing plink sta=" MACSTR,
 495                            MAC2STR(sta->addr));
 496                 eloop_cancel_timeout(plink_timer, wpa_s, sta);
 497                 return 0;
 498         }
 499
 500         return 1;
 501 }
 502
 503
 504 int mesh_mpm_close_peer(struct wpa_supplicant *wpa_s, const u8 *addr)
 505 {
 506         struct hostapd_data *hapd;
 507         struct sta_info *sta;
 508
 509         if (!wpa_s->ifmsh) {
 510                 wpa_msg(wpa_s, MSG_INFO, "Mesh is not prepared yet");
 511                 return -1;
 512         }
 513
 514         hapd = wpa_s->ifmsh->bss[0];
 515         sta = ap_get_sta(hapd, addr);
 516         if (!sta) {
 517                 wpa_msg(wpa_s, MSG_INFO, "No such mesh peer");
 518                 return -1;
 519         }
 520
 521         return mesh_mpm_plink_close(hapd, sta, wpa_s) == 0 ? 0 : -1;
 522 }
 523
 524
 525 static void peer_add_timer(void *eloop_ctx, void *user_data)
 526 {
 527         struct wpa_supplicant *wpa_s = eloop_ctx;
 528         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 529
 530         os_memset(hapd->mesh_required_peer, 0, ETH_ALEN);
 531 }
 532
 533
 534 int mesh_mpm_connect_peer(struct wpa_supplicant *wpa_s, const u8 *addr,
 535                           int duration)
 536 {
 537         struct wpa_ssid *ssid = wpa_s->current_ssid;
 538         struct hostapd_data *hapd;
 539         struct sta_info *sta;
 540         struct mesh_conf *conf;
 541
 542         if (!wpa_s->ifmsh) {
 543                 wpa_msg(wpa_s, MSG_INFO, "Mesh is not prepared yet");
 544                 return -1;
 545         }
 546
 547         if (!ssid || !ssid->no_auto_peer) {
 548                 wpa_msg(wpa_s, MSG_INFO,
 549                         "This command is available only with no_auto_peer mesh network");
 550                 return -1;
 551         }
 552
 553         hapd = wpa_s->ifmsh->bss[0];
 554         conf = wpa_s->ifmsh->mconf;
 555
 556         sta = ap_get_sta(hapd, addr);
 557         if (!sta) {
 558                 wpa_msg(wpa_s, MSG_INFO, "No such mesh peer");
 559                 return -1;
 560         }
 561
 562         if ((PLINK_OPEN_SENT <= sta->plink_state &&
 563             sta->plink_state <= PLINK_ESTAB) ||
 564             (sta->sae && sta->sae->state > SAE_NOTHING)) {
 565                 wpa_msg(wpa_s, MSG_INFO,
 566                         "Specified peer is connecting/connected");
 567                 return -1;
 568         }
 569
 570         if (conf->security == MESH_CONF_SEC_NONE) {
 571                 mesh_mpm_plink_open(wpa_s, sta, PLINK_OPEN_SENT);
 572         } else {
 573                 mesh_rsn_auth_sae_sta(wpa_s, sta);
 574                 os_memcpy(hapd->mesh_required_peer, addr, ETH_ALEN);
 575                 eloop_register_timeout(duration == -1 ? 10 : duration, 0,
 576                                        peer_add_timer, wpa_s, NULL);
 577         }
 578
 579         return 0;
 580 }
 581
 582
 583 void mesh_mpm_deinit(struct wpa_supplicant *wpa_s, struct hostapd_iface *ifmsh)
 584 {
 585         struct hostapd_data *hapd = ifmsh->bss[0];
 586
 587         /* notify peers we're leaving */
 588         ap_for_each_sta(hapd, mesh_mpm_plink_close, wpa_s);
 589
 590         hapd->num_plinks = 0;
 591         hostapd_free_stas(hapd);
 592         eloop_cancel_timeout(peer_add_timer, wpa_s, NULL);
 593 }
 594
 595
 596 /* for mesh_rsn to indicate this peer has completed authentication, and we're
 597  * ready to start AMPE */
 598 void mesh_mpm_auth_peer(struct wpa_supplicant *wpa_s, const u8 *addr)
 599 {
 600         struct hostapd_data *data = wpa_s->ifmsh->bss[0];
 601         struct hostapd_sta_add_params params;
 602         struct sta_info *sta;
 603         int ret;
 604
 605         sta = ap_get_sta(data, addr);
 606         if (!sta) {
 607                 wpa_msg(wpa_s, MSG_DEBUG, "no such mesh peer");
 608                 return;
 609         }
 610
 611         /* TODO: Should do nothing if this STA is already authenticated, but
 612          * the AP code already sets this flag. */
 613         sta->flags |= WLAN_STA_AUTH;
 614
 615         mesh_rsn_init_ampe_sta(wpa_s, sta);
 616
 617         os_memset(&params, 0, sizeof(params));
 618         params.addr = sta->addr;
 619         params.flags = WPA_STA_AUTHENTICATED | WPA_STA_AUTHORIZED;
 620         params.set = 1;
 621
 622         wpa_msg(wpa_s, MSG_DEBUG, "MPM authenticating " MACSTR,
 623                 MAC2STR(sta->addr));
 624         ret = wpa_drv_sta_add(wpa_s, &params);
 625         if (ret) {
 626                 wpa_msg(wpa_s, MSG_ERROR,
 627                         "Driver failed to set " MACSTR ": %d",
 628                         MAC2STR(sta->addr), ret);
 629         }
 630
 631         if (!sta->my_lid)
 632                 mesh_mpm_init_link(wpa_s, sta);
 633
 634         mesh_mpm_plink_open(wpa_s, sta, PLINK_OPEN_SENT);
 635 }
 636
 637 /*
 638  * Initialize a sta_info structure for a peer and upload it into the driver
 639  * in preparation for beginning authentication or peering. This is done when a
 640  * Beacon (secure or open mesh) or a peering open frame (for open mesh) is
 641  * received from the peer for the first time.
 642  */
 643 static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
 644                                            const u8 *addr,
 645                                            struct ieee802_11_elems *elems)
 646 {
 647         struct hostapd_sta_add_params params;
 648         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 649         struct hostapd_data *data = wpa_s->ifmsh->bss[0];
 650         struct sta_info *sta;
 651         int ret;
 652
 653         if (elems->mesh_config_len >= 7 &&
 654             !(elems->mesh_config[6] & MESH_CAP_ACCEPT_ADDITIONAL_PEER)) {
 655                 wpa_msg(wpa_s, MSG_DEBUG,
 656                         "mesh: Ignore a crowded peer " MACSTR,
 657                         MAC2STR(addr));
 658                 return NULL;
 659         }
 660
 661         sta = ap_get_sta(data, addr);
 662         if (!sta) {
 663                 sta = ap_sta_add(data, addr);
 664                 if (!sta)
 665                         return NULL;
 666         }
 667
 668         /* Set WMM by default since Mesh STAs are QoS STAs */
 669         sta->flags |= WLAN_STA_WMM;
 670
 671         /* initialize sta */
 672         if (copy_supp_rates(wpa_s, sta, elems)) {
 673                 ap_free_sta(data, sta);
 674                 return NULL;
 675         }
 676
 677         if (!sta->my_lid)
 678                 mesh_mpm_init_link(wpa_s, sta);
 679
 680 #ifdef CONFIG_IEEE80211N
 681         copy_sta_ht_capab(data, sta, elems->ht_capabilities);
 682         update_ht_state(data, sta);
 683 #endif /* CONFIG_IEEE80211N */
 684
 685 #ifdef CONFIG_IEEE80211AC
 686         copy_sta_vht_capab(data, sta, elems->vht_capabilities);
 687         set_sta_vht_opmode(data, sta, elems->vht_opmode_notif);
 688 #endif /* CONFIG_IEEE80211AC */
 689
 690         if (hostapd_get_aid(data, sta) < 0) {
 691                 wpa_msg(wpa_s, MSG_ERROR, "No AIDs available");
 692                 ap_free_sta(data, sta);
 693                 return NULL;
 694         }
 695
 696         /* insert into driver */
 697         os_memset(&params, 0, sizeof(params));
 698         params.supp_rates = sta->supported_rates;
 699         params.supp_rates_len = sta->supported_rates_len;
 700         params.addr = addr;
 701         params.plink_state = sta->plink_state;
 702         params.aid = sta->aid;
 703         params.listen_interval = 100;
 704         params.ht_capabilities = sta->ht_capabilities;
 705         params.vht_capabilities = sta->vht_capabilities;
 706         params.flags |= WPA_STA_WMM;
 707         params.flags_mask |= WPA_STA_AUTHENTICATED;
 708         if (conf->security == MESH_CONF_SEC_NONE) {
 709                 params.flags |= WPA_STA_AUTHORIZED;
 710                 params.flags |= WPA_STA_AUTHENTICATED;
 711         } else {
 712                 sta->flags |= WLAN_STA_MFP;
 713                 params.flags |= WPA_STA_MFP;
 714         }
 715
 716         ret = wpa_drv_sta_add(wpa_s, &params);
 717         if (ret) {
 718                 wpa_msg(wpa_s, MSG_ERROR,
 719                         "Driver failed to insert " MACSTR ": %d",
 720                         MAC2STR(addr), ret);
 721                 ap_free_sta(data, sta);
 722                 return NULL;
 723         }
 724
 725         return sta;
 726 }
 727
 728
 729 void wpa_mesh_new_mesh_peer(struct wpa_supplicant *wpa_s, const u8 *addr,
 730                             struct ieee802_11_elems *elems)
 731 {
 732         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 733         struct hostapd_data *data = wpa_s->ifmsh->bss[0];
 734         struct sta_info *sta;
 735         struct wpa_ssid *ssid = wpa_s->current_ssid;
 736
 737         sta = mesh_mpm_add_peer(wpa_s, addr, elems);
 738         if (!sta)
 739                 return;
 740
 741         if (ssid && ssid->no_auto_peer &&
 742             (is_zero_ether_addr(data->mesh_required_peer) ||
 743              os_memcmp(data->mesh_required_peer, addr, ETH_ALEN) != 0)) {
 744                 wpa_msg(wpa_s, MSG_INFO, "will not initiate new peer link with "
 745                         MACSTR " because of no_auto_peer", MAC2STR(addr));
 746                 if (data->mesh_pending_auth) {
 747                         struct os_reltime age;
 748                         const struct ieee80211_mgmt *mgmt;
 749                         struct hostapd_frame_info fi;
 750
 751                         mgmt = wpabuf_head(data->mesh_pending_auth);
 752                         os_reltime_age(&data->mesh_pending_auth_time, &age);
 753                         if (age.sec < 2 &&
 754                             os_memcmp(mgmt->sa, addr, ETH_ALEN) == 0) {
 755                                 wpa_printf(MSG_DEBUG,
 756                                            "mesh: Process pending Authentication frame from %u.%06u seconds ago",
 757                                            (unsigned int) age.sec,
 758                                            (unsigned int) age.usec);
 759                                 os_memset(&fi, 0, sizeof(fi));
 760                                 ieee802_11_mgmt(
 761                                         data,
 762                                         wpabuf_head(data->mesh_pending_auth),
 763                                         wpabuf_len(data->mesh_pending_auth),
 764                                         &fi);
 765                         }
 766                         wpabuf_free(data->mesh_pending_auth);
 767                         data->mesh_pending_auth = NULL;
 768                 }
 769                 return;
 770         }
 771
 772         if (conf->security == MESH_CONF_SEC_NONE) {
 773                 if (sta->plink_state < PLINK_OPEN_SENT ||
 774                     sta->plink_state > PLINK_ESTAB)
 775                         mesh_mpm_plink_open(wpa_s, sta, PLINK_OPEN_SENT);
 776         } else {
 777                 mesh_rsn_auth_sae_sta(wpa_s, sta);
 778         }
 779 }
 780
 781
 782 void mesh_mpm_mgmt_rx(struct wpa_supplicant *wpa_s, struct rx_mgmt *rx_mgmt)
 783 {
 784         struct hostapd_frame_info fi;
 785
 786         os_memset(&fi, 0, sizeof(fi));
 787         fi.datarate = rx_mgmt->datarate;
 788         fi.ssi_signal = rx_mgmt->ssi_signal;
 789         ieee802_11_mgmt(wpa_s->ifmsh->bss[0], rx_mgmt->frame,
 790                         rx_mgmt->frame_len, &fi);
 791 }
 792
 793
 794 static void mesh_mpm_plink_estab(struct wpa_supplicant *wpa_s,
 795                                  struct sta_info *sta)
 796 {
 797         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 798         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 799         u8 seq[6] = {};
 800
 801         wpa_msg(wpa_s, MSG_INFO, "mesh plink with " MACSTR " established",
 802                 MAC2STR(sta->addr));
 803
 804         if (conf->security & MESH_CONF_SEC_AMPE) {
 805                 wpa_hexdump_key(MSG_DEBUG, "mesh: MTK", sta->mtk, sta->mtk_len);
 806                 wpa_drv_set_key(wpa_s, wpa_cipher_to_alg(conf->pairwise_cipher),
 807                                 sta->addr, 0, 0, seq, sizeof(seq),
 808                                 sta->mtk, sta->mtk_len);
 809
 810                 wpa_hexdump_key(MSG_DEBUG, "mesh: RX MGTK Key RSC",
 811                                 sta->mgtk_rsc, sizeof(sta->mgtk_rsc));
 812                 wpa_hexdump_key(MSG_DEBUG, "mesh: RX MGTK",
 813                                 sta->mgtk, sta->mgtk_len);
 814                 wpa_drv_set_key(wpa_s, wpa_cipher_to_alg(conf->group_cipher),
 815                                 sta->addr, sta->mgtk_key_id, 0,
 816                                 sta->mgtk_rsc, sizeof(sta->mgtk_rsc),
 817                                 sta->mgtk, sta->mgtk_len);
 818
 819                 if (sta->igtk_len) {
 820                         wpa_hexdump_key(MSG_DEBUG, "mesh: RX IGTK Key RSC",
 821                                         sta->igtk_rsc, sizeof(sta->igtk_rsc));
 822                         wpa_hexdump_key(MSG_DEBUG, "mesh: RX IGTK",
 823                                         sta->igtk, sta->igtk_len);
 824                         wpa_drv_set_key(
 825                                 wpa_s,
 826                                 wpa_cipher_to_alg(conf->mgmt_group_cipher),
 827                                 sta->addr, sta->igtk_key_id, 0,
 828                                 sta->igtk_rsc, sizeof(sta->igtk_rsc),
 829                                 sta->igtk, sta->igtk_len);
 830                 }
 831         }
 832
 833         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_ESTAB);
 834         hapd->num_plinks++;
 835
 836         sta->flags |= WLAN_STA_ASSOC;
 837         sta->mesh_sae_pmksa_caching = 0;
 838
 839         eloop_cancel_timeout(peer_add_timer, wpa_s, NULL);
 840         peer_add_timer(wpa_s, NULL);
 841         eloop_cancel_timeout(plink_timer, wpa_s, sta);
 842
 843         /* Send ctrl event */
 844         wpa_msg(wpa_s, MSG_INFO, MESH_PEER_CONNECTED MACSTR,
 845                 MAC2STR(sta->addr));
 846 }
 847
 848
 849 static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
 850                          enum plink_event event)
 851 {
 852         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
 853         struct mesh_conf *conf = wpa_s->ifmsh->mconf;
 854         u16 reason = 0;
 855
 856         wpa_msg(wpa_s, MSG_DEBUG, "MPM " MACSTR " state %s event %s",
 857                 MAC2STR(sta->addr), mplstate[sta->plink_state],
 858                 mplevent[event]);
 859
 860         switch (sta->plink_state) {
 861         case PLINK_LISTEN:
 862                 switch (event) {
 863                 case CLS_ACPT:
 864                         mesh_mpm_fsm_restart(wpa_s, sta);
 865                         break;
 866                 case OPN_ACPT:
 867                         mesh_mpm_plink_open(wpa_s, sta, PLINK_OPEN_RCVD);
 868                         mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CONFIRM,
 869                                                    0);
 870                         break;
 871                 default:
 872                         break;
 873                 }
 874                 break;
 875         case PLINK_OPEN_SENT:
 876                 switch (event) {
 877                 case OPN_RJCT:
 878                 case CNF_RJCT:
 879                         reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
 880                         /* fall-through */
 881                 case CLS_ACPT:
 882                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 883                         if (!reason)
 884                                 reason = WLAN_REASON_MESH_CLOSE_RCVD;
 885                         eloop_register_timeout(
 886                                 conf->dot11MeshHoldingTimeout / 1000,
 887                                 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
 888                                 plink_timer, wpa_s, sta);
 889                         mesh_mpm_send_plink_action(wpa_s, sta,
 890                                                    PLINK_CLOSE, reason);
 891                         break;
 892                 case OPN_ACPT:
 893                         /* retry timer is left untouched */
 894                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_OPEN_RCVD);
 895                         mesh_mpm_send_plink_action(wpa_s, sta,
 896                                                    PLINK_CONFIRM, 0);
 897                         break;
 898                 case CNF_ACPT:
 899                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_CNF_RCVD);
 900                         eloop_cancel_timeout(plink_timer, wpa_s, sta);
 901                         eloop_register_timeout(
 902                                 conf->dot11MeshConfirmTimeout / 1000,
 903                                 (conf->dot11MeshConfirmTimeout % 1000) * 1000,
 904                                 plink_timer, wpa_s, sta);
 905                         break;
 906                 default:
 907                         break;
 908                 }
 909                 break;
 910         case PLINK_OPEN_RCVD:
 911                 switch (event) {
 912                 case OPN_RJCT:
 913                 case CNF_RJCT:
 914                         reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
 915                         /* fall-through */
 916                 case CLS_ACPT:
 917                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 918                         if (!reason)
 919                                 reason = WLAN_REASON_MESH_CLOSE_RCVD;
 920                         eloop_register_timeout(
 921                                 conf->dot11MeshHoldingTimeout / 1000,
 922                                 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
 923                                 plink_timer, wpa_s, sta);
 924                         sta->mpm_close_reason = reason;
 925                         mesh_mpm_send_plink_action(wpa_s, sta,
 926                                                    PLINK_CLOSE, reason);
 927                         break;
 928                 case OPN_ACPT:
 929                         mesh_mpm_send_plink_action(wpa_s, sta,
 930                                                    PLINK_CONFIRM, 0);
 931                         break;
 932                 case CNF_ACPT:
 933                         if (conf->security & MESH_CONF_SEC_AMPE)
 934                                 mesh_rsn_derive_mtk(wpa_s, sta);
 935                         mesh_mpm_plink_estab(wpa_s, sta);
 936                         break;
 937                 default:
 938                         break;
 939                 }
 940                 break;
 941         case PLINK_CNF_RCVD:
 942                 switch (event) {
 943                 case OPN_RJCT:
 944                 case CNF_RJCT:
 945                         reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
 946                         /* fall-through */
 947                 case CLS_ACPT:
 948                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 949                         if (!reason)
 950                                 reason = WLAN_REASON_MESH_CLOSE_RCVD;
 951                         eloop_register_timeout(
 952                                 conf->dot11MeshHoldingTimeout / 1000,
 953                                 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
 954                                 plink_timer, wpa_s, sta);
 955                         sta->mpm_close_reason = reason;
 956                         mesh_mpm_send_plink_action(wpa_s, sta,
 957                                                    PLINK_CLOSE, reason);
 958                         break;
 959                 case OPN_ACPT:
 960                         if (conf->security & MESH_CONF_SEC_AMPE)
 961                                 mesh_rsn_derive_mtk(wpa_s, sta);
 962                         mesh_mpm_plink_estab(wpa_s, sta);
 963                         mesh_mpm_send_plink_action(wpa_s, sta,
 964                                                    PLINK_CONFIRM, 0);
 965                         break;
 966                 default:
 967                         break;
 968                 }
 969                 break;
 970         case PLINK_ESTAB:
 971                 switch (event) {
 972                 case CLS_ACPT:
 973                         wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
 974                         reason = WLAN_REASON_MESH_CLOSE_RCVD;
 975
 976                         eloop_register_timeout(
 977                                 conf->dot11MeshHoldingTimeout / 1000,
 978                                 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
 979                                 plink_timer, wpa_s, sta);
 980                         sta->mpm_close_reason = reason;
 981
 982                         wpa_msg(wpa_s, MSG_INFO, "mesh plink with " MACSTR
 983                                 " closed with reason %d",
 984                                 MAC2STR(sta->addr), reason);
 985
 986                         wpa_msg(wpa_s, MSG_INFO, MESH_PEER_DISCONNECTED MACSTR,
 987                                 MAC2STR(sta->addr));
 988
 989                         hapd->num_plinks--;
 990
 991                         mesh_mpm_send_plink_action(wpa_s, sta,
 992                                                    PLINK_CLOSE, reason);
 993                         break;
 994                 case OPN_ACPT:
 995                         mesh_mpm_send_plink_action(wpa_s, sta,
 996                                                    PLINK_CONFIRM, 0);
 997                         break;
 998                 default:
 999                         break;
1000                 }
1001                 break;
1002         case PLINK_HOLDING:
1003                 switch (event) {
1004                 case CLS_ACPT:
1005                         mesh_mpm_fsm_restart(wpa_s, sta);
1006                         break;
1007                 case OPN_ACPT:
1008                 case CNF_ACPT:
1009                 case OPN_RJCT:
1010                 case CNF_RJCT:
1011                         reason = sta->mpm_close_reason;
1012                         mesh_mpm_send_plink_action(wpa_s, sta,
1013                                                    PLINK_CLOSE, reason);
1014                         break;
1015                 default:
1016                         break;
1017                 }
1018                 break;
1019         default:
1020                 wpa_msg(wpa_s, MSG_DEBUG,
1021                         "Unsupported MPM event %s for state %s",
1022                         mplevent[event], mplstate[sta->plink_state]);
1023                 break;
1024         }
1025 }
1026
1027
1028 void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
1029                         const struct ieee80211_mgmt *mgmt, size_t len)
1030 {
1031         u8 action_field;
1032         struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
1033         struct mesh_conf *mconf = wpa_s->ifmsh->mconf;
1034         struct sta_info *sta;
1035         u16 plid = 0, llid = 0;
1036         enum plink_event event;
1037         struct ieee802_11_elems elems;
1038         struct mesh_peer_mgmt_ie peer_mgmt_ie;
1039         const u8 *ies;
1040         size_t ie_len;
1041         int ret;
1042
1043         if (mgmt->u.action.category != WLAN_ACTION_SELF_PROTECTED)
1044                 return;
1045
1046         action_field = mgmt->u.action.u.slf_prot_action.action;
1047         if (action_field != PLINK_OPEN &&
1048             action_field != PLINK_CONFIRM &&
1049             action_field != PLINK_CLOSE)
1050                 return;
1051
1052         ies = mgmt->u.action.u.slf_prot_action.variable;
1053         ie_len = (const u8 *) mgmt + len -
1054                 mgmt->u.action.u.slf_prot_action.variable;
1055
1056         /* at least expect mesh id and peering mgmt */
1057         if (ie_len < 2 + 2) {
1058                 wpa_printf(MSG_DEBUG,
1059                            "MPM: Ignore too short action frame %u ie_len %u",
1060                            action_field, (unsigned int) ie_len);
1061                 return;
1062         }
1063         wpa_printf(MSG_DEBUG, "MPM: Received PLINK action %u", action_field);
1064
1065         if (action_field == PLINK_OPEN || action_field == PLINK_CONFIRM) {
1066                 wpa_printf(MSG_DEBUG, "MPM: Capability 0x%x",
1067                            WPA_GET_LE16(ies));
1068                 ies += 2;       /* capability */
1069                 ie_len -= 2;
1070         }
1071         if (action_field == PLINK_CONFIRM) {
1072                 wpa_printf(MSG_DEBUG, "MPM: AID 0x%x", WPA_GET_LE16(ies));
1073                 ies += 2;       /* aid */
1074                 ie_len -= 2;
1075         }
1076
1077         /* check for mesh peering, mesh id and mesh config IEs */
1078         if (ieee802_11_parse_elems(ies, ie_len, &elems, 0) == ParseFailed) {
1079                 wpa_printf(MSG_DEBUG, "MPM: Failed to parse PLINK IEs");
1080                 return;
1081         }
1082         if (!elems.peer_mgmt) {
1083                 wpa_printf(MSG_DEBUG,
1084                            "MPM: No Mesh Peering Management element");
1085                 return;
1086         }
1087         if (action_field != PLINK_CLOSE) {
1088                 if (!elems.mesh_id || !elems.mesh_config) {
1089                         wpa_printf(MSG_DEBUG,
1090                                    "MPM: No Mesh ID or Mesh Configuration element");
1091                         return;
1092                 }
1093
1094                 if (!matches_local(wpa_s, &elems)) {
1095                         wpa_printf(MSG_DEBUG,
1096                                    "MPM: Mesh ID or Mesh Configuration element do not match local MBSS");
1097                         return;
1098                 }
1099         }
1100
1101         ret = mesh_mpm_parse_peer_mgmt(wpa_s, action_field,
1102                                        elems.peer_mgmt,
1103                                        elems.peer_mgmt_len,
1104                                        &peer_mgmt_ie);
1105         if (ret) {
1106                 wpa_printf(MSG_DEBUG, "MPM: Mesh parsing rejected frame");
1107                 return;
1108         }
1109
1110         /* the sender's llid is our plid and vice-versa */
1111         plid = WPA_GET_LE16(peer_mgmt_ie.llid);
1112         if (peer_mgmt_ie.plid)
1113                 llid = WPA_GET_LE16(peer_mgmt_ie.plid);
1114         wpa_printf(MSG_DEBUG, "MPM: plid=0x%x llid=0x%x", plid, llid);
1115
1116         sta = ap_get_sta(hapd, mgmt->sa);
1117
1118         /*
1119          * If this is an open frame from an unknown STA, and this is an
1120          * open mesh, then go ahead and add the peer before proceeding.
1121          */
1122         if (!sta && action_field == PLINK_OPEN &&
1123             (!(mconf->security & MESH_CONF_SEC_AMPE) ||
1124              wpa_auth_pmksa_get(hapd->wpa_auth, mgmt->sa)))
1125                 sta = mesh_mpm_add_peer(wpa_s, mgmt->sa, &elems);
1126
1127         if (!sta) {
1128                 wpa_printf(MSG_DEBUG, "MPM: No STA entry for peer");
1129                 return;
1130         }
1131
1132 #ifdef CONFIG_SAE
1133         /* peer is in sae_accepted? */
1134         if (sta->sae && sta->sae->state != SAE_ACCEPTED) {
1135                 wpa_printf(MSG_DEBUG, "MPM: SAE not yet accepted for peer");
1136                 return;
1137         }
1138 #endif /* CONFIG_SAE */
1139
1140         if (!sta->my_lid)
1141                 mesh_mpm_init_link(wpa_s, sta);
1142
1143         if ((mconf->security & MESH_CONF_SEC_AMPE) &&
1144             mesh_rsn_process_ampe(wpa_s, sta, &elems,
1145                                   &mgmt->u.action.category,
1146                                   peer_mgmt_ie.chosen_pmk,
1147                                   ies, ie_len)) {
1148                 wpa_printf(MSG_DEBUG, "MPM: RSN process rejected frame");
1149                 return;
1150         }
1151
1152         if (sta->plink_state == PLINK_BLOCKED) {
1153                 wpa_printf(MSG_DEBUG, "MPM: PLINK_BLOCKED");
1154                 return;
1155         }
1156
1157         /* Now we will figure out the appropriate event... */
1158         switch (action_field) {
1159         case PLINK_OPEN:
1160                 if (plink_free_count(hapd) == 0) {
1161                         event = OPN_IGNR;
1162                         wpa_printf(MSG_INFO,
1163                                    "MPM: Peer link num over quota(%d)",
1164                                    hapd->max_plinks);
1165                 } else if (sta->peer_lid && sta->peer_lid != plid) {
1166                         event = OPN_IGNR;
1167                 } else {
1168                         sta->peer_lid = plid;
1169                         event = OPN_ACPT;
1170                 }
1171                 break;
1172         case PLINK_CONFIRM:
1173                 if (plink_free_count(hapd) == 0) {
1174                         event = CNF_IGNR;
1175                         wpa_printf(MSG_INFO,
1176                                    "MPM: Peer link num over quota(%d)",
1177                                    hapd->max_plinks);
1178                 } else if (sta->my_lid != llid ||
1179                            (sta->peer_lid && sta->peer_lid != plid)) {
1180                         event = CNF_IGNR;
1181                 } else {
1182                         if (!sta->peer_lid)
1183                                 sta->peer_lid = plid;
1184                         event = CNF_ACPT;
1185                 }
1186                 break;
1187         case PLINK_CLOSE:
1188                 if (sta->plink_state == PLINK_ESTAB)
1189                         /* Do not check for llid or plid. This does not
1190                          * follow the standard but since multiple plinks
1191                          * per cand are not supported, it is necessary in
1192                          * order to avoid a livelock when MP A sees an
1193                          * establish peer link to MP B but MP B does not
1194                          * see it. This can be caused by a timeout in
1195                          * B's peer link establishment or B being
1196                          * restarted.
1197                          */
1198                         event = CLS_ACPT;
1199                 else if (sta->peer_lid != plid)
1200                         event = CLS_IGNR;
1201                 else if (peer_mgmt_ie.plid && sta->my_lid != llid)
1202                         event = CLS_IGNR;
1203                 else
1204                         event = CLS_ACPT;
1205                 break;
1206         default:
1207                 /*
1208                  * This cannot be hit due to the action_field check above, but
1209                  * compilers may not be able to figure that out and can warn
1210                  * about uninitialized event below.
1211                  */
1212                 return;
1213         }
1214         mesh_mpm_fsm(wpa_s, sta, event);
1215 }
1216
1217
1218 /* called by ap_free_sta */
1219 void mesh_mpm_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
1220 {
1221         if (sta->plink_state == PLINK_ESTAB)
1222                 hapd->num_plinks--;
1223         eloop_cancel_timeout(plink_timer, ELOOP_ALL_CTX, sta);
1224         eloop_cancel_timeout(mesh_auth_timer, ELOOP_ALL_CTX, sta);
1225 }