wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "wpa.h"
  24 #include "drivers/driver.h"
  25 #include "ieee802_11_defs.h"
  26 #include "mlme.h"
  27
  28
  29 /* Timeouts and intervals in milliseconds */
  30 #define IEEE80211_AUTH_TIMEOUT (200)
  31 #define IEEE80211_AUTH_MAX_TRIES 3
  32 #define IEEE80211_ASSOC_TIMEOUT (200)
  33 #define IEEE80211_ASSOC_MAX_TRIES 3
  34 #define IEEE80211_MONITORING_INTERVAL (2000)
  35 #define IEEE80211_PROBE_INTERVAL (60000)
  36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  37 #define IEEE80211_SCAN_INTERVAL (2000)
  38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  40
  41 #define IEEE80211_PROBE_DELAY (33)
  42 #define IEEE80211_CHANNEL_TIME (33)
  43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  47
  48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  49
  50
  51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  52
  53
  54 struct ieee80211_sta_bss {
  55         struct ieee80211_sta_bss *next;
  56         struct ieee80211_sta_bss *hnext;
  57
  58         u8 bssid[ETH_ALEN];
  59         u8 ssid[MAX_SSID_LEN];
  60         size_t ssid_len;
  61         u16 capability; /* host byte order */
  62         int hw_mode;
  63         int channel;
  64         int freq;
  65         int rssi;
  66         u8 *ie;
  67         size_t ie_len;
  68         u8 *wpa_ie;
  69         size_t wpa_ie_len;
  70         u8 *rsn_ie;
  71         size_t rsn_ie_len;
  72         u8 *wmm_ie;
  73         size_t wmm_ie_len;
  74         u8 *mdie;
  75         size_t mdie_len;
  76 #define IEEE80211_MAX_SUPP_RATES 32
  77         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  78         size_t supp_rates_len;
  79         int beacon_int;
  80         u64 timestamp;
  81
  82         int probe_resp;
  83         struct os_time last_update;
  84 };
  85
  86
  87 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  88                                      const u8 *dst,
  89                                      const u8 *ssid, size_t ssid_len);
  90 static struct ieee80211_sta_bss *
  91 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  92 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  93 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  94 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  95 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  96
  97
  98 /* Parsed Information Elements */
  99 struct ieee802_11_elems {
 100         u8 *ssid;
 101         u8 ssid_len;
 102         u8 *supp_rates;
 103         u8 supp_rates_len;
 104         u8 *fh_params;
 105         u8 fh_params_len;
 106         u8 *ds_params;
 107         u8 ds_params_len;
 108         u8 *cf_params;
 109         u8 cf_params_len;
 110         u8 *tim;
 111         u8 tim_len;
 112         u8 *ibss_params;
 113         u8 ibss_params_len;
 114         u8 *challenge;
 115         u8 challenge_len;
 116         u8 *wpa;
 117         u8 wpa_len;
 118         u8 *rsn;
 119         u8 rsn_len;
 120         u8 *erp_info;
 121         u8 erp_info_len;
 122         u8 *ext_supp_rates;
 123         u8 ext_supp_rates_len;
 124         u8 *wmm_info;
 125         u8 wmm_info_len;
 126         u8 *wmm_param;
 127         u8 wmm_param_len;
 128         u8 *mdie;
 129         u8 mdie_len;
 130         u8 *ftie;
 131         u8 ftie_len;
 132 };
 133
 134 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
 135
 136
 137 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
 138                                        struct ieee802_11_elems *elems)
 139 {
 140         size_t left = len;
 141         u8 *pos = start;
 142         int unknown = 0;
 143
 144         os_memset(elems, 0, sizeof(*elems));
 145
 146         while (left >= 2) {
 147                 u8 id, elen;
 148
 149                 id = *pos++;
 150                 elen = *pos++;
 151                 left -= 2;
 152
 153                 if (elen > left) {
 154 #if 0
 155                         wpa_printf(MSG_MSGDUMP, "MLME: IEEE 802.11 element "
 156                                    "parse failed (id=%d elen=%d left=%d)",
 157                                    id, elen, left);
 158 #endif
 159                         return ParseFailed;
 160                 }
 161
 162                 switch (id) {
 163                 case WLAN_EID_SSID:
 164                         elems->ssid = pos;
 165                         elems->ssid_len = elen;
 166                         break;
 167                 case WLAN_EID_SUPP_RATES:
 168                         elems->supp_rates = pos;
 169                         elems->supp_rates_len = elen;
 170                         break;
 171                 case WLAN_EID_FH_PARAMS:
 172                         elems->fh_params = pos;
 173                         elems->fh_params_len = elen;
 174                         break;
 175                 case WLAN_EID_DS_PARAMS:
 176                         elems->ds_params = pos;
 177                         elems->ds_params_len = elen;
 178                         break;
 179                 case WLAN_EID_CF_PARAMS:
 180                         elems->cf_params = pos;
 181                         elems->cf_params_len = elen;
 182                         break;
 183                 case WLAN_EID_TIM:
 184                         elems->tim = pos;
 185                         elems->tim_len = elen;
 186                         break;
 187                 case WLAN_EID_IBSS_PARAMS:
 188                         elems->ibss_params = pos;
 189                         elems->ibss_params_len = elen;
 190                         break;
 191                 case WLAN_EID_CHALLENGE:
 192                         elems->challenge = pos;
 193                         elems->challenge_len = elen;
 194                         break;
 195                 case WLAN_EID_VENDOR_SPECIFIC:
 196                         if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
 197                             pos[2] == 0xf2) {
 198                                 /* Microsoft OUI (00:50:F2) */
 199                                 if (pos[3] == 1) {
 200                                         /* OUI Type 1 - WPA IE */
 201                                         elems->wpa = pos;
 202                                         elems->wpa_len = elen;
 203                                 } else if (elen >= 5 && pos[3] == 2) {
 204                                         if (pos[4] == 0) {
 205                                                 elems->wmm_info = pos;
 206                                                 elems->wmm_info_len = elen;
 207                                         } else if (pos[4] == 1) {
 208                                                 elems->wmm_param = pos;
 209                                                 elems->wmm_param_len = elen;
 210                                         }
 211                                 }
 212                         }
 213                         break;
 214                 case WLAN_EID_RSN:
 215                         elems->rsn = pos;
 216                         elems->rsn_len = elen;
 217                         break;
 218                 case WLAN_EID_ERP_INFO:
 219                         elems->erp_info = pos;
 220                         elems->erp_info_len = elen;
 221                         break;
 222                 case WLAN_EID_EXT_SUPP_RATES:
 223                         elems->ext_supp_rates = pos;
 224                         elems->ext_supp_rates_len = elen;
 225                         break;
 226                 case WLAN_EID_MOBILITY_DOMAIN:
 227                         elems->mdie = pos;
 228                         elems->mdie_len = elen;
 229                         break;
 230                 case WLAN_EID_FAST_BSS_TRANSITION:
 231                         elems->ftie = pos;
 232                         elems->ftie_len = elen;
 233                         break;
 234                 default:
 235 #if 0
 236                         wpa_printf(MSG_MSGDUMP "MLME: IEEE 802.11 element "
 237                                    "parse ignored unknown element (id=%d "
 238                                    "elen=%d)", id, elen);
 239 #endif
 240                         unknown++;
 241                         break;
 242                 }
 243
 244                 left -= elen;
 245                 pos += elen;
 246         }
 247
 248         if (left)
 249                 return ParseFailed;
 250
 251         return unknown ? ParseUnknown : ParseOK;
 252 }
 253
 254
 255 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 256                                      wpa_hw_mode phymode, int chan,
 257                                      int freq)
 258 {
 259         size_t i;
 260         struct wpa_hw_modes *mode;
 261
 262         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 263                 mode = &wpa_s->mlme.modes[i];
 264                 if (mode->mode == phymode) {
 265                         wpa_s->mlme.curr_rates = mode->rates;
 266                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 267                         break;
 268                 }
 269         }
 270
 271         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 272 }
 273
 274
 275
 276 #if 0 /* FIX */
 277 static int ecw2cw(int ecw)
 278 {
 279         int cw = 1;
 280         while (ecw > 0) {
 281                 cw <<= 1;
 282                 ecw--;
 283         }
 284         return cw - 1;
 285 }
 286 #endif
 287
 288
 289 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 290                                      u8 *wmm_param, size_t wmm_param_len)
 291 {
 292         size_t left;
 293         int count;
 294         u8 *pos;
 295
 296         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 297                 return;
 298         count = wmm_param[6] & 0x0f;
 299         if (count == wpa_s->mlme.wmm_last_param_set)
 300                 return;
 301         wpa_s->mlme.wmm_last_param_set = count;
 302
 303         pos = wmm_param + 8;
 304         left = wmm_param_len - 8;
 305
 306 #if 0 /* FIX */
 307         wmm_acm = 0;
 308         for (; left >= 4; left -= 4, pos += 4) {
 309                 int aci = (pos[0] >> 5) & 0x03;
 310                 int acm = (pos[0] >> 4) & 0x01;
 311                 int queue;
 312
 313                 switch (aci) {
 314                 case 1:
 315                         queue = IEEE80211_TX_QUEUE_DATA3;
 316                         if (acm)
 317                                 wmm_acm |= BIT(1) | BIT(2);
 318                         break;
 319                 case 2:
 320                         queue = IEEE80211_TX_QUEUE_DATA1;
 321                         if (acm)
 322                                 wmm_acm |= BIT(4) | BIT(5);
 323                         break;
 324                 case 3:
 325                         queue = IEEE80211_TX_QUEUE_DATA0;
 326                         if (acm)
 327                                 wmm_acm |= BIT(6) | BIT(7);
 328                         break;
 329                 case 0:
 330                 default:
 331                         queue = IEEE80211_TX_QUEUE_DATA2;
 332                         if (acm)
 333                                 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
 334                         break;
 335                 }
 336
 337                 params.aifs = pos[0] & 0x0f;
 338                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 339                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 340                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 341                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 342                 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
 343                            "aifs=%d cWmin=%d cWmax=%d burst=%d",
 344                            queue, aci, acm, params.aifs, params.cw_min,
 345                            params.cw_max, params.burst_time);
 346                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 347                  * AC for now) */
 348                 if (local->hw->conf_tx(local->mdev, queue, &params)) {
 349                         wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
 350                                    "parameters for queue %d", queue);
 351                 }
 352         }
 353 #endif
 354 }
 355
 356
 357 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 358 {
 359         if (wpa_s->mlme.associated == assoc && !assoc)
 360                 return;
 361
 362         wpa_s->mlme.associated = assoc;
 363
 364         if (assoc) {
 365                 union wpa_event_data data;
 366                 os_memset(&data, 0, sizeof(data));
 367                 wpa_s->mlme.prev_bssid_set = 1;
 368                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 369                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 370                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 371                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 372                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 373                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 374         } else {
 375                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 376         }
 377         os_get_time(&wpa_s->mlme.last_probe);
 378 }
 379
 380
 381 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 382                             size_t len)
 383 {
 384         return wpa_drv_send_mlme(wpa_s, buf, len);
 385 }
 386
 387
 388 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 389                                 int transaction, u8 *extra, size_t extra_len,
 390                                 int encrypt)
 391 {
 392         u8 *buf;
 393         size_t len;
 394         struct ieee80211_mgmt *mgmt;
 395
 396         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 397         if (buf == NULL) {
 398                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 399                            "auth frame");
 400                 return;
 401         }
 402
 403         mgmt = (struct ieee80211_mgmt *) buf;
 404         len = 24 + 6;
 405         os_memset(mgmt, 0, 24 + 6);
 406         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 407                                            WLAN_FC_STYPE_AUTH);
 408         if (encrypt)
 409                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 410         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 411         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 412         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 413         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 414         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 415         wpa_s->mlme.auth_transaction = transaction + 1;
 416         mgmt->u.auth.status_code = host_to_le16(0);
 417         if (extra) {
 418                 os_memcpy(buf + len, extra, extra_len);
 419                 len += extra_len;
 420         }
 421
 422         ieee80211_sta_tx(wpa_s, buf, len);
 423         os_free(buf);
 424 }
 425
 426
 427 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 428 {
 429         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 430         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 431                                ieee80211_sta_timer, wpa_s, NULL);
 432 }
 433
 434
 435 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 436 {
 437         u8 *extra;
 438         size_t extra_len;
 439
 440         wpa_s->mlme.auth_tries++;
 441         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 442                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 443                            " timed out", MAC2STR(wpa_s->bssid));
 444                 return;
 445         }
 446
 447         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 448         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 449                    MAC2STR(wpa_s->bssid));
 450
 451         extra = NULL;
 452         extra_len = 0;
 453
 454 #ifdef CONFIG_IEEE80211R
 455         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 456              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 457             wpa_s->mlme.ft_ies) {
 458                 struct ieee80211_sta_bss *bss;
 459                 struct rsn_mdie *mdie = NULL;
 460                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 461                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 462                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 463                 if (mdie &&
 464                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 465                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 466                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 467                                    "over-the-air");
 468                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 469                         extra = wpa_s->mlme.ft_ies;
 470                         extra_len = wpa_s->mlme.ft_ies_len;
 471                 }
 472         }
 473 #endif /* CONFIG_IEEE80211R */
 474
 475         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 476
 477         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 478 }
 479
 480
 481 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 482 {
 483         struct ieee80211_mgmt *mgmt;
 484         u8 *pos, *ies, *buf;
 485         int i, len;
 486         u16 capab;
 487         struct ieee80211_sta_bss *bss;
 488         int wmm = 0;
 489         size_t blen, buflen;
 490
 491         if (wpa_s->mlme.curr_rates == NULL) {
 492                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 493                 return;
 494         }
 495
 496         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 497                 wpa_s->mlme.ssid_len;
 498 #ifdef CONFIG_IEEE80211R
 499         if (wpa_s->mlme.ft_ies)
 500                 buflen += wpa_s->mlme.ft_ies_len;
 501 #endif /* CONFIG_IEEE80211R */
 502         buf = os_malloc(buflen);
 503         if (buf == NULL) {
 504                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 505                            "assoc frame");
 506                 return;
 507         }
 508         blen = 0;
 509
 510         capab = wpa_s->mlme.capab;
 511         if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
 512                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 513                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 514         }
 515         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 516         if (bss) {
 517                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 518                         capab |= WLAN_CAPABILITY_PRIVACY;
 519                 if (bss->wmm_ie) {
 520                         wmm = 1;
 521                 }
 522         }
 523
 524         mgmt = (struct ieee80211_mgmt *) buf;
 525         blen += 24;
 526         os_memset(mgmt, 0, 24);
 527         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 528         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 529         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 530
 531         if (wpa_s->mlme.prev_bssid_set) {
 532                 blen += 10;
 533                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 534                                                    WLAN_FC_STYPE_REASSOC_REQ);
 535                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 536                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 537                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 538                           wpa_s->mlme.prev_bssid,
 539                           ETH_ALEN);
 540         } else {
 541                 blen += 4;
 542                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 543                                                    WLAN_FC_STYPE_ASSOC_REQ);
 544                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 545                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 546         }
 547
 548         /* SSID */
 549         ies = pos = buf + blen;
 550         blen += 2 + wpa_s->mlme.ssid_len;
 551         *pos++ = WLAN_EID_SSID;
 552         *pos++ = wpa_s->mlme.ssid_len;
 553         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 554
 555         len = wpa_s->mlme.num_curr_rates;
 556         if (len > 8)
 557                 len = 8;
 558         pos = buf + blen;
 559         blen += len + 2;
 560         *pos++ = WLAN_EID_SUPP_RATES;
 561         *pos++ = len;
 562         for (i = 0; i < len; i++) {
 563                 int rate = wpa_s->mlme.curr_rates[i].rate;
 564                 *pos++ = (u8) (rate / 5);
 565         }
 566
 567         if (wpa_s->mlme.num_curr_rates > len) {
 568                 pos = buf + blen;
 569                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 570                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 571                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 572                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 573                         int rate = wpa_s->mlme.curr_rates[i].rate;
 574                         *pos++ = (u8) (rate / 5);
 575                 }
 576         }
 577
 578         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 579                 pos = buf + blen;
 580                 blen += wpa_s->mlme.extra_ie_len;
 581                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 582         }
 583
 584 #ifdef CONFIG_IEEE80211R
 585         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 586              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 587             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 588             bss && bss->mdie &&
 589             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 590             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 591                 pos = buf + blen;
 592                 blen += 2 + sizeof(struct rsn_mdie);
 593                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 594                 *pos++ = sizeof(struct rsn_mdie);
 595                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 596                 pos += MOBILITY_DOMAIN_ID_LEN;
 597                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 598         }
 599
 600         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 601              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 602             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 603                 pos = buf + blen;
 604                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 605                 pos += wpa_s->mlme.ft_ies_len;
 606                 blen += wpa_s->mlme.ft_ies_len;
 607         }
 608 #endif /* CONFIG_IEEE80211R */
 609
 610         if (wmm && wpa_s->mlme.wmm_enabled) {
 611                 pos = buf + blen;
 612                 blen += 9;
 613                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 614                 *pos++ = 7; /* len */
 615                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 616                 *pos++ = 0x50;
 617                 *pos++ = 0xf2;
 618                 *pos++ = 2; /* WME */
 619                 *pos++ = 0; /* WME info */
 620                 *pos++ = 1; /* WME ver */
 621                 *pos++ = 0;
 622         }
 623
 624         os_free(wpa_s->mlme.assocreq_ies);
 625         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 626         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 627         if (wpa_s->mlme.assocreq_ies) {
 628                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 629                           wpa_s->mlme.assocreq_ies_len);
 630         }
 631
 632         ieee80211_sta_tx(wpa_s, buf, blen);
 633         os_free(buf);
 634 }
 635
 636
 637 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 638 {
 639         u8 *buf;
 640         size_t len;
 641         struct ieee80211_mgmt *mgmt;
 642
 643         buf = os_zalloc(sizeof(*mgmt));
 644         if (buf == NULL) {
 645                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 646                            "deauth frame");
 647                 return;
 648         }
 649
 650         mgmt = (struct ieee80211_mgmt *) buf;
 651         len = 24;
 652         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 653         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 654         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 655         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 656                                            WLAN_FC_STYPE_DEAUTH);
 657         len += 2;
 658         mgmt->u.deauth.reason_code = host_to_le16(reason);
 659
 660         ieee80211_sta_tx(wpa_s, buf, len);
 661         os_free(buf);
 662 }
 663
 664
 665 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 666 {
 667         u8 *buf;
 668         size_t len;
 669         struct ieee80211_mgmt *mgmt;
 670
 671         buf = os_zalloc(sizeof(*mgmt));
 672         if (buf == NULL) {
 673                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 674                            "disassoc frame");
 675                 return;
 676         }
 677
 678         mgmt = (struct ieee80211_mgmt *) buf;
 679         len = 24;
 680         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 681         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 682         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 683         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 684                                            WLAN_FC_STYPE_DISASSOC);
 685         len += 2;
 686         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 687
 688         ieee80211_sta_tx(wpa_s, buf, len);
 689         os_free(buf);
 690 }
 691
 692
 693 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 694 {
 695         struct ieee80211_sta_bss *bss;
 696         int res = 0;
 697
 698         if (wpa_s->mlme.mixed_cell ||
 699             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 700                 return 0;
 701
 702         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 703         if (bss == NULL)
 704                 return 0;
 705
 706         if (ieee80211_sta_wep_configured(wpa_s) !=
 707             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 708                 res = 1;
 709
 710         return res;
 711 }
 712
 713
 714 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 715 {
 716         wpa_s->mlme.assoc_tries++;
 717         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 718                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 719                            " timed out", MAC2STR(wpa_s->bssid));
 720                 return;
 721         }
 722
 723         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 724         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 725                    MAC2STR(wpa_s->bssid));
 726         if (ieee80211_privacy_mismatch(wpa_s)) {
 727                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 728                            "configuration and mixed-cell disabled - abort "
 729                            "association");
 730                 return;
 731         }
 732
 733         ieee80211_send_assoc(wpa_s);
 734
 735         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 736 }
 737
 738
 739 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 740 {
 741         int disassoc;
 742
 743         /* TODO: start monitoring current AP signal quality and number of
 744          * missed beacons. Scan other channels every now and then and search
 745          * for better APs. */
 746         /* TODO: remove expired BSSes */
 747
 748         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 749
 750 #if 0 /* FIX */
 751         sta = sta_info_get(local, wpa_s->bssid);
 752         if (sta == NULL) {
 753                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 754                            MAC2STR(wpa_s->bssid));
 755                 disassoc = 1;
 756         } else {
 757                 disassoc = 0;
 758                 if (time_after(jiffies,
 759                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 760                         if (wpa_s->mlme.probereq_poll) {
 761                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 762                                            "current AP " MACSTR " - assume "
 763                                            "out of range",
 764                                            MAC2STR(wpa_s->bssid));
 765                                 disassoc = 1;
 766                         } else {
 767                                 ieee80211_send_probe_req(
 768                                         wpa_s->bssid,
 769                                         wpa_s->mlme.scan_ssid,
 770                                         wpa_s->mlme.scan_ssid_len);
 771                                 wpa_s->mlme.probereq_poll = 1;
 772                         }
 773                 } else {
 774                         wpa_s->mlme.probereq_poll = 0;
 775                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 776                                        IEEE80211_PROBE_INTERVAL)) {
 777                                 wpa_s->mlme.last_probe = jiffies;
 778                                 ieee80211_send_probe_req(wpa_s->bssid,
 779                                                          wpa_s->mlme.ssid,
 780                                                          wpa_s->mlme.ssid_len);
 781                         }
 782                 }
 783                 sta_info_release(local, sta);
 784         }
 785 #else
 786         disassoc = 0;
 787 #endif
 788         if (disassoc) {
 789                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 790                 ieee80211_reschedule_timer(wpa_s,
 791                                            IEEE80211_MONITORING_INTERVAL +
 792                                            30000);
 793         } else {
 794                 ieee80211_reschedule_timer(wpa_s,
 795                                            IEEE80211_MONITORING_INTERVAL);
 796         }
 797 }
 798
 799
 800 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 801                                      const u8 *dst,
 802                                      const u8 *ssid, size_t ssid_len)
 803 {
 804         u8 *buf;
 805         size_t len;
 806         struct ieee80211_mgmt *mgmt;
 807         u8 *pos, *supp_rates;
 808         u8 *esupp_rates = NULL;
 809         int i;
 810
 811         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 812         if (buf == NULL) {
 813                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 814                            "probe request");
 815                 return;
 816         }
 817
 818         mgmt = (struct ieee80211_mgmt *) buf;
 819         len = 24;
 820         os_memset(mgmt, 0, 24);
 821         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 822                                            WLAN_FC_STYPE_PROBE_REQ);
 823         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 824         if (dst) {
 825                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 826                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 827         } else {
 828                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 829                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 830         }
 831         pos = buf + len;
 832         len += 2 + ssid_len;
 833         *pos++ = WLAN_EID_SSID;
 834         *pos++ = ssid_len;
 835         os_memcpy(pos, ssid, ssid_len);
 836
 837         supp_rates = buf + len;
 838         len += 2;
 839         supp_rates[0] = WLAN_EID_SUPP_RATES;
 840         supp_rates[1] = 0;
 841         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 842                 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 843                 if (esupp_rates) {
 844                         pos = buf + len;
 845                         len++;
 846                         esupp_rates[1]++;
 847                 } else if (supp_rates[1] == 8) {
 848                         esupp_rates = pos;
 849                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 850                         esupp_rates[1] = 1;
 851                         pos = &esupp_rates[2];
 852                         len += 3;
 853                 } else {
 854                         pos = buf + len;
 855                         len++;
 856                         supp_rates[1]++;
 857                 }
 858                 *pos++ = rate->rate / 5;
 859         }
 860
 861         if (wpa_s->mlme.extra_probe_ie) {
 862                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 863                           wpa_s->mlme.extra_probe_ie_len);
 864                 len += wpa_s->mlme.extra_probe_ie_len;
 865         }
 866
 867         ieee80211_sta_tx(wpa_s, buf, len);
 868         os_free(buf);
 869 }
 870
 871
 872 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 873 {
 874 #if 0 /* FIX */
 875         if (sdata == NULL || sdata->default_key == NULL ||
 876             sdata->default_key->alg != ALG_WEP)
 877                 return 0;
 878         return 1;
 879 #else
 880         return 0;
 881 #endif
 882 }
 883
 884
 885 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 886 {
 887         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 888         wpa_s->mlme.authenticated = 1;
 889         ieee80211_associate(wpa_s);
 890 }
 891
 892
 893 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 894                                      struct ieee80211_mgmt *mgmt,
 895                                      size_t len,
 896                                      struct ieee80211_rx_status *rx_status)
 897 {
 898         u8 *pos;
 899         struct ieee802_11_elems elems;
 900
 901         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 902         pos = mgmt->u.auth.variable;
 903         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
 904             == ParseFailed) {
 905                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 906                 return;
 907         }
 908         if (elems.challenge == NULL) {
 909                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 910                            "auth frame");
 911                 return;
 912         }
 913         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 914                             elems.challenge_len + 2, 1);
 915 }
 916
 917
 918 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 919                                    struct ieee80211_mgmt *mgmt,
 920                                    size_t len,
 921                                    struct ieee80211_rx_status *rx_status)
 922 {
 923         struct wpa_ssid *ssid = wpa_s->current_ssid;
 924         u16 auth_alg, auth_transaction, status_code;
 925         int adhoc;
 926
 927         adhoc = ssid && ssid->mode == 1;
 928
 929         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 930                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 931                            "from " MACSTR ", but not in authenticate state - "
 932                            "ignored", MAC2STR(mgmt->sa));
 933                 return;
 934         }
 935
 936         if (len < 24 + 6) {
 937                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 938                            "frame received from " MACSTR " - ignored",
 939                            (unsigned long) len, MAC2STR(mgmt->sa));
 940                 return;
 941         }
 942
 943         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 944                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 945                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 946                            ") - ignored",
 947                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 948                 return;
 949         }
 950
 951         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 952                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 953                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 954                            ") - ignored",
 955                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 956                 return;
 957         }
 958
 959         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 960         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 961         status_code = le_to_host16(mgmt->u.auth.status_code);
 962
 963         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 964                    " (alg=%d transaction=%d status=%d)",
 965                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 966
 967         if (adhoc) {
 968                 /* IEEE 802.11 standard does not require authentication in IBSS
 969                  * networks and most implementations do not seem to use it.
 970                  * However, try to reply to authentication attempts if someone
 971                  * has actually implemented this.
 972                  * TODO: Could implement shared key authentication. */
 973                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 974                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 975                                    "authentication frame (alg=%d "
 976                                    "transaction=%d)",
 977                                    auth_alg, auth_transaction);
 978                         return;
 979                 }
 980                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 981         }
 982
 983         if (auth_alg != wpa_s->mlme.auth_alg ||
 984             auth_transaction != wpa_s->mlme.auth_transaction) {
 985                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 986                            "(alg=%d transaction=%d)",
 987                            auth_alg, auth_transaction);
 988                 return;
 989         }
 990
 991         if (status_code != WLAN_STATUS_SUCCESS) {
 992                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 993                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 994                            status_code);
 995                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 996                         const int num_algs = 3;
 997                         u8 algs[num_algs];
 998                         int i, pos;
 999                         algs[0] = algs[1] = algs[2] = 0xff;
1000                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1001                                 algs[0] = WLAN_AUTH_OPEN;
1002                         if (wpa_s->mlme.auth_algs &
1003                             IEEE80211_AUTH_ALG_SHARED_KEY)
1004                                 algs[1] = WLAN_AUTH_SHARED_KEY;
1005                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
1006                                 algs[2] = WLAN_AUTH_LEAP;
1007                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
1008                                 pos = 0;
1009                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
1010                                 pos = 1;
1011                         else
1012                                 pos = 2;
1013                         for (i = 0; i < num_algs; i++) {
1014                                 pos++;
1015                                 if (pos >= num_algs)
1016                                         pos = 0;
1017                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
1018                                     algs[pos] == 0xff)
1019                                         continue;
1020                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1021                                     !ieee80211_sta_wep_configured(wpa_s))
1022                                         continue;
1023                                 wpa_s->mlme.auth_alg = algs[pos];
1024                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
1025                                            "for next try",
1026                                            wpa_s->mlme.auth_alg);
1027                                 break;
1028                         }
1029                 }
1030                 return;
1031         }
1032
1033         switch (wpa_s->mlme.auth_alg) {
1034         case WLAN_AUTH_OPEN:
1035         case WLAN_AUTH_LEAP:
1036                 ieee80211_auth_completed(wpa_s);
1037                 break;
1038         case WLAN_AUTH_SHARED_KEY:
1039                 if (wpa_s->mlme.auth_transaction == 4)
1040                         ieee80211_auth_completed(wpa_s);
1041                 else
1042                         ieee80211_auth_challenge(wpa_s, mgmt, len,
1043                                                  rx_status);
1044                 break;
1045 #ifdef CONFIG_IEEE80211R
1046         case WLAN_AUTH_FT:
1047         {
1048                 union wpa_event_data data;
1049                 os_memset(&data, 0, sizeof(data));
1050                 data.ft_ies.ies = mgmt->u.auth.variable;
1051                 data.ft_ies.ies_len = len -
1052                         (mgmt->u.auth.variable - (u8 *) mgmt);
1053                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
1054                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1055                 ieee80211_auth_completed(wpa_s);
1056                 break;
1057         }
1058 #endif /* CONFIG_IEEE80211R */
1059         }
1060 }
1061
1062
1063 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
1064                                      struct ieee80211_mgmt *mgmt,
1065                                      size_t len,
1066                                      struct ieee80211_rx_status *rx_status)
1067 {
1068         u16 reason_code;
1069
1070         if (len < 24 + 2) {
1071                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
1072                            "frame received from " MACSTR " - ignored",
1073                            (unsigned long) len, MAC2STR(mgmt->sa));
1074                 return;
1075         }
1076
1077         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1078                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
1079                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1080                            ") - ignored",
1081                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1082                 return;
1083         }
1084
1085         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1086
1087         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
1088                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1089
1090         if (wpa_s->mlme.authenticated)
1091                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
1092
1093         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
1094             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
1095             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1096                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
1097                 ieee80211_reschedule_timer(wpa_s,
1098                                            IEEE80211_RETRY_AUTH_INTERVAL);
1099         }
1100
1101         ieee80211_set_associated(wpa_s, 0);
1102         wpa_s->mlme.authenticated = 0;
1103 }
1104
1105
1106 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
1107                                        struct ieee80211_mgmt *mgmt,
1108                                        size_t len,
1109                                        struct ieee80211_rx_status *rx_status)
1110 {
1111         u16 reason_code;
1112
1113         if (len < 24 + 2) {
1114                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
1115                            "frame received from " MACSTR " - ignored",
1116                            (unsigned long) len, MAC2STR(mgmt->sa));
1117                 return;
1118         }
1119
1120         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1121                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
1122                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1123                            ") - ignored",
1124                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1125                 return;
1126         }
1127
1128         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
1129
1130         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
1131                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1132
1133         if (wpa_s->mlme.associated)
1134                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
1135
1136         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1137                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
1138                 ieee80211_reschedule_timer(wpa_s,
1139                                            IEEE80211_RETRY_AUTH_INTERVAL);
1140         }
1141
1142         ieee80211_set_associated(wpa_s, 0);
1143 }
1144
1145
1146 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1147                                    struct ieee802_11_elems *elems)
1148 {
1149 #ifdef CONFIG_IEEE80211R
1150         const u8 *mobility_domain = NULL;
1151         const u8 *r0kh_id = NULL;
1152         size_t r0kh_id_len = 0;
1153         const u8 *r1kh_id = NULL;
1154         struct rsn_ftie *hdr;
1155         const u8 *pos, *end;
1156
1157         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1158                 mobility_domain = elems->mdie;
1159         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1160                 end = elems->ftie + elems->ftie_len;
1161                 hdr = (struct rsn_ftie *) elems->ftie;
1162                 pos = (const u8 *) (hdr + 1);
1163                 while (pos + 1 < end) {
1164                         if (pos + 2 + pos[1] > end)
1165                                 break;
1166                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1167                             pos[1] == FT_R1KH_ID_LEN)
1168                                 r1kh_id = pos + 2;
1169                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1170                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1171                                 r0kh_id = pos + 2;
1172                                 r0kh_id_len = pos[1];
1173                         }
1174                         pos += 2 + pos[1];
1175                 }
1176         }
1177         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1178                                     r0kh_id_len, r1kh_id);
1179 #else /* CONFIG_IEEE80211R */
1180         return 0;
1181 #endif /* CONFIG_IEEE80211R */
1182 }
1183
1184
1185 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1186                                          struct ieee80211_mgmt *mgmt,
1187                                          size_t len,
1188                                          struct ieee80211_rx_status *rx_status,
1189                                          int reassoc)
1190 {
1191         u8 rates[32];
1192         size_t rates_len;
1193         u16 capab_info, status_code, aid;
1194         struct ieee802_11_elems elems;
1195         u8 *pos;
1196
1197         /* AssocResp and ReassocResp have identical structure, so process both
1198          * of them in this function. */
1199
1200         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1201                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1202                            MACSTR ", but not in associate state - ignored",
1203                            MAC2STR(mgmt->sa));
1204                 return;
1205         }
1206
1207         if (len < 24 + 6) {
1208                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1209                            "frame received from " MACSTR " - ignored",
1210                            (unsigned long) len, MAC2STR(mgmt->sa));
1211                 return;
1212         }
1213
1214         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1215                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1216                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1217                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1218                 return;
1219         }
1220
1221         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1222         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1223         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1224         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1225                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1226                            "not set", aid);
1227         aid &= ~(BIT(15) | BIT(14));
1228
1229         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1230                    " (capab=0x%x status=%d aid=%d)",
1231                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1232                    capab_info, status_code, aid);
1233
1234         if (status_code != WLAN_STATUS_SUCCESS) {
1235                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1236                            status_code);
1237                 return;
1238         }
1239
1240         pos = mgmt->u.assoc_resp.variable;
1241         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1242             == ParseFailed) {
1243                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1244                 return;
1245         }
1246
1247         if (elems.supp_rates == NULL) {
1248                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1249                            "AssocResp");
1250                 return;
1251         }
1252
1253         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1254                 if (!reassoc) {
1255                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1256                                    "association, not reassociation, response "
1257                                    "with FT");
1258                         return;
1259                 }
1260                 if (wpa_ft_validate_reassoc_resp(
1261                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1262                             mgmt->sa) < 0) {
1263                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1264                                    "Resp failed");
1265                         return;
1266                 }
1267         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1268                 return;
1269
1270         wpa_printf(MSG_DEBUG, "MLME: associated");
1271         wpa_s->mlme.aid = aid;
1272         wpa_s->mlme.ap_capab = capab_info;
1273
1274         os_free(wpa_s->mlme.assocresp_ies);
1275         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1276         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1277         if (wpa_s->mlme.assocresp_ies) {
1278                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1279                           wpa_s->mlme.assocresp_ies_len);
1280         }
1281
1282         ieee80211_set_associated(wpa_s, 1);
1283
1284         rates_len = elems.supp_rates_len;
1285         if (rates_len > sizeof(rates))
1286                 rates_len = sizeof(rates);
1287         os_memcpy(rates, elems.supp_rates, rates_len);
1288         if (elems.ext_supp_rates) {
1289                 size_t _len = elems.ext_supp_rates_len;
1290                 if (_len > sizeof(rates) - rates_len)
1291                         _len = sizeof(rates) - rates_len;
1292                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1293                 rates_len += _len;
1294         }
1295
1296         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1297                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1298                            "netstack");
1299         }
1300         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1301             0) {
1302                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1303                            "netstack");
1304         }
1305
1306         /* Remove STA entry before adding a new one just in case to avoid
1307          * problems with existing configuration (e.g., keys). */
1308         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1309         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1310                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1311                            "netstack");
1312         }
1313
1314 #if 0 /* FIX? */
1315         sta->assoc_ap = 1;
1316
1317         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1318                 sta->flags |= WLAN_STA_WME;
1319                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1320                                          elems.wmm_param_len);
1321         }
1322 #endif
1323
1324         ieee80211_associated(wpa_s);
1325 }
1326
1327
1328 /* Caller must hold local->sta_bss_lock */
1329 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1330                                      struct ieee80211_sta_bss *bss)
1331 {
1332         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1333         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1334 }
1335
1336
1337 /* Caller must hold local->sta_bss_lock */
1338 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1339                                      struct ieee80211_sta_bss *bss)
1340 {
1341         struct ieee80211_sta_bss *b, *prev = NULL;
1342         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1343         while (b) {
1344                 if (b == bss) {
1345                         if (prev == NULL) {
1346                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1347                                         = bss->hnext;
1348                         } else {
1349                                 prev->hnext = bss->hnext;
1350                         }
1351                         break;
1352                 }
1353                 prev = b;
1354                 b = b->hnext;
1355         }
1356 }
1357
1358
1359 static struct ieee80211_sta_bss *
1360 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1361 {
1362         struct ieee80211_sta_bss *bss;
1363
1364         bss = os_zalloc(sizeof(*bss));
1365         if (bss == NULL)
1366                 return NULL;
1367         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1368
1369         /* TODO: order by RSSI? */
1370         bss->next = wpa_s->mlme.sta_bss_list;
1371         wpa_s->mlme.sta_bss_list = bss;
1372         __ieee80211_bss_hash_add(wpa_s, bss);
1373         return bss;
1374 }
1375
1376
1377 static struct ieee80211_sta_bss *
1378 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1379 {
1380         struct ieee80211_sta_bss *bss;
1381
1382         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1383         while (bss) {
1384                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1385                         break;
1386                 bss = bss->hnext;
1387         }
1388         return bss;
1389 }
1390
1391
1392 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1393                                struct ieee80211_sta_bss *bss)
1394 {
1395         __ieee80211_bss_hash_del(wpa_s, bss);
1396         os_free(bss->ie);
1397         os_free(bss->wpa_ie);
1398         os_free(bss->rsn_ie);
1399         os_free(bss->wmm_ie);
1400         os_free(bss->mdie);
1401         os_free(bss);
1402 }
1403
1404
1405 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1406 {
1407         struct ieee80211_sta_bss *bss, *prev;
1408
1409         bss = wpa_s->mlme.sta_bss_list;
1410         wpa_s->mlme.sta_bss_list = NULL;
1411         while (bss) {
1412                 prev = bss;
1413                 bss = bss->next;
1414                 ieee80211_bss_free(wpa_s, prev);
1415         }
1416 }
1417
1418
1419 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1420                                struct ieee80211_mgmt *mgmt,
1421                                size_t len,
1422                                struct ieee80211_rx_status *rx_status,
1423                                int beacon)
1424 {
1425         struct ieee802_11_elems elems;
1426         size_t baselen;
1427         int channel, invalid = 0, clen;
1428         struct ieee80211_sta_bss *bss;
1429         u64 timestamp;
1430         u8 *pos, *ie_pos;
1431         size_t ie_len;
1432
1433         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1434                 return; /* ignore ProbeResp to foreign address */
1435
1436 #if 0
1437         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1438                    beacon ? "Beacon" : "Probe Response",
1439                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1440 #endif
1441
1442         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1443         if (baselen > len)
1444                 return;
1445
1446         pos = mgmt->u.beacon.timestamp;
1447         timestamp = WPA_GET_LE64(pos);
1448
1449 #if 0 /* FIX */
1450         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1451             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1452 #ifdef IEEE80211_IBSS_DEBUG
1453                 static unsigned long last_tsf_debug = 0;
1454                 u64 tsf;
1455                 if (local->hw->get_tsf)
1456                         tsf = local->hw->get_tsf(local->mdev);
1457                 else
1458                         tsf = -1LLU;
1459                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1460                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1461                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1462                                    "@%ld",
1463                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1464                                    tsf, timestamp, tsf - timestamp, jiffies);
1465                         last_tsf_debug = jiffies;
1466                 }
1467 #endif /* IEEE80211_IBSS_DEBUG */
1468         }
1469 #endif
1470
1471         ie_pos = mgmt->u.beacon.variable;
1472         ie_len = len - baselen;
1473         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems) == ParseFailed)
1474                 invalid = 1;
1475
1476 #if 0 /* FIX */
1477         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1478             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1479             (sta = sta_info_get(local, mgmt->sa))) {
1480                 struct ieee80211_rate *rates;
1481                 size_t num_rates;
1482                 u32 supp_rates, prev_rates;
1483                 int i, j, oper_mode;
1484
1485                 rates = local->curr_rates;
1486                 num_rates = local->num_curr_rates;
1487                 oper_mode = wpa_s->mlme.sta_scanning ?
1488                         local->scan_oper_phymode : local->conf.phymode;
1489                 for (i = 0; i < local->hw->num_modes; i++) {
1490                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1491                         if (oper_mode == mode->mode) {
1492                                 rates = mode->rates;
1493                                 num_rates = mode->num_rates;
1494                                 break;
1495                         }
1496                 }
1497
1498                 supp_rates = 0;
1499                 for (i = 0; i < elems.supp_rates_len +
1500                              elems.ext_supp_rates_len; i++) {
1501                         u8 rate = 0;
1502                         int own_rate;
1503                         if (i < elems.supp_rates_len)
1504                                 rate = elems.supp_rates[i];
1505                         else if (elems.ext_supp_rates)
1506                                 rate = elems.ext_supp_rates
1507                                         [i - elems.supp_rates_len];
1508                         own_rate = 5 * (rate & 0x7f);
1509                         if (oper_mode == MODE_ATHEROS_TURBO)
1510                                 own_rate *= 2;
1511                         for (j = 0; j < num_rates; j++)
1512                                 if (rates[j].rate == own_rate)
1513                                         supp_rates |= BIT(j);
1514                 }
1515
1516                 prev_rates = sta->supp_rates;
1517                 sta->supp_rates &= supp_rates;
1518                 if (sta->supp_rates == 0) {
1519                         /* No matching rates - this should not really happen.
1520                          * Make sure that at least one rate is marked
1521                          * supported to avoid issues with TX rate ctrl. */
1522                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1523                 }
1524                 if (sta->supp_rates != prev_rates) {
1525                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1526                                    "for " MACSTR " based on beacon info "
1527                                    "(0x%x & 0x%x -> 0x%x)",
1528                                    MAC2STR(sta->addr), prev_rates,
1529                                    supp_rates, sta->supp_rates);
1530                 }
1531                 sta_info_release(local, sta);
1532         }
1533 #endif
1534
1535         if (elems.ssid == NULL)
1536                 return;
1537
1538         if (elems.ds_params && elems.ds_params_len == 1)
1539                 channel = elems.ds_params[0];
1540         else
1541                 channel = rx_status->channel;
1542
1543         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1544         if (bss == NULL) {
1545                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1546                 if (bss == NULL)
1547                         return;
1548         } else {
1549 #if 0
1550                 /* TODO: order by RSSI? */
1551                 spin_lock_bh(&local->sta_bss_lock);
1552                 list_move_tail(&bss->list, &local->sta_bss_list);
1553                 spin_unlock_bh(&local->sta_bss_lock);
1554 #endif
1555         }
1556
1557         if (bss->probe_resp && beacon) {
1558                 /* Do not allow beacon to override data from Probe Response. */
1559                 return;
1560         }
1561
1562         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1563         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1564
1565         if (bss->ie == NULL || bss->ie_len < ie_len) {
1566                 os_free(bss->ie);
1567                 bss->ie = os_malloc(ie_len);
1568         }
1569         if (bss->ie) {
1570                 os_memcpy(bss->ie, ie_pos, ie_len);
1571                 bss->ie_len = ie_len;
1572         }
1573
1574         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1575                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1576                 bss->ssid_len = elems.ssid_len;
1577         }
1578
1579         bss->supp_rates_len = 0;
1580         if (elems.supp_rates) {
1581                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1582                 if (clen > elems.supp_rates_len)
1583                         clen = elems.supp_rates_len;
1584                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1585                           elems.supp_rates, clen);
1586                 bss->supp_rates_len += clen;
1587         }
1588         if (elems.ext_supp_rates) {
1589                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1590                 if (clen > elems.ext_supp_rates_len)
1591                         clen = elems.ext_supp_rates_len;
1592                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1593                           elems.ext_supp_rates, clen);
1594                 bss->supp_rates_len += clen;
1595         }
1596
1597         if (elems.wpa &&
1598             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1599              os_memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1600                 os_free(bss->wpa_ie);
1601                 bss->wpa_ie = os_malloc(elems.wpa_len + 2);
1602                 if (bss->wpa_ie) {
1603                         os_memcpy(bss->wpa_ie, elems.wpa - 2,
1604                                   elems.wpa_len + 2);
1605                         bss->wpa_ie_len = elems.wpa_len + 2;
1606                 } else
1607                         bss->wpa_ie_len = 0;
1608         } else if (!elems.wpa && bss->wpa_ie) {
1609                 os_free(bss->wpa_ie);
1610                 bss->wpa_ie = NULL;
1611                 bss->wpa_ie_len = 0;
1612         }
1613
1614         if (elems.rsn &&
1615             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1616              os_memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1617                 os_free(bss->rsn_ie);
1618                 bss->rsn_ie = os_malloc(elems.rsn_len + 2);
1619                 if (bss->rsn_ie) {
1620                         os_memcpy(bss->rsn_ie, elems.rsn - 2,
1621                                   elems.rsn_len + 2);
1622                         bss->rsn_ie_len = elems.rsn_len + 2;
1623                 } else
1624                         bss->rsn_ie_len = 0;
1625         } else if (!elems.rsn && bss->rsn_ie) {
1626                 os_free(bss->rsn_ie);
1627                 bss->rsn_ie = NULL;
1628                 bss->rsn_ie_len = 0;
1629         }
1630
1631         if (elems.wmm_param &&
1632             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1633              os_memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1634                 os_free(bss->wmm_ie);
1635                 bss->wmm_ie = os_malloc(elems.wmm_param_len + 2);
1636                 if (bss->wmm_ie) {
1637                         os_memcpy(bss->wmm_ie, elems.wmm_param - 2,
1638                                   elems.wmm_param_len + 2);
1639                         bss->wmm_ie_len = elems.wmm_param_len + 2;
1640                 } else
1641                         bss->wmm_ie_len = 0;
1642         } else if (!elems.wmm_param && bss->wmm_ie) {
1643                 os_free(bss->wmm_ie);
1644                 bss->wmm_ie = NULL;
1645                 bss->wmm_ie_len = 0;
1646         }
1647
1648 #ifdef CONFIG_IEEE80211R
1649         if (elems.mdie &&
1650             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1651              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1652                 os_free(bss->mdie);
1653                 bss->mdie = os_malloc(elems.mdie_len + 2);
1654                 if (bss->mdie) {
1655                         os_memcpy(bss->mdie, elems.mdie - 2,
1656                                   elems.mdie_len + 2);
1657                         bss->mdie_len = elems.mdie_len + 2;
1658                 } else
1659                         bss->mdie_len = 0;
1660         } else if (!elems.mdie && bss->mdie) {
1661                 os_free(bss->mdie);
1662                 bss->mdie = NULL;
1663                 bss->mdie_len = 0;
1664         }
1665 #endif /* CONFIG_IEEE80211R */
1666
1667         bss->hw_mode = wpa_s->mlme.phymode;
1668         bss->channel = channel;
1669         bss->freq = wpa_s->mlme.freq;
1670         if (channel != wpa_s->mlme.channel &&
1671             (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1672              wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1673             channel >= 1 && channel <= 14) {
1674                 static const int freq_list[] = {
1675                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1676                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1677                 };
1678                 /* IEEE 802.11g/b mode can receive packets from neighboring
1679                  * channels, so map the channel into frequency. */
1680                 bss->freq = freq_list[channel - 1];
1681         }
1682         bss->timestamp = timestamp;
1683         os_get_time(&bss->last_update);
1684         bss->rssi = rx_status->ssi;
1685         if (!beacon)
1686                 bss->probe_resp++;
1687 }
1688
1689
1690 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1691                                          struct ieee80211_mgmt *mgmt,
1692                                          size_t len,
1693                                          struct ieee80211_rx_status *rx_status)
1694 {
1695         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1696 }
1697
1698
1699 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1700                                      struct ieee80211_mgmt *mgmt,
1701                                      size_t len,
1702                                      struct ieee80211_rx_status *rx_status)
1703 {
1704         int use_protection;
1705         size_t baselen;
1706         struct ieee802_11_elems elems;
1707
1708         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1709
1710         if (!wpa_s->mlme.associated ||
1711             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1712                 return;
1713
1714         /* Process beacon from the current BSS */
1715         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1716         if (baselen > len)
1717                 return;
1718
1719         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1720                                    &elems) == ParseFailed)
1721                 return;
1722
1723         use_protection = 0;
1724         if (elems.erp_info && elems.erp_info_len >= 1) {
1725                 use_protection =
1726                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1727         }
1728
1729         if (use_protection != !!wpa_s->mlme.use_protection) {
1730                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1731                            ")",
1732                            use_protection ? "enabled" : "disabled",
1733                            MAC2STR(wpa_s->bssid));
1734                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1735                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1736         }
1737
1738         if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1739                 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1740                                          elems.wmm_param_len);
1741         }
1742 }
1743
1744
1745 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1746                                         struct ieee80211_mgmt *mgmt,
1747                                         size_t len,
1748                                         struct ieee80211_rx_status *rx_status)
1749 {
1750         int tx_last_beacon, adhoc;
1751 #if 0 /* FIX */
1752         struct ieee80211_mgmt *resp;
1753 #endif
1754         u8 *pos, *end;
1755         struct wpa_ssid *ssid = wpa_s->current_ssid;
1756
1757         adhoc = ssid && ssid->mode == 1;
1758
1759         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1760             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1761                 return;
1762
1763 #if 0 /* FIX */
1764         if (local->hw->tx_last_beacon)
1765                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1766         else
1767 #endif
1768                 tx_last_beacon = 1;
1769
1770 #ifdef IEEE80211_IBSS_DEBUG
1771         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1772                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1773                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1774                    MAC2STR(mgmt->bssid), tx_last_beacon);
1775 #endif /* IEEE80211_IBSS_DEBUG */
1776
1777         if (!tx_last_beacon)
1778                 return;
1779
1780         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1781             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1782                 return;
1783
1784         end = ((u8 *) mgmt) + len;
1785         pos = mgmt->u.probe_req.variable;
1786         if (pos[0] != WLAN_EID_SSID ||
1787             pos + 2 + pos[1] > end) {
1788                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1789                            MACSTR, MAC2STR(mgmt->sa));
1790                 return;
1791         }
1792         if (pos[1] != 0 &&
1793             (pos[1] != wpa_s->mlme.ssid_len ||
1794              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1795         {
1796                 /* Ignore ProbeReq for foreign SSID */
1797                 return;
1798         }
1799
1800 #if 0 /* FIX */
1801         /* Reply with ProbeResp */
1802         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1803         if (skb == NULL)
1804                 return;
1805
1806         resp = (struct ieee80211_mgmt *) skb->data;
1807         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1808 #ifdef IEEE80211_IBSS_DEBUG
1809         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1810                    MAC2STR(resp->da));
1811 #endif /* IEEE80211_IBSS_DEBUG */
1812         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1813 #endif
1814 }
1815
1816
1817 #ifdef CONFIG_IEEE80211R
1818 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1819                                         struct ieee80211_mgmt *mgmt,
1820                                         size_t len,
1821                                         struct ieee80211_rx_status *rx_status)
1822 {
1823         union wpa_event_data data;
1824         u16 status;
1825         u8 *sta_addr, *target_ap_addr;
1826
1827         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1828                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1829                 return;
1830         }
1831
1832         /*
1833          * Only FT Action Response is needed for now since reservation
1834          * protocol is not supported.
1835          */
1836         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1837                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1838                            mgmt->u.action.u.ft_action_resp.action);
1839                 return;
1840         }
1841
1842         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1843         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1844         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1845         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1846                    " TargetAP " MACSTR " Status Code %d",
1847                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1848         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1849                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1850                            " in FT Action Response", MAC2STR(sta_addr));
1851                 return;
1852
1853         }
1854
1855         if (status) {
1856                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1857                            "failure (status code %d)", status);
1858                 /* TODO: report error to FT code(?) */
1859                 return;
1860         }
1861
1862         os_memset(&data, 0, sizeof(data));
1863         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1864         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1865                                      (u8 *) mgmt);
1866         data.ft_ies.ft_action = 1;
1867         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1868         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1869         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1870          * successfully */
1871         wpa_s->mlme.prev_bssid_set = 1;
1872         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1873         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1874         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1875         ieee80211_associate(wpa_s);
1876 }
1877 #endif /* CONFIG_IEEE80211R */
1878
1879
1880 #ifdef CONFIG_IEEE80211W
1881
1882 /* MLME-PING.response */
1883 static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
1884                                         const u8 *addr, const u8 *trans_id)
1885 {
1886         struct ieee80211_mgmt *mgmt;
1887         int res;
1888         size_t len;
1889
1890         mgmt = os_zalloc(sizeof(*mgmt));
1891         if (mgmt == NULL) {
1892                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1893                            "ping action frame");
1894                 return -1;
1895         }
1896
1897         len = 24;
1898         os_memcpy(mgmt->da, addr, ETH_ALEN);
1899         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1900         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1901         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1902                                            WLAN_FC_STYPE_ACTION);
1903         mgmt->u.action.category = WLAN_ACTION_PING;
1904         mgmt->u.action.u.ping_resp.action = WLAN_PING_RESPONSE;
1905         os_memcpy(mgmt->u.action.u.ping_resp.trans_id, trans_id,
1906                   WLAN_PING_TRANS_ID_LEN);
1907         len += 1 + sizeof(mgmt->u.action.u.ping_resp);
1908
1909         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1910         os_free(mgmt);
1911
1912         return res;
1913 }
1914
1915
1916 static void ieee80211_rx_mgmt_ping_action(
1917         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1918         struct ieee80211_rx_status *rx_status)
1919 {
1920         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ping_req)) {
1921                 wpa_printf(MSG_DEBUG, "MLME: Too short Ping Action frame");
1922                 return;
1923         }
1924
1925         if (mgmt->u.action.u.ping_req.action != WLAN_PING_REQUEST) {
1926                 wpa_printf(MSG_DEBUG, "MLME: Unexpected Ping Action %d",
1927                            mgmt->u.action.u.ping_req.action);
1928                 return;
1929         }
1930
1931         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1932                 wpa_printf(MSG_DEBUG, "MLME: Ignore ping from unknown source "
1933                            MACSTR, MAC2STR(mgmt->sa));
1934                 return;
1935         }
1936
1937         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1938                 wpa_printf(MSG_DEBUG, "MLME: Ignore ping request during "
1939                            "association process");
1940                 return;
1941         }
1942
1943         wpa_printf(MSG_DEBUG, "MLME: Replying to ping request");
1944         ieee80211_sta_send_ping_resp(wpa_s, mgmt->sa,
1945                                      mgmt->u.action.u.ping_req.trans_id);
1946 }
1947
1948 #endif /* CONFIG_IEEE80211W */
1949
1950
1951 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1952                                      struct ieee80211_mgmt *mgmt,
1953                                      size_t len,
1954                                      struct ieee80211_rx_status *rx_status)
1955 {
1956         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1957
1958         if (len < 25)
1959                 return;
1960
1961         switch (mgmt->u.action.category) {
1962 #ifdef CONFIG_IEEE80211R
1963         case WLAN_ACTION_FT:
1964                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1965                 break;
1966 #endif /* CONFIG_IEEE80211R */
1967         case WLAN_ACTION_PING:
1968                 ieee80211_rx_mgmt_ping_action(wpa_s, mgmt, len, rx_status);
1969                 break;
1970 #ifdef CONFIG_IEEE80211W
1971 #endif /* CONFIG_IEEE80211W */
1972         default:
1973                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1974                            mgmt->u.action.category);
1975                 break;
1976         }
1977 }
1978
1979
1980 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1981                                   const u8 *buf, size_t len,
1982                                   struct ieee80211_rx_status *rx_status)
1983 {
1984         struct ieee80211_mgmt *mgmt;
1985         u16 fc;
1986
1987         if (len < 24)
1988                 return;
1989
1990         mgmt = (struct ieee80211_mgmt *) buf;
1991         fc = le_to_host16(mgmt->frame_control);
1992
1993         switch (WLAN_FC_GET_STYPE(fc)) {
1994         case WLAN_FC_STYPE_PROBE_REQ:
1995                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1996                 break;
1997         case WLAN_FC_STYPE_PROBE_RESP:
1998                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1999                 break;
2000         case WLAN_FC_STYPE_BEACON:
2001                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2002                 break;
2003         case WLAN_FC_STYPE_AUTH:
2004                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2005                 break;
2006         case WLAN_FC_STYPE_ASSOC_RESP:
2007                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2008                 break;
2009         case WLAN_FC_STYPE_REASSOC_RESP:
2010                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2011                 break;
2012         case WLAN_FC_STYPE_DEAUTH:
2013                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2014                 break;
2015         case WLAN_FC_STYPE_DISASSOC:
2016                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2017                 break;
2018         case WLAN_FC_STYPE_ACTION:
2019                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2020                 break;
2021         default:
2022                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2023                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2024                 break;
2025         }
2026 }
2027
2028
2029 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2030                                   const u8 *buf, size_t len,
2031                                   struct ieee80211_rx_status *rx_status)
2032 {
2033         struct ieee80211_mgmt *mgmt;
2034         u16 fc;
2035
2036         if (len < 24)
2037                 return;
2038
2039         mgmt = (struct ieee80211_mgmt *) buf;
2040         fc = le_to_host16(mgmt->frame_control);
2041
2042         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2043                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2044                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2045                                                      len, rx_status);
2046                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2047                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2048                 }
2049         }
2050 }
2051
2052
2053 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2054 {
2055         int active = 0;
2056
2057 #if 0 /* FIX */
2058         list_for_each(ptr, &local->sta_list) {
2059                 sta = list_entry(ptr, struct sta_info, list);
2060                 if (sta->dev == dev &&
2061                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2062                                jiffies)) {
2063                         active++;
2064                         break;
2065                 }
2066         }
2067 #endif
2068
2069         return active;
2070 }
2071
2072
2073 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2074 {
2075 #if 0 /* FIX */
2076         list_for_each_safe(ptr, n, &local->sta_list) {
2077                 sta = list_entry(ptr, struct sta_info, list);
2078                 if (time_after(jiffies, sta->last_rx +
2079                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2080                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2081                                    MACSTR, MAC2STR(sta->addr));
2082                         sta_info_free(local, sta, 1);
2083                 }
2084         }
2085 #endif
2086 }
2087
2088
2089 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2090 {
2091         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2092
2093         ieee80211_sta_expire(wpa_s);
2094         if (ieee80211_sta_active_ibss(wpa_s))
2095                 return;
2096
2097         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2098                    "other IBSS networks with same SSID (merge)");
2099         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2100 }
2101
2102
2103 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2104 {
2105         struct wpa_supplicant *wpa_s = eloop_ctx;
2106
2107         switch (wpa_s->mlme.state) {
2108         case IEEE80211_DISABLED:
2109                 break;
2110         case IEEE80211_AUTHENTICATE:
2111                 ieee80211_authenticate(wpa_s);
2112                 break;
2113         case IEEE80211_ASSOCIATE:
2114                 ieee80211_associate(wpa_s);
2115                 break;
2116         case IEEE80211_ASSOCIATED:
2117                 ieee80211_associated(wpa_s);
2118                 break;
2119         case IEEE80211_IBSS_SEARCH:
2120                 ieee80211_sta_find_ibss(wpa_s);
2121                 break;
2122         case IEEE80211_IBSS_JOINED:
2123                 ieee80211_sta_merge_ibss(wpa_s);
2124                 break;
2125         default:
2126                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2127                            wpa_s->mlme.state);
2128                 break;
2129         }
2130
2131         if (ieee80211_privacy_mismatch(wpa_s)) {
2132                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2133                            "and mixed-cell disabled - disassociate");
2134
2135                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2136                 ieee80211_set_associated(wpa_s, 0);
2137         }
2138 }
2139
2140
2141 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2142 {
2143         struct wpa_ssid *ssid = wpa_s->current_ssid;
2144         if (ssid && ssid->mode != 0)
2145                 return;
2146
2147 #if 0 /* FIX */
2148         if (local->hw->reset_tsf) {
2149                 /* Reset own TSF to allow time synchronization work. */
2150                 local->hw->reset_tsf(local->mdev);
2151         }
2152 #endif
2153
2154         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2155
2156
2157         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2158                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2159         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2160                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2161         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2162                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2163         else
2164                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2165         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2166                    wpa_s->mlme.auth_alg);
2167         wpa_s->mlme.auth_transaction = -1;
2168         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2169         ieee80211_authenticate(wpa_s);
2170 }
2171
2172
2173 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2174 {
2175 #if 0 /* FIX */
2176         int m, c;
2177
2178         for (m = 0; m < local->hw->num_modes; m++) {
2179                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2180                 if (mode->mode != local->conf.phymode)
2181                         continue;
2182                 for (c = 0; c < mode->num_channels; c++) {
2183                         struct ieee80211_channel *chan = &mode->channels[c];
2184                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2185                             chan->chan == local->conf.channel) {
2186                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2187                                         return 1;
2188                                 break;
2189                         }
2190                 }
2191         }
2192 #endif
2193
2194         return 0;
2195 }
2196
2197
2198 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2199                                    struct ieee80211_sta_bss *bss)
2200 {
2201         int res = 0, rates, done = 0;
2202         struct ieee80211_mgmt *mgmt;
2203 #if 0 /* FIX */
2204         struct ieee80211_tx_control control;
2205         struct ieee80211_rate *rate;
2206         struct rate_control_extra extra;
2207 #endif
2208         u8 *pos, *buf;
2209         size_t len;
2210
2211         /* Remove possible STA entries from other IBSS networks. */
2212 #if 0 /* FIX */
2213         sta_info_flush(local, NULL);
2214
2215         if (local->hw->reset_tsf) {
2216                 /* Reset own TSF to allow time synchronization work. */
2217                 local->hw->reset_tsf(local->mdev);
2218         }
2219 #endif
2220         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2221
2222 #if 0 /* FIX */
2223         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2224
2225         sdata->drop_unencrypted = bss->capability &
2226                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2227 #endif
2228
2229 #if 0 /* FIX */
2230         os_memset(&rq, 0, sizeof(rq));
2231         rq.m = bss->freq * 100000;
2232         rq.e = 1;
2233         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2234 #endif
2235
2236         if (!ieee80211_ibss_allowed(wpa_s)) {
2237 #if 0 /* FIX */
2238                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2239                            "(%d MHz)", local->conf.channel,
2240                            local->conf.freq);
2241 #endif
2242                 return -1;
2243         }
2244
2245         /* Set beacon template based on scan results */
2246         buf = os_malloc(400);
2247         len = 0;
2248         do {
2249                 if (buf == NULL)
2250                         break;
2251
2252                 mgmt = (struct ieee80211_mgmt *) buf;
2253                 len += 24 + sizeof(mgmt->u.beacon);
2254                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2255                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2256                                                    WLAN_FC_STYPE_BEACON);
2257                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2258                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2259                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2260 #if 0 /* FIX */
2261                 mgmt->u.beacon.beacon_int =
2262                         host_to_le16(local->conf.beacon_int);
2263 #endif
2264                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2265
2266                 pos = buf + len;
2267                 len += 2 + wpa_s->mlme.ssid_len;
2268                 *pos++ = WLAN_EID_SSID;
2269                 *pos++ = wpa_s->mlme.ssid_len;
2270                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2271
2272                 rates = bss->supp_rates_len;
2273                 if (rates > 8)
2274                         rates = 8;
2275                 pos = buf + len;
2276                 len += 2 + rates;
2277                 *pos++ = WLAN_EID_SUPP_RATES;
2278                 *pos++ = rates;
2279                 os_memcpy(pos, bss->supp_rates, rates);
2280
2281                 pos = buf + len;
2282                 len += 2 + 1;
2283                 *pos++ = WLAN_EID_DS_PARAMS;
2284                 *pos++ = 1;
2285                 *pos++ = bss->channel;
2286
2287                 pos = buf + len;
2288                 len += 2 + 2;
2289                 *pos++ = WLAN_EID_IBSS_PARAMS;
2290                 *pos++ = 2;
2291                 /* FIX: set ATIM window based on scan results */
2292                 *pos++ = 0;
2293                 *pos++ = 0;
2294
2295                 if (bss->supp_rates_len > 8) {
2296                         rates = bss->supp_rates_len - 8;
2297                         pos = buf + len;
2298                         len += 2 + rates;
2299                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2300                         *pos++ = rates;
2301                         os_memcpy(pos, &bss->supp_rates[8], rates);
2302                 }
2303
2304 #if 0 /* FIX */
2305                 os_memset(&control, 0, sizeof(control));
2306                 control.pkt_type = PKT_PROBE_RESP;
2307                 os_memset(&extra, 0, sizeof(extra));
2308                 extra.endidx = local->num_curr_rates;
2309                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2310                 if (rate == NULL) {
2311                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2312                                    "rate for IBSS beacon");
2313                         break;
2314                 }
2315                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2316                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2317                         rate->val2 : rate->val;
2318                 control.antenna_sel = local->conf.antenna_sel;
2319                 control.power_level = local->conf.power_level;
2320                 control.no_ack = 1;
2321                 control.retry_limit = 1;
2322                 control.rts_cts_duration = 0;
2323 #endif
2324
2325 #if 0 /* FIX */
2326                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2327                 if (wpa_s->mlme.probe_resp) {
2328                         mgmt = (struct ieee80211_mgmt *)
2329                                 wpa_s->mlme.probe_resp->data;
2330                         mgmt->frame_control =
2331                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2332                                              WLAN_FC_STYPE_PROBE_RESP);
2333                 } else {
2334                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2335                                    "ProbeResp template for IBSS");
2336                 }
2337
2338                 if (local->hw->beacon_update &&
2339                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2340                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2341                                    "template based on scan results");
2342                         skb = NULL;
2343                 }
2344
2345                 rates = 0;
2346                 for (i = 0; i < bss->supp_rates_len; i++) {
2347                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2348                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2349                                 rate *= 2;
2350                         for (j = 0; j < local->num_curr_rates; j++)
2351                                 if (local->curr_rates[j].rate == rate)
2352                                         rates |= BIT(j);
2353                 }
2354                 wpa_s->mlme.supp_rates_bits = rates;
2355 #endif
2356                 done = 1;
2357         } while (0);
2358
2359         os_free(buf);
2360         if (!done) {
2361                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2362                            "template");
2363         }
2364
2365         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2366         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2367
2368         return res;
2369 }
2370
2371
2372 #if 0 /* FIX */
2373 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2374 {
2375         struct ieee80211_sta_bss *bss;
2376         u8 bssid[ETH_ALEN], *pos;
2377         int i;
2378
2379 #if 0
2380         /* Easier testing, use fixed BSSID. */
2381         os_memset(bssid, 0xfe, ETH_ALEN);
2382 #else
2383         /* Generate random, not broadcast, locally administered BSSID. Mix in
2384          * own MAC address to make sure that devices that do not have proper
2385          * random number generator get different BSSID. */
2386         os_get_random(bssid, ETH_ALEN);
2387         for (i = 0; i < ETH_ALEN; i++)
2388                 bssid[i] ^= wpa_s->own_addr[i];
2389         bssid[0] &= ~0x01;
2390         bssid[0] |= 0x02;
2391 #endif
2392
2393         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2394                    MACSTR "", MAC2STR(bssid));
2395
2396         bss = ieee80211_bss_add(wpa_s, bssid);
2397         if (bss == NULL)
2398                 return -ENOMEM;
2399
2400 #if 0 /* FIX */
2401         if (local->conf.beacon_int == 0)
2402                 local->conf.beacon_int = 100;
2403         bss->beacon_int = local->conf.beacon_int;
2404         bss->hw_mode = local->conf.phymode;
2405         bss->channel = local->conf.channel;
2406         bss->freq = local->conf.freq;
2407 #endif
2408         os_get_time(&bss->last_update);
2409         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2410 #if 0 /* FIX */
2411         if (sdata->default_key) {
2412                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2413         } else
2414                 sdata->drop_unencrypted = 0;
2415         bss->supp_rates_len = local->num_curr_rates;
2416 #endif
2417         pos = bss->supp_rates;
2418 #if 0 /* FIX */
2419         for (i = 0; i < local->num_curr_rates; i++) {
2420                 int rate = local->curr_rates[i].rate;
2421                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2422                         rate /= 2;
2423                 *pos++ = (u8) (rate / 5);
2424         }
2425 #endif
2426
2427         return ieee80211_sta_join_ibss(wpa_s, bss);
2428 }
2429 #endif
2430
2431
2432 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2433 {
2434         struct ieee80211_sta_bss *bss;
2435         int found = 0;
2436         u8 bssid[ETH_ALEN];
2437         int active_ibss;
2438         struct os_time now;
2439
2440         if (wpa_s->mlme.ssid_len == 0)
2441                 return -EINVAL;
2442
2443         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2444 #ifdef IEEE80211_IBSS_DEBUG
2445         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2446                    active_ibss);
2447 #endif /* IEEE80211_IBSS_DEBUG */
2448         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2449                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2450                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2451                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2452                         continue;
2453 #ifdef IEEE80211_IBSS_DEBUG
2454                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2455                            MAC2STR(bss->bssid));
2456 #endif /* IEEE80211_IBSS_DEBUG */
2457                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2458                 found = 1;
2459                 if (active_ibss ||
2460                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2461                         break;
2462         }
2463
2464 #ifdef IEEE80211_IBSS_DEBUG
2465         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2466                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2467 #endif /* IEEE80211_IBSS_DEBUG */
2468         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2469             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2470                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2471                            " based on configured SSID",
2472                            MAC2STR(bssid));
2473                 return ieee80211_sta_join_ibss(wpa_s, bss);
2474         }
2475 #ifdef IEEE80211_IBSS_DEBUG
2476         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2477 #endif /* IEEE80211_IBSS_DEBUG */
2478
2479         /* Selected IBSS not found in current scan results - try to scan */
2480         os_get_time(&now);
2481 #if 0 /* FIX */
2482         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2483             !ieee80211_sta_active_ibss(wpa_s)) {
2484                 ieee80211_reschedule_timer(wpa_s,
2485                                            IEEE80211_IBSS_MERGE_INTERVAL);
2486         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2487                               IEEE80211_SCAN_INTERVAL)) {
2488                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2489                            "to join");
2490                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2491                                               wpa_s->mlme.ssid_len);
2492         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2493                 int interval = IEEE80211_SCAN_INTERVAL;
2494
2495                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2496                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2497                         if (wpa_s->mlme.create_ibss &&
2498                             ieee80211_ibss_allowed(wpa_s))
2499                                 return ieee80211_sta_create_ibss(wpa_s);
2500                         if (wpa_s->mlme.create_ibss) {
2501                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2502                                            "on the configured channel %d "
2503                                            "(%d MHz)",
2504                                            local->conf.channel,
2505                                            local->conf.freq);
2506                         }
2507
2508                         /* No IBSS found - decrease scan interval and continue
2509                          * scanning. */
2510                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2511                 }
2512
2513                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2514                 ieee80211_reschedule_timer(wpa_s, interval);
2515                 return 0;
2516         }
2517 #endif
2518
2519         return 0;
2520 }
2521
2522
2523 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2524                            size_t *len)
2525 {
2526         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2527         *len = wpa_s->mlme.ssid_len;
2528         return 0;
2529 }
2530
2531
2532 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2533                             struct wpa_driver_associate_params *params)
2534 {
2535         struct ieee80211_sta_bss *bss;
2536
2537         wpa_s->mlme.bssid_set = 0;
2538         wpa_s->mlme.freq = params->freq;
2539         if (params->bssid) {
2540                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2541                 if (!is_zero_ether_addr(params->bssid))
2542                         wpa_s->mlme.bssid_set = 1;
2543                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2544                 if (bss) {
2545                         wpa_s->mlme.phymode = bss->hw_mode;
2546                         wpa_s->mlme.channel = bss->channel;
2547                         wpa_s->mlme.freq = bss->freq;
2548                 }
2549         }
2550
2551 #if 0 /* FIX */
2552         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2553          * not defined. */
2554         if (local->hw->conf_tx) {
2555                 struct ieee80211_tx_queue_params qparam;
2556                 int i;
2557
2558                 os_memset(&qparam, 0, sizeof(qparam));
2559                 /* TODO: are these ok defaults for all hw_modes? */
2560                 qparam.aifs = 2;
2561                 qparam.cw_min =
2562                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2563                 qparam.cw_max = 1023;
2564                 qparam.burst_time = 0;
2565                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2566                 {
2567                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2568                                            &qparam);
2569                 }
2570                 /* IBSS uses different parameters for Beacon sending */
2571                 qparam.cw_min++;
2572                 qparam.cw_min *= 2;
2573                 qparam.cw_min--;
2574                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2575         }
2576 #endif
2577
2578         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2579             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2580                 wpa_s->mlme.prev_bssid_set = 0;
2581         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2582         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2583                   MAX_SSID_LEN - params->ssid_len);
2584         wpa_s->mlme.ssid_len = params->ssid_len;
2585         wpa_s->mlme.ssid_set = 1;
2586
2587         os_free(wpa_s->mlme.extra_ie);
2588         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2589                 wpa_s->mlme.extra_ie = NULL;
2590                 wpa_s->mlme.extra_ie_len = 0;
2591         } else {
2592                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2593                 if (wpa_s->mlme.extra_ie == NULL) {
2594                         wpa_s->mlme.extra_ie_len = 0;
2595                         return -1;
2596                 }
2597                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2598                           params->wpa_ie_len);
2599                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2600         }
2601
2602         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2603
2604         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2605                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2606
2607         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2608                 os_get_time(&wpa_s->mlme.ibss_join_req);
2609                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2610                 return ieee80211_sta_find_ibss(wpa_s);
2611         }
2612
2613         if (wpa_s->mlme.bssid_set)
2614                 ieee80211_sta_new_auth(wpa_s);
2615
2616         return 0;
2617 }
2618
2619
2620 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2621 {
2622         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2623         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2624         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2625 }
2626
2627
2628 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2629 {
2630         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2631         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2632         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2633         if (wpa_s->mlme.freq == 0)
2634                 return 0;
2635         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2636                                          wpa_s->mlme.channel,
2637                                          wpa_s->mlme.freq);
2638 }
2639
2640
2641 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2642 {
2643         size_t m;
2644         int c;
2645
2646         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2647                 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2648                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2649                         continue;
2650                 for (c = 0; c < mode->num_channels; c++) {
2651                         struct wpa_channel_data *chan = &mode->channels[c];
2652                         if (chan->flag & WPA_CHAN_W_SCAN &&
2653                             chan->chan == wpa_s->mlme.channel) {
2654                                 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2655                                         return 1;
2656                                 break;
2657                         }
2658                 }
2659         }
2660
2661         return 0;
2662 }
2663
2664
2665 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2666 {
2667         struct wpa_supplicant *wpa_s = eloop_ctx;
2668         struct wpa_hw_modes *mode;
2669         struct wpa_channel_data *chan;
2670         int skip = 0;
2671         int timeout = 0;
2672         struct wpa_ssid *ssid = wpa_s->current_ssid;
2673         int adhoc;
2674
2675         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2676                 return;
2677
2678         adhoc = ssid && ssid->mode == 1;
2679
2680         switch (wpa_s->mlme.scan_state) {
2681         case SCAN_SET_CHANNEL:
2682                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2683                 if (wpa_s->mlme.scan_hw_mode_idx >=
2684                     (int) wpa_s->mlme.num_modes ||
2685                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2686                      (int) wpa_s->mlme.num_modes
2687                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2688                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2689                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2690                                            "restore operational channel after "
2691                                            "scan");
2692                         }
2693                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2694                         wpa_s->mlme.sta_scanning = 0;
2695                         os_get_time(&wpa_s->mlme.last_scan_completed);
2696                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2697                         if (adhoc) {
2698                                 if (!wpa_s->mlme.bssid_set ||
2699                                     (wpa_s->mlme.state ==
2700                                      IEEE80211_IBSS_JOINED &&
2701                                      !ieee80211_sta_active_ibss(wpa_s)))
2702                                         ieee80211_sta_find_ibss(wpa_s);
2703                         }
2704                         return;
2705                 }
2706                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2707                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2708                 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2709                     (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2710                     (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2711                      mode->mode == WPA_MODE_IEEE80211B &&
2712                      wpa_s->mlme.scan_skip_11b))
2713                         skip = 1;
2714
2715                 if (!skip) {
2716                         wpa_printf(MSG_MSGDUMP,
2717                                    "MLME: scan channel %d (%d MHz)",
2718                                    chan->chan, chan->freq);
2719
2720                         wpa_s->mlme.channel = chan->chan;
2721                         wpa_s->mlme.freq = chan->freq;
2722                         wpa_s->mlme.phymode = mode->mode;
2723                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2724                                                       chan->chan, chan->freq))
2725                         {
2726                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2727                                            "channel %d (%d MHz) for scan",
2728                                            chan->chan, chan->freq);
2729                                 skip = 1;
2730                         }
2731                 }
2732
2733                 wpa_s->mlme.scan_channel_idx++;
2734                 if (wpa_s->mlme.scan_channel_idx >=
2735                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2736                     num_channels) {
2737                         wpa_s->mlme.scan_hw_mode_idx++;
2738                         wpa_s->mlme.scan_channel_idx = 0;
2739                 }
2740
2741                 if (skip) {
2742                         timeout = 0;
2743                         break;
2744                 }
2745
2746                 timeout = IEEE80211_PROBE_DELAY;
2747                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2748                 break;
2749         case SCAN_SEND_PROBE:
2750                 if (ieee80211_active_scan(wpa_s)) {
2751                         ieee80211_send_probe_req(wpa_s, NULL,
2752                                                  wpa_s->mlme.scan_ssid,
2753                                                  wpa_s->mlme.scan_ssid_len);
2754                         timeout = IEEE80211_CHANNEL_TIME;
2755                 } else {
2756                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2757                 }
2758                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2759                 break;
2760         }
2761
2762         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2763                                ieee80211_sta_scan_timer, wpa_s, NULL);
2764 }
2765
2766
2767 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2768                            size_t ssid_len)
2769 {
2770         if (ssid_len > MAX_SSID_LEN)
2771                 return -1;
2772
2773         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2774          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2775          * BSSID: MACAddress
2776          * SSID
2777          * ScanType: ACTIVE, PASSIVE
2778          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2779          *    a Probe frame during active scanning
2780          * ChannelList
2781          * MinChannelTime (>= ProbeDelay), in TU
2782          * MaxChannelTime: (>= MinChannelTime), in TU
2783          */
2784
2785          /* MLME-SCAN.confirm
2786           * BSSDescriptionSet
2787           * ResultCode: SUCCESS, INVALID_PARAMETERS
2788          */
2789
2790         /* TODO: if assoc, move to power save mode for the duration of the
2791          * scan */
2792
2793         if (wpa_s->mlme.sta_scanning)
2794                 return -1;
2795
2796         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2797
2798         ieee80211_sta_save_oper_chan(wpa_s);
2799
2800         wpa_s->mlme.sta_scanning = 1;
2801         /* TODO: stop TX queue? */
2802
2803         if (ssid) {
2804                 wpa_s->mlme.scan_ssid_len = ssid_len;
2805                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2806         } else
2807                 wpa_s->mlme.scan_ssid_len = 0;
2808         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2809                                         * supported */
2810         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2811         wpa_s->mlme.scan_hw_mode_idx = 0;
2812         wpa_s->mlme.scan_channel_idx = 0;
2813         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2814
2815         return 0;
2816 }
2817
2818
2819 struct wpa_scan_results *
2820 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2821 {
2822         size_t ap_num = 0;
2823         struct wpa_scan_results *res;
2824         struct wpa_scan_res *r;
2825         struct ieee80211_sta_bss *bss;
2826
2827         res = os_zalloc(sizeof(*res));
2828         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2829                 ap_num++;
2830         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2831         if (res->res == NULL) {
2832                 os_free(res);
2833                 return NULL;
2834         }
2835
2836         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2837                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2838                 if (r == NULL)
2839                         break;
2840                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2841                 r->freq = bss->freq;
2842                 r->beacon_int = bss->beacon_int;
2843                 r->caps = bss->capability;
2844                 r->level = bss->rssi;
2845                 r->tsf = bss->timestamp;
2846                 if (bss->ie) {
2847                         r->ie_len = bss->ie_len;
2848                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2849                 }
2850
2851                 res->res[res->num++] = r;
2852         }
2853
2854         return res;
2855 }
2856
2857
2858 #if 0 /* FIX */
2859 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2860                                          struct sk_buff *skb, u8 *bssid,
2861                                          u8 *addr)
2862 {
2863         struct ieee80211_local *local = dev->priv;
2864         struct list_head *ptr;
2865         struct sta_info *sta;
2866         struct wpa_supplicant *sta_dev = NULL;
2867
2868         /* TODO: Could consider removing the least recently used entry and
2869          * allow new one to be added. */
2870         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2871                 if (net_ratelimit()) {
2872                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2873                                    "STA entry " MACSTR, MAC2STR(addr));
2874                 }
2875                 return NULL;
2876         }
2877
2878         spin_lock_bh(&local->sub_if_lock);
2879         list_for_each(ptr, &local->sub_if_list) {
2880                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2881                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2882                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2883                         sta_dev = sdata->dev;
2884                         break;
2885                 }
2886         }
2887         spin_unlock_bh(&local->sub_if_lock);
2888
2889         if (sta_dev == NULL)
2890                 return NULL;
2891
2892         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2893                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2894
2895         sta = sta_info_add(wpa_s, addr);
2896         if (sta == NULL) {
2897                 return NULL;
2898         }
2899
2900         sta->dev = sta_dev;
2901         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2902
2903         rate_control_rate_init(local, sta);
2904
2905         return sta; /* caller will call sta_info_release() */
2906 }
2907 #endif
2908
2909
2910 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2911 {
2912         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2913
2914         ieee80211_send_deauth(wpa_s, reason);
2915         ieee80211_set_associated(wpa_s, 0);
2916         return 0;
2917 }
2918
2919
2920 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2921 {
2922         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2923
2924         if (!wpa_s->mlme.associated)
2925                 return -1;
2926
2927         ieee80211_send_disassoc(wpa_s, reason);
2928         ieee80211_set_associated(wpa_s, 0);
2929         return 0;
2930 }
2931
2932
2933 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2934                       struct ieee80211_rx_status *rx_status)
2935 {
2936         struct ieee80211_mgmt *mgmt;
2937         u16 fc;
2938         const u8 *pos;
2939
2940         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2941
2942         if (wpa_s->mlme.sta_scanning) {
2943                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2944                 return;
2945         }
2946
2947         if (len < 24)
2948                 return;
2949
2950         mgmt = (struct ieee80211_mgmt *) buf;
2951         fc = le_to_host16(mgmt->frame_control);
2952
2953         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2954                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2955         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2956                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2957                     WLAN_FC_FROMDS)
2958                         return;
2959                 /* mgmt->sa is actually BSSID for FromDS data frames */
2960                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2961                         return;
2962                 /* Skip IEEE 802.11 and LLC headers */
2963                 pos = buf + 24 + 6;
2964                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2965                         return;
2966                 pos += 2;
2967                 /* mgmt->bssid is actually BSSID for SA data frames */
2968                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2969                                         pos, buf + len - pos);
2970         }
2971 }
2972
2973
2974 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2975                                     size_t num_hw_features)
2976 {
2977         size_t i;
2978
2979         if (hw_features == NULL)
2980                 return;
2981
2982         for (i = 0; i < num_hw_features; i++) {
2983                 os_free(hw_features[i].channels);
2984                 os_free(hw_features[i].rates);
2985         }
2986
2987         os_free(hw_features);
2988 }
2989
2990
2991 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2992 {
2993         u16 num_modes, flags;
2994
2995         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2996                                                         &flags);
2997         if (wpa_s->mlme.modes == NULL) {
2998                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2999                            "channels and rates from the driver");
3000                 return -1;
3001         }
3002
3003         wpa_s->mlme.num_modes = num_modes;
3004
3005         wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
3006         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
3007         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
3008
3009         return 0;
3010 }
3011
3012
3013 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3014 {
3015         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3016         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3017         os_free(wpa_s->mlme.extra_ie);
3018         wpa_s->mlme.extra_ie = NULL;
3019         os_free(wpa_s->mlme.extra_probe_ie);
3020         wpa_s->mlme.extra_probe_ie = NULL;
3021         os_free(wpa_s->mlme.assocreq_ies);
3022         wpa_s->mlme.assocreq_ies = NULL;
3023         os_free(wpa_s->mlme.assocresp_ies);
3024         wpa_s->mlme.assocresp_ies = NULL;
3025         ieee80211_bss_list_deinit(wpa_s);
3026         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3027                                        wpa_s->mlme.num_modes);
3028 #ifdef CONFIG_IEEE80211R
3029         os_free(wpa_s->mlme.ft_ies);
3030         wpa_s->mlme.ft_ies = NULL;
3031         wpa_s->mlme.ft_ies_len = 0;
3032 #endif /* CONFIG_IEEE80211R */
3033 }
3034
3035
3036 #ifdef CONFIG_IEEE80211R
3037
3038 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3039                                 const u8 *ies, size_t ies_len)
3040 {
3041         if (md == NULL) {
3042                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3043                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3044         } else {
3045                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3046                            MAC2STR(md));
3047                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3048         }
3049
3050         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3051         os_free(wpa_s->mlme.ft_ies);
3052         wpa_s->mlme.ft_ies = os_malloc(ies_len);
3053         if (wpa_s->mlme.ft_ies == NULL)
3054                 return -1;
3055         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3056         wpa_s->mlme.ft_ies_len = ies_len;
3057
3058         return 0;
3059 }
3060
3061
3062 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3063                                  const u8 *target_ap,
3064                                  const u8 *ies, size_t ies_len)
3065 {
3066         u8 *buf;
3067         size_t len;
3068         struct ieee80211_mgmt *mgmt;
3069         int res;
3070
3071         /*
3072          * Action frame payload:
3073          * Category[1] = 6 (Fast BSS Transition)
3074          * Action[1] = 1 (Fast BSS Transition Request)
3075          * STA Address
3076          * Target AP Address
3077          * FT IEs
3078          */
3079
3080         buf = os_zalloc(sizeof(*mgmt) + ies_len);
3081         if (buf == NULL) {
3082                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3083                            "FT action frame");
3084                 return -1;
3085         }
3086
3087         mgmt = (struct ieee80211_mgmt *) buf;
3088         len = 24;
3089         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3090         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3091         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3092         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3093                                            WLAN_FC_STYPE_ACTION);
3094         mgmt->u.action.category = WLAN_ACTION_FT;
3095         mgmt->u.action.u.ft_action_req.action = action;
3096         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3097                   ETH_ALEN);
3098         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3099                   ETH_ALEN);
3100         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3101         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3102
3103         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3104                    "Target AP=" MACSTR " body_len=%d",
3105                    action, MAC2STR(target_ap), ies_len);
3106
3107         res = ieee80211_sta_tx(wpa_s, buf, len);
3108         os_free(buf);
3109
3110         return res;
3111 }
3112
3113 #endif /* CONFIG_IEEE80211R */
3114
3115
3116 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3117                                    size_t ies_len)
3118 {
3119         os_free(wpa_s->mlme.extra_probe_ie);
3120         wpa_s->mlme.extra_probe_ie = NULL;
3121         wpa_s->mlme.extra_probe_ie_len = 0;
3122
3123         if (ies == NULL)
3124                 return 0;
3125
3126         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3127         if (wpa_s->mlme.extra_probe_ie == NULL)
3128                 return -1;
3129
3130         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3131         wpa_s->mlme.extra_probe_ie_len = ies_len;
3132
3133         return 0;
3134 }