Passive Client Taxonomy
[mech_eap.git] / src / ap / ieee802_11.c
index b36e68d..f1c396b 100644 (file)
@@ -43,6 +43,8 @@
 #include "ieee802_11.h"
 #include "dfs.h"
 #include "mbo_ap.h"
+#include "rrm.h"
+#include "taxonomy.h"
 
 
 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
@@ -140,6 +142,7 @@ u16 hostapd_own_capab_info(struct hostapd_data *hapd)
        int capab = WLAN_CAPABILITY_ESS;
        int privacy;
        int dfs;
+       int i;
 
        /* Check if any of configured channels require DFS */
        dfs = hostapd_is_dfs_required(hapd->iface);
@@ -187,8 +190,12 @@ u16 hostapd_own_capab_info(struct hostapd_data *hapd)
            (hapd->iconf->spectrum_mgmt_required || dfs))
                capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
 
-       if (hapd->conf->radio_measurements)
-               capab |= IEEE80211_CAP_RRM;
+       for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
+               if (hapd->conf->radio_measurements[i]) {
+                       capab |= IEEE80211_CAP_RRM;
+                       break;
+               }
+       }
 
        return capab;
 }
@@ -512,6 +519,9 @@ static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
        if (sae_check_big_sync(sta))
                return;
        sta->sae->sync++;
+       wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
+                  " (sync=%d state=%d)",
+                  MAC2STR(sta->addr), sta->sae->sync, sta->sae->state);
 
        switch (sta->sae->state) {
        case SAE_COMMITTED:
@@ -554,6 +564,18 @@ static void sae_set_retransmit_timer(struct hostapd_data *hapd,
 }
 
 
+void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
+{
+       sta->flags |= WLAN_STA_AUTH;
+       sta->auth_alg = WLAN_AUTH_SAE;
+       mlme_authenticate_indication(hapd, sta);
+       wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
+       sta->sae->state = SAE_ACCEPTED;
+       wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
+                              sta->sae->pmk, sta->sae->pmkid);
+}
+
+
 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
                       const u8 *bssid, u8 auth_transaction)
 {
@@ -676,13 +698,7 @@ static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
 
                        sae_set_retransmit_timer(hapd, sta);
                } else {
-                       sta->flags |= WLAN_STA_AUTH;
-                       sta->auth_alg = WLAN_AUTH_SAE;
-                       mlme_authenticate_indication(hapd, sta);
-                       wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
-                       sta->sae->state = SAE_ACCEPTED;
-                       wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
-                                              sta->sae->pmk, sta->sae->pmkid);
+                       sae_accept_sta(hapd, sta);
                }
                break;
        case SAE_ACCEPTED:
@@ -691,6 +707,7 @@ static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
                                   ") doing reauthentication",
                                   MAC2STR(sta->addr));
                        ap_free_sta(hapd, sta);
+                       wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
                } else {
                        if (sae_check_big_sync(sta))
                                return WLAN_STATUS_SUCCESS;
@@ -711,6 +728,44 @@ static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
 }
 
 
+static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
+{
+       struct sae_data *sae = sta->sae;
+       int i, *groups = hapd->conf->sae_groups;
+
+       if (sae->state != SAE_COMMITTED)
+               return;
+
+       wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
+
+       for (i = 0; groups && groups[i] > 0; i++) {
+               if (sae->group == groups[i])
+                       break;
+       }
+
+       if (!groups || groups[i] <= 0) {
+               wpa_printf(MSG_DEBUG,
+                          "SAE: Previously selected group not found from the current configuration");
+               return;
+       }
+
+       for (;;) {
+               i++;
+               if (groups[i] <= 0) {
+                       wpa_printf(MSG_DEBUG,
+                                  "SAE: No alternative group enabled");
+                       return;
+               }
+
+               if (sae_set_group(sae, groups[i]) < 0)
+                       continue;
+
+               break;
+       }
+       wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
+}
+
+
 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
                            const struct ieee80211_mgmt *mgmt, size_t len,
                            u16 auth_transaction, u16 status_code)
@@ -733,6 +788,13 @@ static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
                sta->sae->sync = 0;
        }
 
+       if (sta->mesh_sae_pmksa_caching) {
+               wpa_printf(MSG_DEBUG,
+                          "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
+               wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
+               sta->mesh_sae_pmksa_caching = 0;
+       }
+
        if (auth_transaction == 1) {
                const u8 *token = NULL, *pos, *end;
                size_t token_len = 0;
@@ -791,6 +853,16 @@ static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
                        return;
                }
 
+               if ((hapd->conf->mesh & MESH_ENABLED) &&
+                   status_code ==
+                   WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
+                   sta->sae->tmp) {
+                       wpa_printf(MSG_DEBUG,
+                                  "SAE: Peer did not accept our SAE group");
+                       sae_pick_next_group(hapd, sta);
+                       goto remove_sta;
+               }
+
                if (status_code != WLAN_STATUS_SUCCESS)
                        goto remove_sta;
 
@@ -1206,8 +1278,8 @@ static void handle_auth(struct hostapd_data *hapd,
                sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
                                WLAN_STA_AUTHORIZED);
 
-               if (hostapd_sta_add(hapd, sta->addr, 0, 0, 0, 0, 0,
-                                   NULL, NULL, sta->flags, 0, 0, 0)) {
+               if (hostapd_sta_add(hapd, sta->addr, 0, 0, NULL, 0, 0,
+                                   NULL, NULL, sta->flags, 0, 0, 0, 0)) {
                        hostapd_logger(hapd, sta->addr,
                                       HOSTAPD_MODULE_IEEE80211,
                                       HOSTAPD_LEVEL_NOTICE,
@@ -1314,6 +1386,9 @@ int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
                return 0;
        }
 
+       if (TEST_FAIL())
+               return -1;
+
        for (i = 0; i < AID_WORDS; i++) {
                if (hapd->sta_aid[i] == (u32) -1)
                        continue;
@@ -1729,6 +1804,12 @@ static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
        ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
                                    elems.supp_op_classes_len);
 
+       if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
+           elems.rrm_enabled &&
+           elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
+               os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
+                         sizeof(sta->rrm_enabled_capa));
+
        return WLAN_STATUS_SUCCESS;
 }
 
@@ -1791,7 +1872,8 @@ static int add_associated_sta(struct hostapd_data *hapd,
                            sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
                            sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
                            sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
-                           sta->vht_opmode, sta->added_unassoc)) {
+                           sta->vht_opmode, sta->p2p_ie ? 1 : 0,
+                           sta->added_unassoc)) {
                hostapd_logger(hapd, sta->addr,
                               HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
                               "Could not %s STA to kernel driver",
@@ -1863,7 +1945,23 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
 
 #ifdef CONFIG_IEEE80211AC
        if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
-               p = hostapd_eid_vht_capabilities(hapd, p);
+               u32 nsts = 0, sta_nsts;
+
+               if (hapd->conf->use_sta_nsts && sta->vht_capabilities) {
+                       struct ieee80211_vht_capabilities *capa;
+
+                       nsts = (hapd->iface->conf->vht_capab >>
+                               VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
+                       capa = sta->vht_capabilities;
+                       sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
+                                   VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
+
+                       if (nsts < sta_nsts)
+                               nsts = 0;
+                       else
+                               nsts = sta_nsts;
+               }
+               p = hostapd_eid_vht_capabilities(hapd, p, nsts);
                p = hostapd_eid_vht_operation(hapd, p);
        }
 #endif /* CONFIG_IEEE80211AC */
@@ -1933,6 +2031,14 @@ static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
 
        p = hostapd_eid_mbo(hapd, p, buf + sizeof(buf) - p);
 
+       if (hapd->conf->assocresp_elements &&
+           (size_t) (buf + sizeof(buf) - p) >=
+           wpabuf_len(hapd->conf->assocresp_elements)) {
+               os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
+                         wpabuf_len(hapd->conf->assocresp_elements));
+               p += wpabuf_len(hapd->conf->assocresp_elements);
+       }
+
        send_len += p - reply->u.assoc_resp.variable;
 
        if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
@@ -2073,6 +2179,12 @@ static void handle_assoc(struct hostapd_data *hapd,
        }
 #endif /* CONFIG_MBO */
 
+       /*
+        * sta->capability is used in check_assoc_ies() for RRM enabled
+        * capability element.
+        */
+       sta->capability = capab_info;
+
        /* followed by SSID and Supported rates; and HT capabilities if 802.11n
         * is used */
        resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
@@ -2086,7 +2198,6 @@ static void handle_assoc(struct hostapd_data *hapd,
                goto fail;
        }
 
-       sta->capability = capab_info;
        sta->listen_interval = listen_interval;
 
        if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
@@ -2156,6 +2267,10 @@ static void handle_assoc(struct hostapd_data *hapd,
         * remove the STA immediately. */
        sta->timeout_next = STA_NULLFUNC;
 
+#ifdef CONFIG_TAXONOMY
+       taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
+#endif /* CONFIG_TAXONOMY */
+
  fail:
        /*
         * In case of a successful response, add the station to the driver.
@@ -2453,6 +2568,9 @@ static int handle_action(struct hostapd_data *hapd,
                                return 1;
                }
                break;
+       case WLAN_ACTION_RADIO_MEASUREMENT:
+               hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
+               return 1;
        }
 
        hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
@@ -2460,8 +2578,9 @@ static int handle_action(struct hostapd_data *hapd,
                       "handle_action - unknown action category %d or invalid "
                       "frame",
                       mgmt->u.action.category);
-       if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
-           !(mgmt->sa[0] & 0x01)) {
+       if (!is_multicast_ether_addr(mgmt->da) &&
+           !(mgmt->u.action.category & 0x80) &&
+           !is_multicast_ether_addr(mgmt->sa)) {
                struct ieee80211_mgmt *resp;
 
                /*
@@ -2508,7 +2627,6 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
                    struct hostapd_frame_info *fi)
 {
        struct ieee80211_mgmt *mgmt;
-       int broadcast;
        u16 fc, stype;
        int ret = 0;
 
@@ -2524,11 +2642,7 @@ int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
                return 1;
        }
 
-       broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
-               mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
-               mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
-
-       if (!broadcast &&
+       if (!is_broadcast_ether_addr(mgmt->bssid) &&
 #ifdef CONFIG_P2P
            /* Invitation responses can be sent with the peer MAC as BSSID */
            !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
@@ -2782,6 +2896,25 @@ static void handle_assoc_cb(struct hostapd_data *hapd,
                wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
        hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
        ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
+
+       if (sta->pending_eapol_rx) {
+               struct os_reltime now, age;
+
+               os_get_reltime(&now);
+               os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
+               if (age.sec == 0 && age.usec < 200000) {
+                       wpa_printf(MSG_DEBUG,
+                                  "Process pending EAPOL frame that was received from " MACSTR " just before association notification",
+                                  MAC2STR(sta->addr));
+                       ieee802_1x_receive(
+                               hapd, mgmt->da,
+                               wpabuf_head(sta->pending_eapol_rx->buf),
+                               wpabuf_len(sta->pending_eapol_rx->buf));
+               }
+               wpabuf_free(sta->pending_eapol_rx->buf);
+               os_free(sta->pending_eapol_rx);
+               sta->pending_eapol_rx = NULL;
+       }
 }
 
 
@@ -2790,7 +2923,7 @@ static void handle_deauth_cb(struct hostapd_data *hapd,
                             size_t len, int ok)
 {
        struct sta_info *sta;
-       if (mgmt->da[0] & 0x01)
+       if (is_multicast_ether_addr(mgmt->da))
                return;
        sta = ap_get_sta(hapd, mgmt->da);
        if (!sta) {
@@ -2814,7 +2947,7 @@ static void handle_disassoc_cb(struct hostapd_data *hapd,
                               size_t len, int ok)
 {
        struct sta_info *sta;
-       if (mgmt->da[0] & 0x01)
+       if (is_multicast_ether_addr(mgmt->da))
                return;
        sta = ap_get_sta(hapd, mgmt->da);
        if (!sta) {
@@ -2979,6 +3112,8 @@ void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
        }
        if (sta == NULL)
                return;
+       wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
+               MAC2STR(sta->addr));
        if (!(sta->flags & WLAN_STA_PENDING_POLL))
                return;
 
@@ -3017,7 +3152,7 @@ void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
 
        wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
                   MACSTR, MAC2STR(src));
-       if (src[0] & 0x01) {
+       if (is_multicast_ether_addr(src)) {
                /* Broadcast bit set in SA?! Ignore the frame silently. */
                return;
        }