?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Use common driver code for Linux hwaddr get/set
[hostap-gosc2009.git] / wpa_supplicant / mlme.c
blob51db9ef6b818d9367fa56da68b92d4000a4454a6
1 /*
2 * WPA Supplicant - Client mode MLME
3 * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * Alternatively, this software may be distributed under the terms of BSD
12 * license.
13 *
14 * See README and COPYING for more details.
15 */
16
17 #include "includes.h"
18
19 #include "common.h"
20 #include "eloop.h"
21 #include "config_ssid.h"
22 #include "wpa_supplicant_i.h"
23 #include "notify.h"
24 #include "driver_i.h"
25 #include "rsn_supp/wpa.h"
26 #include "common/ieee802_11_defs.h"
27 #include "common/ieee802_11_common.h"
28 #include "mlme.h"
29
30
31 /* Timeouts and intervals in milliseconds */
32 #define IEEE80211_AUTH_TIMEOUT (200)
33 #define IEEE80211_AUTH_MAX_TRIES 3
34 #define IEEE80211_ASSOC_TIMEOUT (200)
35 #define IEEE80211_ASSOC_MAX_TRIES 3
36 #define IEEE80211_MONITORING_INTERVAL (2000)
37 #define IEEE80211_PROBE_INTERVAL (60000)
38 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
39 #define IEEE80211_SCAN_INTERVAL (2000)
40 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
41 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
42
43 #define IEEE80211_PROBE_DELAY (33)
44 #define IEEE80211_CHANNEL_TIME (33)
45 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
46 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
47 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
48 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
49
50 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
51
52
53 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
54
55
56 struct ieee80211_sta_bss {
57 struct ieee80211_sta_bss *next;
58 struct ieee80211_sta_bss *hnext;
59
60 u8 bssid[ETH_ALEN];
61 u8 ssid[MAX_SSID_LEN];
62 size_t ssid_len;
63 u16 capability; /* host byte order */
64 int hw_mode;
65 int channel;
66 int freq;
67 int rssi;
68 u8 *ie;
69 size_t ie_len;
70 u8 *wpa_ie;
71 size_t wpa_ie_len;
72 u8 *rsn_ie;
73 size_t rsn_ie_len;
74 u8 *wmm_ie;
75 size_t wmm_ie_len;
76 u8 *mdie;
77 size_t mdie_len;
78 #define IEEE80211_MAX_SUPP_RATES 32
79 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
80 size_t supp_rates_len;
81 int beacon_int;
82 u64 timestamp;
83
84 int probe_resp;
85 struct os_time last_update;
86 };
87
88
89 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
90 const u8 *dst,
91 const u8 *ssid, size_t ssid_len);
92 static struct ieee80211_sta_bss *
93 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
94 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
95 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
96 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
97 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
98 static void ieee80211_build_tspec(struct wpabuf *buf);
99 static int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s,
100 const u8 *ies, size_t ies_len);
101
102
103 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
104 enum hostapd_hw_mode phymode, int chan,
105 int freq)
106 {
107 size_t i;
108 struct hostapd_hw_modes *mode;
109
110 for (i = 0; i < wpa_s->mlme.num_modes; i++) {
111 mode = &wpa_s->mlme.modes[i];
112 if (mode->mode == phymode) {
113 wpa_s->mlme.curr_rates = mode->rates;
114 wpa_s->mlme.num_curr_rates = mode->num_rates;
115 break;
116 }
117 }
118
119 return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
120 }
121
122
123 static int ecw2cw(int ecw)
124 {
125 int cw = 1;
126 while (ecw > 0) {
127 cw <<= 1;
128 ecw--;
129 }
130 return cw - 1;
131 }
132
133
134 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
135 const u8 *wmm_param, size_t wmm_param_len)
136 {
137 size_t left;
138 int count;
139 const u8 *pos;
140 u8 wmm_acm;
141
142 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
143 return;
144 count = wmm_param[6] & 0x0f;
145 if (count == wpa_s->mlme.wmm_last_param_set)
146 return;
147 wpa_s->mlme.wmm_last_param_set = count;
148
149 pos = wmm_param + 8;
150 left = wmm_param_len - 8;
151
152 wmm_acm = 0;
153 for (; left >= 4; left -= 4, pos += 4) {
154 int aci = (pos[0] >> 5) & 0x03;
155 int acm = (pos[0] >> 4) & 0x01;
156 int aifs, cw_max, cw_min, burst_time;
157
158 switch (aci) {
159 case 1: /* AC_BK */
160 if (acm)
161 wmm_acm |= BIT(1) | BIT(2); /* BK/- */
162 break;
163 case 2: /* AC_VI */
164 if (acm)
165 wmm_acm |= BIT(4) | BIT(5); /* CL/VI */
166 break;
167 case 3: /* AC_VO */
168 if (acm)
169 wmm_acm |= BIT(6) | BIT(7); /* VO/NC */
170 break;
171 case 0: /* AC_BE */
172 default:
173 if (acm)
174 wmm_acm |= BIT(0) | BIT(3); /* BE/EE */
175 break;
176 }
177
178 aifs = pos[0] & 0x0f;
179 cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
180 cw_min = ecw2cw(pos[1] & 0x0f);
181 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
182 burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
183 wpa_printf(MSG_DEBUG, "MLME: WMM aci=%d acm=%d aifs=%d "
184 "cWmin=%d cWmax=%d burst=%d",
185 aci, acm, aifs, cw_min, cw_max, burst_time);
186 /* TODO: driver configuration */
187 }
188 }
189
190
191 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
192 {
193 if (wpa_s->mlme.associated == assoc && !assoc)
194 return;
195
196 wpa_s->mlme.associated = assoc;
197
198 if (assoc) {
199 union wpa_event_data data;
200 os_memset(&data, 0, sizeof(data));
201 wpa_s->mlme.prev_bssid_set = 1;
202 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
203 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
204 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
205 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
206 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
207 data.assoc_info.freq = wpa_s->mlme.freq;
208 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
209 } else {
210 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
211 }
212 os_get_time(&wpa_s->mlme.last_probe);
213 }
214
215
216 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
217 size_t len)
218 {
219 return wpa_drv_send_mlme(wpa_s, buf, len);
220 }
221
222
223 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
224 int transaction, const u8 *extra,
225 size_t extra_len, int encrypt)
226 {
227 u8 *buf;
228 size_t len;
229 struct ieee80211_mgmt *mgmt;
230
231 buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
232 if (buf == NULL) {
233 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
234 "auth frame");
235 return;
236 }
237
238 mgmt = (struct ieee80211_mgmt *) buf;
239 len = 24 + 6;
240 os_memset(mgmt, 0, 24 + 6);
241 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
242 WLAN_FC_STYPE_AUTH);
243 if (encrypt)
244 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
245 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
246 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
247 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
248 mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
249 mgmt->u.auth.auth_transaction = host_to_le16(transaction);
250 wpa_s->mlme.auth_transaction = transaction + 1;
251 mgmt->u.auth.status_code = host_to_le16(0);
252 if (extra) {
253 os_memcpy(buf + len, extra, extra_len);
254 len += extra_len;
255 }
256
257 ieee80211_sta_tx(wpa_s, buf, len);
258 os_free(buf);
259 }
260
261
262 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
263 {
264 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
265 eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
266 ieee80211_sta_timer, wpa_s, NULL);
267 }
268
269
270 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
271 {
272 u8 *extra;
273 size_t extra_len;
274
275 wpa_s->mlme.auth_tries++;
276 if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
277 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
278 " timed out", MAC2STR(wpa_s->bssid));
279 return;
280 }
281
282 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
283 wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
284 MAC2STR(wpa_s->bssid));
285
286 extra = NULL;
287 extra_len = 0;
288
289 #ifdef CONFIG_IEEE80211R
290 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
291 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
292 wpa_s->mlme.ft_ies) {
293 struct ieee80211_sta_bss *bss;
294 struct rsn_mdie *mdie = NULL;
295 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
296 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
297 mdie = (struct rsn_mdie *) (bss->mdie + 2);
298 if (mdie &&
299 os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
300 MOBILITY_DOMAIN_ID_LEN) == 0) {
301 wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
302 "over-the-air");
303 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
304 extra = wpa_s->mlme.ft_ies;
305 extra_len = wpa_s->mlme.ft_ies_len;
306 }
307 }
308 #endif /* CONFIG_IEEE80211R */
309
310 ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
311
312 ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
313 }
314
315
316 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
317 {
318 struct ieee80211_mgmt *mgmt;
319 u8 *pos, *ies, *buf;
320 int i, len;
321 u16 capab;
322 struct ieee80211_sta_bss *bss;
323 int wmm = 0;
324 size_t blen, buflen;
325
326 if (wpa_s->mlme.curr_rates == NULL) {
327 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
328 return;
329 }
330
331 buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
332 wpa_s->mlme.ssid_len;
333 #ifdef CONFIG_IEEE80211R
334 if (wpa_s->mlme.ft_ies)
335 buflen += wpa_s->mlme.ft_ies_len;
336 #endif /* CONFIG_IEEE80211R */
337 buf = os_malloc(buflen);
338 if (buf == NULL) {
339 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
340 "assoc frame");
341 return;
342 }
343 blen = 0;
344
345 capab = wpa_s->mlme.capab;
346 if (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G) {
347 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
348 WLAN_CAPABILITY_SHORT_PREAMBLE;
349 }
350 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
351 if (bss) {
352 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
353 capab |= WLAN_CAPABILITY_PRIVACY;
354 if (bss->wmm_ie) {
355 wmm = 1;
356 }
357 }
358
359 mgmt = (struct ieee80211_mgmt *) buf;
360 blen += 24;
361 os_memset(mgmt, 0, 24);
362 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
363 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
364 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
365
366 if (wpa_s->mlme.prev_bssid_set) {
367 blen += 10;
368 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
369 WLAN_FC_STYPE_REASSOC_REQ);
370 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
371 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
372 os_memcpy(mgmt->u.reassoc_req.current_ap,
373 wpa_s->mlme.prev_bssid,
374 ETH_ALEN);
375 } else {
376 blen += 4;
377 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
378 WLAN_FC_STYPE_ASSOC_REQ);
379 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
380 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
381 }
382
383 /* SSID */
384 ies = pos = buf + blen;
385 blen += 2 + wpa_s->mlme.ssid_len;
386 *pos++ = WLAN_EID_SSID;
387 *pos++ = wpa_s->mlme.ssid_len;
388 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
389
390 len = wpa_s->mlme.num_curr_rates;
391 if (len > 8)
392 len = 8;
393 pos = buf + blen;
394 blen += len + 2;
395 *pos++ = WLAN_EID_SUPP_RATES;
396 *pos++ = len;
397 for (i = 0; i < len; i++)
398 *pos++ = (u8) (wpa_s->mlme.curr_rates[i] / 5);
399
400 if (wpa_s->mlme.num_curr_rates > len) {
401 pos = buf + blen;
402 blen += wpa_s->mlme.num_curr_rates - len + 2;
403 *pos++ = WLAN_EID_EXT_SUPP_RATES;
404 *pos++ = wpa_s->mlme.num_curr_rates - len;
405 for (i = len; i < wpa_s->mlme.num_curr_rates; i++)
406 *pos++ = (u8) (wpa_s->mlme.curr_rates[i] / 5);
407 }
408
409 if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
410 pos = buf + blen;
411 blen += wpa_s->mlme.extra_ie_len;
412 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
413 }
414
415 #ifdef CONFIG_IEEE80211R
416 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
417 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
418 wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
419 bss && bss->mdie &&
420 bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
421 bss->mdie[1] >= sizeof(struct rsn_mdie)) {
422 pos = buf + blen;
423 blen += 2 + sizeof(struct rsn_mdie);
424 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
425 *pos++ = sizeof(struct rsn_mdie);
426 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
427 pos += MOBILITY_DOMAIN_ID_LEN;
428 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
429 }
430
431 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
432 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
433 wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
434 pos = buf + blen;
435 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
436 pos += wpa_s->mlme.ft_ies_len;
437 blen += wpa_s->mlme.ft_ies_len;
438 }
439 #endif /* CONFIG_IEEE80211R */
440
441 if (wmm && wpa_s->mlme.wmm_enabled) {
442 pos = buf + blen;
443 blen += 9;
444 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
445 *pos++ = 7; /* len */
446 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
447 *pos++ = 0x50;
448 *pos++ = 0xf2;
449 *pos++ = 2; /* WMM */
450 *pos++ = 0; /* WMM info */
451 *pos++ = 1; /* WMM ver */
452 *pos++ = 0;
453 }
454
455 os_free(wpa_s->mlme.assocreq_ies);
456 wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
457 wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
458 if (wpa_s->mlme.assocreq_ies) {
459 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
460 wpa_s->mlme.assocreq_ies_len);
461 }
462
463 ieee80211_sta_tx(wpa_s, buf, blen);
464 os_free(buf);
465 }
466
467
468 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
469 {
470 u8 *buf;
471 size_t len;
472 struct ieee80211_mgmt *mgmt;
473
474 buf = os_zalloc(sizeof(*mgmt));
475 if (buf == NULL) {
476 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
477 "deauth frame");
478 return;
479 }
480
481 mgmt = (struct ieee80211_mgmt *) buf;
482 len = 24;
483 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
484 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
485 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
486 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
487 WLAN_FC_STYPE_DEAUTH);
488 len += 2;
489 mgmt->u.deauth.reason_code = host_to_le16(reason);
490
491 ieee80211_sta_tx(wpa_s, buf, len);
492 os_free(buf);
493 }
494
495
496 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
497 {
498 u8 *buf;
499 size_t len;
500 struct ieee80211_mgmt *mgmt;
501
502 buf = os_zalloc(sizeof(*mgmt));
503 if (buf == NULL) {
504 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
505 "disassoc frame");
506 return;
507 }
508
509 mgmt = (struct ieee80211_mgmt *) buf;
510 len = 24;
511 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
512 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
513 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
514 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
515 WLAN_FC_STYPE_DISASSOC);
516 len += 2;
517 mgmt->u.disassoc.reason_code = host_to_le16(reason);
518
519 ieee80211_sta_tx(wpa_s, buf, len);
520 os_free(buf);
521 }
522
523
524 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
525 {
526 struct ieee80211_sta_bss *bss;
527 int res = 0;
528
529 if (wpa_s->mlme.mixed_cell ||
530 wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
531 return 0;
532
533 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
534 if (bss == NULL)
535 return 0;
536
537 if (ieee80211_sta_wep_configured(wpa_s) !=
538 !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
539 res = 1;
540
541 return res;
542 }
543
544
545 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
546 {
547 wpa_s->mlme.assoc_tries++;
548 if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
549 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
550 " timed out", MAC2STR(wpa_s->bssid));
551 return;
552 }
553
554 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
555 wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
556 MAC2STR(wpa_s->bssid));
557 if (ieee80211_privacy_mismatch(wpa_s)) {
558 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
559 "configuration and mixed-cell disabled - abort "
560 "association");
561 return;
562 }
563
564 ieee80211_send_assoc(wpa_s);
565
566 ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
567 }
568
569
570 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
571 {
572 int disassoc;
573
574 /* TODO: start monitoring current AP signal quality and number of
575 * missed beacons. Scan other channels every now and then and search
576 * for better APs. */
577 /* TODO: remove expired BSSes */
578
579 wpa_s->mlme.state = IEEE80211_ASSOCIATED;
580
581 #if 0 /* FIX */
582 sta = sta_info_get(local, wpa_s->bssid);
583 if (sta == NULL) {
584 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
585 MAC2STR(wpa_s->bssid));
586 disassoc = 1;
587 } else {
588 disassoc = 0;
589 if (time_after(jiffies,
590 sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
591 if (wpa_s->mlme.probereq_poll) {
592 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
593 "current AP " MACSTR " - assume "
594 "out of range",
595 MAC2STR(wpa_s->bssid));
596 disassoc = 1;
597 } else {
598 ieee80211_send_probe_req(
599 wpa_s->bssid,
600 wpa_s->mlme.scan_ssid,
601 wpa_s->mlme.scan_ssid_len);
602 wpa_s->mlme.probereq_poll = 1;
603 }
604 } else {
605 wpa_s->mlme.probereq_poll = 0;
606 if (time_after(jiffies, wpa_s->mlme.last_probe +
607 IEEE80211_PROBE_INTERVAL)) {
608 wpa_s->mlme.last_probe = jiffies;
609 ieee80211_send_probe_req(wpa_s->bssid,
610 wpa_s->mlme.ssid,
611 wpa_s->mlme.ssid_len);
612 }
613 }
614 sta_info_release(local, sta);
615 }
616 #else
617 disassoc = 0;
618 #endif
619 if (disassoc) {
620 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
621 ieee80211_reschedule_timer(wpa_s,
622 IEEE80211_MONITORING_INTERVAL +
623 30000);
624 } else {
625 ieee80211_reschedule_timer(wpa_s,
626 IEEE80211_MONITORING_INTERVAL);
627 }
628 }
629
630
631 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
632 const u8 *dst,
633 const u8 *ssid, size_t ssid_len)
634 {
635 u8 *buf;
636 size_t len;
637 struct ieee80211_mgmt *mgmt;
638 u8 *pos, *supp_rates;
639 u8 *esupp_rates = NULL;
640 int i;
641
642 buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
643 if (buf == NULL) {
644 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
645 "probe request");
646 return;
647 }
648
649 mgmt = (struct ieee80211_mgmt *) buf;
650 len = 24;
651 os_memset(mgmt, 0, 24);
652 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
653 WLAN_FC_STYPE_PROBE_REQ);
654 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
655 if (dst) {
656 os_memcpy(mgmt->da, dst, ETH_ALEN);
657 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
658 } else {
659 os_memset(mgmt->da, 0xff, ETH_ALEN);
660 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
661 }
662 pos = buf + len;
663 len += 2 + ssid_len;
664 *pos++ = WLAN_EID_SSID;
665 *pos++ = ssid_len;
666 os_memcpy(pos, ssid, ssid_len);
667
668 supp_rates = buf + len;
669 len += 2;
670 supp_rates[0] = WLAN_EID_SUPP_RATES;
671 supp_rates[1] = 0;
672 for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
673 if (esupp_rates) {
674 pos = buf + len;
675 len++;
676 esupp_rates[1]++;
677 } else if (supp_rates[1] == 8) {
678 esupp_rates = pos;
679 esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
680 esupp_rates[1] = 1;
681 pos = &esupp_rates[2];
682 len += 3;
683 } else {
684 pos = buf + len;
685 len++;
686 supp_rates[1]++;
687 }
688 *pos++ = wpa_s->mlme.curr_rates[i] / 5;
689 }
690
691 if (wpa_s->mlme.extra_probe_ie) {
692 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
693 wpa_s->mlme.extra_probe_ie_len);
694 len += wpa_s->mlme.extra_probe_ie_len;
695 }
696
697 ieee80211_sta_tx(wpa_s, buf, len);
698 os_free(buf);
699 }
700
701
702 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
703 {
704 #if 0 /* FIX */
705 if (sdata == NULL || sdata->default_key == NULL ||
706 sdata->default_key->alg != ALG_WEP)
707 return 0;
708 return 1;
709 #else
710 return 0;
711 #endif
712 }
713
714
715 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
716 {
717 wpa_printf(MSG_DEBUG, "MLME: authenticated");
718 wpa_s->mlme.authenticated = 1;
719 ieee80211_associate(wpa_s);
720 }
721
722
723 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
724 struct ieee80211_mgmt *mgmt,
725 size_t len,
726 struct ieee80211_rx_status *rx_status)
727 {
728 u8 *pos;
729 struct ieee802_11_elems elems;
730
731 wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
732 pos = mgmt->u.auth.variable;
733 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
734 == ParseFailed) {
735 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
736 return;
737 }
738 if (elems.challenge == NULL) {
739 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
740 "auth frame");
741 return;
742 }
743 ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
744 elems.challenge_len + 2, 1);
745 }
746
747
748 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
749 struct ieee80211_mgmt *mgmt,
750 size_t len,
751 struct ieee80211_rx_status *rx_status)
752 {
753 struct wpa_ssid *ssid = wpa_s->current_ssid;
754 u16 auth_alg, auth_transaction, status_code;
755 int adhoc;
756
757 adhoc = ssid && ssid->mode == WPAS_MODE_IBSS;
758
759 if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
760 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
761 "from " MACSTR ", but not in authenticate state - "
762 "ignored", MAC2STR(mgmt->sa));
763 return;
764 }
765
766 if (len < 24 + 6) {
767 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
768 "frame received from " MACSTR " - ignored",
769 (unsigned long) len, MAC2STR(mgmt->sa));
770 return;
771 }
772
773 if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
774 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
775 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
776 ") - ignored",
777 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
778 return;
779 }
780
781 if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
782 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
783 "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
784 ") - ignored",
785 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
786 return;
787 }
788
789 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
790 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
791 status_code = le_to_host16(mgmt->u.auth.status_code);
792
793 wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
794 " (alg=%d transaction=%d status=%d)",
795 MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
796
797 if (adhoc) {
798 /* IEEE 802.11 standard does not require authentication in IBSS
799 * networks and most implementations do not seem to use it.
800 * However, try to reply to authentication attempts if someone
801 * has actually implemented this.
802 * TODO: Could implement shared key authentication. */
803 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
804 wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
805 "authentication frame (alg=%d "
806 "transaction=%d)",
807 auth_alg, auth_transaction);
808 return;
809 }
810 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
811 }
812
813 if (auth_alg != wpa_s->mlme.auth_alg ||
814 auth_transaction != wpa_s->mlme.auth_transaction) {
815 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
816 "(alg=%d transaction=%d)",
817 auth_alg, auth_transaction);
818 return;
819 }
820
821 if (status_code != WLAN_STATUS_SUCCESS) {
822 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
823 "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
824 status_code);
825 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
826 const int num_algs = 3;
827 u8 algs[num_algs];
828 int i, pos;
829 algs[0] = algs[1] = algs[2] = 0xff;
830 if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_OPEN)
831 algs[0] = WLAN_AUTH_OPEN;
832 if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_SHARED)
833 algs[1] = WLAN_AUTH_SHARED_KEY;
834 if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_LEAP)
835 algs[2] = WLAN_AUTH_LEAP;
836 if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
837 pos = 0;
838 else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
839 pos = 1;
840 else
841 pos = 2;
842 for (i = 0; i < num_algs; i++) {
843 pos++;
844 if (pos >= num_algs)
845 pos = 0;
846 if (algs[pos] == wpa_s->mlme.auth_alg ||
847 algs[pos] == 0xff)
848 continue;
849 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
850 !ieee80211_sta_wep_configured(wpa_s))
851 continue;
852 wpa_s->mlme.auth_alg = algs[pos];
853 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
854 "for next try",
855 wpa_s->mlme.auth_alg);
856 break;
857 }
858 }
859 return;
860 }
861
862 switch (wpa_s->mlme.auth_alg) {
863 case WLAN_AUTH_OPEN:
864 case WLAN_AUTH_LEAP:
865 ieee80211_auth_completed(wpa_s);
866 break;
867 case WLAN_AUTH_SHARED_KEY:
868 if (wpa_s->mlme.auth_transaction == 4)
869 ieee80211_auth_completed(wpa_s);
870 else
871 ieee80211_auth_challenge(wpa_s, mgmt, len,
872 rx_status);
873 break;
874 #ifdef CONFIG_IEEE80211R
875 case WLAN_AUTH_FT:
876 {
877 union wpa_event_data data;
878 struct wpabuf *ric = NULL;
879 os_memset(&data, 0, sizeof(data));
880 data.ft_ies.ies = mgmt->u.auth.variable;
881 data.ft_ies.ies_len = len -
882 (mgmt->u.auth.variable - (u8 *) mgmt);
883 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
884 if (os_strcmp(wpa_s->driver->name, "test") == 0 &&
885 wpa_s->mlme.wmm_enabled) {
886 ric = wpabuf_alloc(200);
887 if (ric) {
888 /* Build simple RIC-Request: RDIE | TSPEC */
889
890 /* RIC Data (RDIE) */
891 wpabuf_put_u8(ric, WLAN_EID_RIC_DATA);
892 wpabuf_put_u8(ric, 4);
893 wpabuf_put_u8(ric, 0); /* RDIE Identifier */
894 wpabuf_put_u8(ric, 1); /* Resource Descriptor
895 * Count */
896 wpabuf_put_le16(ric, 0); /* Status Code */
897
898 /* WMM TSPEC */
899 ieee80211_build_tspec(ric);
900
901 data.ft_ies.ric_ies = wpabuf_head(ric);
902 data.ft_ies.ric_ies_len = wpabuf_len(ric);
903 }
904 }
905
906 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
907 wpabuf_free(ric);
908 ieee80211_auth_completed(wpa_s);
909 break;
910 }
911 #endif /* CONFIG_IEEE80211R */
912 }
913 }
914
915
916 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
917 struct ieee80211_mgmt *mgmt,
918 size_t len,
919 struct ieee80211_rx_status *rx_status)
920 {
921 u16 reason_code;
922
923 if (len < 24 + 2) {
924 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
925 "frame received from " MACSTR " - ignored",
926 (unsigned long) len, MAC2STR(mgmt->sa));
927 return;
928 }
929
930 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
931 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
932 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
933 ") - ignored",
934 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
935 return;
936 }
937
938 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
939
940 wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
941 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
942
943 if (wpa_s->mlme.authenticated)
944 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
945
946 if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
947 wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
948 wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
949 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
950 ieee80211_reschedule_timer(wpa_s,
951 IEEE80211_RETRY_AUTH_INTERVAL);
952 }
953
954 ieee80211_set_associated(wpa_s, 0);
955 wpa_s->mlme.authenticated = 0;
956 }
957
958
959 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
960 struct ieee80211_mgmt *mgmt,
961 size_t len,
962 struct ieee80211_rx_status *rx_status)
963 {
964 u16 reason_code;
965
966 if (len < 24 + 2) {
967 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
968 "frame received from " MACSTR " - ignored",
969 (unsigned long) len, MAC2STR(mgmt->sa));
970 return;
971 }
972
973 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
974 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
975 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
976 ") - ignored",
977 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
978 return;
979 }
980
981 reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
982
983 wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
984 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
985
986 if (wpa_s->mlme.associated)
987 wpa_printf(MSG_DEBUG, "MLME: disassociated");
988
989 if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
990 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
991 ieee80211_reschedule_timer(wpa_s,
992 IEEE80211_RETRY_AUTH_INTERVAL);
993 }
994
995 ieee80211_set_associated(wpa_s, 0);
996 }
997
998
999 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1000 struct ieee802_11_elems *elems)
1001 {
1002 #ifdef CONFIG_IEEE80211R
1003 const u8 *mobility_domain = NULL;
1004 const u8 *r0kh_id = NULL;
1005 size_t r0kh_id_len = 0;
1006 const u8 *r1kh_id = NULL;
1007 struct rsn_ftie *hdr;
1008 const u8 *pos, *end;
1009
1010 if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1011 mobility_domain = elems->mdie;
1012 if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1013 end = elems->ftie + elems->ftie_len;
1014 hdr = (struct rsn_ftie *) elems->ftie;
1015 pos = (const u8 *) (hdr + 1);
1016 while (pos + 1 < end) {
1017 if (pos + 2 + pos[1] > end)
1018 break;
1019 if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1020 pos[1] == FT_R1KH_ID_LEN)
1021 r1kh_id = pos + 2;
1022 else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1023 pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1024 r0kh_id = pos + 2;
1025 r0kh_id_len = pos[1];
1026 }
1027 pos += 2 + pos[1];
1028 }
1029 }
1030 return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1031 r0kh_id_len, r1kh_id);
1032 #else /* CONFIG_IEEE80211R */
1033 return 0;
1034 #endif /* CONFIG_IEEE80211R */
1035 }
1036
1037
1038 static void ieee80211_build_tspec(struct wpabuf *buf)
1039 {
1040 struct wmm_tspec_element *tspec;
1041 int tid, up;
1042
1043 tspec = wpabuf_put(buf, sizeof(*tspec));
1044 tspec->eid = WLAN_EID_VENDOR_SPECIFIC;
1045 tspec->length = sizeof(*tspec) - 2;
1046 tspec->oui[0] = 0x00;
1047 tspec->oui[1] = 0x50;
1048 tspec->oui[2] = 0xf2;
1049 tspec->oui_type = 2;
1050 tspec->oui_subtype = 2;
1051 tspec->version = 1;
1052
1053 tid = 1;
1054 up = 6; /* Voice */
1055 tspec->ts_info[0] = (tid << 1) |
1056 (WMM_TSPEC_DIRECTION_BI_DIRECTIONAL << 5) |
1057 BIT(7);
1058 tspec->ts_info[1] = up << 3;
1059 tspec->nominal_msdu_size = host_to_le16(1530);
1060 tspec->mean_data_rate = host_to_le32(128000); /* bits per second */
1061 tspec->minimum_phy_rate = host_to_le32(6000000);
1062 tspec->surplus_bandwidth_allowance = host_to_le16(0x3000); /* 150% */
1063 }
1064
1065
1066 static void ieee80211_tx_addts(struct wpa_supplicant *wpa_s)
1067 {
1068 struct wpabuf *buf;
1069 struct ieee80211_mgmt *mgmt;
1070 size_t alen;
1071
1072 wpa_printf(MSG_DEBUG, "MLME: Send ADDTS Request for Voice TSPEC");
1073 mgmt = NULL;
1074 alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1075
1076 buf = wpabuf_alloc(alen + sizeof(struct wmm_tspec_element));
1077 if (buf == NULL)
1078 return;
1079
1080 mgmt = wpabuf_put(buf, alen);
1081 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
1082 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1083 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1084 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1085 WLAN_FC_STYPE_ACTION);
1086 mgmt->u.action.category = WLAN_ACTION_WMM;
1087 mgmt->u.action.u.wmm_action.action_code = WMM_ACTION_CODE_ADDTS_REQ;
1088 mgmt->u.action.u.wmm_action.dialog_token = 1;
1089 mgmt->u.action.u.wmm_action.status_code = 0;
1090
1091 ieee80211_build_tspec(buf);
1092
1093 ieee80211_sta_tx(wpa_s, wpabuf_head(buf), wpabuf_len(buf));
1094 wpabuf_free(buf);
1095 }
1096
1097
1098 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1099 struct ieee80211_mgmt *mgmt,
1100 size_t len,
1101 struct ieee80211_rx_status *rx_status,
1102 int reassoc)
1103 {
1104 u8 rates[32];
1105 size_t rates_len;
1106 u16 capab_info, status_code, aid;
1107 struct ieee802_11_elems elems;
1108 u8 *pos;
1109
1110 /* AssocResp and ReassocResp have identical structure, so process both
1111 * of them in this function. */
1112
1113 if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1114 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1115 MACSTR ", but not in associate state - ignored",
1116 MAC2STR(mgmt->sa));
1117 return;
1118 }
1119
1120 if (len < 24 + 6) {
1121 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1122 "frame received from " MACSTR " - ignored",
1123 (unsigned long) len, MAC2STR(mgmt->sa));
1124 return;
1125 }
1126
1127 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1128 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1129 "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1130 "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1131 return;
1132 }
1133
1134 capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1135 status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1136 aid = le_to_host16(mgmt->u.assoc_resp.aid);
1137 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1138 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1139 "not set", aid);
1140 aid &= ~(BIT(15) | BIT(14));
1141
1142 wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1143 " (capab=0x%x status=%d aid=%d)",
1144 reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1145 capab_info, status_code, aid);
1146
1147 pos = mgmt->u.assoc_resp.variable;
1148 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1149 == ParseFailed) {
1150 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1151 return;
1152 }
1153
1154 if (status_code != WLAN_STATUS_SUCCESS) {
1155 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1156 status_code);
1157 #ifdef CONFIG_IEEE80211W
1158 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1159 elems.timeout_int && elems.timeout_int_len == 5 &&
1160 elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1161 u32 tu, ms;
1162 tu = WPA_GET_LE32(elems.timeout_int + 1);
1163 ms = tu * 1024 / 1000;
1164 wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1165 "temporarily; comeback duration %u TU "
1166 "(%u ms)", tu, ms);
1167 if (ms > IEEE80211_ASSOC_TIMEOUT) {
1168 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1169 "based on comeback duration");
1170 ieee80211_reschedule_timer(wpa_s, ms);
1171 }
1172 }
1173 #endif /* CONFIG_IEEE80211W */
1174 return;
1175 }
1176
1177 if (elems.supp_rates == NULL) {
1178 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1179 "AssocResp");
1180 return;
1181 }
1182
1183 if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1184 if (!reassoc) {
1185 wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1186 "association, not reassociation, response "
1187 "with FT");
1188 return;
1189 }
1190 if (wpa_ft_validate_reassoc_resp(
1191 wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1192 mgmt->sa) < 0) {
1193 wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1194 "Resp failed");
1195 return;
1196 }
1197 } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1198 return;
1199
1200 wpa_printf(MSG_DEBUG, "MLME: associated");
1201 wpa_s->mlme.aid = aid;
1202 wpa_s->mlme.ap_capab = capab_info;
1203
1204 os_free(wpa_s->mlme.assocresp_ies);
1205 wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1206 wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1207 if (wpa_s->mlme.assocresp_ies) {
1208 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1209 wpa_s->mlme.assocresp_ies_len);
1210 }
1211
1212 ieee80211_set_associated(wpa_s, 1);
1213
1214 rates_len = elems.supp_rates_len;
1215 if (rates_len > sizeof(rates))
1216 rates_len = sizeof(rates);
1217 os_memcpy(rates, elems.supp_rates, rates_len);
1218 if (elems.ext_supp_rates) {
1219 size_t _len = elems.ext_supp_rates_len;
1220 if (_len > sizeof(rates) - rates_len)
1221 _len = sizeof(rates) - rates_len;
1222 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1223 rates_len += _len;
1224 }
1225
1226 if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1227 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1228 "netstack");
1229 }
1230 if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1231 0) {
1232 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1233 "netstack");
1234 }
1235
1236 /* Remove STA entry before adding a new one just in case to avoid
1237 * problems with existing configuration (e.g., keys). */
1238 wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1239 if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1240 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1241 "netstack");
1242 }
1243
1244 if (elems.wmm && wpa_s->mlme.wmm_enabled)
1245 ieee80211_sta_wmm_params(wpa_s, elems.wmm, elems.wmm_len);
1246
1247 ieee80211_associated(wpa_s);
1248
1249 if (wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
1250 os_strcmp(wpa_s->driver->name, "test") == 0 &&
1251 elems.wmm && wpa_s->mlme.wmm_enabled) {
1252 /* Test WMM-AC - send ADDTS for WMM TSPEC */
1253 ieee80211_tx_addts(wpa_s);
1254 }
1255 }
1256
1257
1258 /* Caller must hold local->sta_bss_lock */
1259 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1260 struct ieee80211_sta_bss *bss)
1261 {
1262 bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1263 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1264 }
1265
1266
1267 /* Caller must hold local->sta_bss_lock */
1268 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1269 struct ieee80211_sta_bss *bss)
1270 {
1271 struct ieee80211_sta_bss *b, *prev = NULL;
1272 b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1273 while (b) {
1274 if (b == bss) {
1275 if (prev == NULL) {
1276 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1277 = bss->hnext;
1278 } else {
1279 prev->hnext = bss->hnext;
1280 }
1281 break;
1282 }
1283 prev = b;
1284 b = b->hnext;
1285 }
1286 }
1287
1288
1289 static struct ieee80211_sta_bss *
1290 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1291 {
1292 struct ieee80211_sta_bss *bss;
1293
1294 bss = os_zalloc(sizeof(*bss));
1295 if (bss == NULL)
1296 return NULL;
1297 os_memcpy(bss->bssid, bssid, ETH_ALEN);
1298
1299 /* TODO: order by RSSI? */
1300 bss->next = wpa_s->mlme.sta_bss_list;
1301 wpa_s->mlme.sta_bss_list = bss;
1302 __ieee80211_bss_hash_add(wpa_s, bss);
1303 return bss;
1304 }
1305
1306
1307 static struct ieee80211_sta_bss *
1308 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1309 {
1310 struct ieee80211_sta_bss *bss;
1311
1312 bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1313 while (bss) {
1314 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1315 break;
1316 bss = bss->hnext;
1317 }
1318 return bss;
1319 }
1320
1321
1322 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1323 struct ieee80211_sta_bss *bss)
1324 {
1325 __ieee80211_bss_hash_del(wpa_s, bss);
1326 os_free(bss->ie);
1327 os_free(bss->wpa_ie);
1328 os_free(bss->rsn_ie);
1329 os_free(bss->wmm_ie);
1330 os_free(bss->mdie);
1331 os_free(bss);
1332 }
1333
1334
1335 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1336 {
1337 struct ieee80211_sta_bss *bss, *prev;
1338
1339 bss = wpa_s->mlme.sta_bss_list;
1340 wpa_s->mlme.sta_bss_list = NULL;
1341 while (bss) {
1342 prev = bss;
1343 bss = bss->next;
1344 ieee80211_bss_free(wpa_s, prev);
1345 }
1346 }
1347
1348
1349 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1350 struct ieee80211_mgmt *mgmt,
1351 size_t len,
1352 struct ieee80211_rx_status *rx_status,
1353 int beacon)
1354 {
1355 struct ieee802_11_elems elems;
1356 size_t baselen;
1357 int channel, invalid = 0, clen;
1358 struct ieee80211_sta_bss *bss;
1359 u64 timestamp;
1360 u8 *pos, *ie_pos;
1361 size_t ie_len;
1362
1363 if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1364 return; /* ignore ProbeResp to foreign address */
1365
1366 #if 0
1367 wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1368 beacon ? "Beacon" : "Probe Response",
1369 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1370 #endif
1371
1372 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1373 if (baselen > len)
1374 return;
1375
1376 pos = mgmt->u.beacon.timestamp;
1377 timestamp = WPA_GET_LE64(pos);
1378
1379 #if 0 /* FIX */
1380 if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1381 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1382 #ifdef IEEE80211_IBSS_DEBUG
1383 static unsigned long last_tsf_debug = 0;
1384 u64 tsf;
1385 if (local->hw->get_tsf)
1386 tsf = local->hw->get_tsf(local->mdev);
1387 else
1388 tsf = -1LLU;
1389 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1390 wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1391 MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1392 "@%ld",
1393 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1394 tsf, timestamp, tsf - timestamp, jiffies);
1395 last_tsf_debug = jiffies;
1396 }
1397 #endif /* IEEE80211_IBSS_DEBUG */
1398 }
1399 #endif
1400
1401 ie_pos = mgmt->u.beacon.variable;
1402 ie_len = len - baselen;
1403 if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1404 invalid = 1;
1405
1406 #if 0 /* FIX */
1407 if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1408 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1409 (sta = sta_info_get(local, mgmt->sa))) {
1410 struct ieee80211_rate *rates;
1411 size_t num_rates;
1412 u32 supp_rates, prev_rates;
1413 int i, j, oper_mode;
1414
1415 rates = local->curr_rates;
1416 num_rates = local->num_curr_rates;
1417 oper_mode = wpa_s->mlme.sta_scanning ?
1418 local->scan_oper_phymode : local->conf.phymode;
1419 for (i = 0; i < local->hw->num_modes; i++) {
1420 struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1421 if (oper_mode == mode->mode) {
1422 rates = mode->rates;
1423 num_rates = mode->num_rates;
1424 break;
1425 }
1426 }
1427
1428 supp_rates = 0;
1429 for (i = 0; i < elems.supp_rates_len +
1430 elems.ext_supp_rates_len; i++) {
1431 u8 rate = 0;
1432 int own_rate;
1433 if (i < elems.supp_rates_len)
1434 rate = elems.supp_rates[i];
1435 else if (elems.ext_supp_rates)
1436 rate = elems.ext_supp_rates
1437 [i - elems.supp_rates_len];
1438 own_rate = 5 * (rate & 0x7f);
1439 if (oper_mode == MODE_ATHEROS_TURBO)
1440 own_rate *= 2;
1441 for (j = 0; j < num_rates; j++)
1442 if (rates[j].rate == own_rate)
1443 supp_rates |= BIT(j);
1444 }
1445
1446 prev_rates = sta->supp_rates;
1447 sta->supp_rates &= supp_rates;
1448 if (sta->supp_rates == 0) {
1449 /* No matching rates - this should not really happen.
1450 * Make sure that at least one rate is marked
1451 * supported to avoid issues with TX rate ctrl. */
1452 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1453 }
1454 if (sta->supp_rates != prev_rates) {
1455 wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1456 "for " MACSTR " based on beacon info "
1457 "(0x%x & 0x%x -> 0x%x)",
1458 MAC2STR(sta->addr), prev_rates,
1459 supp_rates, sta->supp_rates);
1460 }
1461 sta_info_release(local, sta);
1462 }
1463 #endif
1464
1465 if (elems.ssid == NULL)
1466 return;
1467
1468 if (elems.ds_params && elems.ds_params_len == 1)
1469 channel = elems.ds_params[0];
1470 else
1471 channel = rx_status->channel;
1472
1473 bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1474 if (bss == NULL) {
1475 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1476 if (bss == NULL)
1477 return;
1478 } else {
1479 #if 0
1480 /* TODO: order by RSSI? */
1481 spin_lock_bh(&local->sta_bss_lock);
1482 list_move_tail(&bss->list, &local->sta_bss_list);
1483 spin_unlock_bh(&local->sta_bss_lock);
1484 #endif
1485 }
1486
1487 if (bss->probe_resp && beacon) {
1488 /* Do not allow beacon to override data from Probe Response. */
1489 return;
1490 }
1491
1492 bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1493 bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1494
1495 if (bss->ie == NULL || bss->ie_len < ie_len) {
1496 os_free(bss->ie);
1497 bss->ie = os_malloc(ie_len);
1498 }
1499 if (bss->ie) {
1500 os_memcpy(bss->ie, ie_pos, ie_len);
1501 bss->ie_len = ie_len;
1502 }
1503
1504 if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1505 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1506 bss->ssid_len = elems.ssid_len;
1507 }
1508
1509 bss->supp_rates_len = 0;
1510 if (elems.supp_rates) {
1511 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1512 if (clen > elems.supp_rates_len)
1513 clen = elems.supp_rates_len;
1514 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1515 elems.supp_rates, clen);
1516 bss->supp_rates_len += clen;
1517 }
1518 if (elems.ext_supp_rates) {
1519 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1520 if (clen > elems.ext_supp_rates_len)
1521 clen = elems.ext_supp_rates_len;
1522 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1523 elems.ext_supp_rates, clen);
1524 bss->supp_rates_len += clen;
1525 }
1526
1527 if (elems.wpa_ie &&
1528 (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1529 os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1530 os_free(bss->wpa_ie);
1531 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1532 if (bss->wpa_ie) {
1533 os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1534 elems.wpa_ie_len + 2);
1535 bss->wpa_ie_len = elems.wpa_ie_len + 2;
1536 } else
1537 bss->wpa_ie_len = 0;
1538 } else if (!elems.wpa_ie && bss->wpa_ie) {
1539 os_free(bss->wpa_ie);
1540 bss->wpa_ie = NULL;
1541 bss->wpa_ie_len = 0;
1542 }
1543
1544 if (elems.rsn_ie &&
1545 (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1546 os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1547 os_free(bss->rsn_ie);
1548 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1549 if (bss->rsn_ie) {
1550 os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1551 elems.rsn_ie_len + 2);
1552 bss->rsn_ie_len = elems.rsn_ie_len + 2;
1553 } else
1554 bss->rsn_ie_len = 0;
1555 } else if (!elems.rsn_ie && bss->rsn_ie) {
1556 os_free(bss->rsn_ie);
1557 bss->rsn_ie = NULL;
1558 bss->rsn_ie_len = 0;
1559 }
1560
1561 if (elems.wmm &&
1562 (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_len ||
1563 os_memcmp(bss->wmm_ie, elems.wmm, elems.wmm_len))) {
1564 os_free(bss->wmm_ie);
1565 bss->wmm_ie = os_malloc(elems.wmm_len + 2);
1566 if (bss->wmm_ie) {
1567 os_memcpy(bss->wmm_ie, elems.wmm - 2,
1568 elems.wmm_len + 2);
1569 bss->wmm_ie_len = elems.wmm_len + 2;
1570 } else
1571 bss->wmm_ie_len = 0;
1572 } else if (!elems.wmm && bss->wmm_ie) {
1573 os_free(bss->wmm_ie);
1574 bss->wmm_ie = NULL;
1575 bss->wmm_ie_len = 0;
1576 }
1577
1578 #ifdef CONFIG_IEEE80211R
1579 if (elems.mdie &&
1580 (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1581 os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1582 os_free(bss->mdie);
1583 bss->mdie = os_malloc(elems.mdie_len + 2);
1584 if (bss->mdie) {
1585 os_memcpy(bss->mdie, elems.mdie - 2,
1586 elems.mdie_len + 2);
1587 bss->mdie_len = elems.mdie_len + 2;
1588 } else
1589 bss->mdie_len = 0;
1590 } else if (!elems.mdie && bss->mdie) {
1591 os_free(bss->mdie);
1592 bss->mdie = NULL;
1593 bss->mdie_len = 0;
1594 }
1595 #endif /* CONFIG_IEEE80211R */
1596
1597 bss->hw_mode = wpa_s->mlme.phymode;
1598 bss->channel = channel;
1599 bss->freq = wpa_s->mlme.freq;
1600 if (channel != wpa_s->mlme.channel &&
1601 (wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211G ||
1602 wpa_s->mlme.phymode == HOSTAPD_MODE_IEEE80211B) &&
1603 channel >= 1 && channel <= 14) {
1604 static const int freq_list[] = {
1605 2412, 2417, 2422, 2427, 2432, 2437, 2442,
1606 2447, 2452, 2457, 2462, 2467, 2472, 2484
1607 };
1608 /* IEEE 802.11g/b mode can receive packets from neighboring
1609 * channels, so map the channel into frequency. */
1610 bss->freq = freq_list[channel - 1];
1611 }
1612 bss->timestamp = timestamp;
1613 os_get_time(&bss->last_update);
1614 bss->rssi = rx_status->ssi;
1615 if (!beacon)
1616 bss->probe_resp++;
1617 }
1618
1619
1620 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1621 struct ieee80211_mgmt *mgmt,
1622 size_t len,
1623 struct ieee80211_rx_status *rx_status)
1624 {
1625 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1626 }
1627
1628
1629 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1630 struct ieee80211_mgmt *mgmt,
1631 size_t len,
1632 struct ieee80211_rx_status *rx_status)
1633 {
1634 int use_protection;
1635 size_t baselen;
1636 struct ieee802_11_elems elems;
1637
1638 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1639
1640 if (!wpa_s->mlme.associated ||
1641 os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1642 return;
1643
1644 /* Process beacon from the current BSS */
1645 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1646 if (baselen > len)
1647 return;
1648
1649 if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1650 &elems, 0) == ParseFailed)
1651 return;
1652
1653 use_protection = 0;
1654 if (elems.erp_info && elems.erp_info_len >= 1) {
1655 use_protection =
1656 (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1657 }
1658
1659 if (use_protection != !!wpa_s->mlme.use_protection) {
1660 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1661 ")",
1662 use_protection ? "enabled" : "disabled",
1663 MAC2STR(wpa_s->bssid));
1664 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1665 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1666 }
1667
1668 if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1669 ieee80211_sta_wmm_params(wpa_s, elems.wmm,
1670 elems.wmm_len);
1671 }
1672 }
1673
1674
1675 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1676 struct ieee80211_mgmt *mgmt,
1677 size_t len,
1678 struct ieee80211_rx_status *rx_status)
1679 {
1680 int tx_last_beacon, adhoc;
1681 #if 0 /* FIX */
1682 struct ieee80211_mgmt *resp;
1683 #endif
1684 u8 *pos, *end;
1685 struct wpa_ssid *ssid = wpa_s->current_ssid;
1686
1687 adhoc = ssid && ssid->mode == WPAS_MODE_IBSS;
1688
1689 if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1690 len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1691 return;
1692
1693 #if 0 /* FIX */
1694 if (local->hw->tx_last_beacon)
1695 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1696 else
1697 #endif
1698 tx_last_beacon = 1;
1699
1700 #ifdef IEEE80211_IBSS_DEBUG
1701 wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1702 " BSSID=" MACSTR " (tx_last_beacon=%d)",
1703 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1704 MAC2STR(mgmt->bssid), tx_last_beacon);
1705 #endif /* IEEE80211_IBSS_DEBUG */
1706
1707 if (!tx_last_beacon)
1708 return;
1709
1710 if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1711 os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1712 return;
1713
1714 end = ((u8 *) mgmt) + len;
1715 pos = mgmt->u.probe_req.variable;
1716 if (pos[0] != WLAN_EID_SSID ||
1717 pos + 2 + pos[1] > end) {
1718 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1719 MACSTR, MAC2STR(mgmt->sa));
1720 return;
1721 }
1722 if (pos[1] != 0 &&
1723 (pos[1] != wpa_s->mlme.ssid_len ||
1724 os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1725 {
1726 /* Ignore ProbeReq for foreign SSID */
1727 return;
1728 }
1729
1730 #if 0 /* FIX */
1731 /* Reply with ProbeResp */
1732 skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1733 if (skb == NULL)
1734 return;
1735
1736 resp = (struct ieee80211_mgmt *) skb->data;
1737 os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1738 #ifdef IEEE80211_IBSS_DEBUG
1739 wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1740 MAC2STR(resp->da));
1741 #endif /* IEEE80211_IBSS_DEBUG */
1742 ieee80211_sta_tx(wpa_s, skb, 0, 1);
1743 #endif
1744 }
1745
1746
1747 #ifdef CONFIG_IEEE80211R
1748 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1749 struct ieee80211_mgmt *mgmt,
1750 size_t len,
1751 struct ieee80211_rx_status *rx_status)
1752 {
1753 union wpa_event_data data;
1754 u16 status;
1755 u8 *sta_addr, *target_ap_addr;
1756
1757 if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1758 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1759 return;
1760 }
1761
1762 /*
1763 * Only FT Action Response is needed for now since reservation
1764 * protocol is not supported.
1765 */
1766 if (mgmt->u.action.u.ft_action_resp.action != 2) {
1767 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1768 mgmt->u.action.u.ft_action_resp.action);
1769 return;
1770 }
1771
1772 status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1773 sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1774 target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1775 wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1776 " TargetAP " MACSTR " Status Code %d",
1777 MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1778 if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1779 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1780 " in FT Action Response", MAC2STR(sta_addr));
1781 return;
1782 }
1783
1784 if (status) {
1785 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1786 "failure (status code %d)", status);
1787 /* TODO: report error to FT code(?) */
1788 return;
1789 }
1790
1791 os_memset(&data, 0, sizeof(data));
1792 data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1793 data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1794 (u8 *) mgmt);
1795 data.ft_ies.ft_action = 1;
1796 os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1797 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1798 /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1799 * successfully */
1800 wpa_s->mlme.prev_bssid_set = 1;
1801 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1802 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1803 os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1804 ieee80211_associate(wpa_s);
1805 }
1806 #endif /* CONFIG_IEEE80211R */
1807
1808
1809 #ifdef CONFIG_IEEE80211W
1810
1811 /* MLME-SAQuery.response */
1812 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1813 const u8 *addr, const u8 *trans_id)
1814 {
1815 struct ieee80211_mgmt *mgmt;
1816 int res;
1817 size_t len;
1818
1819 mgmt = os_zalloc(sizeof(*mgmt));
1820 if (mgmt == NULL) {
1821 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1822 "SA Query action frame");
1823 return -1;
1824 }
1825
1826 len = 24;
1827 os_memcpy(mgmt->da, addr, ETH_ALEN);
1828 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1829 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1830 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1831 WLAN_FC_STYPE_ACTION);
1832 mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1833 mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1834 os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1835 WLAN_SA_QUERY_TR_ID_LEN);
1836 len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1837
1838 res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1839 os_free(mgmt);
1840
1841 return res;
1842 }
1843
1844
1845 static void ieee80211_rx_mgmt_sa_query_action(
1846 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1847 struct ieee80211_rx_status *rx_status)
1848 {
1849 if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1850 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1851 return;
1852 }
1853
1854 if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1855 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1856 mgmt->u.action.u.sa_query_req.action);
1857 return;
1858 }
1859
1860 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1861 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1862 "source " MACSTR, MAC2STR(mgmt->sa));
1863 return;
1864 }
1865
1866 if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1867 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1868 "association process");
1869 return;
1870 }
1871
1872 wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1873 ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1874 sa_query_req.trans_id);
1875 }
1876
1877 #endif /* CONFIG_IEEE80211W */
1878
1879
1880 static void dump_tspec(struct wmm_tspec_element *tspec)
1881 {
1882 int up, psb, dir, tid;
1883 u16 val;
1884
1885 up = (tspec->ts_info[1] >> 3) & 0x07;
1886 psb = (tspec->ts_info[1] >> 2) & 0x01;
1887 dir = (tspec->ts_info[0] >> 5) & 0x03;
1888 tid = (tspec->ts_info[0] >> 1) & 0x0f;
1889 wpa_printf(MSG_DEBUG, "WMM: TS Info: UP=%d PSB=%d Direction=%d TID=%d",
1890 up, psb, dir, tid);
1891 val = le_to_host16(tspec->nominal_msdu_size);
1892 wpa_printf(MSG_DEBUG, "WMM: Nominal MSDU Size: %d%s",
1893 val & 0x7fff, val & 0x8000 ? " (fixed)" : "");
1894 wpa_printf(MSG_DEBUG, "WMM: Mean Data Rate: %u bps",
1895 le_to_host32(tspec->mean_data_rate));
1896 wpa_printf(MSG_DEBUG, "WMM: Minimum PHY Rate: %u bps",
1897 le_to_host32(tspec->minimum_phy_rate));
1898 val = le_to_host16(tspec->surplus_bandwidth_allowance);
1899 wpa_printf(MSG_DEBUG, "WMM: Surplus Bandwidth Allowance: %u.%04u",
1900 val >> 13, 10000 * (val & 0x1fff) / 0x2000);
1901 val = le_to_host16(tspec->medium_time);
1902 wpa_printf(MSG_DEBUG, "WMM: Medium Time: %u (= %u usec/sec)",
1903 val, 32 * val);
1904 }
1905
1906
1907 static int is_wmm_tspec(const u8 *ie, size_t len)
1908 {
1909 const struct wmm_tspec_element *tspec;
1910
1911 if (len < sizeof(*tspec))
1912 return 0;
1913
1914 tspec = (const struct wmm_tspec_element *) ie;
1915 if (tspec->eid != WLAN_EID_VENDOR_SPECIFIC ||
1916 tspec->length < sizeof(*tspec) - 2 ||
1917 tspec->oui[0] != 0x00 || tspec->oui[1] != 0x50 ||
1918 tspec->oui[2] != 0xf2 || tspec->oui_type != 2 ||
1919 tspec->oui_subtype != 2 || tspec->version != 1)
1920 return 0;
1921
1922 return 1;
1923 }
1924
1925
1926 static void ieee80211_rx_addts_resp(
1927 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1928 size_t var_len)
1929 {
1930 struct wmm_tspec_element *tspec;
1931
1932 wpa_printf(MSG_DEBUG, "WMM: Received ADDTS Response");
1933 wpa_hexdump(MSG_MSGDUMP, "WMM: ADDTS Response IE(s)",
1934 mgmt->u.action.u.wmm_action.variable, var_len);
1935 if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1936 return;
1937 tspec = (struct wmm_tspec_element *)
1938 mgmt->u.action.u.wmm_action.variable;
1939 dump_tspec(tspec);
1940 }
1941
1942
1943 static void ieee80211_rx_delts(
1944 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1945 size_t var_len)
1946 {
1947 struct wmm_tspec_element *tspec;
1948
1949 wpa_printf(MSG_DEBUG, "WMM: Received DELTS");
1950 wpa_hexdump(MSG_MSGDUMP, "WMM: DELTS IE(s)",
1951 mgmt->u.action.u.wmm_action.variable, var_len);
1952 if (!is_wmm_tspec(mgmt->u.action.u.wmm_action.variable, var_len))
1953 return;
1954 tspec = (struct wmm_tspec_element *)
1955 mgmt->u.action.u.wmm_action.variable;
1956 dump_tspec(tspec);
1957 }
1958
1959
1960 static void ieee80211_rx_mgmt_wmm_action(
1961 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1962 struct ieee80211_rx_status *rx_status)
1963 {
1964 size_t alen;
1965
1966 alen = mgmt->u.action.u.wmm_action.variable - (u8 *) mgmt;
1967 if (len < alen) {
1968 wpa_printf(MSG_DEBUG, "WMM: Received Action frame too short");
1969 return;
1970 }
1971
1972 wpa_printf(MSG_DEBUG, "WMM: Received Action frame: Action Code %d, "
1973 "Dialog Token %d, Status Code %d",
1974 mgmt->u.action.u.wmm_action.action_code,
1975 mgmt->u.action.u.wmm_action.dialog_token,
1976 mgmt->u.action.u.wmm_action.status_code);
1977
1978 switch (mgmt->u.action.u.wmm_action.action_code) {
1979 case WMM_ACTION_CODE_ADDTS_RESP:
1980 ieee80211_rx_addts_resp(wpa_s, mgmt, len, len - alen);
1981 break;
1982 case WMM_ACTION_CODE_DELTS:
1983 ieee80211_rx_delts(wpa_s, mgmt, len, len - alen);
1984 break;
1985 default:
1986 wpa_printf(MSG_DEBUG, "WMM: Unsupported Action Code %d",
1987 mgmt->u.action.u.wmm_action.action_code);
1988 break;
1989 }
1990 }
1991
1992
1993 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1994 struct ieee80211_mgmt *mgmt,
1995 size_t len,
1996 struct ieee80211_rx_status *rx_status)
1997 {
1998 wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1999
2000 if (len < 25)
2001 return;
2002
2003 switch (mgmt->u.action.category) {
2004 #ifdef CONFIG_IEEE80211R
2005 case WLAN_ACTION_FT:
2006 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
2007 break;
2008 #endif /* CONFIG_IEEE80211R */
2009 #ifdef CONFIG_IEEE80211W
2010 case WLAN_ACTION_SA_QUERY:
2011 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
2012 break;
2013 #endif /* CONFIG_IEEE80211W */
2014 case WLAN_ACTION_WMM:
2015 ieee80211_rx_mgmt_wmm_action(wpa_s, mgmt, len, rx_status);
2016 break;
2017 default:
2018 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
2019 mgmt->u.action.category);
2020 break;
2021 }
2022 }
2023
2024
2025 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
2026 const u8 *buf, size_t len,
2027 struct ieee80211_rx_status *rx_status)
2028 {
2029 struct ieee80211_mgmt *mgmt;
2030 u16 fc;
2031
2032 if (len < 24)
2033 return;
2034
2035 mgmt = (struct ieee80211_mgmt *) buf;
2036 fc = le_to_host16(mgmt->frame_control);
2037
2038 switch (WLAN_FC_GET_STYPE(fc)) {
2039 case WLAN_FC_STYPE_PROBE_REQ:
2040 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
2041 break;
2042 case WLAN_FC_STYPE_PROBE_RESP:
2043 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
2044 break;
2045 case WLAN_FC_STYPE_BEACON:
2046 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2047 break;
2048 case WLAN_FC_STYPE_AUTH:
2049 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2050 break;
2051 case WLAN_FC_STYPE_ASSOC_RESP:
2052 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2053 break;
2054 case WLAN_FC_STYPE_REASSOC_RESP:
2055 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2056 break;
2057 case WLAN_FC_STYPE_DEAUTH:
2058 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2059 break;
2060 case WLAN_FC_STYPE_DISASSOC:
2061 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2062 break;
2063 case WLAN_FC_STYPE_ACTION:
2064 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2065 break;
2066 default:
2067 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2068 "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2069 break;
2070 }
2071 }
2072
2073
2074 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2075 const u8 *buf, size_t len,
2076 struct ieee80211_rx_status *rx_status)
2077 {
2078 struct ieee80211_mgmt *mgmt;
2079 u16 fc;
2080
2081 if (len < 24)
2082 return;
2083
2084 mgmt = (struct ieee80211_mgmt *) buf;
2085 fc = le_to_host16(mgmt->frame_control);
2086
2087 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2088 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2089 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2090 len, rx_status);
2091 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2092 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2093 }
2094 }
2095 }
2096
2097
2098 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2099 {
2100 int active = 0;
2101
2102 #if 0 /* FIX */
2103 list_for_each(ptr, &local->sta_list) {
2104 sta = list_entry(ptr, struct sta_info, list);
2105 if (sta->dev == dev &&
2106 time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2107 jiffies)) {
2108 active++;
2109 break;
2110 }
2111 }
2112 #endif
2113
2114 return active;
2115 }
2116
2117
2118 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2119 {
2120 #if 0 /* FIX */
2121 list_for_each_safe(ptr, n, &local->sta_list) {
2122 sta = list_entry(ptr, struct sta_info, list);
2123 if (time_after(jiffies, sta->last_rx +
2124 IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2125 wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2126 MACSTR, MAC2STR(sta->addr));
2127 sta_info_free(local, sta, 1);
2128 }
2129 }
2130 #endif
2131 }
2132
2133
2134 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2135 {
2136 struct wpa_driver_scan_params params;
2137
2138 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2139
2140 ieee80211_sta_expire(wpa_s);
2141 if (ieee80211_sta_active_ibss(wpa_s))
2142 return;
2143
2144 wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2145 "other IBSS networks with same SSID (merge)");
2146 os_memset(&params, 0, sizeof(params));
2147 params.ssids[0].ssid = wpa_s->mlme.ssid;
2148 params.ssids[0].ssid_len = wpa_s->mlme.ssid_len;
2149 params.num_ssids = wpa_s->mlme.ssid ? 1 : 0;
2150 ieee80211_sta_req_scan(wpa_s, &params);
2151 }
2152
2153
2154 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2155 {
2156 struct wpa_supplicant *wpa_s = eloop_ctx;
2157
2158 switch (wpa_s->mlme.state) {
2159 case IEEE80211_DISABLED:
2160 break;
2161 case IEEE80211_AUTHENTICATE:
2162 ieee80211_authenticate(wpa_s);
2163 break;
2164 case IEEE80211_ASSOCIATE:
2165 ieee80211_associate(wpa_s);
2166 break;
2167 case IEEE80211_ASSOCIATED:
2168 ieee80211_associated(wpa_s);
2169 break;
2170 case IEEE80211_IBSS_SEARCH:
2171 ieee80211_sta_find_ibss(wpa_s);
2172 break;
2173 case IEEE80211_IBSS_JOINED:
2174 ieee80211_sta_merge_ibss(wpa_s);
2175 break;
2176 default:
2177 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2178 wpa_s->mlme.state);
2179 break;
2180 }
2181
2182 if (ieee80211_privacy_mismatch(wpa_s)) {
2183 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2184 "and mixed-cell disabled - disassociate");
2185
2186 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2187 ieee80211_set_associated(wpa_s, 0);
2188 }
2189 }
2190
2191
2192 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2193 {
2194 struct wpa_ssid *ssid = wpa_s->current_ssid;
2195 if (ssid && ssid->mode != WPAS_MODE_INFRA)
2196 return;
2197
2198 #if 0 /* FIX */
2199 if (local->hw->reset_tsf) {
2200 /* Reset own TSF to allow time synchronization work. */
2201 local->hw->reset_tsf(local->mdev);
2202 }
2203 #endif
2204
2205 wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2206
2207
2208 if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_OPEN)
2209 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2210 else if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_SHARED)
2211 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2212 else if (wpa_s->mlme.auth_algs & WPA_AUTH_ALG_LEAP)
2213 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2214 else
2215 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2216 wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2217 wpa_s->mlme.auth_alg);
2218 wpa_s->mlme.auth_transaction = -1;
2219 wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2220 ieee80211_authenticate(wpa_s);
2221 }
2222
2223
2224 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2225 {
2226 #if 0 /* FIX */
2227 int m, c;
2228
2229 for (m = 0; m < local->hw->num_modes; m++) {
2230 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2231 if (mode->mode != local->conf.phymode)
2232 continue;
2233 for (c = 0; c < mode->num_channels; c++) {
2234 struct ieee80211_channel *chan = &mode->channels[c];
2235 if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2236 chan->chan == local->conf.channel) {
2237 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2238 return 1;
2239 break;
2240 }
2241 }
2242 }
2243 #endif
2244
2245 return 0;
2246 }
2247
2248
2249 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2250 struct ieee80211_sta_bss *bss)
2251 {
2252 int res = 0, rates, done = 0, bssid_changed;
2253 struct ieee80211_mgmt *mgmt;
2254 #if 0 /* FIX */
2255 struct ieee80211_tx_control control;
2256 struct ieee80211_rate *rate;
2257 struct rate_control_extra extra;
2258 #endif
2259 u8 *pos, *buf;
2260 size_t len;
2261
2262 /* Remove possible STA entries from other IBSS networks. */
2263 #if 0 /* FIX */
2264 sta_info_flush(local, NULL);
2265
2266 if (local->hw->reset_tsf) {
2267 /* Reset own TSF to allow time synchronization work. */
2268 local->hw->reset_tsf(local->mdev);
2269 }
2270 #endif
2271 bssid_changed = os_memcmp(wpa_s->bssid, bss->bssid, ETH_ALEN);
2272 os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2273 if (bssid_changed)
2274 wpas_notify_bssid_changed(wpa_s);
2275
2276 #if 0 /* FIX */
2277 local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2278
2279 sdata->drop_unencrypted = bss->capability &
2280 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2281 #endif
2282
2283 #if 0 /* FIX */
2284 os_memset(&rq, 0, sizeof(rq));
2285 rq.m = bss->freq * 100000;
2286 rq.e = 1;
2287 res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2288 #endif
2289
2290 if (!ieee80211_ibss_allowed(wpa_s)) {
2291 #if 0 /* FIX */
2292 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2293 "(%d MHz)", local->conf.channel,
2294 local->conf.freq);
2295 #endif
2296 return -1;
2297 }
2298
2299 /* Set beacon template based on scan results */
2300 buf = os_malloc(400);
2301 len = 0;
2302 do {
2303 if (buf == NULL)
2304 break;
2305
2306 mgmt = (struct ieee80211_mgmt *) buf;
2307 len += 24 + sizeof(mgmt->u.beacon);
2308 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2309 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2310 WLAN_FC_STYPE_BEACON);
2311 os_memset(mgmt->da, 0xff, ETH_ALEN);
2312 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2313 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2314 #if 0 /* FIX */
2315 mgmt->u.beacon.beacon_int =
2316 host_to_le16(local->conf.beacon_int);
2317 #endif
2318 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2319
2320 pos = buf + len;
2321 len += 2 + wpa_s->mlme.ssid_len;
2322 *pos++ = WLAN_EID_SSID;
2323 *pos++ = wpa_s->mlme.ssid_len;
2324 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2325
2326 rates = bss->supp_rates_len;
2327 if (rates > 8)
2328 rates = 8;
2329 pos = buf + len;
2330 len += 2 + rates;
2331 *pos++ = WLAN_EID_SUPP_RATES;
2332 *pos++ = rates;
2333 os_memcpy(pos, bss->supp_rates, rates);
2334
2335 pos = buf + len;
2336 len += 2 + 1;
2337 *pos++ = WLAN_EID_DS_PARAMS;
2338 *pos++ = 1;
2339 *pos++ = bss->channel;
2340
2341 pos = buf + len;
2342 len += 2 + 2;
2343 *pos++ = WLAN_EID_IBSS_PARAMS;
2344 *pos++ = 2;
2345 /* FIX: set ATIM window based on scan results */
2346 *pos++ = 0;
2347 *pos++ = 0;
2348
2349 if (bss->supp_rates_len > 8) {
2350 rates = bss->supp_rates_len - 8;
2351 pos = buf + len;
2352 len += 2 + rates;
2353 *pos++ = WLAN_EID_EXT_SUPP_RATES;
2354 *pos++ = rates;
2355 os_memcpy(pos, &bss->supp_rates[8], rates);
2356 }
2357
2358 #if 0 /* FIX */
2359 os_memset(&control, 0, sizeof(control));
2360 control.pkt_type = PKT_PROBE_RESP;
2361 os_memset(&extra, 0, sizeof(extra));
2362 extra.endidx = local->num_curr_rates;
2363 rate = rate_control_get_rate(wpa_s, skb, &extra);
2364 if (rate == NULL) {
2365 wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2366 "rate for IBSS beacon");
2367 break;
2368 }
2369 control.tx_rate = (wpa_s->mlme.short_preamble &&
2370 (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2371 rate->val2 : rate->val;
2372 control.antenna_sel = local->conf.antenna_sel;
2373 control.power_level = local->conf.power_level;
2374 control.no_ack = 1;
2375 control.retry_limit = 1;
2376 control.rts_cts_duration = 0;
2377 #endif
2378
2379 #if 0 /* FIX */
2380 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2381 if (wpa_s->mlme.probe_resp) {
2382 mgmt = (struct ieee80211_mgmt *)
2383 wpa_s->mlme.probe_resp->data;
2384 mgmt->frame_control =
2385 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2386 WLAN_FC_STYPE_PROBE_RESP);
2387 } else {
2388 wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2389 "ProbeResp template for IBSS");
2390 }
2391
2392 if (local->hw->beacon_update &&
2393 local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2394 wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2395 "template based on scan results");
2396 skb = NULL;
2397 }
2398
2399 rates = 0;
2400 for (i = 0; i < bss->supp_rates_len; i++) {
2401 int rate = (bss->supp_rates[i] & 0x7f) * 5;
2402 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2403 rate *= 2;
2404 for (j = 0; j < local->num_curr_rates; j++)
2405 if (local->curr_rates[j] == rate)
2406 rates |= BIT(j);
2407 }
2408 wpa_s->mlme.supp_rates_bits = rates;
2409 #endif
2410 done = 1;
2411 } while (0);
2412
2413 os_free(buf);
2414 if (!done) {
2415 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2416 "template");
2417 }
2418
2419 wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2420 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2421
2422 return res;
2423 }
2424
2425
2426 #if 0 /* FIX */
2427 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2428 {
2429 struct ieee80211_sta_bss *bss;
2430 u8 bssid[ETH_ALEN], *pos;
2431 int i;
2432
2433 #if 0
2434 /* Easier testing, use fixed BSSID. */
2435 os_memset(bssid, 0xfe, ETH_ALEN);
2436 #else
2437 /* Generate random, not broadcast, locally administered BSSID. Mix in
2438 * own MAC address to make sure that devices that do not have proper
2439 * random number generator get different BSSID. */
2440 os_get_random(bssid, ETH_ALEN);
2441 for (i = 0; i < ETH_ALEN; i++)
2442 bssid[i] ^= wpa_s->own_addr[i];
2443 bssid[0] &= ~0x01;
2444 bssid[0] |= 0x02;
2445 #endif
2446
2447 wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2448 MACSTR "", MAC2STR(bssid));
2449
2450 bss = ieee80211_bss_add(wpa_s, bssid);
2451 if (bss == NULL)
2452 return -ENOMEM;
2453
2454 #if 0 /* FIX */
2455 if (local->conf.beacon_int == 0)
2456 local->conf.beacon_int = 100;
2457 bss->beacon_int = local->conf.beacon_int;
2458 bss->hw_mode = local->conf.phymode;
2459 bss->channel = local->conf.channel;
2460 bss->freq = local->conf.freq;
2461 #endif
2462 os_get_time(&bss->last_update);
2463 bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2464 #if 0 /* FIX */
2465 if (sdata->default_key) {
2466 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2467 } else
2468 sdata->drop_unencrypted = 0;
2469 bss->supp_rates_len = local->num_curr_rates;
2470 #endif
2471 pos = bss->supp_rates;
2472 #if 0 /* FIX */
2473 for (i = 0; i < local->num_curr_rates; i++) {
2474 int rate = local->curr_rates[i];
2475 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2476 rate /= 2;
2477 *pos++ = (u8) (rate / 5);
2478 }
2479 #endif
2480
2481 return ieee80211_sta_join_ibss(wpa_s, bss);
2482 }
2483 #endif
2484
2485
2486 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2487 {
2488 struct ieee80211_sta_bss *bss;
2489 int found = 0;
2490 u8 bssid[ETH_ALEN];
2491 int active_ibss;
2492 struct os_time now;
2493
2494 if (wpa_s->mlme.ssid_len == 0)
2495 return -EINVAL;
2496
2497 active_ibss = ieee80211_sta_active_ibss(wpa_s);
2498 #ifdef IEEE80211_IBSS_DEBUG
2499 wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2500 active_ibss);
2501 #endif /* IEEE80211_IBSS_DEBUG */
2502 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2503 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2504 os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2505 || !(bss->capability & WLAN_CAPABILITY_IBSS))
2506 continue;
2507 #ifdef IEEE80211_IBSS_DEBUG
2508 wpa_printf(MSG_DEBUG, " bssid=" MACSTR " found",
2509 MAC2STR(bss->bssid));
2510 #endif /* IEEE80211_IBSS_DEBUG */
2511 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2512 found = 1;
2513 if (active_ibss ||
2514 os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2515 break;
2516 }
2517
2518 #ifdef IEEE80211_IBSS_DEBUG
2519 wpa_printf(MSG_DEBUG, " sta_find_ibss: selected " MACSTR " current "
2520 MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2521 #endif /* IEEE80211_IBSS_DEBUG */
2522 if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2523 (bss = ieee80211_bss_get(wpa_s, bssid))) {
2524 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2525 " based on configured SSID",
2526 MAC2STR(bssid));
2527 return ieee80211_sta_join_ibss(wpa_s, bss);
2528 }
2529 #ifdef IEEE80211_IBSS_DEBUG
2530 wpa_printf(MSG_DEBUG, " did not try to join ibss");
2531 #endif /* IEEE80211_IBSS_DEBUG */
2532
2533 /* Selected IBSS not found in current scan results - try to scan */
2534 os_get_time(&now);
2535 #if 0 /* FIX */
2536 if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2537 !ieee80211_sta_active_ibss(wpa_s)) {
2538 ieee80211_reschedule_timer(wpa_s,
2539 IEEE80211_IBSS_MERGE_INTERVAL);
2540 } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2541 IEEE80211_SCAN_INTERVAL)) {
2542 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2543 "to join");
2544 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2545 wpa_s->mlme.ssid_len);
2546 } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2547 int interval = IEEE80211_SCAN_INTERVAL;
2548
2549 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2550 IEEE80211_IBSS_JOIN_TIMEOUT)) {
2551 if (wpa_s->mlme.create_ibss &&
2552 ieee80211_ibss_allowed(wpa_s))
2553 return ieee80211_sta_create_ibss(wpa_s);
2554 if (wpa_s->mlme.create_ibss) {
2555 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2556 "on the configured channel %d "
2557 "(%d MHz)",
2558 local->conf.channel,
2559 local->conf.freq);
2560 }
2561
2562 /* No IBSS found - decrease scan interval and continue
2563 * scanning. */
2564 interval = IEEE80211_SCAN_INTERVAL_SLOW;
2565 }
2566
2567 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2568 ieee80211_reschedule_timer(wpa_s, interval);
2569 return 0;
2570 }
2571 #endif
2572
2573 return 0;
2574 }
2575
2576
2577 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2578 size_t *len)
2579 {
2580 os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2581 *len = wpa_s->mlme.ssid_len;
2582 return 0;
2583 }
2584
2585
2586 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2587 struct wpa_driver_associate_params *params)
2588 {
2589 struct ieee80211_sta_bss *bss;
2590 int bssid_changed;
2591
2592 wpa_s->mlme.bssid_set = 0;
2593 wpa_s->mlme.freq = params->freq;
2594 if (params->bssid) {
2595 bssid_changed = os_memcmp(wpa_s->bssid, params->bssid,
2596 ETH_ALEN);
2597 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2598 if (bssid_changed)
2599 wpas_notify_bssid_changed(wpa_s);
2600
2601 if (!is_zero_ether_addr(params->bssid))
2602 wpa_s->mlme.bssid_set = 1;
2603 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2604 if (bss) {
2605 wpa_s->mlme.phymode = bss->hw_mode;
2606 wpa_s->mlme.channel = bss->channel;
2607 wpa_s->mlme.freq = bss->freq;
2608 }
2609 }
2610
2611 #if 0 /* FIX */
2612 /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2613 * not defined. */
2614 if (local->hw->conf_tx) {
2615 struct ieee80211_tx_queue_params qparam;
2616 int i;
2617
2618 os_memset(&qparam, 0, sizeof(qparam));
2619 /* TODO: are these ok defaults for all hw_modes? */
2620 qparam.aifs = 2;
2621 qparam.cw_min =
2622 local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2623 qparam.cw_max = 1023;
2624 qparam.burst_time = 0;
2625 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2626 {
2627 local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2628 &qparam);
2629 }
2630 /* IBSS uses different parameters for Beacon sending */
2631 qparam.cw_min++;
2632 qparam.cw_min *= 2;
2633 qparam.cw_min--;
2634 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2635 }
2636 #endif
2637
2638 if (wpa_s->mlme.ssid_len != params->ssid_len ||
2639 os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2640 wpa_s->mlme.prev_bssid_set = 0;
2641 os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2642 os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2643 MAX_SSID_LEN - params->ssid_len);
2644 wpa_s->mlme.ssid_len = params->ssid_len;
2645 wpa_s->mlme.ssid_set = 1;
2646
2647 os_free(wpa_s->mlme.extra_ie);
2648 if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2649 wpa_s->mlme.extra_ie = NULL;
2650 wpa_s->mlme.extra_ie_len = 0;
2651 } else {
2652 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2653 if (wpa_s->mlme.extra_ie == NULL) {
2654 wpa_s->mlme.extra_ie_len = 0;
2655 return -1;
2656 }
2657 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2658 params->wpa_ie_len);
2659 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2660 }
2661
2662 wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2663
2664 ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2665 wpa_s->mlme.channel, wpa_s->mlme.freq);
2666
2667 if (params->mode == WPAS_MODE_IBSS && !wpa_s->mlme.bssid_set) {
2668 os_get_time(&wpa_s->mlme.ibss_join_req);
2669 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2670 return ieee80211_sta_find_ibss(wpa_s);
2671 }
2672
2673 if (wpa_s->mlme.bssid_set)
2674 ieee80211_sta_new_auth(wpa_s);
2675
2676 return 0;
2677 }
2678
2679
2680 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2681 {
2682 wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2683 wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2684 wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2685 }
2686
2687
2688 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2689 {
2690 wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2691 wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2692 wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2693 if (wpa_s->mlme.freq == 0)
2694 return 0;
2695 return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2696 wpa_s->mlme.channel,
2697 wpa_s->mlme.freq);
2698 }
2699
2700
2701 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2702 {
2703 size_t m;
2704 int c;
2705
2706 for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2707 struct hostapd_hw_modes *mode = &wpa_s->mlme.modes[m];
2708 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2709 continue;
2710 for (c = 0; c < mode->num_channels; c++) {
2711 struct hostapd_channel_data *chan = &mode->channels[c];
2712 if (!(chan->flag & HOSTAPD_CHAN_DISABLED) &&
2713 chan->chan == wpa_s->mlme.channel) {
2714 if (!(chan->flag & HOSTAPD_CHAN_PASSIVE_SCAN))
2715 return 1;
2716 break;
2717 }
2718 }
2719 }
2720
2721 return 0;
2722 }
2723
2724
2725 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2726 {
2727 struct wpa_supplicant *wpa_s = eloop_ctx;
2728 struct hostapd_hw_modes *mode;
2729 struct hostapd_channel_data *chan;
2730 int skip = 0;
2731 int timeout = 0;
2732 struct wpa_ssid *ssid = wpa_s->current_ssid;
2733 int adhoc;
2734
2735 if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2736 return;
2737
2738 adhoc = ssid && ssid->mode == 1;
2739
2740 switch (wpa_s->mlme.scan_state) {
2741 case SCAN_SET_CHANNEL:
2742 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2743 if (wpa_s->mlme.scan_hw_mode_idx >=
2744 (int) wpa_s->mlme.num_modes ||
2745 (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2746 (int) wpa_s->mlme.num_modes
2747 && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2748 if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2749 wpa_printf(MSG_DEBUG, "MLME: failed to "
2750 "restore operational channel after "
2751 "scan");
2752 }
2753 wpa_printf(MSG_DEBUG, "MLME: scan completed");
2754 wpa_s->mlme.sta_scanning = 0;
2755 os_get_time(&wpa_s->mlme.last_scan_completed);
2756 wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2757 if (adhoc) {
2758 if (!wpa_s->mlme.bssid_set ||
2759 (wpa_s->mlme.state ==
2760 IEEE80211_IBSS_JOINED &&
2761 !ieee80211_sta_active_ibss(wpa_s)))
2762 ieee80211_sta_find_ibss(wpa_s);
2763 }
2764 return;
2765 }
2766 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2767 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2768 if ((chan->flag & HOSTAPD_CHAN_DISABLED) ||
2769 (adhoc && (chan->flag & HOSTAPD_CHAN_NO_IBSS)) ||
2770 (wpa_s->mlme.hw_modes & (1 << HOSTAPD_MODE_IEEE80211G) &&
2771 mode->mode == HOSTAPD_MODE_IEEE80211B &&
2772 wpa_s->mlme.scan_skip_11b))
2773 skip = 1;
2774 if (!skip && wpa_s->mlme.scan_freqs) {
2775 int i, found = 0;
2776 for (i = 0; wpa_s->mlme.scan_freqs[i]; i++) {
2777 if (wpa_s->mlme.scan_freqs[i] == chan->freq) {
2778 found = 1;
2779 break;
2780 }
2781 }
2782 if (!found)
2783 skip = 1;
2784 }
2785
2786 if (!skip) {
2787 wpa_printf(MSG_MSGDUMP,
2788 "MLME: scan channel %d (%d MHz)",
2789 chan->chan, chan->freq);
2790
2791 wpa_s->mlme.channel = chan->chan;
2792 wpa_s->mlme.freq = chan->freq;
2793 wpa_s->mlme.phymode = mode->mode;
2794 if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2795 chan->chan, chan->freq))
2796 {
2797 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2798 "channel %d (%d MHz) for scan",
2799 chan->chan, chan->freq);
2800 skip = 1;
2801 }
2802 }
2803
2804 wpa_s->mlme.scan_channel_idx++;
2805 if (wpa_s->mlme.scan_channel_idx >=
2806 wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2807 num_channels) {
2808 wpa_s->mlme.scan_hw_mode_idx++;
2809 wpa_s->mlme.scan_channel_idx = 0;
2810 }
2811
2812 if (skip) {
2813 timeout = 0;
2814 break;
2815 }
2816
2817 timeout = IEEE80211_PROBE_DELAY;
2818 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2819 break;
2820 case SCAN_SEND_PROBE:
2821 if (ieee80211_active_scan(wpa_s)) {
2822 ieee80211_send_probe_req(wpa_s, NULL,
2823 wpa_s->mlme.scan_ssid,
2824 wpa_s->mlme.scan_ssid_len);
2825 timeout = IEEE80211_CHANNEL_TIME;
2826 } else {
2827 timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2828 }
2829 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2830 break;
2831 }
2832
2833 eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2834 ieee80211_sta_scan_timer, wpa_s, NULL);
2835 }
2836
2837
2838 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s,
2839 struct wpa_driver_scan_params *params)
2840 {
2841 const u8 *ssid = params->ssids[0].ssid;
2842 size_t ssid_len = params->ssids[0].ssid_len;
2843
2844 if (ssid_len > MAX_SSID_LEN)
2845 return -1;
2846
2847 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
2848 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2849 * BSSID: MACAddress
2850 * SSID
2851 * ScanType: ACTIVE, PASSIVE
2852 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2853 * a Probe frame during active scanning
2854 * ChannelList
2855 * MinChannelTime (>= ProbeDelay), in TU
2856 * MaxChannelTime: (>= MinChannelTime), in TU
2857 */
2858
2859 /* MLME-SCAN.confirm
2860 * BSSDescriptionSet
2861 * ResultCode: SUCCESS, INVALID_PARAMETERS
2862 */
2863
2864 /* TODO: if assoc, move to power save mode for the duration of the
2865 * scan */
2866
2867 if (wpa_s->mlme.sta_scanning)
2868 return -1;
2869
2870 wpa_printf(MSG_DEBUG, "MLME: starting scan");
2871
2872 ieee80211_sta_set_probe_req_ie(wpa_s, params->extra_ies,
2873 params->extra_ies_len);
2874
2875 os_free(wpa_s->mlme.scan_freqs);
2876 if (params->freqs) {
2877 int i;
2878 for (i = 0; params->freqs[i]; i++)
2879 ;
2880 wpa_s->mlme.scan_freqs = os_malloc((i + 1) * sizeof(int));
2881 if (wpa_s->mlme.scan_freqs)
2882 os_memcpy(wpa_s->mlme.scan_freqs, params->freqs,
2883 (i + 1) * sizeof(int));
2884 } else
2885 wpa_s->mlme.scan_freqs = NULL;
2886
2887 ieee80211_sta_save_oper_chan(wpa_s);
2888
2889 wpa_s->mlme.sta_scanning = 1;
2890 /* TODO: stop TX queue? */
2891
2892 if (ssid) {
2893 wpa_s->mlme.scan_ssid_len = ssid_len;
2894 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2895 } else
2896 wpa_s->mlme.scan_ssid_len = 0;
2897 wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2898 * supported */
2899 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2900 wpa_s->mlme.scan_hw_mode_idx = 0;
2901 wpa_s->mlme.scan_channel_idx = 0;
2902 eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2903
2904 return 0;
2905 }
2906
2907
2908 struct wpa_scan_results *
2909 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2910 {
2911 size_t ap_num = 0;
2912 struct wpa_scan_results *res;
2913 struct wpa_scan_res *r;
2914 struct ieee80211_sta_bss *bss;
2915
2916 res = os_zalloc(sizeof(*res));
2917 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2918 ap_num++;
2919 res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2920 if (res->res == NULL) {
2921 os_free(res);
2922 return NULL;
2923 }
2924
2925 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2926 r = os_zalloc(sizeof(*r) + bss->ie_len);
2927 if (r == NULL)
2928 break;
2929 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2930 r->freq = bss->freq;
2931 r->beacon_int = bss->beacon_int;
2932 r->caps = bss->capability;
2933 r->level = bss->rssi;
2934 r->tsf = bss->timestamp;
2935 if (bss->ie) {
2936 r->ie_len = bss->ie_len;
2937 os_memcpy(r + 1, bss->ie, bss->ie_len);
2938 }
2939
2940 res->res[res->num++] = r;
2941 }
2942
2943 return res;
2944 }
2945
2946
2947 #if 0 /* FIX */
2948 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2949 struct sk_buff *skb, u8 *bssid,
2950 u8 *addr)
2951 {
2952 struct ieee80211_local *local = dev->priv;
2953 struct list_head *ptr;
2954 struct sta_info *sta;
2955 struct wpa_supplicant *sta_dev = NULL;
2956
2957 /* TODO: Could consider removing the least recently used entry and
2958 * allow new one to be added. */
2959 if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2960 if (net_ratelimit()) {
2961 wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2962 "STA entry " MACSTR, MAC2STR(addr));
2963 }
2964 return NULL;
2965 }
2966
2967 spin_lock_bh(&local->sub_if_lock);
2968 list_for_each(ptr, &local->sub_if_list) {
2969 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2970 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2971 os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2972 sta_dev = sdata->dev;
2973 break;
2974 }
2975 }
2976 spin_unlock_bh(&local->sub_if_lock);
2977
2978 if (sta_dev == NULL)
2979 return NULL;
2980
2981 wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2982 " (dev=%s)", MAC2STR(addr), sta_dev->name);
2983
2984 sta = sta_info_add(wpa_s, addr);
2985 if (sta == NULL) {
2986 return NULL;
2987 }
2988
2989 sta->dev = sta_dev;
2990 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2991
2992 rate_control_rate_init(local, sta);
2993
2994 return sta; /* caller will call sta_info_release() */
2995 }
2996 #endif
2997
2998
2999 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
3000 {
3001 wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
3002
3003 ieee80211_send_deauth(wpa_s, reason);
3004 ieee80211_set_associated(wpa_s, 0);
3005 return 0;
3006 }
3007
3008
3009 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
3010 {
3011 wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
3012
3013 if (!wpa_s->mlme.associated)
3014 return -1;
3015
3016 ieee80211_send_disassoc(wpa_s, reason);
3017 ieee80211_set_associated(wpa_s, 0);
3018 return 0;
3019 }
3020
3021
3022 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
3023 struct ieee80211_rx_status *rx_status)
3024 {
3025 struct ieee80211_mgmt *mgmt;
3026 u16 fc;
3027 const u8 *pos;
3028
3029 /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
3030
3031 if (wpa_s->mlme.sta_scanning) {
3032 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
3033 return;
3034 }
3035
3036 if (len < 24)
3037 return;
3038
3039 mgmt = (struct ieee80211_mgmt *) buf;
3040 fc = le_to_host16(mgmt->frame_control);
3041
3042 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
3043 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
3044 else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
3045 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
3046 WLAN_FC_FROMDS)
3047 return;
3048 /* mgmt->sa is actually BSSID for FromDS data frames */
3049 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
3050 return;
3051 /* Skip IEEE 802.11 and LLC headers */
3052 pos = buf + 24 + 6;
3053 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
3054 return;
3055 pos += 2;
3056 /* mgmt->bssid is actually BSSID for SA data frames */
3057 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
3058 pos, buf + len - pos);
3059 }
3060 }
3061
3062
3063 void ieee80211_sta_free_hw_features(struct hostapd_hw_modes *hw_features,
3064 size_t num_hw_features)
3065 {
3066 size_t i;
3067
3068 if (hw_features == NULL)
3069 return;
3070
3071 for (i = 0; i < num_hw_features; i++) {
3072 os_free(hw_features[i].channels);
3073 os_free(hw_features[i].rates);
3074 }
3075
3076 os_free(hw_features);
3077 }
3078
3079
3080 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
3081 {
3082 u16 num_modes, flags;
3083
3084 wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
3085 &flags);
3086 if (wpa_s->mlme.modes == NULL) {
3087 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
3088 "channels and rates from the driver");
3089 return -1;
3090 }
3091
3092 wpa_s->mlme.num_modes = num_modes;
3093
3094 wpa_s->mlme.hw_modes = 1 << HOSTAPD_MODE_IEEE80211A;
3095 wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211B;
3096 wpa_s->mlme.hw_modes |= 1 << HOSTAPD_MODE_IEEE80211G;
3097
3098 wpa_s->mlme.wmm_enabled = 1;
3099
3100 return 0;
3101 }
3102
3103
3104 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3105 {
3106 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3107 eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3108 os_free(wpa_s->mlme.extra_ie);
3109 wpa_s->mlme.extra_ie = NULL;
3110 os_free(wpa_s->mlme.extra_probe_ie);
3111 wpa_s->mlme.extra_probe_ie = NULL;
3112 os_free(wpa_s->mlme.assocreq_ies);
3113 wpa_s->mlme.assocreq_ies = NULL;
3114 os_free(wpa_s->mlme.assocresp_ies);
3115 wpa_s->mlme.assocresp_ies = NULL;
3116 ieee80211_bss_list_deinit(wpa_s);
3117 ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3118 wpa_s->mlme.num_modes);
3119 #ifdef CONFIG_IEEE80211R
3120 os_free(wpa_s->mlme.ft_ies);
3121 wpa_s->mlme.ft_ies = NULL;
3122 wpa_s->mlme.ft_ies_len = 0;
3123 #endif /* CONFIG_IEEE80211R */
3124
3125 os_free(wpa_s->mlme.scan_freqs);
3126 wpa_s->mlme.scan_freqs = NULL;
3127 }
3128
3129
3130 #ifdef CONFIG_IEEE80211R
3131
3132 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3133 const u8 *ies, size_t ies_len)
3134 {
3135 if (md == NULL) {
3136 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3137 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3138 } else {
3139 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3140 MAC2STR(md));
3141 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3142 }
3143
3144 wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3145 os_free(wpa_s->mlme.ft_ies);
3146 wpa_s->mlme.ft_ies = os_malloc(ies_len);
3147 if (wpa_s->mlme.ft_ies == NULL)
3148 return -1;
3149 os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3150 wpa_s->mlme.ft_ies_len = ies_len;
3151
3152 return 0;
3153 }
3154
3155
3156 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3157 const u8 *target_ap,
3158 const u8 *ies, size_t ies_len)
3159 {
3160 u8 *buf;
3161 size_t len;
3162 struct ieee80211_mgmt *mgmt;
3163 int res;
3164
3165 /*
3166 * Action frame payload:
3167 * Category[1] = 6 (Fast BSS Transition)
3168 * Action[1] = 1 (Fast BSS Transition Request)
3169 * STA Address
3170 * Target AP Address
3171 * FT IEs
3172 */
3173
3174 buf = os_zalloc(sizeof(*mgmt) + ies_len);
3175 if (buf == NULL) {
3176 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3177 "FT action frame");
3178 return -1;
3179 }
3180
3181 mgmt = (struct ieee80211_mgmt *) buf;
3182 len = 24;
3183 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3184 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3185 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3186 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3187 WLAN_FC_STYPE_ACTION);
3188 mgmt->u.action.category = WLAN_ACTION_FT;
3189 mgmt->u.action.u.ft_action_req.action = action;
3190 os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3191 ETH_ALEN);
3192 os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3193 ETH_ALEN);
3194 os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3195 len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3196
3197 wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3198 "Target AP=" MACSTR " body_len=%lu",
3199 action, MAC2STR(target_ap), (unsigned long) ies_len);
3200
3201 res = ieee80211_sta_tx(wpa_s, buf, len);
3202 os_free(buf);
3203
3204 return res;
3205 }
3206
3207 #endif /* CONFIG_IEEE80211R */
3208
3209
3210 static int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s,
3211 const u8 *ies, size_t ies_len)
3212 {
3213 os_free(wpa_s->mlme.extra_probe_ie);
3214 wpa_s->mlme.extra_probe_ie = NULL;
3215 wpa_s->mlme.extra_probe_ie_len = 0;
3216
3217 if (ies == NULL)
3218 return 0;
3219
3220 wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3221 if (wpa_s->mlme.extra_probe_ie == NULL)
3222 return -1;
3223
3224 os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3225 wpa_s->mlme.extra_probe_ie_len = ies_len;
3226
3227 return 0;
3228 }