1 /*
2 * hostapd / Station table
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/wpa_ctrl.h"
15 #include "common/sae.h"
16 #include "common/dpp.h"
17 #include "radius/radius.h"
18 #include "radius/radius_client.h"
19 #include "p2p/p2p.h"
20 #include "fst/fst.h"
21 #include "crypto/crypto.h"
22 #include "hostapd.h"
23 #include "accounting.h"
24 #include "ieee802_1x.h"
25 #include "ieee802_11.h"
26 #include "ieee802_11_auth.h"
27 #include "wpa_auth.h"
28 #include "preauth_auth.h"
29 #include "ap_config.h"
30 #include "beacon.h"
31 #include "ap_mlme.h"
32 #include "vlan_init.h"
33 #include "p2p_hostapd.h"
34 #include "ap_drv_ops.h"
35 #include "gas_serv.h"
36 #include "wnm_ap.h"
37 #include "mbo_ap.h"
38 #include "ndisc_snoop.h"
39 #include "sta_info.h"
40 #include "vlan.h"
41 #include "wps_hostapd.h"
42
43 static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd,
44 struct sta_info *sta);
45 static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx);
46 static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx);
47 static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx);
48 static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx);
49 static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx);
50 static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta);
51 static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx);
52
ap_for_each_sta(struct hostapd_data * hapd,int (* cb)(struct hostapd_data * hapd,struct sta_info * sta,void * ctx),void * ctx)53 int ap_for_each_sta(struct hostapd_data *hapd,
54 int (*cb)(struct hostapd_data *hapd, struct sta_info *sta,
55 void *ctx),
56 void *ctx)
57 {
58 struct sta_info *sta;
59
60 for (sta = hapd->sta_list; sta; sta = sta->next) {
61 if (cb(hapd, sta, ctx))
62 return 1;
63 }
64
65 return 0;
66 }
67
68
ap_get_sta(struct hostapd_data * hapd,const u8 * sta)69 struct sta_info * ap_get_sta(struct hostapd_data *hapd, const u8 *sta)
70 {
71 struct sta_info *s;
72
73 s = hapd->sta_hash[STA_HASH(sta)];
74 while (s != NULL && os_memcmp(s->addr, sta, 6) != 0)
75 s = s->hnext;
76 return s;
77 }
78
79
80 #ifdef CONFIG_P2P
ap_get_sta_p2p(struct hostapd_data * hapd,const u8 * addr)81 struct sta_info * ap_get_sta_p2p(struct hostapd_data *hapd, const u8 *addr)
82 {
83 struct sta_info *sta;
84
85 for (sta = hapd->sta_list; sta; sta = sta->next) {
86 const u8 *p2p_dev_addr;
87
88 if (sta->p2p_ie == NULL)
89 continue;
90
91 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
92 if (p2p_dev_addr == NULL)
93 continue;
94
95 if (os_memcmp(p2p_dev_addr, addr, ETH_ALEN) == 0)
96 return sta;
97 }
98
99 return NULL;
100 }
101 #endif /* CONFIG_P2P */
102
103
ap_sta_list_del(struct hostapd_data * hapd,struct sta_info * sta)104 static void ap_sta_list_del(struct hostapd_data *hapd, struct sta_info *sta)
105 {
106 struct sta_info *tmp;
107
108 if (hapd->sta_list == sta) {
109 hapd->sta_list = sta->next;
110 return;
111 }
112
113 tmp = hapd->sta_list;
114 while (tmp != NULL && tmp->next != sta)
115 tmp = tmp->next;
116 if (tmp == NULL) {
117 wpa_printf(MSG_DEBUG, "Could not remove STA " MACSTR " from "
118 "list.", MAC2STR(sta->addr));
119 } else
120 tmp->next = sta->next;
121 }
122
123
ap_sta_hash_add(struct hostapd_data * hapd,struct sta_info * sta)124 void ap_sta_hash_add(struct hostapd_data *hapd, struct sta_info *sta)
125 {
126 sta->hnext = hapd->sta_hash[STA_HASH(sta->addr)];
127 hapd->sta_hash[STA_HASH(sta->addr)] = sta;
128 }
129
130
ap_sta_hash_del(struct hostapd_data * hapd,struct sta_info * sta)131 static void ap_sta_hash_del(struct hostapd_data *hapd, struct sta_info *sta)
132 {
133 struct sta_info *s;
134
135 s = hapd->sta_hash[STA_HASH(sta->addr)];
136 if (s == NULL) return;
137 if (os_memcmp(s->addr, sta->addr, 6) == 0) {
138 hapd->sta_hash[STA_HASH(sta->addr)] = s->hnext;
139 return;
140 }
141
142 while (s->hnext != NULL &&
143 os_memcmp(s->hnext->addr, sta->addr, ETH_ALEN) != 0)
144 s = s->hnext;
145 if (s->hnext != NULL)
146 s->hnext = s->hnext->hnext;
147 else
148 wpa_printf(MSG_DEBUG, "AP: could not remove STA " MACSTR
149 " from hash table", MAC2STR(sta->addr));
150 }
151
152
ap_sta_ip6addr_del(struct hostapd_data * hapd,struct sta_info * sta)153 void ap_sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta)
154 {
155 sta_ip6addr_del(hapd, sta);
156 }
157
158
ap_free_sta(struct hostapd_data * hapd,struct sta_info * sta)159 void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
160 {
161 int set_beacon = 0;
162
163 accounting_sta_stop(hapd, sta);
164
165 /* just in case */
166 ap_sta_set_authorized(hapd, sta, 0);
167 hostapd_set_sta_flags(hapd, sta);
168
169 if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP))
170 hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0);
171
172 if (sta->ipaddr)
173 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
174 ap_sta_ip6addr_del(hapd, sta);
175
176 if (!hapd->iface->driver_ap_teardown &&
177 !(sta->flags & WLAN_STA_PREAUTH)) {
178 hostapd_drv_sta_remove(hapd, sta->addr);
179 sta->added_unassoc = 0;
180 }
181
182 ap_sta_hash_del(hapd, sta);
183 ap_sta_list_del(hapd, sta);
184
185 if (sta->aid > 0)
186 hapd->sta_aid[(sta->aid - 1) / 32] &=
187 ~BIT((sta->aid - 1) % 32);
188
189 hapd->num_sta--;
190 if (sta->nonerp_set) {
191 sta->nonerp_set = 0;
192 hapd->iface->num_sta_non_erp--;
193 if (hapd->iface->num_sta_non_erp == 0)
194 set_beacon++;
195 }
196
197 if (sta->no_short_slot_time_set) {
198 sta->no_short_slot_time_set = 0;
199 hapd->iface->num_sta_no_short_slot_time--;
200 if (hapd->iface->current_mode &&
201 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
202 && hapd->iface->num_sta_no_short_slot_time == 0)
203 set_beacon++;
204 }
205
206 if (sta->no_short_preamble_set) {
207 sta->no_short_preamble_set = 0;
208 hapd->iface->num_sta_no_short_preamble--;
209 if (hapd->iface->current_mode &&
210 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
211 && hapd->iface->num_sta_no_short_preamble == 0)
212 set_beacon++;
213 }
214
215 if (sta->no_ht_gf_set) {
216 sta->no_ht_gf_set = 0;
217 hapd->iface->num_sta_ht_no_gf--;
218 }
219
220 if (sta->no_ht_set) {
221 sta->no_ht_set = 0;
222 hapd->iface->num_sta_no_ht--;
223 }
224
225 if (sta->ht_20mhz_set) {
226 sta->ht_20mhz_set = 0;
227 hapd->iface->num_sta_ht_20mhz--;
228 }
229
230 #ifdef CONFIG_TAXONOMY
231 wpabuf_free(sta->probe_ie_taxonomy);
232 sta->probe_ie_taxonomy = NULL;
233 wpabuf_free(sta->assoc_ie_taxonomy);
234 sta->assoc_ie_taxonomy = NULL;
235 #endif /* CONFIG_TAXONOMY */
236
237 ht40_intolerant_remove(hapd->iface, sta);
238
239 #ifdef CONFIG_P2P
240 if (sta->no_p2p_set) {
241 sta->no_p2p_set = 0;
242 hapd->num_sta_no_p2p--;
243 if (hapd->num_sta_no_p2p == 0)
244 hostapd_p2p_non_p2p_sta_disconnected(hapd);
245 }
246 #endif /* CONFIG_P2P */
247
248 #ifdef NEED_AP_MLME
249 if (hostapd_ht_operation_update(hapd->iface) > 0)
250 set_beacon++;
251 #endif /* NEED_AP_MLME */
252
253 #ifdef CONFIG_MESH
254 if (hapd->mesh_sta_free_cb)
255 hapd->mesh_sta_free_cb(hapd, sta);
256 #endif /* CONFIG_MESH */
257
258 if (set_beacon)
259 ieee802_11_set_beacons(hapd->iface);
260
261 wpa_printf(MSG_DEBUG, "%s: cancel ap_handle_timer for " MACSTR,
262 __func__, MAC2STR(sta->addr));
263 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
264 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
265 eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta);
266 ap_sta_clear_disconnect_timeouts(hapd, sta);
267 sae_clear_retransmit_timer(hapd, sta);
268
269 ieee802_1x_free_station(hapd, sta);
270 wpa_auth_sta_deinit(sta->wpa_sm);
271 rsn_preauth_free_station(hapd, sta);
272 #ifndef CONFIG_NO_RADIUS
273 if (hapd->radius)
274 radius_client_flush_auth(hapd->radius, sta->addr);
275 #endif /* CONFIG_NO_RADIUS */
276
277 #ifndef CONFIG_NO_VLAN
278 /*
279 * sta->wpa_sm->group needs to be released before so that
280 * vlan_remove_dynamic() can check that no stations are left on the
281 * AP_VLAN netdev.
282 */
283 if (sta->vlan_id)
284 vlan_remove_dynamic(hapd, sta->vlan_id);
285 if (sta->vlan_id_bound) {
286 /*
287 * Need to remove the STA entry before potentially removing the
288 * VLAN.
289 */
290 if (hapd->iface->driver_ap_teardown &&
291 !(sta->flags & WLAN_STA_PREAUTH)) {
292 hostapd_drv_sta_remove(hapd, sta->addr);
293 sta->added_unassoc = 0;
294 }
295 vlan_remove_dynamic(hapd, sta->vlan_id_bound);
296 }
297 #endif /* CONFIG_NO_VLAN */
298
299 os_free(sta->challenge);
300
301 os_free(sta->sa_query_trans_id);
302 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
303
304 #ifdef CONFIG_P2P
305 p2p_group_notif_disassoc(hapd->p2p_group, sta->addr);
306 #endif /* CONFIG_P2P */
307
308 #ifdef CONFIG_INTERWORKING
309 if (sta->gas_dialog) {
310 int i;
311 for (i = 0; i < GAS_DIALOG_MAX; i++)
312 gas_serv_dialog_clear(&sta->gas_dialog[i]);
313 os_free(sta->gas_dialog);
314 }
315 #endif /* CONFIG_INTERWORKING */
316
317 wpabuf_free(sta->wps_ie);
318 wpabuf_free(sta->p2p_ie);
319 wpabuf_free(sta->hs20_ie);
320 wpabuf_free(sta->roaming_consortium);
321 #ifdef CONFIG_FST
322 wpabuf_free(sta->mb_ies);
323 #endif /* CONFIG_FST */
324
325 os_free(sta->ht_capabilities);
326 os_free(sta->vht_capabilities);
327 os_free(sta->vht_operation);
328 os_free(sta->he_capab);
329 os_free(sta->he_6ghz_capab);
330 hostapd_free_psk_list(sta->psk);
331 os_free(sta->identity);
332 os_free(sta->radius_cui);
333 os_free(sta->remediation_url);
334 os_free(sta->t_c_url);
335 wpabuf_free(sta->hs20_deauth_req);
336 os_free(sta->hs20_session_info_url);
337
338 #ifdef CONFIG_SAE
339 sae_clear_data(sta->sae);
340 os_free(sta->sae);
341 #endif /* CONFIG_SAE */
342
343 mbo_ap_sta_free(sta);
344 os_free(sta->supp_op_classes);
345
346 #ifdef CONFIG_FILS
347 os_free(sta->fils_pending_assoc_req);
348 wpabuf_free(sta->fils_hlp_resp);
349 wpabuf_free(sta->hlp_dhcp_discover);
350 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
351 #ifdef CONFIG_FILS_SK_PFS
352 crypto_ecdh_deinit(sta->fils_ecdh);
353 wpabuf_clear_free(sta->fils_dh_ss);
354 wpabuf_free(sta->fils_g_sta);
355 #endif /* CONFIG_FILS_SK_PFS */
356 #endif /* CONFIG_FILS */
357
358 #ifdef CONFIG_OWE
359 bin_clear_free(sta->owe_pmk, sta->owe_pmk_len);
360 crypto_ecdh_deinit(sta->owe_ecdh);
361 #endif /* CONFIG_OWE */
362
363 #ifdef CONFIG_DPP2
364 dpp_pfs_free(sta->dpp_pfs);
365 sta->dpp_pfs = NULL;
366 #endif /* CONFIG_DPP2 */
367
368 os_free(sta->ext_capability);
369
370 #ifdef CONFIG_WNM_AP
371 eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
372 #endif /* CONFIG_WNM_AP */
373
374 os_free(sta->ifname_wds);
375
376 #ifdef CONFIG_TESTING_OPTIONS
377 os_free(sta->sae_postponed_commit);
378 #endif /* CONFIG_TESTING_OPTIONS */
379
380 os_free(sta);
381 }
382
383
hostapd_free_stas(struct hostapd_data * hapd)384 void hostapd_free_stas(struct hostapd_data *hapd)
385 {
386 struct sta_info *sta, *prev;
387
388 sta = hapd->sta_list;
389
390 while (sta) {
391 prev = sta;
392 if (sta->flags & WLAN_STA_AUTH) {
393 mlme_deauthenticate_indication(
394 hapd, sta, WLAN_REASON_UNSPECIFIED);
395 }
396 sta = sta->next;
397 wpa_printf(MSG_DEBUG, "Removing station " MACSTR,
398 MAC2STR(prev->addr));
399 ap_free_sta(hapd, prev);
400 }
401 }
402
403
404 /**
405 * ap_handle_timer - Per STA timer handler
406 * @eloop_ctx: struct hostapd_data *
407 * @timeout_ctx: struct sta_info *
408 *
409 * This function is called to check station activity and to remove inactive
410 * stations.
411 */
ap_handle_timer(void * eloop_ctx,void * timeout_ctx)412 void ap_handle_timer(void *eloop_ctx, void *timeout_ctx)
413 {
414 struct hostapd_data *hapd = eloop_ctx;
415 struct sta_info *sta = timeout_ctx;
416 unsigned long next_time = 0;
417 int reason;
418
419 wpa_printf(MSG_DEBUG, "%s: %s: " MACSTR " flags=0x%x timeout_next=%d",
420 hapd->conf->iface, __func__, MAC2STR(sta->addr), sta->flags,
421 sta->timeout_next);
422 if (sta->timeout_next == STA_REMOVE) {
423 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
424 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
425 "local deauth request");
426 ap_free_sta(hapd, sta);
427 return;
428 }
429
430 if ((sta->flags & WLAN_STA_ASSOC) &&
431 (sta->timeout_next == STA_NULLFUNC ||
432 sta->timeout_next == STA_DISASSOC)) {
433 int inactive_sec;
434 /*
435 * Add random value to timeout so that we don't end up bouncing
436 * all stations at the same time if we have lots of associated
437 * stations that are idle (but keep re-associating).
438 */
439 int fuzz = os_random() % 20;
440 inactive_sec = hostapd_drv_get_inact_sec(hapd, sta->addr);
441 if (inactive_sec == -1) {
442 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
443 "Check inactivity: Could not "
444 "get station info from kernel driver for "
445 MACSTR, MAC2STR(sta->addr));
446 /*
447 * The driver may not support this functionality.
448 * Anyway, try again after the next inactivity timeout,
449 * but do not disconnect the station now.
450 */
451 next_time = hapd->conf->ap_max_inactivity + fuzz;
452 } else if (inactive_sec == -ENOENT) {
453 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
454 "Station " MACSTR " has lost its driver entry",
455 MAC2STR(sta->addr));
456
457 /* Avoid sending client probe on removed client */
458 sta->timeout_next = STA_DISASSOC;
459 goto skip_poll;
460 } else if (inactive_sec < hapd->conf->ap_max_inactivity) {
461 /* station activity detected; reset timeout state */
462 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
463 "Station " MACSTR " has been active %is ago",
464 MAC2STR(sta->addr), inactive_sec);
465 sta->timeout_next = STA_NULLFUNC;
466 next_time = hapd->conf->ap_max_inactivity + fuzz -
467 inactive_sec;
468 } else {
469 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
470 "Station " MACSTR " has been "
471 "inactive too long: %d sec, max allowed: %d",
472 MAC2STR(sta->addr), inactive_sec,
473 hapd->conf->ap_max_inactivity);
474
475 if (hapd->conf->skip_inactivity_poll)
476 sta->timeout_next = STA_DISASSOC;
477 }
478 }
479
480 if ((sta->flags & WLAN_STA_ASSOC) &&
481 sta->timeout_next == STA_DISASSOC &&
482 !(sta->flags & WLAN_STA_PENDING_POLL) &&
483 !hapd->conf->skip_inactivity_poll) {
484 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR
485 " has ACKed data poll", MAC2STR(sta->addr));
486 /* data nullfunc frame poll did not produce TX errors; assume
487 * station ACKed it */
488 sta->timeout_next = STA_NULLFUNC;
489 next_time = hapd->conf->ap_max_inactivity;
490 }
491
492 skip_poll:
493 if (next_time) {
494 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
495 "for " MACSTR " (%lu seconds)",
496 __func__, MAC2STR(sta->addr), next_time);
497 eloop_register_timeout(next_time, 0, ap_handle_timer, hapd,
498 sta);
499 return;
500 }
501
502 if (sta->timeout_next == STA_NULLFUNC &&
503 (sta->flags & WLAN_STA_ASSOC)) {
504 wpa_printf(MSG_DEBUG, " Polling STA");
505 sta->flags |= WLAN_STA_PENDING_POLL;
506 hostapd_drv_poll_client(hapd, hapd->own_addr, sta->addr,
507 sta->flags & WLAN_STA_WMM);
508 } else if (sta->timeout_next != STA_REMOVE) {
509 int deauth = sta->timeout_next == STA_DEAUTH;
510
511 if (!deauth && !(sta->flags & WLAN_STA_ASSOC)) {
512 /* Cannot disassociate not-associated STA, so move
513 * directly to deauthentication. */
514 sta->timeout_next = STA_DEAUTH;
515 deauth = 1;
516 }
517
518 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
519 "Timeout, sending %s info to STA " MACSTR,
520 deauth ? "deauthentication" : "disassociation",
521 MAC2STR(sta->addr));
522
523 if (deauth) {
524 hostapd_drv_sta_deauth(
525 hapd, sta->addr,
526 WLAN_REASON_PREV_AUTH_NOT_VALID);
527 } else {
528 reason = (sta->timeout_next == STA_DISASSOC) ?
529 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY :
530 WLAN_REASON_PREV_AUTH_NOT_VALID;
531
532 hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
533 }
534 }
535
536 switch (sta->timeout_next) {
537 case STA_NULLFUNC:
538 sta->timeout_next = STA_DISASSOC;
539 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
540 "for " MACSTR " (%d seconds - AP_DISASSOC_DELAY)",
541 __func__, MAC2STR(sta->addr), AP_DISASSOC_DELAY);
542 eloop_register_timeout(AP_DISASSOC_DELAY, 0, ap_handle_timer,
543 hapd, sta);
544 break;
545 case STA_DISASSOC:
546 case STA_DISASSOC_FROM_CLI:
547 ap_sta_set_authorized(hapd, sta, 0);
548 sta->flags &= ~WLAN_STA_ASSOC;
549 hostapd_set_sta_flags(hapd, sta);
550 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
551 if (!sta->acct_terminate_cause)
552 sta->acct_terminate_cause =
553 RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT;
554 accounting_sta_stop(hapd, sta);
555 ieee802_1x_free_station(hapd, sta);
556 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
557 HOSTAPD_LEVEL_INFO, "disassociated due to "
558 "inactivity");
559 reason = (sta->timeout_next == STA_DISASSOC) ?
560 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY :
561 WLAN_REASON_PREV_AUTH_NOT_VALID;
562 sta->timeout_next = STA_DEAUTH;
563 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
564 "for " MACSTR " (%d seconds - AP_DEAUTH_DELAY)",
565 __func__, MAC2STR(sta->addr), AP_DEAUTH_DELAY);
566 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
567 hapd, sta);
568 mlme_disassociate_indication(hapd, sta, reason);
569 break;
570 case STA_DEAUTH:
571 case STA_REMOVE:
572 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
573 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
574 "inactivity (timer DEAUTH/REMOVE)");
575 if (!sta->acct_terminate_cause)
576 sta->acct_terminate_cause =
577 RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT;
578 mlme_deauthenticate_indication(
579 hapd, sta,
580 WLAN_REASON_PREV_AUTH_NOT_VALID);
581 ap_free_sta(hapd, sta);
582 break;
583 }
584 }
585
586
ap_handle_session_timer(void * eloop_ctx,void * timeout_ctx)587 static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx)
588 {
589 struct hostapd_data *hapd = eloop_ctx;
590 struct sta_info *sta = timeout_ctx;
591
592 wpa_printf(MSG_DEBUG, "%s: Session timer for STA " MACSTR,
593 hapd->conf->iface, MAC2STR(sta->addr));
594 if (!(sta->flags & (WLAN_STA_AUTH | WLAN_STA_ASSOC |
595 WLAN_STA_AUTHORIZED))) {
596 if (sta->flags & WLAN_STA_GAS) {
597 wpa_printf(MSG_DEBUG, "GAS: Remove temporary STA "
598 "entry " MACSTR, MAC2STR(sta->addr));
599 ap_free_sta(hapd, sta);
600 }
601 return;
602 }
603
604 hostapd_drv_sta_deauth(hapd, sta->addr,
605 WLAN_REASON_PREV_AUTH_NOT_VALID);
606 mlme_deauthenticate_indication(hapd, sta,
607 WLAN_REASON_PREV_AUTH_NOT_VALID);
608 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
609 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
610 "session timeout");
611 sta->acct_terminate_cause =
612 RADIUS_ACCT_TERMINATE_CAUSE_SESSION_TIMEOUT;
613 ap_free_sta(hapd, sta);
614 }
615
616
ap_sta_replenish_timeout(struct hostapd_data * hapd,struct sta_info * sta,u32 session_timeout)617 void ap_sta_replenish_timeout(struct hostapd_data *hapd, struct sta_info *sta,
618 u32 session_timeout)
619 {
620 if (eloop_replenish_timeout(session_timeout, 0,
621 ap_handle_session_timer, hapd, sta) == 1) {
622 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
623 HOSTAPD_LEVEL_DEBUG, "setting session timeout "
624 "to %d seconds", session_timeout);
625 }
626 }
627
628
ap_sta_session_timeout(struct hostapd_data * hapd,struct sta_info * sta,u32 session_timeout)629 void ap_sta_session_timeout(struct hostapd_data *hapd, struct sta_info *sta,
630 u32 session_timeout)
631 {
632 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
633 HOSTAPD_LEVEL_DEBUG, "setting session timeout to %d "
634 "seconds", session_timeout);
635 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
636 eloop_register_timeout(session_timeout, 0, ap_handle_session_timer,
637 hapd, sta);
638 }
639
640
ap_sta_no_session_timeout(struct hostapd_data * hapd,struct sta_info * sta)641 void ap_sta_no_session_timeout(struct hostapd_data *hapd, struct sta_info *sta)
642 {
643 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
644 }
645
646
ap_handle_session_warning_timer(void * eloop_ctx,void * timeout_ctx)647 static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx)
648 {
649 #ifdef CONFIG_WNM_AP
650 struct hostapd_data *hapd = eloop_ctx;
651 struct sta_info *sta = timeout_ctx;
652
653 wpa_printf(MSG_DEBUG, "%s: WNM: Session warning time reached for "
654 MACSTR, hapd->conf->iface, MAC2STR(sta->addr));
655 if (sta->hs20_session_info_url == NULL)
656 return;
657
658 wnm_send_ess_disassoc_imminent(hapd, sta, sta->hs20_session_info_url,
659 sta->hs20_disassoc_timer);
660 #endif /* CONFIG_WNM_AP */
661 }
662
663
ap_sta_session_warning_timeout(struct hostapd_data * hapd,struct sta_info * sta,int warning_time)664 void ap_sta_session_warning_timeout(struct hostapd_data *hapd,
665 struct sta_info *sta, int warning_time)
666 {
667 eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta);
668 eloop_register_timeout(warning_time, 0, ap_handle_session_warning_timer,
669 hapd, sta);
670 }
671
672
ap_sta_add(struct hostapd_data * hapd,const u8 * addr)673 struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr)
674 {
675 struct sta_info *sta;
676 int i;
677
678 sta = ap_get_sta(hapd, addr);
679 if (sta)
680 return sta;
681
682 wpa_printf(MSG_DEBUG, " New STA");
683 if (hapd->num_sta >= hapd->conf->max_num_sta) {
684 /* FIX: might try to remove some old STAs first? */
685 wpa_printf(MSG_DEBUG, "no more room for new STAs (%d/%d)",
686 hapd->num_sta, hapd->conf->max_num_sta);
687 return NULL;
688 }
689
690 sta = os_zalloc(sizeof(struct sta_info));
691 if (sta == NULL) {
692 wpa_printf(MSG_ERROR, "malloc failed");
693 return NULL;
694 }
695 sta->acct_interim_interval = hapd->conf->acct_interim_interval;
696 if (accounting_sta_get_id(hapd, sta) < 0) {
697 os_free(sta);
698 return NULL;
699 }
700
701 for (i = 0; i < WLAN_SUPP_RATES_MAX; i++) {
702 if (!hapd->iface->basic_rates)
703 break;
704 if (hapd->iface->basic_rates[i] < 0)
705 break;
706 sta->supported_rates[i] = hapd->iface->basic_rates[i] / 5;
707 }
708 sta->supported_rates_len = i;
709
710 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)) {
711 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
712 "for " MACSTR " (%d seconds - ap_max_inactivity)",
713 __func__, MAC2STR(addr),
714 hapd->conf->ap_max_inactivity);
715 eloop_register_timeout(hapd->conf->ap_max_inactivity, 0,
716 ap_handle_timer, hapd, sta);
717 }
718
719 /* initialize STA info data */
720 os_memcpy(sta->addr, addr, ETH_ALEN);
721 sta->next = hapd->sta_list;
722 hapd->sta_list = sta;
723 hapd->num_sta++;
724 ap_sta_hash_add(hapd, sta);
725 ap_sta_remove_in_other_bss(hapd, sta);
726 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
727 dl_list_init(&sta->ip6addr);
728
729 #ifdef CONFIG_TAXONOMY
730 sta_track_claim_taxonomy_info(hapd->iface, addr,
731 &sta->probe_ie_taxonomy);
732 #endif /* CONFIG_TAXONOMY */
733
734 return sta;
735 }
736
737
ap_sta_remove(struct hostapd_data * hapd,struct sta_info * sta)738 static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta)
739 {
740 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
741
742 if (sta->ipaddr)
743 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
744 ap_sta_ip6addr_del(hapd, sta);
745
746 wpa_printf(MSG_DEBUG, "%s: Removing STA " MACSTR " from kernel driver",
747 hapd->conf->iface, MAC2STR(sta->addr));
748 if (hostapd_drv_sta_remove(hapd, sta->addr) &&
749 sta->flags & WLAN_STA_ASSOC) {
750 wpa_printf(MSG_DEBUG, "%s: Could not remove station " MACSTR
751 " from kernel driver",
752 hapd->conf->iface, MAC2STR(sta->addr));
753 return -1;
754 }
755 sta->added_unassoc = 0;
756 return 0;
757 }
758
759
ap_sta_remove_in_other_bss(struct hostapd_data * hapd,struct sta_info * sta)760 static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd,
761 struct sta_info *sta)
762 {
763 struct hostapd_iface *iface = hapd->iface;
764 size_t i;
765
766 for (i = 0; i < iface->num_bss; i++) {
767 struct hostapd_data *bss = iface->bss[i];
768 struct sta_info *sta2;
769 /* bss should always be set during operation, but it may be
770 * NULL during reconfiguration. Assume the STA is not
771 * associated to another BSS in that case to avoid NULL pointer
772 * dereferences. */
773 if (bss == hapd || bss == NULL)
774 continue;
775 sta2 = ap_get_sta(bss, sta->addr);
776 if (!sta2)
777 continue;
778
779 wpa_printf(MSG_DEBUG, "%s: disconnect old STA " MACSTR
780 " association from another BSS %s",
781 hapd->conf->iface, MAC2STR(sta2->addr),
782 bss->conf->iface);
783 ap_sta_disconnect(bss, sta2, sta2->addr,
784 WLAN_REASON_PREV_AUTH_NOT_VALID);
785 }
786 }
787
788
ap_sta_disassoc_cb_timeout(void * eloop_ctx,void * timeout_ctx)789 static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx)
790 {
791 struct hostapd_data *hapd = eloop_ctx;
792 struct sta_info *sta = timeout_ctx;
793
794 wpa_printf(MSG_DEBUG, "%s: Disassociation callback for STA " MACSTR,
795 hapd->conf->iface, MAC2STR(sta->addr));
796 ap_sta_remove(hapd, sta);
797 mlme_disassociate_indication(hapd, sta, sta->disassoc_reason);
798 }
799
800
ap_sta_disassociate(struct hostapd_data * hapd,struct sta_info * sta,u16 reason)801 void ap_sta_disassociate(struct hostapd_data *hapd, struct sta_info *sta,
802 u16 reason)
803 {
804 wpa_printf(MSG_DEBUG, "%s: disassociate STA " MACSTR,
805 hapd->conf->iface, MAC2STR(sta->addr));
806 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
807 if (hapd->iface->current_mode &&
808 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
809 /* Skip deauthentication in DMG/IEEE 802.11ad */
810 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
811 WLAN_STA_ASSOC_REQ_OK);
812 sta->timeout_next = STA_REMOVE;
813 } else {
814 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
815 sta->timeout_next = STA_DEAUTH;
816 }
817 ap_sta_set_authorized(hapd, sta, 0);
818 hostapd_set_sta_flags(hapd, sta);
819 wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout "
820 "for " MACSTR " (%d seconds - "
821 "AP_MAX_INACTIVITY_AFTER_DISASSOC)",
822 __func__, MAC2STR(sta->addr),
823 AP_MAX_INACTIVITY_AFTER_DISASSOC);
824 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
825 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DISASSOC, 0,
826 ap_handle_timer, hapd, sta);
827 accounting_sta_stop(hapd, sta);
828 ieee802_1x_free_station(hapd, sta);
829 wpa_auth_sta_deinit(sta->wpa_sm);
830 sta->wpa_sm = NULL;
831
832 sta->disassoc_reason = reason;
833 sta->flags |= WLAN_STA_PENDING_DISASSOC_CB;
834 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
835 eloop_register_timeout(hapd->iface->drv_flags &
836 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
837 ap_sta_disassoc_cb_timeout, hapd, sta);
838 }
839
840
ap_sta_deauth_cb_timeout(void * eloop_ctx,void * timeout_ctx)841 static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx)
842 {
843 struct hostapd_data *hapd = eloop_ctx;
844 struct sta_info *sta = timeout_ctx;
845
846 wpa_printf(MSG_DEBUG, "%s: Deauthentication callback for STA " MACSTR,
847 hapd->conf->iface, MAC2STR(sta->addr));
848 ap_sta_remove(hapd, sta);
849 mlme_deauthenticate_indication(hapd, sta, sta->deauth_reason);
850 }
851
852
ap_sta_deauthenticate(struct hostapd_data * hapd,struct sta_info * sta,u16 reason)853 void ap_sta_deauthenticate(struct hostapd_data *hapd, struct sta_info *sta,
854 u16 reason)
855 {
856 if (hapd->iface->current_mode &&
857 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
858 /* Deauthentication is not used in DMG/IEEE 802.11ad;
859 * disassociate the STA instead. */
860 ap_sta_disassociate(hapd, sta, reason);
861 return;
862 }
863
864 wpa_printf(MSG_DEBUG, "%s: deauthenticate STA " MACSTR,
865 hapd->conf->iface, MAC2STR(sta->addr));
866 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
867 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
868 ap_sta_set_authorized(hapd, sta, 0);
869 hostapd_set_sta_flags(hapd, sta);
870 sta->timeout_next = STA_REMOVE;
871 wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout "
872 "for " MACSTR " (%d seconds - "
873 "AP_MAX_INACTIVITY_AFTER_DEAUTH)",
874 __func__, MAC2STR(sta->addr),
875 AP_MAX_INACTIVITY_AFTER_DEAUTH);
876 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
877 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0,
878 ap_handle_timer, hapd, sta);
879 accounting_sta_stop(hapd, sta);
880 ieee802_1x_free_station(hapd, sta);
881
882 sta->deauth_reason = reason;
883 sta->flags |= WLAN_STA_PENDING_DEAUTH_CB;
884 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
885 eloop_register_timeout(hapd->iface->drv_flags &
886 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
887 ap_sta_deauth_cb_timeout, hapd, sta);
888 }
889
890
891 #ifdef CONFIG_WPS
ap_sta_wps_cancel(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)892 int ap_sta_wps_cancel(struct hostapd_data *hapd,
893 struct sta_info *sta, void *ctx)
894 {
895 if (sta && (sta->flags & WLAN_STA_WPS)) {
896 ap_sta_deauthenticate(hapd, sta,
897 WLAN_REASON_PREV_AUTH_NOT_VALID);
898 wpa_printf(MSG_DEBUG, "WPS: %s: Deauth sta=" MACSTR,
899 __func__, MAC2STR(sta->addr));
900 return 1;
901 }
902
903 return 0;
904 }
905 #endif /* CONFIG_WPS */
906
907
ap_sta_get_free_vlan_id(struct hostapd_data * hapd)908 static int ap_sta_get_free_vlan_id(struct hostapd_data *hapd)
909 {
910 struct hostapd_vlan *vlan;
911 int vlan_id = MAX_VLAN_ID + 2;
912
913 retry:
914 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
915 if (vlan->vlan_id == vlan_id) {
916 vlan_id++;
917 goto retry;
918 }
919 }
920 return vlan_id;
921 }
922
923
ap_sta_set_vlan(struct hostapd_data * hapd,struct sta_info * sta,struct vlan_description * vlan_desc)924 int ap_sta_set_vlan(struct hostapd_data *hapd, struct sta_info *sta,
925 struct vlan_description *vlan_desc)
926 {
927 struct hostapd_vlan *vlan = NULL, *wildcard_vlan = NULL;
928 int old_vlan_id, vlan_id = 0, ret = 0;
929
930 /* Check if there is something to do */
931 if (hapd->conf->ssid.per_sta_vif && !sta->vlan_id) {
932 /* This sta is lacking its own vif */
933 } else if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED &&
934 !hapd->conf->ssid.per_sta_vif && sta->vlan_id) {
935 /* sta->vlan_id needs to be reset */
936 } else if (!vlan_compare(vlan_desc, sta->vlan_desc)) {
937 return 0; /* nothing to change */
938 }
939
940 /* Now the real VLAN changed or the STA just needs its own vif */
941 if (hapd->conf->ssid.per_sta_vif) {
942 /* Assign a new vif, always */
943 /* find a free vlan_id sufficiently big */
944 vlan_id = ap_sta_get_free_vlan_id(hapd);
945 /* Get wildcard VLAN */
946 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
947 if (vlan->vlan_id == VLAN_ID_WILDCARD)
948 break;
949 }
950 if (!vlan) {
951 hostapd_logger(hapd, sta->addr,
952 HOSTAPD_MODULE_IEEE80211,
953 HOSTAPD_LEVEL_DEBUG,
954 "per_sta_vif missing wildcard");
955 vlan_id = 0;
956 ret = -1;
957 goto done;
958 }
959 } else if (vlan_desc && vlan_desc->notempty) {
960 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
961 if (!vlan_compare(&vlan->vlan_desc, vlan_desc))
962 break;
963 if (vlan->vlan_id == VLAN_ID_WILDCARD)
964 wildcard_vlan = vlan;
965 }
966 if (vlan) {
967 vlan_id = vlan->vlan_id;
968 } else if (wildcard_vlan) {
969 vlan = wildcard_vlan;
970 vlan_id = vlan_desc->untagged;
971 if (vlan_desc->tagged[0]) {
972 /* Tagged VLAN configuration */
973 vlan_id = ap_sta_get_free_vlan_id(hapd);
974 }
975 } else {
976 hostapd_logger(hapd, sta->addr,
977 HOSTAPD_MODULE_IEEE80211,
978 HOSTAPD_LEVEL_DEBUG,
979 "missing vlan and wildcard for vlan=%d%s",
980 vlan_desc->untagged,
981 vlan_desc->tagged[0] ? "+" : "");
982 vlan_id = 0;
983 ret = -1;
984 goto done;
985 }
986 }
987
988 if (vlan && vlan->vlan_id == VLAN_ID_WILDCARD) {
989 vlan = vlan_add_dynamic(hapd, vlan, vlan_id, vlan_desc);
990 if (vlan == NULL) {
991 hostapd_logger(hapd, sta->addr,
992 HOSTAPD_MODULE_IEEE80211,
993 HOSTAPD_LEVEL_DEBUG,
994 "could not add dynamic VLAN interface for vlan=%d%s",
995 vlan_desc ? vlan_desc->untagged : -1,
996 (vlan_desc && vlan_desc->tagged[0]) ?
997 "+" : "");
998 vlan_id = 0;
999 ret = -1;
1000 goto done;
1001 }
1002
1003 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1004 HOSTAPD_LEVEL_DEBUG,
1005 "added new dynamic VLAN interface '%s'",
1006 vlan->ifname);
1007 } else if (vlan && vlan->dynamic_vlan > 0) {
1008 vlan->dynamic_vlan++;
1009 hostapd_logger(hapd, sta->addr,
1010 HOSTAPD_MODULE_IEEE80211,
1011 HOSTAPD_LEVEL_DEBUG,
1012 "updated existing dynamic VLAN interface '%s'",
1013 vlan->ifname);
1014 }
1015 done:
1016 old_vlan_id = sta->vlan_id;
1017 sta->vlan_id = vlan_id;
1018 sta->vlan_desc = vlan ? &vlan->vlan_desc : NULL;
1019
1020 if (vlan_id != old_vlan_id && old_vlan_id)
1021 vlan_remove_dynamic(hapd, old_vlan_id);
1022
1023 return ret;
1024 }
1025
1026
ap_sta_bind_vlan(struct hostapd_data * hapd,struct sta_info * sta)1027 int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta)
1028 {
1029 #ifndef CONFIG_NO_VLAN
1030 const char *iface;
1031 struct hostapd_vlan *vlan = NULL;
1032 int ret;
1033 int old_vlanid = sta->vlan_id_bound;
1034
1035 if ((sta->flags & WLAN_STA_WDS) && sta->vlan_id == 0) {
1036 wpa_printf(MSG_DEBUG,
1037 "Do not override WDS VLAN assignment for STA "
1038 MACSTR, MAC2STR(sta->addr));
1039 return 0;
1040 }
1041
1042 iface = hapd->conf->iface;
1043 if (hapd->conf->ssid.vlan[0])
1044 iface = hapd->conf->ssid.vlan;
1045
1046 if (sta->vlan_id > 0) {
1047 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
1048 if (vlan->vlan_id == sta->vlan_id)
1049 break;
1050 }
1051 if (vlan)
1052 iface = vlan->ifname;
1053 }
1054
1055 /*
1056 * Do not increment ref counters if the VLAN ID remains same, but do
1057 * not skip hostapd_drv_set_sta_vlan() as hostapd_drv_sta_remove() might
1058 * have been called before.
1059 */
1060 if (sta->vlan_id == old_vlanid)
1061 goto skip_counting;
1062
1063 if (sta->vlan_id > 0 && !vlan &&
1064 !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD)) {
1065 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1066 HOSTAPD_LEVEL_DEBUG, "could not find VLAN for "
1067 "binding station to (vlan_id=%d)",
1068 sta->vlan_id);
1069 ret = -1;
1070 goto done;
1071 } else if (vlan && vlan->dynamic_vlan > 0) {
1072 vlan->dynamic_vlan++;
1073 hostapd_logger(hapd, sta->addr,
1074 HOSTAPD_MODULE_IEEE80211,
1075 HOSTAPD_LEVEL_DEBUG,
1076 "updated existing dynamic VLAN interface '%s'",
1077 iface);
1078 }
1079
1080 /* ref counters have been increased, so mark the station */
1081 sta->vlan_id_bound = sta->vlan_id;
1082
1083 skip_counting:
1084 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1085 HOSTAPD_LEVEL_DEBUG, "binding station to interface "
1086 "'%s'", iface);
1087
1088 if (wpa_auth_sta_set_vlan(sta->wpa_sm, sta->vlan_id) < 0)
1089 wpa_printf(MSG_INFO, "Failed to update VLAN-ID for WPA");
1090
1091 ret = hostapd_drv_set_sta_vlan(iface, hapd, sta->addr, sta->vlan_id);
1092 if (ret < 0) {
1093 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1094 HOSTAPD_LEVEL_DEBUG, "could not bind the STA "
1095 "entry to vlan_id=%d", sta->vlan_id);
1096 }
1097
1098 /* During 1x reauth, if the vlan id changes, then remove the old id. */
1099 if (old_vlanid > 0 && old_vlanid != sta->vlan_id)
1100 vlan_remove_dynamic(hapd, old_vlanid);
1101 done:
1102
1103 return ret;
1104 #else /* CONFIG_NO_VLAN */
1105 return 0;
1106 #endif /* CONFIG_NO_VLAN */
1107 }
1108
1109
ap_check_sa_query_timeout(struct hostapd_data * hapd,struct sta_info * sta)1110 int ap_check_sa_query_timeout(struct hostapd_data *hapd, struct sta_info *sta)
1111 {
1112 u32 tu;
1113 struct os_reltime now, passed;
1114 os_get_reltime(&now);
1115 os_reltime_sub(&now, &sta->sa_query_start, &passed);
1116 tu = (passed.sec * 1000000 + passed.usec) / 1024;
1117 if (hapd->conf->assoc_sa_query_max_timeout < tu) {
1118 hostapd_logger(hapd, sta->addr,
1119 HOSTAPD_MODULE_IEEE80211,
1120 HOSTAPD_LEVEL_DEBUG,
1121 "association SA Query timed out");
1122 sta->sa_query_timed_out = 1;
1123 os_free(sta->sa_query_trans_id);
1124 sta->sa_query_trans_id = NULL;
1125 sta->sa_query_count = 0;
1126 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
1127 return 1;
1128 }
1129
1130 return 0;
1131 }
1132
1133
ap_sa_query_timer(void * eloop_ctx,void * timeout_ctx)1134 static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
1135 {
1136 struct hostapd_data *hapd = eloop_ctx;
1137 struct sta_info *sta = timeout_ctx;
1138 unsigned int timeout, sec, usec;
1139 u8 *trans_id, *nbuf;
1140
1141 wpa_printf(MSG_DEBUG, "%s: SA Query timer for STA " MACSTR
1142 " (count=%d)",
1143 hapd->conf->iface, MAC2STR(sta->addr), sta->sa_query_count);
1144
1145 if (sta->sa_query_count > 0 &&
1146 ap_check_sa_query_timeout(hapd, sta))
1147 return;
1148 if (sta->sa_query_count >= 1000)
1149 return;
1150
1151 nbuf = os_realloc_array(sta->sa_query_trans_id,
1152 sta->sa_query_count + 1,
1153 WLAN_SA_QUERY_TR_ID_LEN);
1154 if (nbuf == NULL)
1155 return;
1156 if (sta->sa_query_count == 0) {
1157 /* Starting a new SA Query procedure */
1158 os_get_reltime(&sta->sa_query_start);
1159 }
1160 trans_id = nbuf + sta->sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
1161 sta->sa_query_trans_id = nbuf;
1162 sta->sa_query_count++;
1163
1164 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
1165 /*
1166 * We don't really care which ID is used here, so simply
1167 * hardcode this if the mostly theoretical os_get_random()
1168 * failure happens.
1169 */
1170 trans_id[0] = 0x12;
1171 trans_id[1] = 0x34;
1172 }
1173
1174 timeout = hapd->conf->assoc_sa_query_retry_timeout;
1175 sec = ((timeout / 1000) * 1024) / 1000;
1176 usec = (timeout % 1000) * 1024;
1177 eloop_register_timeout(sec, usec, ap_sa_query_timer, hapd, sta);
1178
1179 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1180 HOSTAPD_LEVEL_DEBUG,
1181 "association SA Query attempt %d", sta->sa_query_count);
1182
1183 ieee802_11_send_sa_query_req(hapd, sta->addr, trans_id);
1184 }
1185
1186
ap_sta_start_sa_query(struct hostapd_data * hapd,struct sta_info * sta)1187 void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
1188 {
1189 ap_sa_query_timer(hapd, sta);
1190 }
1191
1192
ap_sta_stop_sa_query(struct hostapd_data * hapd,struct sta_info * sta)1193 void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
1194 {
1195 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
1196 os_free(sta->sa_query_trans_id);
1197 sta->sa_query_trans_id = NULL;
1198 sta->sa_query_count = 0;
1199 }
1200
1201
ap_sta_wpa_get_keyid(struct hostapd_data * hapd,struct sta_info * sta)1202 const char * ap_sta_wpa_get_keyid(struct hostapd_data *hapd,
1203 struct sta_info *sta)
1204 {
1205 struct hostapd_wpa_psk *psk;
1206 struct hostapd_ssid *ssid;
1207 const u8 *pmk;
1208 int pmk_len;
1209
1210 ssid = &hapd->conf->ssid;
1211
1212 pmk = wpa_auth_get_pmk(sta->wpa_sm, &pmk_len);
1213 if (!pmk || pmk_len != PMK_LEN)
1214 return NULL;
1215
1216 for (psk = ssid->wpa_psk; psk; psk = psk->next)
1217 if (os_memcmp(pmk, psk->psk, PMK_LEN) == 0)
1218 break;
1219 if (!psk)
1220 return NULL;
1221 if (!psk || !psk->keyid[0])
1222 return NULL;
1223
1224 return psk->keyid;
1225 }
1226
1227
ap_sta_set_authorized(struct hostapd_data * hapd,struct sta_info * sta,int authorized)1228 void ap_sta_set_authorized(struct hostapd_data *hapd, struct sta_info *sta,
1229 int authorized)
1230 {
1231 const u8 *dev_addr = NULL;
1232 char buf[100];
1233 #ifdef CONFIG_P2P
1234 u8 addr[ETH_ALEN];
1235 u8 ip_addr_buf[4];
1236 #endif /* CONFIG_P2P */
1237
1238 if (!!authorized == !!(sta->flags & WLAN_STA_AUTHORIZED))
1239 return;
1240
1241 if (authorized)
1242 sta->flags |= WLAN_STA_AUTHORIZED;
1243 else
1244 sta->flags &= ~WLAN_STA_AUTHORIZED;
1245
1246 #ifdef CONFIG_P2P
1247 if (hapd->p2p_group == NULL) {
1248 if (sta->p2p_ie != NULL &&
1249 p2p_parse_dev_addr_in_p2p_ie(sta->p2p_ie, addr) == 0)
1250 dev_addr = addr;
1251 } else
1252 dev_addr = p2p_group_get_dev_addr(hapd->p2p_group, sta->addr);
1253
1254 if (dev_addr)
1255 os_snprintf(buf, sizeof(buf), MACSTR " p2p_dev_addr=" MACSTR,
1256 MAC2STR(sta->addr), MAC2STR(dev_addr));
1257 else
1258 #endif /* CONFIG_P2P */
1259 os_snprintf(buf, sizeof(buf), MACSTR, MAC2STR(sta->addr));
1260
1261 if (hapd->sta_authorized_cb)
1262 hapd->sta_authorized_cb(hapd->sta_authorized_cb_ctx,
1263 sta->addr, authorized, dev_addr);
1264
1265 if (authorized) {
1266 const char *keyid;
1267 char keyid_buf[100];
1268 char ip_addr[100];
1269
1270 keyid_buf[0] = '\0';
1271 ip_addr[0] = '\0';
1272 #ifdef CONFIG_P2P
1273 if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
1274 os_snprintf(ip_addr, sizeof(ip_addr),
1275 " ip_addr=%u.%u.%u.%u",
1276 ip_addr_buf[0], ip_addr_buf[1],
1277 ip_addr_buf[2], ip_addr_buf[3]);
1278 }
1279 #endif /* CONFIG_P2P */
1280
1281 keyid = ap_sta_wpa_get_keyid(hapd, sta);
1282 if (keyid) {
1283 os_snprintf(keyid_buf, sizeof(keyid_buf),
1284 " keyid=%s", keyid);
1285 }
1286
1287 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
1288 buf, ip_addr, keyid_buf);
1289
1290 if (hapd->msg_ctx_parent &&
1291 hapd->msg_ctx_parent != hapd->msg_ctx)
1292 wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
1293 AP_STA_CONNECTED "%s%s%s",
1294 buf, ip_addr, keyid_buf);
1295 } else {
1296 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
1297
1298 if (hapd->msg_ctx_parent &&
1299 hapd->msg_ctx_parent != hapd->msg_ctx)
1300 wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
1301 AP_STA_DISCONNECTED "%s", buf);
1302 }
1303
1304 #ifdef CONFIG_FST
1305 if (hapd->iface->fst) {
1306 if (authorized)
1307 fst_notify_peer_connected(hapd->iface->fst, sta->addr);
1308 else
1309 fst_notify_peer_disconnected(hapd->iface->fst,
1310 sta->addr);
1311 }
1312 #endif /* CONFIG_FST */
1313 }
1314
1315
ap_sta_disconnect(struct hostapd_data * hapd,struct sta_info * sta,const u8 * addr,u16 reason)1316 void ap_sta_disconnect(struct hostapd_data *hapd, struct sta_info *sta,
1317 const u8 *addr, u16 reason)
1318 {
1319 if (sta)
1320 wpa_printf(MSG_DEBUG, "%s: %s STA " MACSTR " reason=%u",
1321 hapd->conf->iface, __func__, MAC2STR(sta->addr),
1322 reason);
1323 else if (addr)
1324 wpa_printf(MSG_DEBUG, "%s: %s addr " MACSTR " reason=%u",
1325 hapd->conf->iface, __func__, MAC2STR(addr),
1326 reason);
1327
1328 if (sta == NULL && addr)
1329 sta = ap_get_sta(hapd, addr);
1330
1331 if (addr)
1332 hostapd_drv_sta_deauth(hapd, addr, reason);
1333
1334 if (sta == NULL)
1335 return;
1336 ap_sta_set_authorized(hapd, sta, 0);
1337 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1338 hostapd_set_sta_flags(hapd, sta);
1339 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1340 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1341 wpa_printf(MSG_DEBUG, "%s: %s: reschedule ap_handle_timer timeout "
1342 "for " MACSTR " (%d seconds - "
1343 "AP_MAX_INACTIVITY_AFTER_DEAUTH)",
1344 hapd->conf->iface, __func__, MAC2STR(sta->addr),
1345 AP_MAX_INACTIVITY_AFTER_DEAUTH);
1346 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1347 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0,
1348 ap_handle_timer, hapd, sta);
1349 sta->timeout_next = STA_REMOVE;
1350
1351 if (hapd->iface->current_mode &&
1352 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
1353 /* Deauthentication is not used in DMG/IEEE 802.11ad;
1354 * disassociate the STA instead. */
1355 sta->disassoc_reason = reason;
1356 sta->flags |= WLAN_STA_PENDING_DISASSOC_CB;
1357 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
1358 eloop_register_timeout(hapd->iface->drv_flags &
1359 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ?
1360 2 : 0, 0, ap_sta_disassoc_cb_timeout,
1361 hapd, sta);
1362 return;
1363 }
1364
1365 sta->deauth_reason = reason;
1366 sta->flags |= WLAN_STA_PENDING_DEAUTH_CB;
1367 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
1368 eloop_register_timeout(hapd->iface->drv_flags &
1369 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
1370 ap_sta_deauth_cb_timeout, hapd, sta);
1371 }
1372
1373
ap_sta_deauth_cb(struct hostapd_data * hapd,struct sta_info * sta)1374 void ap_sta_deauth_cb(struct hostapd_data *hapd, struct sta_info *sta)
1375 {
1376 if (!(sta->flags & WLAN_STA_PENDING_DEAUTH_CB)) {
1377 wpa_printf(MSG_DEBUG, "Ignore deauth cb for test frame");
1378 return;
1379 }
1380 sta->flags &= ~WLAN_STA_PENDING_DEAUTH_CB;
1381 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
1382 ap_sta_deauth_cb_timeout(hapd, sta);
1383 }
1384
1385
ap_sta_disassoc_cb(struct hostapd_data * hapd,struct sta_info * sta)1386 void ap_sta_disassoc_cb(struct hostapd_data *hapd, struct sta_info *sta)
1387 {
1388 if (!(sta->flags & WLAN_STA_PENDING_DISASSOC_CB)) {
1389 wpa_printf(MSG_DEBUG, "Ignore disassoc cb for test frame");
1390 return;
1391 }
1392 sta->flags &= ~WLAN_STA_PENDING_DISASSOC_CB;
1393 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
1394 ap_sta_disassoc_cb_timeout(hapd, sta);
1395 }
1396
1397
ap_sta_clear_disconnect_timeouts(struct hostapd_data * hapd,struct sta_info * sta)1398 void ap_sta_clear_disconnect_timeouts(struct hostapd_data *hapd,
1399 struct sta_info *sta)
1400 {
1401 if (eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta) > 0)
1402 wpa_printf(MSG_DEBUG,
1403 "%s: Removed ap_sta_deauth_cb_timeout timeout for "
1404 MACSTR,
1405 hapd->conf->iface, MAC2STR(sta->addr));
1406 if (eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta) > 0)
1407 wpa_printf(MSG_DEBUG,
1408 "%s: Removed ap_sta_disassoc_cb_timeout timeout for "
1409 MACSTR,
1410 hapd->conf->iface, MAC2STR(sta->addr));
1411 if (eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta) > 0)
1412 {
1413 wpa_printf(MSG_DEBUG,
1414 "%s: Removed ap_sta_delayed_1x_auth_fail_cb timeout for "
1415 MACSTR,
1416 hapd->conf->iface, MAC2STR(sta->addr));
1417 if (sta->flags & WLAN_STA_WPS)
1418 hostapd_wps_eap_completed(hapd);
1419 }
1420 }
1421
1422
ap_sta_flags_txt(u32 flags,char * buf,size_t buflen)1423 int ap_sta_flags_txt(u32 flags, char *buf, size_t buflen)
1424 {
1425 int res;
1426
1427 buf[0] = '\0';
1428 res = os_snprintf(buf, buflen,
1429 "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
1430 (flags & WLAN_STA_AUTH ? "[AUTH]" : ""),
1431 (flags & WLAN_STA_ASSOC ? "[ASSOC]" : ""),
1432 (flags & WLAN_STA_AUTHORIZED ? "[AUTHORIZED]" : ""),
1433 (flags & WLAN_STA_PENDING_POLL ? "[PENDING_POLL" :
1434 ""),
1435 (flags & WLAN_STA_SHORT_PREAMBLE ?
1436 "[SHORT_PREAMBLE]" : ""),
1437 (flags & WLAN_STA_PREAUTH ? "[PREAUTH]" : ""),
1438 (flags & WLAN_STA_WMM ? "[WMM]" : ""),
1439 (flags & WLAN_STA_MFP ? "[MFP]" : ""),
1440 (flags & WLAN_STA_WPS ? "[WPS]" : ""),
1441 (flags & WLAN_STA_MAYBE_WPS ? "[MAYBE_WPS]" : ""),
1442 (flags & WLAN_STA_WDS ? "[WDS]" : ""),
1443 (flags & WLAN_STA_NONERP ? "[NonERP]" : ""),
1444 (flags & WLAN_STA_WPS2 ? "[WPS2]" : ""),
1445 (flags & WLAN_STA_GAS ? "[GAS]" : ""),
1446 (flags & WLAN_STA_HT ? "[HT]" : ""),
1447 (flags & WLAN_STA_VHT ? "[VHT]" : ""),
1448 (flags & WLAN_STA_HE ? "[HE]" : ""),
1449 (flags & WLAN_STA_6GHZ ? "[6GHZ]" : ""),
1450 (flags & WLAN_STA_VENDOR_VHT ? "[VENDOR_VHT]" : ""),
1451 (flags & WLAN_STA_WNM_SLEEP_MODE ?
1452 "[WNM_SLEEP_MODE]" : ""));
1453 if (os_snprintf_error(buflen, res))
1454 res = -1;
1455
1456 return res;
1457 }
1458
1459
ap_sta_delayed_1x_auth_fail_cb(void * eloop_ctx,void * timeout_ctx)1460 static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx)
1461 {
1462 struct hostapd_data *hapd = eloop_ctx;
1463 struct sta_info *sta = timeout_ctx;
1464 u16 reason;
1465
1466 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1467 "IEEE 802.1X: Scheduled disconnection of " MACSTR
1468 " after EAP-Failure", MAC2STR(sta->addr));
1469
1470 reason = sta->disconnect_reason_code;
1471 if (!reason)
1472 reason = WLAN_REASON_IEEE_802_1X_AUTH_FAILED;
1473 ap_sta_disconnect(hapd, sta, sta->addr, reason);
1474 if (sta->flags & WLAN_STA_WPS)
1475 hostapd_wps_eap_completed(hapd);
1476 }
1477
1478
ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data * hapd,struct sta_info * sta)1479 void ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd,
1480 struct sta_info *sta)
1481 {
1482 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1483 "IEEE 802.1X: Force disconnection of " MACSTR
1484 " after EAP-Failure in 10 ms", MAC2STR(sta->addr));
1485
1486 /*
1487 * Add a small sleep to increase likelihood of previously requested
1488 * EAP-Failure TX getting out before this should the driver reorder
1489 * operations.
1490 */
1491 eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta);
1492 eloop_register_timeout(0, 10000, ap_sta_delayed_1x_auth_fail_cb,
1493 hapd, sta);
1494 }
1495
1496
ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data * hapd,struct sta_info * sta)1497 int ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd,
1498 struct sta_info *sta)
1499 {
1500 return eloop_is_timeout_registered(ap_sta_delayed_1x_auth_fail_cb,
1501 hapd, sta);
1502 }
1503
1504
ap_sta_re_add(struct hostapd_data * hapd,struct sta_info * sta)1505 int ap_sta_re_add(struct hostapd_data *hapd, struct sta_info *sta)
1506 {
1507 /*
1508 * If a station that is already associated to the AP, is trying to
1509 * authenticate again, remove the STA entry, in order to make sure the
1510 * STA PS state gets cleared and configuration gets updated. To handle
1511 * this, station's added_unassoc flag is cleared once the station has
1512 * completed association.
1513 */
1514 ap_sta_set_authorized(hapd, sta, 0);
1515 hostapd_drv_sta_remove(hapd, sta->addr);
1516 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH | WLAN_STA_AUTHORIZED);
1517
1518 if (hostapd_sta_add(hapd, sta->addr, 0, 0,
1519 sta->supported_rates,
1520 sta->supported_rates_len,
1521 0, NULL, NULL, NULL, 0, NULL,
1522 sta->flags, 0, 0, 0, 0)) {
1523 hostapd_logger(hapd, sta->addr,
1524 HOSTAPD_MODULE_IEEE80211,
1525 HOSTAPD_LEVEL_NOTICE,
1526 "Could not add STA to kernel driver");
1527 return -1;
1528 }
1529
1530 sta->added_unassoc = 1;
1531 return 0;
1532 }
1533