• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Control interface for shared AP commands
3  * Copyright (c) 2004-2019, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/sae.h"
14 #include "eapol_auth/eapol_auth_sm.h"
15 #include "fst/fst_ctrl_iface.h"
16 #include "hostapd.h"
17 #include "ieee802_1x.h"
18 #include "wpa_auth.h"
19 #include "ieee802_11.h"
20 #include "sta_info.h"
21 #include "wps_hostapd.h"
22 #include "p2p_hostapd.h"
23 #include "ctrl_iface_ap.h"
24 #include "ap_drv_ops.h"
25 #include "mbo_ap.h"
26 #include "taxonomy.h"
27 #include "wnm_ap.h"
28 
29 
hostapd_write_ht_mcs_bitmask(char * buf,size_t buflen,size_t curr_len,const u8 * mcs_set)30 static size_t hostapd_write_ht_mcs_bitmask(char *buf, size_t buflen,
31 					   size_t curr_len, const u8 *mcs_set)
32 {
33 	int ret;
34 	size_t len = curr_len;
35 
36 	ret = os_snprintf(buf + len, buflen - len,
37 			  "ht_mcs_bitmask=");
38 	if (os_snprintf_error(buflen - len, ret))
39 		return len;
40 	len += ret;
41 
42 	/* 77 first bits (+ 3 reserved bits) */
43 	len += wpa_snprintf_hex(buf + len, buflen - len, mcs_set, 10);
44 
45 	ret = os_snprintf(buf + len, buflen - len, "\n");
46 	if (os_snprintf_error(buflen - len, ret))
47 		return curr_len;
48 	len += ret;
49 
50 	return len;
51 }
52 
53 
hostapd_get_sta_conn_time(struct sta_info * sta,struct hostap_sta_driver_data * data,char * buf,size_t buflen)54 static int hostapd_get_sta_conn_time(struct sta_info *sta,
55 				     struct hostap_sta_driver_data *data,
56 				     char *buf, size_t buflen)
57 {
58 	struct os_reltime age;
59 	unsigned long secs;
60 	int ret;
61 
62 	if (sta->connected_time.sec) {
63 		/* Locally maintained time in AP mode */
64 		os_reltime_age(&sta->connected_time, &age);
65 		secs = (unsigned long) age.sec;
66 	} else if (data->flags & STA_DRV_DATA_CONN_TIME) {
67 		/* Time from the driver in mesh mode */
68 		secs = data->connected_sec;
69 	} else {
70 		return 0;
71 	}
72 
73 	ret = os_snprintf(buf, buflen, "connected_time=%lu\n", secs);
74 	if (os_snprintf_error(buflen, ret))
75 		return 0;
76 	return ret;
77 }
78 
79 
hostapd_get_sta_info(struct hostapd_data * hapd,struct sta_info * sta,char * buf,size_t buflen)80 static int hostapd_get_sta_info(struct hostapd_data *hapd,
81 				struct sta_info *sta,
82 				char *buf, size_t buflen)
83 {
84 	struct hostap_sta_driver_data data;
85 	int ret;
86 	int len = 0;
87 
88 	if (hostapd_drv_read_sta_data(hapd, &data, sta->addr) < 0)
89 		return 0;
90 
91 	ret = os_snprintf(buf, buflen, "rx_packets=%lu\ntx_packets=%lu\n"
92 			  "rx_bytes=%llu\ntx_bytes=%llu\ninactive_msec=%lu\n"
93 			  "signal=%d\n",
94 			  data.rx_packets, data.tx_packets,
95 			  data.rx_bytes, data.tx_bytes, data.inactive_msec,
96 			  data.signal);
97 	if (os_snprintf_error(buflen, ret))
98 		return 0;
99 	len += ret;
100 
101 	ret = os_snprintf(buf + len, buflen - len, "rx_rate_info=%lu",
102 			  data.current_rx_rate);
103 	if (os_snprintf_error(buflen - len, ret))
104 		return len;
105 	len += ret;
106 	if (data.flags & STA_DRV_DATA_RX_MCS) {
107 		ret = os_snprintf(buf + len, buflen - len, " mcs %u",
108 				  data.rx_mcs);
109 		if (!os_snprintf_error(buflen - len, ret))
110 			len += ret;
111 	}
112 	if (data.flags & STA_DRV_DATA_RX_VHT_MCS) {
113 		ret = os_snprintf(buf + len, buflen - len, " vhtmcs %u",
114 				  data.rx_vhtmcs);
115 		if (!os_snprintf_error(buflen - len, ret))
116 			len += ret;
117 	}
118 	if (data.flags & STA_DRV_DATA_RX_VHT_NSS) {
119 		ret = os_snprintf(buf + len, buflen - len, " vhtnss %u",
120 				  data.rx_vht_nss);
121 		if (!os_snprintf_error(buflen - len, ret))
122 			len += ret;
123 	}
124 	if (data.flags & STA_DRV_DATA_RX_SHORT_GI) {
125 		ret = os_snprintf(buf + len, buflen - len, " shortGI");
126 		if (!os_snprintf_error(buflen - len, ret))
127 			len += ret;
128 	}
129 	ret = os_snprintf(buf + len, buflen - len, "\n");
130 	if (!os_snprintf_error(buflen - len, ret))
131 		len += ret;
132 
133 	ret = os_snprintf(buf + len, buflen - len, "tx_rate_info=%lu",
134 			  data.current_tx_rate);
135 	if (os_snprintf_error(buflen - len, ret))
136 		return len;
137 	len += ret;
138 	if (data.flags & STA_DRV_DATA_TX_MCS) {
139 		ret = os_snprintf(buf + len, buflen - len, " mcs %u",
140 				  data.tx_mcs);
141 		if (!os_snprintf_error(buflen - len, ret))
142 			len += ret;
143 	}
144 	if (data.flags & STA_DRV_DATA_TX_VHT_MCS) {
145 		ret = os_snprintf(buf + len, buflen - len, " vhtmcs %u",
146 				  data.tx_vhtmcs);
147 		if (!os_snprintf_error(buflen - len, ret))
148 			len += ret;
149 	}
150 	if (data.flags & STA_DRV_DATA_TX_VHT_NSS) {
151 		ret = os_snprintf(buf + len, buflen - len, " vhtnss %u",
152 				  data.tx_vht_nss);
153 		if (!os_snprintf_error(buflen - len, ret))
154 			len += ret;
155 	}
156 	if (data.flags & STA_DRV_DATA_TX_SHORT_GI) {
157 		ret = os_snprintf(buf + len, buflen - len, " shortGI");
158 		if (!os_snprintf_error(buflen - len, ret))
159 			len += ret;
160 	}
161 	ret = os_snprintf(buf + len, buflen - len, "\n");
162 	if (!os_snprintf_error(buflen - len, ret))
163 		len += ret;
164 
165 	if ((sta->flags & WLAN_STA_VHT) && sta->vht_capabilities) {
166 		ret = os_snprintf(buf + len, buflen - len,
167 				  "rx_vht_mcs_map=%04x\n"
168 				  "tx_vht_mcs_map=%04x\n",
169 				  le_to_host16(sta->vht_capabilities->
170 					       vht_supported_mcs_set.rx_map),
171 				  le_to_host16(sta->vht_capabilities->
172 					       vht_supported_mcs_set.tx_map));
173 		if (!os_snprintf_error(buflen - len, ret))
174 			len += ret;
175 	}
176 
177 	if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities) {
178 		len = hostapd_write_ht_mcs_bitmask(buf, buflen, len,
179 						   sta->ht_capabilities->
180 						   supported_mcs_set);
181 	}
182 
183 	if (data.flags & STA_DRV_DATA_LAST_ACK_RSSI) {
184 		ret = os_snprintf(buf + len, buflen - len,
185 				  "last_ack_signal=%d\n", data.last_ack_rssi);
186 		if (!os_snprintf_error(buflen - len, ret))
187 			len += ret;
188 	}
189 
190 	len += hostapd_get_sta_conn_time(sta, &data, buf + len, buflen - len);
191 
192 	return len;
193 }
194 
195 
timeout_next_str(int val)196 static const char * timeout_next_str(int val)
197 {
198 	switch (val) {
199 	case STA_NULLFUNC:
200 		return "NULLFUNC POLL";
201 	case STA_DISASSOC:
202 		return "DISASSOC";
203 	case STA_DEAUTH:
204 		return "DEAUTH";
205 	case STA_REMOVE:
206 		return "REMOVE";
207 	case STA_DISASSOC_FROM_CLI:
208 		return "DISASSOC_FROM_CLI";
209 	}
210 
211 	return "?";
212 }
213 
214 
hostapd_ctrl_iface_sta_mib(struct hostapd_data * hapd,struct sta_info * sta,char * buf,size_t buflen)215 static int hostapd_ctrl_iface_sta_mib(struct hostapd_data *hapd,
216 				      struct sta_info *sta,
217 				      char *buf, size_t buflen)
218 {
219 	int len, res, ret, i;
220 	const char *keyid;
221 
222 	if (!sta)
223 		return 0;
224 
225 	len = 0;
226 	ret = os_snprintf(buf + len, buflen - len, MACSTR "\nflags=",
227 			  MAC2STR(sta->addr));
228 	if (os_snprintf_error(buflen - len, ret))
229 		return len;
230 	len += ret;
231 
232 	ret = ap_sta_flags_txt(sta->flags, buf + len, buflen - len);
233 	if (ret < 0)
234 		return len;
235 	len += ret;
236 
237 	ret = os_snprintf(buf + len, buflen - len, "\naid=%d\ncapability=0x%x\n"
238 			  "listen_interval=%d\nsupported_rates=",
239 			  sta->aid, sta->capability, sta->listen_interval);
240 	if (os_snprintf_error(buflen - len, ret))
241 		return len;
242 	len += ret;
243 
244 	for (i = 0; i < sta->supported_rates_len; i++) {
245 		ret = os_snprintf(buf + len, buflen - len, "%02x%s",
246 				  sta->supported_rates[i],
247 				  i + 1 < sta->supported_rates_len ? " " : "");
248 		if (os_snprintf_error(buflen - len, ret))
249 			return len;
250 		len += ret;
251 	}
252 
253 	ret = os_snprintf(buf + len, buflen - len, "\ntimeout_next=%s\n",
254 			  timeout_next_str(sta->timeout_next));
255 	if (os_snprintf_error(buflen - len, ret))
256 		return len;
257 	len += ret;
258 
259 	res = ieee802_11_get_mib_sta(hapd, sta, buf + len, buflen - len);
260 	if (res >= 0)
261 		len += res;
262 	res = wpa_get_mib_sta(sta->wpa_sm, buf + len, buflen - len);
263 	if (res >= 0)
264 		len += res;
265 	res = ieee802_1x_get_mib_sta(hapd, sta, buf + len, buflen - len);
266 	if (res >= 0)
267 		len += res;
268 	res = hostapd_wps_get_mib_sta(hapd, sta->addr, buf + len,
269 				      buflen - len);
270 	if (res >= 0)
271 		len += res;
272 	res = hostapd_p2p_get_mib_sta(hapd, sta, buf + len, buflen - len);
273 	if (res >= 0)
274 		len += res;
275 
276 	len += hostapd_get_sta_info(hapd, sta, buf + len, buflen - len);
277 
278 #ifdef CONFIG_SAE
279 	if (sta->sae && sta->sae->state == SAE_ACCEPTED) {
280 		res = os_snprintf(buf + len, buflen - len, "sae_group=%d\n",
281 				  sta->sae->group);
282 		if (!os_snprintf_error(buflen - len, res))
283 			len += res;
284 	}
285 
286 	if (sta->sae && sta->sae->tmp) {
287 		const u8 *pos;
288 		unsigned int j, count;
289 		struct wpabuf *groups = sta->sae->tmp->peer_rejected_groups;
290 
291 		res = os_snprintf(buf + len, buflen - len,
292 				  "sae_rejected_groups=");
293 		if (!os_snprintf_error(buflen - len, res))
294 			len += res;
295 
296 		if (groups) {
297 			pos = wpabuf_head(groups);
298 			count = wpabuf_len(groups) / 2;
299 		} else {
300 			pos = NULL;
301 			count = 0;
302 		}
303 		for (j = 0; pos && j < count; j++) {
304 			res = os_snprintf(buf + len, buflen - len, "%s%d",
305 					  j == 0 ? "" : " ", WPA_GET_LE16(pos));
306 			if (!os_snprintf_error(buflen - len, res))
307 				len += res;
308 			pos += 2;
309 		}
310 
311 		res = os_snprintf(buf + len, buflen - len, "\n");
312 		if (!os_snprintf_error(buflen - len, res))
313 			len += res;
314 	}
315 #endif /* CONFIG_SAE */
316 
317 	if (sta->vlan_id > 0) {
318 		res = os_snprintf(buf + len, buflen - len, "vlan_id=%d\n",
319 				  sta->vlan_id);
320 		if (!os_snprintf_error(buflen - len, res))
321 			len += res;
322 	}
323 
324 	res = mbo_ap_get_info(sta, buf + len, buflen - len);
325 	if (res >= 0)
326 		len += res;
327 
328 	if (sta->supp_op_classes &&
329 	    buflen - len > (unsigned) (17 + 2 * sta->supp_op_classes[0])) {
330 		len += os_snprintf(buf + len, buflen - len, "supp_op_classes=");
331 		len += wpa_snprintf_hex(buf + len, buflen - len,
332 					sta->supp_op_classes + 1,
333 					sta->supp_op_classes[0]);
334 		len += os_snprintf(buf + len, buflen - len, "\n");
335 	}
336 
337 	if (sta->power_capab) {
338 		ret = os_snprintf(buf + len, buflen - len,
339 				  "min_txpower=%d\n"
340 				  "max_txpower=%d\n",
341 				  sta->min_tx_power, sta->max_tx_power);
342 		if (!os_snprintf_error(buflen - len, ret))
343 			len += ret;
344 	}
345 
346 #ifdef CONFIG_IEEE80211AC
347 	if ((sta->flags & WLAN_STA_VHT) && sta->vht_capabilities) {
348 		res = os_snprintf(buf + len, buflen - len,
349 				  "vht_caps_info=0x%08x\n",
350 				  le_to_host32(sta->vht_capabilities->
351 					       vht_capabilities_info));
352 		if (!os_snprintf_error(buflen - len, res))
353 			len += res;
354 	}
355 #endif /* CONFIG_IEEE80211AC */
356 
357 	if ((sta->flags & WLAN_STA_HT) && sta->ht_capabilities) {
358 		res = os_snprintf(buf + len, buflen - len,
359 				  "ht_caps_info=0x%04x\n",
360 				  le_to_host16(sta->ht_capabilities->
361 					       ht_capabilities_info));
362 		if (!os_snprintf_error(buflen - len, res))
363 			len += res;
364 	}
365 
366 	if (sta->ext_capability &&
367 	    buflen - len > (unsigned) (11 + 2 * sta->ext_capability[0])) {
368 		len += os_snprintf(buf + len, buflen - len, "ext_capab=");
369 		len += wpa_snprintf_hex(buf + len, buflen - len,
370 					sta->ext_capability + 1,
371 					sta->ext_capability[0]);
372 		len += os_snprintf(buf + len, buflen - len, "\n");
373 	}
374 
375 	if (sta->flags & WLAN_STA_WDS && sta->ifname_wds) {
376 		ret = os_snprintf(buf + len, buflen - len,
377 				  "wds_sta_ifname=%s\n", sta->ifname_wds);
378 		if (!os_snprintf_error(buflen - len, ret))
379 			len += ret;
380 	}
381 
382 	keyid = ap_sta_wpa_get_keyid(hapd, sta);
383 	if (keyid) {
384 		ret = os_snprintf(buf + len, buflen - len, "keyid=%s\n", keyid);
385 		if (!os_snprintf_error(buflen - len, ret))
386 			len += ret;
387 	}
388 
389 	return len;
390 }
391 
392 
hostapd_ctrl_iface_sta_first(struct hostapd_data * hapd,char * buf,size_t buflen)393 int hostapd_ctrl_iface_sta_first(struct hostapd_data *hapd,
394 				 char *buf, size_t buflen)
395 {
396 	return hostapd_ctrl_iface_sta_mib(hapd, hapd->sta_list, buf, buflen);
397 }
398 
399 
hostapd_ctrl_iface_sta(struct hostapd_data * hapd,const char * txtaddr,char * buf,size_t buflen)400 int hostapd_ctrl_iface_sta(struct hostapd_data *hapd, const char *txtaddr,
401 			   char *buf, size_t buflen)
402 {
403 	u8 addr[ETH_ALEN];
404 	int ret;
405 	const char *pos;
406 	struct sta_info *sta;
407 
408 	if (hwaddr_aton(txtaddr, addr)) {
409 		ret = os_snprintf(buf, buflen, "FAIL\n");
410 		if (os_snprintf_error(buflen, ret))
411 			return 0;
412 		return ret;
413 	}
414 
415 	sta = ap_get_sta(hapd, addr);
416 	if (sta == NULL)
417 		return -1;
418 
419 	pos = os_strchr(txtaddr, ' ');
420 	if (pos) {
421 		pos++;
422 
423 #ifdef HOSTAPD_DUMP_STATE
424 		if (os_strcmp(pos, "eapol") == 0) {
425 			if (sta->eapol_sm == NULL)
426 				return -1;
427 			return eapol_auth_dump_state(sta->eapol_sm, buf,
428 						     buflen);
429 		}
430 #endif /* HOSTAPD_DUMP_STATE */
431 
432 		return -1;
433 	}
434 
435 	ret = hostapd_ctrl_iface_sta_mib(hapd, sta, buf, buflen);
436 	ret += fst_ctrl_iface_mb_info(addr, buf + ret, buflen - ret);
437 
438 	return ret;
439 }
440 
441 
hostapd_ctrl_iface_sta_next(struct hostapd_data * hapd,const char * txtaddr,char * buf,size_t buflen)442 int hostapd_ctrl_iface_sta_next(struct hostapd_data *hapd, const char *txtaddr,
443 				char *buf, size_t buflen)
444 {
445 	u8 addr[ETH_ALEN];
446 	struct sta_info *sta;
447 	int ret;
448 
449 	if (hwaddr_aton(txtaddr, addr) ||
450 	    (sta = ap_get_sta(hapd, addr)) == NULL) {
451 		ret = os_snprintf(buf, buflen, "FAIL\n");
452 		if (os_snprintf_error(buflen, ret))
453 			return 0;
454 		return ret;
455 	}
456 
457 	if (!sta->next)
458 		return 0;
459 
460 	return hostapd_ctrl_iface_sta_mib(hapd, sta->next, buf, buflen);
461 }
462 
463 
464 #ifdef CONFIG_P2P_MANAGER
p2p_manager_disconnect(struct hostapd_data * hapd,u16 stype,u8 minor_reason_code,const u8 * addr)465 static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
466 				  u8 minor_reason_code, const u8 *addr)
467 {
468 	struct ieee80211_mgmt *mgmt;
469 	int ret;
470 	u8 *pos;
471 
472 	mgmt = os_zalloc(sizeof(*mgmt) + 100);
473 	if (mgmt == NULL)
474 		return -1;
475 
476 	mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, stype);
477 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "P2P: Disconnect STA " MACSTR
478 		" with minor reason code %u (stype=%u (%s))",
479 		MAC2STR(addr), minor_reason_code, stype,
480 		fc2str(le_to_host16(mgmt->frame_control)));
481 
482 	os_memcpy(mgmt->da, addr, ETH_ALEN);
483 	os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
484 	os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
485 	if (stype == WLAN_FC_STYPE_DEAUTH) {
486 		mgmt->u.deauth.reason_code =
487 			host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
488 		pos = mgmt->u.deauth.variable;
489 	} else {
490 		mgmt->u.disassoc.reason_code =
491 			host_to_le16(WLAN_REASON_PREV_AUTH_NOT_VALID);
492 		pos = mgmt->u.disassoc.variable;
493 	}
494 
495 	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
496 	*pos++ = 4 + 3 + 1;
497 	WPA_PUT_BE32(pos, P2P_IE_VENDOR_TYPE);
498 	pos += 4;
499 
500 	*pos++ = P2P_ATTR_MINOR_REASON_CODE;
501 	WPA_PUT_LE16(pos, 1);
502 	pos += 2;
503 	*pos++ = minor_reason_code;
504 
505 	ret = hostapd_drv_send_mlme(hapd, mgmt, pos - (u8 *) mgmt, 0, NULL, 0,
506 				    0);
507 	os_free(mgmt);
508 
509 	return ret < 0 ? -1 : 0;
510 }
511 #endif /* CONFIG_P2P_MANAGER */
512 
513 
hostapd_ctrl_iface_deauthenticate(struct hostapd_data * hapd,const char * txtaddr)514 int hostapd_ctrl_iface_deauthenticate(struct hostapd_data *hapd,
515 				      const char *txtaddr)
516 {
517 	u8 addr[ETH_ALEN];
518 	struct sta_info *sta;
519 	const char *pos;
520 	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
521 
522 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE DEAUTHENTICATE %s",
523 		txtaddr);
524 
525 	if (hwaddr_aton(txtaddr, addr))
526 		return -1;
527 
528 	pos = os_strstr(txtaddr, " reason=");
529 	if (pos)
530 		reason = atoi(pos + 8);
531 
532 	pos = os_strstr(txtaddr, " test=");
533 	if (pos) {
534 		struct ieee80211_mgmt mgmt;
535 		int encrypt;
536 
537 		pos += 6;
538 		encrypt = atoi(pos);
539 		os_memset(&mgmt, 0, sizeof(mgmt));
540 		mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
541 						  WLAN_FC_STYPE_DEAUTH);
542 		os_memcpy(mgmt.da, addr, ETH_ALEN);
543 		os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
544 		os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
545 		mgmt.u.deauth.reason_code = host_to_le16(reason);
546 		if (hostapd_drv_send_mlme(hapd, (u8 *) &mgmt,
547 					  IEEE80211_HDRLEN +
548 					  sizeof(mgmt.u.deauth),
549 					  0, NULL, 0, !encrypt) < 0)
550 			return -1;
551 		return 0;
552 	}
553 
554 #ifdef CONFIG_P2P_MANAGER
555 	pos = os_strstr(txtaddr, " p2p=");
556 	if (pos) {
557 		return p2p_manager_disconnect(hapd, WLAN_FC_STYPE_DEAUTH,
558 					      atoi(pos + 5), addr);
559 	}
560 #endif /* CONFIG_P2P_MANAGER */
561 
562 	if (os_strstr(txtaddr, " tx=0"))
563 		hostapd_drv_sta_remove(hapd, addr);
564 	else
565 		hostapd_drv_sta_deauth(hapd, addr, reason);
566 	sta = ap_get_sta(hapd, addr);
567 	if (sta)
568 		ap_sta_deauthenticate(hapd, sta, reason);
569 	else if (addr[0] == 0xff)
570 		hostapd_free_stas(hapd);
571 
572 	return 0;
573 }
574 
575 
hostapd_ctrl_iface_disassociate(struct hostapd_data * hapd,const char * txtaddr)576 int hostapd_ctrl_iface_disassociate(struct hostapd_data *hapd,
577 				    const char *txtaddr)
578 {
579 	u8 addr[ETH_ALEN];
580 	struct sta_info *sta;
581 	const char *pos;
582 	u16 reason = WLAN_REASON_PREV_AUTH_NOT_VALID;
583 
584 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE DISASSOCIATE %s",
585 		txtaddr);
586 
587 	if (hwaddr_aton(txtaddr, addr))
588 		return -1;
589 
590 	pos = os_strstr(txtaddr, " reason=");
591 	if (pos)
592 		reason = atoi(pos + 8);
593 
594 	pos = os_strstr(txtaddr, " test=");
595 	if (pos) {
596 		struct ieee80211_mgmt mgmt;
597 		int encrypt;
598 
599 		pos += 6;
600 		encrypt = atoi(pos);
601 		os_memset(&mgmt, 0, sizeof(mgmt));
602 		mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
603 						  WLAN_FC_STYPE_DISASSOC);
604 		os_memcpy(mgmt.da, addr, ETH_ALEN);
605 		os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
606 		os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
607 		mgmt.u.disassoc.reason_code = host_to_le16(reason);
608 		if (hostapd_drv_send_mlme(hapd, (u8 *) &mgmt,
609 					  IEEE80211_HDRLEN +
610 					  sizeof(mgmt.u.deauth),
611 					  0, NULL, 0, !encrypt) < 0)
612 			return -1;
613 		return 0;
614 	}
615 
616 #ifdef CONFIG_P2P_MANAGER
617 	pos = os_strstr(txtaddr, " p2p=");
618 	if (pos) {
619 		return p2p_manager_disconnect(hapd, WLAN_FC_STYPE_DISASSOC,
620 					      atoi(pos + 5), addr);
621 	}
622 #endif /* CONFIG_P2P_MANAGER */
623 
624 	if (os_strstr(txtaddr, " tx=0"))
625 		hostapd_drv_sta_remove(hapd, addr);
626 	else
627 		hostapd_drv_sta_disassoc(hapd, addr, reason);
628 	sta = ap_get_sta(hapd, addr);
629 	if (sta)
630 		ap_sta_disassociate(hapd, sta, reason);
631 	else if (addr[0] == 0xff)
632 		hostapd_free_stas(hapd);
633 
634 	return 0;
635 }
636 
637 
638 #ifdef CONFIG_TAXONOMY
hostapd_ctrl_iface_signature(struct hostapd_data * hapd,const char * txtaddr,char * buf,size_t buflen)639 int hostapd_ctrl_iface_signature(struct hostapd_data *hapd,
640 				 const char *txtaddr,
641 				 char *buf, size_t buflen)
642 {
643 	u8 addr[ETH_ALEN];
644 	struct sta_info *sta;
645 
646 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE SIGNATURE %s", txtaddr);
647 
648 	if (hwaddr_aton(txtaddr, addr))
649 		return -1;
650 
651 	sta = ap_get_sta(hapd, addr);
652 	if (!sta)
653 		return -1;
654 
655 	return retrieve_sta_taxonomy(hapd, sta, buf, buflen);
656 }
657 #endif /* CONFIG_TAXONOMY */
658 
659 
hostapd_ctrl_iface_poll_sta(struct hostapd_data * hapd,const char * txtaddr)660 int hostapd_ctrl_iface_poll_sta(struct hostapd_data *hapd,
661 				const char *txtaddr)
662 {
663 	u8 addr[ETH_ALEN];
664 	struct sta_info *sta;
665 
666 	wpa_dbg(hapd->msg_ctx, MSG_DEBUG, "CTRL_IFACE POLL_STA %s", txtaddr);
667 
668 	if (hwaddr_aton(txtaddr, addr))
669 		return -1;
670 
671 	sta = ap_get_sta(hapd, addr);
672 	if (!sta)
673 		return -1;
674 
675 	hostapd_drv_poll_client(hapd, hapd->own_addr, addr,
676 				sta->flags & WLAN_STA_WMM);
677 	return 0;
678 }
679 
680 
hostapd_ctrl_iface_status(struct hostapd_data * hapd,char * buf,size_t buflen)681 int hostapd_ctrl_iface_status(struct hostapd_data *hapd, char *buf,
682 			      size_t buflen)
683 {
684 	struct hostapd_iface *iface = hapd->iface;
685 	struct hostapd_hw_modes *mode = iface->current_mode;
686 	int len = 0, ret, j;
687 	size_t i;
688 
689 	ret = os_snprintf(buf + len, buflen - len,
690 			  "state=%s\n"
691 			  "phy=%s\n"
692 			  "freq=%d\n"
693 			  "num_sta_non_erp=%d\n"
694 			  "num_sta_no_short_slot_time=%d\n"
695 			  "num_sta_no_short_preamble=%d\n"
696 			  "olbc=%d\n"
697 			  "num_sta_ht_no_gf=%d\n"
698 			  "num_sta_no_ht=%d\n"
699 			  "num_sta_ht_20_mhz=%d\n"
700 			  "num_sta_ht40_intolerant=%d\n"
701 			  "olbc_ht=%d\n"
702 			  "ht_op_mode=0x%x\n",
703 			  hostapd_state_text(iface->state),
704 			  iface->phy,
705 			  iface->freq,
706 			  iface->num_sta_non_erp,
707 			  iface->num_sta_no_short_slot_time,
708 			  iface->num_sta_no_short_preamble,
709 			  iface->olbc,
710 			  iface->num_sta_ht_no_gf,
711 			  iface->num_sta_no_ht,
712 			  iface->num_sta_ht_20mhz,
713 			  iface->num_sta_ht40_intolerant,
714 			  iface->olbc_ht,
715 			  iface->ht_op_mode);
716 	if (os_snprintf_error(buflen - len, ret))
717 		return len;
718 	len += ret;
719 
720 	if (!iface->cac_started || !iface->dfs_cac_ms) {
721 		ret = os_snprintf(buf + len, buflen - len,
722 				  "cac_time_seconds=%d\n"
723 				  "cac_time_left_seconds=N/A\n",
724 				  iface->dfs_cac_ms / 1000);
725 	} else {
726 		/* CAC started and CAC time set - calculate remaining time */
727 		struct os_reltime now;
728 		long left_time;
729 
730 		os_reltime_age(&iface->dfs_cac_start, &now);
731 		left_time = (long) iface->dfs_cac_ms / 1000 - now.sec;
732 		ret = os_snprintf(buf + len, buflen - len,
733 				  "cac_time_seconds=%u\n"
734 				  "cac_time_left_seconds=%lu\n",
735 				  iface->dfs_cac_ms / 1000,
736 				  left_time > 0 ? left_time : 0);
737 	}
738 	if (os_snprintf_error(buflen - len, ret))
739 		return len;
740 	len += ret;
741 
742 	ret = os_snprintf(buf + len, buflen - len,
743 			  "channel=%u\n"
744 			  "edmg_enable=%d\n"
745 			  "edmg_channel=%d\n"
746 			  "secondary_channel=%d\n"
747 			  "ieee80211n=%d\n"
748 			  "ieee80211ac=%d\n"
749 			  "ieee80211ax=%d\n"
750 			  "ieee80211be=%d\n"
751 			  "beacon_int=%u\n"
752 			  "dtim_period=%d\n",
753 			  iface->conf->channel,
754 			  iface->conf->enable_edmg,
755 			  iface->conf->edmg_channel,
756 			  iface->conf->ieee80211n && !hapd->conf->disable_11n ?
757 			  iface->conf->secondary_channel : 0,
758 			  iface->conf->ieee80211n && !hapd->conf->disable_11n,
759 			  iface->conf->ieee80211ac &&
760 			  !hapd->conf->disable_11ac,
761 			  iface->conf->ieee80211ax &&
762 			  !hapd->conf->disable_11ax,
763 			  iface->conf->ieee80211be &&
764 			  !hapd->conf->disable_11be,
765 			  iface->conf->beacon_int,
766 			  hapd->conf->dtim_period);
767 	if (os_snprintf_error(buflen - len, ret))
768 		return len;
769 	len += ret;
770 
771 #ifdef CONFIG_IEEE80211BE
772 	if (iface->conf->ieee80211be && !hapd->conf->disable_11be) {
773 		ret = os_snprintf(buf + len, buflen - len,
774 				  "eht_oper_chwidth=%d\n"
775 				  "eht_oper_centr_freq_seg0_idx=%d\n",
776 				  iface->conf->eht_oper_chwidth,
777 				  iface->conf->eht_oper_centr_freq_seg0_idx);
778 		if (os_snprintf_error(buflen - len, ret))
779 			return len;
780 		len += ret;
781 	}
782 #endif /* CONFIG_IEEE80211BE */
783 
784 #ifdef CONFIG_IEEE80211AX
785 	if (iface->conf->ieee80211ax && !hapd->conf->disable_11ax) {
786 		ret = os_snprintf(buf + len, buflen - len,
787 				  "he_oper_chwidth=%d\n"
788 				  "he_oper_centr_freq_seg0_idx=%d\n"
789 				  "he_oper_centr_freq_seg1_idx=%d\n",
790 				  iface->conf->he_oper_chwidth,
791 				  iface->conf->he_oper_centr_freq_seg0_idx,
792 				  iface->conf->he_oper_centr_freq_seg1_idx);
793 		if (os_snprintf_error(buflen - len, ret))
794 			return len;
795 		len += ret;
796 	}
797 #endif /* CONFIG_IEEE80211AX */
798 
799 	if (iface->conf->ieee80211ac && !hapd->conf->disable_11ac) {
800 		ret = os_snprintf(buf + len, buflen - len,
801 				  "vht_oper_chwidth=%d\n"
802 				  "vht_oper_centr_freq_seg0_idx=%d\n"
803 				  "vht_oper_centr_freq_seg1_idx=%d\n"
804 				  "vht_caps_info=%08x\n",
805 				  iface->conf->vht_oper_chwidth,
806 				  iface->conf->vht_oper_centr_freq_seg0_idx,
807 				  iface->conf->vht_oper_centr_freq_seg1_idx,
808 				  iface->conf->vht_capab);
809 		if (os_snprintf_error(buflen - len, ret))
810 			return len;
811 		len += ret;
812 	}
813 
814 	if (iface->conf->ieee80211ac && !hapd->conf->disable_11ac && mode) {
815 		u16 rxmap = WPA_GET_LE16(&mode->vht_mcs_set[0]);
816 		u16 txmap = WPA_GET_LE16(&mode->vht_mcs_set[4]);
817 
818 		ret = os_snprintf(buf + len, buflen - len,
819 				  "rx_vht_mcs_map=%04x\n"
820 				  "tx_vht_mcs_map=%04x\n",
821 				  rxmap, txmap);
822 		if (os_snprintf_error(buflen - len, ret))
823 			return len;
824 		len += ret;
825 	}
826 
827 	if (iface->conf->ieee80211n && !hapd->conf->disable_11n) {
828 		ret = os_snprintf(buf + len, buflen - len,
829 				  "ht_caps_info=%04x\n",
830 				  hapd->iconf->ht_capab);
831 		if (os_snprintf_error(buflen - len, ret))
832 			return len;
833 		len += ret;
834 	}
835 
836 	if (iface->conf->ieee80211n && !hapd->conf->disable_11n && mode) {
837 		len = hostapd_write_ht_mcs_bitmask(buf, buflen, len,
838 						   mode->mcs_set);
839 	}
840 
841 	if (iface->current_rates && iface->num_rates) {
842 		ret = os_snprintf(buf + len, buflen - len, "supported_rates=");
843 		if (os_snprintf_error(buflen - len, ret))
844 			return len;
845 		len += ret;
846 
847 		for (j = 0; j < iface->num_rates; j++) {
848 			ret = os_snprintf(buf + len, buflen - len, "%s%02x",
849 					  j > 0 ? " " : "",
850 					  iface->current_rates[j].rate / 5);
851 			if (os_snprintf_error(buflen - len, ret))
852 				return len;
853 			len += ret;
854 		}
855 		ret = os_snprintf(buf + len, buflen - len, "\n");
856 		if (os_snprintf_error(buflen - len, ret))
857 			return len;
858 		len += ret;
859 	}
860 
861 	for (j = 0; mode && j < mode->num_channels; j++) {
862 		if (mode->channels[j].freq == iface->freq) {
863 			ret = os_snprintf(buf + len, buflen - len,
864 					  "max_txpower=%u\n",
865 					  mode->channels[j].max_tx_power);
866 			if (os_snprintf_error(buflen - len, ret))
867 				return len;
868 			len += ret;
869 			break;
870 		}
871 	}
872 
873 	for (i = 0; i < iface->num_bss; i++) {
874 		struct hostapd_data *bss = iface->bss[i];
875 		ret = os_snprintf(buf + len, buflen - len,
876 				  "bss[%d]=%s\n"
877 				  "bssid[%d]=" MACSTR "\n"
878 				  "ssid[%d]=%s\n"
879 				  "num_sta[%d]=%d\n",
880 				  (int) i, bss->conf->iface,
881 				  (int) i, MAC2STR(bss->own_addr),
882 				  (int) i,
883 				  wpa_ssid_txt(bss->conf->ssid.ssid,
884 					       bss->conf->ssid.ssid_len),
885 				  (int) i, bss->num_sta);
886 		if (os_snprintf_error(buflen - len, ret))
887 			return len;
888 		len += ret;
889 	}
890 
891 	if (hapd->conf->chan_util_avg_period) {
892 		ret = os_snprintf(buf + len, buflen - len,
893 				  "chan_util_avg=%u\n",
894 				  iface->chan_util_average);
895 		if (os_snprintf_error(buflen - len, ret))
896 			return len;
897 		len += ret;
898 	}
899 
900 	return len;
901 }
902 
903 
hostapd_parse_csa_settings(const char * pos,struct csa_settings * settings)904 int hostapd_parse_csa_settings(const char *pos,
905 			       struct csa_settings *settings)
906 {
907 	char *end;
908 
909 	os_memset(settings, 0, sizeof(*settings));
910 	settings->cs_count = strtol(pos, &end, 10);
911 	if (pos == end) {
912 		wpa_printf(MSG_ERROR, "chanswitch: invalid cs_count provided");
913 		return -1;
914 	}
915 
916 	settings->freq_params.freq = atoi(end);
917 	if (settings->freq_params.freq == 0) {
918 		wpa_printf(MSG_ERROR, "chanswitch: invalid freq provided");
919 		return -1;
920 	}
921 
922 #define SET_CSA_SETTING(str) \
923 	do { \
924 		const char *pos2 = os_strstr(pos, " " #str "="); \
925 		if (pos2) { \
926 			pos2 += sizeof(" " #str "=") - 1; \
927 			settings->freq_params.str = atoi(pos2); \
928 		} \
929 	} while (0)
930 
931 	SET_CSA_SETTING(center_freq1);
932 	SET_CSA_SETTING(center_freq2);
933 	SET_CSA_SETTING(bandwidth);
934 	SET_CSA_SETTING(sec_channel_offset);
935 	settings->freq_params.ht_enabled = !!os_strstr(pos, " ht");
936 	settings->freq_params.vht_enabled = !!os_strstr(pos, " vht");
937 	settings->freq_params.he_enabled = !!os_strstr(pos, " he");
938 	settings->freq_params.eht_enabled = !!os_strstr(pos, " eht");
939 	settings->block_tx = !!os_strstr(pos, " blocktx");
940 #undef SET_CSA_SETTING
941 
942 	return 0;
943 }
944 
945 
hostapd_ctrl_iface_stop_ap(struct hostapd_data * hapd)946 int hostapd_ctrl_iface_stop_ap(struct hostapd_data *hapd)
947 {
948 	return hostapd_drv_stop_ap(hapd);
949 }
950 
951 
hostapd_ctrl_iface_pmksa_list(struct hostapd_data * hapd,char * buf,size_t len)952 int hostapd_ctrl_iface_pmksa_list(struct hostapd_data *hapd, char *buf,
953 				  size_t len)
954 {
955 	return wpa_auth_pmksa_list(hapd->wpa_auth, buf, len);
956 }
957 
958 
hostapd_ctrl_iface_pmksa_flush(struct hostapd_data * hapd)959 void hostapd_ctrl_iface_pmksa_flush(struct hostapd_data *hapd)
960 {
961 	wpa_auth_pmksa_flush(hapd->wpa_auth);
962 }
963 
964 
hostapd_ctrl_iface_pmksa_add(struct hostapd_data * hapd,char * cmd)965 int hostapd_ctrl_iface_pmksa_add(struct hostapd_data *hapd, char *cmd)
966 {
967 	u8 spa[ETH_ALEN];
968 	u8 pmkid[PMKID_LEN];
969 	u8 pmk[PMK_LEN_MAX];
970 	size_t pmk_len;
971 	char *pos, *pos2;
972 	int akmp = 0, expiration = 0;
973 
974 	/*
975 	 * Entry format:
976 	 * <STA addr> <PMKID> <PMK> <expiration in seconds> <akmp>
977 	 */
978 
979 	if (hwaddr_aton(cmd, spa))
980 		return -1;
981 
982 	pos = os_strchr(cmd, ' ');
983 	if (!pos)
984 		return -1;
985 	pos++;
986 
987 	if (hexstr2bin(pos, pmkid, PMKID_LEN) < 0)
988 		return -1;
989 
990 	pos = os_strchr(pos, ' ');
991 	if (!pos)
992 		return -1;
993 	pos++;
994 
995 	pos2 = os_strchr(pos, ' ');
996 	if (!pos2)
997 		return -1;
998 	pmk_len = (pos2 - pos) / 2;
999 	if (pmk_len < PMK_LEN || pmk_len > PMK_LEN_MAX ||
1000 	    hexstr2bin(pos, pmk, pmk_len) < 0)
1001 		return -1;
1002 
1003 	pos = pos2 + 1;
1004 
1005 	if (sscanf(pos, "%d %d", &expiration, &akmp) != 2)
1006 		return -1;
1007 
1008 	return wpa_auth_pmksa_add2(hapd->wpa_auth, spa, pmk, pmk_len,
1009 				   pmkid, expiration, akmp);
1010 }
1011 
1012 
1013 #ifdef CONFIG_PMKSA_CACHE_EXTERNAL
1014 #ifdef CONFIG_MESH
1015 
hostapd_ctrl_iface_pmksa_list_mesh(struct hostapd_data * hapd,const u8 * addr,char * buf,size_t len)1016 int hostapd_ctrl_iface_pmksa_list_mesh(struct hostapd_data *hapd,
1017 				       const u8 *addr, char *buf, size_t len)
1018 {
1019 	return wpa_auth_pmksa_list_mesh(hapd->wpa_auth, addr, buf, len);
1020 }
1021 
1022 
hostapd_ctrl_iface_pmksa_create_entry(const u8 * aa,char * cmd)1023 void * hostapd_ctrl_iface_pmksa_create_entry(const u8 *aa, char *cmd)
1024 {
1025 	u8 spa[ETH_ALEN];
1026 	u8 pmkid[PMKID_LEN];
1027 	u8 pmk[PMK_LEN_MAX];
1028 	char *pos;
1029 	int expiration;
1030 
1031 	/*
1032 	 * Entry format:
1033 	 * <BSSID> <PMKID> <PMK> <expiration in seconds>
1034 	 */
1035 
1036 	if (hwaddr_aton(cmd, spa))
1037 		return NULL;
1038 
1039 	pos = os_strchr(cmd, ' ');
1040 	if (!pos)
1041 		return NULL;
1042 	pos++;
1043 
1044 	if (hexstr2bin(pos, pmkid, PMKID_LEN) < 0)
1045 		return NULL;
1046 
1047 	pos = os_strchr(pos, ' ');
1048 	if (!pos)
1049 		return NULL;
1050 	pos++;
1051 
1052 	if (hexstr2bin(pos, pmk, PMK_LEN) < 0)
1053 		return NULL;
1054 
1055 	pos = os_strchr(pos, ' ');
1056 	if (!pos)
1057 		return NULL;
1058 	pos++;
1059 
1060 	if (sscanf(pos, "%d", &expiration) != 1)
1061 		return NULL;
1062 
1063 	return wpa_auth_pmksa_create_entry(aa, spa, pmk, pmkid, expiration);
1064 }
1065 
1066 #endif /* CONFIG_MESH */
1067 #endif /* CONFIG_PMKSA_CACHE_EXTERNAL */
1068 
1069 
1070 #ifdef CONFIG_WNM_AP
1071 
hostapd_ctrl_iface_disassoc_imminent(struct hostapd_data * hapd,const char * cmd)1072 int hostapd_ctrl_iface_disassoc_imminent(struct hostapd_data *hapd,
1073 					 const char *cmd)
1074 {
1075 	u8 addr[ETH_ALEN];
1076 	int disassoc_timer;
1077 	struct sta_info *sta;
1078 
1079 	if (hwaddr_aton(cmd, addr))
1080 		return -1;
1081 	if (cmd[17] != ' ')
1082 		return -1;
1083 	disassoc_timer = atoi(cmd + 17);
1084 
1085 	sta = ap_get_sta(hapd, addr);
1086 	if (sta == NULL) {
1087 		wpa_printf(MSG_DEBUG, "Station " MACSTR
1088 			   " not found for disassociation imminent message",
1089 			   MAC2STR(addr));
1090 		return -1;
1091 	}
1092 
1093 	return wnm_send_disassoc_imminent(hapd, sta, disassoc_timer);
1094 }
1095 
1096 
hostapd_ctrl_iface_ess_disassoc(struct hostapd_data * hapd,const char * cmd)1097 int hostapd_ctrl_iface_ess_disassoc(struct hostapd_data *hapd,
1098 				    const char *cmd)
1099 {
1100 	u8 addr[ETH_ALEN];
1101 	const char *url, *timerstr;
1102 	int disassoc_timer;
1103 	struct sta_info *sta;
1104 
1105 	if (hwaddr_aton(cmd, addr))
1106 		return -1;
1107 
1108 	sta = ap_get_sta(hapd, addr);
1109 	if (sta == NULL) {
1110 		wpa_printf(MSG_DEBUG, "Station " MACSTR
1111 			   " not found for ESS disassociation imminent message",
1112 			   MAC2STR(addr));
1113 		return -1;
1114 	}
1115 
1116 	timerstr = cmd + 17;
1117 	if (*timerstr != ' ')
1118 		return -1;
1119 	timerstr++;
1120 	disassoc_timer = atoi(timerstr);
1121 	if (disassoc_timer < 0 || disassoc_timer > 65535)
1122 		return -1;
1123 
1124 	url = os_strchr(timerstr, ' ');
1125 	if (url == NULL)
1126 		return -1;
1127 	url++;
1128 
1129 	return wnm_send_ess_disassoc_imminent(hapd, sta, url, disassoc_timer);
1130 }
1131 
1132 
hostapd_ctrl_iface_bss_tm_req(struct hostapd_data * hapd,const char * cmd)1133 int hostapd_ctrl_iface_bss_tm_req(struct hostapd_data *hapd,
1134 				  const char *cmd)
1135 {
1136 	u8 addr[ETH_ALEN];
1137 	const char *pos, *end;
1138 	int disassoc_timer = 0;
1139 	struct sta_info *sta;
1140 	u8 req_mode = 0, valid_int = 0x01, dialog_token = 0x01;
1141 	u8 bss_term_dur[12];
1142 	char *url = NULL;
1143 	int ret;
1144 	u8 nei_rep[1000];
1145 	int nei_len;
1146 	u8 mbo[10];
1147 	size_t mbo_len = 0;
1148 
1149 	if (hwaddr_aton(cmd, addr)) {
1150 		wpa_printf(MSG_DEBUG, "Invalid STA MAC address");
1151 		return -1;
1152 	}
1153 
1154 	sta = ap_get_sta(hapd, addr);
1155 	if (sta == NULL) {
1156 		wpa_printf(MSG_DEBUG, "Station " MACSTR
1157 			   " not found for BSS TM Request message",
1158 			   MAC2STR(addr));
1159 		return -1;
1160 	}
1161 
1162 	pos = os_strstr(cmd, " disassoc_timer=");
1163 	if (pos) {
1164 		pos += 16;
1165 		disassoc_timer = atoi(pos);
1166 		if (disassoc_timer < 0 || disassoc_timer > 65535) {
1167 			wpa_printf(MSG_DEBUG, "Invalid disassoc_timer");
1168 			return -1;
1169 		}
1170 	}
1171 
1172 	pos = os_strstr(cmd, " valid_int=");
1173 	if (pos) {
1174 		pos += 11;
1175 		valid_int = atoi(pos);
1176 	}
1177 
1178 	pos = os_strstr(cmd, " dialog_token=");
1179 	if (pos) {
1180 		pos += 14;
1181 		dialog_token = atoi(pos);
1182 	}
1183 
1184 	pos = os_strstr(cmd, " bss_term=");
1185 	if (pos) {
1186 		pos += 10;
1187 		req_mode |= WNM_BSS_TM_REQ_BSS_TERMINATION_INCLUDED;
1188 		/* TODO: TSF configurable/learnable */
1189 		bss_term_dur[0] = 4; /* Subelement ID */
1190 		bss_term_dur[1] = 10; /* Length */
1191 		os_memset(&bss_term_dur[2], 0, 8);
1192 		end = os_strchr(pos, ',');
1193 		if (end == NULL) {
1194 			wpa_printf(MSG_DEBUG, "Invalid bss_term data");
1195 			return -1;
1196 		}
1197 		end++;
1198 		WPA_PUT_LE16(&bss_term_dur[10], atoi(end));
1199 	}
1200 
1201 	nei_len = ieee802_11_parse_candidate_list(cmd, nei_rep,
1202 						  sizeof(nei_rep));
1203 	if (nei_len < 0)
1204 		return -1;
1205 
1206 	pos = os_strstr(cmd, " url=");
1207 	if (pos) {
1208 		size_t len;
1209 		pos += 5;
1210 		end = os_strchr(pos, ' ');
1211 		if (end)
1212 			len = end - pos;
1213 		else
1214 			len = os_strlen(pos);
1215 		url = os_malloc(len + 1);
1216 		if (url == NULL)
1217 			return -1;
1218 		os_memcpy(url, pos, len);
1219 		url[len] = '\0';
1220 		req_mode |= WNM_BSS_TM_REQ_ESS_DISASSOC_IMMINENT;
1221 	}
1222 
1223 	if (os_strstr(cmd, " pref=1"))
1224 		req_mode |= WNM_BSS_TM_REQ_PREF_CAND_LIST_INCLUDED;
1225 	if (os_strstr(cmd, " abridged=1"))
1226 		req_mode |= WNM_BSS_TM_REQ_ABRIDGED;
1227 	if (os_strstr(cmd, " disassoc_imminent=1"))
1228 		req_mode |= WNM_BSS_TM_REQ_DISASSOC_IMMINENT;
1229 
1230 #ifdef CONFIG_MBO
1231 	pos = os_strstr(cmd, "mbo=");
1232 	if (pos) {
1233 		unsigned int mbo_reason, cell_pref, reassoc_delay;
1234 		u8 *mbo_pos = mbo;
1235 
1236 		ret = sscanf(pos, "mbo=%u:%u:%u", &mbo_reason,
1237 			     &reassoc_delay, &cell_pref);
1238 		if (ret != 3) {
1239 			wpa_printf(MSG_DEBUG,
1240 				   "MBO requires three arguments: mbo=<reason>:<reassoc_delay>:<cell_pref>");
1241 			ret = -1;
1242 			goto fail;
1243 		}
1244 
1245 		if (mbo_reason > MBO_TRANSITION_REASON_PREMIUM_AP) {
1246 			wpa_printf(MSG_DEBUG,
1247 				   "Invalid MBO transition reason code %u",
1248 				   mbo_reason);
1249 			ret = -1;
1250 			goto fail;
1251 		}
1252 
1253 		/* Valid values for Cellular preference are: 0, 1, 255 */
1254 		if (cell_pref != 0 && cell_pref != 1 && cell_pref != 255) {
1255 			wpa_printf(MSG_DEBUG,
1256 				   "Invalid MBO cellular capability %u",
1257 				   cell_pref);
1258 			ret = -1;
1259 			goto fail;
1260 		}
1261 
1262 		if (reassoc_delay > 65535 ||
1263 		    (reassoc_delay &&
1264 		     !(req_mode & WNM_BSS_TM_REQ_DISASSOC_IMMINENT))) {
1265 			wpa_printf(MSG_DEBUG,
1266 				   "MBO: Assoc retry delay is only valid in disassoc imminent mode");
1267 			ret = -1;
1268 			goto fail;
1269 		}
1270 
1271 		*mbo_pos++ = MBO_ATTR_ID_TRANSITION_REASON;
1272 		*mbo_pos++ = 1;
1273 		*mbo_pos++ = mbo_reason;
1274 		*mbo_pos++ = MBO_ATTR_ID_CELL_DATA_PREF;
1275 		*mbo_pos++ = 1;
1276 		*mbo_pos++ = cell_pref;
1277 
1278 		if (reassoc_delay) {
1279 			*mbo_pos++ = MBO_ATTR_ID_ASSOC_RETRY_DELAY;
1280 			*mbo_pos++ = 2;
1281 			WPA_PUT_LE16(mbo_pos, reassoc_delay);
1282 			mbo_pos += 2;
1283 		}
1284 
1285 		mbo_len = mbo_pos - mbo;
1286 	}
1287 #endif /* CONFIG_MBO */
1288 
1289 	ret = wnm_send_bss_tm_req(hapd, sta, req_mode, disassoc_timer,
1290 				  valid_int, bss_term_dur, dialog_token, url,
1291 				  nei_len ? nei_rep : NULL, nei_len,
1292 				  mbo_len ? mbo : NULL, mbo_len);
1293 #ifdef CONFIG_MBO
1294 fail:
1295 #endif /* CONFIG_MBO */
1296 	os_free(url);
1297 	return ret;
1298 }
1299 
1300 #endif /* CONFIG_WNM_AP */
1301 
1302 
hostapd_ctrl_iface_acl_del_mac(struct mac_acl_entry ** acl,int * num,const char * txtaddr)1303 int hostapd_ctrl_iface_acl_del_mac(struct mac_acl_entry **acl, int *num,
1304 				   const char *txtaddr)
1305 {
1306 	u8 addr[ETH_ALEN];
1307 	struct vlan_description vlan_id;
1308 
1309 	if (!(*num))
1310 		return 0;
1311 
1312 	if (hwaddr_aton(txtaddr, addr))
1313 		return -1;
1314 
1315 	if (hostapd_maclist_found(*acl, *num, addr, &vlan_id))
1316 		hostapd_remove_acl_mac(acl, num, addr);
1317 
1318 	return 0;
1319 }
1320 
1321 
hostapd_ctrl_iface_acl_clear_list(struct mac_acl_entry ** acl,int * num)1322 void hostapd_ctrl_iface_acl_clear_list(struct mac_acl_entry **acl,
1323 				       int *num)
1324 {
1325 	while (*num)
1326 		hostapd_remove_acl_mac(acl, num, (*acl)[0].addr);
1327 }
1328 
1329 
hostapd_ctrl_iface_acl_show_mac(struct mac_acl_entry * acl,int num,char * buf,size_t buflen)1330 int hostapd_ctrl_iface_acl_show_mac(struct mac_acl_entry *acl, int num,
1331 				    char *buf, size_t buflen)
1332 {
1333 	int i = 0, len = 0, ret = 0;
1334 
1335 	if (!acl)
1336 		return 0;
1337 
1338 	while (i < num) {
1339 		ret = os_snprintf(buf + len, buflen - len,
1340 				  MACSTR " VLAN_ID=%d\n",
1341 				  MAC2STR(acl[i].addr),
1342 				  acl[i].vlan_id.untagged);
1343 		if (ret < 0 || (size_t) ret >= buflen - len)
1344 			return len;
1345 		i++;
1346 		len += ret;
1347 	}
1348 	return len;
1349 }
1350 
1351 
hostapd_ctrl_iface_acl_add_mac(struct mac_acl_entry ** acl,int * num,const char * cmd)1352 int hostapd_ctrl_iface_acl_add_mac(struct mac_acl_entry **acl, int *num,
1353 				   const char *cmd)
1354 {
1355 	u8 addr[ETH_ALEN];
1356 	struct vlan_description vlan_id;
1357 	int ret = 0, vlanid = 0;
1358 	const char *pos;
1359 
1360 	if (hwaddr_aton(cmd, addr))
1361 		return -1;
1362 
1363 	pos = os_strstr(cmd, "VLAN_ID=");
1364 	if (pos)
1365 		vlanid = atoi(pos + 8);
1366 
1367 	if (!hostapd_maclist_found(*acl, *num, addr, &vlan_id)) {
1368 		ret = hostapd_add_acl_maclist(acl, num, vlanid, addr);
1369 		if (ret != -1 && *acl)
1370 			qsort(*acl, *num, sizeof(**acl), hostapd_acl_comp);
1371 	}
1372 
1373 	return ret < 0 ? -1 : 0;
1374 }
1375 
1376 
hostapd_disassoc_accept_mac(struct hostapd_data * hapd)1377 int hostapd_disassoc_accept_mac(struct hostapd_data *hapd)
1378 {
1379 	struct sta_info *sta;
1380 	struct vlan_description vlan_id;
1381 
1382 	if (hapd->conf->macaddr_acl != DENY_UNLESS_ACCEPTED)
1383 		return 0;
1384 
1385 	for (sta = hapd->sta_list; sta; sta = sta->next) {
1386 		if (!hostapd_maclist_found(hapd->conf->accept_mac,
1387 					   hapd->conf->num_accept_mac,
1388 					   sta->addr, &vlan_id) ||
1389 		    (vlan_id.notempty &&
1390 		     vlan_compare(&vlan_id, sta->vlan_desc)))
1391 			ap_sta_disconnect(hapd, sta, sta->addr,
1392 					  WLAN_REASON_UNSPECIFIED);
1393 	}
1394 
1395 	return 0;
1396 }
1397 
1398 
hostapd_disassoc_deny_mac(struct hostapd_data * hapd)1399 int hostapd_disassoc_deny_mac(struct hostapd_data *hapd)
1400 {
1401 	struct sta_info *sta;
1402 	struct vlan_description vlan_id;
1403 
1404 	for (sta = hapd->sta_list; sta; sta = sta->next) {
1405 		if (hostapd_maclist_found(hapd->conf->deny_mac,
1406 					  hapd->conf->num_deny_mac, sta->addr,
1407 					  &vlan_id) &&
1408 		    (!vlan_id.notempty ||
1409 		     !vlan_compare(&vlan_id, sta->vlan_desc)))
1410 			ap_sta_disconnect(hapd, sta, sta->addr,
1411 					  WLAN_REASON_UNSPECIFIED);
1412 	}
1413 
1414 	return 0;
1415 }
1416