1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ocv.h"
14 #include "common/wpa_ctrl.h"
15 #include "hostapd.h"
16 #include "sta_info.h"
17 #include "ap_config.h"
18 #include "ap_drv_ops.h"
19 #include "wpa_auth.h"
20 #include "dpp_hostapd.h"
21 #include "ieee802_11.h"
22
23
hostapd_eid_assoc_comeback_time(struct hostapd_data * hapd,struct sta_info * sta,u8 * eid)24 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
25 struct sta_info *sta, u8 *eid)
26 {
27 u8 *pos = eid;
28 u32 timeout, tu;
29 struct os_reltime now, passed;
30
31 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
32 *pos++ = 5;
33 *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
34 os_get_reltime(&now);
35 os_reltime_sub(&now, &sta->sa_query_start, &passed);
36 tu = (passed.sec * 1000000 + passed.usec) / 1024;
37 if (hapd->conf->assoc_sa_query_max_timeout > tu)
38 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
39 else
40 timeout = 0;
41 if (timeout < hapd->conf->assoc_sa_query_max_timeout)
42 timeout++; /* add some extra time for local timers */
43 WPA_PUT_LE32(pos, timeout);
44 pos += 4;
45
46 return pos;
47 }
48
49
50 /* MLME-SAQuery.request */
ieee802_11_send_sa_query_req(struct hostapd_data * hapd,const u8 * addr,const u8 * trans_id)51 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
52 const u8 *addr, const u8 *trans_id)
53 {
54 #ifdef CONFIG_OCV
55 struct sta_info *sta;
56 #endif /* CONFIG_OCV */
57 struct ieee80211_mgmt *mgmt;
58 u8 *oci_ie = NULL;
59 u8 oci_ie_len = 0;
60 u8 *end;
61
62 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
63 MACSTR, MAC2STR(addr));
64 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
65 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
66
67 #ifdef CONFIG_OCV
68 sta = ap_get_sta(hapd, addr);
69 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
70 struct wpa_channel_info ci;
71
72 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
73 wpa_printf(MSG_WARNING,
74 "Failed to get channel info for OCI element in SA Query Request");
75 return;
76 }
77 #ifdef CONFIG_TESTING_OPTIONS
78 if (hapd->conf->oci_freq_override_saquery_req) {
79 wpa_printf(MSG_INFO,
80 "TEST: Override OCI frequency %d -> %u MHz",
81 ci.frequency,
82 hapd->conf->oci_freq_override_saquery_req);
83 ci.frequency =
84 hapd->conf->oci_freq_override_saquery_req;
85 }
86 #endif /* CONFIG_TESTING_OPTIONS */
87
88 oci_ie_len = OCV_OCI_EXTENDED_LEN;
89 oci_ie = os_zalloc(oci_ie_len);
90 if (!oci_ie) {
91 wpa_printf(MSG_WARNING,
92 "Failed to allocate buffer for OCI element in SA Query Request");
93 return;
94 }
95
96 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
97 os_free(oci_ie);
98 return;
99 }
100 }
101 #endif /* CONFIG_OCV */
102
103 mgmt = os_zalloc(sizeof(*mgmt) + oci_ie_len);
104 if (!mgmt) {
105 wpa_printf(MSG_DEBUG,
106 "Failed to allocate buffer for SA Query Response frame");
107 os_free(oci_ie);
108 return;
109 }
110
111 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
112 WLAN_FC_STYPE_ACTION);
113 os_memcpy(mgmt->da, addr, ETH_ALEN);
114 os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
115 os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
116 mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
117 mgmt->u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
118 os_memcpy(mgmt->u.action.u.sa_query_req.trans_id, trans_id,
119 WLAN_SA_QUERY_TR_ID_LEN);
120 end = mgmt->u.action.u.sa_query_req.variable;
121 #ifdef CONFIG_OCV
122 if (oci_ie_len > 0) {
123 os_memcpy(end, oci_ie, oci_ie_len);
124 end += oci_ie_len;
125 }
126 #endif /* CONFIG_OCV */
127 if (hostapd_drv_send_mlme(hapd, mgmt, end - (u8 *) mgmt, 0, NULL, 0, 0)
128 < 0)
129 wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
130
131 os_free(mgmt);
132 os_free(oci_ie);
133 }
134
135
ieee802_11_send_sa_query_resp(struct hostapd_data * hapd,const u8 * sa,const u8 * trans_id)136 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
137 const u8 *sa, const u8 *trans_id)
138 {
139 struct sta_info *sta;
140 struct ieee80211_mgmt *resp;
141 u8 *oci_ie = NULL;
142 u8 oci_ie_len = 0;
143 u8 *end;
144
145 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
146 MACSTR, MAC2STR(sa));
147 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
148 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
149
150 sta = ap_get_sta(hapd, sa);
151 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
152 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
153 "from unassociated STA " MACSTR, MAC2STR(sa));
154 return;
155 }
156
157 #ifdef CONFIG_OCV
158 if (wpa_auth_uses_ocv(sta->wpa_sm)) {
159 struct wpa_channel_info ci;
160
161 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
162 wpa_printf(MSG_WARNING,
163 "Failed to get channel info for OCI element in SA Query Response");
164 return;
165 }
166 #ifdef CONFIG_TESTING_OPTIONS
167 if (hapd->conf->oci_freq_override_saquery_resp) {
168 wpa_printf(MSG_INFO,
169 "TEST: Override OCI frequency %d -> %u MHz",
170 ci.frequency,
171 hapd->conf->oci_freq_override_saquery_resp);
172 ci.frequency =
173 hapd->conf->oci_freq_override_saquery_resp;
174 }
175 #endif /* CONFIG_TESTING_OPTIONS */
176
177 oci_ie_len = OCV_OCI_EXTENDED_LEN;
178 oci_ie = os_zalloc(oci_ie_len);
179 if (!oci_ie) {
180 wpa_printf(MSG_WARNING,
181 "Failed to allocate buffer for for OCI element in SA Query Response");
182 return;
183 }
184
185 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
186 os_free(oci_ie);
187 return;
188 }
189 }
190 #endif /* CONFIG_OCV */
191
192 resp = os_zalloc(sizeof(*resp) + oci_ie_len);
193 if (!resp) {
194 wpa_printf(MSG_DEBUG,
195 "Failed to allocate buffer for SA Query Response frame");
196 os_free(oci_ie);
197 return;
198 }
199
200 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
201 MACSTR, MAC2STR(sa));
202
203 resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
204 WLAN_FC_STYPE_ACTION);
205 os_memcpy(resp->da, sa, ETH_ALEN);
206 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
207 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
208 resp->u.action.category = WLAN_ACTION_SA_QUERY;
209 resp->u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
210 os_memcpy(resp->u.action.u.sa_query_req.trans_id, trans_id,
211 WLAN_SA_QUERY_TR_ID_LEN);
212 end = resp->u.action.u.sa_query_req.variable;
213 #ifdef CONFIG_OCV
214 if (oci_ie_len > 0) {
215 os_memcpy(end, oci_ie, oci_ie_len);
216 end += oci_ie_len;
217 }
218 #endif /* CONFIG_OCV */
219 if (hostapd_drv_send_mlme(hapd, resp, end - (u8 *) resp, 0, NULL, 0, 0)
220 < 0)
221 wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
222
223 os_free(resp);
224 os_free(oci_ie);
225 }
226
227
ieee802_11_sa_query_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)228 void ieee802_11_sa_query_action(struct hostapd_data *hapd,
229 const struct ieee80211_mgmt *mgmt,
230 size_t len)
231 {
232 struct sta_info *sta;
233 int i;
234 const u8 *sa = mgmt->sa;
235 const u8 action_type = mgmt->u.action.u.sa_query_resp.action;
236 const u8 *trans_id = mgmt->u.action.u.sa_query_resp.trans_id;
237
238 if (((const u8 *) mgmt) + len <
239 mgmt->u.action.u.sa_query_resp.variable) {
240 wpa_printf(MSG_DEBUG,
241 "IEEE 802.11: Too short SA Query Action frame (len=%lu)",
242 (unsigned long) len);
243 return;
244 }
245 if (is_multicast_ether_addr(mgmt->da)) {
246 wpa_printf(MSG_DEBUG,
247 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
248 MAC2STR(mgmt->da), MAC2STR(mgmt->sa));
249 return;
250 }
251
252 sta = ap_get_sta(hapd, sa);
253
254 #ifdef CONFIG_OCV
255 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
256 struct ieee802_11_elems elems;
257 struct wpa_channel_info ci;
258 int tx_chanwidth;
259 int tx_seg1_idx;
260 size_t ies_len;
261 const u8 *ies;
262
263 ies = mgmt->u.action.u.sa_query_resp.variable;
264 ies_len = len - (ies - (u8 *) mgmt);
265 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) ==
266 ParseFailed) {
267 wpa_printf(MSG_DEBUG,
268 "SA Query: Failed to parse elements");
269 return;
270 }
271
272 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
273 wpa_printf(MSG_WARNING,
274 "Failed to get channel info to validate received OCI in SA Query Action frame");
275 return;
276 }
277
278 if (get_sta_tx_parameters(sta->wpa_sm,
279 channel_width_to_int(ci.chanwidth),
280 ci.seg1_idx, &tx_chanwidth,
281 &tx_seg1_idx) < 0)
282 return;
283
284 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
285 tx_chanwidth, tx_seg1_idx) !=
286 OCI_SUCCESS) {
287 wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
288 MACSTR " frame=saquery%s error=%s",
289 MAC2STR(sa),
290 action_type == WLAN_SA_QUERY_REQUEST ?
291 "req" : "resp", ocv_errorstr);
292 return;
293 }
294 }
295 #endif /* CONFIG_OCV */
296
297 if (action_type == WLAN_SA_QUERY_REQUEST) {
298 if (sta)
299 sta->post_csa_sa_query = 0;
300 ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
301 return;
302 }
303
304 if (action_type != WLAN_SA_QUERY_RESPONSE) {
305 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
306 "Action %d", action_type);
307 return;
308 }
309
310 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
311 MACSTR, MAC2STR(sa));
312 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
313 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
314
315 /* MLME-SAQuery.confirm */
316
317 if (sta == NULL || sta->sa_query_trans_id == NULL) {
318 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
319 "pending SA Query request found");
320 return;
321 }
322
323 for (i = 0; i < sta->sa_query_count; i++) {
324 if (os_memcmp(sta->sa_query_trans_id +
325 i * WLAN_SA_QUERY_TR_ID_LEN,
326 trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
327 break;
328 }
329
330 if (i >= sta->sa_query_count) {
331 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
332 "transaction identifier found");
333 return;
334 }
335
336 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
337 HOSTAPD_LEVEL_DEBUG,
338 "Reply to pending SA Query received");
339 ap_sta_stop_sa_query(hapd, sta);
340 }
341
342
hostapd_ext_capab_byte(struct hostapd_data * hapd,u8 * pos,int idx,bool mbssid_complete)343 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx,
344 bool mbssid_complete)
345 {
346 *pos = 0x00;
347
348 switch (idx) {
349 case 0: /* Bits 0-7 */
350 if (hapd->iconf->obss_interval)
351 *pos |= 0x01; /* Bit 0 - Coexistence management */
352 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)
353 *pos |= 0x04; /* Bit 2 - Extended Channel Switching */
354 break;
355 case 1: /* Bits 8-15 */
356 if (hapd->conf->proxy_arp)
357 *pos |= 0x10; /* Bit 12 - Proxy ARP */
358 if (hapd->conf->coloc_intf_reporting) {
359 /* Bit 13 - Collocated Interference Reporting */
360 *pos |= 0x20;
361 }
362 break;
363 case 2: /* Bits 16-23 */
364 if (hapd->conf->wnm_sleep_mode)
365 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
366 if (hapd->conf->bss_transition)
367 *pos |= 0x08; /* Bit 19 - BSS Transition */
368 if (hapd->iconf->mbssid)
369 *pos |= 0x40; /* Bit 22 - Multiple BSSID */
370 break;
371 case 3: /* Bits 24-31 */
372 #ifdef CONFIG_WNM_AP
373 *pos |= 0x02; /* Bit 25 - SSID List */
374 #endif /* CONFIG_WNM_AP */
375 if (hapd->conf->time_advertisement == 2)
376 *pos |= 0x08; /* Bit 27 - UTC TSF Offset */
377 if (hapd->conf->interworking)
378 *pos |= 0x80; /* Bit 31 - Interworking */
379 break;
380 case 4: /* Bits 32-39 */
381 if (hapd->conf->qos_map_set_len)
382 *pos |= 0x01; /* Bit 32 - QoS Map */
383 if (hapd->conf->tdls & TDLS_PROHIBIT)
384 *pos |= 0x40; /* Bit 38 - TDLS Prohibited */
385 if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
386 /* Bit 39 - TDLS Channel Switching Prohibited */
387 *pos |= 0x80;
388 }
389 break;
390 case 5: /* Bits 40-47 */
391 #ifdef CONFIG_HS20
392 if (hapd->conf->hs20)
393 *pos |= 0x40; /* Bit 46 - WNM-Notification */
394 #endif /* CONFIG_HS20 */
395 #ifdef CONFIG_MBO
396 if (hapd->conf->mbo_enabled)
397 *pos |= 0x40; /* Bit 46 - WNM-Notification */
398 #endif /* CONFIG_MBO */
399 break;
400 case 6: /* Bits 48-55 */
401 if (hapd->conf->ssid.utf8_ssid)
402 *pos |= 0x01; /* Bit 48 - UTF-8 SSID */
403 break;
404 case 7: /* Bits 56-63 */
405 break;
406 case 8: /* Bits 64-71 */
407 if (hapd->conf->ftm_responder)
408 *pos |= 0x40; /* Bit 70 - FTM responder */
409 if (hapd->conf->ftm_initiator)
410 *pos |= 0x80; /* Bit 71 - FTM initiator */
411 break;
412 case 9: /* Bits 72-79 */
413 #ifdef CONFIG_FILS
414 if ((hapd->conf->wpa & WPA_PROTO_RSN) &&
415 wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
416 *pos |= 0x01;
417 #endif /* CONFIG_FILS */
418 #ifdef CONFIG_IEEE80211AX
419 if (hostapd_get_he_twt_responder(hapd, IEEE80211_MODE_AP))
420 *pos |= 0x40; /* Bit 78 - TWT responder */
421 #endif /* CONFIG_IEEE80211AX */
422 break;
423 case 10: /* Bits 80-87 */
424 #ifdef CONFIG_SAE
425 if (hapd->conf->wpa &&
426 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt)) {
427 int in_use = hostapd_sae_pw_id_in_use(hapd->conf);
428
429 if (in_use)
430 *pos |= 0x02; /* Bit 81 - SAE Password
431 * Identifiers In Use */
432 if (in_use == 2)
433 *pos |= 0x04; /* Bit 82 - SAE Password
434 * Identifiers Used Exclusively */
435 }
436 #endif /* CONFIG_SAE */
437 if (hapd->conf->beacon_prot &&
438 (hapd->iface->drv_flags &
439 WPA_DRIVER_FLAGS_BEACON_PROTECTION))
440 *pos |= 0x10; /* Bit 84 - Beacon Protection Enabled */
441 if (hapd->iconf->mbssid == ENHANCED_MBSSID_ENABLED)
442 *pos |= 0x08; /* Bit 83 - Enhanced multiple BSSID */
443 if (mbssid_complete)
444 *pos |= 0x01; /* Bit 80 - Complete List of NonTxBSSID
445 * Profiles */
446 break;
447 case 11: /* Bits 88-95 */
448 #ifdef CONFIG_SAE_PK
449 if (hapd->conf->wpa &&
450 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
451 hostapd_sae_pk_exclusively(hapd->conf))
452 *pos |= 0x01; /* Bit 88 - SAE PK Exclusively */
453 #endif /* CONFIG_SAE_PK */
454 break;
455 }
456 }
457
458
hostapd_eid_ext_capab(struct hostapd_data * hapd,u8 * eid,bool mbssid_complete)459 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid,
460 bool mbssid_complete)
461 {
462 u8 *pos = eid;
463 u8 len = EXT_CAPA_MAX_LEN, i;
464
465 if (len < hapd->iface->extended_capa_len)
466 len = hapd->iface->extended_capa_len;
467
468 *pos++ = WLAN_EID_EXT_CAPAB;
469 *pos++ = len;
470 for (i = 0; i < len; i++, pos++) {
471 hostapd_ext_capab_byte(hapd, pos, i, mbssid_complete);
472
473 if (i < hapd->iface->extended_capa_len) {
474 *pos &= ~hapd->iface->extended_capa_mask[i];
475 *pos |= hapd->iface->extended_capa[i];
476 }
477
478 if (i < EXT_CAPA_MAX_LEN) {
479 *pos &= ~hapd->conf->ext_capa_mask[i];
480 *pos |= hapd->conf->ext_capa[i];
481 }
482
483 /* Clear bits 83 and 22 if EMA and MBSSID are not enabled
484 * otherwise association fails with some clients */
485 if (i == 10 && hapd->iconf->mbssid < ENHANCED_MBSSID_ENABLED)
486 *pos &= ~0x08;
487 if (i == 2 && !hapd->iconf->mbssid)
488 *pos &= ~0x40;
489 }
490
491 while (len > 0 && eid[1 + len] == 0) {
492 len--;
493 eid[1] = len;
494 }
495 if (len == 0)
496 return eid;
497
498 return eid + 2 + len;
499 }
500
501
hostapd_eid_qos_map_set(struct hostapd_data * hapd,u8 * eid)502 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
503 {
504 u8 *pos = eid;
505 u8 len = hapd->conf->qos_map_set_len;
506
507 if (!len)
508 return eid;
509
510 *pos++ = WLAN_EID_QOS_MAP_SET;
511 *pos++ = len;
512 os_memcpy(pos, hapd->conf->qos_map_set, len);
513 pos += len;
514
515 return pos;
516 }
517
518
hostapd_eid_interworking(struct hostapd_data * hapd,u8 * eid)519 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
520 {
521 u8 *pos = eid;
522 #ifdef CONFIG_INTERWORKING
523 u8 *len;
524
525 if (!hapd->conf->interworking)
526 return eid;
527
528 *pos++ = WLAN_EID_INTERWORKING;
529 len = pos++;
530
531 *pos = hapd->conf->access_network_type;
532 if (hapd->conf->internet)
533 *pos |= INTERWORKING_ANO_INTERNET;
534 if (hapd->conf->asra)
535 *pos |= INTERWORKING_ANO_ASRA;
536 if (hapd->conf->esr)
537 *pos |= INTERWORKING_ANO_ESR;
538 if (hapd->conf->uesa)
539 *pos |= INTERWORKING_ANO_UESA;
540 pos++;
541
542 if (hapd->conf->venue_info_set) {
543 *pos++ = hapd->conf->venue_group;
544 *pos++ = hapd->conf->venue_type;
545 }
546
547 if (!is_zero_ether_addr(hapd->conf->hessid)) {
548 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
549 pos += ETH_ALEN;
550 }
551
552 *len = pos - len - 1;
553 #endif /* CONFIG_INTERWORKING */
554
555 return pos;
556 }
557
558
hostapd_eid_adv_proto(struct hostapd_data * hapd,u8 * eid)559 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
560 {
561 u8 *pos = eid;
562 #ifdef CONFIG_INTERWORKING
563
564 /* TODO: Separate configuration for ANQP? */
565 if (!hapd->conf->interworking)
566 return eid;
567
568 *pos++ = WLAN_EID_ADV_PROTO;
569 *pos++ = 2;
570 *pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
571 *pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
572 #endif /* CONFIG_INTERWORKING */
573
574 return pos;
575 }
576
577
hostapd_eid_roaming_consortium(struct hostapd_data * hapd,u8 * eid)578 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
579 {
580 u8 *pos = eid;
581 #ifdef CONFIG_INTERWORKING
582 u8 *len;
583 unsigned int i, count;
584
585 if (!hapd->conf->interworking ||
586 hapd->conf->roaming_consortium == NULL ||
587 hapd->conf->roaming_consortium_count == 0)
588 return eid;
589
590 *pos++ = WLAN_EID_ROAMING_CONSORTIUM;
591 len = pos++;
592
593 /* Number of ANQP OIs (in addition to the max 3 listed here) */
594 if (hapd->conf->roaming_consortium_count > 3 + 255)
595 *pos++ = 255;
596 else if (hapd->conf->roaming_consortium_count > 3)
597 *pos++ = hapd->conf->roaming_consortium_count - 3;
598 else
599 *pos++ = 0;
600
601 /* OU #1 and #2 Lengths */
602 *pos = hapd->conf->roaming_consortium[0].len;
603 if (hapd->conf->roaming_consortium_count > 1)
604 *pos |= hapd->conf->roaming_consortium[1].len << 4;
605 pos++;
606
607 if (hapd->conf->roaming_consortium_count > 3)
608 count = 3;
609 else
610 count = hapd->conf->roaming_consortium_count;
611
612 for (i = 0; i < count; i++) {
613 os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
614 hapd->conf->roaming_consortium[i].len);
615 pos += hapd->conf->roaming_consortium[i].len;
616 }
617
618 *len = pos - len - 1;
619 #endif /* CONFIG_INTERWORKING */
620
621 return pos;
622 }
623
624
hostapd_eid_time_adv(struct hostapd_data * hapd,u8 * eid)625 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
626 {
627 if (hapd->conf->time_advertisement != 2)
628 return eid;
629
630 if (hapd->time_adv == NULL &&
631 hostapd_update_time_adv(hapd) < 0)
632 return eid;
633
634 if (hapd->time_adv == NULL)
635 return eid;
636
637 os_memcpy(eid, wpabuf_head(hapd->time_adv),
638 wpabuf_len(hapd->time_adv));
639 eid += wpabuf_len(hapd->time_adv);
640
641 return eid;
642 }
643
644
hostapd_eid_time_zone(struct hostapd_data * hapd,u8 * eid)645 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
646 {
647 size_t len;
648
649 if (hapd->conf->time_advertisement != 2 || !hapd->conf->time_zone)
650 return eid;
651
652 len = os_strlen(hapd->conf->time_zone);
653
654 *eid++ = WLAN_EID_TIME_ZONE;
655 *eid++ = len;
656 os_memcpy(eid, hapd->conf->time_zone, len);
657 eid += len;
658
659 return eid;
660 }
661
662
hostapd_update_time_adv(struct hostapd_data * hapd)663 int hostapd_update_time_adv(struct hostapd_data *hapd)
664 {
665 const int elen = 2 + 1 + 10 + 5 + 1;
666 struct os_time t;
667 struct os_tm tm;
668 u8 *pos;
669
670 if (hapd->conf->time_advertisement != 2)
671 return 0;
672
673 if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
674 return -1;
675
676 if (!hapd->time_adv) {
677 hapd->time_adv = wpabuf_alloc(elen);
678 if (hapd->time_adv == NULL)
679 return -1;
680 pos = wpabuf_put(hapd->time_adv, elen);
681 } else
682 pos = wpabuf_mhead_u8(hapd->time_adv);
683
684 *pos++ = WLAN_EID_TIME_ADVERTISEMENT;
685 *pos++ = 1 + 10 + 5 + 1;
686
687 *pos++ = 2; /* UTC time at which the TSF timer is 0 */
688
689 /* Time Value at TSF 0 */
690 /* FIX: need to calculate this based on the current TSF value */
691 WPA_PUT_LE16(pos, tm.year); /* Year */
692 pos += 2;
693 *pos++ = tm.month; /* Month */
694 *pos++ = tm.day; /* Day of month */
695 *pos++ = tm.hour; /* Hours */
696 *pos++ = tm.min; /* Minutes */
697 *pos++ = tm.sec; /* Seconds */
698 WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
699 pos += 2;
700 *pos++ = 0; /* Reserved */
701
702 /* Time Error */
703 /* TODO: fill in an estimate on the error */
704 *pos++ = 0;
705 *pos++ = 0;
706 *pos++ = 0;
707 *pos++ = 0;
708 *pos++ = 0;
709
710 *pos++ = hapd->time_update_counter++;
711
712 return 0;
713 }
714
715
hostapd_eid_bss_max_idle_period(struct hostapd_data * hapd,u8 * eid)716 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid)
717 {
718 u8 *pos = eid;
719
720 #ifdef CONFIG_WNM_AP
721 if (hapd->conf->ap_max_inactivity > 0) {
722 unsigned int val;
723 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
724 *pos++ = 3;
725 val = hapd->conf->ap_max_inactivity;
726 if (val > 68000)
727 val = 68000;
728 val *= 1000;
729 val /= 1024;
730 if (val == 0)
731 val = 1;
732 if (val > 65535)
733 val = 65535;
734 WPA_PUT_LE16(pos, val);
735 pos += 2;
736 *pos++ = 0x00; /* TODO: Protected Keep-Alive Required */
737 }
738 #endif /* CONFIG_WNM_AP */
739
740 return pos;
741 }
742
743
744 #ifdef CONFIG_MBO
745
hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data * hapd,u8 * eid,size_t len,int delta)746 u8 * hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data *hapd, u8 *eid,
747 size_t len, int delta)
748 {
749 u8 mbo[4];
750
751 mbo[0] = OCE_ATTR_ID_RSSI_BASED_ASSOC_REJECT;
752 mbo[1] = 2;
753 /* Delta RSSI */
754 mbo[2] = delta;
755 /* Retry delay */
756 mbo[3] = hapd->iconf->rssi_reject_assoc_timeout;
757
758 return eid + mbo_add_ie(eid, len, mbo, 4);
759 }
760
761
hostapd_eid_mbo(struct hostapd_data * hapd,u8 * eid,size_t len)762 u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len)
763 {
764 u8 mbo[9], *mbo_pos = mbo;
765 u8 *pos = eid;
766
767 if (!hapd->conf->mbo_enabled &&
768 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
769 return eid;
770
771 if (hapd->conf->mbo_enabled) {
772 *mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND;
773 *mbo_pos++ = 1;
774 /* Not Cellular aware */
775 *mbo_pos++ = 0;
776 }
777
778 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
779 *mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW;
780 *mbo_pos++ = 1;
781 *mbo_pos++ = hapd->mbo_assoc_disallow;
782 }
783
784 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd)) {
785 u8 ctrl;
786
787 ctrl = OCE_RELEASE;
788 if (OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
789 ctrl |= OCE_IS_STA_CFON;
790
791 *mbo_pos++ = OCE_ATTR_ID_CAPA_IND;
792 *mbo_pos++ = 1;
793 *mbo_pos++ = ctrl;
794 }
795
796 pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo);
797
798 return pos;
799 }
800
801
hostapd_mbo_ie_len(struct hostapd_data * hapd)802 u8 hostapd_mbo_ie_len(struct hostapd_data *hapd)
803 {
804 u8 len;
805
806 if (!hapd->conf->mbo_enabled &&
807 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
808 return 0;
809
810 /*
811 * MBO IE header (6) + Capability Indication attribute (3) +
812 * Association Disallowed attribute (3) = 12
813 */
814 len = 6;
815 if (hapd->conf->mbo_enabled)
816 len += 3 + (hapd->mbo_assoc_disallow ? 3 : 0);
817
818 /* OCE capability indication attribute (3) */
819 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd))
820 len += 3;
821
822 return len;
823 }
824
825 #endif /* CONFIG_MBO */
826
827
828 #ifdef CONFIG_OWE
hostapd_eid_owe_trans_enabled(struct hostapd_data * hapd)829 static int hostapd_eid_owe_trans_enabled(struct hostapd_data *hapd)
830 {
831 return hapd->conf->owe_transition_ssid_len > 0 &&
832 !is_zero_ether_addr(hapd->conf->owe_transition_bssid);
833 }
834 #endif /* CONFIG_OWE */
835
836
hostapd_eid_owe_trans_len(struct hostapd_data * hapd)837 size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd)
838 {
839 #ifdef CONFIG_OWE
840 if (!hostapd_eid_owe_trans_enabled(hapd))
841 return 0;
842 return 6 + ETH_ALEN + 1 + hapd->conf->owe_transition_ssid_len;
843 #else /* CONFIG_OWE */
844 return 0;
845 #endif /* CONFIG_OWE */
846 }
847
848
hostapd_eid_owe_trans(struct hostapd_data * hapd,u8 * eid,size_t len)849 u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid,
850 size_t len)
851 {
852 #ifdef CONFIG_OWE
853 u8 *pos = eid;
854 size_t elen;
855
856 if (hapd->conf->owe_transition_ifname[0] &&
857 !hostapd_eid_owe_trans_enabled(hapd))
858 hostapd_owe_trans_get_info(hapd);
859
860 if (!hostapd_eid_owe_trans_enabled(hapd))
861 return pos;
862
863 elen = hostapd_eid_owe_trans_len(hapd);
864 if (len < elen) {
865 wpa_printf(MSG_DEBUG,
866 "OWE: Not enough room in the buffer for OWE IE");
867 return pos;
868 }
869
870 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
871 *pos++ = elen - 2;
872 WPA_PUT_BE24(pos, OUI_WFA);
873 pos += 3;
874 *pos++ = OWE_OUI_TYPE;
875 os_memcpy(pos, hapd->conf->owe_transition_bssid, ETH_ALEN);
876 pos += ETH_ALEN;
877 *pos++ = hapd->conf->owe_transition_ssid_len;
878 os_memcpy(pos, hapd->conf->owe_transition_ssid,
879 hapd->conf->owe_transition_ssid_len);
880 pos += hapd->conf->owe_transition_ssid_len;
881
882 return pos;
883 #else /* CONFIG_OWE */
884 return eid;
885 #endif /* CONFIG_OWE */
886 }
887
888
hostapd_eid_dpp_cc_len(struct hostapd_data * hapd)889 size_t hostapd_eid_dpp_cc_len(struct hostapd_data *hapd)
890 {
891 #ifdef CONFIG_DPP2
892 if (hostapd_dpp_configurator_connectivity(hapd))
893 return 6;
894 #endif /* CONFIG_DPP2 */
895 return 0;
896 }
897
898
hostapd_eid_dpp_cc(struct hostapd_data * hapd,u8 * eid,size_t len)899 u8 * hostapd_eid_dpp_cc(struct hostapd_data *hapd, u8 *eid, size_t len)
900 {
901 u8 *pos = eid;
902
903 #ifdef CONFIG_DPP2
904 if (!hostapd_dpp_configurator_connectivity(hapd) || len < 6)
905 return pos;
906
907 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
908 *pos++ = 4;
909 WPA_PUT_BE24(pos, OUI_WFA);
910 pos += 3;
911 *pos++ = DPP_CC_OUI_TYPE;
912 #endif /* CONFIG_DPP2 */
913
914 return pos;
915 }
916
917
ap_copy_sta_supp_op_classes(struct sta_info * sta,const u8 * supp_op_classes,size_t supp_op_classes_len)918 void ap_copy_sta_supp_op_classes(struct sta_info *sta,
919 const u8 *supp_op_classes,
920 size_t supp_op_classes_len)
921 {
922 if (!supp_op_classes)
923 return;
924 os_free(sta->supp_op_classes);
925 sta->supp_op_classes = os_malloc(1 + supp_op_classes_len);
926 if (!sta->supp_op_classes)
927 return;
928
929 sta->supp_op_classes[0] = supp_op_classes_len;
930 os_memcpy(sta->supp_op_classes + 1, supp_op_classes,
931 supp_op_classes_len);
932 }
933
934
hostapd_eid_fils_indic(struct hostapd_data * hapd,u8 * eid,int hessid)935 u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid)
936 {
937 u8 *pos = eid;
938 #ifdef CONFIG_FILS
939 u8 *len;
940 u16 fils_info = 0;
941 size_t realms;
942 struct fils_realm *realm;
943
944 if (!(hapd->conf->wpa & WPA_PROTO_RSN) ||
945 !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
946 return pos;
947
948 realms = dl_list_len(&hapd->conf->fils_realms);
949 if (realms > 7)
950 realms = 7; /* 3 bit count field limits this to max 7 */
951
952 *pos++ = WLAN_EID_FILS_INDICATION;
953 len = pos++;
954 /* TODO: B0..B2: Number of Public Key Identifiers */
955 if (hapd->conf->erp_domain) {
956 /* B3..B5: Number of Realm Identifiers */
957 fils_info |= realms << 3;
958 }
959 /* TODO: B6: FILS IP Address Configuration */
960 if (hapd->conf->fils_cache_id_set)
961 fils_info |= BIT(7);
962 if (hessid && !is_zero_ether_addr(hapd->conf->hessid))
963 fils_info |= BIT(8); /* HESSID Included */
964 /* FILS Shared Key Authentication without PFS Supported */
965 fils_info |= BIT(9);
966 if (hapd->conf->fils_dh_group) {
967 /* FILS Shared Key Authentication with PFS Supported */
968 fils_info |= BIT(10);
969 }
970 /* TODO: B11: FILS Public Key Authentication Supported */
971 /* B12..B15: Reserved */
972 WPA_PUT_LE16(pos, fils_info);
973 pos += 2;
974 if (hapd->conf->fils_cache_id_set) {
975 os_memcpy(pos, hapd->conf->fils_cache_id, FILS_CACHE_ID_LEN);
976 pos += FILS_CACHE_ID_LEN;
977 }
978 if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) {
979 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
980 pos += ETH_ALEN;
981 }
982
983 dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm,
984 list) {
985 if (realms == 0)
986 break;
987 realms--;
988 os_memcpy(pos, realm->hash, 2);
989 pos += 2;
990 }
991 *len = pos - len - 1;
992 #endif /* CONFIG_FILS */
993
994 return pos;
995 }
996
997
998 #ifdef CONFIG_OCV
get_tx_parameters(struct sta_info * sta,int ap_max_chanwidth,int ap_seg1_idx,int * bandwidth,int * seg1_idx)999 int get_tx_parameters(struct sta_info *sta, int ap_max_chanwidth,
1000 int ap_seg1_idx, int *bandwidth, int *seg1_idx)
1001 {
1002 int ht_40mhz = 0;
1003 int vht_80p80 = 0;
1004 int requested_bw;
1005
1006 if (sta->ht_capabilities)
1007 ht_40mhz = !!(sta->ht_capabilities->ht_capabilities_info &
1008 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET);
1009
1010 if (sta->vht_operation) {
1011 struct ieee80211_vht_operation *oper = sta->vht_operation;
1012
1013 /*
1014 * If a VHT Operation element was present, use it to determine
1015 * the supported channel bandwidth.
1016 */
1017 if (oper->vht_op_info_chwidth == CHANWIDTH_USE_HT) {
1018 requested_bw = ht_40mhz ? 40 : 20;
1019 } else if (oper->vht_op_info_chan_center_freq_seg1_idx == 0) {
1020 requested_bw = 80;
1021 } else {
1022 int diff;
1023
1024 requested_bw = 160;
1025 diff = abs((int)
1026 oper->vht_op_info_chan_center_freq_seg0_idx -
1027 (int)
1028 oper->vht_op_info_chan_center_freq_seg1_idx);
1029 vht_80p80 = oper->vht_op_info_chan_center_freq_seg1_idx
1030 != 0 && diff > 16;
1031 }
1032 } else if (sta->vht_capabilities) {
1033 struct ieee80211_vht_capabilities *capab;
1034 int vht_chanwidth;
1035
1036 capab = sta->vht_capabilities;
1037
1038 /*
1039 * If only the VHT Capabilities element is present (e.g., for
1040 * normal clients), use it to determine the supported channel
1041 * bandwidth.
1042 */
1043 vht_chanwidth = capab->vht_capabilities_info &
1044 VHT_CAP_SUPP_CHAN_WIDTH_MASK;
1045 vht_80p80 = capab->vht_capabilities_info &
1046 VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1047
1048 /* TODO: Also take into account Extended NSS BW Support field */
1049 requested_bw = vht_chanwidth ? 160 : 80;
1050 } else {
1051 requested_bw = ht_40mhz ? 40 : 20;
1052 }
1053
1054 *bandwidth = requested_bw < ap_max_chanwidth ?
1055 requested_bw : ap_max_chanwidth;
1056
1057 *seg1_idx = 0;
1058 if (ap_seg1_idx && vht_80p80)
1059 *seg1_idx = ap_seg1_idx;
1060
1061 return 0;
1062 }
1063 #endif /* CONFIG_OCV */
1064
1065
hostapd_eid_rsnxe(struct hostapd_data * hapd,u8 * eid,size_t len)1066 u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len)
1067 {
1068 u8 *pos = eid;
1069 bool sae_pk = false;
1070 u16 capab = 0;
1071 size_t flen;
1072
1073 if (!(hapd->conf->wpa & WPA_PROTO_RSN))
1074 return eid;
1075
1076 #ifdef CONFIG_SAE_PK
1077 sae_pk = hostapd_sae_pk_in_use(hapd->conf);
1078 #endif /* CONFIG_SAE_PK */
1079
1080 if (wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1081 (hapd->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
1082 hapd->conf->sae_pwe == SAE_PWE_BOTH ||
1083 hostapd_sae_pw_id_in_use(hapd->conf) || sae_pk ||
1084 wpa_key_mgmt_sae_ext_key(hapd->conf->wpa_key_mgmt)) &&
1085 hapd->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK) {
1086 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1087 #ifdef CONFIG_SAE_PK
1088 if (sae_pk)
1089 capab |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
1090 #endif /* CONFIG_SAE_PK */
1091 }
1092
1093 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP)
1094 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1095 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP)
1096 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
1097 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP)
1098 capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR);
1099
1100 flen = (capab & 0xff00) ? 2 : 1;
1101 if (len < 2 + flen || !capab)
1102 return eid; /* no supported extended RSN capabilities */
1103 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
1104
1105 *pos++ = WLAN_EID_RSNX;
1106 *pos++ = flen;
1107 *pos++ = capab & 0x00ff;
1108 capab >>= 8;
1109 if (capab)
1110 *pos++ = capab;
1111
1112 return pos;
1113 }
1114
1115
check_ext_capab(struct hostapd_data * hapd,struct sta_info * sta,const u8 * ext_capab_ie,size_t ext_capab_ie_len)1116 u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
1117 const u8 *ext_capab_ie, size_t ext_capab_ie_len)
1118 {
1119 #ifdef CONFIG_INTERWORKING
1120 /* check for QoS Map support */
1121 if (ext_capab_ie_len >= 5) {
1122 if (ext_capab_ie[4] & 0x01)
1123 sta->qos_map_enabled = 1;
1124 }
1125 #endif /* CONFIG_INTERWORKING */
1126
1127 if (ext_capab_ie_len > 0) {
1128 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
1129 os_free(sta->ext_capability);
1130 sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
1131 if (sta->ext_capability) {
1132 sta->ext_capability[0] = ext_capab_ie_len;
1133 os_memcpy(sta->ext_capability + 1, ext_capab_ie,
1134 ext_capab_ie_len);
1135 }
1136 }
1137
1138 return WLAN_STATUS_SUCCESS;
1139 }
1140