1 /*
2 * WPA Supplicant - Client mode MLME
3 * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
10 *
11 * Alternatively, this software may be distributed under the terms of BSD
12 * license.
13 *
14 * See README and COPYING for more details.
15 */
16
17 #include "includes.h"
18
19 #include "common.h"
20 #include "eloop.h"
21 #include "config_ssid.h"
22 #include "wpa_supplicant_i.h"
23 #include "wpa.h"
24 #include "drivers/driver.h"
25 #include "ieee802_11_defs.h"
26 #include "ieee802_11_common.h"
27 #include "mlme.h"
28
29
30 /* Timeouts and intervals in milliseconds */
31 #define IEEE80211_AUTH_TIMEOUT (200)
32 #define IEEE80211_AUTH_MAX_TRIES 3
33 #define IEEE80211_ASSOC_TIMEOUT (200)
34 #define IEEE80211_ASSOC_MAX_TRIES 3
35 #define IEEE80211_MONITORING_INTERVAL (2000)
36 #define IEEE80211_PROBE_INTERVAL (60000)
37 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
38 #define IEEE80211_SCAN_INTERVAL (2000)
39 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
40 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
41
42 #define IEEE80211_PROBE_DELAY (33)
43 #define IEEE80211_CHANNEL_TIME (33)
44 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
45 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
46 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
47 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
48
49 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
50
51
52 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
53
54
55 struct ieee80211_sta_bss {
56 struct ieee80211_sta_bss *next;
57 struct ieee80211_sta_bss *hnext;
58
59 u8 bssid[ETH_ALEN];
60 u8 ssid[MAX_SSID_LEN];
61 size_t ssid_len;
62 u16 capability; /* host byte order */
63 int hw_mode;
64 int channel;
65 int freq;
66 int rssi;
67 u8 *ie;
68 size_t ie_len;
69 u8 *wpa_ie;
70 size_t wpa_ie_len;
71 u8 *rsn_ie;
72 size_t rsn_ie_len;
73 u8 *wmm_ie;
74 size_t wmm_ie_len;
75 u8 *mdie;
76 size_t mdie_len;
77 #define IEEE80211_MAX_SUPP_RATES 32
78 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
79 size_t supp_rates_len;
80 int beacon_int;
81 u64 timestamp;
82
83 int probe_resp;
84 struct os_time last_update;
85 };
86
87
88 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
89 const u8 *dst,
90 const u8 *ssid, size_t ssid_len);
91 static struct ieee80211_sta_bss *
92 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
93 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
94 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
95 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
96 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
97
98
ieee80211_sta_set_channel(struct wpa_supplicant * wpa_s,wpa_hw_mode phymode,int chan,int freq)99 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
100 wpa_hw_mode phymode, int chan,
101 int freq)
102 {
103 size_t i;
104 struct wpa_hw_modes *mode;
105
106 for (i = 0; i < wpa_s->mlme.num_modes; i++) {
107 mode = &wpa_s->mlme.modes[i];
108 if (mode->mode == phymode) {
109 wpa_s->mlme.curr_rates = mode->rates;
110 wpa_s->mlme.num_curr_rates = mode->num_rates;
111 break;
112 }
113 }
114
115 return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
116 }
117
118
119
120 #if 0 /* FIX */
121 static int ecw2cw(int ecw)
122 {
123 int cw = 1;
124 while (ecw > 0) {
125 cw <<= 1;
126 ecw--;
127 }
128 return cw - 1;
129 }
130 #endif
131
132
ieee80211_sta_wmm_params(struct wpa_supplicant * wpa_s,u8 * wmm_param,size_t wmm_param_len)133 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
134 u8 *wmm_param, size_t wmm_param_len)
135 {
136 size_t left;
137 int count;
138 u8 *pos;
139
140 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
141 return;
142 count = wmm_param[6] & 0x0f;
143 if (count == wpa_s->mlme.wmm_last_param_set)
144 return;
145 wpa_s->mlme.wmm_last_param_set = count;
146
147 pos = wmm_param + 8;
148 left = wmm_param_len - 8;
149
150 #if 0 /* FIX */
151 wmm_acm = 0;
152 for (; left >= 4; left -= 4, pos += 4) {
153 int aci = (pos[0] >> 5) & 0x03;
154 int acm = (pos[0] >> 4) & 0x01;
155 int queue;
156
157 switch (aci) {
158 case 1:
159 queue = IEEE80211_TX_QUEUE_DATA3;
160 if (acm)
161 wmm_acm |= BIT(1) | BIT(2);
162 break;
163 case 2:
164 queue = IEEE80211_TX_QUEUE_DATA1;
165 if (acm)
166 wmm_acm |= BIT(4) | BIT(5);
167 break;
168 case 3:
169 queue = IEEE80211_TX_QUEUE_DATA0;
170 if (acm)
171 wmm_acm |= BIT(6) | BIT(7);
172 break;
173 case 0:
174 default:
175 queue = IEEE80211_TX_QUEUE_DATA2;
176 if (acm)
177 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
178 break;
179 }
180
181 params.aifs = pos[0] & 0x0f;
182 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
183 params.cw_min = ecw2cw(pos[1] & 0x0f);
184 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
185 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
186 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
187 "aifs=%d cWmin=%d cWmax=%d burst=%d",
188 queue, aci, acm, params.aifs, params.cw_min,
189 params.cw_max, params.burst_time);
190 /* TODO: handle ACM (block TX, fallback to next lowest allowed
191 * AC for now) */
192 if (local->hw->conf_tx(local->mdev, queue, ¶ms)) {
193 wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
194 "parameters for queue %d", queue);
195 }
196 }
197 #endif
198 }
199
200
ieee80211_set_associated(struct wpa_supplicant * wpa_s,int assoc)201 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
202 {
203 if (wpa_s->mlme.associated == assoc && !assoc)
204 return;
205
206 wpa_s->mlme.associated = assoc;
207
208 if (assoc) {
209 union wpa_event_data data;
210 os_memset(&data, 0, sizeof(data));
211 wpa_s->mlme.prev_bssid_set = 1;
212 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
213 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
214 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
215 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
216 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
217 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
218 } else {
219 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
220 }
221 os_get_time(&wpa_s->mlme.last_probe);
222 }
223
224
ieee80211_sta_tx(struct wpa_supplicant * wpa_s,const u8 * buf,size_t len)225 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
226 size_t len)
227 {
228 return wpa_drv_send_mlme(wpa_s, buf, len);
229 }
230
231
ieee80211_send_auth(struct wpa_supplicant * wpa_s,int transaction,u8 * extra,size_t extra_len,int encrypt)232 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
233 int transaction, u8 *extra, size_t extra_len,
234 int encrypt)
235 {
236 u8 *buf;
237 size_t len;
238 struct ieee80211_mgmt *mgmt;
239
240 buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
241 if (buf == NULL) {
242 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
243 "auth frame");
244 return;
245 }
246
247 mgmt = (struct ieee80211_mgmt *) buf;
248 len = 24 + 6;
249 os_memset(mgmt, 0, 24 + 6);
250 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
251 WLAN_FC_STYPE_AUTH);
252 if (encrypt)
253 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
254 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
255 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
256 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
257 mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
258 mgmt->u.auth.auth_transaction = host_to_le16(transaction);
259 wpa_s->mlme.auth_transaction = transaction + 1;
260 mgmt->u.auth.status_code = host_to_le16(0);
261 if (extra) {
262 os_memcpy(buf + len, extra, extra_len);
263 len += extra_len;
264 }
265
266 ieee80211_sta_tx(wpa_s, buf, len);
267 os_free(buf);
268 }
269
270
ieee80211_reschedule_timer(struct wpa_supplicant * wpa_s,int ms)271 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
272 {
273 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
274 eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
275 ieee80211_sta_timer, wpa_s, NULL);
276 }
277
278
ieee80211_authenticate(struct wpa_supplicant * wpa_s)279 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
280 {
281 u8 *extra;
282 size_t extra_len;
283
284 wpa_s->mlme.auth_tries++;
285 if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
286 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
287 " timed out", MAC2STR(wpa_s->bssid));
288 return;
289 }
290
291 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
292 wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
293 MAC2STR(wpa_s->bssid));
294
295 extra = NULL;
296 extra_len = 0;
297
298 #ifdef CONFIG_IEEE80211R
299 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
300 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
301 wpa_s->mlme.ft_ies) {
302 struct ieee80211_sta_bss *bss;
303 struct rsn_mdie *mdie = NULL;
304 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
305 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
306 mdie = (struct rsn_mdie *) (bss->mdie + 2);
307 if (mdie &&
308 os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
309 MOBILITY_DOMAIN_ID_LEN) == 0) {
310 wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
311 "over-the-air");
312 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
313 extra = wpa_s->mlme.ft_ies;
314 extra_len = wpa_s->mlme.ft_ies_len;
315 }
316 }
317 #endif /* CONFIG_IEEE80211R */
318
319 ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
320
321 ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
322 }
323
324
ieee80211_send_assoc(struct wpa_supplicant * wpa_s)325 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
326 {
327 struct ieee80211_mgmt *mgmt;
328 u8 *pos, *ies, *buf;
329 int i, len;
330 u16 capab;
331 struct ieee80211_sta_bss *bss;
332 int wmm = 0;
333 size_t blen, buflen;
334
335 if (wpa_s->mlme.curr_rates == NULL) {
336 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
337 return;
338 }
339
340 buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
341 wpa_s->mlme.ssid_len;
342 #ifdef CONFIG_IEEE80211R
343 if (wpa_s->mlme.ft_ies)
344 buflen += wpa_s->mlme.ft_ies_len;
345 #endif /* CONFIG_IEEE80211R */
346 buf = os_malloc(buflen);
347 if (buf == NULL) {
348 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
349 "assoc frame");
350 return;
351 }
352 blen = 0;
353
354 capab = wpa_s->mlme.capab;
355 if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
356 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
357 WLAN_CAPABILITY_SHORT_PREAMBLE;
358 }
359 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
360 if (bss) {
361 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
362 capab |= WLAN_CAPABILITY_PRIVACY;
363 if (bss->wmm_ie) {
364 wmm = 1;
365 }
366 }
367
368 mgmt = (struct ieee80211_mgmt *) buf;
369 blen += 24;
370 os_memset(mgmt, 0, 24);
371 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
372 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
373 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
374
375 if (wpa_s->mlme.prev_bssid_set) {
376 blen += 10;
377 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
378 WLAN_FC_STYPE_REASSOC_REQ);
379 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
380 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
381 os_memcpy(mgmt->u.reassoc_req.current_ap,
382 wpa_s->mlme.prev_bssid,
383 ETH_ALEN);
384 } else {
385 blen += 4;
386 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
387 WLAN_FC_STYPE_ASSOC_REQ);
388 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
389 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
390 }
391
392 /* SSID */
393 ies = pos = buf + blen;
394 blen += 2 + wpa_s->mlme.ssid_len;
395 *pos++ = WLAN_EID_SSID;
396 *pos++ = wpa_s->mlme.ssid_len;
397 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
398
399 len = wpa_s->mlme.num_curr_rates;
400 if (len > 8)
401 len = 8;
402 pos = buf + blen;
403 blen += len + 2;
404 *pos++ = WLAN_EID_SUPP_RATES;
405 *pos++ = len;
406 for (i = 0; i < len; i++) {
407 int rate = wpa_s->mlme.curr_rates[i].rate;
408 *pos++ = (u8) (rate / 5);
409 }
410
411 if (wpa_s->mlme.num_curr_rates > len) {
412 pos = buf + blen;
413 blen += wpa_s->mlme.num_curr_rates - len + 2;
414 *pos++ = WLAN_EID_EXT_SUPP_RATES;
415 *pos++ = wpa_s->mlme.num_curr_rates - len;
416 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
417 int rate = wpa_s->mlme.curr_rates[i].rate;
418 *pos++ = (u8) (rate / 5);
419 }
420 }
421
422 if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
423 pos = buf + blen;
424 blen += wpa_s->mlme.extra_ie_len;
425 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
426 }
427
428 #ifdef CONFIG_IEEE80211R
429 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
430 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
431 wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
432 bss && bss->mdie &&
433 bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
434 bss->mdie[1] >= sizeof(struct rsn_mdie)) {
435 pos = buf + blen;
436 blen += 2 + sizeof(struct rsn_mdie);
437 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
438 *pos++ = sizeof(struct rsn_mdie);
439 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
440 pos += MOBILITY_DOMAIN_ID_LEN;
441 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
442 }
443
444 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
445 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
446 wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
447 pos = buf + blen;
448 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
449 pos += wpa_s->mlme.ft_ies_len;
450 blen += wpa_s->mlme.ft_ies_len;
451 }
452 #endif /* CONFIG_IEEE80211R */
453
454 if (wmm && wpa_s->mlme.wmm_enabled) {
455 pos = buf + blen;
456 blen += 9;
457 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
458 *pos++ = 7; /* len */
459 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
460 *pos++ = 0x50;
461 *pos++ = 0xf2;
462 *pos++ = 2; /* WMM */
463 *pos++ = 0; /* WMM info */
464 *pos++ = 1; /* WMM ver */
465 *pos++ = 0;
466 }
467
468 os_free(wpa_s->mlme.assocreq_ies);
469 wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
470 wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
471 if (wpa_s->mlme.assocreq_ies) {
472 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
473 wpa_s->mlme.assocreq_ies_len);
474 }
475
476 ieee80211_sta_tx(wpa_s, buf, blen);
477 os_free(buf);
478 }
479
480
ieee80211_send_deauth(struct wpa_supplicant * wpa_s,u16 reason)481 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
482 {
483 u8 *buf;
484 size_t len;
485 struct ieee80211_mgmt *mgmt;
486
487 buf = os_zalloc(sizeof(*mgmt));
488 if (buf == NULL) {
489 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
490 "deauth frame");
491 return;
492 }
493
494 mgmt = (struct ieee80211_mgmt *) buf;
495 len = 24;
496 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
497 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
498 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
499 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
500 WLAN_FC_STYPE_DEAUTH);
501 len += 2;
502 mgmt->u.deauth.reason_code = host_to_le16(reason);
503
504 ieee80211_sta_tx(wpa_s, buf, len);
505 os_free(buf);
506 }
507
508
ieee80211_send_disassoc(struct wpa_supplicant * wpa_s,u16 reason)509 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
510 {
511 u8 *buf;
512 size_t len;
513 struct ieee80211_mgmt *mgmt;
514
515 buf = os_zalloc(sizeof(*mgmt));
516 if (buf == NULL) {
517 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
518 "disassoc frame");
519 return;
520 }
521
522 mgmt = (struct ieee80211_mgmt *) buf;
523 len = 24;
524 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
525 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
526 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
527 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
528 WLAN_FC_STYPE_DISASSOC);
529 len += 2;
530 mgmt->u.disassoc.reason_code = host_to_le16(reason);
531
532 ieee80211_sta_tx(wpa_s, buf, len);
533 os_free(buf);
534 }
535
536
ieee80211_privacy_mismatch(struct wpa_supplicant * wpa_s)537 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
538 {
539 struct ieee80211_sta_bss *bss;
540 int res = 0;
541
542 if (wpa_s->mlme.mixed_cell ||
543 wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
544 return 0;
545
546 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
547 if (bss == NULL)
548 return 0;
549
550 if (ieee80211_sta_wep_configured(wpa_s) !=
551 !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
552 res = 1;
553
554 return res;
555 }
556
557
ieee80211_associate(struct wpa_supplicant * wpa_s)558 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
559 {
560 wpa_s->mlme.assoc_tries++;
561 if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
562 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
563 " timed out", MAC2STR(wpa_s->bssid));
564 return;
565 }
566
567 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
568 wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
569 MAC2STR(wpa_s->bssid));
570 if (ieee80211_privacy_mismatch(wpa_s)) {
571 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
572 "configuration and mixed-cell disabled - abort "
573 "association");
574 return;
575 }
576
577 ieee80211_send_assoc(wpa_s);
578
579 ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
580 }
581
582
ieee80211_associated(struct wpa_supplicant * wpa_s)583 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
584 {
585 int disassoc;
586
587 /* TODO: start monitoring current AP signal quality and number of
588 * missed beacons. Scan other channels every now and then and search
589 * for better APs. */
590 /* TODO: remove expired BSSes */
591
592 wpa_s->mlme.state = IEEE80211_ASSOCIATED;
593
594 #if 0 /* FIX */
595 sta = sta_info_get(local, wpa_s->bssid);
596 if (sta == NULL) {
597 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
598 MAC2STR(wpa_s->bssid));
599 disassoc = 1;
600 } else {
601 disassoc = 0;
602 if (time_after(jiffies,
603 sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
604 if (wpa_s->mlme.probereq_poll) {
605 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
606 "current AP " MACSTR " - assume "
607 "out of range",
608 MAC2STR(wpa_s->bssid));
609 disassoc = 1;
610 } else {
611 ieee80211_send_probe_req(
612 wpa_s->bssid,
613 wpa_s->mlme.scan_ssid,
614 wpa_s->mlme.scan_ssid_len);
615 wpa_s->mlme.probereq_poll = 1;
616 }
617 } else {
618 wpa_s->mlme.probereq_poll = 0;
619 if (time_after(jiffies, wpa_s->mlme.last_probe +
620 IEEE80211_PROBE_INTERVAL)) {
621 wpa_s->mlme.last_probe = jiffies;
622 ieee80211_send_probe_req(wpa_s->bssid,
623 wpa_s->mlme.ssid,
624 wpa_s->mlme.ssid_len);
625 }
626 }
627 sta_info_release(local, sta);
628 }
629 #else
630 disassoc = 0;
631 #endif
632 if (disassoc) {
633 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
634 ieee80211_reschedule_timer(wpa_s,
635 IEEE80211_MONITORING_INTERVAL +
636 30000);
637 } else {
638 ieee80211_reschedule_timer(wpa_s,
639 IEEE80211_MONITORING_INTERVAL);
640 }
641 }
642
643
ieee80211_send_probe_req(struct wpa_supplicant * wpa_s,const u8 * dst,const u8 * ssid,size_t ssid_len)644 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
645 const u8 *dst,
646 const u8 *ssid, size_t ssid_len)
647 {
648 u8 *buf;
649 size_t len;
650 struct ieee80211_mgmt *mgmt;
651 u8 *pos, *supp_rates;
652 u8 *esupp_rates = NULL;
653 int i;
654
655 buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
656 if (buf == NULL) {
657 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
658 "probe request");
659 return;
660 }
661
662 mgmt = (struct ieee80211_mgmt *) buf;
663 len = 24;
664 os_memset(mgmt, 0, 24);
665 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
666 WLAN_FC_STYPE_PROBE_REQ);
667 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
668 if (dst) {
669 os_memcpy(mgmt->da, dst, ETH_ALEN);
670 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
671 } else {
672 os_memset(mgmt->da, 0xff, ETH_ALEN);
673 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
674 }
675 pos = buf + len;
676 len += 2 + ssid_len;
677 *pos++ = WLAN_EID_SSID;
678 *pos++ = ssid_len;
679 os_memcpy(pos, ssid, ssid_len);
680
681 supp_rates = buf + len;
682 len += 2;
683 supp_rates[0] = WLAN_EID_SUPP_RATES;
684 supp_rates[1] = 0;
685 for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
686 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
687 if (esupp_rates) {
688 pos = buf + len;
689 len++;
690 esupp_rates[1]++;
691 } else if (supp_rates[1] == 8) {
692 esupp_rates = pos;
693 esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
694 esupp_rates[1] = 1;
695 pos = &esupp_rates[2];
696 len += 3;
697 } else {
698 pos = buf + len;
699 len++;
700 supp_rates[1]++;
701 }
702 *pos++ = rate->rate / 5;
703 }
704
705 if (wpa_s->mlme.extra_probe_ie) {
706 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
707 wpa_s->mlme.extra_probe_ie_len);
708 len += wpa_s->mlme.extra_probe_ie_len;
709 }
710
711 ieee80211_sta_tx(wpa_s, buf, len);
712 os_free(buf);
713 }
714
715
ieee80211_sta_wep_configured(struct wpa_supplicant * wpa_s)716 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
717 {
718 #if 0 /* FIX */
719 if (sdata == NULL || sdata->default_key == NULL ||
720 sdata->default_key->alg != ALG_WEP)
721 return 0;
722 return 1;
723 #else
724 return 0;
725 #endif
726 }
727
728
ieee80211_auth_completed(struct wpa_supplicant * wpa_s)729 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
730 {
731 wpa_printf(MSG_DEBUG, "MLME: authenticated");
732 wpa_s->mlme.authenticated = 1;
733 ieee80211_associate(wpa_s);
734 }
735
736
ieee80211_auth_challenge(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)737 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
738 struct ieee80211_mgmt *mgmt,
739 size_t len,
740 struct ieee80211_rx_status *rx_status)
741 {
742 u8 *pos;
743 struct ieee802_11_elems elems;
744
745 wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
746 pos = mgmt->u.auth.variable;
747 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
748 == ParseFailed) {
749 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
750 return;
751 }
752 if (elems.challenge == NULL) {
753 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
754 "auth frame");
755 return;
756 }
757 ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
758 elems.challenge_len + 2, 1);
759 }
760
761
ieee80211_rx_mgmt_auth(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)762 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
763 struct ieee80211_mgmt *mgmt,
764 size_t len,
765 struct ieee80211_rx_status *rx_status)
766 {
767 struct wpa_ssid *ssid = wpa_s->current_ssid;
768 u16 auth_alg, auth_transaction, status_code;
769 int adhoc;
770
771 adhoc = ssid && ssid->mode == 1;
772
773 if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
774 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
775 "from " MACSTR ", but not in authenticate state - "
776 "ignored", MAC2STR(mgmt->sa));
777 return;
778 }
779
780 if (len < 24 + 6) {
781 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
782 "frame received from " MACSTR " - ignored",
783 (unsigned long) len, MAC2STR(mgmt->sa));
784 return;
785 }
786
787 if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
788 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
789 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
790 ") - ignored",
791 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
792 return;
793 }
794
795 if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
796 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
797 "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
798 ") - ignored",
799 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
800 return;
801 }
802
803 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
804 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
805 status_code = le_to_host16(mgmt->u.auth.status_code);
806
807 wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
808 " (alg=%d transaction=%d status=%d)",
809 MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
810
811 if (adhoc) {
812 /* IEEE 802.11 standard does not require authentication in IBSS
813 * networks and most implementations do not seem to use it.
814 * However, try to reply to authentication attempts if someone
815 * has actually implemented this.
816 * TODO: Could implement shared key authentication. */
817 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
818 wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
819 "authentication frame (alg=%d "
820 "transaction=%d)",
821 auth_alg, auth_transaction);
822 return;
823 }
824 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
825 }
826
827 if (auth_alg != wpa_s->mlme.auth_alg ||
828 auth_transaction != wpa_s->mlme.auth_transaction) {
829 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
830 "(alg=%d transaction=%d)",
831 auth_alg, auth_transaction);
832 return;
833 }
834
835 if (status_code != WLAN_STATUS_SUCCESS) {
836 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
837 "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
838 status_code);
839 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
840 const int num_algs = 3;
841 u8 algs[num_algs];
842 int i, pos;
843 algs[0] = algs[1] = algs[2] = 0xff;
844 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
845 algs[0] = WLAN_AUTH_OPEN;
846 if (wpa_s->mlme.auth_algs &
847 IEEE80211_AUTH_ALG_SHARED_KEY)
848 algs[1] = WLAN_AUTH_SHARED_KEY;
849 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
850 algs[2] = WLAN_AUTH_LEAP;
851 if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
852 pos = 0;
853 else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
854 pos = 1;
855 else
856 pos = 2;
857 for (i = 0; i < num_algs; i++) {
858 pos++;
859 if (pos >= num_algs)
860 pos = 0;
861 if (algs[pos] == wpa_s->mlme.auth_alg ||
862 algs[pos] == 0xff)
863 continue;
864 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
865 !ieee80211_sta_wep_configured(wpa_s))
866 continue;
867 wpa_s->mlme.auth_alg = algs[pos];
868 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
869 "for next try",
870 wpa_s->mlme.auth_alg);
871 break;
872 }
873 }
874 return;
875 }
876
877 switch (wpa_s->mlme.auth_alg) {
878 case WLAN_AUTH_OPEN:
879 case WLAN_AUTH_LEAP:
880 ieee80211_auth_completed(wpa_s);
881 break;
882 case WLAN_AUTH_SHARED_KEY:
883 if (wpa_s->mlme.auth_transaction == 4)
884 ieee80211_auth_completed(wpa_s);
885 else
886 ieee80211_auth_challenge(wpa_s, mgmt, len,
887 rx_status);
888 break;
889 #ifdef CONFIG_IEEE80211R
890 case WLAN_AUTH_FT:
891 {
892 union wpa_event_data data;
893 os_memset(&data, 0, sizeof(data));
894 data.ft_ies.ies = mgmt->u.auth.variable;
895 data.ft_ies.ies_len = len -
896 (mgmt->u.auth.variable - (u8 *) mgmt);
897 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
898 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
899 ieee80211_auth_completed(wpa_s);
900 break;
901 }
902 #endif /* CONFIG_IEEE80211R */
903 }
904 }
905
906
ieee80211_rx_mgmt_deauth(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)907 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
908 struct ieee80211_mgmt *mgmt,
909 size_t len,
910 struct ieee80211_rx_status *rx_status)
911 {
912 u16 reason_code;
913
914 if (len < 24 + 2) {
915 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
916 "frame received from " MACSTR " - ignored",
917 (unsigned long) len, MAC2STR(mgmt->sa));
918 return;
919 }
920
921 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
922 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
923 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
924 ") - ignored",
925 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
926 return;
927 }
928
929 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
930
931 wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
932 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
933
934 if (wpa_s->mlme.authenticated)
935 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
936
937 if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
938 wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
939 wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
940 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
941 ieee80211_reschedule_timer(wpa_s,
942 IEEE80211_RETRY_AUTH_INTERVAL);
943 }
944
945 ieee80211_set_associated(wpa_s, 0);
946 wpa_s->mlme.authenticated = 0;
947 }
948
949
ieee80211_rx_mgmt_disassoc(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)950 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
951 struct ieee80211_mgmt *mgmt,
952 size_t len,
953 struct ieee80211_rx_status *rx_status)
954 {
955 u16 reason_code;
956
957 if (len < 24 + 2) {
958 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
959 "frame received from " MACSTR " - ignored",
960 (unsigned long) len, MAC2STR(mgmt->sa));
961 return;
962 }
963
964 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
965 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
966 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
967 ") - ignored",
968 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
969 return;
970 }
971
972 reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
973
974 wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
975 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
976
977 if (wpa_s->mlme.associated)
978 wpa_printf(MSG_DEBUG, "MLME: disassociated");
979
980 if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
981 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
982 ieee80211_reschedule_timer(wpa_s,
983 IEEE80211_RETRY_AUTH_INTERVAL);
984 }
985
986 ieee80211_set_associated(wpa_s, 0);
987 }
988
989
ieee80211_ft_assoc_resp(struct wpa_supplicant * wpa_s,struct ieee802_11_elems * elems)990 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
991 struct ieee802_11_elems *elems)
992 {
993 #ifdef CONFIG_IEEE80211R
994 const u8 *mobility_domain = NULL;
995 const u8 *r0kh_id = NULL;
996 size_t r0kh_id_len = 0;
997 const u8 *r1kh_id = NULL;
998 struct rsn_ftie *hdr;
999 const u8 *pos, *end;
1000
1001 if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1002 mobility_domain = elems->mdie;
1003 if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1004 end = elems->ftie + elems->ftie_len;
1005 hdr = (struct rsn_ftie *) elems->ftie;
1006 pos = (const u8 *) (hdr + 1);
1007 while (pos + 1 < end) {
1008 if (pos + 2 + pos[1] > end)
1009 break;
1010 if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1011 pos[1] == FT_R1KH_ID_LEN)
1012 r1kh_id = pos + 2;
1013 else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1014 pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1015 r0kh_id = pos + 2;
1016 r0kh_id_len = pos[1];
1017 }
1018 pos += 2 + pos[1];
1019 }
1020 }
1021 return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1022 r0kh_id_len, r1kh_id);
1023 #else /* CONFIG_IEEE80211R */
1024 return 0;
1025 #endif /* CONFIG_IEEE80211R */
1026 }
1027
1028
ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status,int reassoc)1029 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1030 struct ieee80211_mgmt *mgmt,
1031 size_t len,
1032 struct ieee80211_rx_status *rx_status,
1033 int reassoc)
1034 {
1035 u8 rates[32];
1036 size_t rates_len;
1037 u16 capab_info, status_code, aid;
1038 struct ieee802_11_elems elems;
1039 u8 *pos;
1040
1041 /* AssocResp and ReassocResp have identical structure, so process both
1042 * of them in this function. */
1043
1044 if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1045 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1046 MACSTR ", but not in associate state - ignored",
1047 MAC2STR(mgmt->sa));
1048 return;
1049 }
1050
1051 if (len < 24 + 6) {
1052 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1053 "frame received from " MACSTR " - ignored",
1054 (unsigned long) len, MAC2STR(mgmt->sa));
1055 return;
1056 }
1057
1058 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1059 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1060 "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1061 "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1062 return;
1063 }
1064
1065 capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1066 status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1067 aid = le_to_host16(mgmt->u.assoc_resp.aid);
1068 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1069 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1070 "not set", aid);
1071 aid &= ~(BIT(15) | BIT(14));
1072
1073 wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1074 " (capab=0x%x status=%d aid=%d)",
1075 reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1076 capab_info, status_code, aid);
1077
1078 pos = mgmt->u.assoc_resp.variable;
1079 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1080 == ParseFailed) {
1081 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1082 return;
1083 }
1084
1085 if (status_code != WLAN_STATUS_SUCCESS) {
1086 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1087 status_code);
1088 #ifdef CONFIG_IEEE80211W
1089 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1090 elems.timeout_int && elems.timeout_int_len == 5 &&
1091 elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1092 u32 tu, ms;
1093 tu = WPA_GET_LE32(elems.timeout_int + 1);
1094 ms = tu * 1024 / 1000;
1095 wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1096 "temporarily; comeback duration %u TU "
1097 "(%u ms)", tu, ms);
1098 if (ms > IEEE80211_ASSOC_TIMEOUT) {
1099 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1100 "based on comeback duration");
1101 ieee80211_reschedule_timer(wpa_s, ms);
1102 }
1103 }
1104 #endif /* CONFIG_IEEE80211W */
1105 return;
1106 }
1107
1108 if (elems.supp_rates == NULL) {
1109 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1110 "AssocResp");
1111 return;
1112 }
1113
1114 if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1115 if (!reassoc) {
1116 wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1117 "association, not reassociation, response "
1118 "with FT");
1119 return;
1120 }
1121 if (wpa_ft_validate_reassoc_resp(
1122 wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1123 mgmt->sa) < 0) {
1124 wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1125 "Resp failed");
1126 return;
1127 }
1128 } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1129 return;
1130
1131 wpa_printf(MSG_DEBUG, "MLME: associated");
1132 wpa_s->mlme.aid = aid;
1133 wpa_s->mlme.ap_capab = capab_info;
1134
1135 os_free(wpa_s->mlme.assocresp_ies);
1136 wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1137 wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1138 if (wpa_s->mlme.assocresp_ies) {
1139 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1140 wpa_s->mlme.assocresp_ies_len);
1141 }
1142
1143 ieee80211_set_associated(wpa_s, 1);
1144
1145 rates_len = elems.supp_rates_len;
1146 if (rates_len > sizeof(rates))
1147 rates_len = sizeof(rates);
1148 os_memcpy(rates, elems.supp_rates, rates_len);
1149 if (elems.ext_supp_rates) {
1150 size_t _len = elems.ext_supp_rates_len;
1151 if (_len > sizeof(rates) - rates_len)
1152 _len = sizeof(rates) - rates_len;
1153 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1154 rates_len += _len;
1155 }
1156
1157 if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1158 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1159 "netstack");
1160 }
1161 if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1162 0) {
1163 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1164 "netstack");
1165 }
1166
1167 /* Remove STA entry before adding a new one just in case to avoid
1168 * problems with existing configuration (e.g., keys). */
1169 wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1170 if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1171 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1172 "netstack");
1173 }
1174
1175 #if 0 /* FIX? */
1176 sta->assoc_ap = 1;
1177
1178 if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1179 sta->flags |= WLAN_STA_WMM;
1180 ieee80211_sta_wmm_params(wpa_s, elems.wmm, elems.wmm_len);
1181 }
1182 #endif
1183
1184 ieee80211_associated(wpa_s);
1185 }
1186
1187
1188 /* Caller must hold local->sta_bss_lock */
__ieee80211_bss_hash_add(struct wpa_supplicant * wpa_s,struct ieee80211_sta_bss * bss)1189 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1190 struct ieee80211_sta_bss *bss)
1191 {
1192 bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1193 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1194 }
1195
1196
1197 /* Caller must hold local->sta_bss_lock */
__ieee80211_bss_hash_del(struct wpa_supplicant * wpa_s,struct ieee80211_sta_bss * bss)1198 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1199 struct ieee80211_sta_bss *bss)
1200 {
1201 struct ieee80211_sta_bss *b, *prev = NULL;
1202 b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1203 while (b) {
1204 if (b == bss) {
1205 if (prev == NULL) {
1206 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1207 = bss->hnext;
1208 } else {
1209 prev->hnext = bss->hnext;
1210 }
1211 break;
1212 }
1213 prev = b;
1214 b = b->hnext;
1215 }
1216 }
1217
1218
1219 static struct ieee80211_sta_bss *
ieee80211_bss_add(struct wpa_supplicant * wpa_s,const u8 * bssid)1220 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1221 {
1222 struct ieee80211_sta_bss *bss;
1223
1224 bss = os_zalloc(sizeof(*bss));
1225 if (bss == NULL)
1226 return NULL;
1227 os_memcpy(bss->bssid, bssid, ETH_ALEN);
1228
1229 /* TODO: order by RSSI? */
1230 bss->next = wpa_s->mlme.sta_bss_list;
1231 wpa_s->mlme.sta_bss_list = bss;
1232 __ieee80211_bss_hash_add(wpa_s, bss);
1233 return bss;
1234 }
1235
1236
1237 static struct ieee80211_sta_bss *
ieee80211_bss_get(struct wpa_supplicant * wpa_s,const u8 * bssid)1238 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1239 {
1240 struct ieee80211_sta_bss *bss;
1241
1242 bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1243 while (bss) {
1244 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1245 break;
1246 bss = bss->hnext;
1247 }
1248 return bss;
1249 }
1250
1251
ieee80211_bss_free(struct wpa_supplicant * wpa_s,struct ieee80211_sta_bss * bss)1252 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1253 struct ieee80211_sta_bss *bss)
1254 {
1255 __ieee80211_bss_hash_del(wpa_s, bss);
1256 os_free(bss->ie);
1257 os_free(bss->wpa_ie);
1258 os_free(bss->rsn_ie);
1259 os_free(bss->wmm_ie);
1260 os_free(bss->mdie);
1261 os_free(bss);
1262 }
1263
1264
ieee80211_bss_list_deinit(struct wpa_supplicant * wpa_s)1265 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1266 {
1267 struct ieee80211_sta_bss *bss, *prev;
1268
1269 bss = wpa_s->mlme.sta_bss_list;
1270 wpa_s->mlme.sta_bss_list = NULL;
1271 while (bss) {
1272 prev = bss;
1273 bss = bss->next;
1274 ieee80211_bss_free(wpa_s, prev);
1275 }
1276 }
1277
1278
ieee80211_bss_info(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status,int beacon)1279 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1280 struct ieee80211_mgmt *mgmt,
1281 size_t len,
1282 struct ieee80211_rx_status *rx_status,
1283 int beacon)
1284 {
1285 struct ieee802_11_elems elems;
1286 size_t baselen;
1287 int channel, invalid = 0, clen;
1288 struct ieee80211_sta_bss *bss;
1289 u64 timestamp;
1290 u8 *pos, *ie_pos;
1291 size_t ie_len;
1292
1293 if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1294 return; /* ignore ProbeResp to foreign address */
1295
1296 #if 0
1297 wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1298 beacon ? "Beacon" : "Probe Response",
1299 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1300 #endif
1301
1302 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1303 if (baselen > len)
1304 return;
1305
1306 pos = mgmt->u.beacon.timestamp;
1307 timestamp = WPA_GET_LE64(pos);
1308
1309 #if 0 /* FIX */
1310 if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1311 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1312 #ifdef IEEE80211_IBSS_DEBUG
1313 static unsigned long last_tsf_debug = 0;
1314 u64 tsf;
1315 if (local->hw->get_tsf)
1316 tsf = local->hw->get_tsf(local->mdev);
1317 else
1318 tsf = -1LLU;
1319 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1320 wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1321 MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1322 "@%ld",
1323 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1324 tsf, timestamp, tsf - timestamp, jiffies);
1325 last_tsf_debug = jiffies;
1326 }
1327 #endif /* IEEE80211_IBSS_DEBUG */
1328 }
1329 #endif
1330
1331 ie_pos = mgmt->u.beacon.variable;
1332 ie_len = len - baselen;
1333 if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1334 invalid = 1;
1335
1336 #if 0 /* FIX */
1337 if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1338 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1339 (sta = sta_info_get(local, mgmt->sa))) {
1340 struct ieee80211_rate *rates;
1341 size_t num_rates;
1342 u32 supp_rates, prev_rates;
1343 int i, j, oper_mode;
1344
1345 rates = local->curr_rates;
1346 num_rates = local->num_curr_rates;
1347 oper_mode = wpa_s->mlme.sta_scanning ?
1348 local->scan_oper_phymode : local->conf.phymode;
1349 for (i = 0; i < local->hw->num_modes; i++) {
1350 struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1351 if (oper_mode == mode->mode) {
1352 rates = mode->rates;
1353 num_rates = mode->num_rates;
1354 break;
1355 }
1356 }
1357
1358 supp_rates = 0;
1359 for (i = 0; i < elems.supp_rates_len +
1360 elems.ext_supp_rates_len; i++) {
1361 u8 rate = 0;
1362 int own_rate;
1363 if (i < elems.supp_rates_len)
1364 rate = elems.supp_rates[i];
1365 else if (elems.ext_supp_rates)
1366 rate = elems.ext_supp_rates
1367 [i - elems.supp_rates_len];
1368 own_rate = 5 * (rate & 0x7f);
1369 if (oper_mode == MODE_ATHEROS_TURBO)
1370 own_rate *= 2;
1371 for (j = 0; j < num_rates; j++)
1372 if (rates[j].rate == own_rate)
1373 supp_rates |= BIT(j);
1374 }
1375
1376 prev_rates = sta->supp_rates;
1377 sta->supp_rates &= supp_rates;
1378 if (sta->supp_rates == 0) {
1379 /* No matching rates - this should not really happen.
1380 * Make sure that at least one rate is marked
1381 * supported to avoid issues with TX rate ctrl. */
1382 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1383 }
1384 if (sta->supp_rates != prev_rates) {
1385 wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1386 "for " MACSTR " based on beacon info "
1387 "(0x%x & 0x%x -> 0x%x)",
1388 MAC2STR(sta->addr), prev_rates,
1389 supp_rates, sta->supp_rates);
1390 }
1391 sta_info_release(local, sta);
1392 }
1393 #endif
1394
1395 if (elems.ssid == NULL)
1396 return;
1397
1398 if (elems.ds_params && elems.ds_params_len == 1)
1399 channel = elems.ds_params[0];
1400 else
1401 channel = rx_status->channel;
1402
1403 bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1404 if (bss == NULL) {
1405 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1406 if (bss == NULL)
1407 return;
1408 } else {
1409 #if 0
1410 /* TODO: order by RSSI? */
1411 spin_lock_bh(&local->sta_bss_lock);
1412 list_move_tail(&bss->list, &local->sta_bss_list);
1413 spin_unlock_bh(&local->sta_bss_lock);
1414 #endif
1415 }
1416
1417 if (bss->probe_resp && beacon) {
1418 /* Do not allow beacon to override data from Probe Response. */
1419 return;
1420 }
1421
1422 bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1423 bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1424
1425 if (bss->ie == NULL || bss->ie_len < ie_len) {
1426 os_free(bss->ie);
1427 bss->ie = os_malloc(ie_len);
1428 }
1429 if (bss->ie) {
1430 os_memcpy(bss->ie, ie_pos, ie_len);
1431 bss->ie_len = ie_len;
1432 }
1433
1434 if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1435 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1436 bss->ssid_len = elems.ssid_len;
1437 }
1438
1439 bss->supp_rates_len = 0;
1440 if (elems.supp_rates) {
1441 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1442 if (clen > elems.supp_rates_len)
1443 clen = elems.supp_rates_len;
1444 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1445 elems.supp_rates, clen);
1446 bss->supp_rates_len += clen;
1447 }
1448 if (elems.ext_supp_rates) {
1449 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1450 if (clen > elems.ext_supp_rates_len)
1451 clen = elems.ext_supp_rates_len;
1452 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1453 elems.ext_supp_rates, clen);
1454 bss->supp_rates_len += clen;
1455 }
1456
1457 if (elems.wpa_ie &&
1458 (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1459 os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1460 os_free(bss->wpa_ie);
1461 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1462 if (bss->wpa_ie) {
1463 os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1464 elems.wpa_ie_len + 2);
1465 bss->wpa_ie_len = elems.wpa_ie_len + 2;
1466 } else
1467 bss->wpa_ie_len = 0;
1468 } else if (!elems.wpa_ie && bss->wpa_ie) {
1469 os_free(bss->wpa_ie);
1470 bss->wpa_ie = NULL;
1471 bss->wpa_ie_len = 0;
1472 }
1473
1474 if (elems.rsn_ie &&
1475 (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1476 os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1477 os_free(bss->rsn_ie);
1478 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1479 if (bss->rsn_ie) {
1480 os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1481 elems.rsn_ie_len + 2);
1482 bss->rsn_ie_len = elems.rsn_ie_len + 2;
1483 } else
1484 bss->rsn_ie_len = 0;
1485 } else if (!elems.rsn_ie && bss->rsn_ie) {
1486 os_free(bss->rsn_ie);
1487 bss->rsn_ie = NULL;
1488 bss->rsn_ie_len = 0;
1489 }
1490
1491 if (elems.wmm &&
1492 (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_len ||
1493 os_memcmp(bss->wmm_ie, elems.wmm, elems.wmm_len))) {
1494 os_free(bss->wmm_ie);
1495 bss->wmm_ie = os_malloc(elems.wmm_len + 2);
1496 if (bss->wmm_ie) {
1497 os_memcpy(bss->wmm_ie, elems.wmm - 2,
1498 elems.wmm_len + 2);
1499 bss->wmm_ie_len = elems.wmm_len + 2;
1500 } else
1501 bss->wmm_ie_len = 0;
1502 } else if (!elems.wmm && bss->wmm_ie) {
1503 os_free(bss->wmm_ie);
1504 bss->wmm_ie = NULL;
1505 bss->wmm_ie_len = 0;
1506 }
1507
1508 #ifdef CONFIG_IEEE80211R
1509 if (elems.mdie &&
1510 (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1511 os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1512 os_free(bss->mdie);
1513 bss->mdie = os_malloc(elems.mdie_len + 2);
1514 if (bss->mdie) {
1515 os_memcpy(bss->mdie, elems.mdie - 2,
1516 elems.mdie_len + 2);
1517 bss->mdie_len = elems.mdie_len + 2;
1518 } else
1519 bss->mdie_len = 0;
1520 } else if (!elems.mdie && bss->mdie) {
1521 os_free(bss->mdie);
1522 bss->mdie = NULL;
1523 bss->mdie_len = 0;
1524 }
1525 #endif /* CONFIG_IEEE80211R */
1526
1527 bss->hw_mode = wpa_s->mlme.phymode;
1528 bss->channel = channel;
1529 bss->freq = wpa_s->mlme.freq;
1530 if (channel != wpa_s->mlme.channel &&
1531 (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1532 wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1533 channel >= 1 && channel <= 14) {
1534 static const int freq_list[] = {
1535 2412, 2417, 2422, 2427, 2432, 2437, 2442,
1536 2447, 2452, 2457, 2462, 2467, 2472, 2484
1537 };
1538 /* IEEE 802.11g/b mode can receive packets from neighboring
1539 * channels, so map the channel into frequency. */
1540 bss->freq = freq_list[channel - 1];
1541 }
1542 bss->timestamp = timestamp;
1543 os_get_time(&bss->last_update);
1544 bss->rssi = rx_status->ssi;
1545 if (!beacon)
1546 bss->probe_resp++;
1547 }
1548
1549
ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1550 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1551 struct ieee80211_mgmt *mgmt,
1552 size_t len,
1553 struct ieee80211_rx_status *rx_status)
1554 {
1555 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1556 }
1557
1558
ieee80211_rx_mgmt_beacon(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1559 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1560 struct ieee80211_mgmt *mgmt,
1561 size_t len,
1562 struct ieee80211_rx_status *rx_status)
1563 {
1564 int use_protection;
1565 size_t baselen;
1566 struct ieee802_11_elems elems;
1567
1568 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1569
1570 if (!wpa_s->mlme.associated ||
1571 os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1572 return;
1573
1574 /* Process beacon from the current BSS */
1575 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1576 if (baselen > len)
1577 return;
1578
1579 if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1580 &elems, 0) == ParseFailed)
1581 return;
1582
1583 use_protection = 0;
1584 if (elems.erp_info && elems.erp_info_len >= 1) {
1585 use_protection =
1586 (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1587 }
1588
1589 if (use_protection != !!wpa_s->mlme.use_protection) {
1590 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1591 ")",
1592 use_protection ? "enabled" : "disabled",
1593 MAC2STR(wpa_s->bssid));
1594 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1595 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1596 }
1597
1598 if (elems.wmm && wpa_s->mlme.wmm_enabled) {
1599 ieee80211_sta_wmm_params(wpa_s, elems.wmm,
1600 elems.wmm_len);
1601 }
1602 }
1603
1604
ieee80211_rx_mgmt_probe_req(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1605 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1606 struct ieee80211_mgmt *mgmt,
1607 size_t len,
1608 struct ieee80211_rx_status *rx_status)
1609 {
1610 int tx_last_beacon, adhoc;
1611 #if 0 /* FIX */
1612 struct ieee80211_mgmt *resp;
1613 #endif
1614 u8 *pos, *end;
1615 struct wpa_ssid *ssid = wpa_s->current_ssid;
1616
1617 adhoc = ssid && ssid->mode == 1;
1618
1619 if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1620 len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1621 return;
1622
1623 #if 0 /* FIX */
1624 if (local->hw->tx_last_beacon)
1625 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1626 else
1627 #endif
1628 tx_last_beacon = 1;
1629
1630 #ifdef IEEE80211_IBSS_DEBUG
1631 wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1632 " BSSID=" MACSTR " (tx_last_beacon=%d)",
1633 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1634 MAC2STR(mgmt->bssid), tx_last_beacon);
1635 #endif /* IEEE80211_IBSS_DEBUG */
1636
1637 if (!tx_last_beacon)
1638 return;
1639
1640 if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1641 os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1642 return;
1643
1644 end = ((u8 *) mgmt) + len;
1645 pos = mgmt->u.probe_req.variable;
1646 if (pos[0] != WLAN_EID_SSID ||
1647 pos + 2 + pos[1] > end) {
1648 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1649 MACSTR, MAC2STR(mgmt->sa));
1650 return;
1651 }
1652 if (pos[1] != 0 &&
1653 (pos[1] != wpa_s->mlme.ssid_len ||
1654 os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1655 {
1656 /* Ignore ProbeReq for foreign SSID */
1657 return;
1658 }
1659
1660 #if 0 /* FIX */
1661 /* Reply with ProbeResp */
1662 skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1663 if (skb == NULL)
1664 return;
1665
1666 resp = (struct ieee80211_mgmt *) skb->data;
1667 os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1668 #ifdef IEEE80211_IBSS_DEBUG
1669 wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1670 MAC2STR(resp->da));
1671 #endif /* IEEE80211_IBSS_DEBUG */
1672 ieee80211_sta_tx(wpa_s, skb, 0, 1);
1673 #endif
1674 }
1675
1676
1677 #ifdef CONFIG_IEEE80211R
ieee80211_rx_mgmt_ft_action(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1678 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1679 struct ieee80211_mgmt *mgmt,
1680 size_t len,
1681 struct ieee80211_rx_status *rx_status)
1682 {
1683 union wpa_event_data data;
1684 u16 status;
1685 u8 *sta_addr, *target_ap_addr;
1686
1687 if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1688 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1689 return;
1690 }
1691
1692 /*
1693 * Only FT Action Response is needed for now since reservation
1694 * protocol is not supported.
1695 */
1696 if (mgmt->u.action.u.ft_action_resp.action != 2) {
1697 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1698 mgmt->u.action.u.ft_action_resp.action);
1699 return;
1700 }
1701
1702 status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1703 sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1704 target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1705 wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1706 " TargetAP " MACSTR " Status Code %d",
1707 MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1708 if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1709 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1710 " in FT Action Response", MAC2STR(sta_addr));
1711 return;
1712 }
1713
1714 if (status) {
1715 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1716 "failure (status code %d)", status);
1717 /* TODO: report error to FT code(?) */
1718 return;
1719 }
1720
1721 os_memset(&data, 0, sizeof(data));
1722 data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1723 data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1724 (u8 *) mgmt);
1725 data.ft_ies.ft_action = 1;
1726 os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1727 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1728 /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1729 * successfully */
1730 wpa_s->mlme.prev_bssid_set = 1;
1731 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1732 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1733 os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1734 ieee80211_associate(wpa_s);
1735 }
1736 #endif /* CONFIG_IEEE80211R */
1737
1738
1739 #ifdef CONFIG_IEEE80211W
1740
1741 /* MLME-SAQuery.response */
ieee80211_sta_send_sa_query_resp(struct wpa_supplicant * wpa_s,const u8 * addr,const u8 * trans_id)1742 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1743 const u8 *addr, const u8 *trans_id)
1744 {
1745 struct ieee80211_mgmt *mgmt;
1746 int res;
1747 size_t len;
1748
1749 mgmt = os_zalloc(sizeof(*mgmt));
1750 if (mgmt == NULL) {
1751 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1752 "SA Query action frame");
1753 return -1;
1754 }
1755
1756 len = 24;
1757 os_memcpy(mgmt->da, addr, ETH_ALEN);
1758 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1759 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1760 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1761 WLAN_FC_STYPE_ACTION);
1762 mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1763 mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1764 os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1765 WLAN_SA_QUERY_TR_ID_LEN);
1766 len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1767
1768 res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1769 os_free(mgmt);
1770
1771 return res;
1772 }
1773
1774
ieee80211_rx_mgmt_sa_query_action(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1775 static void ieee80211_rx_mgmt_sa_query_action(
1776 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1777 struct ieee80211_rx_status *rx_status)
1778 {
1779 if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1780 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1781 return;
1782 }
1783
1784 if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1785 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1786 mgmt->u.action.u.sa_query_req.action);
1787 return;
1788 }
1789
1790 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1791 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1792 "source " MACSTR, MAC2STR(mgmt->sa));
1793 return;
1794 }
1795
1796 if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1797 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1798 "association process");
1799 return;
1800 }
1801
1802 wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1803 ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1804 sa_query_req.trans_id);
1805 }
1806
1807 #endif /* CONFIG_IEEE80211W */
1808
1809
ieee80211_rx_mgmt_action(struct wpa_supplicant * wpa_s,struct ieee80211_mgmt * mgmt,size_t len,struct ieee80211_rx_status * rx_status)1810 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1811 struct ieee80211_mgmt *mgmt,
1812 size_t len,
1813 struct ieee80211_rx_status *rx_status)
1814 {
1815 wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1816
1817 if (len < 25)
1818 return;
1819
1820 switch (mgmt->u.action.category) {
1821 #ifdef CONFIG_IEEE80211R
1822 case WLAN_ACTION_FT:
1823 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1824 break;
1825 #endif /* CONFIG_IEEE80211R */
1826 #ifdef CONFIG_IEEE80211W
1827 case WLAN_ACTION_SA_QUERY:
1828 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
1829 break;
1830 #endif /* CONFIG_IEEE80211W */
1831 default:
1832 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1833 mgmt->u.action.category);
1834 break;
1835 }
1836 }
1837
1838
ieee80211_sta_rx_mgmt(struct wpa_supplicant * wpa_s,const u8 * buf,size_t len,struct ieee80211_rx_status * rx_status)1839 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1840 const u8 *buf, size_t len,
1841 struct ieee80211_rx_status *rx_status)
1842 {
1843 struct ieee80211_mgmt *mgmt;
1844 u16 fc;
1845
1846 if (len < 24)
1847 return;
1848
1849 mgmt = (struct ieee80211_mgmt *) buf;
1850 fc = le_to_host16(mgmt->frame_control);
1851
1852 switch (WLAN_FC_GET_STYPE(fc)) {
1853 case WLAN_FC_STYPE_PROBE_REQ:
1854 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1855 break;
1856 case WLAN_FC_STYPE_PROBE_RESP:
1857 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1858 break;
1859 case WLAN_FC_STYPE_BEACON:
1860 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1861 break;
1862 case WLAN_FC_STYPE_AUTH:
1863 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
1864 break;
1865 case WLAN_FC_STYPE_ASSOC_RESP:
1866 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
1867 break;
1868 case WLAN_FC_STYPE_REASSOC_RESP:
1869 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
1870 break;
1871 case WLAN_FC_STYPE_DEAUTH:
1872 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
1873 break;
1874 case WLAN_FC_STYPE_DISASSOC:
1875 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
1876 break;
1877 case WLAN_FC_STYPE_ACTION:
1878 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
1879 break;
1880 default:
1881 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
1882 "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
1883 break;
1884 }
1885 }
1886
1887
ieee80211_sta_rx_scan(struct wpa_supplicant * wpa_s,const u8 * buf,size_t len,struct ieee80211_rx_status * rx_status)1888 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
1889 const u8 *buf, size_t len,
1890 struct ieee80211_rx_status *rx_status)
1891 {
1892 struct ieee80211_mgmt *mgmt;
1893 u16 fc;
1894
1895 if (len < 24)
1896 return;
1897
1898 mgmt = (struct ieee80211_mgmt *) buf;
1899 fc = le_to_host16(mgmt->frame_control);
1900
1901 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1902 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1903 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
1904 len, rx_status);
1905 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1906 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1907 }
1908 }
1909 }
1910
1911
ieee80211_sta_active_ibss(struct wpa_supplicant * wpa_s)1912 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
1913 {
1914 int active = 0;
1915
1916 #if 0 /* FIX */
1917 list_for_each(ptr, &local->sta_list) {
1918 sta = list_entry(ptr, struct sta_info, list);
1919 if (sta->dev == dev &&
1920 time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1921 jiffies)) {
1922 active++;
1923 break;
1924 }
1925 }
1926 #endif
1927
1928 return active;
1929 }
1930
1931
ieee80211_sta_expire(struct wpa_supplicant * wpa_s)1932 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
1933 {
1934 #if 0 /* FIX */
1935 list_for_each_safe(ptr, n, &local->sta_list) {
1936 sta = list_entry(ptr, struct sta_info, list);
1937 if (time_after(jiffies, sta->last_rx +
1938 IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1939 wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
1940 MACSTR, MAC2STR(sta->addr));
1941 sta_info_free(local, sta, 1);
1942 }
1943 }
1944 #endif
1945 }
1946
1947
ieee80211_sta_merge_ibss(struct wpa_supplicant * wpa_s)1948 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
1949 {
1950 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
1951
1952 ieee80211_sta_expire(wpa_s);
1953 if (ieee80211_sta_active_ibss(wpa_s))
1954 return;
1955
1956 wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
1957 "other IBSS networks with same SSID (merge)");
1958 ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
1959 }
1960
1961
ieee80211_sta_timer(void * eloop_ctx,void * timeout_ctx)1962 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
1963 {
1964 struct wpa_supplicant *wpa_s = eloop_ctx;
1965
1966 switch (wpa_s->mlme.state) {
1967 case IEEE80211_DISABLED:
1968 break;
1969 case IEEE80211_AUTHENTICATE:
1970 ieee80211_authenticate(wpa_s);
1971 break;
1972 case IEEE80211_ASSOCIATE:
1973 ieee80211_associate(wpa_s);
1974 break;
1975 case IEEE80211_ASSOCIATED:
1976 ieee80211_associated(wpa_s);
1977 break;
1978 case IEEE80211_IBSS_SEARCH:
1979 ieee80211_sta_find_ibss(wpa_s);
1980 break;
1981 case IEEE80211_IBSS_JOINED:
1982 ieee80211_sta_merge_ibss(wpa_s);
1983 break;
1984 default:
1985 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
1986 wpa_s->mlme.state);
1987 break;
1988 }
1989
1990 if (ieee80211_privacy_mismatch(wpa_s)) {
1991 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
1992 "and mixed-cell disabled - disassociate");
1993
1994 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
1995 ieee80211_set_associated(wpa_s, 0);
1996 }
1997 }
1998
1999
ieee80211_sta_new_auth(struct wpa_supplicant * wpa_s)2000 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2001 {
2002 struct wpa_ssid *ssid = wpa_s->current_ssid;
2003 if (ssid && ssid->mode != 0)
2004 return;
2005
2006 #if 0 /* FIX */
2007 if (local->hw->reset_tsf) {
2008 /* Reset own TSF to allow time synchronization work. */
2009 local->hw->reset_tsf(local->mdev);
2010 }
2011 #endif
2012
2013 wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2014
2015
2016 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2017 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2018 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2019 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2020 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2021 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2022 else
2023 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2024 wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2025 wpa_s->mlme.auth_alg);
2026 wpa_s->mlme.auth_transaction = -1;
2027 wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2028 ieee80211_authenticate(wpa_s);
2029 }
2030
2031
ieee80211_ibss_allowed(struct wpa_supplicant * wpa_s)2032 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2033 {
2034 #if 0 /* FIX */
2035 int m, c;
2036
2037 for (m = 0; m < local->hw->num_modes; m++) {
2038 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2039 if (mode->mode != local->conf.phymode)
2040 continue;
2041 for (c = 0; c < mode->num_channels; c++) {
2042 struct ieee80211_channel *chan = &mode->channels[c];
2043 if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2044 chan->chan == local->conf.channel) {
2045 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2046 return 1;
2047 break;
2048 }
2049 }
2050 }
2051 #endif
2052
2053 return 0;
2054 }
2055
2056
ieee80211_sta_join_ibss(struct wpa_supplicant * wpa_s,struct ieee80211_sta_bss * bss)2057 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2058 struct ieee80211_sta_bss *bss)
2059 {
2060 int res = 0, rates, done = 0;
2061 struct ieee80211_mgmt *mgmt;
2062 #if 0 /* FIX */
2063 struct ieee80211_tx_control control;
2064 struct ieee80211_rate *rate;
2065 struct rate_control_extra extra;
2066 #endif
2067 u8 *pos, *buf;
2068 size_t len;
2069
2070 /* Remove possible STA entries from other IBSS networks. */
2071 #if 0 /* FIX */
2072 sta_info_flush(local, NULL);
2073
2074 if (local->hw->reset_tsf) {
2075 /* Reset own TSF to allow time synchronization work. */
2076 local->hw->reset_tsf(local->mdev);
2077 }
2078 #endif
2079 os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2080
2081 #if 0 /* FIX */
2082 local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2083
2084 sdata->drop_unencrypted = bss->capability &
2085 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2086 #endif
2087
2088 #if 0 /* FIX */
2089 os_memset(&rq, 0, sizeof(rq));
2090 rq.m = bss->freq * 100000;
2091 rq.e = 1;
2092 res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2093 #endif
2094
2095 if (!ieee80211_ibss_allowed(wpa_s)) {
2096 #if 0 /* FIX */
2097 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2098 "(%d MHz)", local->conf.channel,
2099 local->conf.freq);
2100 #endif
2101 return -1;
2102 }
2103
2104 /* Set beacon template based on scan results */
2105 buf = os_malloc(400);
2106 len = 0;
2107 do {
2108 if (buf == NULL)
2109 break;
2110
2111 mgmt = (struct ieee80211_mgmt *) buf;
2112 len += 24 + sizeof(mgmt->u.beacon);
2113 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2114 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2115 WLAN_FC_STYPE_BEACON);
2116 os_memset(mgmt->da, 0xff, ETH_ALEN);
2117 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2118 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2119 #if 0 /* FIX */
2120 mgmt->u.beacon.beacon_int =
2121 host_to_le16(local->conf.beacon_int);
2122 #endif
2123 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2124
2125 pos = buf + len;
2126 len += 2 + wpa_s->mlme.ssid_len;
2127 *pos++ = WLAN_EID_SSID;
2128 *pos++ = wpa_s->mlme.ssid_len;
2129 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2130
2131 rates = bss->supp_rates_len;
2132 if (rates > 8)
2133 rates = 8;
2134 pos = buf + len;
2135 len += 2 + rates;
2136 *pos++ = WLAN_EID_SUPP_RATES;
2137 *pos++ = rates;
2138 os_memcpy(pos, bss->supp_rates, rates);
2139
2140 pos = buf + len;
2141 len += 2 + 1;
2142 *pos++ = WLAN_EID_DS_PARAMS;
2143 *pos++ = 1;
2144 *pos++ = bss->channel;
2145
2146 pos = buf + len;
2147 len += 2 + 2;
2148 *pos++ = WLAN_EID_IBSS_PARAMS;
2149 *pos++ = 2;
2150 /* FIX: set ATIM window based on scan results */
2151 *pos++ = 0;
2152 *pos++ = 0;
2153
2154 if (bss->supp_rates_len > 8) {
2155 rates = bss->supp_rates_len - 8;
2156 pos = buf + len;
2157 len += 2 + rates;
2158 *pos++ = WLAN_EID_EXT_SUPP_RATES;
2159 *pos++ = rates;
2160 os_memcpy(pos, &bss->supp_rates[8], rates);
2161 }
2162
2163 #if 0 /* FIX */
2164 os_memset(&control, 0, sizeof(control));
2165 control.pkt_type = PKT_PROBE_RESP;
2166 os_memset(&extra, 0, sizeof(extra));
2167 extra.endidx = local->num_curr_rates;
2168 rate = rate_control_get_rate(wpa_s, skb, &extra);
2169 if (rate == NULL) {
2170 wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2171 "rate for IBSS beacon");
2172 break;
2173 }
2174 control.tx_rate = (wpa_s->mlme.short_preamble &&
2175 (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2176 rate->val2 : rate->val;
2177 control.antenna_sel = local->conf.antenna_sel;
2178 control.power_level = local->conf.power_level;
2179 control.no_ack = 1;
2180 control.retry_limit = 1;
2181 control.rts_cts_duration = 0;
2182 #endif
2183
2184 #if 0 /* FIX */
2185 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2186 if (wpa_s->mlme.probe_resp) {
2187 mgmt = (struct ieee80211_mgmt *)
2188 wpa_s->mlme.probe_resp->data;
2189 mgmt->frame_control =
2190 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2191 WLAN_FC_STYPE_PROBE_RESP);
2192 } else {
2193 wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2194 "ProbeResp template for IBSS");
2195 }
2196
2197 if (local->hw->beacon_update &&
2198 local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2199 wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2200 "template based on scan results");
2201 skb = NULL;
2202 }
2203
2204 rates = 0;
2205 for (i = 0; i < bss->supp_rates_len; i++) {
2206 int rate = (bss->supp_rates[i] & 0x7f) * 5;
2207 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2208 rate *= 2;
2209 for (j = 0; j < local->num_curr_rates; j++)
2210 if (local->curr_rates[j].rate == rate)
2211 rates |= BIT(j);
2212 }
2213 wpa_s->mlme.supp_rates_bits = rates;
2214 #endif
2215 done = 1;
2216 } while (0);
2217
2218 os_free(buf);
2219 if (!done) {
2220 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2221 "template");
2222 }
2223
2224 wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2225 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2226
2227 return res;
2228 }
2229
2230
2231 #if 0 /* FIX */
2232 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2233 {
2234 struct ieee80211_sta_bss *bss;
2235 u8 bssid[ETH_ALEN], *pos;
2236 int i;
2237
2238 #if 0
2239 /* Easier testing, use fixed BSSID. */
2240 os_memset(bssid, 0xfe, ETH_ALEN);
2241 #else
2242 /* Generate random, not broadcast, locally administered BSSID. Mix in
2243 * own MAC address to make sure that devices that do not have proper
2244 * random number generator get different BSSID. */
2245 os_get_random(bssid, ETH_ALEN);
2246 for (i = 0; i < ETH_ALEN; i++)
2247 bssid[i] ^= wpa_s->own_addr[i];
2248 bssid[0] &= ~0x01;
2249 bssid[0] |= 0x02;
2250 #endif
2251
2252 wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2253 MACSTR "", MAC2STR(bssid));
2254
2255 bss = ieee80211_bss_add(wpa_s, bssid);
2256 if (bss == NULL)
2257 return -ENOMEM;
2258
2259 #if 0 /* FIX */
2260 if (local->conf.beacon_int == 0)
2261 local->conf.beacon_int = 100;
2262 bss->beacon_int = local->conf.beacon_int;
2263 bss->hw_mode = local->conf.phymode;
2264 bss->channel = local->conf.channel;
2265 bss->freq = local->conf.freq;
2266 #endif
2267 os_get_time(&bss->last_update);
2268 bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2269 #if 0 /* FIX */
2270 if (sdata->default_key) {
2271 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2272 } else
2273 sdata->drop_unencrypted = 0;
2274 bss->supp_rates_len = local->num_curr_rates;
2275 #endif
2276 pos = bss->supp_rates;
2277 #if 0 /* FIX */
2278 for (i = 0; i < local->num_curr_rates; i++) {
2279 int rate = local->curr_rates[i].rate;
2280 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2281 rate /= 2;
2282 *pos++ = (u8) (rate / 5);
2283 }
2284 #endif
2285
2286 return ieee80211_sta_join_ibss(wpa_s, bss);
2287 }
2288 #endif
2289
2290
ieee80211_sta_find_ibss(struct wpa_supplicant * wpa_s)2291 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2292 {
2293 struct ieee80211_sta_bss *bss;
2294 int found = 0;
2295 u8 bssid[ETH_ALEN];
2296 int active_ibss;
2297 struct os_time now;
2298
2299 if (wpa_s->mlme.ssid_len == 0)
2300 return -EINVAL;
2301
2302 active_ibss = ieee80211_sta_active_ibss(wpa_s);
2303 #ifdef IEEE80211_IBSS_DEBUG
2304 wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2305 active_ibss);
2306 #endif /* IEEE80211_IBSS_DEBUG */
2307 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2308 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2309 os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2310 || !(bss->capability & WLAN_CAPABILITY_IBSS))
2311 continue;
2312 #ifdef IEEE80211_IBSS_DEBUG
2313 wpa_printf(MSG_DEBUG, " bssid=" MACSTR " found",
2314 MAC2STR(bss->bssid));
2315 #endif /* IEEE80211_IBSS_DEBUG */
2316 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2317 found = 1;
2318 if (active_ibss ||
2319 os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2320 break;
2321 }
2322
2323 #ifdef IEEE80211_IBSS_DEBUG
2324 wpa_printf(MSG_DEBUG, " sta_find_ibss: selected " MACSTR " current "
2325 MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2326 #endif /* IEEE80211_IBSS_DEBUG */
2327 if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2328 (bss = ieee80211_bss_get(wpa_s, bssid))) {
2329 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2330 " based on configured SSID",
2331 MAC2STR(bssid));
2332 return ieee80211_sta_join_ibss(wpa_s, bss);
2333 }
2334 #ifdef IEEE80211_IBSS_DEBUG
2335 wpa_printf(MSG_DEBUG, " did not try to join ibss");
2336 #endif /* IEEE80211_IBSS_DEBUG */
2337
2338 /* Selected IBSS not found in current scan results - try to scan */
2339 os_get_time(&now);
2340 #if 0 /* FIX */
2341 if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2342 !ieee80211_sta_active_ibss(wpa_s)) {
2343 ieee80211_reschedule_timer(wpa_s,
2344 IEEE80211_IBSS_MERGE_INTERVAL);
2345 } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2346 IEEE80211_SCAN_INTERVAL)) {
2347 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2348 "to join");
2349 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2350 wpa_s->mlme.ssid_len);
2351 } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2352 int interval = IEEE80211_SCAN_INTERVAL;
2353
2354 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2355 IEEE80211_IBSS_JOIN_TIMEOUT)) {
2356 if (wpa_s->mlme.create_ibss &&
2357 ieee80211_ibss_allowed(wpa_s))
2358 return ieee80211_sta_create_ibss(wpa_s);
2359 if (wpa_s->mlme.create_ibss) {
2360 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2361 "on the configured channel %d "
2362 "(%d MHz)",
2363 local->conf.channel,
2364 local->conf.freq);
2365 }
2366
2367 /* No IBSS found - decrease scan interval and continue
2368 * scanning. */
2369 interval = IEEE80211_SCAN_INTERVAL_SLOW;
2370 }
2371
2372 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2373 ieee80211_reschedule_timer(wpa_s, interval);
2374 return 0;
2375 }
2376 #endif
2377
2378 return 0;
2379 }
2380
2381
ieee80211_sta_get_ssid(struct wpa_supplicant * wpa_s,u8 * ssid,size_t * len)2382 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2383 size_t *len)
2384 {
2385 os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2386 *len = wpa_s->mlme.ssid_len;
2387 return 0;
2388 }
2389
2390
ieee80211_sta_associate(struct wpa_supplicant * wpa_s,struct wpa_driver_associate_params * params)2391 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2392 struct wpa_driver_associate_params *params)
2393 {
2394 struct ieee80211_sta_bss *bss;
2395
2396 wpa_s->mlme.bssid_set = 0;
2397 wpa_s->mlme.freq = params->freq;
2398 if (params->bssid) {
2399 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2400 if (!is_zero_ether_addr(params->bssid))
2401 wpa_s->mlme.bssid_set = 1;
2402 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2403 if (bss) {
2404 wpa_s->mlme.phymode = bss->hw_mode;
2405 wpa_s->mlme.channel = bss->channel;
2406 wpa_s->mlme.freq = bss->freq;
2407 }
2408 }
2409
2410 #if 0 /* FIX */
2411 /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2412 * not defined. */
2413 if (local->hw->conf_tx) {
2414 struct ieee80211_tx_queue_params qparam;
2415 int i;
2416
2417 os_memset(&qparam, 0, sizeof(qparam));
2418 /* TODO: are these ok defaults for all hw_modes? */
2419 qparam.aifs = 2;
2420 qparam.cw_min =
2421 local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2422 qparam.cw_max = 1023;
2423 qparam.burst_time = 0;
2424 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2425 {
2426 local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2427 &qparam);
2428 }
2429 /* IBSS uses different parameters for Beacon sending */
2430 qparam.cw_min++;
2431 qparam.cw_min *= 2;
2432 qparam.cw_min--;
2433 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2434 }
2435 #endif
2436
2437 if (wpa_s->mlme.ssid_len != params->ssid_len ||
2438 os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2439 wpa_s->mlme.prev_bssid_set = 0;
2440 os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2441 os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2442 MAX_SSID_LEN - params->ssid_len);
2443 wpa_s->mlme.ssid_len = params->ssid_len;
2444 wpa_s->mlme.ssid_set = 1;
2445
2446 os_free(wpa_s->mlme.extra_ie);
2447 if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2448 wpa_s->mlme.extra_ie = NULL;
2449 wpa_s->mlme.extra_ie_len = 0;
2450 } else {
2451 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2452 if (wpa_s->mlme.extra_ie == NULL) {
2453 wpa_s->mlme.extra_ie_len = 0;
2454 return -1;
2455 }
2456 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2457 params->wpa_ie_len);
2458 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2459 }
2460
2461 wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2462
2463 ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2464 wpa_s->mlme.channel, wpa_s->mlme.freq);
2465
2466 if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2467 os_get_time(&wpa_s->mlme.ibss_join_req);
2468 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2469 return ieee80211_sta_find_ibss(wpa_s);
2470 }
2471
2472 if (wpa_s->mlme.bssid_set)
2473 ieee80211_sta_new_auth(wpa_s);
2474
2475 return 0;
2476 }
2477
2478
ieee80211_sta_save_oper_chan(struct wpa_supplicant * wpa_s)2479 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2480 {
2481 wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2482 wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2483 wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2484 }
2485
2486
ieee80211_sta_restore_oper_chan(struct wpa_supplicant * wpa_s)2487 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2488 {
2489 wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2490 wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2491 wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2492 if (wpa_s->mlme.freq == 0)
2493 return 0;
2494 return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2495 wpa_s->mlme.channel,
2496 wpa_s->mlme.freq);
2497 }
2498
2499
ieee80211_active_scan(struct wpa_supplicant * wpa_s)2500 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2501 {
2502 size_t m;
2503 int c;
2504
2505 for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2506 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2507 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2508 continue;
2509 for (c = 0; c < mode->num_channels; c++) {
2510 struct wpa_channel_data *chan = &mode->channels[c];
2511 if (chan->flag & WPA_CHAN_W_SCAN &&
2512 chan->chan == wpa_s->mlme.channel) {
2513 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2514 return 1;
2515 break;
2516 }
2517 }
2518 }
2519
2520 return 0;
2521 }
2522
2523
ieee80211_sta_scan_timer(void * eloop_ctx,void * timeout_ctx)2524 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2525 {
2526 struct wpa_supplicant *wpa_s = eloop_ctx;
2527 struct wpa_hw_modes *mode;
2528 struct wpa_channel_data *chan;
2529 int skip = 0;
2530 int timeout = 0;
2531 struct wpa_ssid *ssid = wpa_s->current_ssid;
2532 int adhoc;
2533
2534 if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2535 return;
2536
2537 adhoc = ssid && ssid->mode == 1;
2538
2539 switch (wpa_s->mlme.scan_state) {
2540 case SCAN_SET_CHANNEL:
2541 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2542 if (wpa_s->mlme.scan_hw_mode_idx >=
2543 (int) wpa_s->mlme.num_modes ||
2544 (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2545 (int) wpa_s->mlme.num_modes
2546 && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2547 if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2548 wpa_printf(MSG_DEBUG, "MLME: failed to "
2549 "restore operational channel after "
2550 "scan");
2551 }
2552 wpa_printf(MSG_DEBUG, "MLME: scan completed");
2553 wpa_s->mlme.sta_scanning = 0;
2554 os_get_time(&wpa_s->mlme.last_scan_completed);
2555 wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2556 if (adhoc) {
2557 if (!wpa_s->mlme.bssid_set ||
2558 (wpa_s->mlme.state ==
2559 IEEE80211_IBSS_JOINED &&
2560 !ieee80211_sta_active_ibss(wpa_s)))
2561 ieee80211_sta_find_ibss(wpa_s);
2562 }
2563 return;
2564 }
2565 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2566 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2567 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2568 (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2569 (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2570 mode->mode == WPA_MODE_IEEE80211B &&
2571 wpa_s->mlme.scan_skip_11b))
2572 skip = 1;
2573
2574 if (!skip) {
2575 wpa_printf(MSG_MSGDUMP,
2576 "MLME: scan channel %d (%d MHz)",
2577 chan->chan, chan->freq);
2578
2579 wpa_s->mlme.channel = chan->chan;
2580 wpa_s->mlme.freq = chan->freq;
2581 wpa_s->mlme.phymode = mode->mode;
2582 if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2583 chan->chan, chan->freq))
2584 {
2585 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2586 "channel %d (%d MHz) for scan",
2587 chan->chan, chan->freq);
2588 skip = 1;
2589 }
2590 }
2591
2592 wpa_s->mlme.scan_channel_idx++;
2593 if (wpa_s->mlme.scan_channel_idx >=
2594 wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2595 num_channels) {
2596 wpa_s->mlme.scan_hw_mode_idx++;
2597 wpa_s->mlme.scan_channel_idx = 0;
2598 }
2599
2600 if (skip) {
2601 timeout = 0;
2602 break;
2603 }
2604
2605 timeout = IEEE80211_PROBE_DELAY;
2606 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2607 break;
2608 case SCAN_SEND_PROBE:
2609 if (ieee80211_active_scan(wpa_s)) {
2610 ieee80211_send_probe_req(wpa_s, NULL,
2611 wpa_s->mlme.scan_ssid,
2612 wpa_s->mlme.scan_ssid_len);
2613 timeout = IEEE80211_CHANNEL_TIME;
2614 } else {
2615 timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2616 }
2617 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2618 break;
2619 }
2620
2621 eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2622 ieee80211_sta_scan_timer, wpa_s, NULL);
2623 }
2624
2625
ieee80211_sta_req_scan(struct wpa_supplicant * wpa_s,const u8 * ssid,size_t ssid_len)2626 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2627 size_t ssid_len)
2628 {
2629 if (ssid_len > MAX_SSID_LEN)
2630 return -1;
2631
2632 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
2633 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2634 * BSSID: MACAddress
2635 * SSID
2636 * ScanType: ACTIVE, PASSIVE
2637 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2638 * a Probe frame during active scanning
2639 * ChannelList
2640 * MinChannelTime (>= ProbeDelay), in TU
2641 * MaxChannelTime: (>= MinChannelTime), in TU
2642 */
2643
2644 /* MLME-SCAN.confirm
2645 * BSSDescriptionSet
2646 * ResultCode: SUCCESS, INVALID_PARAMETERS
2647 */
2648
2649 /* TODO: if assoc, move to power save mode for the duration of the
2650 * scan */
2651
2652 if (wpa_s->mlme.sta_scanning)
2653 return -1;
2654
2655 wpa_printf(MSG_DEBUG, "MLME: starting scan");
2656
2657 ieee80211_sta_save_oper_chan(wpa_s);
2658
2659 wpa_s->mlme.sta_scanning = 1;
2660 /* TODO: stop TX queue? */
2661
2662 if (ssid) {
2663 wpa_s->mlme.scan_ssid_len = ssid_len;
2664 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2665 } else
2666 wpa_s->mlme.scan_ssid_len = 0;
2667 wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2668 * supported */
2669 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2670 wpa_s->mlme.scan_hw_mode_idx = 0;
2671 wpa_s->mlme.scan_channel_idx = 0;
2672 eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2673
2674 return 0;
2675 }
2676
2677
2678 struct wpa_scan_results *
ieee80211_sta_get_scan_results(struct wpa_supplicant * wpa_s)2679 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2680 {
2681 size_t ap_num = 0;
2682 struct wpa_scan_results *res;
2683 struct wpa_scan_res *r;
2684 struct ieee80211_sta_bss *bss;
2685
2686 res = os_zalloc(sizeof(*res));
2687 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2688 ap_num++;
2689 res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2690 if (res->res == NULL) {
2691 os_free(res);
2692 return NULL;
2693 }
2694
2695 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2696 r = os_zalloc(sizeof(*r) + bss->ie_len);
2697 if (r == NULL)
2698 break;
2699 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2700 r->freq = bss->freq;
2701 r->beacon_int = bss->beacon_int;
2702 r->caps = bss->capability;
2703 r->level = bss->rssi;
2704 r->tsf = bss->timestamp;
2705 if (bss->ie) {
2706 r->ie_len = bss->ie_len;
2707 os_memcpy(r + 1, bss->ie, bss->ie_len);
2708 }
2709
2710 res->res[res->num++] = r;
2711 }
2712
2713 return res;
2714 }
2715
2716
2717 #if 0 /* FIX */
2718 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2719 struct sk_buff *skb, u8 *bssid,
2720 u8 *addr)
2721 {
2722 struct ieee80211_local *local = dev->priv;
2723 struct list_head *ptr;
2724 struct sta_info *sta;
2725 struct wpa_supplicant *sta_dev = NULL;
2726
2727 /* TODO: Could consider removing the least recently used entry and
2728 * allow new one to be added. */
2729 if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2730 if (net_ratelimit()) {
2731 wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2732 "STA entry " MACSTR, MAC2STR(addr));
2733 }
2734 return NULL;
2735 }
2736
2737 spin_lock_bh(&local->sub_if_lock);
2738 list_for_each(ptr, &local->sub_if_list) {
2739 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2740 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2741 os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2742 sta_dev = sdata->dev;
2743 break;
2744 }
2745 }
2746 spin_unlock_bh(&local->sub_if_lock);
2747
2748 if (sta_dev == NULL)
2749 return NULL;
2750
2751 wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2752 " (dev=%s)", MAC2STR(addr), sta_dev->name);
2753
2754 sta = sta_info_add(wpa_s, addr);
2755 if (sta == NULL) {
2756 return NULL;
2757 }
2758
2759 sta->dev = sta_dev;
2760 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2761
2762 rate_control_rate_init(local, sta);
2763
2764 return sta; /* caller will call sta_info_release() */
2765 }
2766 #endif
2767
2768
ieee80211_sta_deauthenticate(struct wpa_supplicant * wpa_s,u16 reason)2769 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2770 {
2771 wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2772
2773 ieee80211_send_deauth(wpa_s, reason);
2774 ieee80211_set_associated(wpa_s, 0);
2775 return 0;
2776 }
2777
2778
ieee80211_sta_disassociate(struct wpa_supplicant * wpa_s,u16 reason)2779 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2780 {
2781 wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2782
2783 if (!wpa_s->mlme.associated)
2784 return -1;
2785
2786 ieee80211_send_disassoc(wpa_s, reason);
2787 ieee80211_set_associated(wpa_s, 0);
2788 return 0;
2789 }
2790
2791
ieee80211_sta_rx(struct wpa_supplicant * wpa_s,const u8 * buf,size_t len,struct ieee80211_rx_status * rx_status)2792 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2793 struct ieee80211_rx_status *rx_status)
2794 {
2795 struct ieee80211_mgmt *mgmt;
2796 u16 fc;
2797 const u8 *pos;
2798
2799 /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2800
2801 if (wpa_s->mlme.sta_scanning) {
2802 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2803 return;
2804 }
2805
2806 if (len < 24)
2807 return;
2808
2809 mgmt = (struct ieee80211_mgmt *) buf;
2810 fc = le_to_host16(mgmt->frame_control);
2811
2812 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2813 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2814 else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2815 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2816 WLAN_FC_FROMDS)
2817 return;
2818 /* mgmt->sa is actually BSSID for FromDS data frames */
2819 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2820 return;
2821 /* Skip IEEE 802.11 and LLC headers */
2822 pos = buf + 24 + 6;
2823 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2824 return;
2825 pos += 2;
2826 /* mgmt->bssid is actually BSSID for SA data frames */
2827 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2828 pos, buf + len - pos);
2829 }
2830 }
2831
2832
ieee80211_sta_free_hw_features(struct wpa_hw_modes * hw_features,size_t num_hw_features)2833 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2834 size_t num_hw_features)
2835 {
2836 size_t i;
2837
2838 if (hw_features == NULL)
2839 return;
2840
2841 for (i = 0; i < num_hw_features; i++) {
2842 os_free(hw_features[i].channels);
2843 os_free(hw_features[i].rates);
2844 }
2845
2846 os_free(hw_features);
2847 }
2848
2849
ieee80211_sta_init(struct wpa_supplicant * wpa_s)2850 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2851 {
2852 u16 num_modes, flags;
2853
2854 wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2855 &flags);
2856 if (wpa_s->mlme.modes == NULL) {
2857 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2858 "channels and rates from the driver");
2859 return -1;
2860 }
2861
2862 wpa_s->mlme.num_modes = num_modes;
2863
2864 wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
2865 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
2866 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
2867
2868 return 0;
2869 }
2870
2871
ieee80211_sta_deinit(struct wpa_supplicant * wpa_s)2872 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
2873 {
2874 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
2875 eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
2876 os_free(wpa_s->mlme.extra_ie);
2877 wpa_s->mlme.extra_ie = NULL;
2878 os_free(wpa_s->mlme.extra_probe_ie);
2879 wpa_s->mlme.extra_probe_ie = NULL;
2880 os_free(wpa_s->mlme.assocreq_ies);
2881 wpa_s->mlme.assocreq_ies = NULL;
2882 os_free(wpa_s->mlme.assocresp_ies);
2883 wpa_s->mlme.assocresp_ies = NULL;
2884 ieee80211_bss_list_deinit(wpa_s);
2885 ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
2886 wpa_s->mlme.num_modes);
2887 #ifdef CONFIG_IEEE80211R
2888 os_free(wpa_s->mlme.ft_ies);
2889 wpa_s->mlme.ft_ies = NULL;
2890 wpa_s->mlme.ft_ies_len = 0;
2891 #endif /* CONFIG_IEEE80211R */
2892 }
2893
2894
2895 #ifdef CONFIG_IEEE80211R
2896
ieee80211_sta_update_ft_ies(struct wpa_supplicant * wpa_s,const u8 * md,const u8 * ies,size_t ies_len)2897 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2898 const u8 *ies, size_t ies_len)
2899 {
2900 if (md == NULL) {
2901 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
2902 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
2903 } else {
2904 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
2905 MAC2STR(md));
2906 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
2907 }
2908
2909 wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
2910 os_free(wpa_s->mlme.ft_ies);
2911 wpa_s->mlme.ft_ies = os_malloc(ies_len);
2912 if (wpa_s->mlme.ft_ies == NULL)
2913 return -1;
2914 os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
2915 wpa_s->mlme.ft_ies_len = ies_len;
2916
2917 return 0;
2918 }
2919
2920
ieee80211_sta_send_ft_action(struct wpa_supplicant * wpa_s,u8 action,const u8 * target_ap,const u8 * ies,size_t ies_len)2921 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
2922 const u8 *target_ap,
2923 const u8 *ies, size_t ies_len)
2924 {
2925 u8 *buf;
2926 size_t len;
2927 struct ieee80211_mgmt *mgmt;
2928 int res;
2929
2930 /*
2931 * Action frame payload:
2932 * Category[1] = 6 (Fast BSS Transition)
2933 * Action[1] = 1 (Fast BSS Transition Request)
2934 * STA Address
2935 * Target AP Address
2936 * FT IEs
2937 */
2938
2939 buf = os_zalloc(sizeof(*mgmt) + ies_len);
2940 if (buf == NULL) {
2941 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
2942 "FT action frame");
2943 return -1;
2944 }
2945
2946 mgmt = (struct ieee80211_mgmt *) buf;
2947 len = 24;
2948 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
2949 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2950 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2951 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2952 WLAN_FC_STYPE_ACTION);
2953 mgmt->u.action.category = WLAN_ACTION_FT;
2954 mgmt->u.action.u.ft_action_req.action = action;
2955 os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
2956 ETH_ALEN);
2957 os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
2958 ETH_ALEN);
2959 os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
2960 len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
2961
2962 wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
2963 "Target AP=" MACSTR " body_len=%lu",
2964 action, MAC2STR(target_ap), (unsigned long) ies_len);
2965
2966 res = ieee80211_sta_tx(wpa_s, buf, len);
2967 os_free(buf);
2968
2969 return res;
2970 }
2971
2972 #endif /* CONFIG_IEEE80211R */
2973
2974
ieee80211_sta_set_probe_req_ie(struct wpa_supplicant * wpa_s,const u8 * ies,size_t ies_len)2975 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
2976 size_t ies_len)
2977 {
2978 os_free(wpa_s->mlme.extra_probe_ie);
2979 wpa_s->mlme.extra_probe_ie = NULL;
2980 wpa_s->mlme.extra_probe_ie_len = 0;
2981
2982 if (ies == NULL)
2983 return 0;
2984
2985 wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
2986 if (wpa_s->mlme.extra_probe_ie == NULL)
2987 return -1;
2988
2989 os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
2990 wpa_s->mlme.extra_probe_ie_len = ies_len;
2991
2992 return 0;
2993 }
2994