1 /*
2 * Driver interaction with Linux nl80211/cfg80211
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2003-2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
6 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
7 * Copyright (c) 2009-2010, Atheros Communications
8 *
9 * This software may be distributed under the terms of the BSD license.
10 * See README for more details.
11 */
12
13 #include "includes.h"
14 #include <sys/ioctl.h>
15 #include <sys/types.h>
16 #include <sys/stat.h>
17 #include <fcntl.h>
18 #include <net/if.h>
19 #include <netlink/genl/genl.h>
20 #include <netlink/genl/family.h>
21 #include <netlink/genl/ctrl.h>
22 #include <linux/rtnetlink.h>
23 #include <netpacket/packet.h>
24 #include <linux/filter.h>
25 #include <linux/errqueue.h>
26 #include "nl80211_copy.h"
27
28 #include "common.h"
29 #include "eloop.h"
30 #include "utils/list.h"
31 #include "common/ieee802_11_defs.h"
32 #include "common/ieee802_11_common.h"
33 #include "l2_packet/l2_packet.h"
34 #include "netlink.h"
35 #include "linux_ioctl.h"
36 #include "radiotap.h"
37 #include "radiotap_iter.h"
38 #include "rfkill.h"
39 #include "driver.h"
40
41 #ifndef SO_WIFI_STATUS
42 # if defined(__sparc__)
43 # define SO_WIFI_STATUS 0x0025
44 # elif defined(__parisc__)
45 # define SO_WIFI_STATUS 0x4022
46 # else
47 # define SO_WIFI_STATUS 41
48 # endif
49
50 # define SCM_WIFI_STATUS SO_WIFI_STATUS
51 #endif
52
53 #ifndef SO_EE_ORIGIN_TXSTATUS
54 #define SO_EE_ORIGIN_TXSTATUS 4
55 #endif
56
57 #ifndef PACKET_TX_TIMESTAMP
58 #define PACKET_TX_TIMESTAMP 16
59 #endif
60
61 #ifdef ANDROID
62 #include "android_drv.h"
63 #endif /* ANDROID */
64 #ifdef CONFIG_LIBNL20
65 /* libnl 2.0 compatibility code */
66 #define nl_handle nl_sock
67 #define nl80211_handle_alloc nl_socket_alloc_cb
68 #define nl80211_handle_destroy nl_socket_free
69 #else
70 /*
71 * libnl 1.1 has a bug, it tries to allocate socket numbers densely
72 * but when you free a socket again it will mess up its bitmap and
73 * and use the wrong number the next time it needs a socket ID.
74 * Therefore, we wrap the handle alloc/destroy and add our own pid
75 * accounting.
76 */
77 static uint32_t port_bitmap[32] = { 0 };
78
nl80211_handle_alloc(void * cb)79 static struct nl_handle *nl80211_handle_alloc(void *cb)
80 {
81 struct nl_handle *handle;
82 uint32_t pid = getpid() & 0x3FFFFF;
83 int i;
84
85 handle = nl_handle_alloc_cb(cb);
86
87 for (i = 0; i < 1024; i++) {
88 if (port_bitmap[i / 32] & (1 << (i % 32)))
89 continue;
90 port_bitmap[i / 32] |= 1 << (i % 32);
91 pid += i << 22;
92 break;
93 }
94
95 nl_socket_set_local_port(handle, pid);
96
97 return handle;
98 }
99
nl80211_handle_destroy(struct nl_handle * handle)100 static void nl80211_handle_destroy(struct nl_handle *handle)
101 {
102 uint32_t port = nl_socket_get_local_port(handle);
103
104 port >>= 22;
105 port_bitmap[port / 32] &= ~(1 << (port % 32));
106
107 nl_handle_destroy(handle);
108 }
109 #endif /* CONFIG_LIBNL20 */
110
111
nl_create_handle(struct nl_cb * cb,const char * dbg)112 static struct nl_handle * nl_create_handle(struct nl_cb *cb, const char *dbg)
113 {
114 struct nl_handle *handle;
115
116 handle = nl80211_handle_alloc(cb);
117 if (handle == NULL) {
118 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
119 "callbacks (%s)", dbg);
120 return NULL;
121 }
122
123 if (genl_connect(handle)) {
124 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
125 "netlink (%s)", dbg);
126 nl80211_handle_destroy(handle);
127 return NULL;
128 }
129
130 return handle;
131 }
132
133
nl_destroy_handles(struct nl_handle ** handle)134 static void nl_destroy_handles(struct nl_handle **handle)
135 {
136 if (*handle == NULL)
137 return;
138 nl80211_handle_destroy(*handle);
139 *handle = NULL;
140 }
141
142
143 #ifndef IFF_LOWER_UP
144 #define IFF_LOWER_UP 0x10000 /* driver signals L1 up */
145 #endif
146 #ifndef IFF_DORMANT
147 #define IFF_DORMANT 0x20000 /* driver signals dormant */
148 #endif
149
150 #ifndef IF_OPER_DORMANT
151 #define IF_OPER_DORMANT 5
152 #endif
153 #ifndef IF_OPER_UP
154 #define IF_OPER_UP 6
155 #endif
156
157 struct nl80211_global {
158 struct dl_list interfaces;
159 int if_add_ifindex;
160 struct netlink_data *netlink;
161 struct nl_cb *nl_cb;
162 struct nl_handle *nl;
163 int nl80211_id;
164 int ioctl_sock; /* socket for ioctl() use */
165
166 struct nl_handle *nl_event;
167 };
168
169 struct nl80211_wiphy_data {
170 struct dl_list list;
171 struct dl_list bsss;
172 struct dl_list drvs;
173
174 struct nl_handle *nl_beacons;
175 struct nl_cb *nl_cb;
176
177 int wiphy_idx;
178 };
179
180 static void nl80211_global_deinit(void *priv);
181
182 struct i802_bss {
183 struct wpa_driver_nl80211_data *drv;
184 struct i802_bss *next;
185 int ifindex;
186 char ifname[IFNAMSIZ + 1];
187 char brname[IFNAMSIZ];
188 unsigned int beacon_set:1;
189 unsigned int added_if_into_bridge:1;
190 unsigned int added_bridge:1;
191 unsigned int in_deinit:1;
192
193 u8 addr[ETH_ALEN];
194
195 int freq;
196
197 void *ctx;
198 struct nl_handle *nl_preq, *nl_mgmt;
199 struct nl_cb *nl_cb;
200
201 struct nl80211_wiphy_data *wiphy_data;
202 struct dl_list wiphy_list;
203 };
204
205 struct wpa_driver_nl80211_data {
206 struct nl80211_global *global;
207 struct dl_list list;
208 struct dl_list wiphy_list;
209 char phyname[32];
210 void *ctx;
211 int ifindex;
212 int if_removed;
213 int if_disabled;
214 int ignore_if_down_event;
215 struct rfkill_data *rfkill;
216 struct wpa_driver_capa capa;
217 u8 *extended_capa, *extended_capa_mask;
218 unsigned int extended_capa_len;
219 int has_capability;
220
221 int operstate;
222
223 int scan_complete_events;
224
225 struct nl_cb *nl_cb;
226
227 u8 auth_bssid[ETH_ALEN];
228 u8 bssid[ETH_ALEN];
229 int associated;
230 u8 ssid[32];
231 size_t ssid_len;
232 enum nl80211_iftype nlmode;
233 enum nl80211_iftype ap_scan_as_station;
234 unsigned int assoc_freq;
235
236 int monitor_sock;
237 int monitor_ifidx;
238 int monitor_refcount;
239
240 unsigned int disabled_11b_rates:1;
241 unsigned int pending_remain_on_chan:1;
242 unsigned int in_interface_list:1;
243 unsigned int device_ap_sme:1;
244 unsigned int poll_command_supported:1;
245 unsigned int data_tx_status:1;
246 unsigned int scan_for_auth:1;
247 unsigned int retry_auth:1;
248 unsigned int use_monitor:1;
249 unsigned int ignore_next_local_disconnect:1;
250
251 u64 remain_on_chan_cookie;
252 u64 send_action_cookie;
253
254 unsigned int last_mgmt_freq;
255
256 struct wpa_driver_scan_filter *filter_ssids;
257 size_t num_filter_ssids;
258
259 struct i802_bss first_bss;
260
261 int eapol_tx_sock;
262
263 #ifdef HOSTAPD
264 int eapol_sock; /* socket for EAPOL frames */
265
266 int default_if_indices[16];
267 int *if_indices;
268 int num_if_indices;
269
270 int last_freq;
271 int last_freq_ht;
272 #endif /* HOSTAPD */
273
274 /* From failed authentication command */
275 int auth_freq;
276 u8 auth_bssid_[ETH_ALEN];
277 u8 auth_ssid[32];
278 size_t auth_ssid_len;
279 int auth_alg;
280 u8 *auth_ie;
281 size_t auth_ie_len;
282 u8 auth_wep_key[4][16];
283 size_t auth_wep_key_len[4];
284 int auth_wep_tx_keyidx;
285 int auth_local_state_change;
286 int auth_p2p;
287 };
288
289
290 static void wpa_driver_nl80211_deinit(struct i802_bss *bss);
291 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
292 void *timeout_ctx);
293 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
294 enum nl80211_iftype nlmode);
295 static int
296 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
297 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
298 const u8 *addr, int cmd, u16 reason_code,
299 int local_state_change);
300 static void nl80211_remove_monitor_interface(
301 struct wpa_driver_nl80211_data *drv);
302 static int nl80211_send_frame_cmd(struct i802_bss *bss,
303 unsigned int freq, unsigned int wait,
304 const u8 *buf, size_t buf_len, u64 *cookie,
305 int no_cck, int no_ack, int offchanok);
306 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
307 int report);
308 #ifdef ANDROID
309 static int android_pno_start(struct i802_bss *bss,
310 struct wpa_driver_scan_params *params);
311 static int android_pno_stop(struct i802_bss *bss);
312 #endif /* ANDROID */
313 #ifdef ANDROID_P2P
314 int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration);
315 int wpa_driver_get_p2p_noa(void *priv, u8 *buf, size_t len);
316 int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow);
317 int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon,
318 const struct wpabuf *proberesp,
319 const struct wpabuf *assocresp);
320
321 #endif
322 #ifdef HOSTAPD
323 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
324 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
325 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
326 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
327 enum wpa_driver_if_type type,
328 const char *ifname);
329 #else /* HOSTAPD */
add_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)330 static inline void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
331 {
332 }
333
del_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)334 static inline void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
335 {
336 }
337
have_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)338 static inline int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
339 {
340 return 0;
341 }
342 #endif /* HOSTAPD */
343 #ifdef ANDROID
344 extern int wpa_driver_nl80211_driver_cmd(void *priv, char *cmd, char *buf,
345 size_t buf_len);
346 #endif
347
348 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
349 struct hostapd_freq_params *freq);
350 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
351 int ifindex, int disabled);
352
353 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv);
354 static int wpa_driver_nl80211_authenticate_retry(
355 struct wpa_driver_nl80211_data *drv);
356
357
is_ap_interface(enum nl80211_iftype nlmode)358 static int is_ap_interface(enum nl80211_iftype nlmode)
359 {
360 return (nlmode == NL80211_IFTYPE_AP ||
361 nlmode == NL80211_IFTYPE_P2P_GO);
362 }
363
364
is_sta_interface(enum nl80211_iftype nlmode)365 static int is_sta_interface(enum nl80211_iftype nlmode)
366 {
367 return (nlmode == NL80211_IFTYPE_STATION ||
368 nlmode == NL80211_IFTYPE_P2P_CLIENT);
369 }
370
371
is_p2p_interface(enum nl80211_iftype nlmode)372 static int is_p2p_interface(enum nl80211_iftype nlmode)
373 {
374 return (nlmode == NL80211_IFTYPE_P2P_CLIENT ||
375 nlmode == NL80211_IFTYPE_P2P_GO);
376 }
377
378
379 struct nl80211_bss_info_arg {
380 struct wpa_driver_nl80211_data *drv;
381 struct wpa_scan_results *res;
382 unsigned int assoc_freq;
383 u8 assoc_bssid[ETH_ALEN];
384 };
385
386 static int bss_info_handler(struct nl_msg *msg, void *arg);
387
388
389 /* nl80211 code */
ack_handler(struct nl_msg * msg,void * arg)390 static int ack_handler(struct nl_msg *msg, void *arg)
391 {
392 int *err = arg;
393 *err = 0;
394 return NL_STOP;
395 }
396
finish_handler(struct nl_msg * msg,void * arg)397 static int finish_handler(struct nl_msg *msg, void *arg)
398 {
399 int *ret = arg;
400 *ret = 0;
401 return NL_SKIP;
402 }
403
error_handler(struct sockaddr_nl * nla,struct nlmsgerr * err,void * arg)404 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
405 void *arg)
406 {
407 int *ret = arg;
408 *ret = err->error;
409 return NL_SKIP;
410 }
411
412
no_seq_check(struct nl_msg * msg,void * arg)413 static int no_seq_check(struct nl_msg *msg, void *arg)
414 {
415 return NL_OK;
416 }
417
418
send_and_recv(struct nl80211_global * global,struct nl_handle * nl_handle,struct nl_msg * msg,int (* valid_handler)(struct nl_msg *,void *),void * valid_data)419 static int send_and_recv(struct nl80211_global *global,
420 struct nl_handle *nl_handle, struct nl_msg *msg,
421 int (*valid_handler)(struct nl_msg *, void *),
422 void *valid_data)
423 {
424 struct nl_cb *cb;
425 int err = -ENOMEM;
426
427 cb = nl_cb_clone(global->nl_cb);
428 if (!cb)
429 goto out;
430
431 err = nl_send_auto_complete(nl_handle, msg);
432 if (err < 0)
433 goto out;
434
435 err = 1;
436
437 nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
438 nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
439 nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
440
441 if (valid_handler)
442 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
443 valid_handler, valid_data);
444
445 while (err > 0)
446 nl_recvmsgs(nl_handle, cb);
447 out:
448 nl_cb_put(cb);
449 nlmsg_free(msg);
450 return err;
451 }
452
453
send_and_recv_msgs_global(struct nl80211_global * global,struct nl_msg * msg,int (* valid_handler)(struct nl_msg *,void *),void * valid_data)454 static int send_and_recv_msgs_global(struct nl80211_global *global,
455 struct nl_msg *msg,
456 int (*valid_handler)(struct nl_msg *, void *),
457 void *valid_data)
458 {
459 return send_and_recv(global, global->nl, msg, valid_handler,
460 valid_data);
461 }
462
463
464 #ifndef ANDROID
465 static
466 #endif
send_and_recv_msgs(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,int (* valid_handler)(struct nl_msg *,void *),void * valid_data)467 int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
468 struct nl_msg *msg,
469 int (*valid_handler)(struct nl_msg *, void *),
470 void *valid_data)
471 {
472 return send_and_recv(drv->global, drv->global->nl, msg,
473 valid_handler, valid_data);
474 }
475
476
477 struct family_data {
478 const char *group;
479 int id;
480 };
481
482
family_handler(struct nl_msg * msg,void * arg)483 static int family_handler(struct nl_msg *msg, void *arg)
484 {
485 struct family_data *res = arg;
486 struct nlattr *tb[CTRL_ATTR_MAX + 1];
487 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
488 struct nlattr *mcgrp;
489 int i;
490
491 nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
492 genlmsg_attrlen(gnlh, 0), NULL);
493 if (!tb[CTRL_ATTR_MCAST_GROUPS])
494 return NL_SKIP;
495
496 nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
497 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
498 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
499 nla_len(mcgrp), NULL);
500 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
501 !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
502 os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
503 res->group,
504 nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
505 continue;
506 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
507 break;
508 };
509
510 return NL_SKIP;
511 }
512
513
nl_get_multicast_id(struct nl80211_global * global,const char * family,const char * group)514 static int nl_get_multicast_id(struct nl80211_global *global,
515 const char *family, const char *group)
516 {
517 struct nl_msg *msg;
518 int ret = -1;
519 struct family_data res = { group, -ENOENT };
520
521 msg = nlmsg_alloc();
522 if (!msg)
523 return -ENOMEM;
524 genlmsg_put(msg, 0, 0, genl_ctrl_resolve(global->nl, "nlctrl"),
525 0, 0, CTRL_CMD_GETFAMILY, 0);
526 NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
527
528 ret = send_and_recv_msgs_global(global, msg, family_handler, &res);
529 msg = NULL;
530 if (ret == 0)
531 ret = res.id;
532
533 nla_put_failure:
534 nlmsg_free(msg);
535 return ret;
536 }
537
538
nl80211_cmd(struct wpa_driver_nl80211_data * drv,struct nl_msg * msg,int flags,uint8_t cmd)539 static void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
540 struct nl_msg *msg, int flags, uint8_t cmd)
541 {
542 return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
543 0, flags, cmd, 0);
544 }
545
546
547 struct wiphy_idx_data {
548 int wiphy_idx;
549 };
550
551
netdev_info_handler(struct nl_msg * msg,void * arg)552 static int netdev_info_handler(struct nl_msg *msg, void *arg)
553 {
554 struct nlattr *tb[NL80211_ATTR_MAX + 1];
555 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
556 struct wiphy_idx_data *info = arg;
557
558 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
559 genlmsg_attrlen(gnlh, 0), NULL);
560
561 if (tb[NL80211_ATTR_WIPHY])
562 info->wiphy_idx = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
563
564 return NL_SKIP;
565 }
566
567
nl80211_get_wiphy_index(struct i802_bss * bss)568 static int nl80211_get_wiphy_index(struct i802_bss *bss)
569 {
570 struct nl_msg *msg;
571 struct wiphy_idx_data data = {
572 .wiphy_idx = -1,
573 };
574
575 msg = nlmsg_alloc();
576 if (!msg)
577 return -1;
578
579 nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_GET_INTERFACE);
580
581 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
582
583 if (send_and_recv_msgs(bss->drv, msg, netdev_info_handler, &data) == 0)
584 return data.wiphy_idx;
585 msg = NULL;
586 nla_put_failure:
587 nlmsg_free(msg);
588 return -1;
589 }
590
591
nl80211_register_beacons(struct wpa_driver_nl80211_data * drv,struct nl80211_wiphy_data * w)592 static int nl80211_register_beacons(struct wpa_driver_nl80211_data *drv,
593 struct nl80211_wiphy_data *w)
594 {
595 struct nl_msg *msg;
596 int ret = -1;
597
598 msg = nlmsg_alloc();
599 if (!msg)
600 return -1;
601
602 nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_BEACONS);
603
604 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY, w->wiphy_idx);
605
606 ret = send_and_recv(drv->global, w->nl_beacons, msg, NULL, NULL);
607 msg = NULL;
608 if (ret) {
609 wpa_printf(MSG_DEBUG, "nl80211: Register beacons command "
610 "failed: ret=%d (%s)",
611 ret, strerror(-ret));
612 goto nla_put_failure;
613 }
614 ret = 0;
615 nla_put_failure:
616 nlmsg_free(msg);
617 return ret;
618 }
619
620
nl80211_recv_beacons(int sock,void * eloop_ctx,void * handle)621 static void nl80211_recv_beacons(int sock, void *eloop_ctx, void *handle)
622 {
623 struct nl80211_wiphy_data *w = eloop_ctx;
624
625 wpa_printf(MSG_EXCESSIVE, "nl80211: Beacon event message available");
626
627 nl_recvmsgs(handle, w->nl_cb);
628 }
629
630
process_beacon_event(struct nl_msg * msg,void * arg)631 static int process_beacon_event(struct nl_msg *msg, void *arg)
632 {
633 struct nl80211_wiphy_data *w = arg;
634 struct wpa_driver_nl80211_data *drv;
635 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
636 struct nlattr *tb[NL80211_ATTR_MAX + 1];
637 union wpa_event_data event;
638
639 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
640 genlmsg_attrlen(gnlh, 0), NULL);
641
642 if (gnlh->cmd != NL80211_CMD_FRAME) {
643 wpa_printf(MSG_DEBUG, "nl80211: Unexpected beacon event? (%d)",
644 gnlh->cmd);
645 return NL_SKIP;
646 }
647
648 if (!tb[NL80211_ATTR_FRAME])
649 return NL_SKIP;
650
651 dl_list_for_each(drv, &w->drvs, struct wpa_driver_nl80211_data,
652 wiphy_list) {
653 os_memset(&event, 0, sizeof(event));
654 event.rx_mgmt.frame = nla_data(tb[NL80211_ATTR_FRAME]);
655 event.rx_mgmt.frame_len = nla_len(tb[NL80211_ATTR_FRAME]);
656 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
657 }
658
659 return NL_SKIP;
660 }
661
662
663 static struct nl80211_wiphy_data *
nl80211_get_wiphy_data_ap(struct i802_bss * bss)664 nl80211_get_wiphy_data_ap(struct i802_bss *bss)
665 {
666 static DEFINE_DL_LIST(nl80211_wiphys);
667 struct nl80211_wiphy_data *w;
668 int wiphy_idx, found = 0;
669 struct i802_bss *tmp_bss;
670
671 if (bss->wiphy_data != NULL)
672 return bss->wiphy_data;
673
674 wiphy_idx = nl80211_get_wiphy_index(bss);
675
676 dl_list_for_each(w, &nl80211_wiphys, struct nl80211_wiphy_data, list) {
677 if (w->wiphy_idx == wiphy_idx)
678 goto add;
679 }
680
681 /* alloc new one */
682 w = os_zalloc(sizeof(*w));
683 if (w == NULL)
684 return NULL;
685 w->wiphy_idx = wiphy_idx;
686 dl_list_init(&w->bsss);
687 dl_list_init(&w->drvs);
688
689 w->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
690 if (!w->nl_cb) {
691 os_free(w);
692 return NULL;
693 }
694 nl_cb_set(w->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
695 nl_cb_set(w->nl_cb, NL_CB_VALID, NL_CB_CUSTOM, process_beacon_event,
696 w);
697
698 w->nl_beacons = nl_create_handle(bss->drv->global->nl_cb,
699 "wiphy beacons");
700 if (w->nl_beacons == NULL) {
701 os_free(w);
702 return NULL;
703 }
704
705 if (nl80211_register_beacons(bss->drv, w)) {
706 nl_destroy_handles(&w->nl_beacons);
707 os_free(w);
708 return NULL;
709 }
710
711 eloop_register_read_sock(nl_socket_get_fd(w->nl_beacons),
712 nl80211_recv_beacons, w, w->nl_beacons);
713
714 dl_list_add(&nl80211_wiphys, &w->list);
715
716 add:
717 /* drv entry for this bss already there? */
718 dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
719 if (tmp_bss->drv == bss->drv) {
720 found = 1;
721 break;
722 }
723 }
724 /* if not add it */
725 if (!found)
726 dl_list_add(&w->drvs, &bss->drv->wiphy_list);
727
728 dl_list_add(&w->bsss, &bss->wiphy_list);
729 bss->wiphy_data = w;
730 return w;
731 }
732
733
nl80211_put_wiphy_data_ap(struct i802_bss * bss)734 static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
735 {
736 struct nl80211_wiphy_data *w = bss->wiphy_data;
737 struct i802_bss *tmp_bss;
738 int found = 0;
739
740 if (w == NULL)
741 return;
742 bss->wiphy_data = NULL;
743 dl_list_del(&bss->wiphy_list);
744
745 /* still any for this drv present? */
746 dl_list_for_each(tmp_bss, &w->bsss, struct i802_bss, wiphy_list) {
747 if (tmp_bss->drv == bss->drv) {
748 found = 1;
749 break;
750 }
751 }
752 /* if not remove it */
753 if (!found)
754 dl_list_del(&bss->drv->wiphy_list);
755
756 if (!dl_list_empty(&w->bsss))
757 return;
758
759 eloop_unregister_read_sock(nl_socket_get_fd(w->nl_beacons));
760
761 nl_cb_put(w->nl_cb);
762 nl_destroy_handles(&w->nl_beacons);
763 dl_list_del(&w->list);
764 os_free(w);
765 }
766
767
wpa_driver_nl80211_get_bssid(void * priv,u8 * bssid)768 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
769 {
770 struct i802_bss *bss = priv;
771 struct wpa_driver_nl80211_data *drv = bss->drv;
772 if (!drv->associated)
773 return -1;
774 os_memcpy(bssid, drv->bssid, ETH_ALEN);
775 return 0;
776 }
777
778
wpa_driver_nl80211_get_ssid(void * priv,u8 * ssid)779 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
780 {
781 struct i802_bss *bss = priv;
782 struct wpa_driver_nl80211_data *drv = bss->drv;
783 if (!drv->associated)
784 return -1;
785 os_memcpy(ssid, drv->ssid, drv->ssid_len);
786 return drv->ssid_len;
787 }
788
789
wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data * drv,char * buf,size_t len,int del)790 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
791 char *buf, size_t len, int del)
792 {
793 union wpa_event_data event;
794
795 os_memset(&event, 0, sizeof(event));
796 if (len > sizeof(event.interface_status.ifname))
797 len = sizeof(event.interface_status.ifname) - 1;
798 os_memcpy(event.interface_status.ifname, buf, len);
799 event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
800 EVENT_INTERFACE_ADDED;
801
802 wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
803 del ? "DEL" : "NEW",
804 event.interface_status.ifname,
805 del ? "removed" : "added");
806
807 if (os_strcmp(drv->first_bss.ifname, event.interface_status.ifname) == 0) {
808 if (del) {
809 if (drv->if_removed) {
810 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
811 "already set - ignore event");
812 return;
813 }
814 drv->if_removed = 1;
815 } else {
816 if (if_nametoindex(drv->first_bss.ifname) == 0) {
817 wpa_printf(MSG_DEBUG, "nl80211: Interface %s "
818 "does not exist - ignore "
819 "RTM_NEWLINK",
820 drv->first_bss.ifname);
821 return;
822 }
823 if (!drv->if_removed) {
824 wpa_printf(MSG_DEBUG, "nl80211: if_removed "
825 "already cleared - ignore event");
826 return;
827 }
828 drv->if_removed = 0;
829 }
830 }
831
832 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event);
833 }
834
835
wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data * drv,u8 * buf,size_t len)836 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
837 u8 *buf, size_t len)
838 {
839 int attrlen, rta_len;
840 struct rtattr *attr;
841
842 attrlen = len;
843 attr = (struct rtattr *) buf;
844
845 rta_len = RTA_ALIGN(sizeof(struct rtattr));
846 while (RTA_OK(attr, attrlen)) {
847 if (attr->rta_type == IFLA_IFNAME) {
848 if (os_strcmp(((char *) attr) + rta_len, drv->first_bss.ifname)
849 == 0)
850 return 1;
851 else
852 break;
853 }
854 attr = RTA_NEXT(attr, attrlen);
855 }
856
857 return 0;
858 }
859
860
wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data * drv,int ifindex,u8 * buf,size_t len)861 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
862 int ifindex, u8 *buf, size_t len)
863 {
864 if (drv->ifindex == ifindex)
865 return 1;
866
867 if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) {
868 drv->first_bss.ifindex = if_nametoindex(drv->first_bss.ifname);
869 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
870 "interface");
871 wpa_driver_nl80211_finish_drv_init(drv);
872 return 1;
873 }
874
875 return 0;
876 }
877
878
879 static struct wpa_driver_nl80211_data *
nl80211_find_drv(struct nl80211_global * global,int idx,u8 * buf,size_t len)880 nl80211_find_drv(struct nl80211_global *global, int idx, u8 *buf, size_t len)
881 {
882 struct wpa_driver_nl80211_data *drv;
883 dl_list_for_each(drv, &global->interfaces,
884 struct wpa_driver_nl80211_data, list) {
885 if (wpa_driver_nl80211_own_ifindex(drv, idx, buf, len) ||
886 have_ifidx(drv, idx))
887 return drv;
888 }
889 return NULL;
890 }
891
892
wpa_driver_nl80211_event_rtm_newlink(void * ctx,struct ifinfomsg * ifi,u8 * buf,size_t len)893 static void wpa_driver_nl80211_event_rtm_newlink(void *ctx,
894 struct ifinfomsg *ifi,
895 u8 *buf, size_t len)
896 {
897 struct nl80211_global *global = ctx;
898 struct wpa_driver_nl80211_data *drv;
899 int attrlen, rta_len;
900 struct rtattr *attr;
901 u32 brid = 0;
902 char namebuf[IFNAMSIZ];
903
904 drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
905 if (!drv) {
906 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign "
907 "ifindex %d", ifi->ifi_index);
908 return;
909 }
910
911 wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
912 "(%s%s%s%s)",
913 drv->operstate, ifi->ifi_flags,
914 (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
915 (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
916 (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
917 (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
918
919 if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) {
920 if (if_indextoname(ifi->ifi_index, namebuf) &&
921 linux_iface_up(drv->global->ioctl_sock,
922 drv->first_bss.ifname) > 0) {
923 wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
924 "event since interface %s is up", namebuf);
925 return;
926 }
927 wpa_printf(MSG_DEBUG, "nl80211: Interface down");
928 if (drv->ignore_if_down_event) {
929 wpa_printf(MSG_DEBUG, "nl80211: Ignore interface down "
930 "event generated by mode change");
931 drv->ignore_if_down_event = 0;
932 } else {
933 drv->if_disabled = 1;
934 wpa_supplicant_event(drv->ctx,
935 EVENT_INTERFACE_DISABLED, NULL);
936 }
937 }
938
939 if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) {
940 if (if_indextoname(ifi->ifi_index, namebuf) &&
941 linux_iface_up(drv->global->ioctl_sock,
942 drv->first_bss.ifname) == 0) {
943 wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
944 "event since interface %s is down",
945 namebuf);
946 } else if (if_nametoindex(drv->first_bss.ifname) == 0) {
947 wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
948 "event since interface %s does not exist",
949 drv->first_bss.ifname);
950 } else if (drv->if_removed) {
951 wpa_printf(MSG_DEBUG, "nl80211: Ignore interface up "
952 "event since interface %s is marked "
953 "removed", drv->first_bss.ifname);
954 } else {
955 wpa_printf(MSG_DEBUG, "nl80211: Interface up");
956 drv->if_disabled = 0;
957 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
958 NULL);
959 }
960 }
961
962 /*
963 * Some drivers send the association event before the operup event--in
964 * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
965 * fails. This will hit us when wpa_supplicant does not need to do
966 * IEEE 802.1X authentication
967 */
968 if (drv->operstate == 1 &&
969 (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
970 !(ifi->ifi_flags & IFF_RUNNING))
971 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
972 -1, IF_OPER_UP);
973
974 attrlen = len;
975 attr = (struct rtattr *) buf;
976 rta_len = RTA_ALIGN(sizeof(struct rtattr));
977 while (RTA_OK(attr, attrlen)) {
978 if (attr->rta_type == IFLA_IFNAME) {
979 wpa_driver_nl80211_event_link(
980 drv,
981 ((char *) attr) + rta_len,
982 attr->rta_len - rta_len, 0);
983 } else if (attr->rta_type == IFLA_MASTER)
984 brid = nla_get_u32((struct nlattr *) attr);
985 attr = RTA_NEXT(attr, attrlen);
986 }
987
988 if (ifi->ifi_family == AF_BRIDGE && brid) {
989 /* device has been added to bridge */
990 if_indextoname(brid, namebuf);
991 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s",
992 brid, namebuf);
993 add_ifidx(drv, brid);
994 }
995 }
996
997
wpa_driver_nl80211_event_rtm_dellink(void * ctx,struct ifinfomsg * ifi,u8 * buf,size_t len)998 static void wpa_driver_nl80211_event_rtm_dellink(void *ctx,
999 struct ifinfomsg *ifi,
1000 u8 *buf, size_t len)
1001 {
1002 struct nl80211_global *global = ctx;
1003 struct wpa_driver_nl80211_data *drv;
1004 int attrlen, rta_len;
1005 struct rtattr *attr;
1006 u32 brid = 0;
1007
1008 drv = nl80211_find_drv(global, ifi->ifi_index, buf, len);
1009 if (!drv) {
1010 wpa_printf(MSG_DEBUG, "nl80211: Ignore dellink event for "
1011 "foreign ifindex %d", ifi->ifi_index);
1012 return;
1013 }
1014
1015 attrlen = len;
1016 attr = (struct rtattr *) buf;
1017
1018 rta_len = RTA_ALIGN(sizeof(struct rtattr));
1019 while (RTA_OK(attr, attrlen)) {
1020 if (attr->rta_type == IFLA_IFNAME) {
1021 wpa_driver_nl80211_event_link(
1022 drv,
1023 ((char *) attr) + rta_len,
1024 attr->rta_len - rta_len, 1);
1025 } else if (attr->rta_type == IFLA_MASTER)
1026 brid = nla_get_u32((struct nlattr *) attr);
1027 attr = RTA_NEXT(attr, attrlen);
1028 }
1029
1030 if (ifi->ifi_family == AF_BRIDGE && brid) {
1031 /* device has been removed from bridge */
1032 char namebuf[IFNAMSIZ];
1033 if_indextoname(brid, namebuf);
1034 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge "
1035 "%s", brid, namebuf);
1036 del_ifidx(drv, brid);
1037 }
1038 }
1039
1040
mlme_event_auth(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)1041 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1042 const u8 *frame, size_t len)
1043 {
1044 const struct ieee80211_mgmt *mgmt;
1045 union wpa_event_data event;
1046
1047 wpa_printf(MSG_DEBUG, "nl80211: Authenticate event");
1048 mgmt = (const struct ieee80211_mgmt *) frame;
1049 if (len < 24 + sizeof(mgmt->u.auth)) {
1050 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1051 "frame");
1052 return;
1053 }
1054
1055 os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN);
1056 os_memset(&event, 0, sizeof(event));
1057 os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1058 event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1059 event.auth.auth_transaction =
1060 le_to_host16(mgmt->u.auth.auth_transaction);
1061 event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1062 if (len > 24 + sizeof(mgmt->u.auth)) {
1063 event.auth.ies = mgmt->u.auth.variable;
1064 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1065 }
1066
1067 wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1068 }
1069
1070
nl80211_get_assoc_freq(struct wpa_driver_nl80211_data * drv)1071 static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv)
1072 {
1073 struct nl_msg *msg;
1074 int ret;
1075 struct nl80211_bss_info_arg arg;
1076
1077 os_memset(&arg, 0, sizeof(arg));
1078 msg = nlmsg_alloc();
1079 if (!msg)
1080 goto nla_put_failure;
1081
1082 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
1083 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1084
1085 arg.drv = drv;
1086 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
1087 msg = NULL;
1088 if (ret == 0) {
1089 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the "
1090 "associated BSS from scan results: %u MHz",
1091 arg.assoc_freq);
1092 return arg.assoc_freq ? arg.assoc_freq : drv->assoc_freq;
1093 }
1094 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1095 "(%s)", ret, strerror(-ret));
1096 nla_put_failure:
1097 nlmsg_free(msg);
1098 return drv->assoc_freq;
1099 }
1100
1101
mlme_event_assoc(struct wpa_driver_nl80211_data * drv,const u8 * frame,size_t len)1102 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1103 const u8 *frame, size_t len)
1104 {
1105 const struct ieee80211_mgmt *mgmt;
1106 union wpa_event_data event;
1107 u16 status;
1108
1109 wpa_printf(MSG_DEBUG, "nl80211: Associate event");
1110 mgmt = (const struct ieee80211_mgmt *) frame;
1111 if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1112 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1113 "frame");
1114 return;
1115 }
1116
1117 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1118 if (status != WLAN_STATUS_SUCCESS) {
1119 os_memset(&event, 0, sizeof(event));
1120 event.assoc_reject.bssid = mgmt->bssid;
1121 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1122 event.assoc_reject.resp_ies =
1123 (u8 *) mgmt->u.assoc_resp.variable;
1124 event.assoc_reject.resp_ies_len =
1125 len - 24 - sizeof(mgmt->u.assoc_resp);
1126 }
1127 event.assoc_reject.status_code = status;
1128
1129 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1130 return;
1131 }
1132
1133 drv->associated = 1;
1134 os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1135
1136 os_memset(&event, 0, sizeof(event));
1137 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1138 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1139 event.assoc_info.resp_ies_len =
1140 len - 24 - sizeof(mgmt->u.assoc_resp);
1141 }
1142
1143 event.assoc_info.freq = drv->assoc_freq;
1144
1145 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1146 }
1147
1148
mlme_event_connect(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,struct nlattr * status,struct nlattr * addr,struct nlattr * req_ie,struct nlattr * resp_ie)1149 static void mlme_event_connect(struct wpa_driver_nl80211_data *drv,
1150 enum nl80211_commands cmd, struct nlattr *status,
1151 struct nlattr *addr, struct nlattr *req_ie,
1152 struct nlattr *resp_ie)
1153 {
1154 union wpa_event_data event;
1155
1156 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1157 /*
1158 * Avoid reporting two association events that would confuse
1159 * the core code.
1160 */
1161 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) "
1162 "when using userspace SME", cmd);
1163 return;
1164 }
1165
1166 if (cmd == NL80211_CMD_CONNECT)
1167 wpa_printf(MSG_DEBUG, "nl80211: Connect event");
1168 else if (cmd == NL80211_CMD_ROAM)
1169 wpa_printf(MSG_DEBUG, "nl80211: Roam event");
1170
1171 os_memset(&event, 0, sizeof(event));
1172 if (cmd == NL80211_CMD_CONNECT &&
1173 nla_get_u16(status) != WLAN_STATUS_SUCCESS) {
1174 if (addr)
1175 event.assoc_reject.bssid = nla_data(addr);
1176 if (resp_ie) {
1177 event.assoc_reject.resp_ies = nla_data(resp_ie);
1178 event.assoc_reject.resp_ies_len = nla_len(resp_ie);
1179 }
1180 event.assoc_reject.status_code = nla_get_u16(status);
1181 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
1182 return;
1183 }
1184
1185 drv->associated = 1;
1186 if (addr)
1187 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN);
1188
1189 if (req_ie) {
1190 event.assoc_info.req_ies = nla_data(req_ie);
1191 event.assoc_info.req_ies_len = nla_len(req_ie);
1192 }
1193 if (resp_ie) {
1194 event.assoc_info.resp_ies = nla_data(resp_ie);
1195 event.assoc_info.resp_ies_len = nla_len(resp_ie);
1196 }
1197
1198 event.assoc_info.freq = nl80211_get_assoc_freq(drv);
1199
1200 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1201 }
1202
1203
mlme_event_disconnect(struct wpa_driver_nl80211_data * drv,struct nlattr * reason,struct nlattr * addr,struct nlattr * by_ap)1204 static void mlme_event_disconnect(struct wpa_driver_nl80211_data *drv,
1205 struct nlattr *reason, struct nlattr *addr,
1206 struct nlattr *by_ap)
1207 {
1208 union wpa_event_data data;
1209 unsigned int locally_generated = by_ap == NULL;
1210
1211 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
1212 /*
1213 * Avoid reporting two disassociation events that could
1214 * confuse the core code.
1215 */
1216 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1217 "event when using userspace SME");
1218 return;
1219 }
1220
1221 if (drv->ignore_next_local_disconnect) {
1222 drv->ignore_next_local_disconnect = 0;
1223 if (locally_generated) {
1224 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect "
1225 "event triggered during reassociation");
1226 return;
1227 }
1228 wpa_printf(MSG_WARNING, "nl80211: Was expecting local "
1229 "disconnect but got another disconnect "
1230 "event first");
1231 }
1232
1233 wpa_printf(MSG_DEBUG, "nl80211: Disconnect event");
1234 drv->associated = 0;
1235 os_memset(&data, 0, sizeof(data));
1236 if (reason)
1237 data.deauth_info.reason_code = nla_get_u16(reason);
1238 data.deauth_info.locally_generated = by_ap == NULL;
1239 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, &data);
1240 }
1241
1242
mlme_event_ch_switch(struct wpa_driver_nl80211_data * drv,struct nlattr * freq,struct nlattr * type)1243 static void mlme_event_ch_switch(struct wpa_driver_nl80211_data *drv,
1244 struct nlattr *freq, struct nlattr *type)
1245 {
1246 union wpa_event_data data;
1247 int ht_enabled = 1;
1248 int chan_offset = 0;
1249
1250 wpa_printf(MSG_DEBUG, "nl80211: Channel switch event");
1251
1252 if (!freq || !type)
1253 return;
1254
1255 switch (nla_get_u32(type)) {
1256 case NL80211_CHAN_NO_HT:
1257 ht_enabled = 0;
1258 break;
1259 case NL80211_CHAN_HT20:
1260 break;
1261 case NL80211_CHAN_HT40PLUS:
1262 chan_offset = 1;
1263 break;
1264 case NL80211_CHAN_HT40MINUS:
1265 chan_offset = -1;
1266 break;
1267 }
1268
1269 data.ch_switch.freq = nla_get_u32(freq);
1270 data.ch_switch.ht_enabled = ht_enabled;
1271 data.ch_switch.ch_offset = chan_offset;
1272
1273 wpa_supplicant_event(drv->ctx, EVENT_CH_SWITCH, &data);
1274 }
1275
1276
mlme_timeout_event(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,struct nlattr * addr)1277 static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv,
1278 enum nl80211_commands cmd, struct nlattr *addr)
1279 {
1280 union wpa_event_data event;
1281 enum wpa_event_type ev;
1282
1283 if (nla_len(addr) != ETH_ALEN)
1284 return;
1285
1286 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR,
1287 cmd, MAC2STR((u8 *) nla_data(addr)));
1288
1289 if (cmd == NL80211_CMD_AUTHENTICATE)
1290 ev = EVENT_AUTH_TIMED_OUT;
1291 else if (cmd == NL80211_CMD_ASSOCIATE)
1292 ev = EVENT_ASSOC_TIMED_OUT;
1293 else
1294 return;
1295
1296 os_memset(&event, 0, sizeof(event));
1297 os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN);
1298 wpa_supplicant_event(drv->ctx, ev, &event);
1299 }
1300
1301
mlme_event_mgmt(struct wpa_driver_nl80211_data * drv,struct nlattr * freq,struct nlattr * sig,const u8 * frame,size_t len)1302 static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv,
1303 struct nlattr *freq, struct nlattr *sig,
1304 const u8 *frame, size_t len)
1305 {
1306 const struct ieee80211_mgmt *mgmt;
1307 union wpa_event_data event;
1308 u16 fc, stype;
1309 int ssi_signal = 0;
1310
1311 wpa_printf(MSG_DEBUG, "nl80211: Frame event");
1312 mgmt = (const struct ieee80211_mgmt *) frame;
1313 if (len < 24) {
1314 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame");
1315 return;
1316 }
1317
1318 fc = le_to_host16(mgmt->frame_control);
1319 stype = WLAN_FC_GET_STYPE(fc);
1320
1321 if (sig)
1322 ssi_signal = (s32) nla_get_u32(sig);
1323
1324 os_memset(&event, 0, sizeof(event));
1325 if (freq) {
1326 event.rx_action.freq = nla_get_u32(freq);
1327 drv->last_mgmt_freq = event.rx_action.freq;
1328 }
1329 if (stype == WLAN_FC_STYPE_ACTION) {
1330 event.rx_action.da = mgmt->da;
1331 event.rx_action.sa = mgmt->sa;
1332 event.rx_action.bssid = mgmt->bssid;
1333 event.rx_action.category = mgmt->u.action.category;
1334 event.rx_action.data = &mgmt->u.action.category + 1;
1335 event.rx_action.len = frame + len - event.rx_action.data;
1336 wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event);
1337 } else {
1338 event.rx_mgmt.frame = frame;
1339 event.rx_mgmt.frame_len = len;
1340 event.rx_mgmt.ssi_signal = ssi_signal;
1341 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
1342 }
1343 }
1344
1345
mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data * drv,struct nlattr * cookie,const u8 * frame,size_t len,struct nlattr * ack)1346 static void mlme_event_mgmt_tx_status(struct wpa_driver_nl80211_data *drv,
1347 struct nlattr *cookie, const u8 *frame,
1348 size_t len, struct nlattr *ack)
1349 {
1350 union wpa_event_data event;
1351 const struct ieee80211_hdr *hdr;
1352 u16 fc;
1353
1354 wpa_printf(MSG_DEBUG, "nl80211: Frame TX status event");
1355 if (!is_ap_interface(drv->nlmode)) {
1356 u64 cookie_val;
1357
1358 if (!cookie)
1359 return;
1360
1361 cookie_val = nla_get_u64(cookie);
1362 wpa_printf(MSG_DEBUG, "nl80211: Action TX status:"
1363 " cookie=0%llx%s (ack=%d)",
1364 (long long unsigned int) cookie_val,
1365 cookie_val == drv->send_action_cookie ?
1366 " (match)" : " (unknown)", ack != NULL);
1367 if (cookie_val != drv->send_action_cookie)
1368 return;
1369 }
1370
1371 hdr = (const struct ieee80211_hdr *) frame;
1372 fc = le_to_host16(hdr->frame_control);
1373
1374 os_memset(&event, 0, sizeof(event));
1375 event.tx_status.type = WLAN_FC_GET_TYPE(fc);
1376 event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
1377 event.tx_status.dst = hdr->addr1;
1378 event.tx_status.data = frame;
1379 event.tx_status.data_len = len;
1380 event.tx_status.ack = ack != NULL;
1381 wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event);
1382 }
1383
1384
mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1385 static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv,
1386 enum wpa_event_type type,
1387 const u8 *frame, size_t len)
1388 {
1389 const struct ieee80211_mgmt *mgmt;
1390 union wpa_event_data event;
1391 const u8 *bssid = NULL;
1392 u16 reason_code = 0;
1393
1394 if (type == EVENT_DEAUTH)
1395 wpa_printf(MSG_DEBUG, "nl80211: Deauthenticate event");
1396 else
1397 wpa_printf(MSG_DEBUG, "nl80211: Disassociate event");
1398
1399 mgmt = (const struct ieee80211_mgmt *) frame;
1400 if (len >= 24) {
1401 bssid = mgmt->bssid;
1402
1403 if (drv->associated != 0 &&
1404 os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 &&
1405 os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) {
1406 /*
1407 * We have presumably received this deauth as a
1408 * response to a clear_state_mismatch() outgoing
1409 * deauth. Don't let it take us offline!
1410 */
1411 wpa_printf(MSG_DEBUG, "nl80211: Deauth received "
1412 "from Unknown BSSID " MACSTR " -- ignoring",
1413 MAC2STR(bssid));
1414 return;
1415 }
1416 }
1417
1418 drv->associated = 0;
1419 os_memset(&event, 0, sizeof(event));
1420
1421 /* Note: Same offset for Reason Code in both frame subtypes */
1422 if (len >= 24 + sizeof(mgmt->u.deauth))
1423 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1424
1425 if (type == EVENT_DISASSOC) {
1426 event.disassoc_info.locally_generated =
1427 !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1428 event.disassoc_info.addr = bssid;
1429 event.disassoc_info.reason_code = reason_code;
1430 if (frame + len > mgmt->u.disassoc.variable) {
1431 event.disassoc_info.ie = mgmt->u.disassoc.variable;
1432 event.disassoc_info.ie_len = frame + len -
1433 mgmt->u.disassoc.variable;
1434 }
1435 } else {
1436 event.deauth_info.locally_generated =
1437 !os_memcmp(mgmt->sa, drv->first_bss.addr, ETH_ALEN);
1438 event.deauth_info.addr = bssid;
1439 event.deauth_info.reason_code = reason_code;
1440 if (frame + len > mgmt->u.deauth.variable) {
1441 event.deauth_info.ie = mgmt->u.deauth.variable;
1442 event.deauth_info.ie_len = frame + len -
1443 mgmt->u.deauth.variable;
1444 }
1445 }
1446
1447 wpa_supplicant_event(drv->ctx, type, &event);
1448 }
1449
1450
mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data * drv,enum wpa_event_type type,const u8 * frame,size_t len)1451 static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv,
1452 enum wpa_event_type type,
1453 const u8 *frame, size_t len)
1454 {
1455 const struct ieee80211_mgmt *mgmt;
1456 union wpa_event_data event;
1457 u16 reason_code = 0;
1458
1459 if (type == EVENT_UNPROT_DEAUTH)
1460 wpa_printf(MSG_DEBUG, "nl80211: Unprot Deauthenticate event");
1461 else
1462 wpa_printf(MSG_DEBUG, "nl80211: Unprot Disassociate event");
1463
1464 if (len < 24)
1465 return;
1466
1467 mgmt = (const struct ieee80211_mgmt *) frame;
1468
1469 os_memset(&event, 0, sizeof(event));
1470 /* Note: Same offset for Reason Code in both frame subtypes */
1471 if (len >= 24 + sizeof(mgmt->u.deauth))
1472 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1473
1474 if (type == EVENT_UNPROT_DISASSOC) {
1475 event.unprot_disassoc.sa = mgmt->sa;
1476 event.unprot_disassoc.da = mgmt->da;
1477 event.unprot_disassoc.reason_code = reason_code;
1478 } else {
1479 event.unprot_deauth.sa = mgmt->sa;
1480 event.unprot_deauth.da = mgmt->da;
1481 event.unprot_deauth.reason_code = reason_code;
1482 }
1483
1484 wpa_supplicant_event(drv->ctx, type, &event);
1485 }
1486
1487
mlme_event(struct wpa_driver_nl80211_data * drv,enum nl80211_commands cmd,struct nlattr * frame,struct nlattr * addr,struct nlattr * timed_out,struct nlattr * freq,struct nlattr * ack,struct nlattr * cookie,struct nlattr * sig)1488 static void mlme_event(struct wpa_driver_nl80211_data *drv,
1489 enum nl80211_commands cmd, struct nlattr *frame,
1490 struct nlattr *addr, struct nlattr *timed_out,
1491 struct nlattr *freq, struct nlattr *ack,
1492 struct nlattr *cookie, struct nlattr *sig)
1493 {
1494 if (timed_out && addr) {
1495 mlme_timeout_event(drv, cmd, addr);
1496 return;
1497 }
1498
1499 if (frame == NULL) {
1500 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
1501 "data", cmd);
1502 return;
1503 }
1504
1505 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
1506 wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1507 nla_data(frame), nla_len(frame));
1508
1509 switch (cmd) {
1510 case NL80211_CMD_AUTHENTICATE:
1511 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1512 break;
1513 case NL80211_CMD_ASSOCIATE:
1514 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1515 break;
1516 case NL80211_CMD_DEAUTHENTICATE:
1517 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH,
1518 nla_data(frame), nla_len(frame));
1519 break;
1520 case NL80211_CMD_DISASSOCIATE:
1521 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC,
1522 nla_data(frame), nla_len(frame));
1523 break;
1524 case NL80211_CMD_FRAME:
1525 mlme_event_mgmt(drv, freq, sig, nla_data(frame),
1526 nla_len(frame));
1527 break;
1528 case NL80211_CMD_FRAME_TX_STATUS:
1529 mlme_event_mgmt_tx_status(drv, cookie, nla_data(frame),
1530 nla_len(frame), ack);
1531 break;
1532 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
1533 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH,
1534 nla_data(frame), nla_len(frame));
1535 break;
1536 case NL80211_CMD_UNPROT_DISASSOCIATE:
1537 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC,
1538 nla_data(frame), nla_len(frame));
1539 break;
1540 default:
1541 break;
1542 }
1543 }
1544
1545
mlme_event_michael_mic_failure(struct i802_bss * bss,struct nlattr * tb[])1546 static void mlme_event_michael_mic_failure(struct i802_bss *bss,
1547 struct nlattr *tb[])
1548 {
1549 union wpa_event_data data;
1550
1551 wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
1552 os_memset(&data, 0, sizeof(data));
1553 if (tb[NL80211_ATTR_MAC]) {
1554 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
1555 nla_data(tb[NL80211_ATTR_MAC]),
1556 nla_len(tb[NL80211_ATTR_MAC]));
1557 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]);
1558 }
1559 if (tb[NL80211_ATTR_KEY_SEQ]) {
1560 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
1561 nla_data(tb[NL80211_ATTR_KEY_SEQ]),
1562 nla_len(tb[NL80211_ATTR_KEY_SEQ]));
1563 }
1564 if (tb[NL80211_ATTR_KEY_TYPE]) {
1565 enum nl80211_key_type key_type =
1566 nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
1567 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
1568 if (key_type == NL80211_KEYTYPE_PAIRWISE)
1569 data.michael_mic_failure.unicast = 1;
1570 } else
1571 data.michael_mic_failure.unicast = 1;
1572
1573 if (tb[NL80211_ATTR_KEY_IDX]) {
1574 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
1575 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
1576 }
1577
1578 wpa_supplicant_event(bss->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
1579 }
1580
1581
mlme_event_join_ibss(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1582 static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv,
1583 struct nlattr *tb[])
1584 {
1585 if (tb[NL80211_ATTR_MAC] == NULL) {
1586 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined "
1587 "event");
1588 return;
1589 }
1590 os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1591 drv->associated = 1;
1592 wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined",
1593 MAC2STR(drv->bssid));
1594
1595 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
1596 }
1597
1598
mlme_event_remain_on_channel(struct wpa_driver_nl80211_data * drv,int cancel_event,struct nlattr * tb[])1599 static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv,
1600 int cancel_event, struct nlattr *tb[])
1601 {
1602 unsigned int freq, chan_type, duration;
1603 union wpa_event_data data;
1604 u64 cookie;
1605
1606 if (tb[NL80211_ATTR_WIPHY_FREQ])
1607 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]);
1608 else
1609 freq = 0;
1610
1611 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE])
1612 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
1613 else
1614 chan_type = 0;
1615
1616 if (tb[NL80211_ATTR_DURATION])
1617 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]);
1618 else
1619 duration = 0;
1620
1621 if (tb[NL80211_ATTR_COOKIE])
1622 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
1623 else
1624 cookie = 0;
1625
1626 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d "
1627 "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))",
1628 cancel_event, freq, chan_type, duration,
1629 (long long unsigned int) cookie,
1630 cookie == drv->remain_on_chan_cookie ? "match" : "unknown");
1631
1632 if (cookie != drv->remain_on_chan_cookie)
1633 return; /* not for us */
1634
1635 if (cancel_event)
1636 drv->pending_remain_on_chan = 0;
1637
1638 os_memset(&data, 0, sizeof(data));
1639 data.remain_on_channel.freq = freq;
1640 data.remain_on_channel.duration = duration;
1641 wpa_supplicant_event(drv->ctx, cancel_event ?
1642 EVENT_CANCEL_REMAIN_ON_CHANNEL :
1643 EVENT_REMAIN_ON_CHANNEL, &data);
1644 }
1645
1646
mlme_event_ft_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1647 static void mlme_event_ft_event(struct wpa_driver_nl80211_data *drv,
1648 struct nlattr *tb[])
1649 {
1650 union wpa_event_data data;
1651
1652 os_memset(&data, 0, sizeof(data));
1653
1654 if (tb[NL80211_ATTR_IE]) {
1655 data.ft_ies.ies = nla_data(tb[NL80211_ATTR_IE]);
1656 data.ft_ies.ies_len = nla_len(tb[NL80211_ATTR_IE]);
1657 }
1658
1659 if (tb[NL80211_ATTR_IE_RIC]) {
1660 data.ft_ies.ric_ies = nla_data(tb[NL80211_ATTR_IE_RIC]);
1661 data.ft_ies.ric_ies_len = nla_len(tb[NL80211_ATTR_IE_RIC]);
1662 }
1663
1664 if (tb[NL80211_ATTR_MAC])
1665 os_memcpy(data.ft_ies.target_ap,
1666 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
1667
1668 wpa_printf(MSG_DEBUG, "nl80211: FT event target_ap " MACSTR,
1669 MAC2STR(data.ft_ies.target_ap));
1670
1671 wpa_supplicant_event(drv->ctx, EVENT_FT_RESPONSE, &data);
1672 }
1673
1674
send_scan_event(struct wpa_driver_nl80211_data * drv,int aborted,struct nlattr * tb[])1675 static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted,
1676 struct nlattr *tb[])
1677 {
1678 union wpa_event_data event;
1679 struct nlattr *nl;
1680 int rem;
1681 struct scan_info *info;
1682 #define MAX_REPORT_FREQS 50
1683 int freqs[MAX_REPORT_FREQS];
1684 int num_freqs = 0;
1685
1686 if (drv->scan_for_auth) {
1687 drv->scan_for_auth = 0;
1688 wpa_printf(MSG_DEBUG, "nl80211: Scan results for missing "
1689 "cfg80211 BSS entry");
1690 wpa_driver_nl80211_authenticate_retry(drv);
1691 return;
1692 }
1693
1694 os_memset(&event, 0, sizeof(event));
1695 info = &event.scan_info;
1696 info->aborted = aborted;
1697
1698 if (tb[NL80211_ATTR_SCAN_SSIDS]) {
1699 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) {
1700 struct wpa_driver_scan_ssid *s =
1701 &info->ssids[info->num_ssids];
1702 s->ssid = nla_data(nl);
1703 s->ssid_len = nla_len(nl);
1704 info->num_ssids++;
1705 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS)
1706 break;
1707 }
1708 }
1709 if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) {
1710 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem)
1711 {
1712 freqs[num_freqs] = nla_get_u32(nl);
1713 num_freqs++;
1714 if (num_freqs == MAX_REPORT_FREQS - 1)
1715 break;
1716 }
1717 info->freqs = freqs;
1718 info->num_freqs = num_freqs;
1719 }
1720 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event);
1721 }
1722
1723
get_link_signal(struct nl_msg * msg,void * arg)1724 static int get_link_signal(struct nl_msg *msg, void *arg)
1725 {
1726 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1727 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1728 struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1];
1729 static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = {
1730 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 },
1731 };
1732 struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1];
1733 static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = {
1734 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 },
1735 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 },
1736 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG },
1737 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG },
1738 };
1739 struct wpa_signal_info *sig_change = arg;
1740
1741 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1742 genlmsg_attrlen(gnlh, 0), NULL);
1743 if (!tb[NL80211_ATTR_STA_INFO] ||
1744 nla_parse_nested(sinfo, NL80211_STA_INFO_MAX,
1745 tb[NL80211_ATTR_STA_INFO], policy))
1746 return NL_SKIP;
1747 if (!sinfo[NL80211_STA_INFO_SIGNAL])
1748 return NL_SKIP;
1749
1750 sig_change->current_signal =
1751 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]);
1752
1753 if (sinfo[NL80211_STA_INFO_TX_BITRATE]) {
1754 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX,
1755 sinfo[NL80211_STA_INFO_TX_BITRATE],
1756 rate_policy)) {
1757 sig_change->current_txrate = 0;
1758 } else {
1759 if (rinfo[NL80211_RATE_INFO_BITRATE]) {
1760 sig_change->current_txrate =
1761 nla_get_u16(rinfo[
1762 NL80211_RATE_INFO_BITRATE]) * 100;
1763 }
1764 }
1765 }
1766
1767 return NL_SKIP;
1768 }
1769
1770
nl80211_get_link_signal(struct wpa_driver_nl80211_data * drv,struct wpa_signal_info * sig)1771 static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv,
1772 struct wpa_signal_info *sig)
1773 {
1774 struct nl_msg *msg;
1775
1776 sig->current_signal = -9999;
1777 sig->current_txrate = 0;
1778
1779 msg = nlmsg_alloc();
1780 if (!msg)
1781 return -ENOMEM;
1782
1783 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
1784
1785 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1786 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
1787
1788 return send_and_recv_msgs(drv, msg, get_link_signal, sig);
1789 nla_put_failure:
1790 nlmsg_free(msg);
1791 return -ENOBUFS;
1792 }
1793
1794
get_link_noise(struct nl_msg * msg,void * arg)1795 static int get_link_noise(struct nl_msg *msg, void *arg)
1796 {
1797 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1798 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1799 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1800 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1801 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1802 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1803 };
1804 struct wpa_signal_info *sig_change = arg;
1805
1806 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1807 genlmsg_attrlen(gnlh, 0), NULL);
1808
1809 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1810 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!");
1811 return NL_SKIP;
1812 }
1813
1814 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1815 tb[NL80211_ATTR_SURVEY_INFO],
1816 survey_policy)) {
1817 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested "
1818 "attributes!");
1819 return NL_SKIP;
1820 }
1821
1822 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1823 return NL_SKIP;
1824
1825 if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1826 sig_change->frequency)
1827 return NL_SKIP;
1828
1829 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1830 return NL_SKIP;
1831
1832 sig_change->current_noise =
1833 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1834
1835 return NL_SKIP;
1836 }
1837
1838
nl80211_get_link_noise(struct wpa_driver_nl80211_data * drv,struct wpa_signal_info * sig_change)1839 static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv,
1840 struct wpa_signal_info *sig_change)
1841 {
1842 struct nl_msg *msg;
1843
1844 sig_change->current_noise = 9999;
1845 sig_change->frequency = drv->assoc_freq;
1846
1847 msg = nlmsg_alloc();
1848 if (!msg)
1849 return -ENOMEM;
1850
1851 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1852
1853 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1854
1855 return send_and_recv_msgs(drv, msg, get_link_noise, sig_change);
1856 nla_put_failure:
1857 nlmsg_free(msg);
1858 return -ENOBUFS;
1859 }
1860
1861
get_noise_for_scan_results(struct nl_msg * msg,void * arg)1862 static int get_noise_for_scan_results(struct nl_msg *msg, void *arg)
1863 {
1864 struct nlattr *tb[NL80211_ATTR_MAX + 1];
1865 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1866 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1];
1867 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = {
1868 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 },
1869 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 },
1870 };
1871 struct wpa_scan_results *scan_results = arg;
1872 struct wpa_scan_res *scan_res;
1873 size_t i;
1874
1875 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1876 genlmsg_attrlen(gnlh, 0), NULL);
1877
1878 if (!tb[NL80211_ATTR_SURVEY_INFO]) {
1879 wpa_printf(MSG_DEBUG, "nl80211: Survey data missing");
1880 return NL_SKIP;
1881 }
1882
1883 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX,
1884 tb[NL80211_ATTR_SURVEY_INFO],
1885 survey_policy)) {
1886 wpa_printf(MSG_DEBUG, "nl80211: Failed to parse nested "
1887 "attributes");
1888 return NL_SKIP;
1889 }
1890
1891 if (!sinfo[NL80211_SURVEY_INFO_NOISE])
1892 return NL_SKIP;
1893
1894 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY])
1895 return NL_SKIP;
1896
1897 for (i = 0; i < scan_results->num; ++i) {
1898 scan_res = scan_results->res[i];
1899 if (!scan_res)
1900 continue;
1901 if ((int) nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) !=
1902 scan_res->freq)
1903 continue;
1904 if (!(scan_res->flags & WPA_SCAN_NOISE_INVALID))
1905 continue;
1906 scan_res->noise = (s8)
1907 nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]);
1908 scan_res->flags &= ~WPA_SCAN_NOISE_INVALID;
1909 }
1910
1911 return NL_SKIP;
1912 }
1913
1914
nl80211_get_noise_for_scan_results(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * scan_res)1915 static int nl80211_get_noise_for_scan_results(
1916 struct wpa_driver_nl80211_data *drv,
1917 struct wpa_scan_results *scan_res)
1918 {
1919 struct nl_msg *msg;
1920
1921 msg = nlmsg_alloc();
1922 if (!msg)
1923 return -ENOMEM;
1924
1925 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SURVEY);
1926
1927 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1928
1929 return send_and_recv_msgs(drv, msg, get_noise_for_scan_results,
1930 scan_res);
1931 nla_put_failure:
1932 nlmsg_free(msg);
1933 return -ENOBUFS;
1934 }
1935
1936
nl80211_cqm_event(struct wpa_driver_nl80211_data * drv,struct nlattr * tb[])1937 static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv,
1938 struct nlattr *tb[])
1939 {
1940 static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
1941 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 },
1942 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 },
1943 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
1944 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 },
1945 };
1946 struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1];
1947 enum nl80211_cqm_rssi_threshold_event event;
1948 union wpa_event_data ed;
1949 struct wpa_signal_info sig;
1950 int res;
1951
1952 if (tb[NL80211_ATTR_CQM] == NULL ||
1953 nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM],
1954 cqm_policy)) {
1955 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event");
1956 return;
1957 }
1958
1959 os_memset(&ed, 0, sizeof(ed));
1960
1961 if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) {
1962 if (!tb[NL80211_ATTR_MAC])
1963 return;
1964 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]),
1965 ETH_ALEN);
1966 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed);
1967 return;
1968 }
1969
1970 if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL)
1971 return;
1972 event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]);
1973
1974 if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) {
1975 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1976 "event: RSSI high");
1977 ed.signal_change.above_threshold = 1;
1978 } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) {
1979 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor "
1980 "event: RSSI low");
1981 ed.signal_change.above_threshold = 0;
1982 } else
1983 return;
1984
1985 res = nl80211_get_link_signal(drv, &sig);
1986 if (res == 0) {
1987 ed.signal_change.current_signal = sig.current_signal;
1988 ed.signal_change.current_txrate = sig.current_txrate;
1989 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm txrate: %d",
1990 sig.current_signal, sig.current_txrate);
1991 }
1992
1993 res = nl80211_get_link_noise(drv, &sig);
1994 if (res == 0) {
1995 ed.signal_change.current_noise = sig.current_noise;
1996 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm",
1997 sig.current_noise);
1998 }
1999
2000 wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed);
2001 }
2002
2003
nl80211_new_station_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2004 static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv,
2005 struct nlattr **tb)
2006 {
2007 u8 *addr;
2008 union wpa_event_data data;
2009
2010 if (tb[NL80211_ATTR_MAC] == NULL)
2011 return;
2012 addr = nla_data(tb[NL80211_ATTR_MAC]);
2013 wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr));
2014
2015 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2016 u8 *ies = NULL;
2017 size_t ies_len = 0;
2018 if (tb[NL80211_ATTR_IE]) {
2019 ies = nla_data(tb[NL80211_ATTR_IE]);
2020 ies_len = nla_len(tb[NL80211_ATTR_IE]);
2021 }
2022 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len);
2023 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0);
2024 return;
2025 }
2026
2027 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2028 return;
2029
2030 os_memset(&data, 0, sizeof(data));
2031 os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN);
2032 wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data);
2033 }
2034
2035
nl80211_del_station_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2036 static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv,
2037 struct nlattr **tb)
2038 {
2039 u8 *addr;
2040 union wpa_event_data data;
2041
2042 if (tb[NL80211_ATTR_MAC] == NULL)
2043 return;
2044 addr = nla_data(tb[NL80211_ATTR_MAC]);
2045 wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR,
2046 MAC2STR(addr));
2047
2048 if (is_ap_interface(drv->nlmode) && drv->device_ap_sme) {
2049 drv_event_disassoc(drv->ctx, addr);
2050 return;
2051 }
2052
2053 if (drv->nlmode != NL80211_IFTYPE_ADHOC)
2054 return;
2055
2056 os_memset(&data, 0, sizeof(data));
2057 os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN);
2058 wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data);
2059 }
2060
2061
nl80211_rekey_offload_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2062 static void nl80211_rekey_offload_event(struct wpa_driver_nl80211_data *drv,
2063 struct nlattr **tb)
2064 {
2065 struct nlattr *rekey_info[NUM_NL80211_REKEY_DATA];
2066 static struct nla_policy rekey_policy[NUM_NL80211_REKEY_DATA] = {
2067 [NL80211_REKEY_DATA_KEK] = {
2068 .minlen = NL80211_KEK_LEN,
2069 .maxlen = NL80211_KEK_LEN,
2070 },
2071 [NL80211_REKEY_DATA_KCK] = {
2072 .minlen = NL80211_KCK_LEN,
2073 .maxlen = NL80211_KCK_LEN,
2074 },
2075 [NL80211_REKEY_DATA_REPLAY_CTR] = {
2076 .minlen = NL80211_REPLAY_CTR_LEN,
2077 .maxlen = NL80211_REPLAY_CTR_LEN,
2078 },
2079 };
2080 union wpa_event_data data;
2081
2082 if (!tb[NL80211_ATTR_MAC])
2083 return;
2084 if (!tb[NL80211_ATTR_REKEY_DATA])
2085 return;
2086 if (nla_parse_nested(rekey_info, MAX_NL80211_REKEY_DATA,
2087 tb[NL80211_ATTR_REKEY_DATA], rekey_policy))
2088 return;
2089 if (!rekey_info[NL80211_REKEY_DATA_REPLAY_CTR])
2090 return;
2091
2092 os_memset(&data, 0, sizeof(data));
2093 data.driver_gtk_rekey.bssid = nla_data(tb[NL80211_ATTR_MAC]);
2094 wpa_printf(MSG_DEBUG, "nl80211: Rekey offload event for BSSID " MACSTR,
2095 MAC2STR(data.driver_gtk_rekey.bssid));
2096 data.driver_gtk_rekey.replay_ctr =
2097 nla_data(rekey_info[NL80211_REKEY_DATA_REPLAY_CTR]);
2098 wpa_hexdump(MSG_DEBUG, "nl80211: Rekey offload - Replay Counter",
2099 data.driver_gtk_rekey.replay_ctr, NL80211_REPLAY_CTR_LEN);
2100 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_GTK_REKEY, &data);
2101 }
2102
2103
nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2104 static void nl80211_pmksa_candidate_event(struct wpa_driver_nl80211_data *drv,
2105 struct nlattr **tb)
2106 {
2107 struct nlattr *cand[NUM_NL80211_PMKSA_CANDIDATE];
2108 static struct nla_policy cand_policy[NUM_NL80211_PMKSA_CANDIDATE] = {
2109 [NL80211_PMKSA_CANDIDATE_INDEX] = { .type = NLA_U32 },
2110 [NL80211_PMKSA_CANDIDATE_BSSID] = {
2111 .minlen = ETH_ALEN,
2112 .maxlen = ETH_ALEN,
2113 },
2114 [NL80211_PMKSA_CANDIDATE_PREAUTH] = { .type = NLA_FLAG },
2115 };
2116 union wpa_event_data data;
2117
2118 wpa_printf(MSG_DEBUG, "nl80211: PMKSA candidate event");
2119
2120 if (!tb[NL80211_ATTR_PMKSA_CANDIDATE])
2121 return;
2122 if (nla_parse_nested(cand, MAX_NL80211_PMKSA_CANDIDATE,
2123 tb[NL80211_ATTR_PMKSA_CANDIDATE], cand_policy))
2124 return;
2125 if (!cand[NL80211_PMKSA_CANDIDATE_INDEX] ||
2126 !cand[NL80211_PMKSA_CANDIDATE_BSSID])
2127 return;
2128
2129 os_memset(&data, 0, sizeof(data));
2130 os_memcpy(data.pmkid_candidate.bssid,
2131 nla_data(cand[NL80211_PMKSA_CANDIDATE_BSSID]), ETH_ALEN);
2132 data.pmkid_candidate.index =
2133 nla_get_u32(cand[NL80211_PMKSA_CANDIDATE_INDEX]);
2134 data.pmkid_candidate.preauth =
2135 cand[NL80211_PMKSA_CANDIDATE_PREAUTH] != NULL;
2136 wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
2137 }
2138
2139
nl80211_client_probe_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2140 static void nl80211_client_probe_event(struct wpa_driver_nl80211_data *drv,
2141 struct nlattr **tb)
2142 {
2143 union wpa_event_data data;
2144
2145 wpa_printf(MSG_DEBUG, "nl80211: Probe client event");
2146
2147 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_ACK])
2148 return;
2149
2150 os_memset(&data, 0, sizeof(data));
2151 os_memcpy(data.client_poll.addr,
2152 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2153
2154 wpa_supplicant_event(drv->ctx, EVENT_DRIVER_CLIENT_POLL_OK, &data);
2155 }
2156
2157
nl80211_tdls_oper_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2158 static void nl80211_tdls_oper_event(struct wpa_driver_nl80211_data *drv,
2159 struct nlattr **tb)
2160 {
2161 union wpa_event_data data;
2162
2163 wpa_printf(MSG_DEBUG, "nl80211: TDLS operation event");
2164
2165 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_TDLS_OPERATION])
2166 return;
2167
2168 os_memset(&data, 0, sizeof(data));
2169 os_memcpy(data.tdls.peer, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2170 switch (nla_get_u8(tb[NL80211_ATTR_TDLS_OPERATION])) {
2171 case NL80211_TDLS_SETUP:
2172 wpa_printf(MSG_DEBUG, "nl80211: TDLS setup request for peer "
2173 MACSTR, MAC2STR(data.tdls.peer));
2174 data.tdls.oper = TDLS_REQUEST_SETUP;
2175 break;
2176 case NL80211_TDLS_TEARDOWN:
2177 wpa_printf(MSG_DEBUG, "nl80211: TDLS teardown request for peer "
2178 MACSTR, MAC2STR(data.tdls.peer));
2179 data.tdls.oper = TDLS_REQUEST_TEARDOWN;
2180 break;
2181 default:
2182 wpa_printf(MSG_DEBUG, "nl80211: Unsupported TDLS operatione "
2183 "event");
2184 return;
2185 }
2186 if (tb[NL80211_ATTR_REASON_CODE]) {
2187 data.tdls.reason_code =
2188 nla_get_u16(tb[NL80211_ATTR_REASON_CODE]);
2189 }
2190
2191 wpa_supplicant_event(drv->ctx, EVENT_TDLS, &data);
2192 }
2193
2194
nl80211_connect_failed_event(struct wpa_driver_nl80211_data * drv,struct nlattr ** tb)2195 static void nl80211_connect_failed_event(struct wpa_driver_nl80211_data *drv,
2196 struct nlattr **tb)
2197 {
2198 union wpa_event_data data;
2199 u32 reason;
2200
2201 wpa_printf(MSG_DEBUG, "nl80211: Connect failed event");
2202
2203 if (!tb[NL80211_ATTR_MAC] || !tb[NL80211_ATTR_CONN_FAILED_REASON])
2204 return;
2205
2206 os_memset(&data, 0, sizeof(data));
2207 os_memcpy(data.connect_failed_reason.addr,
2208 nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN);
2209
2210 reason = nla_get_u32(tb[NL80211_ATTR_CONN_FAILED_REASON]);
2211 switch (reason) {
2212 case NL80211_CONN_FAIL_MAX_CLIENTS:
2213 wpa_printf(MSG_DEBUG, "nl80211: Max client reached");
2214 data.connect_failed_reason.code = MAX_CLIENT_REACHED;
2215 break;
2216 case NL80211_CONN_FAIL_BLOCKED_CLIENT:
2217 wpa_printf(MSG_DEBUG, "nl80211: Blocked client " MACSTR
2218 " tried to connect",
2219 MAC2STR(data.connect_failed_reason.addr));
2220 data.connect_failed_reason.code = BLOCKED_CLIENT;
2221 break;
2222 default:
2223 wpa_printf(MSG_DEBUG, "nl8021l: Unknown connect failed reason "
2224 "%u", reason);
2225 return;
2226 }
2227
2228 wpa_supplicant_event(drv->ctx, EVENT_CONNECT_FAILED_REASON, &data);
2229 }
2230
2231
nl80211_spurious_frame(struct i802_bss * bss,struct nlattr ** tb,int wds)2232 static void nl80211_spurious_frame(struct i802_bss *bss, struct nlattr **tb,
2233 int wds)
2234 {
2235 struct wpa_driver_nl80211_data *drv = bss->drv;
2236 union wpa_event_data event;
2237
2238 if (!tb[NL80211_ATTR_MAC])
2239 return;
2240
2241 os_memset(&event, 0, sizeof(event));
2242 event.rx_from_unknown.bssid = bss->addr;
2243 event.rx_from_unknown.addr = nla_data(tb[NL80211_ATTR_MAC]);
2244 event.rx_from_unknown.wds = wds;
2245
2246 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
2247 }
2248
2249
do_process_drv_event(struct i802_bss * bss,int cmd,struct nlattr ** tb)2250 static void do_process_drv_event(struct i802_bss *bss, int cmd,
2251 struct nlattr **tb)
2252 {
2253 struct wpa_driver_nl80211_data *drv = bss->drv;
2254
2255 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED &&
2256 (cmd == NL80211_CMD_NEW_SCAN_RESULTS ||
2257 cmd == NL80211_CMD_SCAN_ABORTED)) {
2258 wpa_driver_nl80211_set_mode(&drv->first_bss,
2259 drv->ap_scan_as_station);
2260 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
2261 }
2262
2263 switch (cmd) {
2264 case NL80211_CMD_TRIGGER_SCAN:
2265 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan trigger");
2266 break;
2267 case NL80211_CMD_START_SCHED_SCAN:
2268 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan started");
2269 break;
2270 case NL80211_CMD_SCHED_SCAN_STOPPED:
2271 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Sched scan stopped");
2272 wpa_supplicant_event(drv->ctx, EVENT_SCHED_SCAN_STOPPED, NULL);
2273 break;
2274 case NL80211_CMD_NEW_SCAN_RESULTS:
2275 wpa_dbg(drv->ctx, MSG_DEBUG,
2276 "nl80211: New scan results available");
2277 drv->scan_complete_events = 1;
2278 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2279 drv->ctx);
2280 send_scan_event(drv, 0, tb);
2281 break;
2282 case NL80211_CMD_SCHED_SCAN_RESULTS:
2283 wpa_dbg(drv->ctx, MSG_DEBUG,
2284 "nl80211: New sched scan results available");
2285 send_scan_event(drv, 0, tb);
2286 break;
2287 case NL80211_CMD_SCAN_ABORTED:
2288 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Scan aborted");
2289 /*
2290 * Need to indicate that scan results are available in order
2291 * not to make wpa_supplicant stop its scanning.
2292 */
2293 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
2294 drv->ctx);
2295 send_scan_event(drv, 1, tb);
2296 break;
2297 case NL80211_CMD_AUTHENTICATE:
2298 case NL80211_CMD_ASSOCIATE:
2299 case NL80211_CMD_DEAUTHENTICATE:
2300 case NL80211_CMD_DISASSOCIATE:
2301 case NL80211_CMD_FRAME_TX_STATUS:
2302 case NL80211_CMD_UNPROT_DEAUTHENTICATE:
2303 case NL80211_CMD_UNPROT_DISASSOCIATE:
2304 mlme_event(drv, cmd, tb[NL80211_ATTR_FRAME],
2305 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2306 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2307 tb[NL80211_ATTR_COOKIE],
2308 tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2309 break;
2310 case NL80211_CMD_CONNECT:
2311 case NL80211_CMD_ROAM:
2312 mlme_event_connect(drv, cmd,
2313 tb[NL80211_ATTR_STATUS_CODE],
2314 tb[NL80211_ATTR_MAC],
2315 tb[NL80211_ATTR_REQ_IE],
2316 tb[NL80211_ATTR_RESP_IE]);
2317 break;
2318 case NL80211_CMD_CH_SWITCH_NOTIFY:
2319 mlme_event_ch_switch(drv, tb[NL80211_ATTR_WIPHY_FREQ],
2320 tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2321 break;
2322 case NL80211_CMD_DISCONNECT:
2323 mlme_event_disconnect(drv, tb[NL80211_ATTR_REASON_CODE],
2324 tb[NL80211_ATTR_MAC],
2325 tb[NL80211_ATTR_DISCONNECTED_BY_AP]);
2326 break;
2327 case NL80211_CMD_MICHAEL_MIC_FAILURE:
2328 mlme_event_michael_mic_failure(bss, tb);
2329 break;
2330 case NL80211_CMD_JOIN_IBSS:
2331 mlme_event_join_ibss(drv, tb);
2332 break;
2333 case NL80211_CMD_REMAIN_ON_CHANNEL:
2334 mlme_event_remain_on_channel(drv, 0, tb);
2335 break;
2336 case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL:
2337 mlme_event_remain_on_channel(drv, 1, tb);
2338 break;
2339 case NL80211_CMD_NOTIFY_CQM:
2340 nl80211_cqm_event(drv, tb);
2341 break;
2342 case NL80211_CMD_REG_CHANGE:
2343 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change");
2344 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2345 NULL);
2346 break;
2347 case NL80211_CMD_REG_BEACON_HINT:
2348 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint");
2349 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED,
2350 NULL);
2351 break;
2352 case NL80211_CMD_NEW_STATION:
2353 nl80211_new_station_event(drv, tb);
2354 break;
2355 case NL80211_CMD_DEL_STATION:
2356 nl80211_del_station_event(drv, tb);
2357 break;
2358 case NL80211_CMD_SET_REKEY_OFFLOAD:
2359 nl80211_rekey_offload_event(drv, tb);
2360 break;
2361 case NL80211_CMD_PMKSA_CANDIDATE:
2362 nl80211_pmksa_candidate_event(drv, tb);
2363 break;
2364 case NL80211_CMD_PROBE_CLIENT:
2365 nl80211_client_probe_event(drv, tb);
2366 break;
2367 case NL80211_CMD_TDLS_OPER:
2368 nl80211_tdls_oper_event(drv, tb);
2369 break;
2370 case NL80211_CMD_CONN_FAILED:
2371 nl80211_connect_failed_event(drv, tb);
2372 break;
2373 case NL80211_CMD_FT_EVENT:
2374 mlme_event_ft_event(drv, tb);
2375 break;
2376 default:
2377 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: Ignored unknown event "
2378 "(cmd=%d)", cmd);
2379 break;
2380 }
2381 }
2382
2383
process_drv_event(struct nl_msg * msg,void * arg)2384 static int process_drv_event(struct nl_msg *msg, void *arg)
2385 {
2386 struct wpa_driver_nl80211_data *drv = arg;
2387 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2388 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2389 struct i802_bss *bss;
2390 int ifidx = -1;
2391
2392 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2393 genlmsg_attrlen(gnlh, 0), NULL);
2394
2395 if (tb[NL80211_ATTR_IFINDEX])
2396 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2397
2398 for (bss = &drv->first_bss; bss; bss = bss->next) {
2399 if (ifidx == -1 || ifidx == bss->ifindex) {
2400 do_process_drv_event(bss, gnlh->cmd, tb);
2401 return NL_SKIP;
2402 }
2403 }
2404
2405 wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d) for foreign "
2406 "interface (ifindex %d)", gnlh->cmd, ifidx);
2407
2408 return NL_SKIP;
2409 }
2410
2411
process_global_event(struct nl_msg * msg,void * arg)2412 static int process_global_event(struct nl_msg *msg, void *arg)
2413 {
2414 struct nl80211_global *global = arg;
2415 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2416 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2417 struct wpa_driver_nl80211_data *drv, *tmp;
2418 int ifidx = -1;
2419 struct i802_bss *bss;
2420
2421 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2422 genlmsg_attrlen(gnlh, 0), NULL);
2423
2424 if (tb[NL80211_ATTR_IFINDEX])
2425 ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2426
2427 dl_list_for_each_safe(drv, tmp, &global->interfaces,
2428 struct wpa_driver_nl80211_data, list) {
2429 for (bss = &drv->first_bss; bss; bss = bss->next) {
2430 if (ifidx == -1 || ifidx == bss->ifindex) {
2431 do_process_drv_event(bss, gnlh->cmd, tb);
2432 return NL_SKIP;
2433 }
2434 }
2435 }
2436
2437 return NL_SKIP;
2438 }
2439
2440
process_bss_event(struct nl_msg * msg,void * arg)2441 static int process_bss_event(struct nl_msg *msg, void *arg)
2442 {
2443 struct i802_bss *bss = arg;
2444 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2445 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2446
2447 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2448 genlmsg_attrlen(gnlh, 0), NULL);
2449
2450 switch (gnlh->cmd) {
2451 case NL80211_CMD_FRAME:
2452 case NL80211_CMD_FRAME_TX_STATUS:
2453 mlme_event(bss->drv, gnlh->cmd, tb[NL80211_ATTR_FRAME],
2454 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT],
2455 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK],
2456 tb[NL80211_ATTR_COOKIE],
2457 tb[NL80211_ATTR_RX_SIGNAL_DBM]);
2458 break;
2459 case NL80211_CMD_UNEXPECTED_FRAME:
2460 nl80211_spurious_frame(bss, tb, 0);
2461 break;
2462 case NL80211_CMD_UNEXPECTED_4ADDR_FRAME:
2463 nl80211_spurious_frame(bss, tb, 1);
2464 break;
2465 default:
2466 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
2467 "(cmd=%d)", gnlh->cmd);
2468 break;
2469 }
2470
2471 return NL_SKIP;
2472 }
2473
2474
wpa_driver_nl80211_event_receive(int sock,void * eloop_ctx,void * handle)2475 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
2476 void *handle)
2477 {
2478 struct nl_cb *cb = eloop_ctx;
2479
2480 wpa_printf(MSG_DEBUG, "nl80211: Event message available");
2481
2482 nl_recvmsgs(handle, cb);
2483 }
2484
2485
2486 /**
2487 * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
2488 * @priv: driver_nl80211 private data
2489 * @alpha2_arg: country to which to switch to
2490 * Returns: 0 on success, -1 on failure
2491 *
2492 * This asks nl80211 to set the regulatory domain for given
2493 * country ISO / IEC alpha2.
2494 */
wpa_driver_nl80211_set_country(void * priv,const char * alpha2_arg)2495 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
2496 {
2497 struct i802_bss *bss = priv;
2498 struct wpa_driver_nl80211_data *drv = bss->drv;
2499 char alpha2[3];
2500 struct nl_msg *msg;
2501
2502 msg = nlmsg_alloc();
2503 if (!msg)
2504 return -ENOMEM;
2505
2506 alpha2[0] = alpha2_arg[0];
2507 alpha2[1] = alpha2_arg[1];
2508 alpha2[2] = '\0';
2509
2510 nl80211_cmd(drv, msg, 0, NL80211_CMD_REQ_SET_REG);
2511
2512 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
2513 if (send_and_recv_msgs(drv, msg, NULL, NULL))
2514 return -EINVAL;
2515 return 0;
2516 nla_put_failure:
2517 nlmsg_free(msg);
2518 return -EINVAL;
2519 }
2520
2521
protocol_feature_handler(struct nl_msg * msg,void * arg)2522 static int protocol_feature_handler(struct nl_msg *msg, void *arg)
2523 {
2524 u32 *feat = arg;
2525 struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
2526 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2527
2528 nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2529 genlmsg_attrlen(gnlh, 0), NULL);
2530
2531 if (tb_msg[NL80211_ATTR_PROTOCOL_FEATURES])
2532 *feat = nla_get_u32(tb_msg[NL80211_ATTR_PROTOCOL_FEATURES]);
2533
2534 return NL_SKIP;
2535 }
2536
2537
get_nl80211_protocol_features(struct wpa_driver_nl80211_data * drv)2538 static u32 get_nl80211_protocol_features(struct wpa_driver_nl80211_data *drv)
2539 {
2540 u32 feat = 0;
2541 struct nl_msg *msg;
2542
2543 msg = nlmsg_alloc();
2544 if (!msg)
2545 goto nla_put_failure;
2546
2547 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_PROTOCOL_FEATURES);
2548 if (send_and_recv_msgs(drv, msg, protocol_feature_handler, &feat) == 0)
2549 return feat;
2550
2551 msg = NULL;
2552 nla_put_failure:
2553 nlmsg_free(msg);
2554 return 0;
2555 }
2556
2557
2558 struct wiphy_info_data {
2559 struct wpa_driver_nl80211_data *drv;
2560 struct wpa_driver_capa *capa;
2561
2562 unsigned int error:1;
2563 unsigned int device_ap_sme:1;
2564 unsigned int poll_command_supported:1;
2565 unsigned int data_tx_status:1;
2566 unsigned int monitor_supported:1;
2567 unsigned int auth_supported:1;
2568 unsigned int connect_supported:1;
2569 unsigned int p2p_go_supported:1;
2570 unsigned int p2p_client_supported:1;
2571 unsigned int p2p_concurrent:1;
2572 unsigned int p2p_multichan_concurrent:1;
2573 };
2574
2575
probe_resp_offload_support(int supp_protocols)2576 static unsigned int probe_resp_offload_support(int supp_protocols)
2577 {
2578 unsigned int prot = 0;
2579
2580 if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS)
2581 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS;
2582 if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_WPS2)
2583 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2;
2584 if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_P2P)
2585 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P;
2586 if (supp_protocols & NL80211_PROBE_RESP_OFFLOAD_SUPPORT_80211U)
2587 prot |= WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING;
2588
2589 return prot;
2590 }
2591
2592
wiphy_info_supported_iftypes(struct wiphy_info_data * info,struct nlattr * tb)2593 static void wiphy_info_supported_iftypes(struct wiphy_info_data *info,
2594 struct nlattr *tb)
2595 {
2596 struct nlattr *nl_mode;
2597 int i;
2598
2599 if (tb == NULL)
2600 return;
2601
2602 nla_for_each_nested(nl_mode, tb, i) {
2603 switch (nla_type(nl_mode)) {
2604 case NL80211_IFTYPE_AP:
2605 info->capa->flags |= WPA_DRIVER_FLAGS_AP;
2606 break;
2607 case NL80211_IFTYPE_ADHOC:
2608 info->capa->flags |= WPA_DRIVER_FLAGS_IBSS;
2609 break;
2610 case NL80211_IFTYPE_P2P_GO:
2611 info->p2p_go_supported = 1;
2612 break;
2613 case NL80211_IFTYPE_P2P_CLIENT:
2614 info->p2p_client_supported = 1;
2615 break;
2616 case NL80211_IFTYPE_MONITOR:
2617 info->monitor_supported = 1;
2618 break;
2619 }
2620 }
2621 }
2622
2623
wiphy_info_iface_comb_process(struct wiphy_info_data * info,struct nlattr * nl_combi)2624 static int wiphy_info_iface_comb_process(struct wiphy_info_data *info,
2625 struct nlattr *nl_combi)
2626 {
2627 struct nlattr *tb_comb[NUM_NL80211_IFACE_COMB];
2628 struct nlattr *tb_limit[NUM_NL80211_IFACE_LIMIT];
2629 struct nlattr *nl_limit, *nl_mode;
2630 int err, rem_limit, rem_mode;
2631 int combination_has_p2p = 0, combination_has_mgd = 0;
2632 static struct nla_policy
2633 iface_combination_policy[NUM_NL80211_IFACE_COMB] = {
2634 [NL80211_IFACE_COMB_LIMITS] = { .type = NLA_NESTED },
2635 [NL80211_IFACE_COMB_MAXNUM] = { .type = NLA_U32 },
2636 [NL80211_IFACE_COMB_STA_AP_BI_MATCH] = { .type = NLA_FLAG },
2637 [NL80211_IFACE_COMB_NUM_CHANNELS] = { .type = NLA_U32 },
2638 },
2639 iface_limit_policy[NUM_NL80211_IFACE_LIMIT] = {
2640 [NL80211_IFACE_LIMIT_TYPES] = { .type = NLA_NESTED },
2641 [NL80211_IFACE_LIMIT_MAX] = { .type = NLA_U32 },
2642 };
2643
2644 err = nla_parse_nested(tb_comb, MAX_NL80211_IFACE_COMB,
2645 nl_combi, iface_combination_policy);
2646 if (err || !tb_comb[NL80211_IFACE_COMB_LIMITS] ||
2647 !tb_comb[NL80211_IFACE_COMB_MAXNUM] ||
2648 !tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS])
2649 return 0; /* broken combination */
2650
2651 nla_for_each_nested(nl_limit, tb_comb[NL80211_IFACE_COMB_LIMITS],
2652 rem_limit) {
2653 err = nla_parse_nested(tb_limit, MAX_NL80211_IFACE_LIMIT,
2654 nl_limit, iface_limit_policy);
2655 if (err || !tb_limit[NL80211_IFACE_LIMIT_TYPES])
2656 return 0; /* broken combination */
2657
2658 nla_for_each_nested(nl_mode,
2659 tb_limit[NL80211_IFACE_LIMIT_TYPES],
2660 rem_mode) {
2661 int ift = nla_type(nl_mode);
2662 if (ift == NL80211_IFTYPE_P2P_GO ||
2663 ift == NL80211_IFTYPE_P2P_CLIENT)
2664 combination_has_p2p = 1;
2665 if (ift == NL80211_IFTYPE_STATION)
2666 combination_has_mgd = 1;
2667 }
2668 if (combination_has_p2p && combination_has_mgd)
2669 break;
2670 }
2671
2672 if (combination_has_p2p && combination_has_mgd) {
2673 info->p2p_concurrent = 1;
2674 if (nla_get_u32(tb_comb[NL80211_IFACE_COMB_NUM_CHANNELS]) > 1)
2675 info->p2p_multichan_concurrent = 1;
2676 return 1;
2677 }
2678
2679 return 0;
2680 }
2681
2682
wiphy_info_iface_comb(struct wiphy_info_data * info,struct nlattr * tb)2683 static void wiphy_info_iface_comb(struct wiphy_info_data *info,
2684 struct nlattr *tb)
2685 {
2686 struct nlattr *nl_combi;
2687 int rem_combi;
2688
2689 if (tb == NULL)
2690 return;
2691
2692 nla_for_each_nested(nl_combi, tb, rem_combi) {
2693 if (wiphy_info_iface_comb_process(info, nl_combi) > 0)
2694 break;
2695 }
2696 }
2697
2698
wiphy_info_supp_cmds(struct wiphy_info_data * info,struct nlattr * tb)2699 static void wiphy_info_supp_cmds(struct wiphy_info_data *info,
2700 struct nlattr *tb)
2701 {
2702 struct nlattr *nl_cmd;
2703 int i;
2704
2705 if (tb == NULL)
2706 return;
2707
2708 nla_for_each_nested(nl_cmd, tb, i) {
2709 switch (nla_get_u32(nl_cmd)) {
2710 case NL80211_CMD_AUTHENTICATE:
2711 info->auth_supported = 1;
2712 break;
2713 case NL80211_CMD_CONNECT:
2714 info->connect_supported = 1;
2715 break;
2716 case NL80211_CMD_START_SCHED_SCAN:
2717 info->capa->sched_scan_supported = 1;
2718 break;
2719 case NL80211_CMD_PROBE_CLIENT:
2720 info->poll_command_supported = 1;
2721 break;
2722 }
2723 }
2724 }
2725
2726
wiphy_info_max_roc(struct wpa_driver_capa * capa,struct nlattr * tb)2727 static void wiphy_info_max_roc(struct wpa_driver_capa *capa,
2728 struct nlattr *tb)
2729 {
2730 /* default to 5000 since early versions of mac80211 don't set it */
2731 capa->max_remain_on_chan = 5000;
2732
2733 if (tb)
2734 capa->max_remain_on_chan = nla_get_u32(tb);
2735 }
2736
2737
wiphy_info_tdls(struct wpa_driver_capa * capa,struct nlattr * tdls,struct nlattr * ext_setup)2738 static void wiphy_info_tdls(struct wpa_driver_capa *capa, struct nlattr *tdls,
2739 struct nlattr *ext_setup)
2740 {
2741 if (tdls == NULL)
2742 return;
2743
2744 wpa_printf(MSG_DEBUG, "nl80211: TDLS supported");
2745 capa->flags |= WPA_DRIVER_FLAGS_TDLS_SUPPORT;
2746
2747 if (ext_setup) {
2748 wpa_printf(MSG_DEBUG, "nl80211: TDLS external setup");
2749 capa->flags |= WPA_DRIVER_FLAGS_TDLS_EXTERNAL_SETUP;
2750 }
2751 }
2752
2753
wiphy_info_feature_flags(struct wiphy_info_data * info,struct nlattr * tb)2754 static void wiphy_info_feature_flags(struct wiphy_info_data *info,
2755 struct nlattr *tb)
2756 {
2757 u32 flags;
2758 struct wpa_driver_capa *capa = info->capa;
2759
2760 if (tb == NULL)
2761 return;
2762
2763 flags = nla_get_u32(tb);
2764
2765 if (flags & NL80211_FEATURE_SK_TX_STATUS)
2766 info->data_tx_status = 1;
2767
2768 if (flags & NL80211_FEATURE_INACTIVITY_TIMER)
2769 capa->flags |= WPA_DRIVER_FLAGS_INACTIVITY_TIMER;
2770
2771 if (flags & NL80211_FEATURE_SAE)
2772 capa->flags |= WPA_DRIVER_FLAGS_SAE;
2773
2774 if (flags & NL80211_FEATURE_NEED_OBSS_SCAN)
2775 capa->flags |= WPA_DRIVER_FLAGS_OBSS_SCAN;
2776 }
2777
2778
wiphy_info_probe_resp_offload(struct wpa_driver_capa * capa,struct nlattr * tb)2779 static void wiphy_info_probe_resp_offload(struct wpa_driver_capa *capa,
2780 struct nlattr *tb)
2781 {
2782 u32 protocols;
2783
2784 if (tb == NULL)
2785 return;
2786
2787 protocols = nla_get_u32(tb);
2788 wpa_printf(MSG_DEBUG, "nl80211: Supports Probe Response offload in AP "
2789 "mode");
2790 capa->flags |= WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD;
2791 capa->probe_resp_offloads = probe_resp_offload_support(protocols);
2792 }
2793
2794
wiphy_info_handler(struct nl_msg * msg,void * arg)2795 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
2796 {
2797 struct nlattr *tb[NL80211_ATTR_MAX + 1];
2798 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2799 struct wiphy_info_data *info = arg;
2800 struct wpa_driver_capa *capa = info->capa;
2801 struct wpa_driver_nl80211_data *drv = info->drv;
2802
2803 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2804 genlmsg_attrlen(gnlh, 0), NULL);
2805
2806 if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
2807 capa->max_scan_ssids =
2808 nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
2809
2810 if (tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS])
2811 capa->max_sched_scan_ssids =
2812 nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS]);
2813
2814 if (tb[NL80211_ATTR_MAX_MATCH_SETS])
2815 capa->max_match_sets =
2816 nla_get_u8(tb[NL80211_ATTR_MAX_MATCH_SETS]);
2817
2818 wiphy_info_supported_iftypes(info, tb[NL80211_ATTR_SUPPORTED_IFTYPES]);
2819 wiphy_info_iface_comb(info, tb[NL80211_ATTR_INTERFACE_COMBINATIONS]);
2820 wiphy_info_supp_cmds(info, tb[NL80211_ATTR_SUPPORTED_COMMANDS]);
2821
2822 if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) {
2823 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based "
2824 "off-channel TX");
2825 capa->flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX;
2826 }
2827
2828 if (tb[NL80211_ATTR_ROAM_SUPPORT]) {
2829 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based roaming");
2830 capa->flags |= WPA_DRIVER_FLAGS_BSS_SELECTION;
2831 }
2832
2833 wiphy_info_max_roc(capa,
2834 tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]);
2835
2836 if (tb[NL80211_ATTR_SUPPORT_AP_UAPSD])
2837 capa->flags |= WPA_DRIVER_FLAGS_AP_UAPSD;
2838
2839 wiphy_info_tdls(capa, tb[NL80211_ATTR_TDLS_SUPPORT],
2840 tb[NL80211_ATTR_TDLS_EXTERNAL_SETUP]);
2841
2842 if (tb[NL80211_ATTR_DEVICE_AP_SME])
2843 info->device_ap_sme = 1;
2844
2845 wiphy_info_feature_flags(info, tb[NL80211_ATTR_FEATURE_FLAGS]);
2846 wiphy_info_probe_resp_offload(capa,
2847 tb[NL80211_ATTR_PROBE_RESP_OFFLOAD]);
2848
2849 if (tb[NL80211_ATTR_EXT_CAPA] && tb[NL80211_ATTR_EXT_CAPA_MASK] &&
2850 drv->extended_capa == NULL) {
2851 drv->extended_capa =
2852 os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
2853 if (drv->extended_capa) {
2854 os_memcpy(drv->extended_capa,
2855 nla_data(tb[NL80211_ATTR_EXT_CAPA]),
2856 nla_len(tb[NL80211_ATTR_EXT_CAPA]));
2857 drv->extended_capa_len =
2858 nla_len(tb[NL80211_ATTR_EXT_CAPA]);
2859 }
2860 drv->extended_capa_mask =
2861 os_malloc(nla_len(tb[NL80211_ATTR_EXT_CAPA]));
2862 if (drv->extended_capa_mask) {
2863 os_memcpy(drv->extended_capa_mask,
2864 nla_data(tb[NL80211_ATTR_EXT_CAPA]),
2865 nla_len(tb[NL80211_ATTR_EXT_CAPA]));
2866 } else {
2867 os_free(drv->extended_capa);
2868 drv->extended_capa = NULL;
2869 drv->extended_capa_len = 0;
2870 }
2871 }
2872
2873 return NL_SKIP;
2874 }
2875
2876
wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data * drv,struct wiphy_info_data * info)2877 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
2878 struct wiphy_info_data *info)
2879 {
2880 u32 feat;
2881 struct nl_msg *msg;
2882
2883 os_memset(info, 0, sizeof(*info));
2884 info->capa = &drv->capa;
2885 info->drv = drv;
2886
2887 msg = nlmsg_alloc();
2888 if (!msg)
2889 return -1;
2890
2891 feat = get_nl80211_protocol_features(drv);
2892 if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
2893 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
2894 else
2895 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
2896
2897 NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
2898 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->first_bss.ifindex);
2899
2900 if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info))
2901 return -1;
2902
2903 if (info->auth_supported)
2904 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
2905 else if (!info->connect_supported) {
2906 wpa_printf(MSG_INFO, "nl80211: Driver does not support "
2907 "authentication/association or connect commands");
2908 info->error = 1;
2909 }
2910
2911 if (info->p2p_go_supported && info->p2p_client_supported)
2912 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE;
2913 if (info->p2p_concurrent) {
2914 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
2915 "interface (driver advertised support)");
2916 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
2917 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
2918 }
2919 if (info->p2p_multichan_concurrent) {
2920 wpa_printf(MSG_DEBUG, "nl80211: Enable multi-channel "
2921 "concurrent (driver advertised support)");
2922 drv->capa.flags |= WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT;
2923 }
2924 return 0;
2925 nla_put_failure:
2926 nlmsg_free(msg);
2927 return -1;
2928 }
2929
2930
wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data * drv)2931 static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
2932 {
2933 struct wiphy_info_data info;
2934 if (wpa_driver_nl80211_get_info(drv, &info))
2935 return -1;
2936
2937 if (info.error)
2938 return -1;
2939
2940 drv->has_capability = 1;
2941 /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
2942 drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
2943 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
2944 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
2945 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
2946 drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
2947 WPA_DRIVER_CAPA_ENC_WEP104 |
2948 WPA_DRIVER_CAPA_ENC_TKIP |
2949 WPA_DRIVER_CAPA_ENC_CCMP;
2950 drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
2951 WPA_DRIVER_AUTH_SHARED |
2952 WPA_DRIVER_AUTH_LEAP;
2953
2954 drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES;
2955 drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE;
2956 drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
2957
2958 if (!info.device_ap_sme) {
2959 drv->capa.flags |= WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS;
2960
2961 /*
2962 * No AP SME is currently assumed to also indicate no AP MLME
2963 * in the driver/firmware.
2964 */
2965 drv->capa.flags |= WPA_DRIVER_FLAGS_AP_MLME;
2966 }
2967
2968 drv->device_ap_sme = info.device_ap_sme;
2969 drv->poll_command_supported = info.poll_command_supported;
2970 drv->data_tx_status = info.data_tx_status;
2971
2972 #ifdef ANDROID_P2P
2973 if(drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) {
2974 /* Driver is new enough to support monitorless mode*/
2975 wpa_printf(MSG_DEBUG, "nl80211: Driver is new "
2976 "enough to support monitor-less mode");
2977 drv->use_monitor = 0;
2978 }
2979 #else
2980 /*
2981 * If poll command and tx status are supported, mac80211 is new enough
2982 * to have everything we need to not need monitor interfaces.
2983 */
2984 drv->use_monitor = !info.poll_command_supported || !info.data_tx_status;
2985 #endif
2986
2987 if (drv->device_ap_sme && drv->use_monitor) {
2988 /*
2989 * Non-mac80211 drivers may not support monitor interface.
2990 * Make sure we do not get stuck with incorrect capability here
2991 * by explicitly testing this.
2992 */
2993 if (!info.monitor_supported) {
2994 wpa_printf(MSG_DEBUG, "nl80211: Disable use_monitor "
2995 "with device_ap_sme since no monitor mode "
2996 "support detected");
2997 drv->use_monitor = 0;
2998 }
2999 }
3000
3001 /*
3002 * If we aren't going to use monitor interfaces, but the
3003 * driver doesn't support data TX status, we won't get TX
3004 * status for EAPOL frames.
3005 */
3006 if (!drv->use_monitor && !info.data_tx_status)
3007 drv->capa.flags &= ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3008
3009 return 0;
3010 }
3011
3012
3013 #ifdef ANDROID
android_genl_ctrl_resolve(struct nl_handle * handle,const char * name)3014 static int android_genl_ctrl_resolve(struct nl_handle *handle,
3015 const char *name)
3016 {
3017 /*
3018 * Android ICS has very minimal genl_ctrl_resolve() implementation, so
3019 * need to work around that.
3020 */
3021 struct nl_cache *cache = NULL;
3022 struct genl_family *nl80211 = NULL;
3023 int id = -1;
3024
3025 if (genl_ctrl_alloc_cache(handle, &cache) < 0) {
3026 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
3027 "netlink cache");
3028 goto fail;
3029 }
3030
3031 nl80211 = genl_ctrl_search_by_name(cache, name);
3032 if (nl80211 == NULL)
3033 goto fail;
3034
3035 id = genl_family_get_id(nl80211);
3036
3037 fail:
3038 if (nl80211)
3039 genl_family_put(nl80211);
3040 if (cache)
3041 nl_cache_free(cache);
3042
3043 return id;
3044 }
3045 #define genl_ctrl_resolve android_genl_ctrl_resolve
3046 #endif /* ANDROID */
3047
3048
wpa_driver_nl80211_init_nl_global(struct nl80211_global * global)3049 static int wpa_driver_nl80211_init_nl_global(struct nl80211_global *global)
3050 {
3051 int ret;
3052
3053 global->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3054 if (global->nl_cb == NULL) {
3055 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
3056 "callbacks");
3057 return -1;
3058 }
3059
3060 global->nl = nl_create_handle(global->nl_cb, "nl");
3061 if (global->nl == NULL)
3062 goto err;
3063
3064 global->nl80211_id = genl_ctrl_resolve(global->nl, "nl80211");
3065 if (global->nl80211_id < 0) {
3066 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
3067 "found");
3068 goto err;
3069 }
3070
3071 global->nl_event = nl_create_handle(global->nl_cb, "event");
3072 if (global->nl_event == NULL)
3073 goto err;
3074
3075 ret = nl_get_multicast_id(global, "nl80211", "scan");
3076 if (ret >= 0)
3077 ret = nl_socket_add_membership(global->nl_event, ret);
3078 if (ret < 0) {
3079 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
3080 "membership for scan events: %d (%s)",
3081 ret, strerror(-ret));
3082 goto err;
3083 }
3084
3085 ret = nl_get_multicast_id(global, "nl80211", "mlme");
3086 if (ret >= 0)
3087 ret = nl_socket_add_membership(global->nl_event, ret);
3088 if (ret < 0) {
3089 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
3090 "membership for mlme events: %d (%s)",
3091 ret, strerror(-ret));
3092 goto err;
3093 }
3094
3095 ret = nl_get_multicast_id(global, "nl80211", "regulatory");
3096 if (ret >= 0)
3097 ret = nl_socket_add_membership(global->nl_event, ret);
3098 if (ret < 0) {
3099 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
3100 "membership for regulatory events: %d (%s)",
3101 ret, strerror(-ret));
3102 /* Continue without regulatory events */
3103 }
3104
3105 nl_cb_set(global->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3106 no_seq_check, NULL);
3107 nl_cb_set(global->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3108 process_global_event, global);
3109
3110 eloop_register_read_sock(nl_socket_get_fd(global->nl_event),
3111 wpa_driver_nl80211_event_receive,
3112 global->nl_cb, global->nl_event);
3113
3114 return 0;
3115
3116 err:
3117 nl_destroy_handles(&global->nl_event);
3118 nl_destroy_handles(&global->nl);
3119 nl_cb_put(global->nl_cb);
3120 global->nl_cb = NULL;
3121 return -1;
3122 }
3123
3124
wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data * drv)3125 static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv)
3126 {
3127 drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3128 if (!drv->nl_cb) {
3129 wpa_printf(MSG_ERROR, "nl80211: Failed to alloc cb struct");
3130 return -1;
3131 }
3132
3133 nl_cb_set(drv->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3134 no_seq_check, NULL);
3135 nl_cb_set(drv->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3136 process_drv_event, drv);
3137
3138 return 0;
3139 }
3140
3141
wpa_driver_nl80211_rfkill_blocked(void * ctx)3142 static void wpa_driver_nl80211_rfkill_blocked(void *ctx)
3143 {
3144 wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked");
3145 /*
3146 * This may be for any interface; use ifdown event to disable
3147 * interface.
3148 */
3149 }
3150
3151
wpa_driver_nl80211_rfkill_unblocked(void * ctx)3152 static void wpa_driver_nl80211_rfkill_unblocked(void *ctx)
3153 {
3154 struct wpa_driver_nl80211_data *drv = ctx;
3155 wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked");
3156 if (linux_set_iface_flags(drv->global->ioctl_sock,
3157 drv->first_bss.ifname, 1)) {
3158 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP "
3159 "after rfkill unblock");
3160 return;
3161 }
3162 /* rtnetlink ifup handler will report interface as enabled */
3163 }
3164
3165
nl80211_get_phy_name(struct wpa_driver_nl80211_data * drv)3166 static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv)
3167 {
3168 /* Find phy (radio) to which this interface belongs */
3169 char buf[90], *pos;
3170 int f, rv;
3171
3172 drv->phyname[0] = '\0';
3173 snprintf(buf, sizeof(buf) - 1, "/sys/class/net/%s/phy80211/name",
3174 drv->first_bss.ifname);
3175 f = open(buf, O_RDONLY);
3176 if (f < 0) {
3177 wpa_printf(MSG_DEBUG, "Could not open file %s: %s",
3178 buf, strerror(errno));
3179 return;
3180 }
3181
3182 rv = read(f, drv->phyname, sizeof(drv->phyname) - 1);
3183 close(f);
3184 if (rv < 0) {
3185 wpa_printf(MSG_DEBUG, "Could not read file %s: %s",
3186 buf, strerror(errno));
3187 return;
3188 }
3189
3190 drv->phyname[rv] = '\0';
3191 pos = os_strchr(drv->phyname, '\n');
3192 if (pos)
3193 *pos = '\0';
3194 wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s",
3195 drv->first_bss.ifname, drv->phyname);
3196 }
3197
3198
wpa_driver_nl80211_handle_eapol_tx_status(int sock,void * eloop_ctx,void * handle)3199 static void wpa_driver_nl80211_handle_eapol_tx_status(int sock,
3200 void *eloop_ctx,
3201 void *handle)
3202 {
3203 struct wpa_driver_nl80211_data *drv = eloop_ctx;
3204 u8 data[2048];
3205 struct msghdr msg;
3206 struct iovec entry;
3207 u8 control[512];
3208 struct cmsghdr *cmsg;
3209 int res, found_ee = 0, found_wifi = 0, acked = 0;
3210 union wpa_event_data event;
3211
3212 memset(&msg, 0, sizeof(msg));
3213 msg.msg_iov = &entry;
3214 msg.msg_iovlen = 1;
3215 entry.iov_base = data;
3216 entry.iov_len = sizeof(data);
3217 msg.msg_control = &control;
3218 msg.msg_controllen = sizeof(control);
3219
3220 res = recvmsg(sock, &msg, MSG_ERRQUEUE);
3221 /* if error or not fitting 802.3 header, return */
3222 if (res < 14)
3223 return;
3224
3225 for (cmsg = CMSG_FIRSTHDR(&msg); cmsg; cmsg = CMSG_NXTHDR(&msg, cmsg))
3226 {
3227 if (cmsg->cmsg_level == SOL_SOCKET &&
3228 cmsg->cmsg_type == SCM_WIFI_STATUS) {
3229 int *ack;
3230
3231 found_wifi = 1;
3232 ack = (void *)CMSG_DATA(cmsg);
3233 acked = *ack;
3234 }
3235
3236 if (cmsg->cmsg_level == SOL_PACKET &&
3237 cmsg->cmsg_type == PACKET_TX_TIMESTAMP) {
3238 struct sock_extended_err *err =
3239 (struct sock_extended_err *)CMSG_DATA(cmsg);
3240
3241 if (err->ee_origin == SO_EE_ORIGIN_TXSTATUS)
3242 found_ee = 1;
3243 }
3244 }
3245
3246 if (!found_ee || !found_wifi)
3247 return;
3248
3249 memset(&event, 0, sizeof(event));
3250 event.eapol_tx_status.dst = data;
3251 event.eapol_tx_status.data = data + 14;
3252 event.eapol_tx_status.data_len = res - 14;
3253 event.eapol_tx_status.ack = acked;
3254 wpa_supplicant_event(drv->ctx, EVENT_EAPOL_TX_STATUS, &event);
3255 }
3256
3257
nl80211_init_bss(struct i802_bss * bss)3258 static int nl80211_init_bss(struct i802_bss *bss)
3259 {
3260 bss->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
3261 if (!bss->nl_cb)
3262 return -1;
3263
3264 nl_cb_set(bss->nl_cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM,
3265 no_seq_check, NULL);
3266 nl_cb_set(bss->nl_cb, NL_CB_VALID, NL_CB_CUSTOM,
3267 process_bss_event, bss);
3268
3269 return 0;
3270 }
3271
3272
nl80211_destroy_bss(struct i802_bss * bss)3273 static void nl80211_destroy_bss(struct i802_bss *bss)
3274 {
3275 nl_cb_put(bss->nl_cb);
3276 bss->nl_cb = NULL;
3277 }
3278
3279
3280 /**
3281 * wpa_driver_nl80211_init - Initialize nl80211 driver interface
3282 * @ctx: context to be used when calling wpa_supplicant functions,
3283 * e.g., wpa_supplicant_event()
3284 * @ifname: interface name, e.g., wlan0
3285 * @global_priv: private driver global data from global_init()
3286 * Returns: Pointer to private data, %NULL on failure
3287 */
wpa_driver_nl80211_init(void * ctx,const char * ifname,void * global_priv)3288 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname,
3289 void *global_priv)
3290 {
3291 struct wpa_driver_nl80211_data *drv;
3292 struct rfkill_config *rcfg;
3293 struct i802_bss *bss;
3294
3295 if (global_priv == NULL)
3296 return NULL;
3297 drv = os_zalloc(sizeof(*drv));
3298 if (drv == NULL)
3299 return NULL;
3300 drv->global = global_priv;
3301 drv->ctx = ctx;
3302 bss = &drv->first_bss;
3303 bss->drv = drv;
3304 bss->ctx = ctx;
3305
3306 os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname));
3307 drv->monitor_ifidx = -1;
3308 drv->monitor_sock = -1;
3309 drv->eapol_tx_sock = -1;
3310 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3311
3312 if (wpa_driver_nl80211_init_nl(drv)) {
3313 os_free(drv);
3314 return NULL;
3315 }
3316
3317 if (nl80211_init_bss(bss))
3318 goto failed;
3319
3320 nl80211_get_phy_name(drv);
3321
3322 rcfg = os_zalloc(sizeof(*rcfg));
3323 if (rcfg == NULL)
3324 goto failed;
3325 rcfg->ctx = drv;
3326 os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname));
3327 rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked;
3328 rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked;
3329 drv->rfkill = rfkill_init(rcfg);
3330 if (drv->rfkill == NULL) {
3331 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available");
3332 os_free(rcfg);
3333 }
3334
3335 if (wpa_driver_nl80211_finish_drv_init(drv))
3336 goto failed;
3337
3338 drv->eapol_tx_sock = socket(PF_PACKET, SOCK_DGRAM, 0);
3339 if (drv->eapol_tx_sock < 0)
3340 goto failed;
3341
3342 if (drv->data_tx_status) {
3343 int enabled = 1;
3344
3345 if (setsockopt(drv->eapol_tx_sock, SOL_SOCKET, SO_WIFI_STATUS,
3346 &enabled, sizeof(enabled)) < 0) {
3347 wpa_printf(MSG_DEBUG,
3348 "nl80211: wifi status sockopt failed\n");
3349 drv->data_tx_status = 0;
3350 if (!drv->use_monitor)
3351 drv->capa.flags &=
3352 ~WPA_DRIVER_FLAGS_EAPOL_TX_STATUS;
3353 } else {
3354 eloop_register_read_sock(drv->eapol_tx_sock,
3355 wpa_driver_nl80211_handle_eapol_tx_status,
3356 drv, NULL);
3357 }
3358 }
3359
3360 if (drv->global) {
3361 dl_list_add(&drv->global->interfaces, &drv->list);
3362 drv->in_interface_list = 1;
3363 }
3364
3365 return bss;
3366
3367 failed:
3368 wpa_driver_nl80211_deinit(bss);
3369 return NULL;
3370 }
3371
3372
nl80211_register_frame(struct i802_bss * bss,struct nl_handle * nl_handle,u16 type,const u8 * match,size_t match_len)3373 static int nl80211_register_frame(struct i802_bss *bss,
3374 struct nl_handle *nl_handle,
3375 u16 type, const u8 *match, size_t match_len)
3376 {
3377 struct wpa_driver_nl80211_data *drv = bss->drv;
3378 struct nl_msg *msg;
3379 int ret = -1;
3380
3381 msg = nlmsg_alloc();
3382 if (!msg)
3383 return -1;
3384
3385 wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x nl_handle=%p",
3386 type, nl_handle);
3387 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3388 match, match_len);
3389
3390 nl80211_cmd(drv, msg, 0, NL80211_CMD_REGISTER_ACTION);
3391
3392 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3393 NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type);
3394 NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match);
3395
3396 ret = send_and_recv(drv->global, nl_handle, msg, NULL, NULL);
3397 msg = NULL;
3398 if (ret) {
3399 wpa_printf(MSG_DEBUG, "nl80211: Register frame command "
3400 "failed (type=%u): ret=%d (%s)",
3401 type, ret, strerror(-ret));
3402 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match",
3403 match, match_len);
3404 goto nla_put_failure;
3405 }
3406 ret = 0;
3407 nla_put_failure:
3408 nlmsg_free(msg);
3409 return ret;
3410 }
3411
3412
nl80211_alloc_mgmt_handle(struct i802_bss * bss)3413 static int nl80211_alloc_mgmt_handle(struct i802_bss *bss)
3414 {
3415 struct wpa_driver_nl80211_data *drv = bss->drv;
3416
3417 if (bss->nl_mgmt) {
3418 wpa_printf(MSG_DEBUG, "nl80211: Mgmt reporting "
3419 "already on! (nl_mgmt=%p)", bss->nl_mgmt);
3420 return -1;
3421 }
3422
3423 bss->nl_mgmt = nl_create_handle(drv->nl_cb, "mgmt");
3424 if (bss->nl_mgmt == NULL)
3425 return -1;
3426
3427 eloop_register_read_sock(nl_socket_get_fd(bss->nl_mgmt),
3428 wpa_driver_nl80211_event_receive, bss->nl_cb,
3429 bss->nl_mgmt);
3430
3431 return 0;
3432 }
3433
3434
nl80211_register_action_frame(struct i802_bss * bss,const u8 * match,size_t match_len)3435 static int nl80211_register_action_frame(struct i802_bss *bss,
3436 const u8 *match, size_t match_len)
3437 {
3438 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4);
3439 return nl80211_register_frame(bss, bss->nl_mgmt,
3440 type, match, match_len);
3441 }
3442
3443
nl80211_mgmt_subscribe_non_ap(struct i802_bss * bss)3444 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
3445 {
3446 struct wpa_driver_nl80211_data *drv = bss->drv;
3447
3448 if (nl80211_alloc_mgmt_handle(bss))
3449 return -1;
3450 wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
3451 "handle %p", bss->nl_mgmt);
3452
3453 #if defined(CONFIG_P2P) || defined(CONFIG_INTERWORKING)
3454 /* GAS Initial Request */
3455 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0a", 2) < 0)
3456 return -1;
3457 /* GAS Initial Response */
3458 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0b", 2) < 0)
3459 return -1;
3460 /* GAS Comeback Request */
3461 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0c", 2) < 0)
3462 return -1;
3463 /* GAS Comeback Response */
3464 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0d", 2) < 0)
3465 return -1;
3466 #endif /* CONFIG_P2P || CONFIG_INTERWORKING */
3467 #ifdef CONFIG_P2P
3468 /* P2P Public Action */
3469 if (nl80211_register_action_frame(bss,
3470 (u8 *) "\x04\x09\x50\x6f\x9a\x09",
3471 6) < 0)
3472 return -1;
3473 /* P2P Action */
3474 if (nl80211_register_action_frame(bss,
3475 (u8 *) "\x7f\x50\x6f\x9a\x09",
3476 5) < 0)
3477 return -1;
3478 #endif /* CONFIG_P2P */
3479 #ifdef CONFIG_IEEE80211W
3480 /* SA Query Response */
3481 if (nl80211_register_action_frame(bss, (u8 *) "\x08\x01", 2) < 0)
3482 return -1;
3483 #endif /* CONFIG_IEEE80211W */
3484 #ifdef CONFIG_TDLS
3485 if ((drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT)) {
3486 /* TDLS Discovery Response */
3487 if (nl80211_register_action_frame(bss, (u8 *) "\x04\x0e", 2) <
3488 0)
3489 return -1;
3490 }
3491 #endif /* CONFIG_TDLS */
3492
3493 /* FT Action frames */
3494 if (nl80211_register_action_frame(bss, (u8 *) "\x06", 1) < 0)
3495 return -1;
3496 else
3497 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT |
3498 WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK;
3499
3500 /* WNM - BSS Transition Management Request */
3501 if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x07", 2) < 0)
3502 return -1;
3503 /* WNM-Sleep Mode Response */
3504 if (nl80211_register_action_frame(bss, (u8 *) "\x0a\x11", 2) < 0)
3505 return -1;
3506
3507 return 0;
3508 }
3509
3510
nl80211_register_spurious_class3(struct i802_bss * bss)3511 static int nl80211_register_spurious_class3(struct i802_bss *bss)
3512 {
3513 struct wpa_driver_nl80211_data *drv = bss->drv;
3514 struct nl_msg *msg;
3515 int ret = -1;
3516
3517 msg = nlmsg_alloc();
3518 if (!msg)
3519 return -1;
3520
3521 nl80211_cmd(drv, msg, 0, NL80211_CMD_UNEXPECTED_FRAME);
3522
3523 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
3524
3525 ret = send_and_recv(drv->global, bss->nl_mgmt, msg, NULL, NULL);
3526 msg = NULL;
3527 if (ret) {
3528 wpa_printf(MSG_DEBUG, "nl80211: Register spurious class3 "
3529 "failed: ret=%d (%s)",
3530 ret, strerror(-ret));
3531 goto nla_put_failure;
3532 }
3533 ret = 0;
3534 nla_put_failure:
3535 nlmsg_free(msg);
3536 return ret;
3537 }
3538
3539
nl80211_mgmt_subscribe_ap(struct i802_bss * bss)3540 static int nl80211_mgmt_subscribe_ap(struct i802_bss *bss)
3541 {
3542 static const int stypes[] = {
3543 WLAN_FC_STYPE_AUTH,
3544 WLAN_FC_STYPE_ASSOC_REQ,
3545 WLAN_FC_STYPE_REASSOC_REQ,
3546 WLAN_FC_STYPE_DISASSOC,
3547 WLAN_FC_STYPE_DEAUTH,
3548 WLAN_FC_STYPE_ACTION,
3549 WLAN_FC_STYPE_PROBE_REQ,
3550 /* Beacon doesn't work as mac80211 doesn't currently allow
3551 * it, but it wouldn't really be the right thing anyway as
3552 * it isn't per interface ... maybe just dump the scan
3553 * results periodically for OLBC?
3554 */
3555 // WLAN_FC_STYPE_BEACON,
3556 };
3557 unsigned int i;
3558
3559 if (nl80211_alloc_mgmt_handle(bss))
3560 return -1;
3561 wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3562 "handle %p", bss->nl_mgmt);
3563
3564 for (i = 0; i < sizeof(stypes) / sizeof(stypes[0]); i++) {
3565 if (nl80211_register_frame(bss, bss->nl_mgmt,
3566 (WLAN_FC_TYPE_MGMT << 2) |
3567 (stypes[i] << 4),
3568 NULL, 0) < 0) {
3569 goto out_err;
3570 }
3571 }
3572
3573 if (nl80211_register_spurious_class3(bss))
3574 goto out_err;
3575
3576 if (nl80211_get_wiphy_data_ap(bss) == NULL)
3577 goto out_err;
3578
3579 return 0;
3580
3581 out_err:
3582 eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3583 nl_destroy_handles(&bss->nl_mgmt);
3584 return -1;
3585 }
3586
3587
nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss * bss)3588 static int nl80211_mgmt_subscribe_ap_dev_sme(struct i802_bss *bss)
3589 {
3590 if (nl80211_alloc_mgmt_handle(bss))
3591 return -1;
3592 wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with AP "
3593 "handle %p (device SME)", bss->nl_mgmt);
3594
3595 if (nl80211_register_frame(bss, bss->nl_mgmt,
3596 (WLAN_FC_TYPE_MGMT << 2) |
3597 (WLAN_FC_STYPE_ACTION << 4),
3598 NULL, 0) < 0)
3599 goto out_err;
3600
3601 return 0;
3602
3603 out_err:
3604 eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3605 nl_destroy_handles(&bss->nl_mgmt);
3606 return -1;
3607 }
3608
3609
nl80211_mgmt_unsubscribe(struct i802_bss * bss,const char * reason)3610 static void nl80211_mgmt_unsubscribe(struct i802_bss *bss, const char *reason)
3611 {
3612 if (bss->nl_mgmt == NULL)
3613 return;
3614 wpa_printf(MSG_DEBUG, "nl80211: Unsubscribe mgmt frames handle %p "
3615 "(%s)", bss->nl_mgmt, reason);
3616 eloop_unregister_read_sock(nl_socket_get_fd(bss->nl_mgmt));
3617 nl_destroy_handles(&bss->nl_mgmt);
3618
3619 nl80211_put_wiphy_data_ap(bss);
3620 }
3621
3622
wpa_driver_nl80211_send_rfkill(void * eloop_ctx,void * timeout_ctx)3623 static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx)
3624 {
3625 wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL);
3626 }
3627
3628
3629 static int
wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data * drv)3630 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
3631 {
3632 struct i802_bss *bss = &drv->first_bss;
3633 int send_rfkill_event = 0;
3634
3635 drv->ifindex = if_nametoindex(bss->ifname);
3636 drv->first_bss.ifindex = drv->ifindex;
3637
3638 #ifndef HOSTAPD
3639 /*
3640 * Make sure the interface starts up in station mode unless this is a
3641 * dynamically added interface (e.g., P2P) that was already configured
3642 * with proper iftype.
3643 */
3644 if (drv->ifindex != drv->global->if_add_ifindex &&
3645 wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION) < 0) {
3646 wpa_printf(MSG_ERROR, "nl80211: Could not configure driver to "
3647 "use managed mode");
3648 return -1;
3649 }
3650
3651 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
3652 if (rfkill_is_blocked(drv->rfkill)) {
3653 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable "
3654 "interface '%s' due to rfkill",
3655 bss->ifname);
3656 drv->if_disabled = 1;
3657 send_rfkill_event = 1;
3658 } else {
3659 wpa_printf(MSG_ERROR, "nl80211: Could not set "
3660 "interface '%s' UP", bss->ifname);
3661 return -1;
3662 }
3663 }
3664
3665 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex,
3666 1, IF_OPER_DORMANT);
3667 #endif /* HOSTAPD */
3668
3669 if (wpa_driver_nl80211_capa(drv))
3670 return -1;
3671
3672 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
3673 bss->addr))
3674 return -1;
3675
3676 if (send_rfkill_event) {
3677 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill,
3678 drv, drv->ctx);
3679 }
3680
3681 return 0;
3682 }
3683
3684
wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data * drv)3685 static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv)
3686 {
3687 struct nl_msg *msg;
3688
3689 msg = nlmsg_alloc();
3690 if (!msg)
3691 return -ENOMEM;
3692
3693 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_BEACON);
3694 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3695
3696 return send_and_recv_msgs(drv, msg, NULL, NULL);
3697 nla_put_failure:
3698 nlmsg_free(msg);
3699 return -ENOBUFS;
3700 }
3701
3702
3703 /**
3704 * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
3705 * @bss: Pointer to private nl80211 data from wpa_driver_nl80211_init()
3706 *
3707 * Shut down driver interface and processing of driver events. Free
3708 * private data buffer if one was allocated in wpa_driver_nl80211_init().
3709 */
wpa_driver_nl80211_deinit(struct i802_bss * bss)3710 static void wpa_driver_nl80211_deinit(struct i802_bss *bss)
3711 {
3712 struct wpa_driver_nl80211_data *drv = bss->drv;
3713
3714 bss->in_deinit = 1;
3715 if (drv->data_tx_status)
3716 eloop_unregister_read_sock(drv->eapol_tx_sock);
3717 if (drv->eapol_tx_sock >= 0)
3718 close(drv->eapol_tx_sock);
3719
3720 if (bss->nl_preq)
3721 wpa_driver_nl80211_probe_req_report(bss, 0);
3722 if (bss->added_if_into_bridge) {
3723 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
3724 bss->ifname) < 0)
3725 wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3726 "interface %s from bridge %s: %s",
3727 bss->ifname, bss->brname, strerror(errno));
3728 }
3729 if (bss->added_bridge) {
3730 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
3731 wpa_printf(MSG_INFO, "nl80211: Failed to remove "
3732 "bridge %s: %s",
3733 bss->brname, strerror(errno));
3734 }
3735
3736 nl80211_remove_monitor_interface(drv);
3737
3738 if (is_ap_interface(drv->nlmode))
3739 wpa_driver_nl80211_del_beacon(drv);
3740
3741 #ifdef HOSTAPD
3742 if (drv->last_freq_ht) {
3743 /* Clear HT flags from the driver */
3744 struct hostapd_freq_params freq;
3745 os_memset(&freq, 0, sizeof(freq));
3746 freq.freq = drv->last_freq;
3747 wpa_driver_nl80211_set_freq(bss, &freq);
3748 }
3749
3750 if (drv->eapol_sock >= 0) {
3751 eloop_unregister_read_sock(drv->eapol_sock);
3752 close(drv->eapol_sock);
3753 }
3754
3755 if (drv->if_indices != drv->default_if_indices)
3756 os_free(drv->if_indices);
3757 #endif /* HOSTAPD */
3758
3759 if (drv->disabled_11b_rates)
3760 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
3761
3762 netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, 0,
3763 IF_OPER_UP);
3764 rfkill_deinit(drv->rfkill);
3765
3766 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3767
3768 (void) linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0);
3769 wpa_driver_nl80211_set_mode(bss, NL80211_IFTYPE_STATION);
3770 nl80211_mgmt_unsubscribe(bss, "deinit");
3771
3772 nl_cb_put(drv->nl_cb);
3773
3774 nl80211_destroy_bss(&drv->first_bss);
3775
3776 os_free(drv->filter_ssids);
3777
3778 os_free(drv->auth_ie);
3779
3780 if (drv->in_interface_list)
3781 dl_list_del(&drv->list);
3782
3783 os_free(drv->extended_capa);
3784 os_free(drv->extended_capa_mask);
3785 os_free(drv);
3786 }
3787
3788
3789 /**
3790 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
3791 * @eloop_ctx: Driver private data
3792 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
3793 *
3794 * This function can be used as registered timeout when starting a scan to
3795 * generate a scan completed event if the driver does not report this.
3796 */
wpa_driver_nl80211_scan_timeout(void * eloop_ctx,void * timeout_ctx)3797 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
3798 {
3799 struct wpa_driver_nl80211_data *drv = eloop_ctx;
3800 if (drv->ap_scan_as_station != NL80211_IFTYPE_UNSPECIFIED) {
3801 wpa_driver_nl80211_set_mode(&drv->first_bss,
3802 drv->ap_scan_as_station);
3803 drv->ap_scan_as_station = NL80211_IFTYPE_UNSPECIFIED;
3804 }
3805 wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
3806 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
3807 }
3808
3809
3810 static struct nl_msg *
nl80211_scan_common(struct wpa_driver_nl80211_data * drv,u8 cmd,struct wpa_driver_scan_params * params)3811 nl80211_scan_common(struct wpa_driver_nl80211_data *drv, u8 cmd,
3812 struct wpa_driver_scan_params *params)
3813 {
3814 struct nl_msg *msg;
3815 int err;
3816 size_t i;
3817
3818 msg = nlmsg_alloc();
3819 if (!msg)
3820 return NULL;
3821
3822 nl80211_cmd(drv, msg, 0, cmd);
3823
3824 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, drv->ifindex) < 0)
3825 goto fail;
3826
3827 if (params->num_ssids) {
3828 struct nl_msg *ssids = nlmsg_alloc();
3829 if (ssids == NULL)
3830 goto fail;
3831 for (i = 0; i < params->num_ssids; i++) {
3832 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID",
3833 params->ssids[i].ssid,
3834 params->ssids[i].ssid_len);
3835 if (nla_put(ssids, i + 1, params->ssids[i].ssid_len,
3836 params->ssids[i].ssid) < 0) {
3837 nlmsg_free(ssids);
3838 goto fail;
3839 }
3840 }
3841 err = nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
3842 nlmsg_free(ssids);
3843 if (err < 0)
3844 goto fail;
3845 }
3846
3847 if (params->extra_ies) {
3848 wpa_hexdump(MSG_MSGDUMP, "nl80211: Scan extra IEs",
3849 params->extra_ies, params->extra_ies_len);
3850 if (nla_put(msg, NL80211_ATTR_IE, params->extra_ies_len,
3851 params->extra_ies) < 0)
3852 goto fail;
3853 }
3854
3855 if (params->freqs) {
3856 struct nl_msg *freqs = nlmsg_alloc();
3857 if (freqs == NULL)
3858 goto fail;
3859 for (i = 0; params->freqs[i]; i++) {
3860 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u "
3861 "MHz", params->freqs[i]);
3862 if (nla_put_u32(freqs, i + 1, params->freqs[i]) < 0) {
3863 nlmsg_free(freqs);
3864 goto fail;
3865 }
3866 }
3867 err = nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES,
3868 freqs);
3869 nlmsg_free(freqs);
3870 if (err < 0)
3871 goto fail;
3872 }
3873
3874 os_free(drv->filter_ssids);
3875 drv->filter_ssids = params->filter_ssids;
3876 params->filter_ssids = NULL;
3877 drv->num_filter_ssids = params->num_filter_ssids;
3878
3879 return msg;
3880
3881 fail:
3882 nlmsg_free(msg);
3883 return NULL;
3884 }
3885
3886
3887 /**
3888 * wpa_driver_nl80211_scan - Request the driver to initiate scan
3889 * @bss: Pointer to private driver data from wpa_driver_nl80211_init()
3890 * @params: Scan parameters
3891 * Returns: 0 on success, -1 on failure
3892 */
wpa_driver_nl80211_scan(struct i802_bss * bss,struct wpa_driver_scan_params * params)3893 static int wpa_driver_nl80211_scan(struct i802_bss *bss,
3894 struct wpa_driver_scan_params *params)
3895 {
3896 struct wpa_driver_nl80211_data *drv = bss->drv;
3897 int ret = -1, timeout;
3898 struct nl_msg *msg, *rates = NULL;
3899
3900 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: scan request");
3901 drv->scan_for_auth = 0;
3902
3903 msg = nl80211_scan_common(drv, NL80211_CMD_TRIGGER_SCAN, params);
3904 if (!msg)
3905 return -1;
3906
3907 if (params->p2p_probe) {
3908 wpa_printf(MSG_DEBUG, "nl80211: P2P probe - mask SuppRates");
3909
3910 rates = nlmsg_alloc();
3911 if (rates == NULL)
3912 goto nla_put_failure;
3913
3914 /*
3915 * Remove 2.4 GHz rates 1, 2, 5.5, 11 Mbps from supported rates
3916 * by masking out everything else apart from the OFDM rates 6,
3917 * 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS rates. All 5 GHz
3918 * rates are left enabled.
3919 */
3920 NLA_PUT(rates, NL80211_BAND_2GHZ, 8,
3921 "\x0c\x12\x18\x24\x30\x48\x60\x6c");
3922 if (nla_put_nested(msg, NL80211_ATTR_SCAN_SUPP_RATES, rates) <
3923 0)
3924 goto nla_put_failure;
3925
3926 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
3927 }
3928
3929 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3930 msg = NULL;
3931 if (ret) {
3932 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
3933 "(%s)", ret, strerror(-ret));
3934 #ifdef HOSTAPD
3935 if (is_ap_interface(drv->nlmode)) {
3936 /*
3937 * mac80211 does not allow scan requests in AP mode, so
3938 * try to do this in station mode.
3939 */
3940 if (wpa_driver_nl80211_set_mode(
3941 bss, NL80211_IFTYPE_STATION))
3942 goto nla_put_failure;
3943
3944 if (wpa_driver_nl80211_scan(bss, params)) {
3945 wpa_driver_nl80211_set_mode(bss, drv->nlmode);
3946 goto nla_put_failure;
3947 }
3948
3949 /* Restore AP mode when processing scan results */
3950 drv->ap_scan_as_station = drv->nlmode;
3951 ret = 0;
3952 } else
3953 goto nla_put_failure;
3954 #else /* HOSTAPD */
3955 goto nla_put_failure;
3956 #endif /* HOSTAPD */
3957 }
3958
3959 /* Not all drivers generate "scan completed" wireless event, so try to
3960 * read results after a timeout. */
3961 timeout = 10;
3962 if (drv->scan_complete_events) {
3963 /*
3964 * The driver seems to deliver events to notify when scan is
3965 * complete, so use longer timeout to avoid race conditions
3966 * with scanning and following association request.
3967 */
3968 timeout = 30;
3969 }
3970 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
3971 "seconds", ret, timeout);
3972 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
3973 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
3974 drv, drv->ctx);
3975
3976 nla_put_failure:
3977 nlmsg_free(msg);
3978 nlmsg_free(rates);
3979 return ret;
3980 }
3981
3982
3983 /**
3984 * wpa_driver_nl80211_sched_scan - Initiate a scheduled scan
3985 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
3986 * @params: Scan parameters
3987 * @interval: Interval between scan cycles in milliseconds
3988 * Returns: 0 on success, -1 on failure or if not supported
3989 */
wpa_driver_nl80211_sched_scan(void * priv,struct wpa_driver_scan_params * params,u32 interval)3990 static int wpa_driver_nl80211_sched_scan(void *priv,
3991 struct wpa_driver_scan_params *params,
3992 u32 interval)
3993 {
3994 struct i802_bss *bss = priv;
3995 struct wpa_driver_nl80211_data *drv = bss->drv;
3996 int ret = -1;
3997 struct nl_msg *msg;
3998 struct nl_msg *match_set_ssid = NULL, *match_sets = NULL;
3999 struct nl_msg *match_set_rssi = NULL;
4000 size_t i;
4001
4002 wpa_dbg(drv->ctx, MSG_DEBUG, "nl80211: sched_scan request");
4003
4004 #ifdef ANDROID
4005 if (!drv->capa.sched_scan_supported)
4006 return android_pno_start(bss, params);
4007 #endif /* ANDROID */
4008
4009 msg = nl80211_scan_common(drv, NL80211_CMD_START_SCHED_SCAN, params);
4010 if (!msg)
4011 goto nla_put_failure;
4012
4013 NLA_PUT_U32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL, interval);
4014
4015 if ((drv->num_filter_ssids &&
4016 (int) drv->num_filter_ssids <= drv->capa.max_match_sets) ||
4017 params->filter_rssi) {
4018 match_sets = nlmsg_alloc();
4019 if (match_sets == NULL)
4020 goto nla_put_failure;
4021
4022 for (i = 0; i < drv->num_filter_ssids; i++) {
4023 wpa_hexdump_ascii(MSG_MSGDUMP,
4024 "nl80211: Sched scan filter SSID",
4025 drv->filter_ssids[i].ssid,
4026 drv->filter_ssids[i].ssid_len);
4027
4028 match_set_ssid = nlmsg_alloc();
4029 if (match_set_ssid == NULL)
4030 goto nla_put_failure;
4031 NLA_PUT(match_set_ssid,
4032 NL80211_ATTR_SCHED_SCAN_MATCH_SSID,
4033 drv->filter_ssids[i].ssid_len,
4034 drv->filter_ssids[i].ssid);
4035
4036 if (nla_put_nested(match_sets, i + 1, match_set_ssid) <
4037 0)
4038 goto nla_put_failure;
4039 }
4040
4041 if (params->filter_rssi) {
4042 match_set_rssi = nlmsg_alloc();
4043 if (match_set_rssi == NULL)
4044 goto nla_put_failure;
4045 NLA_PUT_U32(match_set_rssi,
4046 NL80211_SCHED_SCAN_MATCH_ATTR_RSSI,
4047 params->filter_rssi);
4048 wpa_printf(MSG_MSGDUMP,
4049 "nl80211: Sched scan RSSI filter %d dBm",
4050 params->filter_rssi);
4051 if (nla_put_nested(match_sets, 0, match_set_rssi) < 0)
4052 goto nla_put_failure;
4053 }
4054
4055 if (nla_put_nested(msg, NL80211_ATTR_SCHED_SCAN_MATCH,
4056 match_sets) < 0)
4057 goto nla_put_failure;
4058 }
4059
4060 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4061
4062 /* TODO: if we get an error here, we should fall back to normal scan */
4063
4064 msg = NULL;
4065 if (ret) {
4066 wpa_printf(MSG_DEBUG, "nl80211: Sched scan start failed: "
4067 "ret=%d (%s)", ret, strerror(-ret));
4068 goto nla_put_failure;
4069 }
4070
4071 wpa_printf(MSG_DEBUG, "nl80211: Sched scan requested (ret=%d) - "
4072 "scan interval %d msec", ret, interval);
4073
4074 nla_put_failure:
4075 nlmsg_free(match_set_ssid);
4076 nlmsg_free(match_sets);
4077 nlmsg_free(match_set_rssi);
4078 nlmsg_free(msg);
4079 return ret;
4080 }
4081
4082
4083 /**
4084 * wpa_driver_nl80211_stop_sched_scan - Stop a scheduled scan
4085 * @priv: Pointer to private driver data from wpa_driver_nl80211_init()
4086 * Returns: 0 on success, -1 on failure or if not supported
4087 */
wpa_driver_nl80211_stop_sched_scan(void * priv)4088 static int wpa_driver_nl80211_stop_sched_scan(void *priv)
4089 {
4090 struct i802_bss *bss = priv;
4091 struct wpa_driver_nl80211_data *drv = bss->drv;
4092 int ret = 0;
4093 struct nl_msg *msg;
4094
4095 #ifdef ANDROID
4096 if (!drv->capa.sched_scan_supported)
4097 return android_pno_stop(bss);
4098 #endif /* ANDROID */
4099
4100 msg = nlmsg_alloc();
4101 if (!msg)
4102 return -1;
4103
4104 nl80211_cmd(drv, msg, 0, NL80211_CMD_STOP_SCHED_SCAN);
4105
4106 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4107
4108 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4109 msg = NULL;
4110 if (ret) {
4111 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop failed: "
4112 "ret=%d (%s)", ret, strerror(-ret));
4113 goto nla_put_failure;
4114 }
4115
4116 wpa_printf(MSG_DEBUG, "nl80211: Sched scan stop sent (ret=%d)", ret);
4117
4118 nla_put_failure:
4119 nlmsg_free(msg);
4120 return ret;
4121 }
4122
4123
nl80211_get_ie(const u8 * ies,size_t ies_len,u8 ie)4124 static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie)
4125 {
4126 const u8 *end, *pos;
4127
4128 if (ies == NULL)
4129 return NULL;
4130
4131 pos = ies;
4132 end = ies + ies_len;
4133
4134 while (pos + 1 < end) {
4135 if (pos + 2 + pos[1] > end)
4136 break;
4137 if (pos[0] == ie)
4138 return pos;
4139 pos += 2 + pos[1];
4140 }
4141
4142 return NULL;
4143 }
4144
4145
nl80211_scan_filtered(struct wpa_driver_nl80211_data * drv,const u8 * ie,size_t ie_len)4146 static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv,
4147 const u8 *ie, size_t ie_len)
4148 {
4149 const u8 *ssid;
4150 size_t i;
4151
4152 if (drv->filter_ssids == NULL)
4153 return 0;
4154
4155 ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID);
4156 if (ssid == NULL)
4157 return 1;
4158
4159 for (i = 0; i < drv->num_filter_ssids; i++) {
4160 if (ssid[1] == drv->filter_ssids[i].ssid_len &&
4161 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) ==
4162 0)
4163 return 0;
4164 }
4165
4166 return 1;
4167 }
4168
4169
bss_info_handler(struct nl_msg * msg,void * arg)4170 static int bss_info_handler(struct nl_msg *msg, void *arg)
4171 {
4172 struct nlattr *tb[NL80211_ATTR_MAX + 1];
4173 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
4174 struct nlattr *bss[NL80211_BSS_MAX + 1];
4175 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
4176 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
4177 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
4178 [NL80211_BSS_TSF] = { .type = NLA_U64 },
4179 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
4180 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
4181 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
4182 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
4183 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
4184 [NL80211_BSS_STATUS] = { .type = NLA_U32 },
4185 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 },
4186 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC },
4187 };
4188 struct nl80211_bss_info_arg *_arg = arg;
4189 struct wpa_scan_results *res = _arg->res;
4190 struct wpa_scan_res **tmp;
4191 struct wpa_scan_res *r;
4192 const u8 *ie, *beacon_ie;
4193 size_t ie_len, beacon_ie_len;
4194 u8 *pos;
4195 size_t i;
4196
4197 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
4198 genlmsg_attrlen(gnlh, 0), NULL);
4199 if (!tb[NL80211_ATTR_BSS])
4200 return NL_SKIP;
4201 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
4202 bss_policy))
4203 return NL_SKIP;
4204 if (bss[NL80211_BSS_STATUS]) {
4205 enum nl80211_bss_status status;
4206 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
4207 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
4208 bss[NL80211_BSS_FREQUENCY]) {
4209 _arg->assoc_freq =
4210 nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
4211 wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz",
4212 _arg->assoc_freq);
4213 }
4214 if (status == NL80211_BSS_STATUS_ASSOCIATED &&
4215 bss[NL80211_BSS_BSSID]) {
4216 os_memcpy(_arg->assoc_bssid,
4217 nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN);
4218 wpa_printf(MSG_DEBUG, "nl80211: Associated with "
4219 MACSTR, MAC2STR(_arg->assoc_bssid));
4220 }
4221 }
4222 if (!res)
4223 return NL_SKIP;
4224 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
4225 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
4226 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
4227 } else {
4228 ie = NULL;
4229 ie_len = 0;
4230 }
4231 if (bss[NL80211_BSS_BEACON_IES]) {
4232 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]);
4233 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]);
4234 } else {
4235 beacon_ie = NULL;
4236 beacon_ie_len = 0;
4237 }
4238
4239 if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie,
4240 ie ? ie_len : beacon_ie_len))
4241 return NL_SKIP;
4242
4243 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len);
4244 if (r == NULL)
4245 return NL_SKIP;
4246 if (bss[NL80211_BSS_BSSID])
4247 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
4248 ETH_ALEN);
4249 if (bss[NL80211_BSS_FREQUENCY])
4250 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
4251 if (bss[NL80211_BSS_BEACON_INTERVAL])
4252 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
4253 if (bss[NL80211_BSS_CAPABILITY])
4254 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
4255 r->flags |= WPA_SCAN_NOISE_INVALID;
4256 if (bss[NL80211_BSS_SIGNAL_MBM]) {
4257 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
4258 r->level /= 100; /* mBm to dBm */
4259 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
4260 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
4261 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
4262 r->flags |= WPA_SCAN_QUAL_INVALID;
4263 } else
4264 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
4265 if (bss[NL80211_BSS_TSF])
4266 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
4267 if (bss[NL80211_BSS_SEEN_MS_AGO])
4268 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]);
4269 r->ie_len = ie_len;
4270 pos = (u8 *) (r + 1);
4271 if (ie) {
4272 os_memcpy(pos, ie, ie_len);
4273 pos += ie_len;
4274 }
4275 r->beacon_ie_len = beacon_ie_len;
4276 if (beacon_ie)
4277 os_memcpy(pos, beacon_ie, beacon_ie_len);
4278
4279 if (bss[NL80211_BSS_STATUS]) {
4280 enum nl80211_bss_status status;
4281 status = nla_get_u32(bss[NL80211_BSS_STATUS]);
4282 switch (status) {
4283 case NL80211_BSS_STATUS_AUTHENTICATED:
4284 r->flags |= WPA_SCAN_AUTHENTICATED;
4285 break;
4286 case NL80211_BSS_STATUS_ASSOCIATED:
4287 r->flags |= WPA_SCAN_ASSOCIATED;
4288 break;
4289 default:
4290 break;
4291 }
4292 }
4293
4294 /*
4295 * cfg80211 maintains separate BSS table entries for APs if the same
4296 * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does
4297 * not use frequency as a separate key in the BSS table, so filter out
4298 * duplicated entries. Prefer associated BSS entry in such a case in
4299 * order to get the correct frequency into the BSS table.
4300 */
4301 for (i = 0; i < res->num; i++) {
4302 const u8 *s1, *s2;
4303 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0)
4304 continue;
4305
4306 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1),
4307 res->res[i]->ie_len, WLAN_EID_SSID);
4308 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID);
4309 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] ||
4310 os_memcmp(s1, s2, 2 + s1[1]) != 0)
4311 continue;
4312
4313 /* Same BSSID,SSID was already included in scan results */
4314 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result "
4315 "for " MACSTR, MAC2STR(r->bssid));
4316
4317 if ((r->flags & WPA_SCAN_ASSOCIATED) &&
4318 !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) {
4319 os_free(res->res[i]);
4320 res->res[i] = r;
4321 } else
4322 os_free(r);
4323 return NL_SKIP;
4324 }
4325
4326 tmp = os_realloc_array(res->res, res->num + 1,
4327 sizeof(struct wpa_scan_res *));
4328 if (tmp == NULL) {
4329 os_free(r);
4330 return NL_SKIP;
4331 }
4332 tmp[res->num++] = r;
4333 res->res = tmp;
4334
4335 return NL_SKIP;
4336 }
4337
4338
clear_state_mismatch(struct wpa_driver_nl80211_data * drv,const u8 * addr)4339 static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv,
4340 const u8 *addr)
4341 {
4342 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) {
4343 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state "
4344 "mismatch (" MACSTR ")", MAC2STR(addr));
4345 wpa_driver_nl80211_mlme(drv, addr,
4346 NL80211_CMD_DEAUTHENTICATE,
4347 WLAN_REASON_PREV_AUTH_NOT_VALID, 1);
4348 }
4349 }
4350
4351
wpa_driver_nl80211_check_bss_status(struct wpa_driver_nl80211_data * drv,struct wpa_scan_results * res)4352 static void wpa_driver_nl80211_check_bss_status(
4353 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res)
4354 {
4355 size_t i;
4356
4357 for (i = 0; i < res->num; i++) {
4358 struct wpa_scan_res *r = res->res[i];
4359 if (r->flags & WPA_SCAN_AUTHENTICATED) {
4360 wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4361 "indicates BSS status with " MACSTR
4362 " as authenticated",
4363 MAC2STR(r->bssid));
4364 if (is_sta_interface(drv->nlmode) &&
4365 os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 &&
4366 os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) !=
4367 0) {
4368 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID"
4369 " in local state (auth=" MACSTR
4370 " assoc=" MACSTR ")",
4371 MAC2STR(drv->auth_bssid),
4372 MAC2STR(drv->bssid));
4373 clear_state_mismatch(drv, r->bssid);
4374 }
4375 }
4376
4377 if (r->flags & WPA_SCAN_ASSOCIATED) {
4378 wpa_printf(MSG_DEBUG, "nl80211: Scan results "
4379 "indicate BSS status with " MACSTR
4380 " as associated",
4381 MAC2STR(r->bssid));
4382 if (is_sta_interface(drv->nlmode) &&
4383 !drv->associated) {
4384 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4385 "(not associated) does not match "
4386 "with BSS state");
4387 clear_state_mismatch(drv, r->bssid);
4388 } else if (is_sta_interface(drv->nlmode) &&
4389 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) !=
4390 0) {
4391 wpa_printf(MSG_DEBUG, "nl80211: Local state "
4392 "(associated with " MACSTR ") does "
4393 "not match with BSS state",
4394 MAC2STR(drv->bssid));
4395 clear_state_mismatch(drv, r->bssid);
4396 clear_state_mismatch(drv, drv->bssid);
4397 }
4398 }
4399 }
4400 }
4401
4402
4403 static struct wpa_scan_results *
nl80211_get_scan_results(struct wpa_driver_nl80211_data * drv)4404 nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv)
4405 {
4406 struct nl_msg *msg;
4407 struct wpa_scan_results *res;
4408 int ret;
4409 struct nl80211_bss_info_arg arg;
4410
4411 res = os_zalloc(sizeof(*res));
4412 if (res == NULL)
4413 return NULL;
4414 msg = nlmsg_alloc();
4415 if (!msg)
4416 goto nla_put_failure;
4417
4418 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_SCAN);
4419 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4420
4421 arg.drv = drv;
4422 arg.res = res;
4423 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg);
4424 msg = NULL;
4425 if (ret == 0) {
4426 wpa_printf(MSG_DEBUG, "nl80211: Received scan results (%lu "
4427 "BSSes)", (unsigned long) res->num);
4428 nl80211_get_noise_for_scan_results(drv, res);
4429 return res;
4430 }
4431 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
4432 "(%s)", ret, strerror(-ret));
4433 nla_put_failure:
4434 nlmsg_free(msg);
4435 wpa_scan_results_free(res);
4436 return NULL;
4437 }
4438
4439
4440 /**
4441 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
4442 * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
4443 * Returns: Scan results on success, -1 on failure
4444 */
4445 static struct wpa_scan_results *
wpa_driver_nl80211_get_scan_results(void * priv)4446 wpa_driver_nl80211_get_scan_results(void *priv)
4447 {
4448 struct i802_bss *bss = priv;
4449 struct wpa_driver_nl80211_data *drv = bss->drv;
4450 struct wpa_scan_results *res;
4451
4452 res = nl80211_get_scan_results(drv);
4453 if (res)
4454 wpa_driver_nl80211_check_bss_status(drv, res);
4455 return res;
4456 }
4457
4458
nl80211_dump_scan(struct wpa_driver_nl80211_data * drv)4459 static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv)
4460 {
4461 struct wpa_scan_results *res;
4462 size_t i;
4463
4464 res = nl80211_get_scan_results(drv);
4465 if (res == NULL) {
4466 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results");
4467 return;
4468 }
4469
4470 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump");
4471 for (i = 0; i < res->num; i++) {
4472 struct wpa_scan_res *r = res->res[i];
4473 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s",
4474 (int) i, (int) res->num, MAC2STR(r->bssid),
4475 r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "",
4476 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : "");
4477 }
4478
4479 wpa_scan_results_free(res);
4480 }
4481
4482
wpa_driver_nl80211_set_key(const char * ifname,struct i802_bss * bss,enum wpa_alg alg,const u8 * addr,int key_idx,int set_tx,const u8 * seq,size_t seq_len,const u8 * key,size_t key_len)4483 static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
4484 enum wpa_alg alg, const u8 *addr,
4485 int key_idx, int set_tx,
4486 const u8 *seq, size_t seq_len,
4487 const u8 *key, size_t key_len)
4488 {
4489 struct wpa_driver_nl80211_data *drv = bss->drv;
4490 int ifindex = if_nametoindex(ifname);
4491 struct nl_msg *msg;
4492 int ret;
4493
4494 wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
4495 "set_tx=%d seq_len=%lu key_len=%lu",
4496 __func__, ifindex, alg, addr, key_idx, set_tx,
4497 (unsigned long) seq_len, (unsigned long) key_len);
4498 #ifdef CONFIG_TDLS
4499 if (key_idx == -1)
4500 key_idx = 0;
4501 #endif /* CONFIG_TDLS */
4502
4503 msg = nlmsg_alloc();
4504 if (!msg)
4505 return -ENOMEM;
4506
4507 if (alg == WPA_ALG_NONE) {
4508 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_KEY);
4509 } else {
4510 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_KEY);
4511 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
4512 switch (alg) {
4513 case WPA_ALG_WEP:
4514 if (key_len == 5)
4515 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4516 WLAN_CIPHER_SUITE_WEP40);
4517 else
4518 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4519 WLAN_CIPHER_SUITE_WEP104);
4520 break;
4521 case WPA_ALG_TKIP:
4522 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4523 WLAN_CIPHER_SUITE_TKIP);
4524 break;
4525 case WPA_ALG_CCMP:
4526 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4527 WLAN_CIPHER_SUITE_CCMP);
4528 break;
4529 case WPA_ALG_GCMP:
4530 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4531 WLAN_CIPHER_SUITE_GCMP);
4532 break;
4533 case WPA_ALG_IGTK:
4534 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4535 WLAN_CIPHER_SUITE_AES_CMAC);
4536 break;
4537 case WPA_ALG_SMS4:
4538 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4539 WLAN_CIPHER_SUITE_SMS4);
4540 break;
4541 case WPA_ALG_KRK:
4542 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
4543 WLAN_CIPHER_SUITE_KRK);
4544 break;
4545 default:
4546 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4547 "algorithm %d", __func__, alg);
4548 nlmsg_free(msg);
4549 return -1;
4550 }
4551 }
4552
4553 if (seq && seq_len)
4554 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
4555
4556 if (addr && !is_broadcast_ether_addr(addr)) {
4557 wpa_printf(MSG_DEBUG, " addr=" MACSTR, MAC2STR(addr));
4558 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4559
4560 if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
4561 wpa_printf(MSG_DEBUG, " RSN IBSS RX GTK");
4562 NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE,
4563 NL80211_KEYTYPE_GROUP);
4564 }
4565 } else if (addr && is_broadcast_ether_addr(addr)) {
4566 struct nl_msg *types;
4567 int err;
4568 wpa_printf(MSG_DEBUG, " broadcast key");
4569 types = nlmsg_alloc();
4570 if (!types)
4571 goto nla_put_failure;
4572 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4573 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4574 types);
4575 nlmsg_free(types);
4576 if (err)
4577 goto nla_put_failure;
4578 }
4579 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4580 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4581
4582 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4583 if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
4584 ret = 0;
4585 if (ret)
4586 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
4587 ret, strerror(-ret));
4588
4589 /*
4590 * If we failed or don't need to set the default TX key (below),
4591 * we're done here.
4592 */
4593 if (ret || !set_tx || alg == WPA_ALG_NONE)
4594 return ret;
4595 if (is_ap_interface(drv->nlmode) && addr &&
4596 !is_broadcast_ether_addr(addr))
4597 return ret;
4598
4599 msg = nlmsg_alloc();
4600 if (!msg)
4601 return -ENOMEM;
4602
4603 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_KEY);
4604 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
4605 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
4606 if (alg == WPA_ALG_IGTK)
4607 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
4608 else
4609 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
4610 if (addr && is_broadcast_ether_addr(addr)) {
4611 struct nl_msg *types;
4612 int err;
4613 types = nlmsg_alloc();
4614 if (!types)
4615 goto nla_put_failure;
4616 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST);
4617 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4618 types);
4619 nlmsg_free(types);
4620 if (err)
4621 goto nla_put_failure;
4622 } else if (addr) {
4623 struct nl_msg *types;
4624 int err;
4625 types = nlmsg_alloc();
4626 if (!types)
4627 goto nla_put_failure;
4628 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_UNICAST);
4629 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES,
4630 types);
4631 nlmsg_free(types);
4632 if (err)
4633 goto nla_put_failure;
4634 }
4635
4636 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4637 if (ret == -ENOENT)
4638 ret = 0;
4639 if (ret)
4640 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
4641 "err=%d %s)", ret, strerror(-ret));
4642 return ret;
4643
4644 nla_put_failure:
4645 nlmsg_free(msg);
4646 return -ENOBUFS;
4647 }
4648
4649
nl_add_key(struct nl_msg * msg,enum wpa_alg alg,int key_idx,int defkey,const u8 * seq,size_t seq_len,const u8 * key,size_t key_len)4650 static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg,
4651 int key_idx, int defkey,
4652 const u8 *seq, size_t seq_len,
4653 const u8 *key, size_t key_len)
4654 {
4655 struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY);
4656 if (!key_attr)
4657 return -1;
4658
4659 if (defkey && alg == WPA_ALG_IGTK)
4660 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT);
4661 else if (defkey)
4662 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4663
4664 NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx);
4665
4666 switch (alg) {
4667 case WPA_ALG_WEP:
4668 if (key_len == 5)
4669 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4670 WLAN_CIPHER_SUITE_WEP40);
4671 else
4672 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4673 WLAN_CIPHER_SUITE_WEP104);
4674 break;
4675 case WPA_ALG_TKIP:
4676 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP);
4677 break;
4678 case WPA_ALG_CCMP:
4679 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP);
4680 break;
4681 case WPA_ALG_GCMP:
4682 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_GCMP);
4683 break;
4684 case WPA_ALG_IGTK:
4685 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4686 WLAN_CIPHER_SUITE_AES_CMAC);
4687 break;
4688 default:
4689 wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
4690 "algorithm %d", __func__, alg);
4691 return -1;
4692 }
4693
4694 if (seq && seq_len)
4695 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq);
4696
4697 NLA_PUT(msg, NL80211_KEY_DATA, key_len, key);
4698
4699 nla_nest_end(msg, key_attr);
4700
4701 return 0;
4702 nla_put_failure:
4703 return -1;
4704 }
4705
4706
nl80211_set_conn_keys(struct wpa_driver_associate_params * params,struct nl_msg * msg)4707 static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params,
4708 struct nl_msg *msg)
4709 {
4710 int i, privacy = 0;
4711 struct nlattr *nl_keys, *nl_key;
4712
4713 for (i = 0; i < 4; i++) {
4714 if (!params->wep_key[i])
4715 continue;
4716 privacy = 1;
4717 break;
4718 }
4719 if (params->wps == WPS_MODE_PRIVACY)
4720 privacy = 1;
4721 if (params->pairwise_suite &&
4722 params->pairwise_suite != WPA_CIPHER_NONE)
4723 privacy = 1;
4724
4725 if (!privacy)
4726 return 0;
4727
4728 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
4729
4730 nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS);
4731 if (!nl_keys)
4732 goto nla_put_failure;
4733
4734 for (i = 0; i < 4; i++) {
4735 if (!params->wep_key[i])
4736 continue;
4737
4738 nl_key = nla_nest_start(msg, i);
4739 if (!nl_key)
4740 goto nla_put_failure;
4741
4742 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i],
4743 params->wep_key[i]);
4744 if (params->wep_key_len[i] == 5)
4745 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4746 WLAN_CIPHER_SUITE_WEP40);
4747 else
4748 NLA_PUT_U32(msg, NL80211_KEY_CIPHER,
4749 WLAN_CIPHER_SUITE_WEP104);
4750
4751 NLA_PUT_U8(msg, NL80211_KEY_IDX, i);
4752
4753 if (i == params->wep_tx_keyidx)
4754 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT);
4755
4756 nla_nest_end(msg, nl_key);
4757 }
4758 nla_nest_end(msg, nl_keys);
4759
4760 return 0;
4761
4762 nla_put_failure:
4763 return -ENOBUFS;
4764 }
4765
4766
wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data * drv,const u8 * addr,int cmd,u16 reason_code,int local_state_change)4767 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
4768 const u8 *addr, int cmd, u16 reason_code,
4769 int local_state_change)
4770 {
4771 int ret = -1;
4772 struct nl_msg *msg;
4773
4774 msg = nlmsg_alloc();
4775 if (!msg)
4776 return -1;
4777
4778 nl80211_cmd(drv, msg, 0, cmd);
4779
4780 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4781 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
4782 if (addr)
4783 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
4784 if (local_state_change)
4785 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4786
4787 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4788 msg = NULL;
4789 if (ret) {
4790 wpa_dbg(drv->ctx, MSG_DEBUG,
4791 "nl80211: MLME command failed: reason=%u ret=%d (%s)",
4792 reason_code, ret, strerror(-ret));
4793 goto nla_put_failure;
4794 }
4795 ret = 0;
4796
4797 nla_put_failure:
4798 nlmsg_free(msg);
4799 return ret;
4800 }
4801
4802
wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data * drv,int reason_code)4803 static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv,
4804 int reason_code)
4805 {
4806 wpa_printf(MSG_DEBUG, "%s(reason_code=%d)", __func__, reason_code);
4807 drv->associated = 0;
4808 drv->ignore_next_local_disconnect = 0;
4809 /* Disconnect command doesn't need BSSID - it uses cached value */
4810 return wpa_driver_nl80211_mlme(drv, NULL, NL80211_CMD_DISCONNECT,
4811 reason_code, 0);
4812 }
4813
4814
wpa_driver_nl80211_deauthenticate(struct i802_bss * bss,const u8 * addr,int reason_code)4815 static int wpa_driver_nl80211_deauthenticate(struct i802_bss *bss,
4816 const u8 *addr, int reason_code)
4817 {
4818 struct wpa_driver_nl80211_data *drv = bss->drv;
4819 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
4820 return wpa_driver_nl80211_disconnect(drv, reason_code);
4821 wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)",
4822 __func__, MAC2STR(addr), reason_code);
4823 drv->associated = 0;
4824 if (drv->nlmode == NL80211_IFTYPE_ADHOC)
4825 return nl80211_leave_ibss(drv);
4826 return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
4827 reason_code, 0);
4828 }
4829
4830
nl80211_copy_auth_params(struct wpa_driver_nl80211_data * drv,struct wpa_driver_auth_params * params)4831 static void nl80211_copy_auth_params(struct wpa_driver_nl80211_data *drv,
4832 struct wpa_driver_auth_params *params)
4833 {
4834 int i;
4835
4836 drv->auth_freq = params->freq;
4837 drv->auth_alg = params->auth_alg;
4838 drv->auth_wep_tx_keyidx = params->wep_tx_keyidx;
4839 drv->auth_local_state_change = params->local_state_change;
4840 drv->auth_p2p = params->p2p;
4841
4842 if (params->bssid)
4843 os_memcpy(drv->auth_bssid_, params->bssid, ETH_ALEN);
4844 else
4845 os_memset(drv->auth_bssid_, 0, ETH_ALEN);
4846
4847 if (params->ssid) {
4848 os_memcpy(drv->auth_ssid, params->ssid, params->ssid_len);
4849 drv->auth_ssid_len = params->ssid_len;
4850 } else
4851 drv->auth_ssid_len = 0;
4852
4853
4854 os_free(drv->auth_ie);
4855 drv->auth_ie = NULL;
4856 drv->auth_ie_len = 0;
4857 if (params->ie) {
4858 drv->auth_ie = os_malloc(params->ie_len);
4859 if (drv->auth_ie) {
4860 os_memcpy(drv->auth_ie, params->ie, params->ie_len);
4861 drv->auth_ie_len = params->ie_len;
4862 }
4863 }
4864
4865 for (i = 0; i < 4; i++) {
4866 if (params->wep_key[i] && params->wep_key_len[i] &&
4867 params->wep_key_len[i] <= 16) {
4868 os_memcpy(drv->auth_wep_key[i], params->wep_key[i],
4869 params->wep_key_len[i]);
4870 drv->auth_wep_key_len[i] = params->wep_key_len[i];
4871 } else
4872 drv->auth_wep_key_len[i] = 0;
4873 }
4874 }
4875
4876
wpa_driver_nl80211_authenticate(struct i802_bss * bss,struct wpa_driver_auth_params * params)4877 static int wpa_driver_nl80211_authenticate(
4878 struct i802_bss *bss, struct wpa_driver_auth_params *params)
4879 {
4880 struct wpa_driver_nl80211_data *drv = bss->drv;
4881 int ret = -1, i;
4882 struct nl_msg *msg;
4883 enum nl80211_auth_type type;
4884 enum nl80211_iftype nlmode;
4885 int count = 0;
4886 int is_retry;
4887
4888 is_retry = drv->retry_auth;
4889 drv->retry_auth = 0;
4890
4891 drv->associated = 0;
4892 os_memset(drv->auth_bssid, 0, ETH_ALEN);
4893 /* FIX: IBSS mode */
4894 nlmode = params->p2p ?
4895 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
4896 if (drv->nlmode != nlmode &&
4897 wpa_driver_nl80211_set_mode(bss, nlmode) < 0)
4898 return -1;
4899
4900 retry:
4901 msg = nlmsg_alloc();
4902 if (!msg)
4903 return -1;
4904
4905 wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
4906 drv->ifindex);
4907
4908 nl80211_cmd(drv, msg, 0, NL80211_CMD_AUTHENTICATE);
4909
4910 for (i = 0; i < 4; i++) {
4911 if (!params->wep_key[i])
4912 continue;
4913 wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
4914 NULL, i,
4915 i == params->wep_tx_keyidx, NULL, 0,
4916 params->wep_key[i],
4917 params->wep_key_len[i]);
4918 if (params->wep_tx_keyidx != i)
4919 continue;
4920 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
4921 params->wep_key[i], params->wep_key_len[i])) {
4922 nlmsg_free(msg);
4923 return -1;
4924 }
4925 }
4926
4927 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
4928 if (params->bssid) {
4929 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR,
4930 MAC2STR(params->bssid));
4931 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
4932 }
4933 if (params->freq) {
4934 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq);
4935 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
4936 }
4937 if (params->ssid) {
4938 wpa_hexdump_ascii(MSG_DEBUG, " * SSID",
4939 params->ssid, params->ssid_len);
4940 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
4941 params->ssid);
4942 }
4943 wpa_hexdump(MSG_DEBUG, " * IEs", params->ie, params->ie_len);
4944 if (params->ie)
4945 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
4946 if (params->sae_data) {
4947 wpa_hexdump(MSG_DEBUG, " * SAE data", params->sae_data,
4948 params->sae_data_len);
4949 NLA_PUT(msg, NL80211_ATTR_SAE_DATA, params->sae_data_len,
4950 params->sae_data);
4951 }
4952 if (params->auth_alg & WPA_AUTH_ALG_OPEN)
4953 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
4954 else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
4955 type = NL80211_AUTHTYPE_SHARED_KEY;
4956 else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
4957 type = NL80211_AUTHTYPE_NETWORK_EAP;
4958 else if (params->auth_alg & WPA_AUTH_ALG_FT)
4959 type = NL80211_AUTHTYPE_FT;
4960 else if (params->auth_alg & WPA_AUTH_ALG_SAE)
4961 type = NL80211_AUTHTYPE_SAE;
4962 else
4963 goto nla_put_failure;
4964 wpa_printf(MSG_DEBUG, " * Auth Type %d", type);
4965 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
4966 if (params->local_state_change) {
4967 wpa_printf(MSG_DEBUG, " * Local state change only");
4968 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE);
4969 }
4970
4971 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
4972 msg = NULL;
4973 if (ret) {
4974 wpa_dbg(drv->ctx, MSG_DEBUG,
4975 "nl80211: MLME command failed (auth): ret=%d (%s)",
4976 ret, strerror(-ret));
4977 count++;
4978 if (ret == -EALREADY && count == 1 && params->bssid &&
4979 !params->local_state_change) {
4980 /*
4981 * mac80211 does not currently accept new
4982 * authentication if we are already authenticated. As a
4983 * workaround, force deauthentication and try again.
4984 */
4985 wpa_printf(MSG_DEBUG, "nl80211: Retry authentication "
4986 "after forced deauthentication");
4987 wpa_driver_nl80211_deauthenticate(
4988 bss, params->bssid,
4989 WLAN_REASON_PREV_AUTH_NOT_VALID);
4990 nlmsg_free(msg);
4991 goto retry;
4992 }
4993
4994 if (ret == -ENOENT && params->freq && !is_retry) {
4995 /*
4996 * cfg80211 has likely expired the BSS entry even
4997 * though it was previously available in our internal
4998 * BSS table. To recover quickly, start a single
4999 * channel scan on the specified channel.
5000 */
5001 struct wpa_driver_scan_params scan;
5002 int freqs[2];
5003
5004 os_memset(&scan, 0, sizeof(scan));
5005 scan.num_ssids = 1;
5006 if (params->ssid) {
5007 scan.ssids[0].ssid = params->ssid;
5008 scan.ssids[0].ssid_len = params->ssid_len;
5009 }
5010 freqs[0] = params->freq;
5011 freqs[1] = 0;
5012 scan.freqs = freqs;
5013 wpa_printf(MSG_DEBUG, "nl80211: Trigger single "
5014 "channel scan to refresh cfg80211 BSS "
5015 "entry");
5016 ret = wpa_driver_nl80211_scan(bss, &scan);
5017 if (ret == 0) {
5018 nl80211_copy_auth_params(drv, params);
5019 drv->scan_for_auth = 1;
5020 }
5021 } else if (is_retry) {
5022 /*
5023 * Need to indicate this with an event since the return
5024 * value from the retry is not delivered to core code.
5025 */
5026 union wpa_event_data event;
5027 wpa_printf(MSG_DEBUG, "nl80211: Authentication retry "
5028 "failed");
5029 os_memset(&event, 0, sizeof(event));
5030 os_memcpy(event.timeout_event.addr, drv->auth_bssid_,
5031 ETH_ALEN);
5032 wpa_supplicant_event(drv->ctx, EVENT_AUTH_TIMED_OUT,
5033 &event);
5034 }
5035
5036 goto nla_put_failure;
5037 }
5038 ret = 0;
5039 wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
5040 "successfully");
5041
5042 nla_put_failure:
5043 nlmsg_free(msg);
5044 return ret;
5045 }
5046
5047
wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data * drv)5048 static int wpa_driver_nl80211_authenticate_retry(
5049 struct wpa_driver_nl80211_data *drv)
5050 {
5051 struct wpa_driver_auth_params params;
5052 struct i802_bss *bss = &drv->first_bss;
5053 int i;
5054
5055 wpa_printf(MSG_DEBUG, "nl80211: Try to authenticate again");
5056
5057 os_memset(¶ms, 0, sizeof(params));
5058 params.freq = drv->auth_freq;
5059 params.auth_alg = drv->auth_alg;
5060 params.wep_tx_keyidx = drv->auth_wep_tx_keyidx;
5061 params.local_state_change = drv->auth_local_state_change;
5062 params.p2p = drv->auth_p2p;
5063
5064 if (!is_zero_ether_addr(drv->auth_bssid_))
5065 params.bssid = drv->auth_bssid_;
5066
5067 if (drv->auth_ssid_len) {
5068 params.ssid = drv->auth_ssid;
5069 params.ssid_len = drv->auth_ssid_len;
5070 }
5071
5072 params.ie = drv->auth_ie;
5073 params.ie_len = drv->auth_ie_len;
5074
5075 for (i = 0; i < 4; i++) {
5076 if (drv->auth_wep_key_len[i]) {
5077 params.wep_key[i] = drv->auth_wep_key[i];
5078 params.wep_key_len[i] = drv->auth_wep_key_len[i];
5079 }
5080 }
5081
5082 drv->retry_auth = 1;
5083 return wpa_driver_nl80211_authenticate(bss, ¶ms);
5084 }
5085
5086
5087 struct phy_info_arg {
5088 u16 *num_modes;
5089 struct hostapd_hw_modes *modes;
5090 int last_mode, last_chan_idx;
5091 };
5092
phy_info_ht_capa(struct hostapd_hw_modes * mode,struct nlattr * capa,struct nlattr * ampdu_factor,struct nlattr * ampdu_density,struct nlattr * mcs_set)5093 static void phy_info_ht_capa(struct hostapd_hw_modes *mode, struct nlattr *capa,
5094 struct nlattr *ampdu_factor,
5095 struct nlattr *ampdu_density,
5096 struct nlattr *mcs_set)
5097 {
5098 if (capa)
5099 mode->ht_capab = nla_get_u16(capa);
5100
5101 if (ampdu_factor)
5102 mode->a_mpdu_params |= nla_get_u8(ampdu_factor) & 0x03;
5103
5104 if (ampdu_density)
5105 mode->a_mpdu_params |= nla_get_u8(ampdu_density) << 2;
5106
5107 if (mcs_set && nla_len(mcs_set) >= 16) {
5108 u8 *mcs;
5109 mcs = nla_data(mcs_set);
5110 os_memcpy(mode->mcs_set, mcs, 16);
5111 }
5112 }
5113
5114
phy_info_vht_capa(struct hostapd_hw_modes * mode,struct nlattr * capa,struct nlattr * mcs_set)5115 static void phy_info_vht_capa(struct hostapd_hw_modes *mode,
5116 struct nlattr *capa,
5117 struct nlattr *mcs_set)
5118 {
5119 if (capa)
5120 mode->vht_capab = nla_get_u32(capa);
5121
5122 if (mcs_set && nla_len(mcs_set) >= 8) {
5123 u8 *mcs;
5124 mcs = nla_data(mcs_set);
5125 os_memcpy(mode->vht_mcs_set, mcs, 8);
5126 }
5127 }
5128
5129
phy_info_freq(struct hostapd_hw_modes * mode,struct hostapd_channel_data * chan,struct nlattr * tb_freq[])5130 static void phy_info_freq(struct hostapd_hw_modes *mode,
5131 struct hostapd_channel_data *chan,
5132 struct nlattr *tb_freq[])
5133 {
5134 enum hostapd_hw_mode m;
5135
5136 chan->freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
5137 chan->flag = 0;
5138
5139 if (chan->freq < 4000)
5140 m = HOSTAPD_MODE_IEEE80211B;
5141 else if (chan->freq > 50000)
5142 m = HOSTAPD_MODE_IEEE80211AD;
5143 else
5144 m = HOSTAPD_MODE_IEEE80211A;
5145
5146 switch (m) {
5147 case HOSTAPD_MODE_IEEE80211AD:
5148 chan->chan = (chan->freq - 56160) / 2160;
5149 break;
5150 case HOSTAPD_MODE_IEEE80211A:
5151 chan->chan = chan->freq / 5 - 1000;
5152 break;
5153 case HOSTAPD_MODE_IEEE80211B:
5154 case HOSTAPD_MODE_IEEE80211G:
5155 if (chan->freq == 2484)
5156 chan->chan = 14;
5157 else
5158 chan->chan = (chan->freq - 2407) / 5;
5159 break;
5160 default:
5161 break;
5162 }
5163
5164 if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
5165 chan->flag |= HOSTAPD_CHAN_DISABLED;
5166 if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
5167 chan->flag |= HOSTAPD_CHAN_PASSIVE_SCAN;
5168 if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
5169 chan->flag |= HOSTAPD_CHAN_NO_IBSS;
5170 if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
5171 chan->flag |= HOSTAPD_CHAN_RADAR;
5172
5173 if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
5174 !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
5175 chan->max_tx_power = nla_get_u32(
5176 tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
5177 }
5178
5179
phy_info_freqs(struct phy_info_arg * phy_info,struct hostapd_hw_modes * mode,struct nlattr * tb)5180 static int phy_info_freqs(struct phy_info_arg *phy_info,
5181 struct hostapd_hw_modes *mode, struct nlattr *tb)
5182 {
5183 static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
5184 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
5185 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
5186 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
5187 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
5188 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
5189 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
5190 };
5191 int new_channels = 0;
5192 struct hostapd_channel_data *channel;
5193 struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
5194 struct nlattr *nl_freq;
5195 int rem_freq, idx;
5196
5197 if (tb == NULL)
5198 return NL_OK;
5199
5200 nla_for_each_nested(nl_freq, tb, rem_freq) {
5201 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
5202 nla_data(nl_freq), nla_len(nl_freq), freq_policy);
5203 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
5204 continue;
5205 new_channels++;
5206 }
5207
5208 channel = os_realloc_array(mode->channels,
5209 mode->num_channels + new_channels,
5210 sizeof(struct hostapd_channel_data));
5211 if (!channel)
5212 return NL_SKIP;
5213
5214 mode->channels = channel;
5215 mode->num_channels += new_channels;
5216
5217 idx = phy_info->last_chan_idx;
5218
5219 nla_for_each_nested(nl_freq, tb, rem_freq) {
5220 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
5221 nla_data(nl_freq), nla_len(nl_freq), freq_policy);
5222 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
5223 continue;
5224 phy_info_freq(mode, &mode->channels[idx], tb_freq);
5225 idx++;
5226 }
5227 phy_info->last_chan_idx = idx;
5228
5229 return NL_OK;
5230 }
5231
5232
phy_info_rates(struct hostapd_hw_modes * mode,struct nlattr * tb)5233 static int phy_info_rates(struct hostapd_hw_modes *mode, struct nlattr *tb)
5234 {
5235 static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
5236 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
5237 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
5238 { .type = NLA_FLAG },
5239 };
5240 struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
5241 struct nlattr *nl_rate;
5242 int rem_rate, idx;
5243
5244 if (tb == NULL)
5245 return NL_OK;
5246
5247 nla_for_each_nested(nl_rate, tb, rem_rate) {
5248 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
5249 nla_data(nl_rate), nla_len(nl_rate),
5250 rate_policy);
5251 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
5252 continue;
5253 mode->num_rates++;
5254 }
5255
5256 mode->rates = os_calloc(mode->num_rates, sizeof(int));
5257 if (!mode->rates)
5258 return NL_SKIP;
5259
5260 idx = 0;
5261
5262 nla_for_each_nested(nl_rate, tb, rem_rate) {
5263 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
5264 nla_data(nl_rate), nla_len(nl_rate),
5265 rate_policy);
5266 if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
5267 continue;
5268 mode->rates[idx] = nla_get_u32(
5269 tb_rate[NL80211_BITRATE_ATTR_RATE]);
5270 idx++;
5271 }
5272
5273 return NL_OK;
5274 }
5275
5276
phy_info_band(struct phy_info_arg * phy_info,struct nlattr * nl_band)5277 static int phy_info_band(struct phy_info_arg *phy_info, struct nlattr *nl_band)
5278 {
5279 struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
5280 struct hostapd_hw_modes *mode;
5281 int ret;
5282
5283 if (phy_info->last_mode != nl_band->nla_type) {
5284 mode = os_realloc_array(phy_info->modes,
5285 *phy_info->num_modes + 1,
5286 sizeof(*mode));
5287 if (!mode)
5288 return NL_SKIP;
5289 phy_info->modes = mode;
5290
5291 mode = &phy_info->modes[*(phy_info->num_modes)];
5292 os_memset(mode, 0, sizeof(*mode));
5293 mode->mode = NUM_HOSTAPD_MODES;
5294 mode->flags = HOSTAPD_MODE_FLAG_HT_INFO_KNOWN;
5295 *(phy_info->num_modes) += 1;
5296 phy_info->last_mode = nl_band->nla_type;
5297 phy_info->last_chan_idx = 0;
5298 } else
5299 mode = &phy_info->modes[*(phy_info->num_modes) - 1];
5300
5301 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
5302 nla_len(nl_band), NULL);
5303
5304 phy_info_ht_capa(mode, tb_band[NL80211_BAND_ATTR_HT_CAPA],
5305 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR],
5306 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY],
5307 tb_band[NL80211_BAND_ATTR_HT_MCS_SET]);
5308 phy_info_vht_capa(mode, tb_band[NL80211_BAND_ATTR_VHT_CAPA],
5309 tb_band[NL80211_BAND_ATTR_VHT_MCS_SET]);
5310 ret = phy_info_freqs(phy_info, mode, tb_band[NL80211_BAND_ATTR_FREQS]);
5311 if (ret != NL_OK)
5312 return ret;
5313 ret = phy_info_rates(mode, tb_band[NL80211_BAND_ATTR_RATES]);
5314 if (ret != NL_OK)
5315 return ret;
5316
5317 return NL_OK;
5318 }
5319
5320
phy_info_handler(struct nl_msg * msg,void * arg)5321 static int phy_info_handler(struct nl_msg *msg, void *arg)
5322 {
5323 struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
5324 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5325 struct phy_info_arg *phy_info = arg;
5326 struct nlattr *nl_band;
5327 int rem_band;
5328
5329 nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5330 genlmsg_attrlen(gnlh, 0), NULL);
5331
5332 if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
5333 return NL_SKIP;
5334
5335 nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band)
5336 {
5337 int res = phy_info_band(phy_info, nl_band);
5338 if (res != NL_OK)
5339 return res;
5340 }
5341
5342 return NL_SKIP;
5343 }
5344
5345
5346 static struct hostapd_hw_modes *
wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes * modes,u16 * num_modes)5347 wpa_driver_nl80211_postprocess_modes(struct hostapd_hw_modes *modes,
5348 u16 *num_modes)
5349 {
5350 u16 m;
5351 struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
5352 int i, mode11g_idx = -1;
5353
5354 /* heuristic to set up modes */
5355 for (m = 0; m < *num_modes; m++) {
5356 if (!modes[m].num_channels)
5357 continue;
5358 if (modes[m].channels[0].freq < 4000) {
5359 modes[m].mode = HOSTAPD_MODE_IEEE80211B;
5360 for (i = 0; i < modes[m].num_rates; i++) {
5361 if (modes[m].rates[i] > 200) {
5362 modes[m].mode = HOSTAPD_MODE_IEEE80211G;
5363 break;
5364 }
5365 }
5366 } else if (modes[m].channels[0].freq > 50000)
5367 modes[m].mode = HOSTAPD_MODE_IEEE80211AD;
5368 else
5369 modes[m].mode = HOSTAPD_MODE_IEEE80211A;
5370 }
5371
5372 /* If only 802.11g mode is included, use it to construct matching
5373 * 802.11b mode data. */
5374
5375 for (m = 0; m < *num_modes; m++) {
5376 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
5377 return modes; /* 802.11b already included */
5378 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
5379 mode11g_idx = m;
5380 }
5381
5382 if (mode11g_idx < 0)
5383 return modes; /* 2.4 GHz band not supported at all */
5384
5385 nmodes = os_realloc_array(modes, *num_modes + 1, sizeof(*nmodes));
5386 if (nmodes == NULL)
5387 return modes; /* Could not add 802.11b mode */
5388
5389 mode = &nmodes[*num_modes];
5390 os_memset(mode, 0, sizeof(*mode));
5391 (*num_modes)++;
5392 modes = nmodes;
5393
5394 mode->mode = HOSTAPD_MODE_IEEE80211B;
5395
5396 mode11g = &modes[mode11g_idx];
5397 mode->num_channels = mode11g->num_channels;
5398 mode->channels = os_malloc(mode11g->num_channels *
5399 sizeof(struct hostapd_channel_data));
5400 if (mode->channels == NULL) {
5401 (*num_modes)--;
5402 return modes; /* Could not add 802.11b mode */
5403 }
5404 os_memcpy(mode->channels, mode11g->channels,
5405 mode11g->num_channels * sizeof(struct hostapd_channel_data));
5406
5407 mode->num_rates = 0;
5408 mode->rates = os_malloc(4 * sizeof(int));
5409 if (mode->rates == NULL) {
5410 os_free(mode->channels);
5411 (*num_modes)--;
5412 return modes; /* Could not add 802.11b mode */
5413 }
5414
5415 for (i = 0; i < mode11g->num_rates; i++) {
5416 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 &&
5417 mode11g->rates[i] != 55 && mode11g->rates[i] != 110)
5418 continue;
5419 mode->rates[mode->num_rates] = mode11g->rates[i];
5420 mode->num_rates++;
5421 if (mode->num_rates == 4)
5422 break;
5423 }
5424
5425 if (mode->num_rates == 0) {
5426 os_free(mode->channels);
5427 os_free(mode->rates);
5428 (*num_modes)--;
5429 return modes; /* No 802.11b rates */
5430 }
5431
5432 wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
5433 "information");
5434
5435 return modes;
5436 }
5437
5438
nl80211_set_ht40_mode(struct hostapd_hw_modes * mode,int start,int end)5439 static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start,
5440 int end)
5441 {
5442 int c;
5443
5444 for (c = 0; c < mode->num_channels; c++) {
5445 struct hostapd_channel_data *chan = &mode->channels[c];
5446 if (chan->freq - 10 >= start && chan->freq + 10 <= end)
5447 chan->flag |= HOSTAPD_CHAN_HT40;
5448 }
5449 }
5450
5451
nl80211_set_ht40_mode_sec(struct hostapd_hw_modes * mode,int start,int end)5452 static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start,
5453 int end)
5454 {
5455 int c;
5456
5457 for (c = 0; c < mode->num_channels; c++) {
5458 struct hostapd_channel_data *chan = &mode->channels[c];
5459 if (!(chan->flag & HOSTAPD_CHAN_HT40))
5460 continue;
5461 if (chan->freq - 30 >= start && chan->freq - 10 <= end)
5462 chan->flag |= HOSTAPD_CHAN_HT40MINUS;
5463 if (chan->freq + 10 >= start && chan->freq + 30 <= end)
5464 chan->flag |= HOSTAPD_CHAN_HT40PLUS;
5465 }
5466 }
5467
5468
nl80211_reg_rule_ht40(struct nlattr * tb[],struct phy_info_arg * results)5469 static void nl80211_reg_rule_ht40(struct nlattr *tb[],
5470 struct phy_info_arg *results)
5471 {
5472 u32 start, end, max_bw;
5473 u16 m;
5474
5475 if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5476 tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5477 tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5478 return;
5479
5480 start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5481 end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5482 max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5483
5484 wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz",
5485 start, end, max_bw);
5486 if (max_bw < 40)
5487 return;
5488
5489 for (m = 0; m < *results->num_modes; m++) {
5490 if (!(results->modes[m].ht_capab &
5491 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5492 continue;
5493 nl80211_set_ht40_mode(&results->modes[m], start, end);
5494 }
5495 }
5496
5497
nl80211_reg_rule_sec(struct nlattr * tb[],struct phy_info_arg * results)5498 static void nl80211_reg_rule_sec(struct nlattr *tb[],
5499 struct phy_info_arg *results)
5500 {
5501 u32 start, end, max_bw;
5502 u16 m;
5503
5504 if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL ||
5505 tb[NL80211_ATTR_FREQ_RANGE_END] == NULL ||
5506 tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL)
5507 return;
5508
5509 start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000;
5510 end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000;
5511 max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000;
5512
5513 if (max_bw < 20)
5514 return;
5515
5516 for (m = 0; m < *results->num_modes; m++) {
5517 if (!(results->modes[m].ht_capab &
5518 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
5519 continue;
5520 nl80211_set_ht40_mode_sec(&results->modes[m], start, end);
5521 }
5522 }
5523
5524
nl80211_get_reg(struct nl_msg * msg,void * arg)5525 static int nl80211_get_reg(struct nl_msg *msg, void *arg)
5526 {
5527 struct phy_info_arg *results = arg;
5528 struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
5529 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
5530 struct nlattr *nl_rule;
5531 struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1];
5532 int rem_rule;
5533 static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
5534 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 },
5535 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 },
5536 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 },
5537 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 },
5538 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 },
5539 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 },
5540 };
5541
5542 nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
5543 genlmsg_attrlen(gnlh, 0), NULL);
5544 if (!tb_msg[NL80211_ATTR_REG_ALPHA2] ||
5545 !tb_msg[NL80211_ATTR_REG_RULES]) {
5546 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information "
5547 "available");
5548 return NL_SKIP;
5549 }
5550
5551 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s",
5552 (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2]));
5553
5554 nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5555 {
5556 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5557 nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5558 nl80211_reg_rule_ht40(tb_rule, results);
5559 }
5560
5561 nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule)
5562 {
5563 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX,
5564 nla_data(nl_rule), nla_len(nl_rule), reg_policy);
5565 nl80211_reg_rule_sec(tb_rule, results);
5566 }
5567
5568 return NL_SKIP;
5569 }
5570
5571
nl80211_set_ht40_flags(struct wpa_driver_nl80211_data * drv,struct phy_info_arg * results)5572 static int nl80211_set_ht40_flags(struct wpa_driver_nl80211_data *drv,
5573 struct phy_info_arg *results)
5574 {
5575 struct nl_msg *msg;
5576
5577 msg = nlmsg_alloc();
5578 if (!msg)
5579 return -ENOMEM;
5580
5581 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_REG);
5582 return send_and_recv_msgs(drv, msg, nl80211_get_reg, results);
5583 }
5584
5585
5586 static struct hostapd_hw_modes *
wpa_driver_nl80211_get_hw_feature_data(void * priv,u16 * num_modes,u16 * flags)5587 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
5588 {
5589 u32 feat;
5590 struct i802_bss *bss = priv;
5591 struct wpa_driver_nl80211_data *drv = bss->drv;
5592 struct nl_msg *msg;
5593 struct phy_info_arg result = {
5594 .num_modes = num_modes,
5595 .modes = NULL,
5596 .last_mode = -1,
5597 };
5598
5599 *num_modes = 0;
5600 *flags = 0;
5601
5602 msg = nlmsg_alloc();
5603 if (!msg)
5604 return NULL;
5605
5606 feat = get_nl80211_protocol_features(drv);
5607 if (feat & NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP)
5608 nl80211_cmd(drv, msg, NLM_F_DUMP, NL80211_CMD_GET_WIPHY);
5609 else
5610 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_WIPHY);
5611
5612 NLA_PUT_FLAG(msg, NL80211_ATTR_SPLIT_WIPHY_DUMP);
5613 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
5614
5615 if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) {
5616 nl80211_set_ht40_flags(drv, &result);
5617 return wpa_driver_nl80211_postprocess_modes(result.modes,
5618 num_modes);
5619 }
5620 msg = NULL;
5621 nla_put_failure:
5622 nlmsg_free(msg);
5623 return NULL;
5624 }
5625
5626
wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data * drv,const void * data,size_t len,int encrypt,int noack)5627 static int wpa_driver_nl80211_send_mntr(struct wpa_driver_nl80211_data *drv,
5628 const void *data, size_t len,
5629 int encrypt, int noack)
5630 {
5631 __u8 rtap_hdr[] = {
5632 0x00, 0x00, /* radiotap version */
5633 0x0e, 0x00, /* radiotap length */
5634 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
5635 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
5636 0x00, /* padding */
5637 0x00, 0x00, /* RX and TX flags to indicate that */
5638 0x00, 0x00, /* this is the injected frame directly */
5639 };
5640 struct iovec iov[2] = {
5641 {
5642 .iov_base = &rtap_hdr,
5643 .iov_len = sizeof(rtap_hdr),
5644 },
5645 {
5646 .iov_base = (void *) data,
5647 .iov_len = len,
5648 }
5649 };
5650 struct msghdr msg = {
5651 .msg_name = NULL,
5652 .msg_namelen = 0,
5653 .msg_iov = iov,
5654 .msg_iovlen = 2,
5655 .msg_control = NULL,
5656 .msg_controllen = 0,
5657 .msg_flags = 0,
5658 };
5659 int res;
5660 u16 txflags = 0;
5661
5662 if (encrypt)
5663 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
5664
5665 if (drv->monitor_sock < 0) {
5666 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available "
5667 "for %s", __func__);
5668 return -1;
5669 }
5670
5671 if (noack)
5672 txflags |= IEEE80211_RADIOTAP_F_TX_NOACK;
5673 WPA_PUT_LE16(&rtap_hdr[12], txflags);
5674
5675 res = sendmsg(drv->monitor_sock, &msg, 0);
5676 if (res < 0) {
5677 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno));
5678 return -1;
5679 }
5680 return 0;
5681 }
5682
5683
wpa_driver_nl80211_send_frame(struct i802_bss * bss,const void * data,size_t len,int encrypt,int noack,unsigned int freq,int no_cck,int offchanok,unsigned int wait_time)5684 static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
5685 const void *data, size_t len,
5686 int encrypt, int noack,
5687 unsigned int freq, int no_cck,
5688 int offchanok, unsigned int wait_time)
5689 {
5690 struct wpa_driver_nl80211_data *drv = bss->drv;
5691 u64 cookie;
5692
5693 if (freq == 0)
5694 freq = bss->freq;
5695
5696 if (drv->use_monitor)
5697 return wpa_driver_nl80211_send_mntr(drv, data, len,
5698 encrypt, noack);
5699
5700 return nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
5701 &cookie, no_cck, noack, offchanok);
5702 }
5703
5704
wpa_driver_nl80211_send_mlme(struct i802_bss * bss,const u8 * data,size_t data_len,int noack,unsigned int freq,int no_cck,int offchanok,unsigned int wait_time)5705 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
5706 size_t data_len, int noack,
5707 unsigned int freq, int no_cck,
5708 int offchanok,
5709 unsigned int wait_time)
5710 {
5711 struct wpa_driver_nl80211_data *drv = bss->drv;
5712 struct ieee80211_mgmt *mgmt;
5713 int encrypt = 1;
5714 u16 fc;
5715
5716 mgmt = (struct ieee80211_mgmt *) data;
5717 fc = le_to_host16(mgmt->frame_control);
5718
5719 if (is_sta_interface(drv->nlmode) &&
5720 WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5721 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
5722 /*
5723 * The use of last_mgmt_freq is a bit of a hack,
5724 * but it works due to the single-threaded nature
5725 * of wpa_supplicant.
5726 */
5727 if (freq == 0)
5728 freq = drv->last_mgmt_freq;
5729 return nl80211_send_frame_cmd(bss, freq, 0,
5730 data, data_len, NULL, 1, noack,
5731 1);
5732 }
5733
5734 if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
5735 if (freq == 0)
5736 freq = bss->freq;
5737 return nl80211_send_frame_cmd(bss, freq,
5738 (int) freq == bss->freq ? 0 :
5739 wait_time,
5740 data, data_len,
5741 &drv->send_action_cookie,
5742 no_cck, noack, offchanok);
5743 }
5744
5745 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
5746 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
5747 /*
5748 * Only one of the authentication frame types is encrypted.
5749 * In order for static WEP encryption to work properly (i.e.,
5750 * to not encrypt the frame), we need to tell mac80211 about
5751 * the frames that must not be encrypted.
5752 */
5753 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
5754 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
5755 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3)
5756 encrypt = 0;
5757 }
5758
5759 return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
5760 noack, freq, no_cck, offchanok,
5761 wait_time);
5762 }
5763
5764
nl80211_set_bss(struct i802_bss * bss,int cts,int preamble,int slot,int ht_opmode,int ap_isolate,int * basic_rates)5765 static int nl80211_set_bss(struct i802_bss *bss, int cts, int preamble,
5766 int slot, int ht_opmode, int ap_isolate,
5767 int *basic_rates)
5768 {
5769 struct wpa_driver_nl80211_data *drv = bss->drv;
5770 struct nl_msg *msg;
5771
5772 msg = nlmsg_alloc();
5773 if (!msg)
5774 return -ENOMEM;
5775
5776 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_BSS);
5777
5778 if (cts >= 0)
5779 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
5780 if (preamble >= 0)
5781 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
5782 if (slot >= 0)
5783 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
5784 if (ht_opmode >= 0)
5785 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode);
5786 if (ap_isolate >= 0)
5787 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, ap_isolate);
5788
5789 if (basic_rates) {
5790 u8 rates[NL80211_MAX_SUPP_RATES];
5791 u8 rates_len = 0;
5792 int i;
5793
5794 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0;
5795 i++)
5796 rates[rates_len++] = basic_rates[i] / 5;
5797
5798 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
5799 }
5800
5801 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
5802
5803 return send_and_recv_msgs(drv, msg, NULL, NULL);
5804 nla_put_failure:
5805 nlmsg_free(msg);
5806 return -ENOBUFS;
5807 }
5808
5809
wpa_driver_nl80211_set_ap(void * priv,struct wpa_driver_ap_params * params)5810 static int wpa_driver_nl80211_set_ap(void *priv,
5811 struct wpa_driver_ap_params *params)
5812 {
5813 struct i802_bss *bss = priv;
5814 struct wpa_driver_nl80211_data *drv = bss->drv;
5815 struct nl_msg *msg;
5816 u8 cmd = NL80211_CMD_NEW_BEACON;
5817 int ret;
5818 int beacon_set;
5819 int ifindex = if_nametoindex(bss->ifname);
5820 int num_suites;
5821 u32 suites[10];
5822 u32 ver;
5823
5824 beacon_set = bss->beacon_set;
5825
5826 msg = nlmsg_alloc();
5827 if (!msg)
5828 return -ENOMEM;
5829
5830 wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
5831 beacon_set);
5832 if (beacon_set)
5833 cmd = NL80211_CMD_SET_BEACON;
5834
5835 nl80211_cmd(drv, msg, 0, cmd);
5836 wpa_hexdump(MSG_DEBUG, "nl80211: Beacon head",
5837 params->head, params->head_len);
5838 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, params->head_len, params->head);
5839 wpa_hexdump(MSG_DEBUG, "nl80211: Beacon tail",
5840 params->tail, params->tail_len);
5841 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, params->tail_len, params->tail);
5842 wpa_printf(MSG_DEBUG, "nl80211: ifindex=%d", ifindex);
5843 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
5844 wpa_printf(MSG_DEBUG, "nl80211: beacon_int=%d", params->beacon_int);
5845 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, params->beacon_int);
5846 wpa_printf(MSG_DEBUG, "nl80211: dtim_period=%d", params->dtim_period);
5847 NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, params->dtim_period);
5848 wpa_hexdump_ascii(MSG_DEBUG, "nl80211: ssid",
5849 params->ssid, params->ssid_len);
5850 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
5851 params->ssid);
5852 if (params->proberesp && params->proberesp_len) {
5853 wpa_hexdump(MSG_DEBUG, "nl80211: proberesp (offload)",
5854 params->proberesp, params->proberesp_len);
5855 NLA_PUT(msg, NL80211_ATTR_PROBE_RESP, params->proberesp_len,
5856 params->proberesp);
5857 }
5858 switch (params->hide_ssid) {
5859 case NO_SSID_HIDING:
5860 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID not in use");
5861 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5862 NL80211_HIDDEN_SSID_NOT_IN_USE);
5863 break;
5864 case HIDDEN_SSID_ZERO_LEN:
5865 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero len");
5866 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5867 NL80211_HIDDEN_SSID_ZERO_LEN);
5868 break;
5869 case HIDDEN_SSID_ZERO_CONTENTS:
5870 wpa_printf(MSG_DEBUG, "nl80211: hidden SSID zero contents");
5871 NLA_PUT_U32(msg, NL80211_ATTR_HIDDEN_SSID,
5872 NL80211_HIDDEN_SSID_ZERO_CONTENTS);
5873 break;
5874 }
5875 wpa_printf(MSG_DEBUG, "nl80211: privacy=%d", params->privacy);
5876 if (params->privacy)
5877 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY);
5878 wpa_printf(MSG_DEBUG, "nl80211: auth_algs=0x%x", params->auth_algs);
5879 if ((params->auth_algs & (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) ==
5880 (WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED)) {
5881 /* Leave out the attribute */
5882 } else if (params->auth_algs & WPA_AUTH_ALG_SHARED)
5883 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5884 NL80211_AUTHTYPE_SHARED_KEY);
5885 else
5886 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE,
5887 NL80211_AUTHTYPE_OPEN_SYSTEM);
5888
5889 wpa_printf(MSG_DEBUG, "nl80211: wpa_version=0x%x", params->wpa_version);
5890 ver = 0;
5891 if (params->wpa_version & WPA_PROTO_WPA)
5892 ver |= NL80211_WPA_VERSION_1;
5893 if (params->wpa_version & WPA_PROTO_RSN)
5894 ver |= NL80211_WPA_VERSION_2;
5895 if (ver)
5896 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
5897
5898 wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
5899 params->key_mgmt_suites);
5900 num_suites = 0;
5901 if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
5902 suites[num_suites++] = WLAN_AKM_SUITE_8021X;
5903 if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
5904 suites[num_suites++] = WLAN_AKM_SUITE_PSK;
5905 if (num_suites) {
5906 NLA_PUT(msg, NL80211_ATTR_AKM_SUITES,
5907 num_suites * sizeof(u32), suites);
5908 }
5909
5910 if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X &&
5911 params->pairwise_ciphers & (WPA_CIPHER_WEP104 | WPA_CIPHER_WEP40))
5912 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT);
5913
5914 wpa_printf(MSG_DEBUG, "nl80211: pairwise_ciphers=0x%x",
5915 params->pairwise_ciphers);
5916 num_suites = 0;
5917 if (params->pairwise_ciphers & WPA_CIPHER_CCMP)
5918 suites[num_suites++] = WLAN_CIPHER_SUITE_CCMP;
5919 if (params->pairwise_ciphers & WPA_CIPHER_GCMP)
5920 suites[num_suites++] = WLAN_CIPHER_SUITE_GCMP;
5921 if (params->pairwise_ciphers & WPA_CIPHER_TKIP)
5922 suites[num_suites++] = WLAN_CIPHER_SUITE_TKIP;
5923 if (params->pairwise_ciphers & WPA_CIPHER_WEP104)
5924 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP104;
5925 if (params->pairwise_ciphers & WPA_CIPHER_WEP40)
5926 suites[num_suites++] = WLAN_CIPHER_SUITE_WEP40;
5927 if (num_suites) {
5928 NLA_PUT(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE,
5929 num_suites * sizeof(u32), suites);
5930 }
5931
5932 wpa_printf(MSG_DEBUG, "nl80211: group_cipher=0x%x",
5933 params->group_cipher);
5934 switch (params->group_cipher) {
5935 case WPA_CIPHER_CCMP:
5936 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5937 WLAN_CIPHER_SUITE_CCMP);
5938 break;
5939 case WPA_CIPHER_GCMP:
5940 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5941 WLAN_CIPHER_SUITE_GCMP);
5942 break;
5943 case WPA_CIPHER_TKIP:
5944 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5945 WLAN_CIPHER_SUITE_TKIP);
5946 break;
5947 case WPA_CIPHER_WEP104:
5948 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5949 WLAN_CIPHER_SUITE_WEP104);
5950 break;
5951 case WPA_CIPHER_WEP40:
5952 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP,
5953 WLAN_CIPHER_SUITE_WEP40);
5954 break;
5955 }
5956
5957 if (params->beacon_ies) {
5958 wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
5959 params->beacon_ies);
5960 NLA_PUT(msg, NL80211_ATTR_IE, wpabuf_len(params->beacon_ies),
5961 wpabuf_head(params->beacon_ies));
5962 }
5963 if (params->proberesp_ies) {
5964 wpa_hexdump_buf(MSG_DEBUG, "nl80211: proberesp_ies",
5965 params->proberesp_ies);
5966 NLA_PUT(msg, NL80211_ATTR_IE_PROBE_RESP,
5967 wpabuf_len(params->proberesp_ies),
5968 wpabuf_head(params->proberesp_ies));
5969 }
5970 if (params->assocresp_ies) {
5971 wpa_hexdump_buf(MSG_DEBUG, "nl80211: assocresp_ies",
5972 params->assocresp_ies);
5973 NLA_PUT(msg, NL80211_ATTR_IE_ASSOC_RESP,
5974 wpabuf_len(params->assocresp_ies),
5975 wpabuf_head(params->assocresp_ies));
5976 }
5977
5978 if (drv->capa.flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER) {
5979 wpa_printf(MSG_DEBUG, "nl80211: ap_max_inactivity=%d",
5980 params->ap_max_inactivity);
5981 NLA_PUT_U16(msg, NL80211_ATTR_INACTIVITY_TIMEOUT,
5982 params->ap_max_inactivity);
5983 }
5984
5985 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
5986 if (ret) {
5987 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
5988 ret, strerror(-ret));
5989 } else {
5990 bss->beacon_set = 1;
5991 nl80211_set_bss(bss, params->cts_protect, params->preamble,
5992 params->short_slot_time, params->ht_opmode,
5993 params->isolate, params->basic_rates);
5994 }
5995 return ret;
5996 nla_put_failure:
5997 nlmsg_free(msg);
5998 return -ENOBUFS;
5999 }
6000
6001
wpa_driver_nl80211_set_freq(struct i802_bss * bss,struct hostapd_freq_params * freq)6002 static int wpa_driver_nl80211_set_freq(struct i802_bss *bss,
6003 struct hostapd_freq_params *freq)
6004 {
6005 struct wpa_driver_nl80211_data *drv = bss->drv;
6006 struct nl_msg *msg;
6007 int ret;
6008
6009 wpa_printf(MSG_DEBUG, "nl80211: Set freq %d (ht_enabled=%d, vht_enabled=%d,"
6010 " bandwidth=%d MHz, cf1=%d MHz, cf2=%d MHz)",
6011 freq->freq, freq->ht_enabled, freq->vht_enabled,
6012 freq->bandwidth, freq->center_freq1, freq->center_freq2);
6013 msg = nlmsg_alloc();
6014 if (!msg)
6015 return -1;
6016
6017 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
6018
6019 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6020 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
6021 if (freq->vht_enabled) {
6022 switch (freq->bandwidth) {
6023 case 20:
6024 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6025 NL80211_CHAN_WIDTH_20);
6026 break;
6027 case 40:
6028 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6029 NL80211_CHAN_WIDTH_40);
6030 break;
6031 case 80:
6032 if (freq->center_freq2)
6033 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6034 NL80211_CHAN_WIDTH_80P80);
6035 else
6036 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6037 NL80211_CHAN_WIDTH_80);
6038 break;
6039 case 160:
6040 NLA_PUT_U32(msg, NL80211_ATTR_CHANNEL_WIDTH,
6041 NL80211_CHAN_WIDTH_160);
6042 break;
6043 default:
6044 return -1;
6045 }
6046 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ1, freq->center_freq1);
6047 if (freq->center_freq2)
6048 NLA_PUT_U32(msg, NL80211_ATTR_CENTER_FREQ2,
6049 freq->center_freq2);
6050 } else if (freq->ht_enabled) {
6051 switch (freq->sec_channel_offset) {
6052 case -1:
6053 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6054 NL80211_CHAN_HT40MINUS);
6055 break;
6056 case 1:
6057 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6058 NL80211_CHAN_HT40PLUS);
6059 break;
6060 default:
6061 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
6062 NL80211_CHAN_HT20);
6063 break;
6064 }
6065 }
6066
6067 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6068 msg = NULL;
6069 if (ret == 0) {
6070 bss->freq = freq->freq;
6071 return 0;
6072 }
6073 wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
6074 "%d (%s)", freq->freq, ret, strerror(-ret));
6075 nla_put_failure:
6076 nlmsg_free(msg);
6077 return -1;
6078 }
6079
6080
sta_flags_nl80211(int flags)6081 static u32 sta_flags_nl80211(int flags)
6082 {
6083 u32 f = 0;
6084
6085 if (flags & WPA_STA_AUTHORIZED)
6086 f |= BIT(NL80211_STA_FLAG_AUTHORIZED);
6087 if (flags & WPA_STA_WMM)
6088 f |= BIT(NL80211_STA_FLAG_WME);
6089 if (flags & WPA_STA_SHORT_PREAMBLE)
6090 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE);
6091 if (flags & WPA_STA_MFP)
6092 f |= BIT(NL80211_STA_FLAG_MFP);
6093 if (flags & WPA_STA_TDLS_PEER)
6094 f |= BIT(NL80211_STA_FLAG_TDLS_PEER);
6095
6096 return f;
6097 }
6098
6099
wpa_driver_nl80211_sta_add(void * priv,struct hostapd_sta_add_params * params)6100 static int wpa_driver_nl80211_sta_add(void *priv,
6101 struct hostapd_sta_add_params *params)
6102 {
6103 struct i802_bss *bss = priv;
6104 struct wpa_driver_nl80211_data *drv = bss->drv;
6105 struct nl_msg *msg, *wme = NULL;
6106 struct nl80211_sta_flag_update upd;
6107 int ret = -ENOBUFS;
6108
6109 if ((params->flags & WPA_STA_TDLS_PEER) &&
6110 !(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
6111 return -EOPNOTSUPP;
6112
6113 msg = nlmsg_alloc();
6114 if (!msg)
6115 return -ENOMEM;
6116
6117 wpa_printf(MSG_DEBUG, "nl80211: %s STA " MACSTR,
6118 params->set ? "Set" : "Add", MAC2STR(params->addr));
6119 nl80211_cmd(drv, msg, 0, params->set ? NL80211_CMD_SET_STATION :
6120 NL80211_CMD_NEW_STATION);
6121
6122 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
6123 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
6124 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
6125 params->supp_rates);
6126 wpa_hexdump(MSG_DEBUG, " * supported rates", params->supp_rates,
6127 params->supp_rates_len);
6128 if (!params->set) {
6129 wpa_printf(MSG_DEBUG, " * aid=%u", params->aid);
6130 NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
6131 wpa_printf(MSG_DEBUG, " * listen_interval=%u",
6132 params->listen_interval);
6133 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
6134 params->listen_interval);
6135 }
6136 if (params->ht_capabilities) {
6137 wpa_hexdump(MSG_DEBUG, " * ht_capabilities",
6138 (u8 *) params->ht_capabilities,
6139 sizeof(*params->ht_capabilities));
6140 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
6141 sizeof(*params->ht_capabilities),
6142 params->ht_capabilities);
6143 }
6144
6145 if (params->vht_capabilities) {
6146 wpa_hexdump(MSG_DEBUG, " * vht_capabilities",
6147 (u8 *) params->vht_capabilities,
6148 sizeof(*params->vht_capabilities));
6149 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY,
6150 sizeof(*params->vht_capabilities),
6151 params->vht_capabilities);
6152 }
6153
6154 wpa_printf(MSG_DEBUG, " * capability=0x%x", params->capability);
6155 NLA_PUT_U16(msg, NL80211_ATTR_STA_CAPABILITY, params->capability);
6156
6157 if (params->ext_capab) {
6158 wpa_hexdump(MSG_DEBUG, " * ext_capab",
6159 params->ext_capab, params->ext_capab_len);
6160 NLA_PUT(msg, NL80211_ATTR_STA_EXT_CAPABILITY,
6161 params->ext_capab_len, params->ext_capab);
6162 }
6163
6164 os_memset(&upd, 0, sizeof(upd));
6165 upd.mask = sta_flags_nl80211(params->flags);
6166 upd.set = upd.mask;
6167 wpa_printf(MSG_DEBUG, " * flags set=0x%x mask=0x%x",
6168 upd.set, upd.mask);
6169 NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
6170
6171 if (params->flags & WPA_STA_WMM) {
6172 wme = nlmsg_alloc();
6173 if (!wme)
6174 goto nla_put_failure;
6175
6176 wpa_printf(MSG_DEBUG, " * qosinfo=0x%x", params->qosinfo);
6177 NLA_PUT_U8(wme, NL80211_STA_WME_UAPSD_QUEUES,
6178 params->qosinfo & WMM_QOSINFO_STA_AC_MASK);
6179 NLA_PUT_U8(wme, NL80211_STA_WME_MAX_SP,
6180 (params->qosinfo >> WMM_QOSINFO_STA_SP_SHIFT) &
6181 WMM_QOSINFO_STA_SP_MASK);
6182 if (nla_put_nested(msg, NL80211_ATTR_STA_WME, wme) < 0)
6183 goto nla_put_failure;
6184 }
6185
6186 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6187 msg = NULL;
6188 if (ret)
6189 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_%s_STATION "
6190 "result: %d (%s)", params->set ? "SET" : "NEW", ret,
6191 strerror(-ret));
6192 if (ret == -EEXIST)
6193 ret = 0;
6194 nla_put_failure:
6195 nlmsg_free(wme);
6196 nlmsg_free(msg);
6197 return ret;
6198 }
6199
6200
wpa_driver_nl80211_sta_remove(struct i802_bss * bss,const u8 * addr)6201 static int wpa_driver_nl80211_sta_remove(struct i802_bss *bss, const u8 *addr)
6202 {
6203 struct wpa_driver_nl80211_data *drv = bss->drv;
6204 struct nl_msg *msg;
6205 int ret;
6206
6207 msg = nlmsg_alloc();
6208 if (!msg)
6209 return -ENOMEM;
6210
6211 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
6212
6213 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6214 if_nametoindex(bss->ifname));
6215 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6216
6217 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6218 if (ret == -ENOENT)
6219 return 0;
6220 return ret;
6221 nla_put_failure:
6222 nlmsg_free(msg);
6223 return -ENOBUFS;
6224 }
6225
6226
nl80211_remove_iface(struct wpa_driver_nl80211_data * drv,int ifidx)6227 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
6228 int ifidx)
6229 {
6230 struct nl_msg *msg;
6231
6232 wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx);
6233
6234 /* stop listening for EAPOL on this interface */
6235 del_ifidx(drv, ifidx);
6236
6237 msg = nlmsg_alloc();
6238 if (!msg)
6239 goto nla_put_failure;
6240
6241 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_INTERFACE);
6242 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
6243
6244 if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
6245 return;
6246 msg = NULL;
6247 nla_put_failure:
6248 nlmsg_free(msg);
6249 wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx);
6250 }
6251
6252
nl80211_iftype_str(enum nl80211_iftype mode)6253 static const char * nl80211_iftype_str(enum nl80211_iftype mode)
6254 {
6255 switch (mode) {
6256 case NL80211_IFTYPE_ADHOC:
6257 return "ADHOC";
6258 case NL80211_IFTYPE_STATION:
6259 return "STATION";
6260 case NL80211_IFTYPE_AP:
6261 return "AP";
6262 case NL80211_IFTYPE_MONITOR:
6263 return "MONITOR";
6264 case NL80211_IFTYPE_P2P_CLIENT:
6265 return "P2P_CLIENT";
6266 case NL80211_IFTYPE_P2P_GO:
6267 return "P2P_GO";
6268 default:
6269 return "unknown";
6270 }
6271 }
6272
6273
nl80211_create_iface_once(struct wpa_driver_nl80211_data * drv,const char * ifname,enum nl80211_iftype iftype,const u8 * addr,int wds)6274 static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv,
6275 const char *ifname,
6276 enum nl80211_iftype iftype,
6277 const u8 *addr, int wds)
6278 {
6279 struct nl_msg *msg, *flags = NULL;
6280 int ifidx;
6281 int ret = -ENOBUFS;
6282
6283 wpa_printf(MSG_DEBUG, "nl80211: Create interface iftype %d (%s)",
6284 iftype, nl80211_iftype_str(iftype));
6285
6286 msg = nlmsg_alloc();
6287 if (!msg)
6288 return -1;
6289
6290 nl80211_cmd(drv, msg, 0, NL80211_CMD_NEW_INTERFACE);
6291 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
6292 NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
6293 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
6294
6295 if (iftype == NL80211_IFTYPE_MONITOR) {
6296 int err;
6297
6298 flags = nlmsg_alloc();
6299 if (!flags)
6300 goto nla_put_failure;
6301
6302 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
6303
6304 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
6305
6306 nlmsg_free(flags);
6307
6308 if (err)
6309 goto nla_put_failure;
6310 } else if (wds) {
6311 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds);
6312 }
6313
6314 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
6315 msg = NULL;
6316 if (ret) {
6317 nla_put_failure:
6318 nlmsg_free(msg);
6319 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)",
6320 ifname, ret, strerror(-ret));
6321 return ret;
6322 }
6323
6324 ifidx = if_nametoindex(ifname);
6325 wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d",
6326 ifname, ifidx);
6327
6328 if (ifidx <= 0)
6329 return -1;
6330
6331 /* start listening for EAPOL on this interface */
6332 add_ifidx(drv, ifidx);
6333
6334 if (addr && iftype != NL80211_IFTYPE_MONITOR &&
6335 linux_set_ifhwaddr(drv->global->ioctl_sock, ifname, addr)) {
6336 nl80211_remove_iface(drv, ifidx);
6337 return -1;
6338 }
6339
6340 return ifidx;
6341 }
6342
6343
nl80211_create_iface(struct wpa_driver_nl80211_data * drv,const char * ifname,enum nl80211_iftype iftype,const u8 * addr,int wds)6344 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
6345 const char *ifname, enum nl80211_iftype iftype,
6346 const u8 *addr, int wds)
6347 {
6348 int ret;
6349
6350 ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds);
6351
6352 /* if error occurred and interface exists already */
6353 if (ret == -ENFILE && if_nametoindex(ifname)) {
6354 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname);
6355
6356 /* Try to remove the interface that was already there. */
6357 nl80211_remove_iface(drv, if_nametoindex(ifname));
6358
6359 /* Try to create the interface again */
6360 ret = nl80211_create_iface_once(drv, ifname, iftype, addr,
6361 wds);
6362 }
6363
6364 if (ret >= 0 && is_p2p_interface(iftype))
6365 nl80211_disable_11b_rates(drv, ret, 1);
6366
6367 return ret;
6368 }
6369
6370
handle_tx_callback(void * ctx,u8 * buf,size_t len,int ok)6371 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
6372 {
6373 struct ieee80211_hdr *hdr;
6374 u16 fc;
6375 union wpa_event_data event;
6376
6377 hdr = (struct ieee80211_hdr *) buf;
6378 fc = le_to_host16(hdr->frame_control);
6379
6380 os_memset(&event, 0, sizeof(event));
6381 event.tx_status.type = WLAN_FC_GET_TYPE(fc);
6382 event.tx_status.stype = WLAN_FC_GET_STYPE(fc);
6383 event.tx_status.dst = hdr->addr1;
6384 event.tx_status.data = buf;
6385 event.tx_status.data_len = len;
6386 event.tx_status.ack = ok;
6387 wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event);
6388 }
6389
6390
from_unknown_sta(struct wpa_driver_nl80211_data * drv,u8 * buf,size_t len)6391 static void from_unknown_sta(struct wpa_driver_nl80211_data *drv,
6392 u8 *buf, size_t len)
6393 {
6394 struct ieee80211_hdr *hdr = (void *)buf;
6395 u16 fc;
6396 union wpa_event_data event;
6397
6398 if (len < sizeof(*hdr))
6399 return;
6400
6401 fc = le_to_host16(hdr->frame_control);
6402
6403 os_memset(&event, 0, sizeof(event));
6404 event.rx_from_unknown.bssid = get_hdr_bssid(hdr, len);
6405 event.rx_from_unknown.addr = hdr->addr2;
6406 event.rx_from_unknown.wds = (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) ==
6407 (WLAN_FC_FROMDS | WLAN_FC_TODS);
6408 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event);
6409 }
6410
6411
handle_frame(struct wpa_driver_nl80211_data * drv,u8 * buf,size_t len,int datarate,int ssi_signal)6412 static void handle_frame(struct wpa_driver_nl80211_data *drv,
6413 u8 *buf, size_t len, int datarate, int ssi_signal)
6414 {
6415 struct ieee80211_hdr *hdr;
6416 u16 fc;
6417 union wpa_event_data event;
6418
6419 hdr = (struct ieee80211_hdr *) buf;
6420 fc = le_to_host16(hdr->frame_control);
6421
6422 switch (WLAN_FC_GET_TYPE(fc)) {
6423 case WLAN_FC_TYPE_MGMT:
6424 os_memset(&event, 0, sizeof(event));
6425 event.rx_mgmt.frame = buf;
6426 event.rx_mgmt.frame_len = len;
6427 event.rx_mgmt.datarate = datarate;
6428 event.rx_mgmt.ssi_signal = ssi_signal;
6429 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event);
6430 break;
6431 case WLAN_FC_TYPE_CTRL:
6432 /* can only get here with PS-Poll frames */
6433 wpa_printf(MSG_DEBUG, "CTRL");
6434 from_unknown_sta(drv, buf, len);
6435 break;
6436 case WLAN_FC_TYPE_DATA:
6437 from_unknown_sta(drv, buf, len);
6438 break;
6439 }
6440 }
6441
6442
handle_monitor_read(int sock,void * eloop_ctx,void * sock_ctx)6443 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
6444 {
6445 struct wpa_driver_nl80211_data *drv = eloop_ctx;
6446 int len;
6447 unsigned char buf[3000];
6448 struct ieee80211_radiotap_iterator iter;
6449 int ret;
6450 int datarate = 0, ssi_signal = 0;
6451 int injected = 0, failed = 0, rxflags = 0;
6452
6453 len = recv(sock, buf, sizeof(buf), 0);
6454 if (len < 0) {
6455 perror("recv");
6456 return;
6457 }
6458
6459 if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
6460 printf("received invalid radiotap frame\n");
6461 return;
6462 }
6463
6464 while (1) {
6465 ret = ieee80211_radiotap_iterator_next(&iter);
6466 if (ret == -ENOENT)
6467 break;
6468 if (ret) {
6469 printf("received invalid radiotap frame (%d)\n", ret);
6470 return;
6471 }
6472 switch (iter.this_arg_index) {
6473 case IEEE80211_RADIOTAP_FLAGS:
6474 if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
6475 len -= 4;
6476 break;
6477 case IEEE80211_RADIOTAP_RX_FLAGS:
6478 rxflags = 1;
6479 break;
6480 case IEEE80211_RADIOTAP_TX_FLAGS:
6481 injected = 1;
6482 failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
6483 IEEE80211_RADIOTAP_F_TX_FAIL;
6484 break;
6485 case IEEE80211_RADIOTAP_DATA_RETRIES:
6486 break;
6487 case IEEE80211_RADIOTAP_CHANNEL:
6488 /* TODO: convert from freq/flags to channel number */
6489 break;
6490 case IEEE80211_RADIOTAP_RATE:
6491 datarate = *iter.this_arg * 5;
6492 break;
6493 case IEEE80211_RADIOTAP_DBM_ANTSIGNAL:
6494 ssi_signal = (s8) *iter.this_arg;
6495 break;
6496 }
6497 }
6498
6499 if (rxflags && injected)
6500 return;
6501
6502 if (!injected)
6503 handle_frame(drv, buf + iter.max_length,
6504 len - iter.max_length, datarate, ssi_signal);
6505 else
6506 handle_tx_callback(drv->ctx, buf + iter.max_length,
6507 len - iter.max_length, !failed);
6508 }
6509
6510
6511 /*
6512 * we post-process the filter code later and rewrite
6513 * this to the offset to the last instruction
6514 */
6515 #define PASS 0xFF
6516 #define FAIL 0xFE
6517
6518 static struct sock_filter msock_filter_insns[] = {
6519 /*
6520 * do a little-endian load of the radiotap length field
6521 */
6522 /* load lower byte into A */
6523 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2),
6524 /* put it into X (== index register) */
6525 BPF_STMT(BPF_MISC| BPF_TAX, 0),
6526 /* load upper byte into A */
6527 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 3),
6528 /* left-shift it by 8 */
6529 BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
6530 /* or with X */
6531 BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
6532 /* put result into X */
6533 BPF_STMT(BPF_MISC| BPF_TAX, 0),
6534
6535 /*
6536 * Allow management frames through, this also gives us those
6537 * management frames that we sent ourselves with status
6538 */
6539 /* load the lower byte of the IEEE 802.11 frame control field */
6540 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
6541 /* mask off frame type and version */
6542 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
6543 /* accept frame if it's both 0, fall through otherwise */
6544 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
6545
6546 /*
6547 * TODO: add a bit to radiotap RX flags that indicates
6548 * that the sending station is not associated, then
6549 * add a filter here that filters on our DA and that flag
6550 * to allow us to deauth frames to that bad station.
6551 *
6552 * For now allow all To DS data frames through.
6553 */
6554 /* load the IEEE 802.11 frame control field */
6555 BPF_STMT(BPF_LD | BPF_H | BPF_IND, 0),
6556 /* mask off frame type, version and DS status */
6557 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03),
6558 /* accept frame if version 0, type 2 and To DS, fall through otherwise
6559 */
6560 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0),
6561
6562 #if 0
6563 /*
6564 * drop non-data frames
6565 */
6566 /* load the lower byte of the frame control field */
6567 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
6568 /* mask off QoS bit */
6569 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0c),
6570 /* drop non-data frames */
6571 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 8, 0, FAIL),
6572 #endif
6573 /* load the upper byte of the frame control field */
6574 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 1),
6575 /* mask off toDS/fromDS */
6576 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x03),
6577 /* accept WDS frames */
6578 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, PASS, 0),
6579
6580 /*
6581 * add header length to index
6582 */
6583 /* load the lower byte of the frame control field */
6584 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0),
6585 /* mask off QoS bit */
6586 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x80),
6587 /* right shift it by 6 to give 0 or 2 */
6588 BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 6),
6589 /* add data frame header length */
6590 BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 24),
6591 /* add index, was start of 802.11 header */
6592 BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0),
6593 /* move to index, now start of LL header */
6594 BPF_STMT(BPF_MISC | BPF_TAX, 0),
6595
6596 /*
6597 * Accept empty data frames, we use those for
6598 * polling activity.
6599 */
6600 BPF_STMT(BPF_LD | BPF_W | BPF_LEN, 0),
6601 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
6602
6603 /*
6604 * Accept EAPOL frames
6605 */
6606 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 0),
6607 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
6608 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 4),
6609 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
6610
6611 /* keep these last two statements or change the code below */
6612 /* return 0 == "DROP" */
6613 BPF_STMT(BPF_RET | BPF_K, 0),
6614 /* return ~0 == "keep all" */
6615 BPF_STMT(BPF_RET | BPF_K, ~0),
6616 };
6617
6618 static struct sock_fprog msock_filter = {
6619 .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
6620 .filter = msock_filter_insns,
6621 };
6622
6623
add_monitor_filter(int s)6624 static int add_monitor_filter(int s)
6625 {
6626 int idx;
6627
6628 /* rewrite all PASS/FAIL jump offsets */
6629 for (idx = 0; idx < msock_filter.len; idx++) {
6630 struct sock_filter *insn = &msock_filter_insns[idx];
6631
6632 if (BPF_CLASS(insn->code) == BPF_JMP) {
6633 if (insn->code == (BPF_JMP|BPF_JA)) {
6634 if (insn->k == PASS)
6635 insn->k = msock_filter.len - idx - 2;
6636 else if (insn->k == FAIL)
6637 insn->k = msock_filter.len - idx - 3;
6638 }
6639
6640 if (insn->jt == PASS)
6641 insn->jt = msock_filter.len - idx - 2;
6642 else if (insn->jt == FAIL)
6643 insn->jt = msock_filter.len - idx - 3;
6644
6645 if (insn->jf == PASS)
6646 insn->jf = msock_filter.len - idx - 2;
6647 else if (insn->jf == FAIL)
6648 insn->jf = msock_filter.len - idx - 3;
6649 }
6650 }
6651
6652 if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
6653 &msock_filter, sizeof(msock_filter))) {
6654 perror("SO_ATTACH_FILTER");
6655 return -1;
6656 }
6657
6658 return 0;
6659 }
6660
6661
nl80211_remove_monitor_interface(struct wpa_driver_nl80211_data * drv)6662 static void nl80211_remove_monitor_interface(
6663 struct wpa_driver_nl80211_data *drv)
6664 {
6665 drv->monitor_refcount--;
6666 if (drv->monitor_refcount > 0)
6667 return;
6668
6669 if (drv->monitor_ifidx >= 0) {
6670 nl80211_remove_iface(drv, drv->monitor_ifidx);
6671 drv->monitor_ifidx = -1;
6672 }
6673 if (drv->monitor_sock >= 0) {
6674 eloop_unregister_read_sock(drv->monitor_sock);
6675 close(drv->monitor_sock);
6676 drv->monitor_sock = -1;
6677 }
6678 }
6679
6680
6681 static int
nl80211_create_monitor_interface(struct wpa_driver_nl80211_data * drv)6682 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
6683 {
6684 char buf[IFNAMSIZ];
6685 struct sockaddr_ll ll;
6686 int optval;
6687 socklen_t optlen;
6688
6689 if (drv->monitor_ifidx >= 0) {
6690 drv->monitor_refcount++;
6691 return 0;
6692 }
6693
6694 if (os_strncmp(drv->first_bss.ifname, "p2p-", 4) == 0) {
6695 /*
6696 * P2P interface name is of the format p2p-%s-%d. For monitor
6697 * interface name corresponding to P2P GO, replace "p2p-" with
6698 * "mon-" to retain the same interface name length and to
6699 * indicate that it is a monitor interface.
6700 */
6701 snprintf(buf, IFNAMSIZ, "mon-%s", drv->first_bss.ifname + 4);
6702 } else {
6703 /* Non-P2P interface with AP functionality. */
6704 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss.ifname);
6705 }
6706
6707 buf[IFNAMSIZ - 1] = '\0';
6708
6709 drv->monitor_ifidx =
6710 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL,
6711 0);
6712
6713 if (drv->monitor_ifidx == -EOPNOTSUPP) {
6714 /*
6715 * This is backward compatibility for a few versions of
6716 * the kernel only that didn't advertise the right
6717 * attributes for the only driver that then supported
6718 * AP mode w/o monitor -- ath6kl.
6719 */
6720 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support "
6721 "monitor interface type - try to run without it");
6722 drv->device_ap_sme = 1;
6723 }
6724
6725 if (drv->monitor_ifidx < 0)
6726 return -1;
6727
6728 if (linux_set_iface_flags(drv->global->ioctl_sock, buf, 1))
6729 goto error;
6730
6731 memset(&ll, 0, sizeof(ll));
6732 ll.sll_family = AF_PACKET;
6733 ll.sll_ifindex = drv->monitor_ifidx;
6734 drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
6735 if (drv->monitor_sock < 0) {
6736 perror("socket[PF_PACKET,SOCK_RAW]");
6737 goto error;
6738 }
6739
6740 if (add_monitor_filter(drv->monitor_sock)) {
6741 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
6742 "interface; do filtering in user space");
6743 /* This works, but will cost in performance. */
6744 }
6745
6746 if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
6747 perror("monitor socket bind");
6748 goto error;
6749 }
6750
6751 optlen = sizeof(optval);
6752 optval = 20;
6753 if (setsockopt
6754 (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
6755 perror("Failed to set socket priority");
6756 goto error;
6757 }
6758
6759 if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
6760 drv, NULL)) {
6761 printf("Could not register monitor read socket\n");
6762 goto error;
6763 }
6764
6765 return 0;
6766 error:
6767 nl80211_remove_monitor_interface(drv);
6768 return -1;
6769 }
6770
6771
nl80211_setup_ap(struct i802_bss * bss)6772 static int nl80211_setup_ap(struct i802_bss *bss)
6773 {
6774 struct wpa_driver_nl80211_data *drv = bss->drv;
6775
6776 wpa_printf(MSG_DEBUG, "nl80211: Setup AP - device_ap_sme=%d "
6777 "use_monitor=%d", drv->device_ap_sme, drv->use_monitor);
6778
6779 /*
6780 * Disable Probe Request reporting unless we need it in this way for
6781 * devices that include the AP SME, in the other case (unless using
6782 * monitor iface) we'll get it through the nl_mgmt socket instead.
6783 */
6784 if (!drv->device_ap_sme)
6785 wpa_driver_nl80211_probe_req_report(bss, 0);
6786
6787 if (!drv->device_ap_sme && !drv->use_monitor)
6788 if (nl80211_mgmt_subscribe_ap(bss))
6789 return -1;
6790
6791 if (drv->device_ap_sme && !drv->use_monitor)
6792 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
6793 return -1;
6794
6795 if (!drv->device_ap_sme && drv->use_monitor &&
6796 nl80211_create_monitor_interface(drv) &&
6797 !drv->device_ap_sme)
6798 return -1;
6799
6800 #ifdef ANDROID_P2P
6801 if (drv->device_ap_sme && drv->use_monitor)
6802 if (nl80211_mgmt_subscribe_ap_dev_sme(bss))
6803 return -1;
6804
6805 if (drv->use_monitor &&
6806 nl80211_create_monitor_interface(drv))
6807 return -1;
6808 #endif
6809
6810 if (drv->device_ap_sme &&
6811 wpa_driver_nl80211_probe_req_report(bss, 1) < 0) {
6812 wpa_printf(MSG_DEBUG, "nl80211: Failed to enable "
6813 "Probe Request frame reporting in AP mode");
6814 /* Try to survive without this */
6815 }
6816
6817 return 0;
6818 }
6819
6820
nl80211_teardown_ap(struct i802_bss * bss)6821 static void nl80211_teardown_ap(struct i802_bss *bss)
6822 {
6823 struct wpa_driver_nl80211_data *drv = bss->drv;
6824
6825 if (drv->device_ap_sme) {
6826 wpa_driver_nl80211_probe_req_report(bss, 0);
6827 if (!drv->use_monitor)
6828 nl80211_mgmt_unsubscribe(bss, "AP teardown (dev SME)");
6829 } else if (drv->use_monitor)
6830 nl80211_remove_monitor_interface(drv);
6831 else
6832 nl80211_mgmt_unsubscribe(bss, "AP teardown");
6833
6834 bss->beacon_set = 0;
6835 }
6836
6837
nl80211_send_eapol_data(struct i802_bss * bss,const u8 * addr,const u8 * data,size_t data_len)6838 static int nl80211_send_eapol_data(struct i802_bss *bss,
6839 const u8 *addr, const u8 *data,
6840 size_t data_len)
6841 {
6842 struct sockaddr_ll ll;
6843 int ret;
6844
6845 if (bss->drv->eapol_tx_sock < 0) {
6846 wpa_printf(MSG_DEBUG, "nl80211: No socket to send EAPOL");
6847 return -1;
6848 }
6849
6850 os_memset(&ll, 0, sizeof(ll));
6851 ll.sll_family = AF_PACKET;
6852 ll.sll_ifindex = bss->ifindex;
6853 ll.sll_protocol = htons(ETH_P_PAE);
6854 ll.sll_halen = ETH_ALEN;
6855 os_memcpy(ll.sll_addr, addr, ETH_ALEN);
6856 ret = sendto(bss->drv->eapol_tx_sock, data, data_len, 0,
6857 (struct sockaddr *) &ll, sizeof(ll));
6858 if (ret < 0)
6859 wpa_printf(MSG_ERROR, "nl80211: EAPOL TX: %s",
6860 strerror(errno));
6861
6862 return ret;
6863 }
6864
6865
6866 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
6867
wpa_driver_nl80211_hapd_send_eapol(void * priv,const u8 * addr,const u8 * data,size_t data_len,int encrypt,const u8 * own_addr,u32 flags)6868 static int wpa_driver_nl80211_hapd_send_eapol(
6869 void *priv, const u8 *addr, const u8 *data,
6870 size_t data_len, int encrypt, const u8 *own_addr, u32 flags)
6871 {
6872 struct i802_bss *bss = priv;
6873 struct wpa_driver_nl80211_data *drv = bss->drv;
6874 struct ieee80211_hdr *hdr;
6875 size_t len;
6876 u8 *pos;
6877 int res;
6878 int qos = flags & WPA_STA_WMM;
6879 #ifndef ANDROID_P2P
6880 if (drv->device_ap_sme || !drv->use_monitor)
6881 #else
6882 if (drv->device_ap_sme && !drv->use_monitor)
6883 #endif
6884 return nl80211_send_eapol_data(bss, addr, data, data_len);
6885
6886 len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
6887 data_len;
6888 hdr = os_zalloc(len);
6889 if (hdr == NULL) {
6890 printf("malloc() failed for i802_send_data(len=%lu)\n",
6891 (unsigned long) len);
6892 return -1;
6893 }
6894
6895 hdr->frame_control =
6896 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
6897 hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
6898 if (encrypt)
6899 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
6900 if (qos) {
6901 hdr->frame_control |=
6902 host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
6903 }
6904
6905 memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
6906 memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
6907 memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
6908 pos = (u8 *) (hdr + 1);
6909
6910 if (qos) {
6911 /* Set highest priority in QoS header */
6912 pos[0] = 7;
6913 pos[1] = 0;
6914 pos += 2;
6915 }
6916
6917 memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
6918 pos += sizeof(rfc1042_header);
6919 WPA_PUT_BE16(pos, ETH_P_PAE);
6920 pos += 2;
6921 memcpy(pos, data, data_len);
6922
6923 res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
6924 0, 0, 0, 0);
6925 if (res < 0) {
6926 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
6927 "failed: %d (%s)",
6928 (unsigned long) len, errno, strerror(errno));
6929 }
6930 os_free(hdr);
6931
6932 return res;
6933 }
6934
6935
wpa_driver_nl80211_sta_set_flags(void * priv,const u8 * addr,int total_flags,int flags_or,int flags_and)6936 static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr,
6937 int total_flags,
6938 int flags_or, int flags_and)
6939 {
6940 struct i802_bss *bss = priv;
6941 struct wpa_driver_nl80211_data *drv = bss->drv;
6942 struct nl_msg *msg, *flags = NULL;
6943 struct nl80211_sta_flag_update upd;
6944
6945 msg = nlmsg_alloc();
6946 if (!msg)
6947 return -ENOMEM;
6948
6949 flags = nlmsg_alloc();
6950 if (!flags) {
6951 nlmsg_free(msg);
6952 return -ENOMEM;
6953 }
6954
6955 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
6956
6957 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
6958 if_nametoindex(bss->ifname));
6959 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
6960
6961 /*
6962 * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This
6963 * can be removed eventually.
6964 */
6965 if (total_flags & WPA_STA_AUTHORIZED)
6966 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
6967
6968 if (total_flags & WPA_STA_WMM)
6969 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
6970
6971 if (total_flags & WPA_STA_SHORT_PREAMBLE)
6972 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
6973
6974 if (total_flags & WPA_STA_MFP)
6975 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
6976
6977 if (total_flags & WPA_STA_TDLS_PEER)
6978 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_TDLS_PEER);
6979
6980 if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
6981 goto nla_put_failure;
6982
6983 os_memset(&upd, 0, sizeof(upd));
6984 upd.mask = sta_flags_nl80211(flags_or | ~flags_and);
6985 upd.set = sta_flags_nl80211(flags_or);
6986 NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
6987
6988 nlmsg_free(flags);
6989
6990 return send_and_recv_msgs(drv, msg, NULL, NULL);
6991 nla_put_failure:
6992 nlmsg_free(msg);
6993 nlmsg_free(flags);
6994 return -ENOBUFS;
6995 }
6996
6997
wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data * drv,struct wpa_driver_associate_params * params)6998 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
6999 struct wpa_driver_associate_params *params)
7000 {
7001 enum nl80211_iftype nlmode, old_mode;
7002 struct hostapd_freq_params freq = {
7003 .freq = params->freq,
7004 };
7005
7006 if (params->p2p) {
7007 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P "
7008 "group (GO)");
7009 nlmode = NL80211_IFTYPE_P2P_GO;
7010 } else
7011 nlmode = NL80211_IFTYPE_AP;
7012
7013 old_mode = drv->nlmode;
7014 if (wpa_driver_nl80211_set_mode(&drv->first_bss, nlmode)) {
7015 nl80211_remove_monitor_interface(drv);
7016 return -1;
7017 }
7018
7019 if (wpa_driver_nl80211_set_freq(&drv->first_bss, &freq)) {
7020 if (old_mode != nlmode)
7021 wpa_driver_nl80211_set_mode(&drv->first_bss, old_mode);
7022 nl80211_remove_monitor_interface(drv);
7023 return -1;
7024 }
7025
7026 return 0;
7027 }
7028
7029
nl80211_leave_ibss(struct wpa_driver_nl80211_data * drv)7030 static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv)
7031 {
7032 struct nl_msg *msg;
7033 int ret = -1;
7034
7035 msg = nlmsg_alloc();
7036 if (!msg)
7037 return -1;
7038
7039 nl80211_cmd(drv, msg, 0, NL80211_CMD_LEAVE_IBSS);
7040 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7041 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7042 msg = NULL;
7043 if (ret) {
7044 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d "
7045 "(%s)", ret, strerror(-ret));
7046 goto nla_put_failure;
7047 }
7048
7049 ret = 0;
7050 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully");
7051
7052 nla_put_failure:
7053 nlmsg_free(msg);
7054 return ret;
7055 }
7056
7057
wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data * drv,struct wpa_driver_associate_params * params)7058 static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv,
7059 struct wpa_driver_associate_params *params)
7060 {
7061 struct nl_msg *msg;
7062 int ret = -1;
7063 int count = 0;
7064
7065 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex);
7066
7067 if (wpa_driver_nl80211_set_mode(&drv->first_bss,
7068 NL80211_IFTYPE_ADHOC)) {
7069 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into "
7070 "IBSS mode");
7071 return -1;
7072 }
7073
7074 retry:
7075 msg = nlmsg_alloc();
7076 if (!msg)
7077 return -1;
7078
7079 nl80211_cmd(drv, msg, 0, NL80211_CMD_JOIN_IBSS);
7080 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7081
7082 if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid))
7083 goto nla_put_failure;
7084
7085 wpa_hexdump_ascii(MSG_DEBUG, " * SSID",
7086 params->ssid, params->ssid_len);
7087 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7088 params->ssid);
7089 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
7090 drv->ssid_len = params->ssid_len;
7091
7092 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq);
7093 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
7094
7095 ret = nl80211_set_conn_keys(params, msg);
7096 if (ret)
7097 goto nla_put_failure;
7098
7099 if (params->bssid && params->fixed_bssid) {
7100 wpa_printf(MSG_DEBUG, " * BSSID=" MACSTR,
7101 MAC2STR(params->bssid));
7102 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
7103 }
7104
7105 if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
7106 params->key_mgmt_suite == KEY_MGMT_PSK ||
7107 params->key_mgmt_suite == KEY_MGMT_802_1X_SHA256 ||
7108 params->key_mgmt_suite == KEY_MGMT_PSK_SHA256) {
7109 wpa_printf(MSG_DEBUG, " * control port");
7110 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
7111 }
7112
7113 if (params->wpa_ie) {
7114 wpa_hexdump(MSG_DEBUG,
7115 " * Extra IEs for Beacon/Probe Response frames",
7116 params->wpa_ie, params->wpa_ie_len);
7117 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
7118 params->wpa_ie);
7119 }
7120
7121 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7122 msg = NULL;
7123 if (ret) {
7124 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)",
7125 ret, strerror(-ret));
7126 count++;
7127 if (ret == -EALREADY && count == 1) {
7128 wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after "
7129 "forced leave");
7130 nl80211_leave_ibss(drv);
7131 nlmsg_free(msg);
7132 goto retry;
7133 }
7134
7135 goto nla_put_failure;
7136 }
7137 ret = 0;
7138 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully");
7139
7140 nla_put_failure:
7141 nlmsg_free(msg);
7142 return ret;
7143 }
7144
7145
wpa_driver_nl80211_try_connect(struct wpa_driver_nl80211_data * drv,struct wpa_driver_associate_params * params)7146 static int wpa_driver_nl80211_try_connect(
7147 struct wpa_driver_nl80211_data *drv,
7148 struct wpa_driver_associate_params *params)
7149 {
7150 struct nl_msg *msg;
7151 enum nl80211_auth_type type;
7152 int ret = 0;
7153 int algs;
7154
7155 msg = nlmsg_alloc();
7156 if (!msg)
7157 return -1;
7158
7159 wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex);
7160 nl80211_cmd(drv, msg, 0, NL80211_CMD_CONNECT);
7161
7162 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7163 if (params->bssid) {
7164 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR,
7165 MAC2STR(params->bssid));
7166 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
7167 }
7168 if (params->freq) {
7169 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq);
7170 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
7171 }
7172 if (params->bg_scan_period >= 0) {
7173 wpa_printf(MSG_DEBUG, " * bg scan period=%d",
7174 params->bg_scan_period);
7175 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
7176 params->bg_scan_period);
7177 }
7178 if (params->ssid) {
7179 wpa_hexdump_ascii(MSG_DEBUG, " * SSID",
7180 params->ssid, params->ssid_len);
7181 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7182 params->ssid);
7183 if (params->ssid_len > sizeof(drv->ssid))
7184 goto nla_put_failure;
7185 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
7186 drv->ssid_len = params->ssid_len;
7187 }
7188 wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len);
7189 if (params->wpa_ie)
7190 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
7191 params->wpa_ie);
7192
7193 algs = 0;
7194 if (params->auth_alg & WPA_AUTH_ALG_OPEN)
7195 algs++;
7196 if (params->auth_alg & WPA_AUTH_ALG_SHARED)
7197 algs++;
7198 if (params->auth_alg & WPA_AUTH_ALG_LEAP)
7199 algs++;
7200 if (algs > 1) {
7201 wpa_printf(MSG_DEBUG, " * Leave out Auth Type for automatic "
7202 "selection");
7203 goto skip_auth_type;
7204 }
7205
7206 if (params->auth_alg & WPA_AUTH_ALG_OPEN)
7207 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
7208 else if (params->auth_alg & WPA_AUTH_ALG_SHARED)
7209 type = NL80211_AUTHTYPE_SHARED_KEY;
7210 else if (params->auth_alg & WPA_AUTH_ALG_LEAP)
7211 type = NL80211_AUTHTYPE_NETWORK_EAP;
7212 else if (params->auth_alg & WPA_AUTH_ALG_FT)
7213 type = NL80211_AUTHTYPE_FT;
7214 else
7215 goto nla_put_failure;
7216
7217 wpa_printf(MSG_DEBUG, " * Auth Type %d", type);
7218 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
7219
7220 skip_auth_type:
7221 if (params->wpa_proto) {
7222 enum nl80211_wpa_versions ver = 0;
7223
7224 if (params->wpa_proto & WPA_PROTO_WPA)
7225 ver |= NL80211_WPA_VERSION_1;
7226 if (params->wpa_proto & WPA_PROTO_RSN)
7227 ver |= NL80211_WPA_VERSION_2;
7228
7229 wpa_printf(MSG_DEBUG, " * WPA Versions 0x%x", ver);
7230 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver);
7231 }
7232
7233 if (params->pairwise_suite != CIPHER_NONE) {
7234 int cipher;
7235
7236 switch (params->pairwise_suite) {
7237 case CIPHER_SMS4:
7238 cipher = WLAN_CIPHER_SUITE_SMS4;
7239 break;
7240 case CIPHER_WEP40:
7241 cipher = WLAN_CIPHER_SUITE_WEP40;
7242 break;
7243 case CIPHER_WEP104:
7244 cipher = WLAN_CIPHER_SUITE_WEP104;
7245 break;
7246 case CIPHER_CCMP:
7247 cipher = WLAN_CIPHER_SUITE_CCMP;
7248 break;
7249 case CIPHER_GCMP:
7250 cipher = WLAN_CIPHER_SUITE_GCMP;
7251 break;
7252 case CIPHER_TKIP:
7253 default:
7254 cipher = WLAN_CIPHER_SUITE_TKIP;
7255 break;
7256 }
7257 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
7258 }
7259
7260 if (params->group_suite != CIPHER_NONE) {
7261 int cipher;
7262
7263 switch (params->group_suite) {
7264 case CIPHER_SMS4:
7265 cipher = WLAN_CIPHER_SUITE_SMS4;
7266 break;
7267 case CIPHER_WEP40:
7268 cipher = WLAN_CIPHER_SUITE_WEP40;
7269 break;
7270 case CIPHER_WEP104:
7271 cipher = WLAN_CIPHER_SUITE_WEP104;
7272 break;
7273 case CIPHER_CCMP:
7274 cipher = WLAN_CIPHER_SUITE_CCMP;
7275 break;
7276 case CIPHER_GCMP:
7277 cipher = WLAN_CIPHER_SUITE_GCMP;
7278 break;
7279 case CIPHER_TKIP:
7280 default:
7281 cipher = WLAN_CIPHER_SUITE_TKIP;
7282 break;
7283 }
7284 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
7285 }
7286
7287 if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
7288 params->key_mgmt_suite == KEY_MGMT_PSK ||
7289 params->key_mgmt_suite == KEY_MGMT_FT_802_1X ||
7290 params->key_mgmt_suite == KEY_MGMT_FT_PSK ||
7291 params->key_mgmt_suite == KEY_MGMT_CCKM) {
7292 int mgmt = WLAN_AKM_SUITE_PSK;
7293
7294 switch (params->key_mgmt_suite) {
7295 case KEY_MGMT_CCKM:
7296 mgmt = WLAN_AKM_SUITE_CCKM;
7297 break;
7298 case KEY_MGMT_802_1X:
7299 mgmt = WLAN_AKM_SUITE_8021X;
7300 break;
7301 case KEY_MGMT_FT_802_1X:
7302 mgmt = WLAN_AKM_SUITE_FT_8021X;
7303 break;
7304 case KEY_MGMT_FT_PSK:
7305 mgmt = WLAN_AKM_SUITE_FT_PSK;
7306 break;
7307 case KEY_MGMT_PSK:
7308 default:
7309 mgmt = WLAN_AKM_SUITE_PSK;
7310 break;
7311 }
7312 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt);
7313 }
7314
7315 #ifdef CONFIG_IEEE80211W
7316 if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
7317 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
7318 #endif /* CONFIG_IEEE80211W */
7319
7320 if (params->disable_ht)
7321 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
7322
7323 if (params->htcaps && params->htcaps_mask) {
7324 int sz = sizeof(struct ieee80211_ht_capabilities);
7325 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
7326 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
7327 params->htcaps_mask);
7328 }
7329
7330 #ifdef CONFIG_VHT_OVERRIDES
7331 if (params->disable_vht) {
7332 wpa_printf(MSG_DEBUG, " * VHT disabled");
7333 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
7334 }
7335
7336 if (params->vhtcaps && params->vhtcaps_mask) {
7337 int sz = sizeof(struct ieee80211_vht_capabilities);
7338 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
7339 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
7340 params->vhtcaps_mask);
7341 }
7342 #endif /* CONFIG_VHT_OVERRIDES */
7343
7344 ret = nl80211_set_conn_keys(params, msg);
7345 if (ret)
7346 goto nla_put_failure;
7347
7348 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7349 msg = NULL;
7350 if (ret) {
7351 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d "
7352 "(%s)", ret, strerror(-ret));
7353 goto nla_put_failure;
7354 }
7355 ret = 0;
7356 wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully");
7357
7358 nla_put_failure:
7359 nlmsg_free(msg);
7360 return ret;
7361
7362 }
7363
7364
wpa_driver_nl80211_connect(struct wpa_driver_nl80211_data * drv,struct wpa_driver_associate_params * params)7365 static int wpa_driver_nl80211_connect(
7366 struct wpa_driver_nl80211_data *drv,
7367 struct wpa_driver_associate_params *params)
7368 {
7369 int ret = wpa_driver_nl80211_try_connect(drv, params);
7370 if (ret == -EALREADY) {
7371 /*
7372 * cfg80211 does not currently accept new connections if
7373 * we are already connected. As a workaround, force
7374 * disconnection and try again.
7375 */
7376 wpa_printf(MSG_DEBUG, "nl80211: Explicitly "
7377 "disconnecting before reassociation "
7378 "attempt");
7379 if (wpa_driver_nl80211_disconnect(
7380 drv, WLAN_REASON_PREV_AUTH_NOT_VALID))
7381 return -1;
7382 /* Ignore the next local disconnect message. */
7383 drv->ignore_next_local_disconnect = 1;
7384 ret = wpa_driver_nl80211_try_connect(drv, params);
7385 }
7386 return ret;
7387 }
7388
7389
wpa_driver_nl80211_associate(void * priv,struct wpa_driver_associate_params * params)7390 static int wpa_driver_nl80211_associate(
7391 void *priv, struct wpa_driver_associate_params *params)
7392 {
7393 struct i802_bss *bss = priv;
7394 struct wpa_driver_nl80211_data *drv = bss->drv;
7395 int ret = -1;
7396 struct nl_msg *msg;
7397
7398 if (params->mode == IEEE80211_MODE_AP)
7399 return wpa_driver_nl80211_ap(drv, params);
7400
7401 if (params->mode == IEEE80211_MODE_IBSS)
7402 return wpa_driver_nl80211_ibss(drv, params);
7403
7404 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
7405 enum nl80211_iftype nlmode = params->p2p ?
7406 NL80211_IFTYPE_P2P_CLIENT : NL80211_IFTYPE_STATION;
7407
7408 if (wpa_driver_nl80211_set_mode(priv, nlmode) < 0)
7409 return -1;
7410 return wpa_driver_nl80211_connect(drv, params);
7411 }
7412
7413 drv->associated = 0;
7414
7415 msg = nlmsg_alloc();
7416 if (!msg)
7417 return -1;
7418
7419 wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
7420 drv->ifindex);
7421 nl80211_cmd(drv, msg, 0, NL80211_CMD_ASSOCIATE);
7422
7423 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7424 if (params->bssid) {
7425 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR,
7426 MAC2STR(params->bssid));
7427 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
7428 }
7429 if (params->freq) {
7430 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq);
7431 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
7432 drv->assoc_freq = params->freq;
7433 } else
7434 drv->assoc_freq = 0;
7435 if (params->bg_scan_period >= 0) {
7436 wpa_printf(MSG_DEBUG, " * bg scan period=%d",
7437 params->bg_scan_period);
7438 NLA_PUT_U16(msg, NL80211_ATTR_BG_SCAN_PERIOD,
7439 params->bg_scan_period);
7440 }
7441 if (params->ssid) {
7442 wpa_hexdump_ascii(MSG_DEBUG, " * SSID",
7443 params->ssid, params->ssid_len);
7444 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
7445 params->ssid);
7446 if (params->ssid_len > sizeof(drv->ssid))
7447 goto nla_put_failure;
7448 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
7449 drv->ssid_len = params->ssid_len;
7450 }
7451 wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len);
7452 if (params->wpa_ie)
7453 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
7454 params->wpa_ie);
7455
7456 if (params->pairwise_suite != CIPHER_NONE) {
7457 int cipher;
7458
7459 switch (params->pairwise_suite) {
7460 case CIPHER_WEP40:
7461 cipher = WLAN_CIPHER_SUITE_WEP40;
7462 break;
7463 case CIPHER_WEP104:
7464 cipher = WLAN_CIPHER_SUITE_WEP104;
7465 break;
7466 case CIPHER_CCMP:
7467 cipher = WLAN_CIPHER_SUITE_CCMP;
7468 break;
7469 case CIPHER_GCMP:
7470 cipher = WLAN_CIPHER_SUITE_GCMP;
7471 break;
7472 case CIPHER_TKIP:
7473 default:
7474 cipher = WLAN_CIPHER_SUITE_TKIP;
7475 break;
7476 }
7477 wpa_printf(MSG_DEBUG, " * pairwise=0x%x", cipher);
7478 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher);
7479 }
7480
7481 if (params->group_suite != CIPHER_NONE) {
7482 int cipher;
7483
7484 switch (params->group_suite) {
7485 case CIPHER_WEP40:
7486 cipher = WLAN_CIPHER_SUITE_WEP40;
7487 break;
7488 case CIPHER_WEP104:
7489 cipher = WLAN_CIPHER_SUITE_WEP104;
7490 break;
7491 case CIPHER_CCMP:
7492 cipher = WLAN_CIPHER_SUITE_CCMP;
7493 break;
7494 case CIPHER_GCMP:
7495 cipher = WLAN_CIPHER_SUITE_GCMP;
7496 break;
7497 case CIPHER_TKIP:
7498 default:
7499 cipher = WLAN_CIPHER_SUITE_TKIP;
7500 break;
7501 }
7502 wpa_printf(MSG_DEBUG, " * group=0x%x", cipher);
7503 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher);
7504 }
7505
7506 #ifdef CONFIG_IEEE80211W
7507 if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED)
7508 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED);
7509 #endif /* CONFIG_IEEE80211W */
7510
7511 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT);
7512
7513 if (params->prev_bssid) {
7514 wpa_printf(MSG_DEBUG, " * prev_bssid=" MACSTR,
7515 MAC2STR(params->prev_bssid));
7516 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN,
7517 params->prev_bssid);
7518 }
7519
7520 if (params->disable_ht)
7521 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_HT);
7522
7523 if (params->htcaps && params->htcaps_mask) {
7524 int sz = sizeof(struct ieee80211_ht_capabilities);
7525 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sz, params->htcaps);
7526 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY_MASK, sz,
7527 params->htcaps_mask);
7528 }
7529
7530 #ifdef CONFIG_VHT_OVERRIDES
7531 if (params->disable_vht) {
7532 wpa_printf(MSG_DEBUG, " * VHT disabled");
7533 NLA_PUT_FLAG(msg, NL80211_ATTR_DISABLE_VHT);
7534 }
7535
7536 if (params->vhtcaps && params->vhtcaps_mask) {
7537 int sz = sizeof(struct ieee80211_vht_capabilities);
7538 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY, sz, params->vhtcaps);
7539 NLA_PUT(msg, NL80211_ATTR_VHT_CAPABILITY_MASK, sz,
7540 params->vhtcaps_mask);
7541 }
7542 #endif /* CONFIG_VHT_OVERRIDES */
7543
7544 if (params->p2p)
7545 wpa_printf(MSG_DEBUG, " * P2P group");
7546
7547 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7548 msg = NULL;
7549 if (ret) {
7550 wpa_dbg(drv->ctx, MSG_DEBUG,
7551 "nl80211: MLME command failed (assoc): ret=%d (%s)",
7552 ret, strerror(-ret));
7553 nl80211_dump_scan(drv);
7554 goto nla_put_failure;
7555 }
7556 ret = 0;
7557 wpa_printf(MSG_DEBUG, "nl80211: Association request send "
7558 "successfully");
7559
7560 nla_put_failure:
7561 nlmsg_free(msg);
7562 return ret;
7563 }
7564
7565
nl80211_set_mode(struct wpa_driver_nl80211_data * drv,int ifindex,enum nl80211_iftype mode)7566 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
7567 int ifindex, enum nl80211_iftype mode)
7568 {
7569 struct nl_msg *msg;
7570 int ret = -ENOBUFS;
7571
7572 wpa_printf(MSG_DEBUG, "nl80211: Set mode ifindex %d iftype %d (%s)",
7573 ifindex, mode, nl80211_iftype_str(mode));
7574
7575 msg = nlmsg_alloc();
7576 if (!msg)
7577 return -ENOMEM;
7578
7579 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_INTERFACE);
7580 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
7581 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
7582
7583 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7584 msg = NULL;
7585 if (!ret)
7586 return 0;
7587 nla_put_failure:
7588 nlmsg_free(msg);
7589 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:"
7590 " %d (%s)", ifindex, mode, ret, strerror(-ret));
7591 return ret;
7592 }
7593
7594
wpa_driver_nl80211_set_mode(struct i802_bss * bss,enum nl80211_iftype nlmode)7595 static int wpa_driver_nl80211_set_mode(struct i802_bss *bss,
7596 enum nl80211_iftype nlmode)
7597 {
7598 struct wpa_driver_nl80211_data *drv = bss->drv;
7599 int ret = -1;
7600 int i;
7601 int was_ap = is_ap_interface(drv->nlmode);
7602 int res;
7603
7604 res = nl80211_set_mode(drv, drv->ifindex, nlmode);
7605 if (res == 0) {
7606 drv->nlmode = nlmode;
7607 ret = 0;
7608 goto done;
7609 }
7610
7611 if (res == -ENODEV)
7612 return -1;
7613
7614 if (nlmode == drv->nlmode) {
7615 wpa_printf(MSG_DEBUG, "nl80211: Interface already in "
7616 "requested mode - ignore error");
7617 ret = 0;
7618 goto done; /* Already in the requested mode */
7619 }
7620
7621 /* mac80211 doesn't allow mode changes while the device is up, so
7622 * take the device down, try to set the mode again, and bring the
7623 * device back up.
7624 */
7625 wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting "
7626 "interface down");
7627 for (i = 0; i < 10; i++) {
7628 res = linux_set_iface_flags(drv->global->ioctl_sock,
7629 bss->ifname, 0);
7630 if (res == -EACCES || res == -ENODEV)
7631 break;
7632 if (res == 0) {
7633 /* Try to set the mode again while the interface is
7634 * down */
7635 ret = nl80211_set_mode(drv, drv->ifindex, nlmode);
7636 if (ret == -EACCES)
7637 break;
7638 res = linux_set_iface_flags(drv->global->ioctl_sock,
7639 bss->ifname, 1);
7640 if (res && !ret)
7641 ret = -1;
7642 else if (ret != -EBUSY)
7643 break;
7644 } else
7645 wpa_printf(MSG_DEBUG, "nl80211: Failed to set "
7646 "interface down");
7647 os_sleep(0, 100000);
7648 }
7649
7650 if (!ret) {
7651 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while "
7652 "interface is down");
7653 drv->nlmode = nlmode;
7654 drv->ignore_if_down_event = 1;
7655 }
7656
7657 done:
7658 if (ret) {
7659 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d "
7660 "from %d failed", nlmode, drv->nlmode);
7661 return ret;
7662 }
7663
7664 if (is_p2p_interface(nlmode))
7665 nl80211_disable_11b_rates(drv, drv->ifindex, 1);
7666 else if (drv->disabled_11b_rates)
7667 nl80211_disable_11b_rates(drv, drv->ifindex, 0);
7668
7669 if (is_ap_interface(nlmode)) {
7670 nl80211_mgmt_unsubscribe(bss, "start AP");
7671 /* Setup additional AP mode functionality if needed */
7672 if (nl80211_setup_ap(bss))
7673 return -1;
7674 } else if (was_ap) {
7675 /* Remove additional AP mode functionality */
7676 nl80211_teardown_ap(bss);
7677 } else {
7678 nl80211_mgmt_unsubscribe(bss, "mode change");
7679 }
7680
7681 if (!bss->in_deinit && !is_ap_interface(nlmode) &&
7682 nl80211_mgmt_subscribe_non_ap(bss) < 0)
7683 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action "
7684 "frame processing - ignore for now");
7685
7686 return 0;
7687 }
7688
7689
wpa_driver_nl80211_get_capa(void * priv,struct wpa_driver_capa * capa)7690 static int wpa_driver_nl80211_get_capa(void *priv,
7691 struct wpa_driver_capa *capa)
7692 {
7693 struct i802_bss *bss = priv;
7694 struct wpa_driver_nl80211_data *drv = bss->drv;
7695 if (!drv->has_capability)
7696 return -1;
7697 os_memcpy(capa, &drv->capa, sizeof(*capa));
7698 if (drv->extended_capa && drv->extended_capa_mask) {
7699 capa->extended_capa = drv->extended_capa;
7700 capa->extended_capa_mask = drv->extended_capa_mask;
7701 capa->extended_capa_len = drv->extended_capa_len;
7702 }
7703 return 0;
7704 }
7705
7706
wpa_driver_nl80211_set_operstate(void * priv,int state)7707 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
7708 {
7709 struct i802_bss *bss = priv;
7710 struct wpa_driver_nl80211_data *drv = bss->drv;
7711
7712 wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
7713 __func__, drv->operstate, state, state ? "UP" : "DORMANT");
7714 drv->operstate = state;
7715 return netlink_send_oper_ifla(drv->global->netlink, drv->ifindex, -1,
7716 state ? IF_OPER_UP : IF_OPER_DORMANT);
7717 }
7718
7719
wpa_driver_nl80211_set_supp_port(void * priv,int authorized)7720 static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized)
7721 {
7722 struct i802_bss *bss = priv;
7723 struct wpa_driver_nl80211_data *drv = bss->drv;
7724 struct nl_msg *msg;
7725 struct nl80211_sta_flag_update upd;
7726
7727 msg = nlmsg_alloc();
7728 if (!msg)
7729 return -ENOMEM;
7730
7731 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
7732
7733 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7734 if_nametoindex(bss->ifname));
7735 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid);
7736
7737 os_memset(&upd, 0, sizeof(upd));
7738 upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED);
7739 if (authorized)
7740 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED);
7741 NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd);
7742
7743 return send_and_recv_msgs(drv, msg, NULL, NULL);
7744 nla_put_failure:
7745 nlmsg_free(msg);
7746 return -ENOBUFS;
7747 }
7748
7749
7750 /* Set kernel driver on given frequency (MHz) */
i802_set_freq(void * priv,struct hostapd_freq_params * freq)7751 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
7752 {
7753 struct i802_bss *bss = priv;
7754 return wpa_driver_nl80211_set_freq(bss, freq);
7755 }
7756
7757
7758 #if defined(HOSTAPD) || defined(CONFIG_AP)
7759
min_int(int a,int b)7760 static inline int min_int(int a, int b)
7761 {
7762 if (a < b)
7763 return a;
7764 return b;
7765 }
7766
7767
get_key_handler(struct nl_msg * msg,void * arg)7768 static int get_key_handler(struct nl_msg *msg, void *arg)
7769 {
7770 struct nlattr *tb[NL80211_ATTR_MAX + 1];
7771 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7772
7773 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7774 genlmsg_attrlen(gnlh, 0), NULL);
7775
7776 /*
7777 * TODO: validate the key index and mac address!
7778 * Otherwise, there's a race condition as soon as
7779 * the kernel starts sending key notifications.
7780 */
7781
7782 if (tb[NL80211_ATTR_KEY_SEQ])
7783 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
7784 min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
7785 return NL_SKIP;
7786 }
7787
7788
i802_get_seqnum(const char * iface,void * priv,const u8 * addr,int idx,u8 * seq)7789 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
7790 int idx, u8 *seq)
7791 {
7792 struct i802_bss *bss = priv;
7793 struct wpa_driver_nl80211_data *drv = bss->drv;
7794 struct nl_msg *msg;
7795
7796 msg = nlmsg_alloc();
7797 if (!msg)
7798 return -ENOMEM;
7799
7800 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_KEY);
7801
7802 if (addr)
7803 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7804 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
7805 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
7806
7807 memset(seq, 0, 6);
7808
7809 return send_and_recv_msgs(drv, msg, get_key_handler, seq);
7810 nla_put_failure:
7811 nlmsg_free(msg);
7812 return -ENOBUFS;
7813 }
7814
7815
i802_set_rts(void * priv,int rts)7816 static int i802_set_rts(void *priv, int rts)
7817 {
7818 struct i802_bss *bss = priv;
7819 struct wpa_driver_nl80211_data *drv = bss->drv;
7820 struct nl_msg *msg;
7821 int ret = -ENOBUFS;
7822 u32 val;
7823
7824 msg = nlmsg_alloc();
7825 if (!msg)
7826 return -ENOMEM;
7827
7828 if (rts >= 2347)
7829 val = (u32) -1;
7830 else
7831 val = rts;
7832
7833 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7834 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7835 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val);
7836
7837 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7838 msg = NULL;
7839 if (!ret)
7840 return 0;
7841 nla_put_failure:
7842 nlmsg_free(msg);
7843 wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: "
7844 "%d (%s)", rts, ret, strerror(-ret));
7845 return ret;
7846 }
7847
7848
i802_set_frag(void * priv,int frag)7849 static int i802_set_frag(void *priv, int frag)
7850 {
7851 struct i802_bss *bss = priv;
7852 struct wpa_driver_nl80211_data *drv = bss->drv;
7853 struct nl_msg *msg;
7854 int ret = -ENOBUFS;
7855 u32 val;
7856
7857 msg = nlmsg_alloc();
7858 if (!msg)
7859 return -ENOMEM;
7860
7861 if (frag >= 2346)
7862 val = (u32) -1;
7863 else
7864 val = frag;
7865
7866 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
7867 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
7868 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val);
7869
7870 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
7871 msg = NULL;
7872 if (!ret)
7873 return 0;
7874 nla_put_failure:
7875 nlmsg_free(msg);
7876 wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold "
7877 "%d: %d (%s)", frag, ret, strerror(-ret));
7878 return ret;
7879 }
7880
7881
i802_flush(void * priv)7882 static int i802_flush(void *priv)
7883 {
7884 struct i802_bss *bss = priv;
7885 struct wpa_driver_nl80211_data *drv = bss->drv;
7886 struct nl_msg *msg;
7887 int res;
7888
7889 msg = nlmsg_alloc();
7890 if (!msg)
7891 return -1;
7892
7893 nl80211_cmd(drv, msg, 0, NL80211_CMD_DEL_STATION);
7894
7895 /*
7896 * XXX: FIX! this needs to flush all VLANs too
7897 */
7898 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
7899 if_nametoindex(bss->ifname));
7900
7901 res = send_and_recv_msgs(drv, msg, NULL, NULL);
7902 if (res) {
7903 wpa_printf(MSG_DEBUG, "nl80211: Station flush failed: ret=%d "
7904 "(%s)", res, strerror(-res));
7905 }
7906 return res;
7907 nla_put_failure:
7908 nlmsg_free(msg);
7909 return -ENOBUFS;
7910 }
7911
7912 #endif /* HOSTAPD || CONFIG_AP */
7913
7914
get_sta_handler(struct nl_msg * msg,void * arg)7915 static int get_sta_handler(struct nl_msg *msg, void *arg)
7916 {
7917 struct nlattr *tb[NL80211_ATTR_MAX + 1];
7918 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
7919 struct hostap_sta_driver_data *data = arg;
7920 struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
7921 static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
7922 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
7923 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
7924 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
7925 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
7926 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
7927 [NL80211_STA_INFO_TX_FAILED] = { .type = NLA_U32 },
7928 };
7929
7930 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
7931 genlmsg_attrlen(gnlh, 0), NULL);
7932
7933 /*
7934 * TODO: validate the interface and mac address!
7935 * Otherwise, there's a race condition as soon as
7936 * the kernel starts sending station notifications.
7937 */
7938
7939 if (!tb[NL80211_ATTR_STA_INFO]) {
7940 wpa_printf(MSG_DEBUG, "sta stats missing!");
7941 return NL_SKIP;
7942 }
7943 if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
7944 tb[NL80211_ATTR_STA_INFO],
7945 stats_policy)) {
7946 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
7947 return NL_SKIP;
7948 }
7949
7950 if (stats[NL80211_STA_INFO_INACTIVE_TIME])
7951 data->inactive_msec =
7952 nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
7953 if (stats[NL80211_STA_INFO_RX_BYTES])
7954 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
7955 if (stats[NL80211_STA_INFO_TX_BYTES])
7956 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
7957 if (stats[NL80211_STA_INFO_RX_PACKETS])
7958 data->rx_packets =
7959 nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
7960 if (stats[NL80211_STA_INFO_TX_PACKETS])
7961 data->tx_packets =
7962 nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
7963 if (stats[NL80211_STA_INFO_TX_FAILED])
7964 data->tx_retry_failed =
7965 nla_get_u32(stats[NL80211_STA_INFO_TX_FAILED]);
7966
7967 return NL_SKIP;
7968 }
7969
i802_read_sta_data(struct i802_bss * bss,struct hostap_sta_driver_data * data,const u8 * addr)7970 static int i802_read_sta_data(struct i802_bss *bss,
7971 struct hostap_sta_driver_data *data,
7972 const u8 *addr)
7973 {
7974 struct wpa_driver_nl80211_data *drv = bss->drv;
7975 struct nl_msg *msg;
7976
7977 os_memset(data, 0, sizeof(*data));
7978 msg = nlmsg_alloc();
7979 if (!msg)
7980 return -ENOMEM;
7981
7982 nl80211_cmd(drv, msg, 0, NL80211_CMD_GET_STATION);
7983
7984 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
7985 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
7986
7987 return send_and_recv_msgs(drv, msg, get_sta_handler, data);
7988 nla_put_failure:
7989 nlmsg_free(msg);
7990 return -ENOBUFS;
7991 }
7992
7993
7994 #if defined(HOSTAPD) || defined(CONFIG_AP)
7995
i802_set_tx_queue_params(void * priv,int queue,int aifs,int cw_min,int cw_max,int burst_time)7996 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
7997 int cw_min, int cw_max, int burst_time)
7998 {
7999 struct i802_bss *bss = priv;
8000 struct wpa_driver_nl80211_data *drv = bss->drv;
8001 struct nl_msg *msg;
8002 struct nlattr *txq, *params;
8003
8004 msg = nlmsg_alloc();
8005 if (!msg)
8006 return -1;
8007
8008 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_WIPHY);
8009
8010 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
8011
8012 txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
8013 if (!txq)
8014 goto nla_put_failure;
8015
8016 /* We are only sending parameters for a single TXQ at a time */
8017 params = nla_nest_start(msg, 1);
8018 if (!params)
8019 goto nla_put_failure;
8020
8021 switch (queue) {
8022 case 0:
8023 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO);
8024 break;
8025 case 1:
8026 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI);
8027 break;
8028 case 2:
8029 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE);
8030 break;
8031 case 3:
8032 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK);
8033 break;
8034 }
8035 /* Burst time is configured in units of 0.1 msec and TXOP parameter in
8036 * 32 usec, so need to convert the value here. */
8037 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
8038 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
8039 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
8040 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
8041
8042 nla_nest_end(msg, params);
8043
8044 nla_nest_end(msg, txq);
8045
8046 if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
8047 return 0;
8048 msg = NULL;
8049 nla_put_failure:
8050 nlmsg_free(msg);
8051 return -1;
8052 }
8053
8054
i802_set_sta_vlan(struct i802_bss * bss,const u8 * addr,const char * ifname,int vlan_id)8055 static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
8056 const char *ifname, int vlan_id)
8057 {
8058 struct wpa_driver_nl80211_data *drv = bss->drv;
8059 struct nl_msg *msg;
8060 int ret = -ENOBUFS;
8061
8062 msg = nlmsg_alloc();
8063 if (!msg)
8064 return -ENOMEM;
8065
8066 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_STATION);
8067
8068 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
8069 if_nametoindex(bss->ifname));
8070 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
8071 NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN,
8072 if_nametoindex(ifname));
8073
8074 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8075 msg = NULL;
8076 if (ret < 0) {
8077 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr="
8078 MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)",
8079 MAC2STR(addr), ifname, vlan_id, ret,
8080 strerror(-ret));
8081 }
8082 nla_put_failure:
8083 nlmsg_free(msg);
8084 return ret;
8085 }
8086
8087
i802_get_inact_sec(void * priv,const u8 * addr)8088 static int i802_get_inact_sec(void *priv, const u8 *addr)
8089 {
8090 struct hostap_sta_driver_data data;
8091 int ret;
8092
8093 data.inactive_msec = (unsigned long) -1;
8094 ret = i802_read_sta_data(priv, &data, addr);
8095 if (ret || data.inactive_msec == (unsigned long) -1)
8096 return -1;
8097 return data.inactive_msec / 1000;
8098 }
8099
8100
i802_sta_clear_stats(void * priv,const u8 * addr)8101 static int i802_sta_clear_stats(void *priv, const u8 *addr)
8102 {
8103 #if 0
8104 /* TODO */
8105 #endif
8106 return 0;
8107 }
8108
8109
i802_sta_deauth(void * priv,const u8 * own_addr,const u8 * addr,int reason)8110 static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
8111 int reason)
8112 {
8113 struct i802_bss *bss = priv;
8114 struct wpa_driver_nl80211_data *drv = bss->drv;
8115 struct ieee80211_mgmt mgmt;
8116
8117 if (drv->device_ap_sme)
8118 return wpa_driver_nl80211_sta_remove(bss, addr);
8119
8120 memset(&mgmt, 0, sizeof(mgmt));
8121 mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
8122 WLAN_FC_STYPE_DEAUTH);
8123 memcpy(mgmt.da, addr, ETH_ALEN);
8124 memcpy(mgmt.sa, own_addr, ETH_ALEN);
8125 memcpy(mgmt.bssid, own_addr, ETH_ALEN);
8126 mgmt.u.deauth.reason_code = host_to_le16(reason);
8127 return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
8128 IEEE80211_HDRLEN +
8129 sizeof(mgmt.u.deauth), 0, 0, 0, 0,
8130 0);
8131 }
8132
8133
i802_sta_disassoc(void * priv,const u8 * own_addr,const u8 * addr,int reason)8134 static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
8135 int reason)
8136 {
8137 struct i802_bss *bss = priv;
8138 struct wpa_driver_nl80211_data *drv = bss->drv;
8139 struct ieee80211_mgmt mgmt;
8140
8141 if (drv->device_ap_sme)
8142 return wpa_driver_nl80211_sta_remove(bss, addr);
8143
8144 memset(&mgmt, 0, sizeof(mgmt));
8145 mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
8146 WLAN_FC_STYPE_DISASSOC);
8147 memcpy(mgmt.da, addr, ETH_ALEN);
8148 memcpy(mgmt.sa, own_addr, ETH_ALEN);
8149 memcpy(mgmt.bssid, own_addr, ETH_ALEN);
8150 mgmt.u.disassoc.reason_code = host_to_le16(reason);
8151 return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
8152 IEEE80211_HDRLEN +
8153 sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
8154 0);
8155 }
8156
8157 #endif /* HOSTAPD || CONFIG_AP */
8158
8159 #ifdef HOSTAPD
8160
add_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)8161 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
8162 {
8163 int i;
8164 int *old;
8165
8166 wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
8167 ifidx);
8168 for (i = 0; i < drv->num_if_indices; i++) {
8169 if (drv->if_indices[i] == 0) {
8170 drv->if_indices[i] = ifidx;
8171 return;
8172 }
8173 }
8174
8175 if (drv->if_indices != drv->default_if_indices)
8176 old = drv->if_indices;
8177 else
8178 old = NULL;
8179
8180 drv->if_indices = os_realloc_array(old, drv->num_if_indices + 1,
8181 sizeof(int));
8182 if (!drv->if_indices) {
8183 if (!old)
8184 drv->if_indices = drv->default_if_indices;
8185 else
8186 drv->if_indices = old;
8187 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
8188 "interfaces");
8189 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
8190 return;
8191 } else if (!old)
8192 os_memcpy(drv->if_indices, drv->default_if_indices,
8193 sizeof(drv->default_if_indices));
8194 drv->if_indices[drv->num_if_indices] = ifidx;
8195 drv->num_if_indices++;
8196 }
8197
8198
del_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)8199 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
8200 {
8201 int i;
8202
8203 for (i = 0; i < drv->num_if_indices; i++) {
8204 if (drv->if_indices[i] == ifidx) {
8205 drv->if_indices[i] = 0;
8206 break;
8207 }
8208 }
8209 }
8210
8211
have_ifidx(struct wpa_driver_nl80211_data * drv,int ifidx)8212 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
8213 {
8214 int i;
8215
8216 for (i = 0; i < drv->num_if_indices; i++)
8217 if (drv->if_indices[i] == ifidx)
8218 return 1;
8219
8220 return 0;
8221 }
8222
8223
i802_set_wds_sta(void * priv,const u8 * addr,int aid,int val,const char * bridge_ifname)8224 static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val,
8225 const char *bridge_ifname)
8226 {
8227 struct i802_bss *bss = priv;
8228 struct wpa_driver_nl80211_data *drv = bss->drv;
8229 char name[IFNAMSIZ + 1];
8230
8231 os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid);
8232 wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR
8233 " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name);
8234 if (val) {
8235 if (!if_nametoindex(name)) {
8236 if (nl80211_create_iface(drv, name,
8237 NL80211_IFTYPE_AP_VLAN,
8238 bss->addr, 1) < 0)
8239 return -1;
8240 if (bridge_ifname &&
8241 linux_br_add_if(drv->global->ioctl_sock,
8242 bridge_ifname, name) < 0)
8243 return -1;
8244 }
8245 if (linux_set_iface_flags(drv->global->ioctl_sock, name, 1)) {
8246 wpa_printf(MSG_ERROR, "nl80211: Failed to set WDS STA "
8247 "interface %s up", name);
8248 }
8249 return i802_set_sta_vlan(priv, addr, name, 0);
8250 } else {
8251 if (bridge_ifname)
8252 linux_br_del_if(drv->global->ioctl_sock, bridge_ifname,
8253 name);
8254
8255 i802_set_sta_vlan(priv, addr, bss->ifname, 0);
8256 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN,
8257 name);
8258 }
8259 }
8260
8261
handle_eapol(int sock,void * eloop_ctx,void * sock_ctx)8262 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
8263 {
8264 struct wpa_driver_nl80211_data *drv = eloop_ctx;
8265 struct sockaddr_ll lladdr;
8266 unsigned char buf[3000];
8267 int len;
8268 socklen_t fromlen = sizeof(lladdr);
8269
8270 len = recvfrom(sock, buf, sizeof(buf), 0,
8271 (struct sockaddr *)&lladdr, &fromlen);
8272 if (len < 0) {
8273 perror("recv");
8274 return;
8275 }
8276
8277 if (have_ifidx(drv, lladdr.sll_ifindex))
8278 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len);
8279 }
8280
8281
i802_check_bridge(struct wpa_driver_nl80211_data * drv,struct i802_bss * bss,const char * brname,const char * ifname)8282 static int i802_check_bridge(struct wpa_driver_nl80211_data *drv,
8283 struct i802_bss *bss,
8284 const char *brname, const char *ifname)
8285 {
8286 int ifindex;
8287 char in_br[IFNAMSIZ];
8288
8289 os_strlcpy(bss->brname, brname, IFNAMSIZ);
8290 ifindex = if_nametoindex(brname);
8291 if (ifindex == 0) {
8292 /*
8293 * Bridge was configured, but the bridge device does
8294 * not exist. Try to add it now.
8295 */
8296 if (linux_br_add(drv->global->ioctl_sock, brname) < 0) {
8297 wpa_printf(MSG_ERROR, "nl80211: Failed to add the "
8298 "bridge interface %s: %s",
8299 brname, strerror(errno));
8300 return -1;
8301 }
8302 bss->added_bridge = 1;
8303 add_ifidx(drv, if_nametoindex(brname));
8304 }
8305
8306 if (linux_br_get(in_br, ifname) == 0) {
8307 if (os_strcmp(in_br, brname) == 0)
8308 return 0; /* already in the bridge */
8309
8310 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from "
8311 "bridge %s", ifname, in_br);
8312 if (linux_br_del_if(drv->global->ioctl_sock, in_br, ifname) <
8313 0) {
8314 wpa_printf(MSG_ERROR, "nl80211: Failed to "
8315 "remove interface %s from bridge "
8316 "%s: %s",
8317 ifname, brname, strerror(errno));
8318 return -1;
8319 }
8320 }
8321
8322 wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s",
8323 ifname, brname);
8324 if (linux_br_add_if(drv->global->ioctl_sock, brname, ifname) < 0) {
8325 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s "
8326 "into bridge %s: %s",
8327 ifname, brname, strerror(errno));
8328 return -1;
8329 }
8330 bss->added_if_into_bridge = 1;
8331
8332 return 0;
8333 }
8334
8335
i802_init(struct hostapd_data * hapd,struct wpa_init_params * params)8336 static void *i802_init(struct hostapd_data *hapd,
8337 struct wpa_init_params *params)
8338 {
8339 struct wpa_driver_nl80211_data *drv;
8340 struct i802_bss *bss;
8341 size_t i;
8342 char brname[IFNAMSIZ];
8343 int ifindex, br_ifindex;
8344 int br_added = 0;
8345
8346 bss = wpa_driver_nl80211_init(hapd, params->ifname,
8347 params->global_priv);
8348 if (bss == NULL)
8349 return NULL;
8350
8351 drv = bss->drv;
8352 drv->nlmode = NL80211_IFTYPE_AP;
8353 drv->eapol_sock = -1;
8354
8355 if (linux_br_get(brname, params->ifname) == 0) {
8356 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s",
8357 params->ifname, brname);
8358 br_ifindex = if_nametoindex(brname);
8359 } else {
8360 brname[0] = '\0';
8361 br_ifindex = 0;
8362 }
8363
8364 drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
8365 drv->if_indices = drv->default_if_indices;
8366 for (i = 0; i < params->num_bridge; i++) {
8367 if (params->bridge[i]) {
8368 ifindex = if_nametoindex(params->bridge[i]);
8369 if (ifindex)
8370 add_ifidx(drv, ifindex);
8371 if (ifindex == br_ifindex)
8372 br_added = 1;
8373 }
8374 }
8375 if (!br_added && br_ifindex &&
8376 (params->num_bridge == 0 || !params->bridge[0]))
8377 add_ifidx(drv, br_ifindex);
8378
8379 /* start listening for EAPOL on the default AP interface */
8380 add_ifidx(drv, drv->ifindex);
8381
8382 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 0))
8383 goto failed;
8384
8385 if (params->bssid) {
8386 if (linux_set_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
8387 params->bssid))
8388 goto failed;
8389 }
8390
8391 if (wpa_driver_nl80211_set_mode(bss, drv->nlmode)) {
8392 wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s "
8393 "into AP mode", bss->ifname);
8394 goto failed;
8395 }
8396
8397 if (params->num_bridge && params->bridge[0] &&
8398 i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0)
8399 goto failed;
8400
8401 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1))
8402 goto failed;
8403
8404 drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
8405 if (drv->eapol_sock < 0) {
8406 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
8407 goto failed;
8408 }
8409
8410 if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
8411 {
8412 printf("Could not register read socket for eapol\n");
8413 goto failed;
8414 }
8415
8416 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
8417 params->own_addr))
8418 goto failed;
8419
8420 memcpy(bss->addr, params->own_addr, ETH_ALEN);
8421
8422 return bss;
8423
8424 failed:
8425 wpa_driver_nl80211_deinit(bss);
8426 return NULL;
8427 }
8428
8429
i802_deinit(void * priv)8430 static void i802_deinit(void *priv)
8431 {
8432 struct i802_bss *bss = priv;
8433 wpa_driver_nl80211_deinit(bss);
8434 }
8435
8436 #endif /* HOSTAPD */
8437
8438
wpa_driver_nl80211_if_type(enum wpa_driver_if_type type)8439 static enum nl80211_iftype wpa_driver_nl80211_if_type(
8440 enum wpa_driver_if_type type)
8441 {
8442 switch (type) {
8443 case WPA_IF_STATION:
8444 return NL80211_IFTYPE_STATION;
8445 case WPA_IF_P2P_CLIENT:
8446 case WPA_IF_P2P_GROUP:
8447 return NL80211_IFTYPE_P2P_CLIENT;
8448 case WPA_IF_AP_VLAN:
8449 return NL80211_IFTYPE_AP_VLAN;
8450 case WPA_IF_AP_BSS:
8451 return NL80211_IFTYPE_AP;
8452 case WPA_IF_P2P_GO:
8453 return NL80211_IFTYPE_P2P_GO;
8454 }
8455 return -1;
8456 }
8457
8458
8459 #ifdef CONFIG_P2P
8460
nl80211_addr_in_use(struct nl80211_global * global,const u8 * addr)8461 static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr)
8462 {
8463 struct wpa_driver_nl80211_data *drv;
8464 dl_list_for_each(drv, &global->interfaces,
8465 struct wpa_driver_nl80211_data, list) {
8466 if (os_memcmp(addr, drv->first_bss.addr, ETH_ALEN) == 0)
8467 return 1;
8468 }
8469 return 0;
8470 }
8471
8472
nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data * drv,u8 * new_addr)8473 static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv,
8474 u8 *new_addr)
8475 {
8476 unsigned int idx;
8477
8478 if (!drv->global)
8479 return -1;
8480
8481 os_memcpy(new_addr, drv->first_bss.addr, ETH_ALEN);
8482 for (idx = 0; idx < 64; idx++) {
8483 new_addr[0] = drv->first_bss.addr[0] | 0x02;
8484 new_addr[0] ^= idx << 2;
8485 if (!nl80211_addr_in_use(drv->global, new_addr))
8486 break;
8487 }
8488 if (idx == 64)
8489 return -1;
8490
8491 wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address "
8492 MACSTR, MAC2STR(new_addr));
8493
8494 return 0;
8495 }
8496
8497 #endif /* CONFIG_P2P */
8498
8499
wpa_driver_nl80211_if_add(void * priv,enum wpa_driver_if_type type,const char * ifname,const u8 * addr,void * bss_ctx,void ** drv_priv,char * force_ifname,u8 * if_addr,const char * bridge)8500 static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type,
8501 const char *ifname, const u8 *addr,
8502 void *bss_ctx, void **drv_priv,
8503 char *force_ifname, u8 *if_addr,
8504 const char *bridge)
8505 {
8506 struct i802_bss *bss = priv;
8507 struct wpa_driver_nl80211_data *drv = bss->drv;
8508 int ifidx;
8509 #ifdef HOSTAPD
8510 struct i802_bss *new_bss = NULL;
8511
8512 if (type == WPA_IF_AP_BSS) {
8513 new_bss = os_zalloc(sizeof(*new_bss));
8514 if (new_bss == NULL)
8515 return -1;
8516 }
8517 #endif /* HOSTAPD */
8518
8519 if (addr)
8520 os_memcpy(if_addr, addr, ETH_ALEN);
8521 ifidx = nl80211_create_iface(drv, ifname,
8522 wpa_driver_nl80211_if_type(type), addr,
8523 0);
8524 if (ifidx < 0) {
8525 #ifdef HOSTAPD
8526 os_free(new_bss);
8527 #endif /* HOSTAPD */
8528 return -1;
8529 }
8530
8531 if (!addr &&
8532 linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
8533 if_addr) < 0) {
8534 nl80211_remove_iface(drv, ifidx);
8535 return -1;
8536 }
8537
8538 #ifdef CONFIG_P2P
8539 if (!addr &&
8540 (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP ||
8541 type == WPA_IF_P2P_GO)) {
8542 /* Enforce unique P2P Interface Address */
8543 u8 new_addr[ETH_ALEN], own_addr[ETH_ALEN];
8544
8545 if (linux_get_ifhwaddr(drv->global->ioctl_sock, bss->ifname,
8546 own_addr) < 0 ||
8547 linux_get_ifhwaddr(drv->global->ioctl_sock, ifname,
8548 new_addr) < 0) {
8549 nl80211_remove_iface(drv, ifidx);
8550 return -1;
8551 }
8552 if (os_memcmp(own_addr, new_addr, ETH_ALEN) == 0) {
8553 wpa_printf(MSG_DEBUG, "nl80211: Allocate new address "
8554 "for P2P group interface");
8555 if (nl80211_p2p_interface_addr(drv, new_addr) < 0) {
8556 nl80211_remove_iface(drv, ifidx);
8557 return -1;
8558 }
8559 if (linux_set_ifhwaddr(drv->global->ioctl_sock, ifname,
8560 new_addr) < 0) {
8561 nl80211_remove_iface(drv, ifidx);
8562 return -1;
8563 }
8564 }
8565 os_memcpy(if_addr, new_addr, ETH_ALEN);
8566 }
8567 #endif /* CONFIG_P2P */
8568
8569 #ifdef HOSTAPD
8570 if (bridge &&
8571 i802_check_bridge(drv, new_bss, bridge, ifname) < 0) {
8572 wpa_printf(MSG_ERROR, "nl80211: Failed to add the new "
8573 "interface %s to a bridge %s", ifname, bridge);
8574 nl80211_remove_iface(drv, ifidx);
8575 os_free(new_bss);
8576 return -1;
8577 }
8578
8579 if (type == WPA_IF_AP_BSS) {
8580 if (linux_set_iface_flags(drv->global->ioctl_sock, ifname, 1))
8581 {
8582 nl80211_remove_iface(drv, ifidx);
8583 os_free(new_bss);
8584 return -1;
8585 }
8586 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ);
8587 os_memcpy(new_bss->addr, if_addr, ETH_ALEN);
8588 new_bss->ifindex = ifidx;
8589 new_bss->drv = drv;
8590 new_bss->next = drv->first_bss.next;
8591 new_bss->freq = drv->first_bss.freq;
8592 new_bss->ctx = bss_ctx;
8593 drv->first_bss.next = new_bss;
8594 if (drv_priv)
8595 *drv_priv = new_bss;
8596 nl80211_init_bss(new_bss);
8597
8598 /* Subscribe management frames for this WPA_IF_AP_BSS */
8599 if (nl80211_setup_ap(new_bss))
8600 return -1;
8601 }
8602 #endif /* HOSTAPD */
8603
8604 if (drv->global)
8605 drv->global->if_add_ifindex = ifidx;
8606
8607 return 0;
8608 }
8609
8610
wpa_driver_nl80211_if_remove(struct i802_bss * bss,enum wpa_driver_if_type type,const char * ifname)8611 static int wpa_driver_nl80211_if_remove(struct i802_bss *bss,
8612 enum wpa_driver_if_type type,
8613 const char *ifname)
8614 {
8615 struct wpa_driver_nl80211_data *drv = bss->drv;
8616 int ifindex = if_nametoindex(ifname);
8617
8618 wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d",
8619 __func__, type, ifname, ifindex);
8620 if (ifindex <= 0)
8621 return -1;
8622
8623 nl80211_remove_iface(drv, ifindex);
8624
8625 #ifdef HOSTAPD
8626 if (type != WPA_IF_AP_BSS)
8627 return 0;
8628
8629 if (bss->added_if_into_bridge) {
8630 if (linux_br_del_if(drv->global->ioctl_sock, bss->brname,
8631 bss->ifname) < 0)
8632 wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8633 "interface %s from bridge %s: %s",
8634 bss->ifname, bss->brname, strerror(errno));
8635 }
8636 if (bss->added_bridge) {
8637 if (linux_br_del(drv->global->ioctl_sock, bss->brname) < 0)
8638 wpa_printf(MSG_INFO, "nl80211: Failed to remove "
8639 "bridge %s: %s",
8640 bss->brname, strerror(errno));
8641 }
8642
8643 if (bss != &drv->first_bss) {
8644 struct i802_bss *tbss;
8645
8646 for (tbss = &drv->first_bss; tbss; tbss = tbss->next) {
8647 if (tbss->next == bss) {
8648 tbss->next = bss->next;
8649 /* Unsubscribe management frames */
8650 nl80211_teardown_ap(bss);
8651 nl80211_destroy_bss(bss);
8652 os_free(bss);
8653 bss = NULL;
8654 break;
8655 }
8656 }
8657 if (bss)
8658 wpa_printf(MSG_INFO, "nl80211: %s - could not find "
8659 "BSS %p in the list", __func__, bss);
8660 }
8661 #endif /* HOSTAPD */
8662
8663 return 0;
8664 }
8665
8666
cookie_handler(struct nl_msg * msg,void * arg)8667 static int cookie_handler(struct nl_msg *msg, void *arg)
8668 {
8669 struct nlattr *tb[NL80211_ATTR_MAX + 1];
8670 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
8671 u64 *cookie = arg;
8672 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
8673 genlmsg_attrlen(gnlh, 0), NULL);
8674 if (tb[NL80211_ATTR_COOKIE])
8675 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]);
8676 return NL_SKIP;
8677 }
8678
8679
nl80211_send_frame_cmd(struct i802_bss * bss,unsigned int freq,unsigned int wait,const u8 * buf,size_t buf_len,u64 * cookie_out,int no_cck,int no_ack,int offchanok)8680 static int nl80211_send_frame_cmd(struct i802_bss *bss,
8681 unsigned int freq, unsigned int wait,
8682 const u8 *buf, size_t buf_len,
8683 u64 *cookie_out, int no_cck, int no_ack,
8684 int offchanok)
8685 {
8686 struct wpa_driver_nl80211_data *drv = bss->drv;
8687 struct nl_msg *msg;
8688 u64 cookie;
8689 int ret = -1;
8690
8691 msg = nlmsg_alloc();
8692 if (!msg)
8693 return -1;
8694
8695 wpa_printf(MSG_DEBUG, "nl80211: CMD_FRAME freq=%u wait=%u no_cck=%d "
8696 "no_ack=%d offchanok=%d",
8697 freq, wait, no_cck, no_ack, offchanok);
8698 nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME);
8699
8700 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
8701 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8702 if (wait)
8703 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait);
8704 if (offchanok && (drv->capa.flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX))
8705 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK);
8706 if (no_cck)
8707 NLA_PUT_FLAG(msg, NL80211_ATTR_TX_NO_CCK_RATE);
8708 if (no_ack)
8709 NLA_PUT_FLAG(msg, NL80211_ATTR_DONT_WAIT_FOR_ACK);
8710
8711 NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf);
8712
8713 cookie = 0;
8714 ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8715 msg = NULL;
8716 if (ret) {
8717 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d "
8718 "(%s) (freq=%u wait=%u)", ret, strerror(-ret),
8719 freq, wait);
8720 goto nla_put_failure;
8721 }
8722 wpa_printf(MSG_DEBUG, "nl80211: Frame TX command accepted%s; "
8723 "cookie 0x%llx", no_ack ? " (no ACK)" : "",
8724 (long long unsigned int) cookie);
8725
8726 if (cookie_out)
8727 *cookie_out = no_ack ? (u64) -1 : cookie;
8728
8729 nla_put_failure:
8730 nlmsg_free(msg);
8731 return ret;
8732 }
8733
8734
wpa_driver_nl80211_send_action(struct i802_bss * bss,unsigned int freq,unsigned int wait_time,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,int no_cck)8735 static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
8736 unsigned int freq,
8737 unsigned int wait_time,
8738 const u8 *dst, const u8 *src,
8739 const u8 *bssid,
8740 const u8 *data, size_t data_len,
8741 int no_cck)
8742 {
8743 struct wpa_driver_nl80211_data *drv = bss->drv;
8744 int ret = -1;
8745 u8 *buf;
8746 struct ieee80211_hdr *hdr;
8747
8748 wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
8749 "freq=%u MHz wait=%d ms no_cck=%d)",
8750 drv->ifindex, freq, wait_time, no_cck);
8751
8752 buf = os_zalloc(24 + data_len);
8753 if (buf == NULL)
8754 return ret;
8755 os_memcpy(buf + 24, data, data_len);
8756 hdr = (struct ieee80211_hdr *) buf;
8757 hdr->frame_control =
8758 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION);
8759 os_memcpy(hdr->addr1, dst, ETH_ALEN);
8760 os_memcpy(hdr->addr2, src, ETH_ALEN);
8761 os_memcpy(hdr->addr3, bssid, ETH_ALEN);
8762
8763 if (is_ap_interface(drv->nlmode))
8764 ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
8765 0, freq, no_cck, 1,
8766 wait_time);
8767 else
8768 ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
8769 24 + data_len,
8770 &drv->send_action_cookie,
8771 no_cck, 0, 1);
8772
8773 os_free(buf);
8774 return ret;
8775 }
8776
8777
wpa_driver_nl80211_send_action_cancel_wait(void * priv)8778 static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
8779 {
8780 struct i802_bss *bss = priv;
8781 struct wpa_driver_nl80211_data *drv = bss->drv;
8782 struct nl_msg *msg;
8783 int ret;
8784
8785 msg = nlmsg_alloc();
8786 if (!msg)
8787 return;
8788
8789 wpa_printf(MSG_DEBUG, "nl80211: Cancel TX frame wait: cookie=0x%llx",
8790 (long long unsigned int) drv->send_action_cookie);
8791 nl80211_cmd(drv, msg, 0, NL80211_CMD_FRAME_WAIT_CANCEL);
8792
8793 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8794 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie);
8795
8796 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8797 msg = NULL;
8798 if (ret)
8799 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d "
8800 "(%s)", ret, strerror(-ret));
8801
8802 nla_put_failure:
8803 nlmsg_free(msg);
8804 }
8805
8806
wpa_driver_nl80211_remain_on_channel(void * priv,unsigned int freq,unsigned int duration)8807 static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq,
8808 unsigned int duration)
8809 {
8810 struct i802_bss *bss = priv;
8811 struct wpa_driver_nl80211_data *drv = bss->drv;
8812 struct nl_msg *msg;
8813 int ret;
8814 u64 cookie;
8815
8816 msg = nlmsg_alloc();
8817 if (!msg)
8818 return -1;
8819
8820 nl80211_cmd(drv, msg, 0, NL80211_CMD_REMAIN_ON_CHANNEL);
8821
8822 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8823 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
8824 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration);
8825
8826 cookie = 0;
8827 ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie);
8828 msg = NULL;
8829 if (ret == 0) {
8830 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie "
8831 "0x%llx for freq=%u MHz duration=%u",
8832 (long long unsigned int) cookie, freq, duration);
8833 drv->remain_on_chan_cookie = cookie;
8834 drv->pending_remain_on_chan = 1;
8835 return 0;
8836 }
8837 wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel "
8838 "(freq=%d duration=%u): %d (%s)",
8839 freq, duration, ret, strerror(-ret));
8840 nla_put_failure:
8841 nlmsg_free(msg);
8842 return -1;
8843 }
8844
8845
wpa_driver_nl80211_cancel_remain_on_channel(void * priv)8846 static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv)
8847 {
8848 struct i802_bss *bss = priv;
8849 struct wpa_driver_nl80211_data *drv = bss->drv;
8850 struct nl_msg *msg;
8851 int ret;
8852
8853 if (!drv->pending_remain_on_chan) {
8854 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel "
8855 "to cancel");
8856 return -1;
8857 }
8858
8859 wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie "
8860 "0x%llx",
8861 (long long unsigned int) drv->remain_on_chan_cookie);
8862
8863 msg = nlmsg_alloc();
8864 if (!msg)
8865 return -1;
8866
8867 nl80211_cmd(drv, msg, 0, NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL);
8868
8869 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
8870 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie);
8871
8872 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8873 msg = NULL;
8874 if (ret == 0)
8875 return 0;
8876 wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: "
8877 "%d (%s)", ret, strerror(-ret));
8878 nla_put_failure:
8879 nlmsg_free(msg);
8880 return -1;
8881 }
8882
8883
wpa_driver_nl80211_probe_req_report(struct i802_bss * bss,int report)8884 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
8885 {
8886 struct wpa_driver_nl80211_data *drv = bss->drv;
8887
8888 if (!report) {
8889 if (bss->nl_preq && drv->device_ap_sme &&
8890 is_ap_interface(drv->nlmode)) {
8891 /*
8892 * Do not disable Probe Request reporting that was
8893 * enabled in nl80211_setup_ap().
8894 */
8895 wpa_printf(MSG_DEBUG, "nl80211: Skip disabling of "
8896 "Probe Request reporting nl_preq=%p while "
8897 "in AP mode", bss->nl_preq);
8898 } else if (bss->nl_preq) {
8899 wpa_printf(MSG_DEBUG, "nl80211: Disable Probe Request "
8900 "reporting nl_preq=%p", bss->nl_preq);
8901 eloop_unregister_read_sock(
8902 nl_socket_get_fd(bss->nl_preq));
8903 nl_destroy_handles(&bss->nl_preq);
8904 }
8905 return 0;
8906 }
8907
8908 if (bss->nl_preq) {
8909 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting "
8910 "already on! nl_preq=%p", bss->nl_preq);
8911 return 0;
8912 }
8913
8914 bss->nl_preq = nl_create_handle(drv->global->nl_cb, "preq");
8915 if (bss->nl_preq == NULL)
8916 return -1;
8917 wpa_printf(MSG_DEBUG, "nl80211: Enable Probe Request "
8918 "reporting nl_preq=%p", bss->nl_preq);
8919
8920 if (nl80211_register_frame(bss, bss->nl_preq,
8921 (WLAN_FC_TYPE_MGMT << 2) |
8922 (WLAN_FC_STYPE_PROBE_REQ << 4),
8923 NULL, 0) < 0)
8924 goto out_err;
8925
8926 eloop_register_read_sock(nl_socket_get_fd(bss->nl_preq),
8927 wpa_driver_nl80211_event_receive, bss->nl_cb,
8928 bss->nl_preq);
8929
8930 return 0;
8931
8932 out_err:
8933 nl_destroy_handles(&bss->nl_preq);
8934 return -1;
8935 }
8936
8937
nl80211_disable_11b_rates(struct wpa_driver_nl80211_data * drv,int ifindex,int disabled)8938 static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv,
8939 int ifindex, int disabled)
8940 {
8941 struct nl_msg *msg;
8942 struct nlattr *bands, *band;
8943 int ret;
8944
8945 msg = nlmsg_alloc();
8946 if (!msg)
8947 return -1;
8948
8949 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_TX_BITRATE_MASK);
8950 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
8951
8952 bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES);
8953 if (!bands)
8954 goto nla_put_failure;
8955
8956 /*
8957 * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything
8958 * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS
8959 * rates. All 5 GHz rates are left enabled.
8960 */
8961 band = nla_nest_start(msg, NL80211_BAND_2GHZ);
8962 if (!band)
8963 goto nla_put_failure;
8964 if (disabled) {
8965 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8,
8966 "\x0c\x12\x18\x24\x30\x48\x60\x6c");
8967 }
8968 nla_nest_end(msg, band);
8969
8970 nla_nest_end(msg, bands);
8971
8972 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
8973 msg = NULL;
8974 if (ret) {
8975 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d "
8976 "(%s)", ret, strerror(-ret));
8977 } else
8978 drv->disabled_11b_rates = disabled;
8979
8980 return ret;
8981
8982 nla_put_failure:
8983 nlmsg_free(msg);
8984 return -1;
8985 }
8986
8987
wpa_driver_nl80211_deinit_ap(void * priv)8988 static int wpa_driver_nl80211_deinit_ap(void *priv)
8989 {
8990 struct i802_bss *bss = priv;
8991 struct wpa_driver_nl80211_data *drv = bss->drv;
8992 if (!is_ap_interface(drv->nlmode))
8993 return -1;
8994 wpa_driver_nl80211_del_beacon(drv);
8995 return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
8996 }
8997
8998
wpa_driver_nl80211_deinit_p2p_cli(void * priv)8999 static int wpa_driver_nl80211_deinit_p2p_cli(void *priv)
9000 {
9001 struct i802_bss *bss = priv;
9002 struct wpa_driver_nl80211_data *drv = bss->drv;
9003 if (drv->nlmode != NL80211_IFTYPE_P2P_CLIENT)
9004 return -1;
9005 return wpa_driver_nl80211_set_mode(priv, NL80211_IFTYPE_STATION);
9006 }
9007
9008
wpa_driver_nl80211_resume(void * priv)9009 static void wpa_driver_nl80211_resume(void *priv)
9010 {
9011 struct i802_bss *bss = priv;
9012 struct wpa_driver_nl80211_data *drv = bss->drv;
9013 if (linux_set_iface_flags(drv->global->ioctl_sock, bss->ifname, 1)) {
9014 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on "
9015 "resume event");
9016 }
9017 }
9018
9019
nl80211_send_ft_action(void * priv,u8 action,const u8 * target_ap,const u8 * ies,size_t ies_len)9020 static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap,
9021 const u8 *ies, size_t ies_len)
9022 {
9023 struct i802_bss *bss = priv;
9024 struct wpa_driver_nl80211_data *drv = bss->drv;
9025 int ret;
9026 u8 *data, *pos;
9027 size_t data_len;
9028 const u8 *own_addr = bss->addr;
9029
9030 if (action != 1) {
9031 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action "
9032 "action %d", action);
9033 return -1;
9034 }
9035
9036 /*
9037 * Action frame payload:
9038 * Category[1] = 6 (Fast BSS Transition)
9039 * Action[1] = 1 (Fast BSS Transition Request)
9040 * STA Address
9041 * Target AP Address
9042 * FT IEs
9043 */
9044
9045 data_len = 2 + 2 * ETH_ALEN + ies_len;
9046 data = os_malloc(data_len);
9047 if (data == NULL)
9048 return -1;
9049 pos = data;
9050 *pos++ = 0x06; /* FT Action category */
9051 *pos++ = action;
9052 os_memcpy(pos, own_addr, ETH_ALEN);
9053 pos += ETH_ALEN;
9054 os_memcpy(pos, target_ap, ETH_ALEN);
9055 pos += ETH_ALEN;
9056 os_memcpy(pos, ies, ies_len);
9057
9058 ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0,
9059 drv->bssid, own_addr, drv->bssid,
9060 data, data_len, 0);
9061 os_free(data);
9062
9063 return ret;
9064 }
9065
9066
nl80211_signal_monitor(void * priv,int threshold,int hysteresis)9067 static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis)
9068 {
9069 struct i802_bss *bss = priv;
9070 struct wpa_driver_nl80211_data *drv = bss->drv;
9071 struct nl_msg *msg, *cqm = NULL;
9072 int ret = -1;
9073
9074 wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d "
9075 "hysteresis=%d", threshold, hysteresis);
9076
9077 msg = nlmsg_alloc();
9078 if (!msg)
9079 return -1;
9080
9081 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_CQM);
9082
9083 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
9084
9085 cqm = nlmsg_alloc();
9086 if (cqm == NULL)
9087 goto nla_put_failure;
9088
9089 NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_THOLD, threshold);
9090 NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_HYST, hysteresis);
9091 if (nla_put_nested(msg, NL80211_ATTR_CQM, cqm) < 0)
9092 goto nla_put_failure;
9093
9094 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9095 msg = NULL;
9096
9097 nla_put_failure:
9098 nlmsg_free(cqm);
9099 nlmsg_free(msg);
9100 return ret;
9101 }
9102
9103
nl80211_signal_poll(void * priv,struct wpa_signal_info * si)9104 static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
9105 {
9106 struct i802_bss *bss = priv;
9107 struct wpa_driver_nl80211_data *drv = bss->drv;
9108 int res;
9109
9110 os_memset(si, 0, sizeof(*si));
9111 res = nl80211_get_link_signal(drv, si);
9112 if (res != 0)
9113 return res;
9114
9115 return nl80211_get_link_noise(drv, si);
9116 }
9117
9118
wpa_driver_nl80211_shared_freq(void * priv)9119 static int wpa_driver_nl80211_shared_freq(void *priv)
9120 {
9121 struct i802_bss *bss = priv;
9122 struct wpa_driver_nl80211_data *drv = bss->drv;
9123 struct wpa_driver_nl80211_data *driver;
9124 int freq = 0;
9125
9126 /*
9127 * If the same PHY is in connected state with some other interface,
9128 * then retrieve the assoc freq.
9129 */
9130 wpa_printf(MSG_DEBUG, "nl80211: Get shared freq for PHY %s",
9131 drv->phyname);
9132
9133 dl_list_for_each(driver, &drv->global->interfaces,
9134 struct wpa_driver_nl80211_data, list) {
9135 if (drv == driver ||
9136 os_strcmp(drv->phyname, driver->phyname) != 0 ||
9137 #ifdef ANDROID_P2P
9138 (!driver->associated && !is_ap_interface(driver->nlmode)))
9139 #else
9140 !driver->associated)
9141 #endif
9142 continue;
9143
9144 wpa_printf(MSG_DEBUG, "nl80211: Found a match for PHY %s - %s "
9145 MACSTR,
9146 driver->phyname, driver->first_bss.ifname,
9147 MAC2STR(driver->first_bss.addr));
9148 if (is_ap_interface(driver->nlmode))
9149 freq = driver->first_bss.freq;
9150 else
9151 freq = nl80211_get_assoc_freq(driver);
9152 wpa_printf(MSG_DEBUG, "nl80211: Shared freq for PHY %s: %d",
9153 drv->phyname, freq);
9154 }
9155
9156 if (!freq)
9157 wpa_printf(MSG_DEBUG, "nl80211: No shared interface for "
9158 "PHY (%s) in associated state", drv->phyname);
9159
9160 return freq;
9161 }
9162
9163
nl80211_send_frame(void * priv,const u8 * data,size_t data_len,int encrypt)9164 static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
9165 int encrypt)
9166 {
9167 struct i802_bss *bss = priv;
9168 return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
9169 0, 0, 0, 0);
9170 }
9171
9172
nl80211_set_param(void * priv,const char * param)9173 static int nl80211_set_param(void *priv, const char *param)
9174 {
9175 wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param);
9176 if (param == NULL)
9177 return 0;
9178
9179 #ifdef CONFIG_P2P
9180 if (os_strstr(param, "use_p2p_group_interface=1")) {
9181 struct i802_bss *bss = priv;
9182 struct wpa_driver_nl80211_data *drv = bss->drv;
9183
9184 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group "
9185 "interface");
9186 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT;
9187 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P;
9188 }
9189 #ifdef ANDROID_P2P
9190 if(os_strstr(param, "use_multi_chan_concurrent=1")) {
9191 struct i802_bss *bss = priv;
9192 struct wpa_driver_nl80211_data *drv = bss->drv;
9193 wpa_printf(MSG_DEBUG, "nl80211: Use Multi channel "
9194 "concurrency");
9195 drv->capa.flags |= WPA_DRIVER_FLAGS_MULTI_CHANNEL_CONCURRENT;
9196 }
9197 #endif
9198 #endif /* CONFIG_P2P */
9199
9200 return 0;
9201 }
9202
9203
nl80211_global_init(void)9204 static void * nl80211_global_init(void)
9205 {
9206 struct nl80211_global *global;
9207 struct netlink_config *cfg;
9208
9209 global = os_zalloc(sizeof(*global));
9210 if (global == NULL)
9211 return NULL;
9212 global->ioctl_sock = -1;
9213 dl_list_init(&global->interfaces);
9214 global->if_add_ifindex = -1;
9215
9216 cfg = os_zalloc(sizeof(*cfg));
9217 if (cfg == NULL)
9218 goto err;
9219
9220 cfg->ctx = global;
9221 cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink;
9222 cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink;
9223 global->netlink = netlink_init(cfg);
9224 if (global->netlink == NULL) {
9225 os_free(cfg);
9226 goto err;
9227 }
9228
9229 if (wpa_driver_nl80211_init_nl_global(global) < 0)
9230 goto err;
9231
9232 global->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
9233 if (global->ioctl_sock < 0) {
9234 perror("socket(PF_INET,SOCK_DGRAM)");
9235 goto err;
9236 }
9237
9238 return global;
9239
9240 err:
9241 nl80211_global_deinit(global);
9242 return NULL;
9243 }
9244
9245
nl80211_global_deinit(void * priv)9246 static void nl80211_global_deinit(void *priv)
9247 {
9248 struct nl80211_global *global = priv;
9249 if (global == NULL)
9250 return;
9251 if (!dl_list_empty(&global->interfaces)) {
9252 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at "
9253 "nl80211_global_deinit",
9254 dl_list_len(&global->interfaces));
9255 }
9256
9257 if (global->netlink)
9258 netlink_deinit(global->netlink);
9259
9260 nl_destroy_handles(&global->nl);
9261
9262 if (global->nl_event) {
9263 eloop_unregister_read_sock(
9264 nl_socket_get_fd(global->nl_event));
9265 nl_destroy_handles(&global->nl_event);
9266 }
9267
9268 nl_cb_put(global->nl_cb);
9269
9270 if (global->ioctl_sock >= 0)
9271 close(global->ioctl_sock);
9272
9273 os_free(global);
9274 }
9275
9276
nl80211_get_radio_name(void * priv)9277 static const char * nl80211_get_radio_name(void *priv)
9278 {
9279 struct i802_bss *bss = priv;
9280 struct wpa_driver_nl80211_data *drv = bss->drv;
9281 return drv->phyname;
9282 }
9283
9284
nl80211_pmkid(struct i802_bss * bss,int cmd,const u8 * bssid,const u8 * pmkid)9285 static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid,
9286 const u8 *pmkid)
9287 {
9288 struct nl_msg *msg;
9289
9290 msg = nlmsg_alloc();
9291 if (!msg)
9292 return -ENOMEM;
9293
9294 nl80211_cmd(bss->drv, msg, 0, cmd);
9295
9296 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname));
9297 if (pmkid)
9298 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid);
9299 if (bssid)
9300 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid);
9301
9302 return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
9303 nla_put_failure:
9304 nlmsg_free(msg);
9305 return -ENOBUFS;
9306 }
9307
9308
nl80211_add_pmkid(void * priv,const u8 * bssid,const u8 * pmkid)9309 static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
9310 {
9311 struct i802_bss *bss = priv;
9312 wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid));
9313 return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid);
9314 }
9315
9316
nl80211_remove_pmkid(void * priv,const u8 * bssid,const u8 * pmkid)9317 static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid)
9318 {
9319 struct i802_bss *bss = priv;
9320 wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR,
9321 MAC2STR(bssid));
9322 return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid);
9323 }
9324
9325
nl80211_flush_pmkid(void * priv)9326 static int nl80211_flush_pmkid(void *priv)
9327 {
9328 struct i802_bss *bss = priv;
9329 wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs");
9330 return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL);
9331 }
9332
9333
nl80211_set_rekey_info(void * priv,const u8 * kek,const u8 * kck,const u8 * replay_ctr)9334 static void nl80211_set_rekey_info(void *priv, const u8 *kek, const u8 *kck,
9335 const u8 *replay_ctr)
9336 {
9337 struct i802_bss *bss = priv;
9338 struct wpa_driver_nl80211_data *drv = bss->drv;
9339 struct nlattr *replay_nested;
9340 struct nl_msg *msg;
9341
9342 msg = nlmsg_alloc();
9343 if (!msg)
9344 return;
9345
9346 nl80211_cmd(drv, msg, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
9347
9348 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
9349
9350 replay_nested = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
9351 if (!replay_nested)
9352 goto nla_put_failure;
9353
9354 NLA_PUT(msg, NL80211_REKEY_DATA_KEK, NL80211_KEK_LEN, kek);
9355 NLA_PUT(msg, NL80211_REKEY_DATA_KCK, NL80211_KCK_LEN, kck);
9356 NLA_PUT(msg, NL80211_REKEY_DATA_REPLAY_CTR, NL80211_REPLAY_CTR_LEN,
9357 replay_ctr);
9358
9359 nla_nest_end(msg, replay_nested);
9360
9361 send_and_recv_msgs(drv, msg, NULL, NULL);
9362 return;
9363 nla_put_failure:
9364 nlmsg_free(msg);
9365 }
9366
9367
nl80211_send_null_frame(struct i802_bss * bss,const u8 * own_addr,const u8 * addr,int qos)9368 static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
9369 const u8 *addr, int qos)
9370 {
9371 /* send data frame to poll STA and check whether
9372 * this frame is ACKed */
9373 struct {
9374 struct ieee80211_hdr hdr;
9375 u16 qos_ctl;
9376 } STRUCT_PACKED nulldata;
9377 size_t size;
9378
9379 /* Send data frame to poll STA and check whether this frame is ACKed */
9380
9381 os_memset(&nulldata, 0, sizeof(nulldata));
9382
9383 if (qos) {
9384 nulldata.hdr.frame_control =
9385 IEEE80211_FC(WLAN_FC_TYPE_DATA,
9386 WLAN_FC_STYPE_QOS_NULL);
9387 size = sizeof(nulldata);
9388 } else {
9389 nulldata.hdr.frame_control =
9390 IEEE80211_FC(WLAN_FC_TYPE_DATA,
9391 WLAN_FC_STYPE_NULLFUNC);
9392 size = sizeof(struct ieee80211_hdr);
9393 }
9394
9395 nulldata.hdr.frame_control |= host_to_le16(WLAN_FC_FROMDS);
9396 os_memcpy(nulldata.hdr.IEEE80211_DA_FROMDS, addr, ETH_ALEN);
9397 os_memcpy(nulldata.hdr.IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
9398 os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
9399
9400 if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
9401 0, 0) < 0)
9402 wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
9403 "send poll frame");
9404 }
9405
nl80211_poll_client(void * priv,const u8 * own_addr,const u8 * addr,int qos)9406 static void nl80211_poll_client(void *priv, const u8 *own_addr, const u8 *addr,
9407 int qos)
9408 {
9409 struct i802_bss *bss = priv;
9410 struct wpa_driver_nl80211_data *drv = bss->drv;
9411 struct nl_msg *msg;
9412
9413 if (!drv->poll_command_supported) {
9414 nl80211_send_null_frame(bss, own_addr, addr, qos);
9415 return;
9416 }
9417
9418 msg = nlmsg_alloc();
9419 if (!msg)
9420 return;
9421
9422 nl80211_cmd(drv, msg, 0, NL80211_CMD_PROBE_CLIENT);
9423
9424 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
9425 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
9426
9427 send_and_recv_msgs(drv, msg, NULL, NULL);
9428 return;
9429 nla_put_failure:
9430 nlmsg_free(msg);
9431 }
9432
9433
nl80211_set_power_save(struct i802_bss * bss,int enabled)9434 static int nl80211_set_power_save(struct i802_bss *bss, int enabled)
9435 {
9436 struct nl_msg *msg;
9437
9438 msg = nlmsg_alloc();
9439 if (!msg)
9440 return -ENOMEM;
9441
9442 nl80211_cmd(bss->drv, msg, 0, NL80211_CMD_SET_POWER_SAVE);
9443 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex);
9444 NLA_PUT_U32(msg, NL80211_ATTR_PS_STATE,
9445 enabled ? NL80211_PS_ENABLED : NL80211_PS_DISABLED);
9446 return send_and_recv_msgs(bss->drv, msg, NULL, NULL);
9447 nla_put_failure:
9448 nlmsg_free(msg);
9449 return -ENOBUFS;
9450 }
9451
9452
nl80211_set_p2p_powersave(void * priv,int legacy_ps,int opp_ps,int ctwindow)9453 static int nl80211_set_p2p_powersave(void *priv, int legacy_ps, int opp_ps,
9454 int ctwindow)
9455 {
9456 struct i802_bss *bss = priv;
9457
9458 wpa_printf(MSG_DEBUG, "nl80211: set_p2p_powersave (legacy_ps=%d "
9459 "opp_ps=%d ctwindow=%d)", legacy_ps, opp_ps, ctwindow);
9460
9461 if (opp_ps != -1 || ctwindow != -1)
9462 #ifdef ANDROID_P2P
9463 wpa_driver_set_p2p_ps(priv, legacy_ps, opp_ps, ctwindow);
9464 #else
9465 return -1; /* Not yet supported */
9466 #endif
9467
9468 if (legacy_ps == -1)
9469 return 0;
9470 if (legacy_ps != 0 && legacy_ps != 1)
9471 return -1; /* Not yet supported */
9472
9473 return nl80211_set_power_save(bss, legacy_ps);
9474 }
9475
9476
9477 #ifdef CONFIG_TDLS
9478
nl80211_send_tdls_mgmt(void * priv,const u8 * dst,u8 action_code,u8 dialog_token,u16 status_code,const u8 * buf,size_t len)9479 static int nl80211_send_tdls_mgmt(void *priv, const u8 *dst, u8 action_code,
9480 u8 dialog_token, u16 status_code,
9481 const u8 *buf, size_t len)
9482 {
9483 struct i802_bss *bss = priv;
9484 struct wpa_driver_nl80211_data *drv = bss->drv;
9485 struct nl_msg *msg;
9486
9487 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
9488 return -EOPNOTSUPP;
9489
9490 if (!dst)
9491 return -EINVAL;
9492
9493 msg = nlmsg_alloc();
9494 if (!msg)
9495 return -ENOMEM;
9496
9497 nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_MGMT);
9498 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9499 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, dst);
9500 NLA_PUT_U8(msg, NL80211_ATTR_TDLS_ACTION, action_code);
9501 NLA_PUT_U8(msg, NL80211_ATTR_TDLS_DIALOG_TOKEN, dialog_token);
9502 NLA_PUT_U16(msg, NL80211_ATTR_STATUS_CODE, status_code);
9503 NLA_PUT(msg, NL80211_ATTR_IE, len, buf);
9504
9505 return send_and_recv_msgs(drv, msg, NULL, NULL);
9506
9507 nla_put_failure:
9508 nlmsg_free(msg);
9509 return -ENOBUFS;
9510 }
9511
9512
nl80211_tdls_oper(void * priv,enum tdls_oper oper,const u8 * peer)9513 static int nl80211_tdls_oper(void *priv, enum tdls_oper oper, const u8 *peer)
9514 {
9515 struct i802_bss *bss = priv;
9516 struct wpa_driver_nl80211_data *drv = bss->drv;
9517 struct nl_msg *msg;
9518 enum nl80211_tdls_operation nl80211_oper;
9519
9520 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_TDLS_SUPPORT))
9521 return -EOPNOTSUPP;
9522
9523 switch (oper) {
9524 case TDLS_DISCOVERY_REQ:
9525 nl80211_oper = NL80211_TDLS_DISCOVERY_REQ;
9526 break;
9527 case TDLS_SETUP:
9528 nl80211_oper = NL80211_TDLS_SETUP;
9529 break;
9530 case TDLS_TEARDOWN:
9531 nl80211_oper = NL80211_TDLS_TEARDOWN;
9532 break;
9533 case TDLS_ENABLE_LINK:
9534 nl80211_oper = NL80211_TDLS_ENABLE_LINK;
9535 break;
9536 case TDLS_DISABLE_LINK:
9537 nl80211_oper = NL80211_TDLS_DISABLE_LINK;
9538 break;
9539 case TDLS_ENABLE:
9540 return 0;
9541 case TDLS_DISABLE:
9542 return 0;
9543 default:
9544 return -EINVAL;
9545 }
9546
9547 msg = nlmsg_alloc();
9548 if (!msg)
9549 return -ENOMEM;
9550
9551 nl80211_cmd(drv, msg, 0, NL80211_CMD_TDLS_OPER);
9552 NLA_PUT_U8(msg, NL80211_ATTR_TDLS_OPERATION, nl80211_oper);
9553 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9554 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, peer);
9555
9556 return send_and_recv_msgs(drv, msg, NULL, NULL);
9557
9558 nla_put_failure:
9559 nlmsg_free(msg);
9560 return -ENOBUFS;
9561 }
9562
9563 #endif /* CONFIG TDLS */
9564
9565
9566 #ifdef ANDROID
9567
9568 typedef struct android_wifi_priv_cmd {
9569 char *buf;
9570 int used_len;
9571 int total_len;
9572 } android_wifi_priv_cmd;
9573
9574 static int drv_errors = 0;
9575
wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data * drv)9576 static void wpa_driver_send_hang_msg(struct wpa_driver_nl80211_data *drv)
9577 {
9578 drv_errors++;
9579 if (drv_errors > DRV_NUMBER_SEQUENTIAL_ERRORS) {
9580 drv_errors = 0;
9581 wpa_msg(drv->ctx, MSG_INFO, WPA_EVENT_DRIVER_STATE "HANGED");
9582 }
9583 }
9584
9585
android_priv_cmd(struct i802_bss * bss,const char * cmd)9586 static int android_priv_cmd(struct i802_bss *bss, const char *cmd)
9587 {
9588 struct wpa_driver_nl80211_data *drv = bss->drv;
9589 struct ifreq ifr;
9590 android_wifi_priv_cmd priv_cmd;
9591 char buf[MAX_DRV_CMD_SIZE];
9592 int ret;
9593
9594 os_memset(&ifr, 0, sizeof(ifr));
9595 os_memset(&priv_cmd, 0, sizeof(priv_cmd));
9596 os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
9597
9598 os_memset(buf, 0, sizeof(buf));
9599 os_strlcpy(buf, cmd, sizeof(buf));
9600
9601 priv_cmd.buf = buf;
9602 priv_cmd.used_len = sizeof(buf);
9603 priv_cmd.total_len = sizeof(buf);
9604 ifr.ifr_data = &priv_cmd;
9605
9606 ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
9607 if (ret < 0) {
9608 wpa_printf(MSG_ERROR, "%s: failed to issue private commands",
9609 __func__);
9610 wpa_driver_send_hang_msg(drv);
9611 return ret;
9612 }
9613
9614 drv_errors = 0;
9615 return 0;
9616 }
9617
9618
android_pno_start(struct i802_bss * bss,struct wpa_driver_scan_params * params)9619 static int android_pno_start(struct i802_bss *bss,
9620 struct wpa_driver_scan_params *params)
9621 {
9622 struct wpa_driver_nl80211_data *drv = bss->drv;
9623 struct ifreq ifr;
9624 android_wifi_priv_cmd priv_cmd;
9625 int ret = 0, i = 0, bp;
9626 char buf[WEXT_PNO_MAX_COMMAND_SIZE];
9627
9628 bp = WEXT_PNOSETUP_HEADER_SIZE;
9629 os_memcpy(buf, WEXT_PNOSETUP_HEADER, bp);
9630 buf[bp++] = WEXT_PNO_TLV_PREFIX;
9631 buf[bp++] = WEXT_PNO_TLV_VERSION;
9632 buf[bp++] = WEXT_PNO_TLV_SUBVERSION;
9633 buf[bp++] = WEXT_PNO_TLV_RESERVED;
9634
9635 while (i < WEXT_PNO_AMOUNT && (size_t) i < params->num_ssids) {
9636 /* Check that there is enough space needed for 1 more SSID, the
9637 * other sections and null termination */
9638 if ((bp + WEXT_PNO_SSID_HEADER_SIZE + MAX_SSID_LEN +
9639 WEXT_PNO_NONSSID_SECTIONS_SIZE + 1) >= (int) sizeof(buf))
9640 break;
9641 wpa_hexdump_ascii(MSG_DEBUG, "For PNO Scan",
9642 params->ssids[i].ssid,
9643 params->ssids[i].ssid_len);
9644 buf[bp++] = WEXT_PNO_SSID_SECTION;
9645 buf[bp++] = params->ssids[i].ssid_len;
9646 os_memcpy(&buf[bp], params->ssids[i].ssid,
9647 params->ssids[i].ssid_len);
9648 bp += params->ssids[i].ssid_len;
9649 i++;
9650 }
9651
9652 buf[bp++] = WEXT_PNO_SCAN_INTERVAL_SECTION;
9653 os_snprintf(&buf[bp], WEXT_PNO_SCAN_INTERVAL_LENGTH + 1, "%x",
9654 WEXT_PNO_SCAN_INTERVAL);
9655 bp += WEXT_PNO_SCAN_INTERVAL_LENGTH;
9656
9657 buf[bp++] = WEXT_PNO_REPEAT_SECTION;
9658 os_snprintf(&buf[bp], WEXT_PNO_REPEAT_LENGTH + 1, "%x",
9659 WEXT_PNO_REPEAT);
9660 bp += WEXT_PNO_REPEAT_LENGTH;
9661
9662 buf[bp++] = WEXT_PNO_MAX_REPEAT_SECTION;
9663 os_snprintf(&buf[bp], WEXT_PNO_MAX_REPEAT_LENGTH + 1, "%x",
9664 WEXT_PNO_MAX_REPEAT);
9665 bp += WEXT_PNO_MAX_REPEAT_LENGTH + 1;
9666
9667 memset(&ifr, 0, sizeof(ifr));
9668 memset(&priv_cmd, 0, sizeof(priv_cmd));
9669 os_strncpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
9670
9671 priv_cmd.buf = buf;
9672 priv_cmd.used_len = bp;
9673 priv_cmd.total_len = bp;
9674 ifr.ifr_data = &priv_cmd;
9675
9676 ret = ioctl(drv->global->ioctl_sock, SIOCDEVPRIVATE + 1, &ifr);
9677
9678 if (ret < 0) {
9679 wpa_printf(MSG_ERROR, "ioctl[SIOCSIWPRIV] (pnosetup): %d",
9680 ret);
9681 wpa_driver_send_hang_msg(drv);
9682 return ret;
9683 }
9684
9685 drv_errors = 0;
9686
9687 return android_priv_cmd(bss, "PNOFORCE 1");
9688 }
9689
9690
android_pno_stop(struct i802_bss * bss)9691 static int android_pno_stop(struct i802_bss *bss)
9692 {
9693 return android_priv_cmd(bss, "PNOFORCE 0");
9694 }
9695
9696 #endif /* ANDROID */
9697
9698
driver_nl80211_set_key(const char * ifname,void * priv,enum wpa_alg alg,const u8 * addr,int key_idx,int set_tx,const u8 * seq,size_t seq_len,const u8 * key,size_t key_len)9699 static int driver_nl80211_set_key(const char *ifname, void *priv,
9700 enum wpa_alg alg, const u8 *addr,
9701 int key_idx, int set_tx,
9702 const u8 *seq, size_t seq_len,
9703 const u8 *key, size_t key_len)
9704 {
9705 struct i802_bss *bss = priv;
9706 return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
9707 set_tx, seq, seq_len, key, key_len);
9708 }
9709
9710
driver_nl80211_scan2(void * priv,struct wpa_driver_scan_params * params)9711 static int driver_nl80211_scan2(void *priv,
9712 struct wpa_driver_scan_params *params)
9713 {
9714 struct i802_bss *bss = priv;
9715 return wpa_driver_nl80211_scan(bss, params);
9716 }
9717
9718
driver_nl80211_deauthenticate(void * priv,const u8 * addr,int reason_code)9719 static int driver_nl80211_deauthenticate(void *priv, const u8 *addr,
9720 int reason_code)
9721 {
9722 struct i802_bss *bss = priv;
9723 return wpa_driver_nl80211_deauthenticate(bss, addr, reason_code);
9724 }
9725
9726
driver_nl80211_authenticate(void * priv,struct wpa_driver_auth_params * params)9727 static int driver_nl80211_authenticate(void *priv,
9728 struct wpa_driver_auth_params *params)
9729 {
9730 struct i802_bss *bss = priv;
9731 return wpa_driver_nl80211_authenticate(bss, params);
9732 }
9733
9734
driver_nl80211_deinit(void * priv)9735 static void driver_nl80211_deinit(void *priv)
9736 {
9737 struct i802_bss *bss = priv;
9738 wpa_driver_nl80211_deinit(bss);
9739 }
9740
9741
driver_nl80211_if_remove(void * priv,enum wpa_driver_if_type type,const char * ifname)9742 static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
9743 const char *ifname)
9744 {
9745 struct i802_bss *bss = priv;
9746 return wpa_driver_nl80211_if_remove(bss, type, ifname);
9747 }
9748
9749
driver_nl80211_send_mlme(void * priv,const u8 * data,size_t data_len,int noack)9750 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
9751 size_t data_len, int noack)
9752 {
9753 struct i802_bss *bss = priv;
9754 return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
9755 0, 0, 0, 0);
9756 }
9757
9758
driver_nl80211_sta_remove(void * priv,const u8 * addr)9759 static int driver_nl80211_sta_remove(void *priv, const u8 *addr)
9760 {
9761 struct i802_bss *bss = priv;
9762 return wpa_driver_nl80211_sta_remove(bss, addr);
9763 }
9764
9765
9766 #if defined(HOSTAPD) || defined(CONFIG_AP)
driver_nl80211_set_sta_vlan(void * priv,const u8 * addr,const char * ifname,int vlan_id)9767 static int driver_nl80211_set_sta_vlan(void *priv, const u8 *addr,
9768 const char *ifname, int vlan_id)
9769 {
9770 struct i802_bss *bss = priv;
9771 return i802_set_sta_vlan(bss, addr, ifname, vlan_id);
9772 }
9773 #endif /* HOSTAPD || CONFIG_AP */
9774
9775
driver_nl80211_read_sta_data(void * priv,struct hostap_sta_driver_data * data,const u8 * addr)9776 static int driver_nl80211_read_sta_data(void *priv,
9777 struct hostap_sta_driver_data *data,
9778 const u8 *addr)
9779 {
9780 struct i802_bss *bss = priv;
9781 return i802_read_sta_data(bss, data, addr);
9782 }
9783
9784
driver_nl80211_send_action(void * priv,unsigned int freq,unsigned int wait_time,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,int no_cck)9785 static int driver_nl80211_send_action(void *priv, unsigned int freq,
9786 unsigned int wait_time,
9787 const u8 *dst, const u8 *src,
9788 const u8 *bssid,
9789 const u8 *data, size_t data_len,
9790 int no_cck)
9791 {
9792 struct i802_bss *bss = priv;
9793 return wpa_driver_nl80211_send_action(bss, freq, wait_time, dst, src,
9794 bssid, data, data_len, no_cck);
9795 }
9796
9797
driver_nl80211_probe_req_report(void * priv,int report)9798 static int driver_nl80211_probe_req_report(void *priv, int report)
9799 {
9800 struct i802_bss *bss = priv;
9801 return wpa_driver_nl80211_probe_req_report(bss, report);
9802 }
9803
9804
wpa_driver_nl80211_update_ft_ies(void * priv,const u8 * md,const u8 * ies,size_t ies_len)9805 static int wpa_driver_nl80211_update_ft_ies(void *priv, const u8 *md,
9806 const u8 *ies, size_t ies_len)
9807 {
9808 int ret;
9809 struct nl_msg *msg;
9810 struct i802_bss *bss = priv;
9811 struct wpa_driver_nl80211_data *drv = bss->drv;
9812 u16 mdid = WPA_GET_LE16(md);
9813
9814 msg = nlmsg_alloc();
9815 if (!msg)
9816 return -ENOMEM;
9817
9818 wpa_printf(MSG_DEBUG, "nl80211: Updating FT IEs");
9819 nl80211_cmd(drv, msg, 0, NL80211_CMD_UPDATE_FT_IES);
9820 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
9821 NLA_PUT(msg, NL80211_ATTR_IE, ies_len, ies);
9822 NLA_PUT_U16(msg, NL80211_ATTR_MDID, mdid);
9823
9824 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
9825 if (ret) {
9826 wpa_printf(MSG_DEBUG, "nl80211: update_ft_ies failed "
9827 "err=%d (%s)", ret, strerror(-ret));
9828 }
9829
9830 return ret;
9831
9832 nla_put_failure:
9833 nlmsg_free(msg);
9834 return -ENOBUFS;
9835 }
9836
9837
9838 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
9839 .name = "nl80211",
9840 .desc = "Linux nl80211/cfg80211",
9841 .get_bssid = wpa_driver_nl80211_get_bssid,
9842 .get_ssid = wpa_driver_nl80211_get_ssid,
9843 .set_key = driver_nl80211_set_key,
9844 .scan2 = driver_nl80211_scan2,
9845 .sched_scan = wpa_driver_nl80211_sched_scan,
9846 .stop_sched_scan = wpa_driver_nl80211_stop_sched_scan,
9847 .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
9848 .deauthenticate = driver_nl80211_deauthenticate,
9849 .authenticate = driver_nl80211_authenticate,
9850 .associate = wpa_driver_nl80211_associate,
9851 .global_init = nl80211_global_init,
9852 .global_deinit = nl80211_global_deinit,
9853 .init2 = wpa_driver_nl80211_init,
9854 .deinit = driver_nl80211_deinit,
9855 .get_capa = wpa_driver_nl80211_get_capa,
9856 .set_operstate = wpa_driver_nl80211_set_operstate,
9857 .set_supp_port = wpa_driver_nl80211_set_supp_port,
9858 .set_country = wpa_driver_nl80211_set_country,
9859 .set_ap = wpa_driver_nl80211_set_ap,
9860 .if_add = wpa_driver_nl80211_if_add,
9861 .if_remove = driver_nl80211_if_remove,
9862 .send_mlme = driver_nl80211_send_mlme,
9863 .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
9864 .sta_add = wpa_driver_nl80211_sta_add,
9865 .sta_remove = driver_nl80211_sta_remove,
9866 .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
9867 .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
9868 #ifdef HOSTAPD
9869 .hapd_init = i802_init,
9870 .hapd_deinit = i802_deinit,
9871 .set_wds_sta = i802_set_wds_sta,
9872 #endif /* HOSTAPD */
9873 #if defined(HOSTAPD) || defined(CONFIG_AP)
9874 .get_seqnum = i802_get_seqnum,
9875 .flush = i802_flush,
9876 .get_inact_sec = i802_get_inact_sec,
9877 .sta_clear_stats = i802_sta_clear_stats,
9878 .set_rts = i802_set_rts,
9879 .set_frag = i802_set_frag,
9880 .set_tx_queue_params = i802_set_tx_queue_params,
9881 .set_sta_vlan = driver_nl80211_set_sta_vlan,
9882 .sta_deauth = i802_sta_deauth,
9883 .sta_disassoc = i802_sta_disassoc,
9884 #endif /* HOSTAPD || CONFIG_AP */
9885 .read_sta_data = driver_nl80211_read_sta_data,
9886 .set_freq = i802_set_freq,
9887 .send_action = driver_nl80211_send_action,
9888 .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait,
9889 .remain_on_channel = wpa_driver_nl80211_remain_on_channel,
9890 .cancel_remain_on_channel =
9891 wpa_driver_nl80211_cancel_remain_on_channel,
9892 .probe_req_report = driver_nl80211_probe_req_report,
9893 .deinit_ap = wpa_driver_nl80211_deinit_ap,
9894 .deinit_p2p_cli = wpa_driver_nl80211_deinit_p2p_cli,
9895 .resume = wpa_driver_nl80211_resume,
9896 .send_ft_action = nl80211_send_ft_action,
9897 .signal_monitor = nl80211_signal_monitor,
9898 .signal_poll = nl80211_signal_poll,
9899 .send_frame = nl80211_send_frame,
9900 .shared_freq = wpa_driver_nl80211_shared_freq,
9901 .set_param = nl80211_set_param,
9902 .get_radio_name = nl80211_get_radio_name,
9903 .add_pmkid = nl80211_add_pmkid,
9904 .remove_pmkid = nl80211_remove_pmkid,
9905 .flush_pmkid = nl80211_flush_pmkid,
9906 .set_rekey_info = nl80211_set_rekey_info,
9907 .poll_client = nl80211_poll_client,
9908 .set_p2p_powersave = nl80211_set_p2p_powersave,
9909 #ifdef CONFIG_TDLS
9910 .send_tdls_mgmt = nl80211_send_tdls_mgmt,
9911 .tdls_oper = nl80211_tdls_oper,
9912 #endif /* CONFIG_TDLS */
9913 .update_ft_ies = wpa_driver_nl80211_update_ft_ies,
9914 #ifdef ANDROID_P2P
9915 .set_noa = wpa_driver_set_p2p_noa,
9916 .get_noa = wpa_driver_get_p2p_noa,
9917 .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie,
9918 #endif
9919 #ifdef ANDROID
9920 .driver_cmd = wpa_driver_nl80211_driver_cmd,
9921 #endif
9922 };
9923