1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "hostapd.h"
14 #include "sta_info.h"
15 #include "ap_config.h"
16 #include "ap_drv_ops.h"
17 #include "ieee802_11.h"
18
19
20 #ifdef CONFIG_IEEE80211W
21
hostapd_eid_assoc_comeback_time(struct hostapd_data * hapd,struct sta_info * sta,u8 * eid)22 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
23 struct sta_info *sta, u8 *eid)
24 {
25 u8 *pos = eid;
26 u32 timeout, tu;
27 struct os_reltime now, passed;
28
29 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
30 *pos++ = 5;
31 *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
32 os_get_reltime(&now);
33 os_reltime_sub(&now, &sta->sa_query_start, &passed);
34 tu = (passed.sec * 1000000 + passed.usec) / 1024;
35 if (hapd->conf->assoc_sa_query_max_timeout > tu)
36 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
37 else
38 timeout = 0;
39 if (timeout < hapd->conf->assoc_sa_query_max_timeout)
40 timeout++; /* add some extra time for local timers */
41 WPA_PUT_LE32(pos, timeout);
42 pos += 4;
43
44 return pos;
45 }
46
47
48 /* MLME-SAQuery.request */
ieee802_11_send_sa_query_req(struct hostapd_data * hapd,const u8 * addr,const u8 * trans_id)49 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
50 const u8 *addr, const u8 *trans_id)
51 {
52 struct ieee80211_mgmt mgmt;
53 u8 *end;
54
55 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
56 MACSTR, MAC2STR(addr));
57 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
58 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
59
60 os_memset(&mgmt, 0, sizeof(mgmt));
61 mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
62 WLAN_FC_STYPE_ACTION);
63 os_memcpy(mgmt.da, addr, ETH_ALEN);
64 os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
65 os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
66 mgmt.u.action.category = WLAN_ACTION_SA_QUERY;
67 mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
68 os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
69 WLAN_SA_QUERY_TR_ID_LEN);
70 end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
71 if (hostapd_drv_send_mlme(hapd, &mgmt, end - (u8 *) &mgmt, 0) < 0)
72 wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
73 }
74
75
ieee802_11_send_sa_query_resp(struct hostapd_data * hapd,const u8 * sa,const u8 * trans_id)76 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
77 const u8 *sa, const u8 *trans_id)
78 {
79 struct sta_info *sta;
80 struct ieee80211_mgmt resp;
81 u8 *end;
82
83 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
84 MACSTR, MAC2STR(sa));
85 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
86 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
87
88 sta = ap_get_sta(hapd, sa);
89 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
90 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
91 "from unassociated STA " MACSTR, MAC2STR(sa));
92 return;
93 }
94
95 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
96 MACSTR, MAC2STR(sa));
97
98 os_memset(&resp, 0, sizeof(resp));
99 resp.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
100 WLAN_FC_STYPE_ACTION);
101 os_memcpy(resp.da, sa, ETH_ALEN);
102 os_memcpy(resp.sa, hapd->own_addr, ETH_ALEN);
103 os_memcpy(resp.bssid, hapd->own_addr, ETH_ALEN);
104 resp.u.action.category = WLAN_ACTION_SA_QUERY;
105 resp.u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
106 os_memcpy(resp.u.action.u.sa_query_req.trans_id, trans_id,
107 WLAN_SA_QUERY_TR_ID_LEN);
108 end = resp.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
109 if (hostapd_drv_send_mlme(hapd, &resp, end - (u8 *) &resp, 0) < 0)
110 wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
111 }
112
113
ieee802_11_sa_query_action(struct hostapd_data * hapd,const u8 * sa,const u8 action_type,const u8 * trans_id)114 void ieee802_11_sa_query_action(struct hostapd_data *hapd, const u8 *sa,
115 const u8 action_type, const u8 *trans_id)
116 {
117 struct sta_info *sta;
118 int i;
119
120 if (action_type == WLAN_SA_QUERY_REQUEST) {
121 ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
122 return;
123 }
124
125 if (action_type != WLAN_SA_QUERY_RESPONSE) {
126 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
127 "Action %d", action_type);
128 return;
129 }
130
131 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
132 MACSTR, MAC2STR(sa));
133 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
134 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
135
136 /* MLME-SAQuery.confirm */
137
138 sta = ap_get_sta(hapd, sa);
139 if (sta == NULL || sta->sa_query_trans_id == NULL) {
140 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
141 "pending SA Query request found");
142 return;
143 }
144
145 for (i = 0; i < sta->sa_query_count; i++) {
146 if (os_memcmp(sta->sa_query_trans_id +
147 i * WLAN_SA_QUERY_TR_ID_LEN,
148 trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
149 break;
150 }
151
152 if (i >= sta->sa_query_count) {
153 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
154 "transaction identifier found");
155 return;
156 }
157
158 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
159 HOSTAPD_LEVEL_DEBUG,
160 "Reply to pending SA Query received");
161 ap_sta_stop_sa_query(hapd, sta);
162 }
163
164 #endif /* CONFIG_IEEE80211W */
165
166
hostapd_ext_capab_byte(struct hostapd_data * hapd,u8 * pos,int idx)167 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx)
168 {
169 *pos = 0x00;
170
171 switch (idx) {
172 case 0: /* Bits 0-7 */
173 if (hapd->iconf->obss_interval)
174 *pos |= 0x01; /* Bit 0 - Coexistence management */
175 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)
176 *pos |= 0x04; /* Bit 2 - Extended Channel Switching */
177 break;
178 case 1: /* Bits 8-15 */
179 if (hapd->conf->proxy_arp)
180 *pos |= 0x10; /* Bit 12 - Proxy ARP */
181 break;
182 case 2: /* Bits 16-23 */
183 if (hapd->conf->wnm_sleep_mode)
184 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
185 if (hapd->conf->bss_transition)
186 *pos |= 0x08; /* Bit 19 - BSS Transition */
187 break;
188 case 3: /* Bits 24-31 */
189 #ifdef CONFIG_WNM
190 *pos |= 0x02; /* Bit 25 - SSID List */
191 #endif /* CONFIG_WNM */
192 if (hapd->conf->time_advertisement == 2)
193 *pos |= 0x08; /* Bit 27 - UTC TSF Offset */
194 if (hapd->conf->interworking)
195 *pos |= 0x80; /* Bit 31 - Interworking */
196 break;
197 case 4: /* Bits 32-39 */
198 if (hapd->conf->qos_map_set_len)
199 *pos |= 0x01; /* Bit 32 - QoS Map */
200 if (hapd->conf->tdls & TDLS_PROHIBIT)
201 *pos |= 0x40; /* Bit 38 - TDLS Prohibited */
202 if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
203 /* Bit 39 - TDLS Channel Switching Prohibited */
204 *pos |= 0x80;
205 }
206 break;
207 case 5: /* Bits 40-47 */
208 #ifdef CONFIG_HS20
209 if (hapd->conf->hs20)
210 *pos |= 0x40; /* Bit 46 - WNM-Notification */
211 #endif /* CONFIG_HS20 */
212 #ifdef CONFIG_MBO
213 if (hapd->conf->mbo_enabled)
214 *pos |= 0x40; /* Bit 46 - WNM-Notification */
215 #endif /* CONFIG_MBO */
216 break;
217 case 6: /* Bits 48-55 */
218 if (hapd->conf->ssid.utf8_ssid)
219 *pos |= 0x01; /* Bit 48 - UTF-8 SSID */
220 break;
221 }
222 }
223
224
hostapd_eid_ext_capab(struct hostapd_data * hapd,u8 * eid)225 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid)
226 {
227 u8 *pos = eid;
228 u8 len = 0, i;
229
230 if (hapd->conf->tdls & (TDLS_PROHIBIT | TDLS_PROHIBIT_CHAN_SWITCH))
231 len = 5;
232 if (len < 4 && hapd->conf->interworking)
233 len = 4;
234 if (len < 3 && hapd->conf->wnm_sleep_mode)
235 len = 3;
236 if (len < 1 && hapd->iconf->obss_interval)
237 len = 1;
238 if (len < 7 && hapd->conf->ssid.utf8_ssid)
239 len = 7;
240 #ifdef CONFIG_WNM
241 if (len < 4)
242 len = 4;
243 #endif /* CONFIG_WNM */
244 #ifdef CONFIG_HS20
245 if (hapd->conf->hs20 && len < 6)
246 len = 6;
247 #endif /* CONFIG_HS20 */
248 #ifdef CONFIG_MBO
249 if (hapd->conf->mbo_enabled && len < 6)
250 len = 6;
251 #endif /* CONFIG_MBO */
252 if (len < hapd->iface->extended_capa_len)
253 len = hapd->iface->extended_capa_len;
254 if (len == 0)
255 return eid;
256
257 *pos++ = WLAN_EID_EXT_CAPAB;
258 *pos++ = len;
259 for (i = 0; i < len; i++, pos++) {
260 hostapd_ext_capab_byte(hapd, pos, i);
261
262 if (i < hapd->iface->extended_capa_len) {
263 *pos &= ~hapd->iface->extended_capa_mask[i];
264 *pos |= hapd->iface->extended_capa[i];
265 }
266 }
267
268 while (len > 0 && eid[1 + len] == 0) {
269 len--;
270 eid[1] = len;
271 }
272 if (len == 0)
273 return eid;
274
275 return eid + 2 + len;
276 }
277
278
hostapd_eid_qos_map_set(struct hostapd_data * hapd,u8 * eid)279 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
280 {
281 u8 *pos = eid;
282 u8 len = hapd->conf->qos_map_set_len;
283
284 if (!len)
285 return eid;
286
287 *pos++ = WLAN_EID_QOS_MAP_SET;
288 *pos++ = len;
289 os_memcpy(pos, hapd->conf->qos_map_set, len);
290 pos += len;
291
292 return pos;
293 }
294
295
hostapd_eid_interworking(struct hostapd_data * hapd,u8 * eid)296 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
297 {
298 u8 *pos = eid;
299 #ifdef CONFIG_INTERWORKING
300 u8 *len;
301
302 if (!hapd->conf->interworking)
303 return eid;
304
305 *pos++ = WLAN_EID_INTERWORKING;
306 len = pos++;
307
308 *pos = hapd->conf->access_network_type;
309 if (hapd->conf->internet)
310 *pos |= INTERWORKING_ANO_INTERNET;
311 if (hapd->conf->asra)
312 *pos |= INTERWORKING_ANO_ASRA;
313 if (hapd->conf->esr)
314 *pos |= INTERWORKING_ANO_ESR;
315 if (hapd->conf->uesa)
316 *pos |= INTERWORKING_ANO_UESA;
317 pos++;
318
319 if (hapd->conf->venue_info_set) {
320 *pos++ = hapd->conf->venue_group;
321 *pos++ = hapd->conf->venue_type;
322 }
323
324 if (!is_zero_ether_addr(hapd->conf->hessid)) {
325 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
326 pos += ETH_ALEN;
327 }
328
329 *len = pos - len - 1;
330 #endif /* CONFIG_INTERWORKING */
331
332 return pos;
333 }
334
335
hostapd_eid_adv_proto(struct hostapd_data * hapd,u8 * eid)336 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
337 {
338 u8 *pos = eid;
339 #ifdef CONFIG_INTERWORKING
340
341 /* TODO: Separate configuration for ANQP? */
342 if (!hapd->conf->interworking)
343 return eid;
344
345 *pos++ = WLAN_EID_ADV_PROTO;
346 *pos++ = 2;
347 *pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
348 *pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
349 #endif /* CONFIG_INTERWORKING */
350
351 return pos;
352 }
353
354
hostapd_eid_roaming_consortium(struct hostapd_data * hapd,u8 * eid)355 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
356 {
357 u8 *pos = eid;
358 #ifdef CONFIG_INTERWORKING
359 u8 *len;
360 unsigned int i, count;
361
362 if (!hapd->conf->interworking ||
363 hapd->conf->roaming_consortium == NULL ||
364 hapd->conf->roaming_consortium_count == 0)
365 return eid;
366
367 *pos++ = WLAN_EID_ROAMING_CONSORTIUM;
368 len = pos++;
369
370 /* Number of ANQP OIs (in addition to the max 3 listed here) */
371 if (hapd->conf->roaming_consortium_count > 3 + 255)
372 *pos++ = 255;
373 else if (hapd->conf->roaming_consortium_count > 3)
374 *pos++ = hapd->conf->roaming_consortium_count - 3;
375 else
376 *pos++ = 0;
377
378 /* OU #1 and #2 Lengths */
379 *pos = hapd->conf->roaming_consortium[0].len;
380 if (hapd->conf->roaming_consortium_count > 1)
381 *pos |= hapd->conf->roaming_consortium[1].len << 4;
382 pos++;
383
384 if (hapd->conf->roaming_consortium_count > 3)
385 count = 3;
386 else
387 count = hapd->conf->roaming_consortium_count;
388
389 for (i = 0; i < count; i++) {
390 os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
391 hapd->conf->roaming_consortium[i].len);
392 pos += hapd->conf->roaming_consortium[i].len;
393 }
394
395 *len = pos - len - 1;
396 #endif /* CONFIG_INTERWORKING */
397
398 return pos;
399 }
400
401
hostapd_eid_time_adv(struct hostapd_data * hapd,u8 * eid)402 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
403 {
404 if (hapd->conf->time_advertisement != 2)
405 return eid;
406
407 if (hapd->time_adv == NULL &&
408 hostapd_update_time_adv(hapd) < 0)
409 return eid;
410
411 if (hapd->time_adv == NULL)
412 return eid;
413
414 os_memcpy(eid, wpabuf_head(hapd->time_adv),
415 wpabuf_len(hapd->time_adv));
416 eid += wpabuf_len(hapd->time_adv);
417
418 return eid;
419 }
420
421
hostapd_eid_time_zone(struct hostapd_data * hapd,u8 * eid)422 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
423 {
424 size_t len;
425
426 if (hapd->conf->time_advertisement != 2)
427 return eid;
428
429 len = os_strlen(hapd->conf->time_zone);
430
431 *eid++ = WLAN_EID_TIME_ZONE;
432 *eid++ = len;
433 os_memcpy(eid, hapd->conf->time_zone, len);
434 eid += len;
435
436 return eid;
437 }
438
439
hostapd_update_time_adv(struct hostapd_data * hapd)440 int hostapd_update_time_adv(struct hostapd_data *hapd)
441 {
442 const int elen = 2 + 1 + 10 + 5 + 1;
443 struct os_time t;
444 struct os_tm tm;
445 u8 *pos;
446
447 if (hapd->conf->time_advertisement != 2)
448 return 0;
449
450 if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
451 return -1;
452
453 if (!hapd->time_adv) {
454 hapd->time_adv = wpabuf_alloc(elen);
455 if (hapd->time_adv == NULL)
456 return -1;
457 pos = wpabuf_put(hapd->time_adv, elen);
458 } else
459 pos = wpabuf_mhead_u8(hapd->time_adv);
460
461 *pos++ = WLAN_EID_TIME_ADVERTISEMENT;
462 *pos++ = 1 + 10 + 5 + 1;
463
464 *pos++ = 2; /* UTC time at which the TSF timer is 0 */
465
466 /* Time Value at TSF 0 */
467 /* FIX: need to calculate this based on the current TSF value */
468 WPA_PUT_LE16(pos, tm.year); /* Year */
469 pos += 2;
470 *pos++ = tm.month; /* Month */
471 *pos++ = tm.day; /* Day of month */
472 *pos++ = tm.hour; /* Hours */
473 *pos++ = tm.min; /* Minutes */
474 *pos++ = tm.sec; /* Seconds */
475 WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
476 pos += 2;
477 *pos++ = 0; /* Reserved */
478
479 /* Time Error */
480 /* TODO: fill in an estimate on the error */
481 *pos++ = 0;
482 *pos++ = 0;
483 *pos++ = 0;
484 *pos++ = 0;
485 *pos++ = 0;
486
487 *pos++ = hapd->time_update_counter++;
488
489 return 0;
490 }
491
492
hostapd_eid_bss_max_idle_period(struct hostapd_data * hapd,u8 * eid)493 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid)
494 {
495 u8 *pos = eid;
496
497 #ifdef CONFIG_WNM
498 if (hapd->conf->ap_max_inactivity > 0) {
499 unsigned int val;
500 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
501 *pos++ = 3;
502 val = hapd->conf->ap_max_inactivity;
503 if (val > 68000)
504 val = 68000;
505 val *= 1000;
506 val /= 1024;
507 if (val == 0)
508 val = 1;
509 if (val > 65535)
510 val = 65535;
511 WPA_PUT_LE16(pos, val);
512 pos += 2;
513 *pos++ = 0x00; /* TODO: Protected Keep-Alive Required */
514 }
515 #endif /* CONFIG_WNM */
516
517 return pos;
518 }
519
520
521 #ifdef CONFIG_MBO
522
hostapd_eid_mbo(struct hostapd_data * hapd,u8 * eid,size_t len)523 u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len)
524 {
525 u8 mbo[6], *mbo_pos = mbo;
526 u8 *pos = eid;
527
528 if (!hapd->conf->mbo_enabled)
529 return eid;
530
531 *mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND;
532 *mbo_pos++ = 1;
533 /* Not Cellular aware */
534 *mbo_pos++ = 0;
535
536 if (hapd->mbo_assoc_disallow) {
537 *mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW;
538 *mbo_pos++ = 1;
539 *mbo_pos++ = hapd->mbo_assoc_disallow;
540 }
541
542 pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo);
543
544 return pos;
545 }
546
547
hostapd_mbo_ie_len(struct hostapd_data * hapd)548 u8 hostapd_mbo_ie_len(struct hostapd_data *hapd)
549 {
550 if (!hapd->conf->mbo_enabled)
551 return 0;
552
553 /*
554 * MBO IE header (6) + Capability Indication attribute (3) +
555 * Association Disallowed attribute (3) = 12
556 */
557 return 6 + 3 + (hapd->mbo_assoc_disallow ? 3 : 0);
558 }
559
560 #endif /* CONFIG_MBO */
561
562
ap_copy_sta_supp_op_classes(struct sta_info * sta,const u8 * supp_op_classes,size_t supp_op_classes_len)563 void ap_copy_sta_supp_op_classes(struct sta_info *sta,
564 const u8 *supp_op_classes,
565 size_t supp_op_classes_len)
566 {
567 if (!supp_op_classes)
568 return;
569 os_free(sta->supp_op_classes);
570 sta->supp_op_classes = os_malloc(1 + supp_op_classes_len);
571 if (!sta->supp_op_classes)
572 return;
573
574 sta->supp_op_classes[0] = supp_op_classes_len;
575 os_memcpy(sta->supp_op_classes + 1, supp_op_classes,
576 supp_op_classes_len);
577 }
578