driver_nl80211.c revision 6e933c1e09094a8972ef1e782c57f8b3c55c91d0
1/* 2 * Driver interaction with Linux nl80211/cfg80211 3 * Copyright (c) 2002-2010, Jouni Malinen <j@w1.fi> 4 * Copyright (c) 2003-2004, Instant802 Networks, Inc. 5 * Copyright (c) 2005-2006, Devicescape Software, Inc. 6 * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net> 7 * Copyright (c) 2009-2010, Atheros Communications 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License version 2 as 11 * published by the Free Software Foundation. 12 * 13 * Alternatively, this software may be distributed under the terms of BSD 14 * license. 15 * 16 * See README and COPYING for more details. 17 */ 18 19#include "includes.h" 20#include <sys/ioctl.h> 21#include <sys/types.h> 22#include <sys/stat.h> 23#include <fcntl.h> 24#include <net/if.h> 25#include <netlink/genl/genl.h> 26#include <netlink/genl/family.h> 27#include <netlink/genl/ctrl.h> 28#include <linux/rtnetlink.h> 29#include <netpacket/packet.h> 30#include <linux/filter.h> 31#include "nl80211_copy.h" 32 33#include "common.h" 34#include "eloop.h" 35#include "utils/list.h" 36#include "common/ieee802_11_defs.h" 37#include "netlink.h" 38#include "linux_ioctl.h" 39#include "radiotap.h" 40#include "radiotap_iter.h" 41#include "rfkill.h" 42#include "driver.h" 43#if defined(ANDROID_BRCM_P2P_PATCH) && !defined(HOSTAPD) 44#include "wpa_supplicant_i.h" 45#endif 46#ifdef ANDROID 47#define WPA_EVENT_DRIVER_STATE "CTRL-EVENT-DRIVER-STATE " 48#endif 49#ifdef CONFIG_LIBNL20 50/* libnl 2.0 compatibility code */ 51#define nl_handle nl_sock 52#define nl80211_handle_alloc nl_socket_alloc_cb 53#define nl80211_handle_destroy nl_socket_free 54#else 55/* 56 * libnl 1.1 has a bug, it tries to allocate socket numbers densely 57 * but when you free a socket again it will mess up its bitmap and 58 * and use the wrong number the next time it needs a socket ID. 59 * Therefore, we wrap the handle alloc/destroy and add our own pid 60 * accounting. 61 */ 62static uint32_t port_bitmap[32] = { 0 }; 63 64static struct nl_handle *nl80211_handle_alloc(void *cb) 65{ 66 struct nl_handle *handle; 67 uint32_t pid = getpid() & 0x3FFFFF; 68 int i; 69 70 handle = nl_handle_alloc_cb(cb); 71 72 for (i = 0; i < 1024; i++) { 73 if (port_bitmap[i / 32] & (1 << (i % 32))) 74 continue; 75 port_bitmap[i / 32] |= 1 << (i % 32); 76 pid += i << 22; 77 break; 78 } 79 80 nl_socket_set_local_port(handle, pid); 81 82 return handle; 83} 84 85static void nl80211_handle_destroy(struct nl_handle *handle) 86{ 87 uint32_t port = nl_socket_get_local_port(handle); 88 89 port >>= 22; 90 port_bitmap[port / 32] &= ~(1 << (port % 32)); 91 92 nl_handle_destroy(handle); 93} 94#endif /* CONFIG_LIBNL20 */ 95 96 97#ifndef IFF_LOWER_UP 98#define IFF_LOWER_UP 0x10000 /* driver signals L1 up */ 99#endif 100#ifndef IFF_DORMANT 101#define IFF_DORMANT 0x20000 /* driver signals dormant */ 102#endif 103 104#ifndef IF_OPER_DORMANT 105#define IF_OPER_DORMANT 5 106#endif 107#ifndef IF_OPER_UP 108#define IF_OPER_UP 6 109#endif 110 111struct nl80211_global { 112 struct dl_list interfaces; 113}; 114 115struct i802_bss { 116 struct wpa_driver_nl80211_data *drv; 117 struct i802_bss *next; 118 int ifindex; 119 char ifname[IFNAMSIZ + 1]; 120 char brname[IFNAMSIZ]; 121 unsigned int beacon_set:1; 122 unsigned int added_if_into_bridge:1; 123 unsigned int added_bridge:1; 124}; 125 126struct wpa_driver_nl80211_data { 127 struct nl80211_global *global; 128 struct dl_list list; 129 u8 addr[ETH_ALEN]; 130 char phyname[32]; 131 void *ctx; 132 struct netlink_data *netlink; 133 int ioctl_sock; /* socket for ioctl() use */ 134 int ifindex; 135 int if_removed; 136 int if_disabled; 137 struct rfkill_data *rfkill; 138 struct wpa_driver_capa capa; 139 int has_capability; 140 141 int operstate; 142 143 int scan_complete_events; 144 145 struct nl_handle *nl_handle; 146 struct nl_handle *nl_handle_event; 147 struct nl_handle *nl_handle_preq; 148 struct nl_cache *nl_cache; 149 struct nl_cache *nl_cache_event; 150 struct nl_cache *nl_cache_preq; 151 struct nl_cb *nl_cb; 152 struct genl_family *nl80211; 153 154 u8 auth_bssid[ETH_ALEN]; 155 u8 bssid[ETH_ALEN]; 156 int associated; 157 u8 ssid[32]; 158 size_t ssid_len; 159 int nlmode; 160 int ap_scan_as_station; 161 unsigned int assoc_freq; 162 163 int monitor_sock; 164 int monitor_ifidx; 165 int no_monitor_iface_capab; 166 int disable_11b_rates; 167 168 unsigned int pending_remain_on_chan:1; 169 170 u64 remain_on_chan_cookie; 171 u64 send_action_cookie; 172 173 unsigned int last_mgmt_freq; 174 unsigned int ap_oper_freq; 175 176 struct wpa_driver_scan_filter *filter_ssids; 177 size_t num_filter_ssids; 178 179 struct i802_bss first_bss; 180 181#ifdef HOSTAPD 182 int eapol_sock; /* socket for EAPOL frames */ 183 184 int default_if_indices[16]; 185 int *if_indices; 186 int num_if_indices; 187 188 int last_freq; 189 int last_freq_ht; 190#endif /* HOSTAPD */ 191}; 192 193 194static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, 195 void *timeout_ctx); 196static int wpa_driver_nl80211_set_mode(void *priv, int mode); 197static int 198wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv); 199static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv, 200 const u8 *addr, int cmd, u16 reason_code, 201 int local_state_change); 202static void nl80211_remove_monitor_interface( 203 struct wpa_driver_nl80211_data *drv); 204static int nl80211_send_frame_cmd(struct wpa_driver_nl80211_data *drv, 205 unsigned int freq, unsigned int wait, 206 const u8 *buf, size_t buf_len, u64 *cookie); 207static int wpa_driver_nl80211_probe_req_report(void *priv, int report); 208#ifdef ANDROID_BRCM_P2P_PATCH 209static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv, 210 enum wpa_event_type type, 211 const u8 *frame, size_t len); 212int wpa_driver_set_p2p_noa(void *priv, u8 count, int start, int duration); 213int wpa_driver_set_p2p_ps(void *priv, int legacy_ps, int opp_ps, int ctwindow); 214int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon, 215 const struct wpabuf *proberesp, 216 const struct wpabuf *assocresp); 217#endif 218 219#ifdef HOSTAPD 220static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx); 221static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx); 222static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx); 223static int wpa_driver_nl80211_if_remove(void *priv, 224 enum wpa_driver_if_type type, 225 const char *ifname); 226#else /* HOSTAPD */ 227static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) 228{ 229 return 0; 230} 231#endif /* HOSTAPD */ 232 233#ifdef ANDROID 234extern int wpa_driver_nl80211_driver_cmd(void *priv, char *cmd, char *buf, 235 size_t buf_len); 236#endif 237 238static int i802_set_freq(void *priv, struct hostapd_freq_params *freq); 239static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv, 240 int ifindex, int disabled); 241 242static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv); 243 244 245struct nl80211_bss_info_arg { 246 struct wpa_driver_nl80211_data *drv; 247 struct wpa_scan_results *res; 248 unsigned int assoc_freq; 249}; 250 251static int bss_info_handler(struct nl_msg *msg, void *arg); 252 253 254/* nl80211 code */ 255static int ack_handler(struct nl_msg *msg, void *arg) 256{ 257 int *err = arg; 258 *err = 0; 259 return NL_STOP; 260} 261 262static int finish_handler(struct nl_msg *msg, void *arg) 263{ 264 int *ret = arg; 265 *ret = 0; 266 return NL_SKIP; 267} 268 269static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err, 270 void *arg) 271{ 272 int *ret = arg; 273 *ret = err->error; 274 return NL_SKIP; 275} 276 277 278static int no_seq_check(struct nl_msg *msg, void *arg) 279{ 280 return NL_OK; 281} 282 283 284static int send_and_recv(struct wpa_driver_nl80211_data *drv, 285 struct nl_handle *nl_handle, struct nl_msg *msg, 286 int (*valid_handler)(struct nl_msg *, void *), 287 void *valid_data) 288{ 289 struct nl_cb *cb; 290 int err = -ENOMEM; 291 292 cb = nl_cb_clone(drv->nl_cb); 293 if (!cb) 294 goto out; 295 296 err = nl_send_auto_complete(nl_handle, msg); 297 if (err < 0) 298 goto out; 299 300 err = 1; 301 302 nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err); 303 nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err); 304 nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err); 305 306 if (valid_handler) 307 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, 308 valid_handler, valid_data); 309 310 while (err > 0) 311 nl_recvmsgs(nl_handle, cb); 312 out: 313 nl_cb_put(cb); 314 nlmsg_free(msg); 315 return err; 316} 317 318 319int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv, 320 struct nl_msg *msg, 321 int (*valid_handler)(struct nl_msg *, void *), 322 void *valid_data) 323{ 324 return send_and_recv(drv, drv->nl_handle, msg, valid_handler, 325 valid_data); 326} 327 328 329struct family_data { 330 const char *group; 331 int id; 332}; 333 334 335static int family_handler(struct nl_msg *msg, void *arg) 336{ 337 struct family_data *res = arg; 338 struct nlattr *tb[CTRL_ATTR_MAX + 1]; 339 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 340 struct nlattr *mcgrp; 341 int i; 342 343 nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 344 genlmsg_attrlen(gnlh, 0), NULL); 345 if (!tb[CTRL_ATTR_MCAST_GROUPS]) 346 return NL_SKIP; 347 348 nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) { 349 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1]; 350 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp), 351 nla_len(mcgrp), NULL); 352 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] || 353 !tb2[CTRL_ATTR_MCAST_GRP_ID] || 354 os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]), 355 res->group, 356 nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0) 357 continue; 358 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]); 359 break; 360 }; 361 362 return NL_SKIP; 363} 364 365 366static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv, 367 const char *family, const char *group) 368{ 369 struct nl_msg *msg; 370 int ret = -1; 371 struct family_data res = { group, -ENOENT }; 372 373 msg = nlmsg_alloc(); 374 if (!msg) 375 return -ENOMEM; 376 genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"), 377 0, 0, CTRL_CMD_GETFAMILY, 0); 378 NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family); 379 380 ret = send_and_recv_msgs(drv, msg, family_handler, &res); 381 msg = NULL; 382 if (ret == 0) 383 ret = res.id; 384 385nla_put_failure: 386 nlmsg_free(msg); 387 return ret; 388} 389 390 391static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid) 392{ 393 struct i802_bss *bss = priv; 394 struct wpa_driver_nl80211_data *drv = bss->drv; 395 if (!drv->associated) 396 return -1; 397 os_memcpy(bssid, drv->bssid, ETH_ALEN); 398 return 0; 399} 400 401 402static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid) 403{ 404 struct i802_bss *bss = priv; 405 struct wpa_driver_nl80211_data *drv = bss->drv; 406 if (!drv->associated) 407 return -1; 408 os_memcpy(ssid, drv->ssid, drv->ssid_len); 409 return drv->ssid_len; 410} 411 412 413static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv, 414 char *buf, size_t len, int del) 415{ 416 union wpa_event_data event; 417 418 os_memset(&event, 0, sizeof(event)); 419 if (len > sizeof(event.interface_status.ifname)) 420 len = sizeof(event.interface_status.ifname) - 1; 421 os_memcpy(event.interface_status.ifname, buf, len); 422 event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED : 423 EVENT_INTERFACE_ADDED; 424 425 wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s", 426 del ? "DEL" : "NEW", 427 event.interface_status.ifname, 428 del ? "removed" : "added"); 429 430 if (os_strcmp(drv->first_bss.ifname, event.interface_status.ifname) == 0) { 431 if (del) 432 drv->if_removed = 1; 433 else 434 drv->if_removed = 0; 435 } 436 437 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS, &event); 438} 439 440 441static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv, 442 u8 *buf, size_t len) 443{ 444 int attrlen, rta_len; 445 struct rtattr *attr; 446 447 attrlen = len; 448 attr = (struct rtattr *) buf; 449 450 rta_len = RTA_ALIGN(sizeof(struct rtattr)); 451 while (RTA_OK(attr, attrlen)) { 452 if (attr->rta_type == IFLA_IFNAME) { 453 if (os_strcmp(((char *) attr) + rta_len, drv->first_bss.ifname) 454 == 0) 455 return 1; 456 else 457 break; 458 } 459 attr = RTA_NEXT(attr, attrlen); 460 } 461 462 return 0; 463} 464 465 466static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv, 467 int ifindex, u8 *buf, size_t len) 468{ 469 if (drv->ifindex == ifindex) 470 return 1; 471 472 if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, buf, len)) { 473 drv->first_bss.ifindex = if_nametoindex(drv->first_bss.ifname); 474 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed " 475 "interface"); 476 wpa_driver_nl80211_finish_drv_init(drv); 477 return 1; 478 } 479 480 return 0; 481} 482 483 484static void wpa_driver_nl80211_event_rtm_newlink(void *ctx, 485 struct ifinfomsg *ifi, 486 u8 *buf, size_t len) 487{ 488 struct wpa_driver_nl80211_data *drv = ctx; 489 int attrlen, rta_len; 490 struct rtattr *attr; 491 u32 brid = 0; 492 493 if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, buf, len) && 494 !have_ifidx(drv, ifi->ifi_index)) { 495 wpa_printf(MSG_DEBUG, "nl80211: Ignore event for foreign " 496 "ifindex %d", ifi->ifi_index); 497 return; 498 } 499 500 wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x " 501 "(%s%s%s%s)", 502 drv->operstate, ifi->ifi_flags, 503 (ifi->ifi_flags & IFF_UP) ? "[UP]" : "", 504 (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "", 505 (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "", 506 (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : ""); 507 508 if (!drv->if_disabled && !(ifi->ifi_flags & IFF_UP)) { 509 wpa_printf(MSG_DEBUG, "nl80211: Interface down"); 510 drv->if_disabled = 1; 511 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED, NULL); 512 } 513 514 if (drv->if_disabled && (ifi->ifi_flags & IFF_UP)) { 515 wpa_printf(MSG_DEBUG, "nl80211: Interface up"); 516 drv->if_disabled = 0; 517 wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED, NULL); 518 } 519 520 /* 521 * Some drivers send the association event before the operup event--in 522 * this case, lifting operstate in wpa_driver_nl80211_set_operstate() 523 * fails. This will hit us when wpa_supplicant does not need to do 524 * IEEE 802.1X authentication 525 */ 526 if (drv->operstate == 1 && 527 (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP && 528 !(ifi->ifi_flags & IFF_RUNNING)) 529 netlink_send_oper_ifla(drv->netlink, drv->ifindex, 530 -1, IF_OPER_UP); 531 532 attrlen = len; 533 attr = (struct rtattr *) buf; 534 rta_len = RTA_ALIGN(sizeof(struct rtattr)); 535 while (RTA_OK(attr, attrlen)) { 536 if (attr->rta_type == IFLA_IFNAME) { 537 wpa_driver_nl80211_event_link( 538 drv, 539 ((char *) attr) + rta_len, 540 attr->rta_len - rta_len, 0); 541 } else if (attr->rta_type == IFLA_MASTER) 542 brid = nla_get_u32((struct nlattr *) attr); 543 attr = RTA_NEXT(attr, attrlen); 544 } 545 546#ifdef HOSTAPD 547 if (ifi->ifi_family == AF_BRIDGE && brid) { 548 /* device has been added to bridge */ 549 char namebuf[IFNAMSIZ]; 550 if_indextoname(brid, namebuf); 551 wpa_printf(MSG_DEBUG, "nl80211: Add ifindex %u for bridge %s", 552 brid, namebuf); 553 add_ifidx(drv, brid); 554 } 555#endif /* HOSTAPD */ 556} 557 558 559static void wpa_driver_nl80211_event_rtm_dellink(void *ctx, 560 struct ifinfomsg *ifi, 561 u8 *buf, size_t len) 562{ 563 struct wpa_driver_nl80211_data *drv = ctx; 564 int attrlen, rta_len; 565 struct rtattr *attr; 566 u32 brid = 0; 567 568 attrlen = len; 569 attr = (struct rtattr *) buf; 570 571 rta_len = RTA_ALIGN(sizeof(struct rtattr)); 572 while (RTA_OK(attr, attrlen)) { 573 if (attr->rta_type == IFLA_IFNAME) { 574 wpa_driver_nl80211_event_link( 575 drv, 576 ((char *) attr) + rta_len, 577 attr->rta_len - rta_len, 1); 578 } else if (attr->rta_type == IFLA_MASTER) 579 brid = nla_get_u32((struct nlattr *) attr); 580 attr = RTA_NEXT(attr, attrlen); 581 } 582 583#ifdef HOSTAPD 584 if (ifi->ifi_family == AF_BRIDGE && brid) { 585 /* device has been removed from bridge */ 586 char namebuf[IFNAMSIZ]; 587 if_indextoname(brid, namebuf); 588 wpa_printf(MSG_DEBUG, "nl80211: Remove ifindex %u for bridge " 589 "%s", brid, namebuf); 590 del_ifidx(drv, brid); 591 } 592#endif /* HOSTAPD */ 593} 594 595 596static void mlme_event_auth(struct wpa_driver_nl80211_data *drv, 597 const u8 *frame, size_t len) 598{ 599 const struct ieee80211_mgmt *mgmt; 600 union wpa_event_data event; 601 602 mgmt = (const struct ieee80211_mgmt *) frame; 603 if (len < 24 + sizeof(mgmt->u.auth)) { 604 wpa_printf(MSG_DEBUG, "nl80211: Too short association event " 605 "frame"); 606 return; 607 } 608 609 os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN); 610 os_memset(&event, 0, sizeof(event)); 611 os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN); 612 event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg); 613 event.auth.status_code = le_to_host16(mgmt->u.auth.status_code); 614 if (len > 24 + sizeof(mgmt->u.auth)) { 615 event.auth.ies = mgmt->u.auth.variable; 616 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth); 617 } 618 619 wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event); 620} 621 622 623static unsigned int nl80211_get_assoc_freq(struct wpa_driver_nl80211_data *drv) 624{ 625 struct nl_msg *msg; 626 int ret; 627 struct nl80211_bss_info_arg arg; 628 629 os_memset(&arg, 0, sizeof(arg)); 630 msg = nlmsg_alloc(); 631 if (!msg) 632 goto nla_put_failure; 633 634 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP, 635 NL80211_CMD_GET_SCAN, 0); 636 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 637 638 arg.drv = drv; 639 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg); 640 msg = NULL; 641 if (ret == 0) { 642 wpa_printf(MSG_DEBUG, "nl80211: Operating frequency for the " 643 "associated BSS from scan results: %u MHz", 644 arg.assoc_freq); 645 return arg.assoc_freq ? arg.assoc_freq : drv->assoc_freq; 646 } 647 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d " 648 "(%s)", ret, strerror(-ret)); 649nla_put_failure: 650 nlmsg_free(msg); 651 return drv->assoc_freq; 652} 653 654 655static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv, 656 const u8 *frame, size_t len) 657{ 658 const struct ieee80211_mgmt *mgmt; 659 union wpa_event_data event; 660 u16 status; 661#ifdef ANDROID_BRCM_P2P_PATCH 662 struct wpa_supplicant *wpa_s = drv->ctx; 663#endif 664 665 mgmt = (const struct ieee80211_mgmt *) frame; 666#if (defined (CONFIG_AP) || defined (HOSTAPD) ) && defined (ANDROID_BRCM_P2P_PATCH) 667 if (drv->nlmode == NL80211_IFTYPE_AP || drv->nlmode == NL80211_IFTYPE_P2P_GO) { 668 if (len < 24 + sizeof(mgmt->u.assoc_req)) { 669 wpa_printf(MSG_DEBUG, "nl80211: Too short association event " 670 "frame"); 671 return; 672 } 673 os_memset(&event, 0, sizeof(event)); 674 event.assoc_info.freq = drv->assoc_freq; 675 event.assoc_info.req_ies = (u8 *) mgmt->u.assoc_req.variable; 676 event.assoc_info.req_ies_len = len - 24 - sizeof(mgmt->u.assoc_req); 677 event.assoc_info.addr = mgmt->sa; 678 } else { 679#endif 680 if (len < 24 + sizeof(mgmt->u.assoc_resp)) { 681 wpa_printf(MSG_DEBUG, "nl80211: Too short association event " 682 "frame"); 683 return; 684 } 685 686 status = le_to_host16(mgmt->u.assoc_resp.status_code); 687 if (status != WLAN_STATUS_SUCCESS) { 688 os_memset(&event, 0, sizeof(event)); 689 event.assoc_reject.bssid = mgmt->bssid; 690 if (len > 24 + sizeof(mgmt->u.assoc_resp)) { 691 event.assoc_reject.resp_ies = 692 (u8 *) mgmt->u.assoc_resp.variable; 693 event.assoc_reject.resp_ies_len = 694 len - 24 - sizeof(mgmt->u.assoc_resp); 695 } 696 event.assoc_reject.status_code = status; 697 698 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event); 699 return; 700 } 701 702 drv->associated = 1; 703 os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN); 704 705 os_memset(&event, 0, sizeof(event)); 706 if (len > 24 + sizeof(mgmt->u.assoc_resp)) { 707 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable; 708 event.assoc_info.resp_ies_len = 709 len - 24 - sizeof(mgmt->u.assoc_resp); 710 } 711 712 event.assoc_info.freq = drv->assoc_freq; 713#if (defined (CONFIG_AP) || defined(HOSTAPD)) && defined (ANDROID_BRCM_P2P_PATCH) 714 } 715#endif 716 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event); 717} 718 719 720static void mlme_event_connect(struct wpa_driver_nl80211_data *drv, 721 enum nl80211_commands cmd, struct nlattr *status, 722 struct nlattr *addr, struct nlattr *req_ie, 723 struct nlattr *resp_ie) 724{ 725 union wpa_event_data event; 726 727 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { 728 /* 729 * Avoid reporting two association events that would confuse 730 * the core code. 731 */ 732 wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) " 733 "when using userspace SME", cmd); 734 return; 735 } 736 737 os_memset(&event, 0, sizeof(event)); 738 if (cmd == NL80211_CMD_CONNECT && 739 nla_get_u16(status) != WLAN_STATUS_SUCCESS) { 740 if (addr) 741 event.assoc_reject.bssid = nla_data(addr); 742 if (resp_ie) { 743 event.assoc_reject.resp_ies = nla_data(resp_ie); 744 event.assoc_reject.resp_ies_len = nla_len(resp_ie); 745 } 746 event.assoc_reject.status_code = nla_get_u16(status); 747 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event); 748 return; 749 } 750 751 drv->associated = 1; 752 if (addr) 753 os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN); 754 755 if (req_ie) { 756 event.assoc_info.req_ies = nla_data(req_ie); 757 event.assoc_info.req_ies_len = nla_len(req_ie); 758 } 759 if (resp_ie) { 760 event.assoc_info.resp_ies = nla_data(resp_ie); 761 event.assoc_info.resp_ies_len = nla_len(resp_ie); 762 } 763 764 event.assoc_info.freq = nl80211_get_assoc_freq(drv); 765 766 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event); 767} 768 769 770static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv, 771 enum nl80211_commands cmd, struct nlattr *addr) 772{ 773 union wpa_event_data event; 774 enum wpa_event_type ev; 775 776 if (nla_len(addr) != ETH_ALEN) 777 return; 778 779 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR, 780 cmd, MAC2STR((u8 *) nla_data(addr))); 781 782 if (cmd == NL80211_CMD_AUTHENTICATE) 783 ev = EVENT_AUTH_TIMED_OUT; 784 else if (cmd == NL80211_CMD_ASSOCIATE) 785 ev = EVENT_ASSOC_TIMED_OUT; 786 else 787 return; 788 789 os_memset(&event, 0, sizeof(event)); 790 os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN); 791 wpa_supplicant_event(drv->ctx, ev, &event); 792} 793 794 795static void mlme_event_mgmt(struct wpa_driver_nl80211_data *drv, 796 struct nlattr *freq, const u8 *frame, size_t len) 797{ 798 const struct ieee80211_mgmt *mgmt; 799 union wpa_event_data event; 800 u16 fc, stype; 801 802 mgmt = (const struct ieee80211_mgmt *) frame; 803 if (len < 24) { 804 wpa_printf(MSG_DEBUG, "nl80211: Too short action frame"); 805 return; 806 } 807 808 fc = le_to_host16(mgmt->frame_control); 809 stype = WLAN_FC_GET_STYPE(fc); 810 811 os_memset(&event, 0, sizeof(event)); 812 if (freq) { 813 event.rx_action.freq = nla_get_u32(freq); 814 drv->last_mgmt_freq = event.rx_action.freq; 815 } 816 if (stype == WLAN_FC_STYPE_ACTION) { 817 event.rx_action.da = mgmt->da; 818 event.rx_action.sa = mgmt->sa; 819 event.rx_action.bssid = mgmt->bssid; 820 event.rx_action.category = mgmt->u.action.category; 821 event.rx_action.data = &mgmt->u.action.category + 1; 822 event.rx_action.len = frame + len - event.rx_action.data; 823 wpa_supplicant_event(drv->ctx, EVENT_RX_ACTION, &event); 824#ifdef ANDROID_BRCM_P2P_PATCH 825 } else if (stype == WLAN_FC_STYPE_ASSOC_REQ) { 826 mlme_event_assoc(drv, frame, len); 827 } else if (stype == WLAN_FC_STYPE_DISASSOC) { 828 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC, frame, len); 829 } else if (stype == WLAN_FC_STYPE_DEAUTH) { 830 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH, frame, len); 831#endif 832 } else { 833 event.rx_mgmt.frame = frame; 834 event.rx_mgmt.frame_len = len; 835 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event); 836 } 837} 838 839 840static void mlme_event_action_tx_status(struct wpa_driver_nl80211_data *drv, 841 struct nlattr *cookie, const u8 *frame, 842 size_t len, struct nlattr *ack) 843{ 844 union wpa_event_data event; 845 const struct ieee80211_hdr *hdr; 846 u16 fc; 847 u64 cookie_val; 848 849 if (!cookie) 850 return; 851 852 cookie_val = nla_get_u64(cookie); 853 wpa_printf(MSG_DEBUG, "nl80211: Action TX status: cookie=0%llx%s " 854 "(ack=%d)", 855 (long long unsigned int) cookie_val, 856 cookie_val == drv->send_action_cookie ? 857 " (match)" : " (unknown)", ack != NULL); 858 if (cookie_val != drv->send_action_cookie) 859 return; 860 861 hdr = (const struct ieee80211_hdr *) frame; 862 fc = le_to_host16(hdr->frame_control); 863 864 os_memset(&event, 0, sizeof(event)); 865 event.tx_status.type = WLAN_FC_GET_TYPE(fc); 866 event.tx_status.stype = WLAN_FC_GET_STYPE(fc); 867 event.tx_status.dst = hdr->addr1; 868 event.tx_status.data = frame; 869 event.tx_status.data_len = len; 870 event.tx_status.ack = ack != NULL; 871 wpa_supplicant_event(drv->ctx, EVENT_TX_STATUS, &event); 872} 873 874 875static void mlme_event_deauth_disassoc(struct wpa_driver_nl80211_data *drv, 876 enum wpa_event_type type, 877 const u8 *frame, size_t len) 878{ 879 const struct ieee80211_mgmt *mgmt; 880 union wpa_event_data event; 881 const u8 *bssid = NULL; 882 u16 reason_code = 0; 883 884 mgmt = (const struct ieee80211_mgmt *) frame; 885 if (len >= 24) { 886 bssid = mgmt->bssid; 887 888 if (drv->associated != 0 && 889 os_memcmp(bssid, drv->bssid, ETH_ALEN) != 0 && 890 os_memcmp(bssid, drv->auth_bssid, ETH_ALEN) != 0) { 891 /* 892 * We have presumably received this deauth as a 893 * response to a clear_state_mismatch() outgoing 894 * deauth. Don't let it take us offline! 895 */ 896 wpa_printf(MSG_DEBUG, "nl80211: Deauth received " 897 "from Unknown BSSID " MACSTR " -- ignoring", 898 MAC2STR(bssid)); 899 return; 900 } 901 } 902 903 drv->associated = 0; 904 os_memset(&event, 0, sizeof(event)); 905 906 /* Note: Same offset for Reason Code in both frame subtypes */ 907 if (len >= 24 + sizeof(mgmt->u.deauth)) 908 reason_code = le_to_host16(mgmt->u.deauth.reason_code); 909 910 if (type == EVENT_DISASSOC) { 911#ifdef ANDROID_BRCM_P2P_PATCH 912 if (drv->nlmode == NL80211_IFTYPE_AP || 913 drv->nlmode == NL80211_IFTYPE_P2P_GO) { 914 event.disassoc_info.addr = mgmt->sa; 915 } else 916#endif 917 event.disassoc_info.addr = bssid; 918 event.disassoc_info.reason_code = reason_code; 919 if (frame + len > mgmt->u.disassoc.variable) { 920 event.disassoc_info.ie = mgmt->u.disassoc.variable; 921 event.disassoc_info.ie_len = frame + len - 922 mgmt->u.disassoc.variable; 923 } 924 } else { 925#ifdef ANDROID_BRCM_P2P_PATCH 926 if (drv->nlmode == NL80211_IFTYPE_AP || 927 drv->nlmode == NL80211_IFTYPE_P2P_GO) { 928 event.deauth_info.addr = mgmt->sa; 929 } else 930#endif 931 event.deauth_info.addr = bssid; 932 event.deauth_info.reason_code = reason_code; 933 if (frame + len > mgmt->u.deauth.variable) { 934 event.deauth_info.ie = mgmt->u.deauth.variable; 935 event.deauth_info.ie_len = frame + len - 936 mgmt->u.deauth.variable; 937 } 938 } 939 940 wpa_supplicant_event(drv->ctx, type, &event); 941} 942 943 944static void mlme_event_unprot_disconnect(struct wpa_driver_nl80211_data *drv, 945 enum wpa_event_type type, 946 const u8 *frame, size_t len) 947{ 948 const struct ieee80211_mgmt *mgmt; 949 union wpa_event_data event; 950 u16 reason_code = 0; 951 952 if (len < 24) 953 return; 954 955 mgmt = (const struct ieee80211_mgmt *) frame; 956 957 os_memset(&event, 0, sizeof(event)); 958 /* Note: Same offset for Reason Code in both frame subtypes */ 959 if (len >= 24 + sizeof(mgmt->u.deauth)) 960 reason_code = le_to_host16(mgmt->u.deauth.reason_code); 961 962 if (type == EVENT_UNPROT_DISASSOC) { 963 event.unprot_disassoc.sa = mgmt->sa; 964 event.unprot_disassoc.da = mgmt->da; 965 event.unprot_disassoc.reason_code = reason_code; 966 } else { 967 event.unprot_deauth.sa = mgmt->sa; 968 event.unprot_deauth.da = mgmt->da; 969 event.unprot_deauth.reason_code = reason_code; 970 } 971 972 wpa_supplicant_event(drv->ctx, type, &event); 973} 974 975 976static void mlme_event(struct wpa_driver_nl80211_data *drv, 977 enum nl80211_commands cmd, struct nlattr *frame, 978 struct nlattr *addr, struct nlattr *timed_out, 979 struct nlattr *freq, struct nlattr *ack, 980 struct nlattr *cookie) 981{ 982 if (timed_out && addr) { 983 mlme_timeout_event(drv, cmd, addr); 984 return; 985 } 986 987 if (frame == NULL) { 988 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame " 989 "data", cmd); 990 return; 991 } 992 993 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd); 994 wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame", 995 nla_data(frame), nla_len(frame)); 996 997 switch (cmd) { 998 case NL80211_CMD_AUTHENTICATE: 999 mlme_event_auth(drv, nla_data(frame), nla_len(frame)); 1000 break; 1001 case NL80211_CMD_ASSOCIATE: 1002 mlme_event_assoc(drv, nla_data(frame), nla_len(frame)); 1003 break; 1004 case NL80211_CMD_DEAUTHENTICATE: 1005 mlme_event_deauth_disassoc(drv, EVENT_DEAUTH, 1006 nla_data(frame), nla_len(frame)); 1007 break; 1008 case NL80211_CMD_DISASSOCIATE: 1009 mlme_event_deauth_disassoc(drv, EVENT_DISASSOC, 1010 nla_data(frame), nla_len(frame)); 1011 break; 1012 case NL80211_CMD_FRAME: 1013 mlme_event_mgmt(drv, freq, nla_data(frame), nla_len(frame)); 1014 break; 1015 case NL80211_CMD_FRAME_TX_STATUS: 1016 mlme_event_action_tx_status(drv, cookie, nla_data(frame), 1017 nla_len(frame), ack); 1018 break; 1019 case NL80211_CMD_UNPROT_DEAUTHENTICATE: 1020 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DEAUTH, 1021 nla_data(frame), nla_len(frame)); 1022 break; 1023 case NL80211_CMD_UNPROT_DISASSOCIATE: 1024 mlme_event_unprot_disconnect(drv, EVENT_UNPROT_DISASSOC, 1025 nla_data(frame), nla_len(frame)); 1026 break; 1027 default: 1028 break; 1029 } 1030} 1031 1032 1033static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv, 1034 struct nlattr *tb[]) 1035{ 1036 union wpa_event_data data; 1037 1038 wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure"); 1039 os_memset(&data, 0, sizeof(data)); 1040 if (tb[NL80211_ATTR_MAC]) { 1041 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address", 1042 nla_data(tb[NL80211_ATTR_MAC]), 1043 nla_len(tb[NL80211_ATTR_MAC])); 1044 data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]); 1045 } 1046 if (tb[NL80211_ATTR_KEY_SEQ]) { 1047 wpa_hexdump(MSG_DEBUG, "nl80211: TSC", 1048 nla_data(tb[NL80211_ATTR_KEY_SEQ]), 1049 nla_len(tb[NL80211_ATTR_KEY_SEQ])); 1050 } 1051 if (tb[NL80211_ATTR_KEY_TYPE]) { 1052 enum nl80211_key_type key_type = 1053 nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]); 1054 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type); 1055 if (key_type == NL80211_KEYTYPE_PAIRWISE) 1056 data.michael_mic_failure.unicast = 1; 1057 } else 1058 data.michael_mic_failure.unicast = 1; 1059 1060 if (tb[NL80211_ATTR_KEY_IDX]) { 1061 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]); 1062 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id); 1063 } 1064 1065 wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data); 1066} 1067 1068 1069static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv, 1070 struct nlattr *tb[]) 1071{ 1072 if (tb[NL80211_ATTR_MAC] == NULL) { 1073 wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined " 1074 "event"); 1075 return; 1076 } 1077 os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN); 1078 drv->associated = 1; 1079 wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined", 1080 MAC2STR(drv->bssid)); 1081 1082 wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL); 1083} 1084 1085 1086static void mlme_event_remain_on_channel(struct wpa_driver_nl80211_data *drv, 1087 int cancel_event, struct nlattr *tb[]) 1088{ 1089 unsigned int freq, chan_type, duration; 1090 union wpa_event_data data; 1091 u64 cookie; 1092 1093 if (tb[NL80211_ATTR_WIPHY_FREQ]) 1094 freq = nla_get_u32(tb[NL80211_ATTR_WIPHY_FREQ]); 1095 else 1096 freq = 0; 1097 1098 if (tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) 1099 chan_type = nla_get_u32(tb[NL80211_ATTR_WIPHY_CHANNEL_TYPE]); 1100 else 1101 chan_type = 0; 1102 1103 if (tb[NL80211_ATTR_DURATION]) 1104 duration = nla_get_u32(tb[NL80211_ATTR_DURATION]); 1105 else 1106 duration = 0; 1107 1108 if (tb[NL80211_ATTR_COOKIE]) 1109 cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]); 1110 else 1111 cookie = 0; 1112 1113 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel event (cancel=%d " 1114 "freq=%u channel_type=%u duration=%u cookie=0x%llx (%s))", 1115 cancel_event, freq, chan_type, duration, 1116 (long long unsigned int) cookie, 1117 cookie == drv->remain_on_chan_cookie ? "match" : "unknown"); 1118 1119 if (cookie != drv->remain_on_chan_cookie) 1120 return; /* not for us */ 1121 1122 drv->pending_remain_on_chan = !cancel_event; 1123 1124 os_memset(&data, 0, sizeof(data)); 1125 data.remain_on_channel.freq = freq; 1126 data.remain_on_channel.duration = duration; 1127 wpa_supplicant_event(drv->ctx, cancel_event ? 1128 EVENT_CANCEL_REMAIN_ON_CHANNEL : 1129 EVENT_REMAIN_ON_CHANNEL, &data); 1130} 1131 1132 1133static void send_scan_event(struct wpa_driver_nl80211_data *drv, int aborted, 1134 struct nlattr *tb[]) 1135{ 1136 union wpa_event_data event; 1137 struct nlattr *nl; 1138 int rem; 1139 struct scan_info *info; 1140#define MAX_REPORT_FREQS 50 1141 int freqs[MAX_REPORT_FREQS]; 1142 int num_freqs = 0; 1143 1144 os_memset(&event, 0, sizeof(event)); 1145 info = &event.scan_info; 1146 info->aborted = aborted; 1147 1148 if (tb[NL80211_ATTR_SCAN_SSIDS]) { 1149 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_SSIDS], rem) { 1150 struct wpa_driver_scan_ssid *s = 1151 &info->ssids[info->num_ssids]; 1152 s->ssid = nla_data(nl); 1153 s->ssid_len = nla_len(nl); 1154 info->num_ssids++; 1155 if (info->num_ssids == WPAS_MAX_SCAN_SSIDS) 1156 break; 1157 } 1158 } 1159 if (tb[NL80211_ATTR_SCAN_FREQUENCIES]) { 1160 nla_for_each_nested(nl, tb[NL80211_ATTR_SCAN_FREQUENCIES], rem) 1161 { 1162 freqs[num_freqs] = nla_get_u32(nl); 1163 num_freqs++; 1164 if (num_freqs == MAX_REPORT_FREQS - 1) 1165 break; 1166 } 1167 info->freqs = freqs; 1168 info->num_freqs = num_freqs; 1169 } 1170 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, &event); 1171} 1172 1173 1174static int get_link_signal(struct nl_msg *msg, void *arg) 1175{ 1176 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 1177 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1178 struct nlattr *sinfo[NL80211_STA_INFO_MAX + 1]; 1179 static struct nla_policy policy[NL80211_STA_INFO_MAX + 1] = { 1180 [NL80211_STA_INFO_SIGNAL] = { .type = NLA_U8 }, 1181 }; 1182 struct nlattr *rinfo[NL80211_RATE_INFO_MAX + 1]; 1183 static struct nla_policy rate_policy[NL80211_RATE_INFO_MAX + 1] = { 1184 [NL80211_RATE_INFO_BITRATE] = { .type = NLA_U16 }, 1185 [NL80211_RATE_INFO_MCS] = { .type = NLA_U8 }, 1186 [NL80211_RATE_INFO_40_MHZ_WIDTH] = { .type = NLA_FLAG }, 1187 [NL80211_RATE_INFO_SHORT_GI] = { .type = NLA_FLAG }, 1188 }; 1189 struct wpa_signal_info *sig_change = arg; 1190 1191 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1192 genlmsg_attrlen(gnlh, 0), NULL); 1193 if (!tb[NL80211_ATTR_STA_INFO] || 1194 nla_parse_nested(sinfo, NL80211_STA_INFO_MAX, 1195 tb[NL80211_ATTR_STA_INFO], policy)) 1196 return NL_SKIP; 1197 if (!sinfo[NL80211_STA_INFO_SIGNAL]) 1198 return NL_SKIP; 1199 1200 sig_change->current_signal = 1201 (s8) nla_get_u8(sinfo[NL80211_STA_INFO_SIGNAL]); 1202 1203 if (sinfo[NL80211_STA_INFO_TX_BITRATE]) { 1204 if (nla_parse_nested(rinfo, NL80211_RATE_INFO_MAX, 1205 sinfo[NL80211_STA_INFO_TX_BITRATE], 1206 rate_policy)) { 1207 sig_change->current_txrate = 0; 1208 } else { 1209 if (rinfo[NL80211_RATE_INFO_BITRATE]) { 1210 sig_change->current_txrate = 1211 nla_get_u16(rinfo[ 1212 NL80211_RATE_INFO_BITRATE]) * 100; 1213 } 1214 } 1215 } 1216 1217 return NL_SKIP; 1218} 1219 1220 1221static int nl80211_get_link_signal(struct wpa_driver_nl80211_data *drv, 1222 struct wpa_signal_info *sig) 1223{ 1224 struct nl_msg *msg; 1225 1226 sig->current_signal = -9999; 1227 sig->current_txrate = 0; 1228 1229 msg = nlmsg_alloc(); 1230 if (!msg) 1231 return -ENOMEM; 1232 1233 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 1234 0, NL80211_CMD_GET_STATION, 0); 1235 1236 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 1237 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid); 1238 1239 return send_and_recv_msgs(drv, msg, get_link_signal, sig); 1240 nla_put_failure: 1241 return -ENOBUFS; 1242} 1243 1244 1245static int get_link_noise(struct nl_msg *msg, void *arg) 1246{ 1247 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 1248 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1249 struct nlattr *sinfo[NL80211_SURVEY_INFO_MAX + 1]; 1250 static struct nla_policy survey_policy[NL80211_SURVEY_INFO_MAX + 1] = { 1251 [NL80211_SURVEY_INFO_FREQUENCY] = { .type = NLA_U32 }, 1252 [NL80211_SURVEY_INFO_NOISE] = { .type = NLA_U8 }, 1253 }; 1254 struct wpa_signal_info *sig_change = arg; 1255 1256 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1257 genlmsg_attrlen(gnlh, 0), NULL); 1258 1259 if (!tb[NL80211_ATTR_SURVEY_INFO]) { 1260 wpa_printf(MSG_DEBUG, "nl80211: survey data missing!"); 1261 return NL_SKIP; 1262 } 1263 1264 if (nla_parse_nested(sinfo, NL80211_SURVEY_INFO_MAX, 1265 tb[NL80211_ATTR_SURVEY_INFO], 1266 survey_policy)) { 1267 wpa_printf(MSG_DEBUG, "nl80211: failed to parse nested " 1268 "attributes!"); 1269 return NL_SKIP; 1270 } 1271 1272 if (!sinfo[NL80211_SURVEY_INFO_FREQUENCY]) 1273 return NL_SKIP; 1274 1275 if (nla_get_u32(sinfo[NL80211_SURVEY_INFO_FREQUENCY]) != 1276 sig_change->frequency) 1277 return NL_SKIP; 1278 1279 if (!sinfo[NL80211_SURVEY_INFO_NOISE]) 1280 return NL_SKIP; 1281 1282 sig_change->current_noise = 1283 (s8) nla_get_u8(sinfo[NL80211_SURVEY_INFO_NOISE]); 1284 1285 return NL_SKIP; 1286} 1287 1288 1289static int nl80211_get_link_noise(struct wpa_driver_nl80211_data *drv, 1290 struct wpa_signal_info *sig_change) 1291{ 1292 struct nl_msg *msg; 1293 1294 sig_change->current_noise = 9999; 1295 sig_change->frequency = drv->assoc_freq; 1296 1297 msg = nlmsg_alloc(); 1298 if (!msg) 1299 return -ENOMEM; 1300 1301 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 1302 NLM_F_DUMP, NL80211_CMD_GET_SURVEY, 0); 1303 1304 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 1305 1306 return send_and_recv_msgs(drv, msg, get_link_noise, sig_change); 1307 nla_put_failure: 1308 return -ENOBUFS; 1309} 1310 1311 1312static void nl80211_cqm_event(struct wpa_driver_nl80211_data *drv, 1313 struct nlattr *tb[]) 1314{ 1315 static struct nla_policy cqm_policy[NL80211_ATTR_CQM_MAX + 1] = { 1316 [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_U32 }, 1317 [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U8 }, 1318 [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 }, 1319 [NL80211_ATTR_CQM_PKT_LOSS_EVENT] = { .type = NLA_U32 }, 1320 }; 1321 struct nlattr *cqm[NL80211_ATTR_CQM_MAX + 1]; 1322 enum nl80211_cqm_rssi_threshold_event event; 1323 union wpa_event_data ed; 1324 struct wpa_signal_info sig; 1325 int res; 1326 1327 if (tb[NL80211_ATTR_CQM] == NULL || 1328 nla_parse_nested(cqm, NL80211_ATTR_CQM_MAX, tb[NL80211_ATTR_CQM], 1329 cqm_policy)) { 1330 wpa_printf(MSG_DEBUG, "nl80211: Ignore invalid CQM event"); 1331 return; 1332 } 1333 1334 os_memset(&ed, 0, sizeof(ed)); 1335 1336 if (cqm[NL80211_ATTR_CQM_PKT_LOSS_EVENT]) { 1337 if (!tb[NL80211_ATTR_MAC]) 1338 return; 1339 os_memcpy(ed.low_ack.addr, nla_data(tb[NL80211_ATTR_MAC]), 1340 ETH_ALEN); 1341 wpa_supplicant_event(drv->ctx, EVENT_STATION_LOW_ACK, &ed); 1342 return; 1343 } 1344 1345 if (cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] == NULL) 1346 return; 1347 event = nla_get_u32(cqm[NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT]); 1348 1349 if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH) { 1350 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor " 1351 "event: RSSI high"); 1352 ed.signal_change.above_threshold = 1; 1353 } else if (event == NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW) { 1354 wpa_printf(MSG_DEBUG, "nl80211: Connection quality monitor " 1355 "event: RSSI low"); 1356 ed.signal_change.above_threshold = 0; 1357 } else 1358 return; 1359 1360 res = nl80211_get_link_signal(drv, &sig); 1361 if (res == 0) { 1362 ed.signal_change.current_signal = sig.current_signal; 1363 ed.signal_change.current_txrate = sig.current_txrate; 1364 wpa_printf(MSG_DEBUG, "nl80211: Signal: %d dBm txrate: %d", 1365 sig.current_signal, sig.current_txrate); 1366 } 1367 1368 res = nl80211_get_link_noise(drv, &sig); 1369 if (res == 0) { 1370 ed.signal_change.current_noise = sig.current_noise; 1371 wpa_printf(MSG_DEBUG, "nl80211: Noise: %d dBm", 1372 sig.current_noise); 1373 } 1374 1375 wpa_supplicant_event(drv->ctx, EVENT_SIGNAL_CHANGE, &ed); 1376} 1377 1378 1379static void nl80211_new_station_event(struct wpa_driver_nl80211_data *drv, 1380 struct nlattr **tb) 1381{ 1382 u8 *addr; 1383 union wpa_event_data data; 1384 1385 if (tb[NL80211_ATTR_MAC] == NULL) 1386 return; 1387 addr = nla_data(tb[NL80211_ATTR_MAC]); 1388 wpa_printf(MSG_DEBUG, "nl80211: New station " MACSTR, MAC2STR(addr)); 1389 1390 if (drv->nlmode == NL80211_IFTYPE_AP && 1391 drv->no_monitor_iface_capab) { 1392 u8 *ies = NULL; 1393 size_t ies_len = 0; 1394 if (tb[NL80211_ATTR_IE]) { 1395 ies = nla_data(tb[NL80211_ATTR_IE]); 1396 ies_len = nla_len(tb[NL80211_ATTR_IE]); 1397 } 1398 wpa_hexdump(MSG_DEBUG, "nl80211: Assoc Req IEs", ies, ies_len); 1399 drv_event_assoc(drv->ctx, addr, ies, ies_len, 0); 1400 return; 1401 } 1402 1403 if (drv->nlmode != NL80211_IFTYPE_ADHOC) 1404 return; 1405 1406 os_memset(&data, 0, sizeof(data)); 1407 os_memcpy(data.ibss_rsn_start.peer, addr, ETH_ALEN); 1408 wpa_supplicant_event(drv->ctx, EVENT_IBSS_RSN_START, &data); 1409} 1410 1411 1412static void nl80211_del_station_event(struct wpa_driver_nl80211_data *drv, 1413 struct nlattr **tb) 1414{ 1415 u8 *addr; 1416 union wpa_event_data data; 1417 1418 if (tb[NL80211_ATTR_MAC] == NULL) 1419 return; 1420 addr = nla_data(tb[NL80211_ATTR_MAC]); 1421 wpa_printf(MSG_DEBUG, "nl80211: Delete station " MACSTR, 1422 MAC2STR(addr)); 1423 1424 if (drv->nlmode == NL80211_IFTYPE_AP && 1425 drv->no_monitor_iface_capab) { 1426 drv_event_disassoc(drv->ctx, addr); 1427 return; 1428 } 1429 1430 if (drv->nlmode != NL80211_IFTYPE_ADHOC) 1431 return; 1432 1433 os_memset(&data, 0, sizeof(data)); 1434 os_memcpy(data.ibss_peer_lost.peer, addr, ETH_ALEN); 1435 wpa_supplicant_event(drv->ctx, EVENT_IBSS_PEER_LOST, &data); 1436} 1437 1438 1439static int process_event(struct nl_msg *msg, void *arg) 1440{ 1441 struct wpa_driver_nl80211_data *drv = arg; 1442 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1443 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 1444 union wpa_event_data data; 1445 1446 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1447 genlmsg_attrlen(gnlh, 0), NULL); 1448 1449 if (tb[NL80211_ATTR_IFINDEX]) { 1450 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); 1451 if (ifindex != drv->ifindex && !have_ifidx(drv, ifindex)) { 1452 wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)" 1453 " for foreign interface (ifindex %d)", 1454 gnlh->cmd, ifindex); 1455 return NL_SKIP; 1456 } 1457 } 1458 1459 if (drv->ap_scan_as_station && 1460 (gnlh->cmd == NL80211_CMD_NEW_SCAN_RESULTS || 1461 gnlh->cmd == NL80211_CMD_SCAN_ABORTED)) { 1462 wpa_driver_nl80211_set_mode(&drv->first_bss, 1463 IEEE80211_MODE_AP); 1464 drv->ap_scan_as_station = 0; 1465 } 1466 1467 switch (gnlh->cmd) { 1468 case NL80211_CMD_TRIGGER_SCAN: 1469 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger"); 1470 break; 1471 case NL80211_CMD_NEW_SCAN_RESULTS: 1472 wpa_printf(MSG_DEBUG, "nl80211: New scan results available"); 1473 drv->scan_complete_events = 1; 1474 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, 1475 drv->ctx); 1476 send_scan_event(drv, 0, tb); 1477 break; 1478 case NL80211_CMD_SCAN_ABORTED: 1479 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted"); 1480 /* 1481 * Need to indicate that scan results are available in order 1482 * not to make wpa_supplicant stop its scanning. 1483 */ 1484 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, 1485 drv->ctx); 1486 send_scan_event(drv, 1, tb); 1487 break; 1488 case NL80211_CMD_AUTHENTICATE: 1489 case NL80211_CMD_ASSOCIATE: 1490 case NL80211_CMD_DEAUTHENTICATE: 1491 case NL80211_CMD_DISASSOCIATE: 1492 case NL80211_CMD_FRAME: 1493 case NL80211_CMD_FRAME_TX_STATUS: 1494 case NL80211_CMD_UNPROT_DEAUTHENTICATE: 1495 case NL80211_CMD_UNPROT_DISASSOCIATE: 1496 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME], 1497 tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT], 1498 tb[NL80211_ATTR_WIPHY_FREQ], tb[NL80211_ATTR_ACK], 1499 tb[NL80211_ATTR_COOKIE]); 1500 break; 1501 case NL80211_CMD_CONNECT: 1502 case NL80211_CMD_ROAM: 1503 mlme_event_connect(drv, gnlh->cmd, 1504 tb[NL80211_ATTR_STATUS_CODE], 1505 tb[NL80211_ATTR_MAC], 1506 tb[NL80211_ATTR_REQ_IE], 1507 tb[NL80211_ATTR_RESP_IE]); 1508 break; 1509 case NL80211_CMD_DISCONNECT: 1510 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { 1511 /* 1512 * Avoid reporting two disassociation events that could 1513 * confuse the core code. 1514 */ 1515 wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect " 1516 "event when using userspace SME"); 1517 break; 1518 } 1519 drv->associated = 0; 1520 os_memset(&data, 0, sizeof(data)); 1521 if (tb[NL80211_ATTR_REASON_CODE]) { 1522 data.disassoc_info.reason_code = 1523 nla_get_u16(tb[NL80211_ATTR_REASON_CODE]); 1524#ifdef ANDROID 1525 if (data.disassoc_info.reason_code == WLAN_REASON_UNSPECIFIED) 1526 wpa_msg(drv->ctx, MSG_INFO, 1527 WPA_EVENT_DRIVER_STATE "HANGED"); 1528#endif 1529 } 1530 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, &data); 1531 break; 1532 case NL80211_CMD_MICHAEL_MIC_FAILURE: 1533 mlme_event_michael_mic_failure(drv, tb); 1534 break; 1535 case NL80211_CMD_JOIN_IBSS: 1536 mlme_event_join_ibss(drv, tb); 1537 break; 1538 case NL80211_CMD_REMAIN_ON_CHANNEL: 1539 mlme_event_remain_on_channel(drv, 0, tb); 1540 break; 1541 case NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL: 1542 mlme_event_remain_on_channel(drv, 1, tb); 1543 break; 1544 case NL80211_CMD_NOTIFY_CQM: 1545 nl80211_cqm_event(drv, tb); 1546 break; 1547 case NL80211_CMD_REG_CHANGE: 1548 wpa_printf(MSG_DEBUG, "nl80211: Regulatory domain change"); 1549 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, 1550 NULL); 1551 break; 1552 case NL80211_CMD_REG_BEACON_HINT: 1553 wpa_printf(MSG_DEBUG, "nl80211: Regulatory beacon hint"); 1554 wpa_supplicant_event(drv->ctx, EVENT_CHANNEL_LIST_CHANGED, 1555 NULL); 1556 break; 1557 case NL80211_CMD_NEW_STATION: 1558 nl80211_new_station_event(drv, tb); 1559 break; 1560 case NL80211_CMD_DEL_STATION: 1561 nl80211_del_station_event(drv, tb); 1562 break; 1563 default: 1564 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event " 1565 "(cmd=%d)", gnlh->cmd); 1566 break; 1567 } 1568 1569 return NL_SKIP; 1570} 1571 1572 1573static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx, 1574 void *handle) 1575{ 1576 struct nl_cb *cb; 1577 struct wpa_driver_nl80211_data *drv = eloop_ctx; 1578 1579 wpa_printf(MSG_DEBUG, "nl80211: Event message available"); 1580 1581 cb = nl_cb_clone(drv->nl_cb); 1582 if (!cb) 1583 return; 1584 nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL); 1585 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv); 1586 nl_recvmsgs(handle, cb); 1587 nl_cb_put(cb); 1588} 1589 1590 1591/** 1592 * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain 1593 * @priv: driver_nl80211 private data 1594 * @alpha2_arg: country to which to switch to 1595 * Returns: 0 on success, -1 on failure 1596 * 1597 * This asks nl80211 to set the regulatory domain for given 1598 * country ISO / IEC alpha2. 1599 */ 1600static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg) 1601{ 1602 struct i802_bss *bss = priv; 1603 struct wpa_driver_nl80211_data *drv = bss->drv; 1604 char alpha2[3]; 1605 struct nl_msg *msg; 1606 1607 msg = nlmsg_alloc(); 1608 if (!msg) 1609 return -ENOMEM; 1610 1611 alpha2[0] = alpha2_arg[0]; 1612 alpha2[1] = alpha2_arg[1]; 1613 alpha2[2] = '\0'; 1614 1615 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 1616 0, NL80211_CMD_REQ_SET_REG, 0); 1617 1618 NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2); 1619 if (send_and_recv_msgs(drv, msg, NULL, NULL)) 1620 return -EINVAL; 1621 return 0; 1622nla_put_failure: 1623 return -EINVAL; 1624} 1625 1626 1627struct wiphy_info_data { 1628 int max_scan_ssids; 1629 int ap_supported; 1630 int p2p_supported; 1631 int auth_supported; 1632 int connect_supported; 1633 int offchan_tx_supported; 1634 int max_remain_on_chan; 1635}; 1636 1637 1638static int wiphy_info_handler(struct nl_msg *msg, void *arg) 1639{ 1640 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 1641 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 1642 struct wiphy_info_data *info = arg; 1643 int p2p_go_supported = 0, p2p_client_supported = 0; 1644 1645 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 1646 genlmsg_attrlen(gnlh, 0), NULL); 1647 1648 if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]) 1649 info->max_scan_ssids = 1650 nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]); 1651 1652 if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) { 1653 struct nlattr *nl_mode; 1654 int i; 1655 nla_for_each_nested(nl_mode, 1656 tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) { 1657 switch (nla_type(nl_mode)) { 1658 case NL80211_IFTYPE_AP: 1659 info->ap_supported = 1; 1660 break; 1661 case NL80211_IFTYPE_P2P_GO: 1662 p2p_go_supported = 1; 1663 break; 1664 case NL80211_IFTYPE_P2P_CLIENT: 1665 p2p_client_supported = 1; 1666 break; 1667 } 1668 } 1669 } 1670 1671 info->p2p_supported = p2p_go_supported && p2p_client_supported; 1672 1673 if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) { 1674 struct nlattr *nl_cmd; 1675 int i; 1676 1677 nla_for_each_nested(nl_cmd, 1678 tb[NL80211_ATTR_SUPPORTED_COMMANDS], i) { 1679 u32 cmd = nla_get_u32(nl_cmd); 1680 if (cmd == NL80211_CMD_AUTHENTICATE) 1681 info->auth_supported = 1; 1682 else if (cmd == NL80211_CMD_CONNECT) 1683 info->connect_supported = 1; 1684 } 1685 } 1686 1687 if (tb[NL80211_ATTR_OFFCHANNEL_TX_OK]) 1688 info->offchan_tx_supported = 1; 1689 1690 if (tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]) 1691 info->max_remain_on_chan = 1692 nla_get_u32(tb[NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION]); 1693 1694 return NL_SKIP; 1695} 1696 1697 1698static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv, 1699 struct wiphy_info_data *info) 1700{ 1701 struct nl_msg *msg; 1702 1703 os_memset(info, 0, sizeof(*info)); 1704 1705 /* default to 5000 since early versions of mac80211 don't set it */ 1706 info->max_remain_on_chan = 5000; 1707 1708 msg = nlmsg_alloc(); 1709 if (!msg) 1710 return -1; 1711 1712 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 1713 0, NL80211_CMD_GET_WIPHY, 0); 1714 1715 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->first_bss.ifindex); 1716 1717 if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0) 1718 return 0; 1719 msg = NULL; 1720nla_put_failure: 1721 nlmsg_free(msg); 1722 return -1; 1723} 1724 1725 1726static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv) 1727{ 1728 struct wiphy_info_data info; 1729 if (wpa_driver_nl80211_get_info(drv, &info)) 1730 return -1; 1731 drv->has_capability = 1; 1732 /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */ 1733 drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA | 1734 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK | 1735 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 | 1736 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK; 1737 drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 | 1738 WPA_DRIVER_CAPA_ENC_WEP104 | 1739 WPA_DRIVER_CAPA_ENC_TKIP | 1740 WPA_DRIVER_CAPA_ENC_CCMP; 1741 drv->capa.auth = WPA_DRIVER_AUTH_OPEN | 1742 WPA_DRIVER_AUTH_SHARED | 1743 WPA_DRIVER_AUTH_LEAP; 1744 1745 drv->capa.max_scan_ssids = info.max_scan_ssids; 1746 if (info.ap_supported) 1747 drv->capa.flags |= WPA_DRIVER_FLAGS_AP; 1748 1749 if (info.auth_supported) 1750 drv->capa.flags |= WPA_DRIVER_FLAGS_SME; 1751 else if (!info.connect_supported) { 1752 wpa_printf(MSG_INFO, "nl80211: Driver does not support " 1753 "authentication/association or connect commands"); 1754 return -1; 1755 } 1756 1757 if (info.offchan_tx_supported) { 1758 wpa_printf(MSG_DEBUG, "nl80211: Using driver-based " 1759 "off-channel TX"); 1760 drv->capa.flags |= WPA_DRIVER_FLAGS_OFFCHANNEL_TX; 1761 } 1762 1763 drv->capa.flags |= WPA_DRIVER_FLAGS_SANE_ERROR_CODES; 1764 drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE; 1765 if (info.p2p_supported) 1766 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CAPABLE; 1767 drv->capa.flags |= WPA_DRIVER_FLAGS_EAPOL_TX_STATUS; 1768 drv->capa.max_remain_on_chan = info.max_remain_on_chan; 1769 1770 return 0; 1771} 1772 1773 1774static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv) 1775{ 1776 int ret; 1777 1778 /* Initialize generic netlink and nl80211 */ 1779 1780 drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT); 1781 if (drv->nl_cb == NULL) { 1782 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " 1783 "callbacks"); 1784 goto err1; 1785 } 1786 1787 drv->nl_handle = nl80211_handle_alloc(drv->nl_cb); 1788 if (drv->nl_handle == NULL) { 1789 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " 1790 "callbacks"); 1791 goto err2; 1792 } 1793 1794 drv->nl_handle_event = nl80211_handle_alloc(drv->nl_cb); 1795 if (drv->nl_handle_event == NULL) { 1796 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " 1797 "callbacks (event)"); 1798 goto err2b; 1799 } 1800 1801 if (genl_connect(drv->nl_handle)) { 1802 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic " 1803 "netlink"); 1804 goto err3; 1805 } 1806 1807 if (genl_connect(drv->nl_handle_event)) { 1808 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic " 1809 "netlink (event)"); 1810 goto err3; 1811 } 1812 1813#ifdef CONFIG_LIBNL20 1814 if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) { 1815 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 1816 "netlink cache"); 1817 goto err3; 1818 } 1819 if (genl_ctrl_alloc_cache(drv->nl_handle_event, &drv->nl_cache_event) < 1820 0) { 1821 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 1822 "netlink cache (event)"); 1823 goto err3b; 1824 } 1825#else /* CONFIG_LIBNL20 */ 1826 drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle); 1827 if (drv->nl_cache == NULL) { 1828 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 1829 "netlink cache"); 1830 goto err3; 1831 } 1832 drv->nl_cache_event = genl_ctrl_alloc_cache(drv->nl_handle_event); 1833 if (drv->nl_cache_event == NULL) { 1834 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 1835 "netlink cache (event)"); 1836 goto err3b; 1837 } 1838#endif /* CONFIG_LIBNL20 */ 1839 1840 drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211"); 1841 if (drv->nl80211 == NULL) { 1842 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not " 1843 "found"); 1844 goto err4; 1845 } 1846 1847 ret = nl_get_multicast_id(drv, "nl80211", "scan"); 1848 if (ret >= 0) 1849 ret = nl_socket_add_membership(drv->nl_handle_event, ret); 1850 if (ret < 0) { 1851 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast " 1852 "membership for scan events: %d (%s)", 1853 ret, strerror(-ret)); 1854 goto err4; 1855 } 1856 1857 ret = nl_get_multicast_id(drv, "nl80211", "mlme"); 1858 if (ret >= 0) 1859 ret = nl_socket_add_membership(drv->nl_handle_event, ret); 1860 if (ret < 0) { 1861 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast " 1862 "membership for mlme events: %d (%s)", 1863 ret, strerror(-ret)); 1864 goto err4; 1865 } 1866 1867 ret = nl_get_multicast_id(drv, "nl80211", "regulatory"); 1868 if (ret >= 0) 1869 ret = nl_socket_add_membership(drv->nl_handle_event, ret); 1870 if (ret < 0) { 1871 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast " 1872 "membership for regulatory events: %d (%s)", 1873 ret, strerror(-ret)); 1874 /* Continue without regulatory events */ 1875 } 1876 1877 eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_event), 1878 wpa_driver_nl80211_event_receive, drv, 1879 drv->nl_handle_event); 1880 1881 return 0; 1882 1883err4: 1884 nl_cache_free(drv->nl_cache_event); 1885err3b: 1886 nl_cache_free(drv->nl_cache); 1887err3: 1888 nl80211_handle_destroy(drv->nl_handle_event); 1889err2b: 1890 nl80211_handle_destroy(drv->nl_handle); 1891err2: 1892 nl_cb_put(drv->nl_cb); 1893err1: 1894 return -1; 1895} 1896 1897 1898static void wpa_driver_nl80211_rfkill_blocked(void *ctx) 1899{ 1900 wpa_printf(MSG_DEBUG, "nl80211: RFKILL blocked"); 1901 /* 1902 * This may be for any interface; use ifdown event to disable 1903 * interface. 1904 */ 1905} 1906 1907 1908static void wpa_driver_nl80211_rfkill_unblocked(void *ctx) 1909{ 1910 struct wpa_driver_nl80211_data *drv = ctx; 1911 wpa_printf(MSG_DEBUG, "nl80211: RFKILL unblocked"); 1912 if (linux_set_iface_flags(drv->ioctl_sock, drv->first_bss.ifname, 1)) { 1913 wpa_printf(MSG_DEBUG, "nl80211: Could not set interface UP " 1914 "after rfkill unblock"); 1915 return; 1916 } 1917 /* rtnetlink ifup handler will report interface as enabled */ 1918} 1919 1920 1921static void nl80211_get_phy_name(struct wpa_driver_nl80211_data *drv) 1922{ 1923 /* Find phy (radio) to which this interface belongs */ 1924 char buf[90], *pos; 1925 int f, rv; 1926 1927 drv->phyname[0] = '\0'; 1928 snprintf(buf, sizeof(buf) - 1, "/sys/class/net/%s/phy80211/name", 1929 drv->first_bss.ifname); 1930 f = open(buf, O_RDONLY); 1931 if (f < 0) { 1932 wpa_printf(MSG_DEBUG, "Could not open file %s: %s", 1933 buf, strerror(errno)); 1934 return; 1935 } 1936 1937 rv = read(f, drv->phyname, sizeof(drv->phyname) - 1); 1938 close(f); 1939 if (rv < 0) { 1940 wpa_printf(MSG_DEBUG, "Could not read file %s: %s", 1941 buf, strerror(errno)); 1942 return; 1943 } 1944 1945 drv->phyname[rv] = '\0'; 1946 pos = os_strchr(drv->phyname, '\n'); 1947 if (pos) 1948 *pos = '\0'; 1949 wpa_printf(MSG_DEBUG, "nl80211: interface %s in phy %s", 1950 drv->first_bss.ifname, drv->phyname); 1951} 1952 1953 1954/** 1955 * wpa_driver_nl80211_init - Initialize nl80211 driver interface 1956 * @ctx: context to be used when calling wpa_supplicant functions, 1957 * e.g., wpa_supplicant_event() 1958 * @ifname: interface name, e.g., wlan0 1959 * @global_priv: private driver global data from global_init() 1960 * Returns: Pointer to private data, %NULL on failure 1961 */ 1962static void * wpa_driver_nl80211_init(void *ctx, const char *ifname, 1963 void *global_priv) 1964{ 1965 struct wpa_driver_nl80211_data *drv; 1966 struct netlink_config *cfg; 1967 struct rfkill_config *rcfg; 1968 struct i802_bss *bss; 1969 1970 drv = os_zalloc(sizeof(*drv)); 1971 if (drv == NULL) 1972 return NULL; 1973 drv->global = global_priv; 1974 drv->ctx = ctx; 1975 bss = &drv->first_bss; 1976 bss->drv = drv; 1977 os_strlcpy(bss->ifname, ifname, sizeof(bss->ifname)); 1978 drv->monitor_ifidx = -1; 1979 drv->monitor_sock = -1; 1980 drv->ioctl_sock = -1; 1981 1982 if (wpa_driver_nl80211_init_nl(drv)) { 1983 os_free(drv); 1984 return NULL; 1985 } 1986 1987 nl80211_get_phy_name(drv); 1988 1989 drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0); 1990 if (drv->ioctl_sock < 0) { 1991 perror("socket(PF_INET,SOCK_DGRAM)"); 1992 goto failed; 1993 } 1994 1995 cfg = os_zalloc(sizeof(*cfg)); 1996 if (cfg == NULL) 1997 goto failed; 1998 cfg->ctx = drv; 1999 cfg->newlink_cb = wpa_driver_nl80211_event_rtm_newlink; 2000 cfg->dellink_cb = wpa_driver_nl80211_event_rtm_dellink; 2001 drv->netlink = netlink_init(cfg); 2002 if (drv->netlink == NULL) { 2003 os_free(cfg); 2004 goto failed; 2005 } 2006 2007 rcfg = os_zalloc(sizeof(*rcfg)); 2008 if (rcfg == NULL) 2009 goto failed; 2010 rcfg->ctx = drv; 2011 os_strlcpy(rcfg->ifname, ifname, sizeof(rcfg->ifname)); 2012 rcfg->blocked_cb = wpa_driver_nl80211_rfkill_blocked; 2013 rcfg->unblocked_cb = wpa_driver_nl80211_rfkill_unblocked; 2014 drv->rfkill = rfkill_init(rcfg); 2015 if (drv->rfkill == NULL) { 2016 wpa_printf(MSG_DEBUG, "nl80211: RFKILL status not available"); 2017 os_free(rcfg); 2018 } 2019 2020 if (wpa_driver_nl80211_finish_drv_init(drv)) 2021 goto failed; 2022 2023 if (drv->global) 2024 dl_list_add(&drv->global->interfaces, &drv->list); 2025 2026 return bss; 2027 2028failed: 2029 rfkill_deinit(drv->rfkill); 2030 netlink_deinit(drv->netlink); 2031 if (drv->ioctl_sock >= 0) 2032 close(drv->ioctl_sock); 2033 2034 genl_family_put(drv->nl80211); 2035 nl_cache_free(drv->nl_cache); 2036 nl80211_handle_destroy(drv->nl_handle); 2037 nl_cb_put(drv->nl_cb); 2038 eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event)); 2039 2040 os_free(drv); 2041 return NULL; 2042} 2043 2044 2045static int nl80211_register_frame(struct wpa_driver_nl80211_data *drv, 2046 struct nl_handle *nl_handle, 2047 u16 type, const u8 *match, size_t match_len) 2048{ 2049 struct nl_msg *msg; 2050 int ret = -1; 2051 2052 msg = nlmsg_alloc(); 2053 if (!msg) 2054 return -1; 2055 2056 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 2057 NL80211_CMD_REGISTER_ACTION, 0); 2058 2059 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 2060 NLA_PUT_U16(msg, NL80211_ATTR_FRAME_TYPE, type); 2061 NLA_PUT(msg, NL80211_ATTR_FRAME_MATCH, match_len, match); 2062 2063 ret = send_and_recv(drv, nl_handle, msg, NULL, NULL); 2064 msg = NULL; 2065 if (ret) { 2066 wpa_printf(MSG_DEBUG, "nl80211: Register frame command " 2067 "failed (type=%u): ret=%d (%s)", 2068 type, ret, strerror(-ret)); 2069 wpa_hexdump(MSG_DEBUG, "nl80211: Register frame match", 2070 match, match_len); 2071 goto nla_put_failure; 2072 } 2073 ret = 0; 2074nla_put_failure: 2075 nlmsg_free(msg); 2076 return ret; 2077} 2078 2079 2080static int nl80211_register_action_frame(struct wpa_driver_nl80211_data *drv, 2081 const u8 *match, size_t match_len) 2082{ 2083 u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_ACTION << 4); 2084 return nl80211_register_frame(drv, drv->nl_handle_event, 2085 type, match, match_len); 2086} 2087 2088 2089static int nl80211_register_action_frames(struct wpa_driver_nl80211_data *drv) 2090{ 2091#ifdef CONFIG_P2P 2092 /* GAS Initial Request */ 2093 if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0a", 2) < 0) 2094 return -1; 2095 /* GAS Initial Response */ 2096 if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0b", 2) < 0) 2097 return -1; 2098 /* GAS Comeback Request */ 2099 if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0c", 2) < 0) 2100 return -1; 2101 /* GAS Comeback Response */ 2102 if (nl80211_register_action_frame(drv, (u8 *) "\x04\x0d", 2) < 0) 2103 return -1; 2104 /* P2P Public Action */ 2105 if (nl80211_register_action_frame(drv, 2106 (u8 *) "\x04\x09\x50\x6f\x9a\x09", 2107 6) < 0) 2108 return -1; 2109 /* P2P Action */ 2110 if (nl80211_register_action_frame(drv, 2111 (u8 *) "\x7f\x50\x6f\x9a\x09", 2112 5) < 0) 2113 return -1; 2114#endif /* CONFIG_P2P */ 2115#ifdef CONFIG_IEEE80211W 2116 /* SA Query Response */ 2117 if (nl80211_register_action_frame(drv, (u8 *) "\x08\x01", 2) < 0) 2118 return -1; 2119#endif /* CONFIG_IEEE80211W */ 2120 2121 /* FT Action frames */ 2122 if (nl80211_register_action_frame(drv, (u8 *) "\x06", 1) < 0) 2123 return -1; 2124 else 2125 drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_FT | 2126 WPA_DRIVER_CAPA_KEY_MGMT_FT_PSK; 2127 2128 return 0; 2129} 2130 2131 2132static void wpa_driver_nl80211_send_rfkill(void *eloop_ctx, void *timeout_ctx) 2133{ 2134 wpa_supplicant_event(timeout_ctx, EVENT_INTERFACE_DISABLED, NULL); 2135} 2136 2137 2138static int 2139wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv) 2140{ 2141 struct i802_bss *bss = &drv->first_bss; 2142 int send_rfkill_event = 0; 2143 2144 drv->ifindex = if_nametoindex(bss->ifname); 2145 drv->first_bss.ifindex = drv->ifindex; 2146 2147#ifndef HOSTAPD 2148 if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA) < 0) { 2149 wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to " 2150 "use managed mode"); 2151 } 2152 2153 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) { 2154 if (rfkill_is_blocked(drv->rfkill)) { 2155 wpa_printf(MSG_DEBUG, "nl80211: Could not yet enable " 2156 "interface '%s' due to rfkill", 2157 bss->ifname); 2158 drv->if_disabled = 1; 2159 send_rfkill_event = 1; 2160 } else { 2161 wpa_printf(MSG_ERROR, "nl80211: Could not set " 2162 "interface '%s' UP", bss->ifname); 2163 return -1; 2164 } 2165 } 2166 2167 netlink_send_oper_ifla(drv->netlink, drv->ifindex, 2168 1, IF_OPER_DORMANT); 2169#endif /* HOSTAPD */ 2170 2171 if (wpa_driver_nl80211_capa(drv)) 2172 return -1; 2173 2174 if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, drv->addr)) 2175 return -1; 2176 2177 if (nl80211_register_action_frames(drv) < 0) { 2178 wpa_printf(MSG_DEBUG, "nl80211: Failed to register Action " 2179 "frame processing - ignore for now"); 2180 /* 2181 * Older kernel versions did not support this, so ignore the 2182 * error for now. Some functionality may not be available 2183 * because of this. 2184 */ 2185 } 2186 2187 if (send_rfkill_event) { 2188 eloop_register_timeout(0, 0, wpa_driver_nl80211_send_rfkill, 2189 drv, drv->ctx); 2190 } 2191 2192 return 0; 2193} 2194 2195 2196static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv) 2197{ 2198 struct nl_msg *msg; 2199 2200 msg = nlmsg_alloc(); 2201 if (!msg) 2202 return -ENOMEM; 2203 2204 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 2205 0, NL80211_CMD_DEL_BEACON, 0); 2206 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 2207 2208 return send_and_recv_msgs(drv, msg, NULL, NULL); 2209 nla_put_failure: 2210 return -ENOBUFS; 2211} 2212 2213 2214/** 2215 * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface 2216 * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init() 2217 * 2218 * Shut down driver interface and processing of driver events. Free 2219 * private data buffer if one was allocated in wpa_driver_nl80211_init(). 2220 */ 2221static void wpa_driver_nl80211_deinit(void *priv) 2222{ 2223 struct i802_bss *bss = priv; 2224 struct wpa_driver_nl80211_data *drv = bss->drv; 2225 2226 if (drv->nl_handle_preq) 2227 wpa_driver_nl80211_probe_req_report(bss, 0); 2228 if (bss->added_if_into_bridge) { 2229 if (linux_br_del_if(drv->ioctl_sock, bss->brname, bss->ifname) 2230 < 0) 2231 wpa_printf(MSG_INFO, "nl80211: Failed to remove " 2232 "interface %s from bridge %s: %s", 2233 bss->ifname, bss->brname, strerror(errno)); 2234 } 2235 if (bss->added_bridge) { 2236 if (linux_br_del(drv->ioctl_sock, bss->brname) < 0) 2237 wpa_printf(MSG_INFO, "nl80211: Failed to remove " 2238 "bridge %s: %s", 2239 bss->brname, strerror(errno)); 2240 } 2241 2242 nl80211_remove_monitor_interface(drv); 2243 2244 if (drv->nlmode == NL80211_IFTYPE_AP) 2245 wpa_driver_nl80211_del_beacon(drv); 2246 2247#ifdef HOSTAPD 2248 if (drv->last_freq_ht) { 2249 /* Clear HT flags from the driver */ 2250 struct hostapd_freq_params freq; 2251 os_memset(&freq, 0, sizeof(freq)); 2252 freq.freq = drv->last_freq; 2253 i802_set_freq(priv, &freq); 2254 } 2255 2256 if (drv->eapol_sock >= 0) { 2257 eloop_unregister_read_sock(drv->eapol_sock); 2258 close(drv->eapol_sock); 2259 } 2260 2261 if (drv->if_indices != drv->default_if_indices) 2262 os_free(drv->if_indices); 2263#endif /* HOSTAPD */ 2264 2265 if (drv->disable_11b_rates) 2266 nl80211_disable_11b_rates(drv, drv->ifindex, 0); 2267 2268 netlink_send_oper_ifla(drv->netlink, drv->ifindex, 0, IF_OPER_UP); 2269 netlink_deinit(drv->netlink); 2270 rfkill_deinit(drv->rfkill); 2271 2272 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); 2273 2274 (void) linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0); 2275 wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_INFRA); 2276 2277 if (drv->ioctl_sock >= 0) 2278 close(drv->ioctl_sock); 2279 2280 eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event)); 2281 genl_family_put(drv->nl80211); 2282 nl_cache_free(drv->nl_cache); 2283 nl_cache_free(drv->nl_cache_event); 2284 nl80211_handle_destroy(drv->nl_handle); 2285 nl80211_handle_destroy(drv->nl_handle_event); 2286 nl_cb_put(drv->nl_cb); 2287 2288 os_free(drv->filter_ssids); 2289 2290 if (drv->global) 2291 dl_list_del(&drv->list); 2292 2293 os_free(drv); 2294} 2295 2296 2297/** 2298 * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion 2299 * @eloop_ctx: Driver private data 2300 * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init() 2301 * 2302 * This function can be used as registered timeout when starting a scan to 2303 * generate a scan completed event if the driver does not report this. 2304 */ 2305static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx) 2306{ 2307 struct wpa_driver_nl80211_data *drv = eloop_ctx; 2308 if (drv->ap_scan_as_station) { 2309 wpa_driver_nl80211_set_mode(&drv->first_bss, 2310 IEEE80211_MODE_AP); 2311 drv->ap_scan_as_station = 0; 2312 } 2313 wpa_printf(MSG_DEBUG, "Scan timeout - try to get results"); 2314 wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL); 2315} 2316 2317 2318/** 2319 * wpa_driver_nl80211_scan - Request the driver to initiate scan 2320 * @priv: Pointer to private driver data from wpa_driver_nl80211_init() 2321 * @params: Scan parameters 2322 * Returns: 0 on success, -1 on failure 2323 */ 2324static int wpa_driver_nl80211_scan(void *priv, 2325 struct wpa_driver_scan_params *params) 2326{ 2327 struct i802_bss *bss = priv; 2328 struct wpa_driver_nl80211_data *drv = bss->drv; 2329 int ret = 0, timeout; 2330 struct nl_msg *msg, *ssids, *freqs; 2331 size_t i; 2332 2333 msg = nlmsg_alloc(); 2334 ssids = nlmsg_alloc(); 2335 freqs = nlmsg_alloc(); 2336 if (!msg || !ssids || !freqs) { 2337 nlmsg_free(msg); 2338 nlmsg_free(ssids); 2339 nlmsg_free(freqs); 2340 return -1; 2341 } 2342 2343 os_free(drv->filter_ssids); 2344 drv->filter_ssids = params->filter_ssids; 2345 params->filter_ssids = NULL; 2346 drv->num_filter_ssids = params->num_filter_ssids; 2347 2348 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 2349 NL80211_CMD_TRIGGER_SCAN, 0); 2350 2351 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 2352 2353 for (i = 0; i < params->num_ssids; i++) { 2354 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan SSID", 2355 params->ssids[i].ssid, 2356 params->ssids[i].ssid_len); 2357 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len, 2358 params->ssids[i].ssid); 2359 } 2360 if (params->num_ssids) 2361 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids); 2362 2363 if (params->extra_ies) { 2364 wpa_hexdump_ascii(MSG_MSGDUMP, "nl80211: Scan extra IEs", 2365 params->extra_ies, params->extra_ies_len); 2366 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len, 2367 params->extra_ies); 2368 } 2369 2370 if (params->freqs) { 2371 for (i = 0; params->freqs[i]; i++) { 2372 wpa_printf(MSG_MSGDUMP, "nl80211: Scan frequency %u " 2373 "MHz", params->freqs[i]); 2374 NLA_PUT_U32(freqs, i + 1, params->freqs[i]); 2375 } 2376 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs); 2377 } 2378 2379 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 2380 msg = NULL; 2381 if (ret) { 2382 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d " 2383 "(%s)", ret, strerror(-ret)); 2384#ifdef HOSTAPD 2385 if (drv->nlmode == NL80211_IFTYPE_AP) { 2386 /* 2387 * mac80211 does not allow scan requests in AP mode, so 2388 * try to do this in station mode. 2389 */ 2390 if (wpa_driver_nl80211_set_mode(bss, 2391 IEEE80211_MODE_INFRA)) 2392 goto nla_put_failure; 2393 2394 if (wpa_driver_nl80211_scan(drv, params)) { 2395 wpa_driver_nl80211_set_mode(bss, 2396 IEEE80211_MODE_AP); 2397 goto nla_put_failure; 2398 } 2399 2400 /* Restore AP mode when processing scan results */ 2401 drv->ap_scan_as_station = 1; 2402 ret = 0; 2403 } else 2404 goto nla_put_failure; 2405#else /* HOSTAPD */ 2406 goto nla_put_failure; 2407#endif /* HOSTAPD */ 2408 } 2409 2410 /* Not all drivers generate "scan completed" wireless event, so try to 2411 * read results after a timeout. */ 2412 timeout = 10; 2413 if (drv->scan_complete_events) { 2414 /* 2415 * The driver seems to deliver events to notify when scan is 2416 * complete, so use longer timeout to avoid race conditions 2417 * with scanning and following association request. 2418 */ 2419 timeout = 30; 2420 } 2421 wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d " 2422 "seconds", ret, timeout); 2423 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); 2424 eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout, 2425 drv, drv->ctx); 2426 2427nla_put_failure: 2428 nlmsg_free(ssids); 2429 nlmsg_free(msg); 2430 nlmsg_free(freqs); 2431 return ret; 2432} 2433 2434 2435static const u8 * nl80211_get_ie(const u8 *ies, size_t ies_len, u8 ie) 2436{ 2437 const u8 *end, *pos; 2438 2439 if (ies == NULL) 2440 return NULL; 2441 2442 pos = ies; 2443 end = ies + ies_len; 2444 2445 while (pos + 1 < end) { 2446 if (pos + 2 + pos[1] > end) 2447 break; 2448 if (pos[0] == ie) 2449 return pos; 2450 pos += 2 + pos[1]; 2451 } 2452 2453 return NULL; 2454} 2455 2456 2457static int nl80211_scan_filtered(struct wpa_driver_nl80211_data *drv, 2458 const u8 *ie, size_t ie_len) 2459{ 2460 const u8 *ssid; 2461 size_t i; 2462 2463 if (drv->filter_ssids == NULL) 2464 return 0; 2465 2466 ssid = nl80211_get_ie(ie, ie_len, WLAN_EID_SSID); 2467 if (ssid == NULL) 2468 return 1; 2469 2470 for (i = 0; i < drv->num_filter_ssids; i++) { 2471 if (ssid[1] == drv->filter_ssids[i].ssid_len && 2472 os_memcmp(ssid + 2, drv->filter_ssids[i].ssid, ssid[1]) == 2473 0) 2474 return 0; 2475 } 2476 2477 return 1; 2478} 2479 2480 2481static int bss_info_handler(struct nl_msg *msg, void *arg) 2482{ 2483 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 2484 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 2485 struct nlattr *bss[NL80211_BSS_MAX + 1]; 2486 static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = { 2487 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC }, 2488 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 }, 2489 [NL80211_BSS_TSF] = { .type = NLA_U64 }, 2490 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 }, 2491 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 }, 2492 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC }, 2493 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 }, 2494 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 }, 2495 [NL80211_BSS_STATUS] = { .type = NLA_U32 }, 2496 [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 }, 2497 [NL80211_BSS_BEACON_IES] = { .type = NLA_UNSPEC }, 2498 }; 2499 struct nl80211_bss_info_arg *_arg = arg; 2500 struct wpa_scan_results *res = _arg->res; 2501 struct wpa_scan_res **tmp; 2502 struct wpa_scan_res *r; 2503 const u8 *ie, *beacon_ie; 2504 size_t ie_len, beacon_ie_len; 2505 u8 *pos; 2506 size_t i; 2507 2508 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 2509 genlmsg_attrlen(gnlh, 0), NULL); 2510 if (!tb[NL80211_ATTR_BSS]) 2511 return NL_SKIP; 2512 if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS], 2513 bss_policy)) 2514 return NL_SKIP; 2515 if (bss[NL80211_BSS_STATUS]) { 2516 enum nl80211_bss_status status; 2517 status = nla_get_u32(bss[NL80211_BSS_STATUS]); 2518 if (status == NL80211_BSS_STATUS_ASSOCIATED && 2519 bss[NL80211_BSS_FREQUENCY]) { 2520 _arg->assoc_freq = 2521 nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 2522 wpa_printf(MSG_DEBUG, "nl80211: Associated on %u MHz", 2523 _arg->assoc_freq); 2524 } 2525 } 2526 if (!res) 2527 return NL_SKIP; 2528 if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) { 2529 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 2530 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]); 2531 } else { 2532 ie = NULL; 2533 ie_len = 0; 2534 } 2535 if (bss[NL80211_BSS_BEACON_IES]) { 2536 beacon_ie = nla_data(bss[NL80211_BSS_BEACON_IES]); 2537 beacon_ie_len = nla_len(bss[NL80211_BSS_BEACON_IES]); 2538 } else { 2539 beacon_ie = NULL; 2540 beacon_ie_len = 0; 2541 } 2542 2543 if (nl80211_scan_filtered(_arg->drv, ie ? ie : beacon_ie, 2544 ie ? ie_len : beacon_ie_len)) 2545 return NL_SKIP; 2546 2547 r = os_zalloc(sizeof(*r) + ie_len + beacon_ie_len); 2548 if (r == NULL) 2549 return NL_SKIP; 2550 if (bss[NL80211_BSS_BSSID]) 2551 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]), 2552 ETH_ALEN); 2553 if (bss[NL80211_BSS_FREQUENCY]) 2554 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]); 2555 if (bss[NL80211_BSS_BEACON_INTERVAL]) 2556 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]); 2557 if (bss[NL80211_BSS_CAPABILITY]) 2558 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]); 2559 r->flags |= WPA_SCAN_NOISE_INVALID; 2560 if (bss[NL80211_BSS_SIGNAL_MBM]) { 2561 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]); 2562 r->level /= 100; /* mBm to dBm */ 2563 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID; 2564 } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) { 2565 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]); 2566 r->flags |= WPA_SCAN_LEVEL_INVALID; 2567 } else 2568 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID; 2569 if (bss[NL80211_BSS_TSF]) 2570 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]); 2571 if (bss[NL80211_BSS_SEEN_MS_AGO]) 2572 r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]); 2573 r->ie_len = ie_len; 2574 pos = (u8 *) (r + 1); 2575 if (ie) { 2576 os_memcpy(pos, ie, ie_len); 2577 pos += ie_len; 2578 } 2579 r->beacon_ie_len = beacon_ie_len; 2580 if (beacon_ie) 2581 os_memcpy(pos, beacon_ie, beacon_ie_len); 2582 2583 if (bss[NL80211_BSS_STATUS]) { 2584 enum nl80211_bss_status status; 2585 status = nla_get_u32(bss[NL80211_BSS_STATUS]); 2586 switch (status) { 2587 case NL80211_BSS_STATUS_AUTHENTICATED: 2588 r->flags |= WPA_SCAN_AUTHENTICATED; 2589 break; 2590 case NL80211_BSS_STATUS_ASSOCIATED: 2591 r->flags |= WPA_SCAN_ASSOCIATED; 2592 break; 2593 default: 2594 break; 2595 } 2596 } 2597 2598 /* 2599 * cfg80211 maintains separate BSS table entries for APs if the same 2600 * BSSID,SSID pair is seen on multiple channels. wpa_supplicant does 2601 * not use frequency as a separate key in the BSS table, so filter out 2602 * duplicated entries. Prefer associated BSS entry in such a case in 2603 * order to get the correct frequency into the BSS table. 2604 */ 2605 for (i = 0; i < res->num; i++) { 2606 const u8 *s1, *s2; 2607 if (os_memcmp(res->res[i]->bssid, r->bssid, ETH_ALEN) != 0) 2608 continue; 2609 2610 s1 = nl80211_get_ie((u8 *) (res->res[i] + 1), 2611 res->res[i]->ie_len, WLAN_EID_SSID); 2612 s2 = nl80211_get_ie((u8 *) (r + 1), r->ie_len, WLAN_EID_SSID); 2613 if (s1 == NULL || s2 == NULL || s1[1] != s2[1] || 2614 os_memcmp(s1, s2, 2 + s1[1]) != 0) 2615 continue; 2616 2617 /* Same BSSID,SSID was already included in scan results */ 2618 wpa_printf(MSG_DEBUG, "nl80211: Remove duplicated scan result " 2619 "for " MACSTR, MAC2STR(r->bssid)); 2620 2621 if ((r->flags & WPA_SCAN_ASSOCIATED) && 2622 !(res->res[i]->flags & WPA_SCAN_ASSOCIATED)) { 2623 os_free(res->res[i]); 2624 res->res[i] = r; 2625 } else 2626 os_free(r); 2627 return NL_SKIP; 2628 } 2629 2630 tmp = os_realloc(res->res, 2631 (res->num + 1) * sizeof(struct wpa_scan_res *)); 2632 if (tmp == NULL) { 2633 os_free(r); 2634 return NL_SKIP; 2635 } 2636 tmp[res->num++] = r; 2637 res->res = tmp; 2638 2639 return NL_SKIP; 2640} 2641 2642 2643static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv, 2644 const u8 *addr) 2645{ 2646 if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { 2647 wpa_printf(MSG_DEBUG, "nl80211: Clear possible state " 2648 "mismatch (" MACSTR ")", MAC2STR(addr)); 2649 wpa_driver_nl80211_mlme(drv, addr, 2650 NL80211_CMD_DEAUTHENTICATE, 2651 WLAN_REASON_PREV_AUTH_NOT_VALID, 1); 2652 } 2653} 2654 2655 2656static void wpa_driver_nl80211_check_bss_status( 2657 struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res) 2658{ 2659 size_t i; 2660 2661 for (i = 0; i < res->num; i++) { 2662 struct wpa_scan_res *r = res->res[i]; 2663 if (r->flags & WPA_SCAN_AUTHENTICATED) { 2664 wpa_printf(MSG_DEBUG, "nl80211: Scan results " 2665 "indicates BSS status with " MACSTR 2666 " as authenticated", 2667 MAC2STR(r->bssid)); 2668 if (drv->nlmode == NL80211_IFTYPE_STATION && 2669 os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 && 2670 os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) != 2671 0) { 2672 wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID" 2673 " in local state (auth=" MACSTR 2674 " assoc=" MACSTR ")", 2675 MAC2STR(drv->auth_bssid), 2676 MAC2STR(drv->bssid)); 2677 clear_state_mismatch(drv, r->bssid); 2678 } 2679 } 2680 2681 if (r->flags & WPA_SCAN_ASSOCIATED) { 2682 wpa_printf(MSG_DEBUG, "nl80211: Scan results " 2683 "indicate BSS status with " MACSTR 2684 " as associated", 2685 MAC2STR(r->bssid)); 2686 if (drv->nlmode == NL80211_IFTYPE_STATION && 2687 !drv->associated) { 2688 wpa_printf(MSG_DEBUG, "nl80211: Local state " 2689 "(not associated) does not match " 2690 "with BSS state"); 2691 clear_state_mismatch(drv, r->bssid); 2692 } else if (drv->nlmode == NL80211_IFTYPE_STATION && 2693 os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 2694 0) { 2695 wpa_printf(MSG_DEBUG, "nl80211: Local state " 2696 "(associated with " MACSTR ") does " 2697 "not match with BSS state", 2698 MAC2STR(drv->bssid)); 2699 clear_state_mismatch(drv, r->bssid); 2700 clear_state_mismatch(drv, drv->bssid); 2701 } 2702 } 2703 } 2704} 2705 2706 2707static void wpa_scan_results_free(struct wpa_scan_results *res) 2708{ 2709 size_t i; 2710 2711 if (res == NULL) 2712 return; 2713 2714 for (i = 0; i < res->num; i++) 2715 os_free(res->res[i]); 2716 os_free(res->res); 2717 os_free(res); 2718} 2719 2720 2721static struct wpa_scan_results * 2722nl80211_get_scan_results(struct wpa_driver_nl80211_data *drv) 2723{ 2724 struct nl_msg *msg; 2725 struct wpa_scan_results *res; 2726 int ret; 2727 struct nl80211_bss_info_arg arg; 2728 2729 res = os_zalloc(sizeof(*res)); 2730 if (res == NULL) 2731 return NULL; 2732 msg = nlmsg_alloc(); 2733 if (!msg) 2734 goto nla_put_failure; 2735 2736 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP, 2737 NL80211_CMD_GET_SCAN, 0); 2738 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 2739 2740 arg.drv = drv; 2741 arg.res = res; 2742 ret = send_and_recv_msgs(drv, msg, bss_info_handler, &arg); 2743 msg = NULL; 2744 if (ret == 0) { 2745 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)", 2746 (unsigned long) res->num); 2747 return res; 2748 } 2749 wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d " 2750 "(%s)", ret, strerror(-ret)); 2751nla_put_failure: 2752 nlmsg_free(msg); 2753 wpa_scan_results_free(res); 2754 return NULL; 2755} 2756 2757 2758/** 2759 * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results 2760 * @priv: Pointer to private wext data from wpa_driver_nl80211_init() 2761 * Returns: Scan results on success, -1 on failure 2762 */ 2763static struct wpa_scan_results * 2764wpa_driver_nl80211_get_scan_results(void *priv) 2765{ 2766 struct i802_bss *bss = priv; 2767 struct wpa_driver_nl80211_data *drv = bss->drv; 2768 struct wpa_scan_results *res; 2769 2770 res = nl80211_get_scan_results(drv); 2771 if (res) 2772 wpa_driver_nl80211_check_bss_status(drv, res); 2773 return res; 2774} 2775 2776 2777static void nl80211_dump_scan(struct wpa_driver_nl80211_data *drv) 2778{ 2779 struct wpa_scan_results *res; 2780 size_t i; 2781 2782 res = nl80211_get_scan_results(drv); 2783 if (res == NULL) { 2784 wpa_printf(MSG_DEBUG, "nl80211: Failed to get scan results"); 2785 return; 2786 } 2787 2788 wpa_printf(MSG_DEBUG, "nl80211: Scan result dump"); 2789 for (i = 0; i < res->num; i++) { 2790 struct wpa_scan_res *r = res->res[i]; 2791 wpa_printf(MSG_DEBUG, "nl80211: %d/%d " MACSTR "%s%s", 2792 (int) i, (int) res->num, MAC2STR(r->bssid), 2793 r->flags & WPA_SCAN_AUTHENTICATED ? " [auth]" : "", 2794 r->flags & WPA_SCAN_ASSOCIATED ? " [assoc]" : ""); 2795 } 2796 2797 wpa_scan_results_free(res); 2798} 2799 2800 2801static int wpa_driver_nl80211_set_key(const char *ifname, void *priv, 2802 enum wpa_alg alg, const u8 *addr, 2803 int key_idx, int set_tx, 2804 const u8 *seq, size_t seq_len, 2805 const u8 *key, size_t key_len) 2806{ 2807 struct i802_bss *bss = priv; 2808 struct wpa_driver_nl80211_data *drv = bss->drv; 2809 int ifindex = if_nametoindex(ifname); 2810 struct nl_msg *msg; 2811 int ret; 2812 2813 wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d " 2814 "set_tx=%d seq_len=%lu key_len=%lu", 2815 __func__, ifindex, alg, addr, key_idx, set_tx, 2816 (unsigned long) seq_len, (unsigned long) key_len); 2817 2818 msg = nlmsg_alloc(); 2819 if (!msg) 2820 return -ENOMEM; 2821 2822 if (alg == WPA_ALG_NONE) { 2823 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 2824 0, NL80211_CMD_DEL_KEY, 0); 2825 } else { 2826 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 2827 0, NL80211_CMD_NEW_KEY, 0); 2828 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key); 2829 switch (alg) { 2830 case WPA_ALG_WEP: 2831 if (key_len == 5) 2832 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 2833 WLAN_CIPHER_SUITE_WEP40); 2834 else 2835 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 2836 WLAN_CIPHER_SUITE_WEP104); 2837 break; 2838 case WPA_ALG_TKIP: 2839 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 2840 WLAN_CIPHER_SUITE_TKIP); 2841 break; 2842 case WPA_ALG_CCMP: 2843 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 2844 WLAN_CIPHER_SUITE_CCMP); 2845 break; 2846 case WPA_ALG_IGTK: 2847 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 2848 WLAN_CIPHER_SUITE_AES_CMAC); 2849 break; 2850 default: 2851 wpa_printf(MSG_ERROR, "%s: Unsupported encryption " 2852 "algorithm %d", __func__, alg); 2853 nlmsg_free(msg); 2854 return -1; 2855 } 2856 } 2857 2858 if (seq && seq_len) 2859 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq); 2860 2861 if (addr && !is_broadcast_ether_addr(addr)) { 2862 wpa_printf(MSG_DEBUG, " addr=" MACSTR, MAC2STR(addr)); 2863 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 2864 2865 if (alg != WPA_ALG_WEP && key_idx && !set_tx) { 2866 wpa_printf(MSG_DEBUG, " RSN IBSS RX GTK"); 2867 NLA_PUT_U32(msg, NL80211_ATTR_KEY_TYPE, 2868 NL80211_KEYTYPE_GROUP); 2869 } 2870 } else if (addr && is_broadcast_ether_addr(addr)) { 2871 struct nl_msg *types; 2872 int err; 2873 wpa_printf(MSG_DEBUG, " broadcast key"); 2874 types = nlmsg_alloc(); 2875 if (!types) 2876 goto nla_put_failure; 2877 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST); 2878 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES, 2879 types); 2880 nlmsg_free(types); 2881 if (err) 2882 goto nla_put_failure; 2883 } 2884 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx); 2885 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); 2886 2887 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 2888 if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE) 2889 ret = 0; 2890 if (ret) 2891 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)", 2892 ret, strerror(-ret)); 2893 2894 /* 2895 * If we failed or don't need to set the default TX key (below), 2896 * we're done here. 2897 */ 2898 if (ret || !set_tx || alg == WPA_ALG_NONE) 2899 return ret; 2900 if (drv->nlmode == NL80211_IFTYPE_AP && addr && 2901 !is_broadcast_ether_addr(addr)) 2902 return ret; 2903 2904 msg = nlmsg_alloc(); 2905 if (!msg) 2906 return -ENOMEM; 2907 2908 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 2909 0, NL80211_CMD_SET_KEY, 0); 2910 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx); 2911 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); 2912 if (alg == WPA_ALG_IGTK) 2913 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT); 2914 else 2915 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT); 2916 if (addr && is_broadcast_ether_addr(addr)) { 2917 struct nl_msg *types; 2918 int err; 2919 types = nlmsg_alloc(); 2920 if (!types) 2921 goto nla_put_failure; 2922 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_MULTICAST); 2923 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES, 2924 types); 2925 nlmsg_free(types); 2926 if (err) 2927 goto nla_put_failure; 2928 } else if (addr) { 2929 struct nl_msg *types; 2930 int err; 2931 types = nlmsg_alloc(); 2932 if (!types) 2933 goto nla_put_failure; 2934 NLA_PUT_FLAG(types, NL80211_KEY_DEFAULT_TYPE_UNICAST); 2935 err = nla_put_nested(msg, NL80211_ATTR_KEY_DEFAULT_TYPES, 2936 types); 2937 nlmsg_free(types); 2938 if (err) 2939 goto nla_put_failure; 2940 } 2941 2942 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 2943 if (ret == -ENOENT) 2944 ret = 0; 2945 if (ret) 2946 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; " 2947 "err=%d %s)", ret, strerror(-ret)); 2948 return ret; 2949 2950nla_put_failure: 2951 return -ENOBUFS; 2952} 2953 2954 2955static int nl_add_key(struct nl_msg *msg, enum wpa_alg alg, 2956 int key_idx, int defkey, 2957 const u8 *seq, size_t seq_len, 2958 const u8 *key, size_t key_len) 2959{ 2960 struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY); 2961 if (!key_attr) 2962 return -1; 2963 2964 if (defkey && alg == WPA_ALG_IGTK) 2965 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT); 2966 else if (defkey) 2967 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT); 2968 2969 NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx); 2970 2971 switch (alg) { 2972 case WPA_ALG_WEP: 2973 if (key_len == 5) 2974 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 2975 WLAN_CIPHER_SUITE_WEP40); 2976 else 2977 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 2978 WLAN_CIPHER_SUITE_WEP104); 2979 break; 2980 case WPA_ALG_TKIP: 2981 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP); 2982 break; 2983 case WPA_ALG_CCMP: 2984 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP); 2985 break; 2986 case WPA_ALG_IGTK: 2987 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 2988 WLAN_CIPHER_SUITE_AES_CMAC); 2989 break; 2990 default: 2991 wpa_printf(MSG_ERROR, "%s: Unsupported encryption " 2992 "algorithm %d", __func__, alg); 2993 return -1; 2994 } 2995 2996 if (seq && seq_len) 2997 NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq); 2998 2999 NLA_PUT(msg, NL80211_KEY_DATA, key_len, key); 3000 3001 nla_nest_end(msg, key_attr); 3002 3003 return 0; 3004 nla_put_failure: 3005 return -1; 3006} 3007 3008 3009static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params, 3010 struct nl_msg *msg) 3011{ 3012 int i, privacy = 0; 3013 struct nlattr *nl_keys, *nl_key; 3014 3015 for (i = 0; i < 4; i++) { 3016 if (!params->wep_key[i]) 3017 continue; 3018 privacy = 1; 3019 break; 3020 } 3021 if (params->wps == WPS_MODE_PRIVACY) 3022 privacy = 1; 3023 if (params->pairwise_suite && 3024 params->pairwise_suite != WPA_CIPHER_NONE) 3025 privacy = 1; 3026 3027 if (!privacy) 3028 return 0; 3029 3030 NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY); 3031 3032 nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS); 3033 if (!nl_keys) 3034 goto nla_put_failure; 3035 3036 for (i = 0; i < 4; i++) { 3037 if (!params->wep_key[i]) 3038 continue; 3039 3040 nl_key = nla_nest_start(msg, i); 3041 if (!nl_key) 3042 goto nla_put_failure; 3043 3044 NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i], 3045 params->wep_key[i]); 3046 if (params->wep_key_len[i] == 5) 3047 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 3048 WLAN_CIPHER_SUITE_WEP40); 3049 else 3050 NLA_PUT_U32(msg, NL80211_KEY_CIPHER, 3051 WLAN_CIPHER_SUITE_WEP104); 3052 3053 NLA_PUT_U8(msg, NL80211_KEY_IDX, i); 3054 3055 if (i == params->wep_tx_keyidx) 3056 NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT); 3057 3058 nla_nest_end(msg, nl_key); 3059 } 3060 nla_nest_end(msg, nl_keys); 3061 3062 return 0; 3063 3064nla_put_failure: 3065 return -ENOBUFS; 3066} 3067 3068 3069static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv, 3070 const u8 *addr, int cmd, u16 reason_code, 3071 int local_state_change) 3072{ 3073 int ret = -1; 3074 struct nl_msg *msg; 3075 3076 msg = nlmsg_alloc(); 3077 if (!msg) 3078 return -1; 3079 3080 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0); 3081 3082 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 3083 NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code); 3084 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 3085 if (local_state_change) 3086 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE); 3087 3088 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3089 msg = NULL; 3090 if (ret) { 3091 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " 3092 "(%s)", ret, strerror(-ret)); 3093 goto nla_put_failure; 3094 } 3095 ret = 0; 3096 3097nla_put_failure: 3098 nlmsg_free(msg); 3099 return ret; 3100} 3101 3102 3103static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv, 3104 const u8 *addr, int reason_code) 3105{ 3106 wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)", 3107 __func__, MAC2STR(addr), reason_code); 3108 drv->associated = 0; 3109 return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT, 3110 reason_code, 0); 3111} 3112 3113 3114static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr, 3115 int reason_code) 3116{ 3117 struct i802_bss *bss = priv; 3118 struct wpa_driver_nl80211_data *drv = bss->drv; 3119 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) 3120 return wpa_driver_nl80211_disconnect(drv, addr, reason_code); 3121 wpa_printf(MSG_DEBUG, "%s(addr=" MACSTR " reason_code=%d)", 3122 __func__, MAC2STR(addr), reason_code); 3123 drv->associated = 0; 3124 if (drv->nlmode == NL80211_IFTYPE_ADHOC) 3125 return nl80211_leave_ibss(drv); 3126 return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE, 3127 reason_code, 0); 3128} 3129 3130 3131static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr, 3132 int reason_code) 3133{ 3134 struct i802_bss *bss = priv; 3135 struct wpa_driver_nl80211_data *drv = bss->drv; 3136 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) 3137 return wpa_driver_nl80211_disconnect(drv, addr, reason_code); 3138 wpa_printf(MSG_DEBUG, "%s", __func__); 3139 drv->associated = 0; 3140 return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE, 3141 reason_code, 0); 3142} 3143 3144 3145static int wpa_driver_nl80211_authenticate( 3146 void *priv, struct wpa_driver_auth_params *params) 3147{ 3148 struct i802_bss *bss = priv; 3149 struct wpa_driver_nl80211_data *drv = bss->drv; 3150 int ret = -1, i; 3151 struct nl_msg *msg; 3152 enum nl80211_auth_type type; 3153 int count = 0; 3154 3155 drv->associated = 0; 3156 os_memset(drv->auth_bssid, 0, ETH_ALEN); 3157 /* FIX: IBSS mode */ 3158 if (drv->nlmode != NL80211_IFTYPE_STATION && 3159 wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA) < 0) 3160 return -1; 3161 3162retry: 3163 msg = nlmsg_alloc(); 3164 if (!msg) 3165 return -1; 3166 3167 wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)", 3168 drv->ifindex); 3169 3170 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 3171 NL80211_CMD_AUTHENTICATE, 0); 3172 3173 for (i = 0; i < 4; i++) { 3174 if (!params->wep_key[i]) 3175 continue; 3176 wpa_driver_nl80211_set_key(bss->ifname, priv, WPA_ALG_WEP, 3177 NULL, i, 3178 i == params->wep_tx_keyidx, NULL, 0, 3179 params->wep_key[i], 3180 params->wep_key_len[i]); 3181 if (params->wep_tx_keyidx != i) 3182 continue; 3183 if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0, 3184 params->wep_key[i], params->wep_key_len[i])) { 3185 nlmsg_free(msg); 3186 return -1; 3187 } 3188 } 3189 3190 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 3191 if (params->bssid) { 3192 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, 3193 MAC2STR(params->bssid)); 3194 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); 3195 } 3196 if (params->freq) { 3197 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); 3198 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); 3199 } 3200 if (params->ssid) { 3201 wpa_hexdump_ascii(MSG_DEBUG, " * SSID", 3202 params->ssid, params->ssid_len); 3203 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, 3204 params->ssid); 3205 } 3206 wpa_hexdump(MSG_DEBUG, " * IEs", params->ie, params->ie_len); 3207 if (params->ie) 3208 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie); 3209 if (params->auth_alg & WPA_AUTH_ALG_OPEN) 3210 type = NL80211_AUTHTYPE_OPEN_SYSTEM; 3211 else if (params->auth_alg & WPA_AUTH_ALG_SHARED) 3212 type = NL80211_AUTHTYPE_SHARED_KEY; 3213 else if (params->auth_alg & WPA_AUTH_ALG_LEAP) 3214 type = NL80211_AUTHTYPE_NETWORK_EAP; 3215 else if (params->auth_alg & WPA_AUTH_ALG_FT) 3216 type = NL80211_AUTHTYPE_FT; 3217 else 3218 goto nla_put_failure; 3219 wpa_printf(MSG_DEBUG, " * Auth Type %d", type); 3220 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type); 3221 if (params->local_state_change) { 3222 wpa_printf(MSG_DEBUG, " * Local state change only"); 3223 NLA_PUT_FLAG(msg, NL80211_ATTR_LOCAL_STATE_CHANGE); 3224 } 3225 3226 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3227 msg = NULL; 3228 if (ret) { 3229 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " 3230 "(%s)", ret, strerror(-ret)); 3231 count++; 3232 if (ret == -EALREADY && count == 1 && params->bssid && 3233 !params->local_state_change) { 3234 /* 3235 * mac80211 does not currently accept new 3236 * authentication if we are already authenticated. As a 3237 * workaround, force deauthentication and try again. 3238 */ 3239 wpa_printf(MSG_DEBUG, "nl80211: Retry authentication " 3240 "after forced deauthentication"); 3241 wpa_driver_nl80211_deauthenticate( 3242 bss, params->bssid, 3243 WLAN_REASON_PREV_AUTH_NOT_VALID); 3244 nlmsg_free(msg); 3245 goto retry; 3246 } 3247 goto nla_put_failure; 3248 } 3249 ret = 0; 3250 wpa_printf(MSG_DEBUG, "nl80211: Authentication request send " 3251 "successfully"); 3252 3253nla_put_failure: 3254 nlmsg_free(msg); 3255 return ret; 3256} 3257 3258 3259struct phy_info_arg { 3260 u16 *num_modes; 3261 struct hostapd_hw_modes *modes; 3262}; 3263 3264static int phy_info_handler(struct nl_msg *msg, void *arg) 3265{ 3266 struct nlattr *tb_msg[NL80211_ATTR_MAX + 1]; 3267 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 3268 struct phy_info_arg *phy_info = arg; 3269 3270 struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1]; 3271 3272 struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1]; 3273 static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = { 3274 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 }, 3275 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG }, 3276 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG }, 3277 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG }, 3278 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG }, 3279 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 }, 3280 }; 3281 3282 struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1]; 3283 static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = { 3284 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 }, 3285 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG }, 3286 }; 3287 3288 struct nlattr *nl_band; 3289 struct nlattr *nl_freq; 3290 struct nlattr *nl_rate; 3291 int rem_band, rem_freq, rem_rate; 3292 struct hostapd_hw_modes *mode; 3293 int idx, mode_is_set; 3294 3295 nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 3296 genlmsg_attrlen(gnlh, 0), NULL); 3297 3298 if (!tb_msg[NL80211_ATTR_WIPHY_BANDS]) 3299 return NL_SKIP; 3300 3301 nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) { 3302 mode = os_realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode)); 3303 if (!mode) 3304 return NL_SKIP; 3305 phy_info->modes = mode; 3306 3307 mode_is_set = 0; 3308 3309 mode = &phy_info->modes[*(phy_info->num_modes)]; 3310 memset(mode, 0, sizeof(*mode)); 3311 *(phy_info->num_modes) += 1; 3312 3313 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band), 3314 nla_len(nl_band), NULL); 3315 3316 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) { 3317 mode->ht_capab = nla_get_u16( 3318 tb_band[NL80211_BAND_ATTR_HT_CAPA]); 3319 } 3320 3321 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) { 3322 mode->a_mpdu_params |= nla_get_u8( 3323 tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) & 3324 0x03; 3325 } 3326 3327 if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) { 3328 mode->a_mpdu_params |= nla_get_u8( 3329 tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) << 3330 2; 3331 } 3332 3333 if (tb_band[NL80211_BAND_ATTR_HT_MCS_SET] && 3334 nla_len(tb_band[NL80211_BAND_ATTR_HT_MCS_SET])) { 3335 u8 *mcs; 3336 mcs = nla_data(tb_band[NL80211_BAND_ATTR_HT_MCS_SET]); 3337 os_memcpy(mode->mcs_set, mcs, 16); 3338 } 3339 3340 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) { 3341 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq), 3342 nla_len(nl_freq), freq_policy); 3343 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ]) 3344 continue; 3345 mode->num_channels++; 3346 } 3347 3348 mode->channels = os_zalloc(mode->num_channels * sizeof(struct hostapd_channel_data)); 3349 if (!mode->channels) 3350 return NL_SKIP; 3351 3352 idx = 0; 3353 3354 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) { 3355 nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq), 3356 nla_len(nl_freq), freq_policy); 3357 if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ]) 3358 continue; 3359 3360 mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]); 3361 mode->channels[idx].flag = 0; 3362 3363 if (!mode_is_set) { 3364 /* crude heuristic */ 3365 if (mode->channels[idx].freq < 4000) 3366 mode->mode = HOSTAPD_MODE_IEEE80211B; 3367 else 3368 mode->mode = HOSTAPD_MODE_IEEE80211A; 3369 mode_is_set = 1; 3370 } 3371 3372 /* crude heuristic */ 3373 if (mode->channels[idx].freq < 4000) 3374 if (mode->channels[idx].freq == 2484) 3375 mode->channels[idx].chan = 14; 3376 else 3377 mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5; 3378 else 3379 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000; 3380 3381 if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED]) 3382 mode->channels[idx].flag |= 3383 HOSTAPD_CHAN_DISABLED; 3384 if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN]) 3385 mode->channels[idx].flag |= 3386 HOSTAPD_CHAN_PASSIVE_SCAN; 3387 if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS]) 3388 mode->channels[idx].flag |= 3389 HOSTAPD_CHAN_NO_IBSS; 3390 if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR]) 3391 mode->channels[idx].flag |= 3392 HOSTAPD_CHAN_RADAR; 3393 3394 if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] && 3395 !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED]) 3396 mode->channels[idx].max_tx_power = 3397 nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100; 3398 3399 idx++; 3400 } 3401 3402 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) { 3403 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate), 3404 nla_len(nl_rate), rate_policy); 3405 if (!tb_rate[NL80211_BITRATE_ATTR_RATE]) 3406 continue; 3407 mode->num_rates++; 3408 } 3409 3410 mode->rates = os_zalloc(mode->num_rates * sizeof(int)); 3411 if (!mode->rates) 3412 return NL_SKIP; 3413 3414 idx = 0; 3415 3416 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) { 3417 nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate), 3418 nla_len(nl_rate), rate_policy); 3419 if (!tb_rate[NL80211_BITRATE_ATTR_RATE]) 3420 continue; 3421 mode->rates[idx] = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]); 3422 3423 /* crude heuristic */ 3424 if (mode->mode == HOSTAPD_MODE_IEEE80211B && 3425 mode->rates[idx] > 200) 3426 mode->mode = HOSTAPD_MODE_IEEE80211G; 3427 3428 idx++; 3429 } 3430 } 3431 3432 return NL_SKIP; 3433} 3434 3435static struct hostapd_hw_modes * 3436wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes) 3437{ 3438 u16 m; 3439 struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode; 3440 int i, mode11g_idx = -1; 3441 3442 /* If only 802.11g mode is included, use it to construct matching 3443 * 802.11b mode data. */ 3444 3445 for (m = 0; m < *num_modes; m++) { 3446 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B) 3447 return modes; /* 802.11b already included */ 3448 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G) 3449 mode11g_idx = m; 3450 } 3451 3452 if (mode11g_idx < 0) 3453 return modes; /* 2.4 GHz band not supported at all */ 3454 3455 nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes)); 3456 if (nmodes == NULL) 3457 return modes; /* Could not add 802.11b mode */ 3458 3459 mode = &nmodes[*num_modes]; 3460 os_memset(mode, 0, sizeof(*mode)); 3461 (*num_modes)++; 3462 modes = nmodes; 3463 3464 mode->mode = HOSTAPD_MODE_IEEE80211B; 3465 3466 mode11g = &modes[mode11g_idx]; 3467 mode->num_channels = mode11g->num_channels; 3468 mode->channels = os_malloc(mode11g->num_channels * 3469 sizeof(struct hostapd_channel_data)); 3470 if (mode->channels == NULL) { 3471 (*num_modes)--; 3472 return modes; /* Could not add 802.11b mode */ 3473 } 3474 os_memcpy(mode->channels, mode11g->channels, 3475 mode11g->num_channels * sizeof(struct hostapd_channel_data)); 3476 3477 mode->num_rates = 0; 3478 mode->rates = os_malloc(4 * sizeof(int)); 3479 if (mode->rates == NULL) { 3480 os_free(mode->channels); 3481 (*num_modes)--; 3482 return modes; /* Could not add 802.11b mode */ 3483 } 3484 3485 for (i = 0; i < mode11g->num_rates; i++) { 3486 if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 && 3487 mode11g->rates[i] != 55 && mode11g->rates[i] != 110) 3488 continue; 3489 mode->rates[mode->num_rates] = mode11g->rates[i]; 3490 mode->num_rates++; 3491 if (mode->num_rates == 4) 3492 break; 3493 } 3494 3495 if (mode->num_rates == 0) { 3496 os_free(mode->channels); 3497 os_free(mode->rates); 3498 (*num_modes)--; 3499 return modes; /* No 802.11b rates */ 3500 } 3501 3502 wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g " 3503 "information"); 3504 3505 return modes; 3506} 3507 3508 3509static void nl80211_set_ht40_mode(struct hostapd_hw_modes *mode, int start, 3510 int end) 3511{ 3512 int c; 3513 3514 for (c = 0; c < mode->num_channels; c++) { 3515 struct hostapd_channel_data *chan = &mode->channels[c]; 3516 if (chan->freq - 10 >= start && chan->freq + 10 <= end) 3517 chan->flag |= HOSTAPD_CHAN_HT40; 3518 } 3519} 3520 3521 3522static void nl80211_set_ht40_mode_sec(struct hostapd_hw_modes *mode, int start, 3523 int end) 3524{ 3525 int c; 3526 3527 for (c = 0; c < mode->num_channels; c++) { 3528 struct hostapd_channel_data *chan = &mode->channels[c]; 3529 if (!(chan->flag & HOSTAPD_CHAN_HT40)) 3530 continue; 3531 if (chan->freq - 30 >= start && chan->freq - 10 <= end) 3532 chan->flag |= HOSTAPD_CHAN_HT40MINUS; 3533 if (chan->freq + 10 >= start && chan->freq + 30 <= end) 3534 chan->flag |= HOSTAPD_CHAN_HT40PLUS; 3535 } 3536} 3537 3538 3539static void nl80211_reg_rule_ht40(struct nlattr *tb[], 3540 struct phy_info_arg *results) 3541{ 3542 u32 start, end, max_bw; 3543 u16 m; 3544 3545 if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL || 3546 tb[NL80211_ATTR_FREQ_RANGE_END] == NULL || 3547 tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL) 3548 return; 3549 3550 start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000; 3551 end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000; 3552 max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000; 3553 3554 wpa_printf(MSG_DEBUG, "nl80211: %u-%u @ %u MHz", 3555 start, end, max_bw); 3556 if (max_bw < 40) 3557 return; 3558 3559 for (m = 0; m < *results->num_modes; m++) { 3560 if (!(results->modes[m].ht_capab & 3561 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) 3562 continue; 3563 nl80211_set_ht40_mode(&results->modes[m], start, end); 3564 } 3565} 3566 3567 3568static void nl80211_reg_rule_sec(struct nlattr *tb[], 3569 struct phy_info_arg *results) 3570{ 3571 u32 start, end, max_bw; 3572 u16 m; 3573 3574 if (tb[NL80211_ATTR_FREQ_RANGE_START] == NULL || 3575 tb[NL80211_ATTR_FREQ_RANGE_END] == NULL || 3576 tb[NL80211_ATTR_FREQ_RANGE_MAX_BW] == NULL) 3577 return; 3578 3579 start = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]) / 1000; 3580 end = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]) / 1000; 3581 max_bw = nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]) / 1000; 3582 3583 if (max_bw < 20) 3584 return; 3585 3586 for (m = 0; m < *results->num_modes; m++) { 3587 if (!(results->modes[m].ht_capab & 3588 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) 3589 continue; 3590 nl80211_set_ht40_mode_sec(&results->modes[m], start, end); 3591 } 3592} 3593 3594 3595static int nl80211_get_reg(struct nl_msg *msg, void *arg) 3596{ 3597 struct phy_info_arg *results = arg; 3598 struct nlattr *tb_msg[NL80211_ATTR_MAX + 1]; 3599 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 3600 struct nlattr *nl_rule; 3601 struct nlattr *tb_rule[NL80211_FREQUENCY_ATTR_MAX + 1]; 3602 int rem_rule; 3603 static struct nla_policy reg_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = { 3604 [NL80211_ATTR_REG_RULE_FLAGS] = { .type = NLA_U32 }, 3605 [NL80211_ATTR_FREQ_RANGE_START] = { .type = NLA_U32 }, 3606 [NL80211_ATTR_FREQ_RANGE_END] = { .type = NLA_U32 }, 3607 [NL80211_ATTR_FREQ_RANGE_MAX_BW] = { .type = NLA_U32 }, 3608 [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN] = { .type = NLA_U32 }, 3609 [NL80211_ATTR_POWER_RULE_MAX_EIRP] = { .type = NLA_U32 }, 3610 }; 3611 3612 nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 3613 genlmsg_attrlen(gnlh, 0), NULL); 3614 if (!tb_msg[NL80211_ATTR_REG_ALPHA2] || 3615 !tb_msg[NL80211_ATTR_REG_RULES]) { 3616 wpa_printf(MSG_DEBUG, "nl80211: No regulatory information " 3617 "available"); 3618 return NL_SKIP; 3619 } 3620 3621 wpa_printf(MSG_DEBUG, "nl80211: Regulatory information - country=%s", 3622 (char *) nla_data(tb_msg[NL80211_ATTR_REG_ALPHA2])); 3623 3624 nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule) 3625 { 3626 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX, 3627 nla_data(nl_rule), nla_len(nl_rule), reg_policy); 3628 nl80211_reg_rule_ht40(tb_rule, results); 3629 } 3630 3631 nla_for_each_nested(nl_rule, tb_msg[NL80211_ATTR_REG_RULES], rem_rule) 3632 { 3633 nla_parse(tb_rule, NL80211_FREQUENCY_ATTR_MAX, 3634 nla_data(nl_rule), nla_len(nl_rule), reg_policy); 3635 nl80211_reg_rule_sec(tb_rule, results); 3636 } 3637 3638 return NL_SKIP; 3639} 3640 3641 3642static int nl80211_set_ht40_flags(struct wpa_driver_nl80211_data *drv, 3643 struct phy_info_arg *results) 3644{ 3645 struct nl_msg *msg; 3646 3647 msg = nlmsg_alloc(); 3648 if (!msg) 3649 return -ENOMEM; 3650 3651 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3652 0, NL80211_CMD_GET_REG, 0); 3653 return send_and_recv_msgs(drv, msg, nl80211_get_reg, results); 3654} 3655 3656 3657static struct hostapd_hw_modes * 3658wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags) 3659{ 3660 struct i802_bss *bss = priv; 3661 struct wpa_driver_nl80211_data *drv = bss->drv; 3662 struct nl_msg *msg; 3663 struct phy_info_arg result = { 3664 .num_modes = num_modes, 3665 .modes = NULL, 3666 }; 3667 3668 *num_modes = 0; 3669 *flags = 0; 3670 3671 msg = nlmsg_alloc(); 3672 if (!msg) 3673 return NULL; 3674 3675 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3676 0, NL80211_CMD_GET_WIPHY, 0); 3677 3678 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 3679 3680 if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) { 3681 nl80211_set_ht40_flags(drv, &result); 3682 return wpa_driver_nl80211_add_11b(result.modes, num_modes); 3683 } 3684 nla_put_failure: 3685 return NULL; 3686} 3687 3688 3689static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv, 3690 const void *data, size_t len, 3691 int encrypt) 3692{ 3693 __u8 rtap_hdr[] = { 3694 0x00, 0x00, /* radiotap version */ 3695 0x0e, 0x00, /* radiotap length */ 3696 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */ 3697 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */ 3698 0x00, /* padding */ 3699 0x00, 0x00, /* RX and TX flags to indicate that */ 3700 0x00, 0x00, /* this is the injected frame directly */ 3701 }; 3702 struct iovec iov[2] = { 3703 { 3704 .iov_base = &rtap_hdr, 3705 .iov_len = sizeof(rtap_hdr), 3706 }, 3707 { 3708 .iov_base = (void *) data, 3709 .iov_len = len, 3710 } 3711 }; 3712 struct msghdr msg = { 3713 .msg_name = NULL, 3714 .msg_namelen = 0, 3715 .msg_iov = iov, 3716 .msg_iovlen = 2, 3717 .msg_control = NULL, 3718 .msg_controllen = 0, 3719 .msg_flags = 0, 3720 }; 3721 int res; 3722 3723 if (encrypt) 3724 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP; 3725 3726 if (drv->monitor_sock < 0) { 3727 wpa_printf(MSG_DEBUG, "nl80211: No monitor socket available " 3728 "for %s", __func__); 3729 return -1; 3730 } 3731 3732 res = sendmsg(drv->monitor_sock, &msg, 0); 3733 if (res < 0) { 3734 wpa_printf(MSG_INFO, "nl80211: sendmsg: %s", strerror(errno)); 3735 return -1; 3736 } 3737 return 0; 3738} 3739 3740 3741static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data, 3742 size_t data_len) 3743{ 3744 struct i802_bss *bss = priv; 3745 struct wpa_driver_nl80211_data *drv = bss->drv; 3746 struct ieee80211_mgmt *mgmt; 3747 int encrypt = 1; 3748 u16 fc; 3749 3750 mgmt = (struct ieee80211_mgmt *) data; 3751 fc = le_to_host16(mgmt->frame_control); 3752 if (drv->nlmode == NL80211_IFTYPE_STATION && 3753 WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 3754 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) { 3755 /* 3756 * The use of last_mgmt_freq is a bit of a hack, 3757 * but it works due to the single-threaded nature 3758 * of wpa_supplicant. 3759 */ 3760 return nl80211_send_frame_cmd(drv, drv->last_mgmt_freq, 0, 3761 data, data_len, NULL); 3762 } 3763#ifdef ANDROID_BRCM_P2P_PATCH 3764 if (drv->nlmode == NL80211_IFTYPE_AP) { 3765 wpa_printf(MSG_DEBUG, "%s: Sending frame on ap_oper_freq %d using nl80211_send_frame_cmd", __func__, drv->ap_oper_freq); 3766 return nl80211_send_frame_cmd(drv, drv->ap_oper_freq, 0, 3767 data, data_len, &drv->send_action_cookie); 3768 } 3769#else 3770 if (drv->no_monitor_iface_capab && drv->nlmode == NL80211_IFTYPE_AP ) { 3771 return nl80211_send_frame_cmd(drv, drv->ap_oper_freq, 0, 3772 data, data_len, NULL); 3773 } 3774#endif 3775 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 3776 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) { 3777 /* 3778 * Only one of the authentication frame types is encrypted. 3779 * In order for static WEP encryption to work properly (i.e., 3780 * to not encrypt the frame), we need to tell mac80211 about 3781 * the frames that must not be encrypted. 3782 */ 3783 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg); 3784 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction); 3785 if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3) 3786 encrypt = 0; 3787 } 3788 wpa_printf(MSG_DEBUG, "%s: Sending frame using monitor interface/l2 socket", __func__); 3789 return wpa_driver_nl80211_send_frame(drv, data, data_len, encrypt); 3790} 3791 3792 3793static int wpa_driver_nl80211_set_beacon(void *priv, 3794 const u8 *head, size_t head_len, 3795 const u8 *tail, size_t tail_len, 3796 int dtim_period, int beacon_int) 3797{ 3798 struct i802_bss *bss = priv; 3799 struct wpa_driver_nl80211_data *drv = bss->drv; 3800 struct nl_msg *msg; 3801 u8 cmd = NL80211_CMD_NEW_BEACON; 3802 int ret; 3803 int beacon_set; 3804 int ifindex = if_nametoindex(bss->ifname); 3805 beacon_set = bss->beacon_set; 3806 3807 msg = nlmsg_alloc(); 3808 if (!msg) 3809 return -ENOMEM; 3810 3811 wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)", 3812 beacon_set); 3813 if (beacon_set) 3814 cmd = NL80211_CMD_SET_BEACON; 3815 3816 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3817 0, cmd, 0); 3818 NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head); 3819 NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail); 3820 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); 3821 NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, beacon_int); 3822 NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period); 3823 3824 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3825 if (ret) { 3826 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)", 3827 ret, strerror(-ret)); 3828 } else { 3829 bss->beacon_set = 1; 3830 } 3831#if defined(ANDROID_BRCM_P2P_PATCH) && defined(HOSTAPD) 3832 wpa_driver_nl80211_probe_req_report(priv, 1); 3833#endif 3834 return ret; 3835 nla_put_failure: 3836 return -ENOBUFS; 3837} 3838 3839 3840static int wpa_driver_nl80211_set_freq(struct wpa_driver_nl80211_data *drv, 3841 int freq, int ht_enabled, 3842 int sec_channel_offset) 3843{ 3844 struct nl_msg *msg; 3845 int ret; 3846 3847 msg = nlmsg_alloc(); 3848 if (!msg) 3849 return -1; 3850 3851 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 3852 NL80211_CMD_SET_WIPHY, 0); 3853 3854 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 3855 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq); 3856 if (ht_enabled) { 3857 switch (sec_channel_offset) { 3858 case -1: 3859 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3860 NL80211_CHAN_HT40MINUS); 3861 break; 3862 case 1: 3863 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3864 NL80211_CHAN_HT40PLUS); 3865 break; 3866 default: 3867#ifndef ANDROID_BRCM_P2P_PATCH 3868/* Should be change to HT20 as a default value because P2P firmware does not support 11n for BCM4329 */ 3869 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3870 NL80211_CHAN_HT20); 3871#else 3872 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, 3873 NL80211_CHAN_NO_HT); 3874#endif 3875 break; 3876 } 3877 } 3878 3879 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3880 if (ret == 0) 3881 return 0; 3882 wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): " 3883 "%d (%s)", freq, ret, strerror(-ret)); 3884nla_put_failure: 3885 return -1; 3886} 3887 3888 3889static int wpa_driver_nl80211_sta_add(void *priv, 3890 struct hostapd_sta_add_params *params) 3891{ 3892 struct i802_bss *bss = priv; 3893 struct wpa_driver_nl80211_data *drv = bss->drv; 3894 struct nl_msg *msg; 3895 int ret = -ENOBUFS; 3896 3897 msg = nlmsg_alloc(); 3898 if (!msg) 3899 return -ENOMEM; 3900 3901 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3902 0, NL80211_CMD_NEW_STATION, 0); 3903 3904 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 3905 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr); 3906 NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid); 3907 NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len, 3908 params->supp_rates); 3909 NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL, 3910 params->listen_interval); 3911 if (params->ht_capabilities) { 3912 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, 3913 sizeof(*params->ht_capabilities), 3914 params->ht_capabilities); 3915 } 3916 3917 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3918 if (ret) 3919 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION " 3920 "result: %d (%s)", ret, strerror(-ret)); 3921 if (ret == -EEXIST) 3922 ret = 0; 3923 nla_put_failure: 3924 return ret; 3925} 3926 3927 3928static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr) 3929{ 3930 struct i802_bss *bss = priv; 3931 struct wpa_driver_nl80211_data *drv = bss->drv; 3932 struct nl_msg *msg; 3933 int ret; 3934 3935 msg = nlmsg_alloc(); 3936 if (!msg) 3937 return -ENOMEM; 3938 3939 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3940 0, NL80211_CMD_DEL_STATION, 0); 3941 3942 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, 3943 if_nametoindex(bss->ifname)); 3944 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 3945 3946 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 3947 if (ret == -ENOENT) 3948 return 0; 3949 return ret; 3950 nla_put_failure: 3951 return -ENOBUFS; 3952} 3953 3954 3955static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, 3956 int ifidx) 3957{ 3958 struct nl_msg *msg; 3959 3960 wpa_printf(MSG_DEBUG, "nl80211: Remove interface ifindex=%d", ifidx); 3961 3962#ifdef HOSTAPD 3963 /* stop listening for EAPOL on this interface */ 3964 del_ifidx(drv, ifidx); 3965#endif /* HOSTAPD */ 3966 3967 msg = nlmsg_alloc(); 3968 if (!msg) 3969 goto nla_put_failure; 3970 3971 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3972 0, NL80211_CMD_DEL_INTERFACE, 0); 3973 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx); 3974 3975 if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0) 3976 return; 3977 nla_put_failure: 3978 wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d)", ifidx); 3979} 3980 3981 3982static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv, 3983 const char *ifname, 3984 enum nl80211_iftype iftype, 3985 const u8 *addr, int wds) 3986{ 3987 struct nl_msg *msg, *flags = NULL; 3988 int ifidx; 3989 int ret = -ENOBUFS; 3990 3991 msg = nlmsg_alloc(); 3992 if (!msg) 3993 return -1; 3994 3995 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 3996 0, NL80211_CMD_NEW_INTERFACE, 0); 3997 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 3998 NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname); 3999 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype); 4000 4001 if (iftype == NL80211_IFTYPE_MONITOR) { 4002 int err; 4003 4004 flags = nlmsg_alloc(); 4005 if (!flags) 4006 goto nla_put_failure; 4007 4008 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES); 4009 4010 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags); 4011 4012 nlmsg_free(flags); 4013 4014 if (err) 4015 goto nla_put_failure; 4016 } else if (wds) { 4017 NLA_PUT_U8(msg, NL80211_ATTR_4ADDR, wds); 4018 } 4019 4020 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 4021 if (ret) { 4022 nla_put_failure: 4023 wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)", 4024 ifname, ret, strerror(-ret)); 4025 return ret; 4026 } 4027 4028 ifidx = if_nametoindex(ifname); 4029 wpa_printf(MSG_DEBUG, "nl80211: New interface %s created: ifindex=%d", 4030 ifname, ifidx); 4031 4032 if (ifidx <= 0) 4033 return -1; 4034 4035#ifdef HOSTAPD 4036 /* start listening for EAPOL on this interface */ 4037 add_ifidx(drv, ifidx); 4038#endif /* HOSTAPD */ 4039 4040 if (addr && iftype != NL80211_IFTYPE_MONITOR && 4041 linux_set_ifhwaddr(drv->ioctl_sock, ifname, addr)) { 4042 nl80211_remove_iface(drv, ifidx); 4043 return -1; 4044 } 4045 4046 return ifidx; 4047} 4048 4049 4050static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv, 4051 const char *ifname, enum nl80211_iftype iftype, 4052 const u8 *addr, int wds) 4053{ 4054 int ret; 4055 4056 ret = nl80211_create_iface_once(drv, ifname, iftype, addr, wds); 4057 4058 /* if error occured and interface exists already */ 4059 if (ret == -ENFILE && if_nametoindex(ifname)) { 4060 wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname); 4061 4062 /* Try to remove the interface that was already there. */ 4063 nl80211_remove_iface(drv, if_nametoindex(ifname)); 4064 4065 /* Try to create the interface again */ 4066 ret = nl80211_create_iface_once(drv, ifname, iftype, addr, 4067 wds); 4068 } 4069 4070 if (ret >= 0 && drv->disable_11b_rates) 4071 nl80211_disable_11b_rates(drv, ret, 1); 4072 4073 return ret; 4074} 4075 4076 4077static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok) 4078{ 4079 struct ieee80211_hdr *hdr; 4080 u16 fc; 4081 union wpa_event_data event; 4082 4083 hdr = (struct ieee80211_hdr *) buf; 4084 fc = le_to_host16(hdr->frame_control); 4085 4086 os_memset(&event, 0, sizeof(event)); 4087 event.tx_status.type = WLAN_FC_GET_TYPE(fc); 4088 event.tx_status.stype = WLAN_FC_GET_STYPE(fc); 4089 event.tx_status.dst = hdr->addr1; 4090 event.tx_status.data = buf; 4091 event.tx_status.data_len = len; 4092 event.tx_status.ack = ok; 4093 wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event); 4094} 4095 4096 4097static void from_unknown_sta(struct wpa_driver_nl80211_data *drv, 4098 u8 *buf, size_t len) 4099{ 4100 union wpa_event_data event; 4101 os_memset(&event, 0, sizeof(event)); 4102 event.rx_from_unknown.frame = buf; 4103 event.rx_from_unknown.len = len; 4104 wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event); 4105} 4106 4107 4108static void handle_frame(struct wpa_driver_nl80211_data *drv, 4109 u8 *buf, size_t len, int datarate, int ssi_signal) 4110{ 4111 struct ieee80211_hdr *hdr; 4112 u16 fc; 4113 union wpa_event_data event; 4114 4115 hdr = (struct ieee80211_hdr *) buf; 4116 fc = le_to_host16(hdr->frame_control); 4117 4118 switch (WLAN_FC_GET_TYPE(fc)) { 4119 case WLAN_FC_TYPE_MGMT: 4120 os_memset(&event, 0, sizeof(event)); 4121 event.rx_mgmt.frame = buf; 4122 event.rx_mgmt.frame_len = len; 4123 event.rx_mgmt.datarate = datarate; 4124 event.rx_mgmt.ssi_signal = ssi_signal; 4125 wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event); 4126 break; 4127 case WLAN_FC_TYPE_CTRL: 4128 /* can only get here with PS-Poll frames */ 4129 wpa_printf(MSG_DEBUG, "CTRL"); 4130 from_unknown_sta(drv, buf, len); 4131 break; 4132 case WLAN_FC_TYPE_DATA: 4133 from_unknown_sta(drv, buf, len); 4134 break; 4135 } 4136} 4137 4138 4139static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx) 4140{ 4141 struct wpa_driver_nl80211_data *drv = eloop_ctx; 4142 int len; 4143 unsigned char buf[3000]; 4144 struct ieee80211_radiotap_iterator iter; 4145 int ret; 4146 int datarate = 0, ssi_signal = 0; 4147 int injected = 0, failed = 0, rxflags = 0; 4148 4149 len = recv(sock, buf, sizeof(buf), 0); 4150 if (len < 0) { 4151 perror("recv"); 4152 return; 4153 } 4154 4155 if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) { 4156 printf("received invalid radiotap frame\n"); 4157 return; 4158 } 4159 4160 while (1) { 4161 ret = ieee80211_radiotap_iterator_next(&iter); 4162 if (ret == -ENOENT) 4163 break; 4164 if (ret) { 4165 printf("received invalid radiotap frame (%d)\n", ret); 4166 return; 4167 } 4168 switch (iter.this_arg_index) { 4169 case IEEE80211_RADIOTAP_FLAGS: 4170 if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS) 4171 len -= 4; 4172 break; 4173 case IEEE80211_RADIOTAP_RX_FLAGS: 4174 rxflags = 1; 4175 break; 4176 case IEEE80211_RADIOTAP_TX_FLAGS: 4177 injected = 1; 4178 failed = le_to_host16((*(uint16_t *) iter.this_arg)) & 4179 IEEE80211_RADIOTAP_F_TX_FAIL; 4180 break; 4181 case IEEE80211_RADIOTAP_DATA_RETRIES: 4182 break; 4183 case IEEE80211_RADIOTAP_CHANNEL: 4184 /* TODO: convert from freq/flags to channel number */ 4185 break; 4186 case IEEE80211_RADIOTAP_RATE: 4187 datarate = *iter.this_arg * 5; 4188 break; 4189 case IEEE80211_RADIOTAP_DB_ANTSIGNAL: 4190 ssi_signal = *iter.this_arg; 4191 break; 4192 } 4193 } 4194 4195 if (rxflags && injected) 4196 return; 4197 4198 if (!injected) 4199 handle_frame(drv, buf + iter.max_length, 4200 len - iter.max_length, datarate, ssi_signal); 4201 else 4202 handle_tx_callback(drv->ctx, buf + iter.max_length, 4203 len - iter.max_length, !failed); 4204} 4205 4206 4207/* 4208 * we post-process the filter code later and rewrite 4209 * this to the offset to the last instruction 4210 */ 4211#define PASS 0xFF 4212#define FAIL 0xFE 4213 4214static struct sock_filter msock_filter_insns[] = { 4215 /* 4216 * do a little-endian load of the radiotap length field 4217 */ 4218 /* load lower byte into A */ 4219 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2), 4220 /* put it into X (== index register) */ 4221 BPF_STMT(BPF_MISC| BPF_TAX, 0), 4222 /* load upper byte into A */ 4223 BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 3), 4224 /* left-shift it by 8 */ 4225 BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8), 4226 /* or with X */ 4227 BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0), 4228 /* put result into X */ 4229 BPF_STMT(BPF_MISC| BPF_TAX, 0), 4230 4231 /* 4232 * Allow management frames through, this also gives us those 4233 * management frames that we sent ourselves with status 4234 */ 4235 /* load the lower byte of the IEEE 802.11 frame control field */ 4236 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 4237 /* mask off frame type and version */ 4238 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF), 4239 /* accept frame if it's both 0, fall through otherwise */ 4240 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0), 4241 4242 /* 4243 * TODO: add a bit to radiotap RX flags that indicates 4244 * that the sending station is not associated, then 4245 * add a filter here that filters on our DA and that flag 4246 * to allow us to deauth frames to that bad station. 4247 * 4248 * For now allow all To DS data frames through. 4249 */ 4250 /* load the IEEE 802.11 frame control field */ 4251 BPF_STMT(BPF_LD | BPF_H | BPF_IND, 0), 4252 /* mask off frame type, version and DS status */ 4253 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0F03), 4254 /* accept frame if version 0, type 2 and To DS, fall through otherwise 4255 */ 4256 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0801, PASS, 0), 4257 4258#if 0 4259 /* 4260 * drop non-data frames 4261 */ 4262 /* load the lower byte of the frame control field */ 4263 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 4264 /* mask off QoS bit */ 4265 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0c), 4266 /* drop non-data frames */ 4267 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 8, 0, FAIL), 4268#endif 4269 /* load the upper byte of the frame control field */ 4270 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 1), 4271 /* mask off toDS/fromDS */ 4272 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x03), 4273 /* accept WDS frames */ 4274 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, PASS, 0), 4275 4276 /* 4277 * add header length to index 4278 */ 4279 /* load the lower byte of the frame control field */ 4280 BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), 4281 /* mask off QoS bit */ 4282 BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x80), 4283 /* right shift it by 6 to give 0 or 2 */ 4284 BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 6), 4285 /* add data frame header length */ 4286 BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 24), 4287 /* add index, was start of 802.11 header */ 4288 BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0), 4289 /* move to index, now start of LL header */ 4290 BPF_STMT(BPF_MISC | BPF_TAX, 0), 4291 4292 /* 4293 * Accept empty data frames, we use those for 4294 * polling activity. 4295 */ 4296 BPF_STMT(BPF_LD | BPF_W | BPF_LEN, 0), 4297 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0), 4298 4299 /* 4300 * Accept EAPOL frames 4301 */ 4302 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 0), 4303 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL), 4304 BPF_STMT(BPF_LD | BPF_W | BPF_IND, 4), 4305 BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL), 4306 4307 /* keep these last two statements or change the code below */ 4308 /* return 0 == "DROP" */ 4309 BPF_STMT(BPF_RET | BPF_K, 0), 4310 /* return ~0 == "keep all" */ 4311 BPF_STMT(BPF_RET | BPF_K, ~0), 4312}; 4313 4314static struct sock_fprog msock_filter = { 4315 .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]), 4316 .filter = msock_filter_insns, 4317}; 4318 4319 4320static int add_monitor_filter(int s) 4321{ 4322 int idx; 4323 4324 /* rewrite all PASS/FAIL jump offsets */ 4325 for (idx = 0; idx < msock_filter.len; idx++) { 4326 struct sock_filter *insn = &msock_filter_insns[idx]; 4327 4328 if (BPF_CLASS(insn->code) == BPF_JMP) { 4329 if (insn->code == (BPF_JMP|BPF_JA)) { 4330 if (insn->k == PASS) 4331 insn->k = msock_filter.len - idx - 2; 4332 else if (insn->k == FAIL) 4333 insn->k = msock_filter.len - idx - 3; 4334 } 4335 4336 if (insn->jt == PASS) 4337 insn->jt = msock_filter.len - idx - 2; 4338 else if (insn->jt == FAIL) 4339 insn->jt = msock_filter.len - idx - 3; 4340 4341 if (insn->jf == PASS) 4342 insn->jf = msock_filter.len - idx - 2; 4343 else if (insn->jf == FAIL) 4344 insn->jf = msock_filter.len - idx - 3; 4345 } 4346 } 4347 4348 if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, 4349 &msock_filter, sizeof(msock_filter))) { 4350 perror("SO_ATTACH_FILTER"); 4351 return -1; 4352 } 4353 4354 return 0; 4355} 4356 4357 4358static void nl80211_remove_monitor_interface( 4359 struct wpa_driver_nl80211_data *drv) 4360{ 4361 if (drv->monitor_ifidx >= 0) { 4362 nl80211_remove_iface(drv, drv->monitor_ifidx); 4363 drv->monitor_ifidx = -1; 4364 } 4365 if (drv->monitor_sock >= 0) { 4366 eloop_unregister_read_sock(drv->monitor_sock); 4367 close(drv->monitor_sock); 4368 drv->monitor_sock = -1; 4369 } 4370} 4371 4372 4373static int 4374nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv) 4375{ 4376 char buf[IFNAMSIZ]; 4377 struct sockaddr_ll ll; 4378 int optval; 4379 socklen_t optlen; 4380#ifdef ANDROID_BRCM_P2P_PATCH 4381 snprintf(buf, IFNAMSIZ, "%s%s", WPA_MONITOR_IFNAME_PREFIX, drv->first_bss.ifname); 4382#else 4383 snprintf(buf, IFNAMSIZ, "mon.%s", drv->first_bss.ifname); 4384#endif 4385 buf[IFNAMSIZ - 1] = '\0'; 4386 4387 drv->monitor_ifidx = 4388 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL, 4389 0); 4390 4391 if (drv->monitor_ifidx == -EOPNOTSUPP) { 4392 wpa_printf(MSG_DEBUG, "nl80211: Driver does not support " 4393 "monitor interface type - try to run without it"); 4394 drv->no_monitor_iface_capab = 1; 4395 } 4396 4397 if (drv->monitor_ifidx < 0) 4398 return -1; 4399 4400 if (linux_set_iface_flags(drv->ioctl_sock, buf, 1)) 4401 goto error; 4402 4403 memset(&ll, 0, sizeof(ll)); 4404 ll.sll_family = AF_PACKET; 4405 ll.sll_ifindex = drv->monitor_ifidx; 4406 drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); 4407 if (drv->monitor_sock < 0) { 4408 perror("socket[PF_PACKET,SOCK_RAW]"); 4409 goto error; 4410 } 4411 4412 if (add_monitor_filter(drv->monitor_sock)) { 4413 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor " 4414 "interface; do filtering in user space"); 4415 /* This works, but will cost in performance. */ 4416 } 4417 4418 if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) { 4419 perror("monitor socket bind"); 4420 goto error; 4421 } 4422 4423 optlen = sizeof(optval); 4424 optval = 20; 4425 if (setsockopt 4426 (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) { 4427 perror("Failed to set socket priority"); 4428 goto error; 4429 } 4430 4431 if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read, 4432 drv, NULL)) { 4433 printf("Could not register monitor read socket\n"); 4434 goto error; 4435 } 4436 4437 return 0; 4438 error: 4439 nl80211_remove_monitor_interface(drv); 4440 return -1; 4441} 4442 4443 4444static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; 4445 4446static int wpa_driver_nl80211_hapd_send_eapol( 4447 void *priv, const u8 *addr, const u8 *data, 4448 size_t data_len, int encrypt, const u8 *own_addr, u32 flags) 4449{ 4450 struct i802_bss *bss = priv; 4451 struct wpa_driver_nl80211_data *drv = bss->drv; 4452 struct ieee80211_hdr *hdr; 4453 size_t len; 4454 u8 *pos; 4455 int res; 4456 int qos = flags & WPA_STA_WMM; 4457 4458 len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 + 4459 data_len; 4460 hdr = os_zalloc(len); 4461 if (hdr == NULL) { 4462 printf("malloc() failed for i802_send_data(len=%lu)\n", 4463 (unsigned long) len); 4464 return -1; 4465 } 4466 4467 hdr->frame_control = 4468 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA); 4469 hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS); 4470 if (encrypt) 4471 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP); 4472 if (qos) { 4473 hdr->frame_control |= 4474 host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4); 4475 } 4476 4477 memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN); 4478 memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN); 4479 memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN); 4480 pos = (u8 *) (hdr + 1); 4481 4482 if (qos) { 4483 /* add an empty QoS header if needed */ 4484 pos[0] = 0; 4485 pos[1] = 0; 4486 pos += 2; 4487 } 4488 4489 memcpy(pos, rfc1042_header, sizeof(rfc1042_header)); 4490 pos += sizeof(rfc1042_header); 4491 WPA_PUT_BE16(pos, ETH_P_PAE); 4492 pos += 2; 4493 memcpy(pos, data, data_len); 4494 4495 res = wpa_driver_nl80211_send_frame(drv, (u8 *) hdr, len, encrypt); 4496 if (res < 0) { 4497 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - " 4498 "failed: %d (%s)", 4499 (unsigned long) len, errno, strerror(errno)); 4500 } 4501 os_free(hdr); 4502 4503 return res; 4504} 4505 4506 4507static u32 sta_flags_nl80211(int flags) 4508{ 4509 u32 f = 0; 4510 4511 if (flags & WPA_STA_AUTHORIZED) 4512 f |= BIT(NL80211_STA_FLAG_AUTHORIZED); 4513 if (flags & WPA_STA_WMM) 4514 f |= BIT(NL80211_STA_FLAG_WME); 4515 if (flags & WPA_STA_SHORT_PREAMBLE) 4516 f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE); 4517 if (flags & WPA_STA_MFP) 4518 f |= BIT(NL80211_STA_FLAG_MFP); 4519 4520 return f; 4521} 4522 4523 4524static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr, 4525 int total_flags, 4526 int flags_or, int flags_and) 4527{ 4528 struct i802_bss *bss = priv; 4529 struct wpa_driver_nl80211_data *drv = bss->drv; 4530 struct nl_msg *msg, *flags = NULL; 4531 struct nl80211_sta_flag_update upd; 4532 4533 msg = nlmsg_alloc(); 4534 if (!msg) 4535 return -ENOMEM; 4536 4537 flags = nlmsg_alloc(); 4538 if (!flags) { 4539 nlmsg_free(msg); 4540 return -ENOMEM; 4541 } 4542 4543 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 4544 0, NL80211_CMD_SET_STATION, 0); 4545 4546 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, 4547 if_nametoindex(bss->ifname)); 4548 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 4549 4550 /* 4551 * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This 4552 * can be removed eventually. 4553 */ 4554 if (total_flags & WPA_STA_AUTHORIZED) 4555 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED); 4556 4557 if (total_flags & WPA_STA_WMM) 4558 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME); 4559 4560 if (total_flags & WPA_STA_SHORT_PREAMBLE) 4561 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE); 4562 4563 if (total_flags & WPA_STA_MFP) 4564 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP); 4565 4566 if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags)) 4567 goto nla_put_failure; 4568 4569 os_memset(&upd, 0, sizeof(upd)); 4570 upd.mask = sta_flags_nl80211(flags_or | ~flags_and); 4571 upd.set = sta_flags_nl80211(flags_or); 4572 NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd); 4573 4574 nlmsg_free(flags); 4575 4576 return send_and_recv_msgs(drv, msg, NULL, NULL); 4577 nla_put_failure: 4578 nlmsg_free(flags); 4579 return -ENOBUFS; 4580} 4581 4582 4583static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv, 4584 struct wpa_driver_associate_params *params) 4585{ 4586 if (params->p2p) 4587 wpa_printf(MSG_DEBUG, "nl80211: Setup AP operations for P2P " 4588 "group (GO)"); 4589 if (wpa_driver_nl80211_set_mode(&drv->first_bss, params->mode) || 4590 wpa_driver_nl80211_set_freq(drv, params->freq, 0, 0)) { 4591 nl80211_remove_monitor_interface(drv); 4592 return -1; 4593 } 4594 4595 /* TODO: setup monitor interface (and add code somewhere to remove this 4596 * when AP mode is stopped; associate with mode != 2 or drv_deinit) */ 4597 wpa_printf(MSG_DEBUG, "nl80211: Update ap_oper_freq with params->freq %d", params->freq); 4598 drv->ap_oper_freq = params->freq; 4599 4600 return 0; 4601} 4602 4603 4604static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv) 4605{ 4606 struct nl_msg *msg; 4607 int ret = -1; 4608 4609 msg = nlmsg_alloc(); 4610 if (!msg) 4611 return -1; 4612 4613 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 4614 NL80211_CMD_LEAVE_IBSS, 0); 4615 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 4616 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 4617 msg = NULL; 4618 if (ret) { 4619 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d " 4620 "(%s)", ret, strerror(-ret)); 4621 goto nla_put_failure; 4622 } 4623 4624 ret = 0; 4625 wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully"); 4626 4627nla_put_failure: 4628 nlmsg_free(msg); 4629 return ret; 4630} 4631 4632 4633static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv, 4634 struct wpa_driver_associate_params *params) 4635{ 4636 struct nl_msg *msg; 4637 int ret = -1; 4638 int count = 0; 4639 4640 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex); 4641 4642 if (wpa_driver_nl80211_set_mode(&drv->first_bss, params->mode)) { 4643 wpa_printf(MSG_INFO, "nl80211: Failed to set interface into " 4644 "IBSS mode"); 4645 return -1; 4646 } 4647 4648retry: 4649 msg = nlmsg_alloc(); 4650 if (!msg) 4651 return -1; 4652 4653 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 4654 NL80211_CMD_JOIN_IBSS, 0); 4655 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 4656 4657 if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid)) 4658 goto nla_put_failure; 4659 4660 wpa_hexdump_ascii(MSG_DEBUG, " * SSID", 4661 params->ssid, params->ssid_len); 4662 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, 4663 params->ssid); 4664 os_memcpy(drv->ssid, params->ssid, params->ssid_len); 4665 drv->ssid_len = params->ssid_len; 4666 4667 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); 4668 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); 4669 4670 ret = nl80211_set_conn_keys(params, msg); 4671 if (ret) 4672 goto nla_put_failure; 4673 4674 if (params->wpa_ie) { 4675 wpa_hexdump(MSG_DEBUG, 4676 " * Extra IEs for Beacon/Probe Response frames", 4677 params->wpa_ie, params->wpa_ie_len); 4678 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, 4679 params->wpa_ie); 4680 } 4681 4682 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 4683 msg = NULL; 4684 if (ret) { 4685 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)", 4686 ret, strerror(-ret)); 4687 count++; 4688 if (ret == -EALREADY && count == 1) { 4689 wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after " 4690 "forced leave"); 4691 nl80211_leave_ibss(drv); 4692 nlmsg_free(msg); 4693 goto retry; 4694 } 4695 4696 goto nla_put_failure; 4697 } 4698 ret = 0; 4699 wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully"); 4700 4701nla_put_failure: 4702 nlmsg_free(msg); 4703 return ret; 4704} 4705 4706 4707static int wpa_driver_nl80211_connect( 4708 struct wpa_driver_nl80211_data *drv, 4709 struct wpa_driver_associate_params *params) 4710{ 4711 struct nl_msg *msg; 4712 enum nl80211_auth_type type; 4713 int ret = 0; 4714 int algs; 4715 4716 msg = nlmsg_alloc(); 4717 if (!msg) 4718 return -1; 4719 4720 wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex); 4721 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 4722 NL80211_CMD_CONNECT, 0); 4723 4724 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 4725 if (params->bssid) { 4726 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, 4727 MAC2STR(params->bssid)); 4728 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); 4729 } 4730 if (params->freq) { 4731 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); 4732 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); 4733 } 4734 if (params->ssid) { 4735 wpa_hexdump_ascii(MSG_DEBUG, " * SSID", 4736 params->ssid, params->ssid_len); 4737 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, 4738 params->ssid); 4739 if (params->ssid_len > sizeof(drv->ssid)) 4740 goto nla_put_failure; 4741 os_memcpy(drv->ssid, params->ssid, params->ssid_len); 4742 drv->ssid_len = params->ssid_len; 4743 } 4744 wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len); 4745 if (params->wpa_ie) 4746 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, 4747 params->wpa_ie); 4748 4749 algs = 0; 4750 if (params->auth_alg & WPA_AUTH_ALG_OPEN) 4751 algs++; 4752 if (params->auth_alg & WPA_AUTH_ALG_SHARED) 4753 algs++; 4754 if (params->auth_alg & WPA_AUTH_ALG_LEAP) 4755 algs++; 4756 if (algs > 1) { 4757 wpa_printf(MSG_DEBUG, " * Leave out Auth Type for automatic " 4758 "selection"); 4759 goto skip_auth_type; 4760 } 4761 4762 if (params->auth_alg & WPA_AUTH_ALG_OPEN) 4763 type = NL80211_AUTHTYPE_OPEN_SYSTEM; 4764 else if (params->auth_alg & WPA_AUTH_ALG_SHARED) 4765 type = NL80211_AUTHTYPE_SHARED_KEY; 4766 else if (params->auth_alg & WPA_AUTH_ALG_LEAP) 4767 type = NL80211_AUTHTYPE_NETWORK_EAP; 4768 else if (params->auth_alg & WPA_AUTH_ALG_FT) 4769 type = NL80211_AUTHTYPE_FT; 4770 else 4771 goto nla_put_failure; 4772 4773 wpa_printf(MSG_DEBUG, " * Auth Type %d", type); 4774 NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type); 4775 4776skip_auth_type: 4777 if (params->wpa_ie && params->wpa_ie_len) { 4778 enum nl80211_wpa_versions ver; 4779 4780 if (params->wpa_ie[0] == WLAN_EID_RSN) 4781 ver = NL80211_WPA_VERSION_2; 4782 else 4783 ver = NL80211_WPA_VERSION_1; 4784 4785 wpa_printf(MSG_DEBUG, " * WPA Version %d", ver); 4786 NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver); 4787 } 4788 4789 if (params->pairwise_suite != CIPHER_NONE) { 4790 int cipher; 4791 4792 switch (params->pairwise_suite) { 4793 case CIPHER_WEP40: 4794 cipher = WLAN_CIPHER_SUITE_WEP40; 4795 break; 4796 case CIPHER_WEP104: 4797 cipher = WLAN_CIPHER_SUITE_WEP104; 4798 break; 4799 case CIPHER_CCMP: 4800 cipher = WLAN_CIPHER_SUITE_CCMP; 4801 break; 4802 case CIPHER_TKIP: 4803 default: 4804 cipher = WLAN_CIPHER_SUITE_TKIP; 4805 break; 4806 } 4807 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher); 4808 } 4809 4810 if (params->group_suite != CIPHER_NONE) { 4811 int cipher; 4812 4813 switch (params->group_suite) { 4814 case CIPHER_WEP40: 4815 cipher = WLAN_CIPHER_SUITE_WEP40; 4816 break; 4817 case CIPHER_WEP104: 4818 cipher = WLAN_CIPHER_SUITE_WEP104; 4819 break; 4820 case CIPHER_CCMP: 4821 cipher = WLAN_CIPHER_SUITE_CCMP; 4822 break; 4823 case CIPHER_TKIP: 4824 default: 4825 cipher = WLAN_CIPHER_SUITE_TKIP; 4826 break; 4827 } 4828 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher); 4829 } 4830 4831 if (params->key_mgmt_suite == KEY_MGMT_802_1X || 4832 params->key_mgmt_suite == KEY_MGMT_PSK) { 4833 int mgmt = WLAN_AKM_SUITE_PSK; 4834 4835 switch (params->key_mgmt_suite) { 4836 case KEY_MGMT_802_1X: 4837 mgmt = WLAN_AKM_SUITE_8021X; 4838 break; 4839 case KEY_MGMT_PSK: 4840 default: 4841 mgmt = WLAN_AKM_SUITE_PSK; 4842 break; 4843 } 4844 NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt); 4845 } 4846 4847 ret = nl80211_set_conn_keys(params, msg); 4848 if (ret) 4849 goto nla_put_failure; 4850 4851 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 4852 msg = NULL; 4853 if (ret) { 4854 wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d " 4855 "(%s)", ret, strerror(-ret)); 4856 goto nla_put_failure; 4857 } 4858 ret = 0; 4859 wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully"); 4860 4861nla_put_failure: 4862 nlmsg_free(msg); 4863 return ret; 4864 4865} 4866 4867 4868static int wpa_driver_nl80211_associate( 4869 void *priv, struct wpa_driver_associate_params *params) 4870{ 4871 struct i802_bss *bss = priv; 4872 struct wpa_driver_nl80211_data *drv = bss->drv; 4873 int ret = -1; 4874 struct nl_msg *msg; 4875 4876 if (params->mode == IEEE80211_MODE_AP) 4877 return wpa_driver_nl80211_ap(drv, params); 4878 4879 if (params->mode == IEEE80211_MODE_IBSS) 4880 return wpa_driver_nl80211_ibss(drv, params); 4881 4882 if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) { 4883 if (wpa_driver_nl80211_set_mode(priv, params->mode) < 0) 4884 return -1; 4885 return wpa_driver_nl80211_connect(drv, params); 4886 } 4887 4888 drv->associated = 0; 4889 4890 msg = nlmsg_alloc(); 4891 if (!msg) 4892 return -1; 4893 4894 wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)", 4895 drv->ifindex); 4896 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 4897 NL80211_CMD_ASSOCIATE, 0); 4898 4899 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 4900 if (params->bssid) { 4901 wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, 4902 MAC2STR(params->bssid)); 4903 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); 4904 } 4905 if (params->freq) { 4906 wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); 4907 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); 4908 drv->assoc_freq = params->freq; 4909 } else 4910 drv->assoc_freq = 0; 4911 if (params->ssid) { 4912 wpa_hexdump_ascii(MSG_DEBUG, " * SSID", 4913 params->ssid, params->ssid_len); 4914 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, 4915 params->ssid); 4916 if (params->ssid_len > sizeof(drv->ssid)) 4917 goto nla_put_failure; 4918 os_memcpy(drv->ssid, params->ssid, params->ssid_len); 4919 drv->ssid_len = params->ssid_len; 4920 } 4921 wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len); 4922 if (params->wpa_ie) 4923 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, 4924 params->wpa_ie); 4925 4926 if (params->pairwise_suite != CIPHER_NONE) { 4927 int cipher; 4928 4929 switch (params->pairwise_suite) { 4930 case CIPHER_WEP40: 4931 cipher = WLAN_CIPHER_SUITE_WEP40; 4932 break; 4933 case CIPHER_WEP104: 4934 cipher = WLAN_CIPHER_SUITE_WEP104; 4935 break; 4936 case CIPHER_CCMP: 4937 cipher = WLAN_CIPHER_SUITE_CCMP; 4938 break; 4939 case CIPHER_TKIP: 4940 default: 4941 cipher = WLAN_CIPHER_SUITE_TKIP; 4942 break; 4943 } 4944 wpa_printf(MSG_DEBUG, " * pairwise=0x%x", cipher); 4945 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher); 4946 } 4947 4948 if (params->group_suite != CIPHER_NONE) { 4949 int cipher; 4950 4951 switch (params->group_suite) { 4952 case CIPHER_WEP40: 4953 cipher = WLAN_CIPHER_SUITE_WEP40; 4954 break; 4955 case CIPHER_WEP104: 4956 cipher = WLAN_CIPHER_SUITE_WEP104; 4957 break; 4958 case CIPHER_CCMP: 4959 cipher = WLAN_CIPHER_SUITE_CCMP; 4960 break; 4961 case CIPHER_TKIP: 4962 default: 4963 cipher = WLAN_CIPHER_SUITE_TKIP; 4964 break; 4965 } 4966 wpa_printf(MSG_DEBUG, " * group=0x%x", cipher); 4967 NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher); 4968 } 4969 4970#ifdef CONFIG_IEEE80211W 4971 if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED) 4972 NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED); 4973#endif /* CONFIG_IEEE80211W */ 4974 4975 NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT); 4976 4977 if (params->prev_bssid) { 4978 wpa_printf(MSG_DEBUG, " * prev_bssid=" MACSTR, 4979 MAC2STR(params->prev_bssid)); 4980 NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN, 4981 params->prev_bssid); 4982 } 4983 4984 if (params->p2p) 4985 wpa_printf(MSG_DEBUG, " * P2P group"); 4986 4987 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 4988 msg = NULL; 4989 if (ret) { 4990 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " 4991 "(%s)", ret, strerror(-ret)); 4992 nl80211_dump_scan(drv); 4993 goto nla_put_failure; 4994 } 4995 ret = 0; 4996 wpa_printf(MSG_DEBUG, "nl80211: Association request send " 4997 "successfully"); 4998 4999nla_put_failure: 5000 nlmsg_free(msg); 5001 return ret; 5002} 5003 5004 5005static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv, 5006 int ifindex, int mode) 5007{ 5008 struct nl_msg *msg; 5009 int ret = -ENOBUFS; 5010 5011 msg = nlmsg_alloc(); 5012 if (!msg) 5013 return -ENOMEM; 5014 5015 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5016 0, NL80211_CMD_SET_INTERFACE, 0); 5017 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); 5018 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode); 5019 5020 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 5021 if (!ret) 5022 return 0; 5023nla_put_failure: 5024 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:" 5025 " %d (%s)", ifindex, mode, ret, strerror(-ret)); 5026 return ret; 5027} 5028 5029 5030static int wpa_driver_nl80211_set_mode(void *priv, int mode) 5031{ 5032 struct i802_bss *bss = priv; 5033 struct wpa_driver_nl80211_data *drv = bss->drv; 5034 int ret = -1; 5035 int nlmode; 5036 int i; 5037 5038 switch (mode) { 5039 case 0: 5040 nlmode = NL80211_IFTYPE_STATION; 5041 break; 5042 case 1: 5043 nlmode = NL80211_IFTYPE_ADHOC; 5044 break; 5045 case 2: 5046 nlmode = NL80211_IFTYPE_AP; 5047 break; 5048 default: 5049 return -1; 5050 } 5051 5052 if (nl80211_set_mode(drv, drv->ifindex, nlmode) == 0) { 5053 drv->nlmode = nlmode; 5054 ret = 0; 5055 goto done; 5056 } 5057 5058 if (nlmode == drv->nlmode) { 5059 wpa_printf(MSG_DEBUG, "nl80211: Interface already in " 5060 "requested mode - ignore error"); 5061 ret = 0; 5062 goto done; /* Already in the requested mode */ 5063 } 5064 5065 /* mac80211 doesn't allow mode changes while the device is up, so 5066 * take the device down, try to set the mode again, and bring the 5067 * device back up. 5068 */ 5069 wpa_printf(MSG_DEBUG, "nl80211: Try mode change after setting " 5070 "interface down"); 5071 for (i = 0; i < 10; i++) { 5072 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0) == 5073 0) { 5074 /* Try to set the mode again while the interface is 5075 * down */ 5076 ret = nl80211_set_mode(drv, drv->ifindex, nlmode); 5077 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 5078 1)) 5079 ret = -1; 5080 if (!ret) 5081 break; 5082 } else 5083 wpa_printf(MSG_DEBUG, "nl80211: Failed to set " 5084 "interface down"); 5085 os_sleep(0, 100000); 5086 } 5087 5088 if (!ret) { 5089 wpa_printf(MSG_DEBUG, "nl80211: Mode change succeeded while " 5090 "interface is down"); 5091 drv->nlmode = nlmode; 5092 } 5093 5094done: 5095 if (!ret && nlmode == NL80211_IFTYPE_AP) { 5096 /* Setup additional AP mode functionality if needed */ 5097 if (!drv->no_monitor_iface_capab && drv->monitor_ifidx < 0 && 5098 nl80211_create_monitor_interface(drv) && 5099 !drv->no_monitor_iface_capab) 5100 return -1; 5101 } else if (!ret && nlmode != NL80211_IFTYPE_AP) { 5102 /* Remove additional AP mode functionality */ 5103 nl80211_remove_monitor_interface(drv); 5104 bss->beacon_set = 0; 5105 } 5106 5107 if (ret) 5108 wpa_printf(MSG_DEBUG, "nl80211: Interface mode change to %d " 5109 "from %d failed", nlmode, drv->nlmode); 5110 5111 return ret; 5112} 5113 5114 5115static int wpa_driver_nl80211_get_capa(void *priv, 5116 struct wpa_driver_capa *capa) 5117{ 5118 struct i802_bss *bss = priv; 5119 struct wpa_driver_nl80211_data *drv = bss->drv; 5120 if (!drv->has_capability) 5121 return -1; 5122 os_memcpy(capa, &drv->capa, sizeof(*capa)); 5123 return 0; 5124} 5125 5126 5127static int wpa_driver_nl80211_set_operstate(void *priv, int state) 5128{ 5129 struct i802_bss *bss = priv; 5130 struct wpa_driver_nl80211_data *drv = bss->drv; 5131 5132 wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)", 5133 __func__, drv->operstate, state, state ? "UP" : "DORMANT"); 5134 drv->operstate = state; 5135 return netlink_send_oper_ifla(drv->netlink, drv->ifindex, -1, 5136 state ? IF_OPER_UP : IF_OPER_DORMANT); 5137} 5138 5139 5140static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized) 5141{ 5142 struct i802_bss *bss = priv; 5143 struct wpa_driver_nl80211_data *drv = bss->drv; 5144 struct nl_msg *msg; 5145 struct nl80211_sta_flag_update upd; 5146 5147 msg = nlmsg_alloc(); 5148 if (!msg) 5149 return -ENOMEM; 5150 5151 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5152 0, NL80211_CMD_SET_STATION, 0); 5153 5154 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, 5155 if_nametoindex(bss->ifname)); 5156 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid); 5157 5158 os_memset(&upd, 0, sizeof(upd)); 5159 upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED); 5160 if (authorized) 5161 upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED); 5162 NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd); 5163 5164 return send_and_recv_msgs(drv, msg, NULL, NULL); 5165 nla_put_failure: 5166 return -ENOBUFS; 5167} 5168 5169 5170/* Set kernel driver on given frequency (MHz) */ 5171static int i802_set_freq(void *priv, struct hostapd_freq_params *freq) 5172{ 5173 struct i802_bss *bss = priv; 5174 struct wpa_driver_nl80211_data *drv = bss->drv; 5175 return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled, 5176 freq->sec_channel_offset); 5177} 5178 5179 5180#if defined(HOSTAPD) || defined(CONFIG_AP) 5181 5182static inline int min_int(int a, int b) 5183{ 5184 if (a < b) 5185 return a; 5186 return b; 5187} 5188 5189 5190static int get_key_handler(struct nl_msg *msg, void *arg) 5191{ 5192 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 5193 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 5194 5195 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 5196 genlmsg_attrlen(gnlh, 0), NULL); 5197 5198 /* 5199 * TODO: validate the key index and mac address! 5200 * Otherwise, there's a race condition as soon as 5201 * the kernel starts sending key notifications. 5202 */ 5203 5204 if (tb[NL80211_ATTR_KEY_SEQ]) 5205 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]), 5206 min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6)); 5207 return NL_SKIP; 5208} 5209 5210 5211static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr, 5212 int idx, u8 *seq) 5213{ 5214 struct i802_bss *bss = priv; 5215 struct wpa_driver_nl80211_data *drv = bss->drv; 5216 struct nl_msg *msg; 5217 5218 msg = nlmsg_alloc(); 5219 if (!msg) 5220 return -ENOMEM; 5221 5222 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5223 0, NL80211_CMD_GET_KEY, 0); 5224 5225 if (addr) 5226 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 5227 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx); 5228 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface)); 5229 5230 memset(seq, 0, 6); 5231 5232 return send_and_recv_msgs(drv, msg, get_key_handler, seq); 5233 nla_put_failure: 5234 return -ENOBUFS; 5235} 5236 5237 5238static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates, 5239 int mode) 5240{ 5241 struct i802_bss *bss = priv; 5242 struct wpa_driver_nl80211_data *drv = bss->drv; 5243 struct nl_msg *msg; 5244 u8 rates[NL80211_MAX_SUPP_RATES]; 5245 u8 rates_len = 0; 5246 int i; 5247 5248 msg = nlmsg_alloc(); 5249 if (!msg) 5250 return -ENOMEM; 5251 5252 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 5253 NL80211_CMD_SET_BSS, 0); 5254 5255 for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++) 5256 rates[rates_len++] = basic_rates[i] / 5; 5257 5258 NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates); 5259 5260 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 5261 5262 return send_and_recv_msgs(drv, msg, NULL, NULL); 5263 nla_put_failure: 5264 return -ENOBUFS; 5265} 5266 5267 5268static int i802_set_rts(void *priv, int rts) 5269{ 5270 struct i802_bss *bss = priv; 5271 struct wpa_driver_nl80211_data *drv = bss->drv; 5272 struct nl_msg *msg; 5273 int ret = -ENOBUFS; 5274 u32 val; 5275 5276 msg = nlmsg_alloc(); 5277 if (!msg) 5278 return -ENOMEM; 5279 5280 if (rts >= 2347) 5281 val = (u32) -1; 5282 else 5283 val = rts; 5284 5285 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5286 0, NL80211_CMD_SET_WIPHY, 0); 5287 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 5288 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val); 5289 5290 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 5291 if (!ret) 5292 return 0; 5293nla_put_failure: 5294 wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: " 5295 "%d (%s)", rts, ret, strerror(-ret)); 5296 return ret; 5297} 5298 5299 5300static int i802_set_frag(void *priv, int frag) 5301{ 5302 struct i802_bss *bss = priv; 5303 struct wpa_driver_nl80211_data *drv = bss->drv; 5304 struct nl_msg *msg; 5305 int ret = -ENOBUFS; 5306 u32 val; 5307 5308 msg = nlmsg_alloc(); 5309 if (!msg) 5310 return -ENOMEM; 5311 5312 if (frag >= 2346) 5313 val = (u32) -1; 5314 else 5315 val = frag; 5316 5317 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5318 0, NL80211_CMD_SET_WIPHY, 0); 5319 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 5320 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val); 5321 5322 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 5323 if (!ret) 5324 return 0; 5325nla_put_failure: 5326 wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold " 5327 "%d: %d (%s)", frag, ret, strerror(-ret)); 5328 return ret; 5329} 5330 5331 5332static int i802_flush(void *priv) 5333{ 5334 struct i802_bss *bss = priv; 5335 struct wpa_driver_nl80211_data *drv = bss->drv; 5336 struct nl_msg *msg; 5337 5338 msg = nlmsg_alloc(); 5339 if (!msg) 5340 return -1; 5341 5342 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5343 0, NL80211_CMD_DEL_STATION, 0); 5344 5345 /* 5346 * XXX: FIX! this needs to flush all VLANs too 5347 */ 5348 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, 5349 if_nametoindex(bss->ifname)); 5350 5351 return send_and_recv_msgs(drv, msg, NULL, NULL); 5352 nla_put_failure: 5353 return -ENOBUFS; 5354} 5355 5356 5357static int get_sta_handler(struct nl_msg *msg, void *arg) 5358{ 5359 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 5360 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 5361 struct hostap_sta_driver_data *data = arg; 5362 struct nlattr *stats[NL80211_STA_INFO_MAX + 1]; 5363 static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = { 5364 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 }, 5365 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 }, 5366 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 }, 5367 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 }, 5368 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 }, 5369 }; 5370 5371 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 5372 genlmsg_attrlen(gnlh, 0), NULL); 5373 5374 /* 5375 * TODO: validate the interface and mac address! 5376 * Otherwise, there's a race condition as soon as 5377 * the kernel starts sending station notifications. 5378 */ 5379 5380 if (!tb[NL80211_ATTR_STA_INFO]) { 5381 wpa_printf(MSG_DEBUG, "sta stats missing!"); 5382 return NL_SKIP; 5383 } 5384 if (nla_parse_nested(stats, NL80211_STA_INFO_MAX, 5385 tb[NL80211_ATTR_STA_INFO], 5386 stats_policy)) { 5387 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!"); 5388 return NL_SKIP; 5389 } 5390 5391 if (stats[NL80211_STA_INFO_INACTIVE_TIME]) 5392 data->inactive_msec = 5393 nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]); 5394 if (stats[NL80211_STA_INFO_RX_BYTES]) 5395 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]); 5396 if (stats[NL80211_STA_INFO_TX_BYTES]) 5397 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]); 5398 if (stats[NL80211_STA_INFO_RX_PACKETS]) 5399 data->rx_packets = 5400 nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]); 5401 if (stats[NL80211_STA_INFO_TX_PACKETS]) 5402 data->tx_packets = 5403 nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]); 5404 5405 return NL_SKIP; 5406} 5407 5408static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data, 5409 const u8 *addr) 5410{ 5411 struct i802_bss *bss = priv; 5412 struct wpa_driver_nl80211_data *drv = bss->drv; 5413 struct nl_msg *msg; 5414 5415 os_memset(data, 0, sizeof(*data)); 5416 msg = nlmsg_alloc(); 5417 if (!msg) 5418 return -ENOMEM; 5419 5420 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5421 0, NL80211_CMD_GET_STATION, 0); 5422 5423 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 5424 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 5425 5426 return send_and_recv_msgs(drv, msg, get_sta_handler, data); 5427 nla_put_failure: 5428 return -ENOBUFS; 5429} 5430 5431 5432static int i802_set_tx_queue_params(void *priv, int queue, int aifs, 5433 int cw_min, int cw_max, int burst_time) 5434{ 5435 struct i802_bss *bss = priv; 5436 struct wpa_driver_nl80211_data *drv = bss->drv; 5437 struct nl_msg *msg; 5438 struct nlattr *txq, *params; 5439 5440 msg = nlmsg_alloc(); 5441 if (!msg) 5442 return -1; 5443 5444 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5445 0, NL80211_CMD_SET_WIPHY, 0); 5446 5447 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 5448 5449 txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS); 5450 if (!txq) 5451 goto nla_put_failure; 5452 5453 /* We are only sending parameters for a single TXQ at a time */ 5454 params = nla_nest_start(msg, 1); 5455 if (!params) 5456 goto nla_put_failure; 5457 5458 switch (queue) { 5459 case 0: 5460 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VO); 5461 break; 5462 case 1: 5463 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_VI); 5464 break; 5465 case 2: 5466 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BE); 5467 break; 5468 case 3: 5469 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, NL80211_TXQ_Q_BK); 5470 break; 5471 } 5472 /* Burst time is configured in units of 0.1 msec and TXOP parameter in 5473 * 32 usec, so need to convert the value here. */ 5474 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32); 5475 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min); 5476 NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max); 5477 NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs); 5478 5479 nla_nest_end(msg, params); 5480 5481 nla_nest_end(msg, txq); 5482 5483 if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0) 5484 return 0; 5485 nla_put_failure: 5486 return -1; 5487} 5488 5489 5490static int i802_set_bss(void *priv, int cts, int preamble, int slot, 5491 int ht_opmode) 5492{ 5493 struct i802_bss *bss = priv; 5494 struct wpa_driver_nl80211_data *drv = bss->drv; 5495 struct nl_msg *msg; 5496 5497 msg = nlmsg_alloc(); 5498 if (!msg) 5499 return -ENOMEM; 5500 5501 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 5502 NL80211_CMD_SET_BSS, 0); 5503 5504 if (cts >= 0) 5505 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts); 5506 if (preamble >= 0) 5507 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble); 5508 if (slot >= 0) 5509 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot); 5510 if (ht_opmode >= 0) 5511 NLA_PUT_U16(msg, NL80211_ATTR_BSS_HT_OPMODE, ht_opmode); 5512 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 5513 5514 return send_and_recv_msgs(drv, msg, NULL, NULL); 5515 nla_put_failure: 5516 return -ENOBUFS; 5517} 5518 5519 5520static int i802_set_cts_protect(void *priv, int value) 5521{ 5522 return i802_set_bss(priv, value, -1, -1, -1); 5523} 5524 5525 5526static int i802_set_preamble(void *priv, int value) 5527{ 5528 return i802_set_bss(priv, -1, value, -1, -1); 5529} 5530 5531 5532static int i802_set_short_slot_time(void *priv, int value) 5533{ 5534 return i802_set_bss(priv, -1, -1, value, -1); 5535} 5536 5537 5538static int i802_set_sta_vlan(void *priv, const u8 *addr, 5539 const char *ifname, int vlan_id) 5540{ 5541 struct i802_bss *bss = priv; 5542 struct wpa_driver_nl80211_data *drv = bss->drv; 5543 struct nl_msg *msg; 5544 int ret = -ENOBUFS; 5545 5546 msg = nlmsg_alloc(); 5547 if (!msg) 5548 return -ENOMEM; 5549 5550 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 5551 0, NL80211_CMD_SET_STATION, 0); 5552 5553 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, 5554 if_nametoindex(bss->ifname)); 5555 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); 5556 NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN, 5557 if_nametoindex(ifname)); 5558 5559 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 5560 if (ret < 0) { 5561 wpa_printf(MSG_ERROR, "nl80211: NL80211_ATTR_STA_VLAN (addr=" 5562 MACSTR " ifname=%s vlan_id=%d) failed: %d (%s)", 5563 MAC2STR(addr), ifname, vlan_id, ret, 5564 strerror(-ret)); 5565 } 5566 nla_put_failure: 5567 return ret; 5568} 5569 5570 5571static int i802_set_ht_params(void *priv, const u8 *ht_capab, 5572 size_t ht_capab_len, const u8 *ht_oper, 5573 size_t ht_oper_len) 5574{ 5575 if (ht_oper_len >= 6) { 5576 /* ht opmode uses 16bit in octet 5 & 6 */ 5577 u16 ht_opmode = le_to_host16(((u16 *) ht_oper)[2]); 5578 return i802_set_bss(priv, -1, -1, -1, ht_opmode); 5579 } else 5580 return -1; 5581} 5582 5583 5584static int i802_get_inact_sec(void *priv, const u8 *addr) 5585{ 5586 struct hostap_sta_driver_data data; 5587 int ret; 5588 5589 data.inactive_msec = (unsigned long) -1; 5590 ret = i802_read_sta_data(priv, &data, addr); 5591 if (ret || data.inactive_msec == (unsigned long) -1) 5592 return -1; 5593 return data.inactive_msec / 1000; 5594} 5595 5596 5597static int i802_sta_clear_stats(void *priv, const u8 *addr) 5598{ 5599#if 0 5600 /* TODO */ 5601#endif 5602 return 0; 5603} 5604 5605 5606static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr, 5607 int reason) 5608{ 5609 struct i802_bss *bss = priv; 5610 struct ieee80211_mgmt mgmt; 5611 5612 memset(&mgmt, 0, sizeof(mgmt)); 5613 mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 5614 WLAN_FC_STYPE_DEAUTH); 5615 memcpy(mgmt.da, addr, ETH_ALEN); 5616 memcpy(mgmt.sa, own_addr, ETH_ALEN); 5617 memcpy(mgmt.bssid, own_addr, ETH_ALEN); 5618 mgmt.u.deauth.reason_code = host_to_le16(reason); 5619 return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt, 5620 IEEE80211_HDRLEN + 5621 sizeof(mgmt.u.deauth)); 5622} 5623 5624 5625static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr, 5626 int reason) 5627{ 5628 struct i802_bss *bss = priv; 5629 struct ieee80211_mgmt mgmt; 5630 5631 memset(&mgmt, 0, sizeof(mgmt)); 5632 mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, 5633 WLAN_FC_STYPE_DISASSOC); 5634 memcpy(mgmt.da, addr, ETH_ALEN); 5635 memcpy(mgmt.sa, own_addr, ETH_ALEN); 5636 memcpy(mgmt.bssid, own_addr, ETH_ALEN); 5637 mgmt.u.disassoc.reason_code = host_to_le16(reason); 5638 return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt, 5639 IEEE80211_HDRLEN + 5640 sizeof(mgmt.u.disassoc)); 5641} 5642 5643#endif /* HOSTAPD || CONFIG_AP */ 5644 5645#ifdef HOSTAPD 5646 5647static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) 5648{ 5649 int i; 5650 int *old; 5651 5652 wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d", 5653 ifidx); 5654 for (i = 0; i < drv->num_if_indices; i++) { 5655 if (drv->if_indices[i] == 0) { 5656 drv->if_indices[i] = ifidx; 5657 return; 5658 } 5659 } 5660 5661 if (drv->if_indices != drv->default_if_indices) 5662 old = drv->if_indices; 5663 else 5664 old = NULL; 5665 5666 drv->if_indices = os_realloc(old, 5667 sizeof(int) * (drv->num_if_indices + 1)); 5668 if (!drv->if_indices) { 5669 if (!old) 5670 drv->if_indices = drv->default_if_indices; 5671 else 5672 drv->if_indices = old; 5673 wpa_printf(MSG_ERROR, "Failed to reallocate memory for " 5674 "interfaces"); 5675 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx); 5676 return; 5677 } else if (!old) 5678 os_memcpy(drv->if_indices, drv->default_if_indices, 5679 sizeof(drv->default_if_indices)); 5680 drv->if_indices[drv->num_if_indices] = ifidx; 5681 drv->num_if_indices++; 5682} 5683 5684 5685static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) 5686{ 5687 int i; 5688 5689 for (i = 0; i < drv->num_if_indices; i++) { 5690 if (drv->if_indices[i] == ifidx) { 5691 drv->if_indices[i] = 0; 5692 break; 5693 } 5694 } 5695} 5696 5697 5698static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) 5699{ 5700 int i; 5701 5702 for (i = 0; i < drv->num_if_indices; i++) 5703 if (drv->if_indices[i] == ifidx) 5704 return 1; 5705 5706 return 0; 5707} 5708 5709 5710static int i802_set_wds_sta(void *priv, const u8 *addr, int aid, int val, 5711 const char *bridge_ifname) 5712{ 5713 struct i802_bss *bss = priv; 5714 struct wpa_driver_nl80211_data *drv = bss->drv; 5715 char name[IFNAMSIZ + 1]; 5716 5717 os_snprintf(name, sizeof(name), "%s.sta%d", bss->ifname, aid); 5718 wpa_printf(MSG_DEBUG, "nl80211: Set WDS STA addr=" MACSTR 5719 " aid=%d val=%d name=%s", MAC2STR(addr), aid, val, name); 5720 if (val) { 5721 if (!if_nametoindex(name)) { 5722 if (nl80211_create_iface(drv, name, 5723 NL80211_IFTYPE_AP_VLAN, 5724 NULL, 1) < 0) 5725 return -1; 5726 if (bridge_ifname && 5727 linux_br_add_if(drv->ioctl_sock, bridge_ifname, 5728 name) < 0) 5729 return -1; 5730 } 5731 linux_set_iface_flags(drv->ioctl_sock, name, 1); 5732 return i802_set_sta_vlan(priv, addr, name, 0); 5733 } else { 5734 i802_set_sta_vlan(priv, addr, bss->ifname, 0); 5735 return wpa_driver_nl80211_if_remove(priv, WPA_IF_AP_VLAN, 5736 name); 5737 } 5738} 5739 5740 5741static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx) 5742{ 5743 struct wpa_driver_nl80211_data *drv = eloop_ctx; 5744 struct sockaddr_ll lladdr; 5745 unsigned char buf[3000]; 5746 int len; 5747 socklen_t fromlen = sizeof(lladdr); 5748 5749 len = recvfrom(sock, buf, sizeof(buf), 0, 5750 (struct sockaddr *)&lladdr, &fromlen); 5751 if (len < 0) { 5752 perror("recv"); 5753 return; 5754 } 5755 5756 if (have_ifidx(drv, lladdr.sll_ifindex)) 5757 drv_event_eapol_rx(drv->ctx, lladdr.sll_addr, buf, len); 5758} 5759 5760 5761static int i802_check_bridge(struct wpa_driver_nl80211_data *drv, 5762 struct i802_bss *bss, 5763 const char *brname, const char *ifname) 5764{ 5765 int ifindex; 5766 char in_br[IFNAMSIZ]; 5767 5768 os_strlcpy(bss->brname, brname, IFNAMSIZ); 5769 ifindex = if_nametoindex(brname); 5770 if (ifindex == 0) { 5771 /* 5772 * Bridge was configured, but the bridge device does 5773 * not exist. Try to add it now. 5774 */ 5775 if (linux_br_add(drv->ioctl_sock, brname) < 0) { 5776 wpa_printf(MSG_ERROR, "nl80211: Failed to add the " 5777 "bridge interface %s: %s", 5778 brname, strerror(errno)); 5779 return -1; 5780 } 5781 bss->added_bridge = 1; 5782 add_ifidx(drv, if_nametoindex(brname)); 5783 } 5784 5785 if (linux_br_get(in_br, ifname) == 0) { 5786 if (os_strcmp(in_br, brname) == 0) 5787 return 0; /* already in the bridge */ 5788 5789 wpa_printf(MSG_DEBUG, "nl80211: Removing interface %s from " 5790 "bridge %s", ifname, in_br); 5791 if (linux_br_del_if(drv->ioctl_sock, in_br, ifname) < 0) { 5792 wpa_printf(MSG_ERROR, "nl80211: Failed to " 5793 "remove interface %s from bridge " 5794 "%s: %s", 5795 ifname, brname, strerror(errno)); 5796 return -1; 5797 } 5798 } 5799 5800 wpa_printf(MSG_DEBUG, "nl80211: Adding interface %s into bridge %s", 5801 ifname, brname); 5802 if (linux_br_add_if(drv->ioctl_sock, brname, ifname) < 0) { 5803 wpa_printf(MSG_ERROR, "nl80211: Failed to add interface %s " 5804 "into bridge %s: %s", 5805 ifname, brname, strerror(errno)); 5806 return -1; 5807 } 5808 bss->added_if_into_bridge = 1; 5809 5810 return 0; 5811} 5812 5813 5814static void *i802_init(struct hostapd_data *hapd, 5815 struct wpa_init_params *params) 5816{ 5817 struct wpa_driver_nl80211_data *drv; 5818 struct i802_bss *bss; 5819 size_t i; 5820 char brname[IFNAMSIZ]; 5821 int ifindex, br_ifindex; 5822 int br_added = 0; 5823 5824 bss = wpa_driver_nl80211_init(hapd, params->ifname, NULL); 5825 if (bss == NULL) 5826 return NULL; 5827 5828 drv = bss->drv; 5829 drv->nlmode = NL80211_IFTYPE_AP; 5830 if (linux_br_get(brname, params->ifname) == 0) { 5831 wpa_printf(MSG_DEBUG, "nl80211: Interface %s is in bridge %s", 5832 params->ifname, brname); 5833 br_ifindex = if_nametoindex(brname); 5834 } else { 5835 brname[0] = '\0'; 5836 br_ifindex = 0; 5837 } 5838 5839 drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int); 5840 drv->if_indices = drv->default_if_indices; 5841 for (i = 0; i < params->num_bridge; i++) { 5842 if (params->bridge[i]) { 5843 ifindex = if_nametoindex(params->bridge[i]); 5844 if (ifindex) 5845 add_ifidx(drv, ifindex); 5846 if (ifindex == br_ifindex) 5847 br_added = 1; 5848 } 5849 } 5850 if (!br_added && br_ifindex && 5851 (params->num_bridge == 0 || !params->bridge[0])) 5852 add_ifidx(drv, br_ifindex); 5853 5854 /* start listening for EAPOL on the default AP interface */ 5855 add_ifidx(drv, drv->ifindex); 5856 5857 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 0)) 5858 goto failed; 5859 5860 if (params->bssid) { 5861 if (linux_set_ifhwaddr(drv->ioctl_sock, bss->ifname, 5862 params->bssid)) 5863 goto failed; 5864 } 5865 5866 if (wpa_driver_nl80211_set_mode(bss, IEEE80211_MODE_AP)) { 5867 wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s " 5868 "into AP mode", bss->ifname); 5869 goto failed; 5870 } 5871 5872 if (params->num_bridge && params->bridge[0] && 5873 i802_check_bridge(drv, bss, params->bridge[0], params->ifname) < 0) 5874 goto failed; 5875 5876 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) 5877 goto failed; 5878 5879 drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE)); 5880 if (drv->eapol_sock < 0) { 5881 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)"); 5882 goto failed; 5883 } 5884 5885 if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL)) 5886 { 5887 printf("Could not register read socket for eapol\n"); 5888 goto failed; 5889 } 5890 5891 if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, params->own_addr)) 5892 goto failed; 5893 5894 return bss; 5895 5896failed: 5897 nl80211_remove_monitor_interface(drv); 5898 rfkill_deinit(drv->rfkill); 5899 netlink_deinit(drv->netlink); 5900 if (drv->ioctl_sock >= 0) 5901 close(drv->ioctl_sock); 5902 5903 genl_family_put(drv->nl80211); 5904 nl_cache_free(drv->nl_cache); 5905 nl80211_handle_destroy(drv->nl_handle); 5906 nl_cb_put(drv->nl_cb); 5907 eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event)); 5908 5909 os_free(drv); 5910 return NULL; 5911} 5912 5913 5914static void i802_deinit(void *priv) 5915{ 5916 wpa_driver_nl80211_deinit(priv); 5917} 5918 5919#endif /* HOSTAPD */ 5920 5921 5922static enum nl80211_iftype wpa_driver_nl80211_if_type( 5923 enum wpa_driver_if_type type) 5924{ 5925 switch (type) { 5926 case WPA_IF_STATION: 5927 return NL80211_IFTYPE_STATION; 5928 case WPA_IF_P2P_CLIENT: 5929 case WPA_IF_P2P_GROUP: 5930 return NL80211_IFTYPE_P2P_CLIENT; 5931 case WPA_IF_AP_VLAN: 5932 return NL80211_IFTYPE_AP_VLAN; 5933 case WPA_IF_AP_BSS: 5934 return NL80211_IFTYPE_AP; 5935 case WPA_IF_P2P_GO: 5936 return NL80211_IFTYPE_P2P_GO; 5937 } 5938 return -1; 5939} 5940 5941 5942#ifdef CONFIG_P2P 5943 5944static int nl80211_addr_in_use(struct nl80211_global *global, const u8 *addr) 5945{ 5946 struct wpa_driver_nl80211_data *drv; 5947 dl_list_for_each(drv, &global->interfaces, 5948 struct wpa_driver_nl80211_data, list) { 5949 if (os_memcmp(addr, drv->addr, ETH_ALEN) == 0) 5950 return 1; 5951 } 5952 return 0; 5953} 5954 5955 5956static int nl80211_p2p_interface_addr(struct wpa_driver_nl80211_data *drv, 5957 u8 *new_addr) 5958{ 5959 unsigned int idx; 5960 5961 if (!drv->global) 5962 return -1; 5963 5964 os_memcpy(new_addr, drv->addr, ETH_ALEN); 5965 for (idx = 0; idx < 64; idx++) { 5966 new_addr[0] = drv->addr[0] | 0x02; 5967 new_addr[0] ^= idx << 2; 5968 if (!nl80211_addr_in_use(drv->global, new_addr)) 5969 break; 5970 } 5971 if (idx == 64) 5972 return -1; 5973 5974 wpa_printf(MSG_DEBUG, "nl80211: Assigned new P2P Interface Address " 5975 MACSTR, MAC2STR(new_addr)); 5976 5977 return 0; 5978} 5979 5980#endif /* CONFIG_P2P */ 5981 5982 5983static int wpa_driver_nl80211_if_add(void *priv, enum wpa_driver_if_type type, 5984 const char *ifname, const u8 *addr, 5985 void *bss_ctx, void **drv_priv, 5986 char *force_ifname, u8 *if_addr, 5987 const char *bridge) 5988{ 5989 struct i802_bss *bss = priv; 5990 struct wpa_driver_nl80211_data *drv = bss->drv; 5991 int ifidx; 5992#ifdef HOSTAPD 5993 struct i802_bss *new_bss = NULL; 5994 5995 if (type == WPA_IF_AP_BSS) { 5996 new_bss = os_zalloc(sizeof(*new_bss)); 5997 if (new_bss == NULL) 5998 return -1; 5999 } 6000#endif /* HOSTAPD */ 6001 6002 if (addr) 6003 os_memcpy(if_addr, addr, ETH_ALEN); 6004 ifidx = nl80211_create_iface(drv, ifname, 6005 wpa_driver_nl80211_if_type(type), addr, 6006 0); 6007 if (ifidx < 0) { 6008#ifdef HOSTAPD 6009 os_free(new_bss); 6010#endif /* HOSTAPD */ 6011 return -1; 6012 } 6013 6014 if (!addr && 6015 linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, if_addr) < 0) { 6016 nl80211_remove_iface(drv, ifidx); 6017 return -1; 6018 } 6019 6020#ifdef CONFIG_P2P 6021 if (!addr && 6022 (type == WPA_IF_P2P_CLIENT || type == WPA_IF_P2P_GROUP || 6023 type == WPA_IF_P2P_GO)) { 6024 /* Enforce unique P2P Interface Address */ 6025 u8 new_addr[ETH_ALEN], own_addr[ETH_ALEN]; 6026 6027 if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, own_addr) 6028 < 0 || 6029 linux_get_ifhwaddr(drv->ioctl_sock, ifname, new_addr) < 0) 6030 { 6031 nl80211_remove_iface(drv, ifidx); 6032 return -1; 6033 } 6034 if (os_memcmp(own_addr, new_addr, ETH_ALEN) == 0) { 6035 wpa_printf(MSG_DEBUG, "nl80211: Allocate new address " 6036 "for P2P group interface"); 6037 if (nl80211_p2p_interface_addr(drv, new_addr) < 0) { 6038 nl80211_remove_iface(drv, ifidx); 6039 return -1; 6040 } 6041 if (linux_set_ifhwaddr(drv->ioctl_sock, ifname, 6042 new_addr) < 0) { 6043 nl80211_remove_iface(drv, ifidx); 6044 return -1; 6045 } 6046 } 6047 os_memcpy(if_addr, new_addr, ETH_ALEN); 6048 } 6049#endif /* CONFIG_P2P */ 6050 6051#ifdef HOSTAPD 6052 if (bridge && 6053 i802_check_bridge(drv, new_bss, bridge, ifname) < 0) { 6054 wpa_printf(MSG_ERROR, "nl80211: Failed to add the new " 6055 "interface %s to a bridge %s", ifname, bridge); 6056 nl80211_remove_iface(drv, ifidx); 6057 os_free(new_bss); 6058 return -1; 6059 } 6060 6061 if (type == WPA_IF_AP_BSS) { 6062 if (linux_set_iface_flags(drv->ioctl_sock, ifname, 1)) { 6063 nl80211_remove_iface(drv, ifidx); 6064 os_free(new_bss); 6065 return -1; 6066 } 6067 os_strlcpy(new_bss->ifname, ifname, IFNAMSIZ); 6068 new_bss->ifindex = ifidx; 6069 new_bss->drv = drv; 6070 new_bss->next = drv->first_bss.next; 6071 drv->first_bss.next = new_bss; 6072 if (drv_priv) 6073 *drv_priv = new_bss; 6074 } 6075#endif /* HOSTAPD */ 6076 6077 return 0; 6078} 6079 6080 6081static int wpa_driver_nl80211_if_remove(void *priv, 6082 enum wpa_driver_if_type type, 6083 const char *ifname) 6084{ 6085 struct i802_bss *bss = priv; 6086 struct wpa_driver_nl80211_data *drv = bss->drv; 6087 int ifindex = if_nametoindex(ifname); 6088 6089 wpa_printf(MSG_DEBUG, "nl80211: %s(type=%d ifname=%s) ifindex=%d", 6090 __func__, type, ifname, ifindex); 6091 if (ifindex <= 0) 6092 return -1; 6093 6094#ifdef HOSTAPD 6095 if (bss->added_if_into_bridge) { 6096 if (linux_br_del_if(drv->ioctl_sock, bss->brname, bss->ifname) 6097 < 0) 6098 wpa_printf(MSG_INFO, "nl80211: Failed to remove " 6099 "interface %s from bridge %s: %s", 6100 bss->ifname, bss->brname, strerror(errno)); 6101 } 6102 if (bss->added_bridge) { 6103 if (linux_br_del(drv->ioctl_sock, bss->brname) < 0) 6104 wpa_printf(MSG_INFO, "nl80211: Failed to remove " 6105 "bridge %s: %s", 6106 bss->brname, strerror(errno)); 6107 } 6108#endif /* HOSTAPD */ 6109 6110 nl80211_remove_iface(drv, ifindex); 6111 6112#ifdef HOSTAPD 6113 if (type != WPA_IF_AP_BSS) 6114 return 0; 6115 6116 if (bss != &drv->first_bss) { 6117 struct i802_bss *tbss; 6118 6119 for (tbss = &drv->first_bss; tbss; tbss = tbss->next) { 6120 if (tbss->next == bss) { 6121 tbss->next = bss->next; 6122 os_free(bss); 6123 bss = NULL; 6124 break; 6125 } 6126 } 6127 if (bss) 6128 wpa_printf(MSG_INFO, "nl80211: %s - could not find " 6129 "BSS %p in the list", __func__, bss); 6130 } 6131#endif /* HOSTAPD */ 6132 6133 return 0; 6134} 6135 6136 6137static int cookie_handler(struct nl_msg *msg, void *arg) 6138{ 6139 struct nlattr *tb[NL80211_ATTR_MAX + 1]; 6140 struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); 6141 u64 *cookie = arg; 6142 nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), 6143 genlmsg_attrlen(gnlh, 0), NULL); 6144 if (tb[NL80211_ATTR_COOKIE]) 6145 *cookie = nla_get_u64(tb[NL80211_ATTR_COOKIE]); 6146 return NL_SKIP; 6147} 6148 6149 6150static int nl80211_send_frame_cmd(struct wpa_driver_nl80211_data *drv, 6151 unsigned int freq, unsigned int wait, 6152 const u8 *buf, size_t buf_len, 6153 u64 *cookie_out) 6154{ 6155 struct nl_msg *msg; 6156 u64 cookie; 6157 int ret = -1; 6158 6159 msg = nlmsg_alloc(); 6160 if (!msg) 6161 return -1; 6162 6163 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6164 NL80211_CMD_FRAME, 0); 6165 6166 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 6167 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq); 6168#ifndef ANDROID_BRCM_P2P_PATCH 6169 if (wait) 6170 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, wait); 6171#endif 6172 NLA_PUT_FLAG(msg, NL80211_ATTR_OFFCHANNEL_TX_OK); 6173 NLA_PUT(msg, NL80211_ATTR_FRAME, buf_len, buf); 6174 6175 cookie = 0; 6176 ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie); 6177 msg = NULL; 6178 if (ret) { 6179 wpa_printf(MSG_DEBUG, "nl80211: Frame command failed: ret=%d " 6180 "(%s) (freq=%u wait=%u)", ret, strerror(-ret), 6181 freq, wait); 6182 goto nla_put_failure; 6183 } 6184 wpa_printf(MSG_DEBUG, "nl80211: Frame TX command accepted; " 6185 "cookie 0x%llx", (long long unsigned int) cookie); 6186 6187 if (cookie_out) 6188 *cookie_out = cookie; 6189 6190nla_put_failure: 6191 nlmsg_free(msg); 6192 return ret; 6193} 6194 6195 6196static int wpa_driver_nl80211_send_action(void *priv, unsigned int freq, 6197 unsigned int wait_time, 6198 const u8 *dst, const u8 *src, 6199 const u8 *bssid, 6200 const u8 *data, size_t data_len) 6201{ 6202 struct i802_bss *bss = priv; 6203 struct wpa_driver_nl80211_data *drv = bss->drv; 6204 int ret = -1; 6205 u8 *buf; 6206 struct ieee80211_hdr *hdr; 6207 6208 wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, " 6209 "wait=%d ms)", drv->ifindex, wait_time); 6210 6211 buf = os_zalloc(24 + data_len); 6212 if (buf == NULL) 6213 return ret; 6214 os_memcpy(buf + 24, data, data_len); 6215 hdr = (struct ieee80211_hdr *) buf; 6216 hdr->frame_control = 6217 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_ACTION); 6218 os_memcpy(hdr->addr1, dst, ETH_ALEN); 6219 os_memcpy(hdr->addr2, src, ETH_ALEN); 6220 os_memcpy(hdr->addr3, bssid, ETH_ALEN); 6221 6222 if (drv->nlmode == NL80211_IFTYPE_AP) 6223 ret = wpa_driver_nl80211_send_mlme(priv, buf, 24 + data_len); 6224 else 6225 ret = nl80211_send_frame_cmd(drv, freq, wait_time, buf, 6226 24 + data_len, 6227 &drv->send_action_cookie); 6228 6229 os_free(buf); 6230 return ret; 6231} 6232 6233 6234static void wpa_driver_nl80211_send_action_cancel_wait(void *priv) 6235{ 6236 struct i802_bss *bss = priv; 6237 struct wpa_driver_nl80211_data *drv = bss->drv; 6238 struct nl_msg *msg; 6239 int ret; 6240 6241 msg = nlmsg_alloc(); 6242 if (!msg) 6243 return; 6244 6245 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6246 NL80211_CMD_FRAME_WAIT_CANCEL, 0); 6247 6248 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 6249 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->send_action_cookie); 6250 6251 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 6252 msg = NULL; 6253 if (ret) 6254 wpa_printf(MSG_DEBUG, "nl80211: wait cancel failed: ret=%d " 6255 "(%s)", ret, strerror(-ret)); 6256 6257 nla_put_failure: 6258 nlmsg_free(msg); 6259} 6260 6261 6262static int wpa_driver_nl80211_remain_on_channel(void *priv, unsigned int freq, 6263 unsigned int duration) 6264{ 6265 struct i802_bss *bss = priv; 6266 struct wpa_driver_nl80211_data *drv = bss->drv; 6267 struct nl_msg *msg; 6268 int ret; 6269 u64 cookie; 6270 6271 msg = nlmsg_alloc(); 6272 if (!msg) 6273 return -1; 6274 6275 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6276 NL80211_CMD_REMAIN_ON_CHANNEL, 0); 6277 6278 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 6279 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq); 6280 NLA_PUT_U32(msg, NL80211_ATTR_DURATION, duration); 6281 6282 cookie = 0; 6283 ret = send_and_recv_msgs(drv, msg, cookie_handler, &cookie); 6284 if (ret == 0) { 6285 wpa_printf(MSG_DEBUG, "nl80211: Remain-on-channel cookie " 6286 "0x%llx for freq=%u MHz duration=%u", 6287 (long long unsigned int) cookie, freq, duration); 6288 drv->remain_on_chan_cookie = cookie; 6289 return 0; 6290 } 6291 wpa_printf(MSG_DEBUG, "nl80211: Failed to request remain-on-channel " 6292 "(freq=%d duration=%u): %d (%s)", 6293 freq, duration, ret, strerror(-ret)); 6294nla_put_failure: 6295 return -1; 6296} 6297 6298 6299static int wpa_driver_nl80211_cancel_remain_on_channel(void *priv) 6300{ 6301 struct i802_bss *bss = priv; 6302 struct wpa_driver_nl80211_data *drv = bss->drv; 6303 struct nl_msg *msg; 6304 int ret; 6305 6306 if (!drv->pending_remain_on_chan) { 6307 wpa_printf(MSG_DEBUG, "nl80211: No pending remain-on-channel " 6308 "to cancel"); 6309 return -1; 6310 } 6311 6312 wpa_printf(MSG_DEBUG, "nl80211: Cancel remain-on-channel with cookie " 6313 "0x%llx", 6314 (long long unsigned int) drv->remain_on_chan_cookie); 6315 6316 msg = nlmsg_alloc(); 6317 if (!msg) 6318 return -1; 6319 6320 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6321 NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL, 0); 6322 6323 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); 6324 NLA_PUT_U64(msg, NL80211_ATTR_COOKIE, drv->remain_on_chan_cookie); 6325 6326 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 6327 if (ret == 0) 6328 return 0; 6329 wpa_printf(MSG_DEBUG, "nl80211: Failed to cancel remain-on-channel: " 6330 "%d (%s)", ret, strerror(-ret)); 6331nla_put_failure: 6332 return -1; 6333} 6334 6335 6336static int wpa_driver_nl80211_probe_req_report(void *priv, int report) 6337{ 6338 struct i802_bss *bss = priv; 6339 struct wpa_driver_nl80211_data *drv = bss->drv; 6340 6341 if (!report) { 6342 if (drv->nl_handle_preq) { 6343 eloop_unregister_read_sock( 6344 nl_socket_get_fd(drv->nl_handle_preq)); 6345 nl_cache_free(drv->nl_cache_preq); 6346 nl80211_handle_destroy(drv->nl_handle_preq); 6347 drv->nl_handle_preq = NULL; 6348 } 6349 return 0; 6350 } 6351 6352 if (drv->nl_handle_preq) { 6353 wpa_printf(MSG_DEBUG, "nl80211: Probe Request reporting " 6354 "already on!"); 6355 return 0; 6356 } 6357 6358 drv->nl_handle_preq = nl80211_handle_alloc(drv->nl_cb); 6359 if (drv->nl_handle_preq == NULL) { 6360 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate " 6361 "netlink callbacks (preq)"); 6362 goto out_err1; 6363 } 6364 6365 if (genl_connect(drv->nl_handle_preq)) { 6366 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to " 6367 "generic netlink (preq)"); 6368 goto out_err2; 6369 return -1; 6370 } 6371 6372#ifdef CONFIG_LIBNL20 6373 if (genl_ctrl_alloc_cache(drv->nl_handle_preq, 6374 &drv->nl_cache_preq) < 0) { 6375 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 6376 "netlink cache (preq)"); 6377 goto out_err2; 6378 } 6379#else /* CONFIG_LIBNL20 */ 6380 drv->nl_cache_preq = genl_ctrl_alloc_cache(drv->nl_handle_preq); 6381 if (drv->nl_cache_preq == NULL) { 6382 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " 6383 "netlink cache (preq)"); 6384 goto out_err2; 6385 } 6386#endif /* CONFIG_LIBNL20 */ 6387 6388 if (nl80211_register_frame(drv, drv->nl_handle_preq, 6389 (WLAN_FC_TYPE_MGMT << 2) | 6390 (WLAN_FC_STYPE_PROBE_REQ << 4), 6391 NULL, 0) < 0) { 6392 goto out_err3; 6393 } 6394 6395#ifdef ANDROID_BRCM_P2P_PATCH 6396 if (drv->nlmode != NL80211_IFTYPE_AP && 6397 drv->nlmode != NL80211_IFTYPE_P2P_GO) { 6398 wpa_printf(MSG_DEBUG, "nl80211: probe_req_report control only " 6399 "allowed in AP or P2P GO mode (iftype=%d)", 6400 drv->nlmode); 6401 goto done; 6402 } 6403 6404 if (nl80211_register_frame(drv, drv->nl_handle_preq, 6405 (WLAN_FC_TYPE_MGMT << 2) | 6406 (WLAN_FC_STYPE_ASSOC_REQ << 4), 6407 NULL, 0) < 0) { 6408 goto out_err3; 6409 } 6410 6411 if (nl80211_register_frame(drv, drv->nl_handle_preq, 6412 (WLAN_FC_TYPE_MGMT << 2) | 6413 (WLAN_FC_STYPE_REASSOC_REQ << 4), 6414 NULL, 0) < 0) { 6415 goto out_err3; 6416 } 6417 6418 if (nl80211_register_frame(drv, drv->nl_handle_preq, 6419 (WLAN_FC_TYPE_MGMT << 2) | 6420 (WLAN_FC_STYPE_DISASSOC << 4), 6421 NULL, 0) < 0) { 6422 goto out_err3; 6423 } 6424 6425 if (nl80211_register_frame(drv, drv->nl_handle_preq, 6426 (WLAN_FC_TYPE_MGMT << 2) | 6427 (WLAN_FC_STYPE_DEAUTH << 4), 6428 NULL, 0) < 0) { 6429 goto out_err3; 6430 } 6431 6432done: 6433#endif 6434 eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_preq), 6435 wpa_driver_nl80211_event_receive, drv, 6436 drv->nl_handle_preq); 6437 6438 return 0; 6439 6440 out_err3: 6441 nl_cache_free(drv->nl_cache_preq); 6442 out_err2: 6443 nl80211_handle_destroy(drv->nl_handle_preq); 6444 drv->nl_handle_preq = NULL; 6445 out_err1: 6446 return -1; 6447} 6448 6449 6450static int nl80211_disable_11b_rates(struct wpa_driver_nl80211_data *drv, 6451 int ifindex, int disabled) 6452{ 6453 struct nl_msg *msg; 6454 struct nlattr *bands, *band; 6455 int ret; 6456 6457 msg = nlmsg_alloc(); 6458 if (!msg) 6459 return -1; 6460 6461 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6462 NL80211_CMD_SET_TX_BITRATE_MASK, 0); 6463 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); 6464 6465 bands = nla_nest_start(msg, NL80211_ATTR_TX_RATES); 6466 if (!bands) 6467 goto nla_put_failure; 6468 6469 /* 6470 * Disable 2 GHz rates 1, 2, 5.5, 11 Mbps by masking out everything 6471 * else apart from 6, 9, 12, 18, 24, 36, 48, 54 Mbps from non-MCS 6472 * rates. All 5 GHz rates are left enabled. 6473 */ 6474 band = nla_nest_start(msg, NL80211_BAND_2GHZ); 6475 if (!band) 6476 goto nla_put_failure; 6477 NLA_PUT(msg, NL80211_TXRATE_LEGACY, 8, 6478 "\x0c\x12\x18\x24\x30\x48\x60\x6c"); 6479 nla_nest_end(msg, band); 6480 6481 nla_nest_end(msg, bands); 6482 6483 ret = send_and_recv_msgs(drv, msg, NULL, NULL); 6484 msg = NULL; 6485 if (ret) { 6486 wpa_printf(MSG_DEBUG, "nl80211: Set TX rates failed: ret=%d " 6487 "(%s)", ret, strerror(-ret)); 6488 } 6489 6490 return ret; 6491 6492nla_put_failure: 6493 nlmsg_free(msg); 6494 return -1; 6495} 6496 6497 6498static int wpa_driver_nl80211_disable_11b_rates(void *priv, int disabled) 6499{ 6500 struct i802_bss *bss = priv; 6501 struct wpa_driver_nl80211_data *drv = bss->drv; 6502 drv->disable_11b_rates = disabled; 6503 return nl80211_disable_11b_rates(drv, drv->ifindex, disabled); 6504} 6505 6506 6507static int wpa_driver_nl80211_deinit_ap(void *priv) 6508{ 6509 struct i802_bss *bss = priv; 6510 struct wpa_driver_nl80211_data *drv = bss->drv; 6511 if (drv->nlmode != NL80211_IFTYPE_AP) 6512 return -1; 6513 wpa_driver_nl80211_del_beacon(drv); 6514 return wpa_driver_nl80211_set_mode(priv, IEEE80211_MODE_INFRA); 6515} 6516 6517 6518static void wpa_driver_nl80211_resume(void *priv) 6519{ 6520 struct i802_bss *bss = priv; 6521 struct wpa_driver_nl80211_data *drv = bss->drv; 6522 if (linux_set_iface_flags(drv->ioctl_sock, bss->ifname, 1)) { 6523 wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface up on " 6524 "resume event"); 6525 } 6526} 6527 6528 6529static int nl80211_send_ft_action(void *priv, u8 action, const u8 *target_ap, 6530 const u8 *ies, size_t ies_len) 6531{ 6532 struct i802_bss *bss = priv; 6533 struct wpa_driver_nl80211_data *drv = bss->drv; 6534 int ret; 6535 u8 *data, *pos; 6536 size_t data_len; 6537 u8 own_addr[ETH_ALEN]; 6538 6539 if (linux_get_ifhwaddr(drv->ioctl_sock, bss->ifname, own_addr) < 0) 6540 return -1; 6541 6542 if (action != 1) { 6543 wpa_printf(MSG_ERROR, "nl80211: Unsupported send_ft_action " 6544 "action %d", action); 6545 return -1; 6546 } 6547 6548 /* 6549 * Action frame payload: 6550 * Category[1] = 6 (Fast BSS Transition) 6551 * Action[1] = 1 (Fast BSS Transition Request) 6552 * STA Address 6553 * Target AP Address 6554 * FT IEs 6555 */ 6556 6557 data_len = 2 + 2 * ETH_ALEN + ies_len; 6558 data = os_malloc(data_len); 6559 if (data == NULL) 6560 return -1; 6561 pos = data; 6562 *pos++ = 0x06; /* FT Action category */ 6563 *pos++ = action; 6564 os_memcpy(pos, own_addr, ETH_ALEN); 6565 pos += ETH_ALEN; 6566 os_memcpy(pos, target_ap, ETH_ALEN); 6567 pos += ETH_ALEN; 6568 os_memcpy(pos, ies, ies_len); 6569 6570 ret = wpa_driver_nl80211_send_action(bss, drv->assoc_freq, 0, 6571 drv->bssid, own_addr, drv->bssid, 6572 data, data_len); 6573 os_free(data); 6574 6575 return ret; 6576} 6577 6578 6579static int nl80211_signal_monitor(void *priv, int threshold, int hysteresis) 6580{ 6581 struct i802_bss *bss = priv; 6582 struct wpa_driver_nl80211_data *drv = bss->drv; 6583 struct nl_msg *msg, *cqm = NULL; 6584 6585 wpa_printf(MSG_DEBUG, "nl80211: Signal monitor threshold=%d " 6586 "hysteresis=%d", threshold, hysteresis); 6587 6588 msg = nlmsg_alloc(); 6589 if (!msg) 6590 return -1; 6591 6592 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 6593 0, NL80211_CMD_SET_CQM, 0); 6594 6595 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, bss->ifindex); 6596 6597 cqm = nlmsg_alloc(); 6598 if (cqm == NULL) 6599 return -1; 6600 6601 NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_THOLD, threshold); 6602 NLA_PUT_U32(cqm, NL80211_ATTR_CQM_RSSI_HYST, hysteresis); 6603 nla_put_nested(msg, NL80211_ATTR_CQM, cqm); 6604 6605 if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0) 6606 return 0; 6607 msg = NULL; 6608 6609nla_put_failure: 6610 if (cqm) 6611 nlmsg_free(cqm); 6612 nlmsg_free(msg); 6613 return -1; 6614} 6615 6616 6617static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si) 6618{ 6619 struct i802_bss *bss = priv; 6620 struct wpa_driver_nl80211_data *drv = bss->drv; 6621 int res; 6622 6623 os_memset(si, 0, sizeof(*si)); 6624 res = nl80211_get_link_signal(drv, si); 6625 if (res != 0) 6626 return res; 6627 6628 return nl80211_get_link_noise(drv, si); 6629} 6630 6631 6632static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len, 6633 int encrypt) 6634{ 6635 struct i802_bss *bss = priv; 6636 struct wpa_driver_nl80211_data *drv = bss->drv; 6637 return wpa_driver_nl80211_send_frame(drv, data, data_len, encrypt); 6638} 6639 6640 6641static int nl80211_set_intra_bss(void *priv, int enabled) 6642{ 6643 struct i802_bss *bss = priv; 6644 struct wpa_driver_nl80211_data *drv = bss->drv; 6645 struct nl_msg *msg; 6646 6647 msg = nlmsg_alloc(); 6648 if (!msg) 6649 return -ENOMEM; 6650 6651 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, 6652 NL80211_CMD_SET_BSS, 0); 6653 6654 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 6655 NLA_PUT_U8(msg, NL80211_ATTR_AP_ISOLATE, !enabled); 6656 6657 return send_and_recv_msgs(drv, msg, NULL, NULL); 6658 nla_put_failure: 6659 return -ENOBUFS; 6660} 6661 6662 6663static int nl80211_set_param(void *priv, const char *param) 6664{ 6665 wpa_printf(MSG_DEBUG, "nl80211: driver param='%s'", param); 6666 if (param == NULL) 6667 return 0; 6668 6669#ifdef CONFIG_P2P 6670 if (os_strstr(param, "use_p2p_group_interface=1")) { 6671 struct i802_bss *bss = priv; 6672 struct wpa_driver_nl80211_data *drv = bss->drv; 6673 6674 wpa_printf(MSG_DEBUG, "nl80211: Use separate P2P group " 6675 "interface"); 6676 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_CONCURRENT; 6677 drv->capa.flags |= WPA_DRIVER_FLAGS_P2P_MGMT_AND_NON_P2P; 6678 } 6679#endif /* CONFIG_P2P */ 6680 6681 return 0; 6682} 6683 6684 6685static void * nl80211_global_init(void) 6686{ 6687 struct nl80211_global *global; 6688 global = os_zalloc(sizeof(*global)); 6689 if (global == NULL) 6690 return NULL; 6691 dl_list_init(&global->interfaces); 6692 return global; 6693} 6694 6695 6696static void nl80211_global_deinit(void *priv) 6697{ 6698 struct nl80211_global *global = priv; 6699 if (global == NULL) 6700 return; 6701 if (!dl_list_empty(&global->interfaces)) { 6702 wpa_printf(MSG_ERROR, "nl80211: %u interface(s) remain at " 6703 "nl80211_global_deinit", 6704 dl_list_len(&global->interfaces)); 6705 } 6706 os_free(global); 6707} 6708 6709 6710static const char * nl80211_get_radio_name(void *priv) 6711{ 6712 struct i802_bss *bss = priv; 6713 struct wpa_driver_nl80211_data *drv = bss->drv; 6714 return drv->phyname; 6715} 6716 6717 6718static int nl80211_pmkid(struct i802_bss *bss, int cmd, const u8 *bssid, 6719 const u8 *pmkid) 6720{ 6721 struct nl_msg *msg; 6722 6723 msg = nlmsg_alloc(); 6724 if (!msg) 6725 return -ENOMEM; 6726 6727 genlmsg_put(msg, 0, 0, genl_family_get_id(bss->drv->nl80211), 0, 0, 6728 cmd, 0); 6729 6730 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(bss->ifname)); 6731 if (pmkid) 6732 NLA_PUT(msg, NL80211_ATTR_PMKID, 16, pmkid); 6733 if (bssid) 6734 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid); 6735 6736 return send_and_recv_msgs(bss->drv, msg, NULL, NULL); 6737 nla_put_failure: 6738 return -ENOBUFS; 6739} 6740 6741 6742static int nl80211_add_pmkid(void *priv, const u8 *bssid, const u8 *pmkid) 6743{ 6744 struct i802_bss *bss = priv; 6745 wpa_printf(MSG_DEBUG, "nl80211: Add PMKID for " MACSTR, MAC2STR(bssid)); 6746 return nl80211_pmkid(bss, NL80211_CMD_SET_PMKSA, bssid, pmkid); 6747} 6748 6749 6750static int nl80211_remove_pmkid(void *priv, const u8 *bssid, const u8 *pmkid) 6751{ 6752 struct i802_bss *bss = priv; 6753 wpa_printf(MSG_DEBUG, "nl80211: Delete PMKID for " MACSTR, 6754 MAC2STR(bssid)); 6755 return nl80211_pmkid(bss, NL80211_CMD_DEL_PMKSA, bssid, pmkid); 6756} 6757 6758 6759static int nl80211_flush_pmkid(void *priv) 6760{ 6761 struct i802_bss *bss = priv; 6762 wpa_printf(MSG_DEBUG, "nl80211: Flush PMKIDs"); 6763 return nl80211_pmkid(bss, NL80211_CMD_FLUSH_PMKSA, NULL, NULL); 6764} 6765 6766 6767const struct wpa_driver_ops wpa_driver_nl80211_ops = { 6768 .name = "nl80211", 6769 .desc = "Linux nl80211/cfg80211", 6770 .get_bssid = wpa_driver_nl80211_get_bssid, 6771 .get_ssid = wpa_driver_nl80211_get_ssid, 6772 .set_key = wpa_driver_nl80211_set_key, 6773 .scan2 = wpa_driver_nl80211_scan, 6774 .get_scan_results2 = wpa_driver_nl80211_get_scan_results, 6775 .deauthenticate = wpa_driver_nl80211_deauthenticate, 6776 .disassociate = wpa_driver_nl80211_disassociate, 6777 .authenticate = wpa_driver_nl80211_authenticate, 6778 .associate = wpa_driver_nl80211_associate, 6779 .global_init = nl80211_global_init, 6780 .global_deinit = nl80211_global_deinit, 6781 .init2 = wpa_driver_nl80211_init, 6782 .deinit = wpa_driver_nl80211_deinit, 6783 .get_capa = wpa_driver_nl80211_get_capa, 6784 .set_operstate = wpa_driver_nl80211_set_operstate, 6785 .set_supp_port = wpa_driver_nl80211_set_supp_port, 6786 .set_country = wpa_driver_nl80211_set_country, 6787 .set_beacon = wpa_driver_nl80211_set_beacon, 6788 .if_add = wpa_driver_nl80211_if_add, 6789 .if_remove = wpa_driver_nl80211_if_remove, 6790 .send_mlme = wpa_driver_nl80211_send_mlme, 6791 .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data, 6792 .sta_add = wpa_driver_nl80211_sta_add, 6793 .sta_remove = wpa_driver_nl80211_sta_remove, 6794 .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol, 6795 .sta_set_flags = wpa_driver_nl80211_sta_set_flags, 6796#ifdef HOSTAPD 6797 .hapd_init = i802_init, 6798 .hapd_deinit = i802_deinit, 6799 .set_wds_sta = i802_set_wds_sta, 6800#endif /* HOSTAPD */ 6801#if defined(HOSTAPD) || defined(CONFIG_AP) 6802 .get_seqnum = i802_get_seqnum, 6803 .flush = i802_flush, 6804 .read_sta_data = i802_read_sta_data, 6805 .get_inact_sec = i802_get_inact_sec, 6806 .sta_clear_stats = i802_sta_clear_stats, 6807 .set_rts = i802_set_rts, 6808 .set_frag = i802_set_frag, 6809 .set_cts_protect = i802_set_cts_protect, 6810 .set_preamble = i802_set_preamble, 6811 .set_short_slot_time = i802_set_short_slot_time, 6812 .set_tx_queue_params = i802_set_tx_queue_params, 6813 .set_sta_vlan = i802_set_sta_vlan, 6814 .set_ht_params = i802_set_ht_params, 6815 .set_rate_sets = i802_set_rate_sets, 6816 .sta_deauth = i802_sta_deauth, 6817 .sta_disassoc = i802_sta_disassoc, 6818#endif /* HOSTAPD || CONFIG_AP */ 6819 .set_freq = i802_set_freq, 6820 .send_action = wpa_driver_nl80211_send_action, 6821 .send_action_cancel_wait = wpa_driver_nl80211_send_action_cancel_wait, 6822 .remain_on_channel = wpa_driver_nl80211_remain_on_channel, 6823 .cancel_remain_on_channel = 6824 wpa_driver_nl80211_cancel_remain_on_channel, 6825 .probe_req_report = wpa_driver_nl80211_probe_req_report, 6826 .disable_11b_rates = wpa_driver_nl80211_disable_11b_rates, 6827 .deinit_ap = wpa_driver_nl80211_deinit_ap, 6828 .resume = wpa_driver_nl80211_resume, 6829 .send_ft_action = nl80211_send_ft_action, 6830 .signal_monitor = nl80211_signal_monitor, 6831 .signal_poll = nl80211_signal_poll, 6832 .send_frame = nl80211_send_frame, 6833 .set_intra_bss = nl80211_set_intra_bss, 6834 .set_param = nl80211_set_param, 6835 .get_radio_name = nl80211_get_radio_name, 6836 .add_pmkid = nl80211_add_pmkid, 6837 .remove_pmkid = nl80211_remove_pmkid, 6838 .flush_pmkid = nl80211_flush_pmkid, 6839#ifdef ANDROID_BRCM_P2P_PATCH 6840 .set_noa = wpa_driver_set_p2p_noa, 6841 .set_p2p_powersave = wpa_driver_set_p2p_ps, 6842 .set_ap_wps_ie = wpa_driver_set_ap_wps_p2p_ie, 6843#endif 6844#ifdef ANDROID 6845 .driver_cmd = wpa_driver_nl80211_driver_cmd, 6846#endif 6847}; 6848