1/*
2 * hostapd / Callback functions for driver wrappers
3 * Copyright (c) 2002-2013, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
12#include "utils/eloop.h"
13#include "radius/radius.h"
14#include "drivers/driver.h"
15#include "common/ieee802_11_defs.h"
16#include "common/ieee802_11_common.h"
17#include "common/wpa_ctrl.h"
18#include "crypto/random.h"
19#include "p2p/p2p.h"
20#include "wps/wps.h"
21#include "wnm_ap.h"
22#include "hostapd.h"
23#include "ieee802_11.h"
24#include "sta_info.h"
25#include "accounting.h"
26#include "tkip_countermeasures.h"
27#include "ieee802_1x.h"
28#include "wpa_auth.h"
29#include "wps_hostapd.h"
30#include "ap_drv_ops.h"
31#include "ap_config.h"
32#include "hw_features.h"
33#include "dfs.h"
34#include "beacon.h"
35
36
37int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
38			const u8 *req_ies, size_t req_ies_len, int reassoc)
39{
40	struct sta_info *sta;
41	int new_assoc, res;
42	struct ieee802_11_elems elems;
43	const u8 *ie;
44	size_t ielen;
45#ifdef CONFIG_IEEE80211R
46	u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
47	u8 *p = buf;
48#endif /* CONFIG_IEEE80211R */
49	u16 reason = WLAN_REASON_UNSPECIFIED;
50	u16 status = WLAN_STATUS_SUCCESS;
51	const u8 *p2p_dev_addr = NULL;
52
53	if (addr == NULL) {
54		/*
55		 * This could potentially happen with unexpected event from the
56		 * driver wrapper. This was seen at least in one case where the
57		 * driver ended up being set to station mode while hostapd was
58		 * running, so better make sure we stop processing such an
59		 * event here.
60		 */
61		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
62			   "no address");
63		return -1;
64	}
65	random_add_randomness(addr, ETH_ALEN);
66
67	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
68		       HOSTAPD_LEVEL_INFO, "associated");
69
70	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
71	if (elems.wps_ie) {
72		ie = elems.wps_ie - 2;
73		ielen = elems.wps_ie_len + 2;
74		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
75	} else if (elems.rsn_ie) {
76		ie = elems.rsn_ie - 2;
77		ielen = elems.rsn_ie_len + 2;
78		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
79	} else if (elems.wpa_ie) {
80		ie = elems.wpa_ie - 2;
81		ielen = elems.wpa_ie_len + 2;
82		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
83#ifdef CONFIG_HS20
84	} else if (elems.osen) {
85		ie = elems.osen - 2;
86		ielen = elems.osen_len + 2;
87		wpa_printf(MSG_DEBUG, "STA included OSEN IE in (Re)AssocReq");
88#endif /* CONFIG_HS20 */
89	} else {
90		ie = NULL;
91		ielen = 0;
92		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
93			   "(Re)AssocReq");
94	}
95
96	sta = ap_get_sta(hapd, addr);
97	if (sta) {
98		ap_sta_no_session_timeout(hapd, sta);
99		accounting_sta_stop(hapd, sta);
100
101		/*
102		 * Make sure that the previously registered inactivity timer
103		 * will not remove the STA immediately.
104		 */
105		sta->timeout_next = STA_NULLFUNC;
106	} else {
107		sta = ap_sta_add(hapd, addr);
108		if (sta == NULL) {
109			hostapd_drv_sta_disassoc(hapd, addr,
110						 WLAN_REASON_DISASSOC_AP_BUSY);
111			return -1;
112		}
113	}
114	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
115
116#ifdef CONFIG_P2P
117	if (elems.p2p) {
118		wpabuf_free(sta->p2p_ie);
119		sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
120							  P2P_IE_VENDOR_TYPE);
121		if (sta->p2p_ie)
122			p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
123	}
124#endif /* CONFIG_P2P */
125
126#ifdef CONFIG_IEEE80211N
127#ifdef NEED_AP_MLME
128	if (elems.ht_capabilities &&
129	    elems.ht_capabilities_len >=
130	    sizeof(struct ieee80211_ht_capabilities) &&
131	    (hapd->iface->conf->ht_capab &
132	     HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) {
133		struct ieee80211_ht_capabilities *ht_cap =
134			(struct ieee80211_ht_capabilities *)
135			elems.ht_capabilities;
136
137		if (le_to_host16(ht_cap->ht_capabilities_info) &
138		    HT_CAP_INFO_40MHZ_INTOLERANT)
139			ht40_intolerant_add(hapd->iface, sta);
140	}
141#endif /* NEED_AP_MLME */
142#endif /* CONFIG_IEEE80211N */
143
144#ifdef CONFIG_INTERWORKING
145	if (elems.ext_capab && elems.ext_capab_len > 4) {
146		if (elems.ext_capab[4] & 0x01)
147			sta->qos_map_enabled = 1;
148	}
149#endif /* CONFIG_INTERWORKING */
150
151#ifdef CONFIG_HS20
152	wpabuf_free(sta->hs20_ie);
153	if (elems.hs20 && elems.hs20_len > 4) {
154		sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
155						 elems.hs20_len - 4);
156	} else
157		sta->hs20_ie = NULL;
158#endif /* CONFIG_HS20 */
159
160	if (hapd->conf->wpa) {
161		if (ie == NULL || ielen == 0) {
162#ifdef CONFIG_WPS
163			if (hapd->conf->wps_state) {
164				wpa_printf(MSG_DEBUG, "STA did not include "
165					   "WPA/RSN IE in (Re)Association "
166					   "Request - possible WPS use");
167				sta->flags |= WLAN_STA_MAYBE_WPS;
168				goto skip_wpa_check;
169			}
170#endif /* CONFIG_WPS */
171
172			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
173			return -1;
174		}
175#ifdef CONFIG_WPS
176		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
177		    os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
178			struct wpabuf *wps;
179			sta->flags |= WLAN_STA_WPS;
180			wps = ieee802_11_vendor_ie_concat(ie, ielen,
181							  WPS_IE_VENDOR_TYPE);
182			if (wps) {
183				if (wps_is_20(wps)) {
184					wpa_printf(MSG_DEBUG, "WPS: STA "
185						   "supports WPS 2.0");
186					sta->flags |= WLAN_STA_WPS2;
187				}
188				wpabuf_free(wps);
189			}
190			goto skip_wpa_check;
191		}
192#endif /* CONFIG_WPS */
193
194		if (sta->wpa_sm == NULL)
195			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
196							sta->addr,
197							p2p_dev_addr);
198		if (sta->wpa_sm == NULL) {
199			wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
200				   "machine");
201			return -1;
202		}
203		res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
204					  ie, ielen,
205					  elems.mdie, elems.mdie_len);
206		if (res != WPA_IE_OK) {
207			wpa_printf(MSG_DEBUG, "WPA/RSN information element "
208				   "rejected? (res %u)", res);
209			wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
210			if (res == WPA_INVALID_GROUP) {
211				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
212				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
213			} else if (res == WPA_INVALID_PAIRWISE) {
214				reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
215				status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
216			} else if (res == WPA_INVALID_AKMP) {
217				reason = WLAN_REASON_AKMP_NOT_VALID;
218				status = WLAN_STATUS_AKMP_NOT_VALID;
219			}
220#ifdef CONFIG_IEEE80211W
221			else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) {
222				reason = WLAN_REASON_INVALID_IE;
223				status = WLAN_STATUS_INVALID_IE;
224			} else if (res == WPA_INVALID_MGMT_GROUP_CIPHER) {
225				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
226				status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
227			}
228#endif /* CONFIG_IEEE80211W */
229			else {
230				reason = WLAN_REASON_INVALID_IE;
231				status = WLAN_STATUS_INVALID_IE;
232			}
233			goto fail;
234		}
235#ifdef CONFIG_IEEE80211W
236		if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
237		    sta->sa_query_count > 0)
238			ap_check_sa_query_timeout(hapd, sta);
239		if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
240		    (sta->auth_alg != WLAN_AUTH_FT)) {
241			/*
242			 * STA has already been associated with MFP and SA
243			 * Query timeout has not been reached. Reject the
244			 * association attempt temporarily and start SA Query,
245			 * if one is not pending.
246			 */
247
248			if (sta->sa_query_count == 0)
249				ap_sta_start_sa_query(hapd, sta);
250
251#ifdef CONFIG_IEEE80211R
252			status = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
253
254			p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
255
256			hostapd_sta_assoc(hapd, addr, reassoc, status, buf,
257					  p - buf);
258#endif /* CONFIG_IEEE80211R */
259			return 0;
260		}
261
262		if (wpa_auth_uses_mfp(sta->wpa_sm))
263			sta->flags |= WLAN_STA_MFP;
264		else
265			sta->flags &= ~WLAN_STA_MFP;
266#endif /* CONFIG_IEEE80211W */
267
268#ifdef CONFIG_IEEE80211R
269		if (sta->auth_alg == WLAN_AUTH_FT) {
270			status = wpa_ft_validate_reassoc(sta->wpa_sm, req_ies,
271							 req_ies_len);
272			if (status != WLAN_STATUS_SUCCESS) {
273				if (status == WLAN_STATUS_INVALID_PMKID)
274					reason = WLAN_REASON_INVALID_IE;
275				if (status == WLAN_STATUS_INVALID_MDIE)
276					reason = WLAN_REASON_INVALID_IE;
277				if (status == WLAN_STATUS_INVALID_FTIE)
278					reason = WLAN_REASON_INVALID_IE;
279				goto fail;
280			}
281		}
282#endif /* CONFIG_IEEE80211R */
283	} else if (hapd->conf->wps_state) {
284#ifdef CONFIG_WPS
285		struct wpabuf *wps;
286		if (req_ies)
287			wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
288							  WPS_IE_VENDOR_TYPE);
289		else
290			wps = NULL;
291#ifdef CONFIG_WPS_STRICT
292		if (wps && wps_validate_assoc_req(wps) < 0) {
293			reason = WLAN_REASON_INVALID_IE;
294			status = WLAN_STATUS_INVALID_IE;
295			wpabuf_free(wps);
296			goto fail;
297		}
298#endif /* CONFIG_WPS_STRICT */
299		if (wps) {
300			sta->flags |= WLAN_STA_WPS;
301			if (wps_is_20(wps)) {
302				wpa_printf(MSG_DEBUG, "WPS: STA supports "
303					   "WPS 2.0");
304				sta->flags |= WLAN_STA_WPS2;
305			}
306		} else
307			sta->flags |= WLAN_STA_MAYBE_WPS;
308		wpabuf_free(wps);
309#endif /* CONFIG_WPS */
310#ifdef CONFIG_HS20
311	} else if (hapd->conf->osen) {
312		if (elems.osen == NULL) {
313			hostapd_logger(
314				hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
315				HOSTAPD_LEVEL_INFO,
316				"No HS 2.0 OSEN element in association request");
317			return WLAN_STATUS_INVALID_IE;
318		}
319
320		wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
321		if (sta->wpa_sm == NULL)
322			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
323							sta->addr, NULL);
324		if (sta->wpa_sm == NULL) {
325			wpa_printf(MSG_WARNING, "Failed to initialize WPA "
326				   "state machine");
327			return WLAN_STATUS_UNSPECIFIED_FAILURE;
328		}
329		if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
330				      elems.osen - 2, elems.osen_len + 2) < 0)
331			return WLAN_STATUS_INVALID_IE;
332#endif /* CONFIG_HS20 */
333	}
334#ifdef CONFIG_WPS
335skip_wpa_check:
336#endif /* CONFIG_WPS */
337
338#ifdef CONFIG_IEEE80211R
339	p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, buf, sizeof(buf),
340					sta->auth_alg, req_ies, req_ies_len);
341
342	hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf);
343
344	if (sta->auth_alg == WLAN_AUTH_FT)
345		ap_sta_set_authorized(hapd, sta, 1);
346#else /* CONFIG_IEEE80211R */
347	/* Keep compiler silent about unused variables */
348	if (status) {
349	}
350#endif /* CONFIG_IEEE80211R */
351
352	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
353	sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
354	sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
355
356	hostapd_set_sta_flags(hapd, sta);
357
358	if (reassoc && (sta->auth_alg == WLAN_AUTH_FT))
359		wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
360	else
361		wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
362
363	hostapd_new_assoc_sta(hapd, sta, !new_assoc);
364
365	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
366
367#ifdef CONFIG_P2P
368	if (req_ies) {
369		p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
370				      req_ies, req_ies_len);
371	}
372#endif /* CONFIG_P2P */
373
374	return 0;
375
376fail:
377#ifdef CONFIG_IEEE80211R
378	hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf);
379#endif /* CONFIG_IEEE80211R */
380	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
381	ap_free_sta(hapd, sta);
382	return -1;
383}
384
385
386void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
387{
388	struct sta_info *sta;
389
390	if (addr == NULL) {
391		/*
392		 * This could potentially happen with unexpected event from the
393		 * driver wrapper. This was seen at least in one case where the
394		 * driver ended up reporting a station mode event while hostapd
395		 * was running, so better make sure we stop processing such an
396		 * event here.
397		 */
398		wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
399			   "with no address");
400		return;
401	}
402
403	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
404		       HOSTAPD_LEVEL_INFO, "disassociated");
405
406	sta = ap_get_sta(hapd, addr);
407	if (sta == NULL) {
408		wpa_printf(MSG_DEBUG, "Disassociation notification for "
409			   "unknown STA " MACSTR, MAC2STR(addr));
410		return;
411	}
412
413	ap_sta_set_authorized(hapd, sta, 0);
414	sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
415	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
416	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
417	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
418	ap_free_sta(hapd, sta);
419}
420
421
422void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
423{
424	struct sta_info *sta = ap_get_sta(hapd, addr);
425
426	if (!sta || !hapd->conf->disassoc_low_ack)
427		return;
428
429	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
430		       HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
431		       "missing ACKs");
432	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
433	if (sta)
434		ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
435}
436
437
438void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht,
439			     int offset, int width, int cf1, int cf2)
440{
441#ifdef NEED_AP_MLME
442	int channel, chwidth, seg0_idx = 0, seg1_idx = 0;
443
444	hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
445		       HOSTAPD_LEVEL_INFO, "driver had channel switch: "
446		       "freq=%d, ht=%d, offset=%d, width=%d, cf1=%d, cf2=%d",
447		       freq, ht, offset, width, cf1, cf2);
448
449	hapd->iface->freq = freq;
450
451	channel = hostapd_hw_get_channel(hapd, freq);
452	if (!channel) {
453		hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
454			       HOSTAPD_LEVEL_WARNING, "driver switched to "
455			       "bad channel!");
456		return;
457	}
458
459	switch (width) {
460	case CHAN_WIDTH_80:
461		chwidth = VHT_CHANWIDTH_80MHZ;
462		break;
463	case CHAN_WIDTH_80P80:
464		chwidth = VHT_CHANWIDTH_80P80MHZ;
465		break;
466	case CHAN_WIDTH_160:
467		chwidth = VHT_CHANWIDTH_160MHZ;
468		break;
469	case CHAN_WIDTH_20_NOHT:
470	case CHAN_WIDTH_20:
471	case CHAN_WIDTH_40:
472	default:
473		chwidth = VHT_CHANWIDTH_USE_HT;
474		break;
475	}
476
477	switch (hapd->iface->current_mode->mode) {
478	case HOSTAPD_MODE_IEEE80211A:
479		if (cf1 > 5000)
480			seg0_idx = (cf1 - 5000) / 5;
481		if (cf2 > 5000)
482			seg1_idx = (cf2 - 5000) / 5;
483		break;
484	default:
485		seg0_idx = hostapd_hw_get_channel(hapd, cf1);
486		seg1_idx = hostapd_hw_get_channel(hapd, cf2);
487		break;
488	}
489
490	hapd->iconf->channel = channel;
491	hapd->iconf->ieee80211n = ht;
492	hapd->iconf->secondary_channel = offset;
493	hapd->iconf->vht_oper_chwidth = chwidth;
494	hapd->iconf->vht_oper_centr_freq_seg0_idx = seg0_idx;
495	hapd->iconf->vht_oper_centr_freq_seg1_idx = seg1_idx;
496
497	if (hapd->csa_in_progress &&
498	    freq == hapd->cs_freq_params.freq) {
499		hostapd_cleanup_cs_params(hapd);
500		ieee802_11_set_beacon(hapd);
501
502		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d",
503			freq);
504	}
505#endif /* NEED_AP_MLME */
506}
507
508
509void hostapd_event_connect_failed_reason(struct hostapd_data *hapd,
510					 const u8 *addr, int reason_code)
511{
512	switch (reason_code) {
513	case MAX_CLIENT_REACHED:
514		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_MAX_STA MACSTR,
515			MAC2STR(addr));
516		break;
517	case BLOCKED_CLIENT:
518		wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_BLOCKED_STA MACSTR,
519			MAC2STR(addr));
520		break;
521	}
522}
523
524
525int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da,
526			 const u8 *bssid, const u8 *ie, size_t ie_len,
527			 int ssi_signal)
528{
529	size_t i;
530	int ret = 0;
531
532	if (sa == NULL || ie == NULL)
533		return -1;
534
535	random_add_randomness(sa, ETH_ALEN);
536	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
537		if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
538					    sa, da, bssid, ie, ie_len,
539					    ssi_signal) > 0) {
540			ret = 1;
541			break;
542		}
543	}
544	return ret;
545}
546
547
548#ifdef HOSTAPD
549
550#ifdef CONFIG_IEEE80211R
551static void hostapd_notify_auth_ft_finish(void *ctx, const u8 *dst,
552					  const u8 *bssid,
553					  u16 auth_transaction, u16 status,
554					  const u8 *ies, size_t ies_len)
555{
556	struct hostapd_data *hapd = ctx;
557	struct sta_info *sta;
558
559	sta = ap_get_sta(hapd, dst);
560	if (sta == NULL)
561		return;
562
563	hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
564		       HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
565	sta->flags |= WLAN_STA_AUTH;
566
567	hostapd_sta_auth(hapd, dst, auth_transaction, status, ies, ies_len);
568}
569#endif /* CONFIG_IEEE80211R */
570
571
572static void hostapd_notif_auth(struct hostapd_data *hapd,
573			       struct auth_info *rx_auth)
574{
575	struct sta_info *sta;
576	u16 status = WLAN_STATUS_SUCCESS;
577	u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
578	size_t resp_ies_len = 0;
579
580	sta = ap_get_sta(hapd, rx_auth->peer);
581	if (!sta) {
582		sta = ap_sta_add(hapd, rx_auth->peer);
583		if (sta == NULL) {
584			status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
585			goto fail;
586		}
587	}
588	sta->flags &= ~WLAN_STA_PREAUTH;
589	ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
590#ifdef CONFIG_IEEE80211R
591	if (rx_auth->auth_type == WLAN_AUTH_FT && hapd->wpa_auth) {
592		sta->auth_alg = WLAN_AUTH_FT;
593		if (sta->wpa_sm == NULL)
594			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
595							sta->addr, NULL);
596		if (sta->wpa_sm == NULL) {
597			wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
598				   "state machine");
599			status = WLAN_STATUS_UNSPECIFIED_FAILURE;
600			goto fail;
601		}
602		wpa_ft_process_auth(sta->wpa_sm, rx_auth->bssid,
603				    rx_auth->auth_transaction, rx_auth->ies,
604				    rx_auth->ies_len,
605				    hostapd_notify_auth_ft_finish, hapd);
606		return;
607	}
608#endif /* CONFIG_IEEE80211R */
609fail:
610	hostapd_sta_auth(hapd, rx_auth->peer, rx_auth->auth_transaction + 1,
611			 status, resp_ies, resp_ies_len);
612}
613
614
615static void hostapd_action_rx(struct hostapd_data *hapd,
616			      struct rx_mgmt *drv_mgmt)
617{
618	struct ieee80211_mgmt *mgmt;
619	struct sta_info *sta;
620	size_t plen __maybe_unused;
621	u16 fc;
622
623	if (drv_mgmt->frame_len < 24 + 1)
624		return;
625
626	plen = drv_mgmt->frame_len - 24 - 1;
627
628	mgmt = (struct ieee80211_mgmt *) drv_mgmt->frame;
629	fc = le_to_host16(mgmt->frame_control);
630	if (WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION)
631		return; /* handled by the driver */
632
633        wpa_printf(MSG_DEBUG, "RX_ACTION cat %d action plen %d",
634		   mgmt->u.action.category, (int) plen);
635
636	sta = ap_get_sta(hapd, mgmt->sa);
637	if (sta == NULL) {
638		wpa_printf(MSG_DEBUG, "%s: station not found", __func__);
639		return;
640	}
641#ifdef CONFIG_IEEE80211R
642	if (mgmt->u.action.category == WLAN_ACTION_FT) {
643		const u8 *payload = drv_mgmt->frame + 24 + 1;
644		wpa_ft_action_rx(sta->wpa_sm, payload, plen);
645	}
646#endif /* CONFIG_IEEE80211R */
647#ifdef CONFIG_IEEE80211W
648	if (mgmt->u.action.category == WLAN_ACTION_SA_QUERY && plen >= 4) {
649		ieee802_11_sa_query_action(
650			hapd, mgmt->sa,
651			mgmt->u.action.u.sa_query_resp.action,
652			mgmt->u.action.u.sa_query_resp.trans_id);
653	}
654#endif /* CONFIG_IEEE80211W */
655#ifdef CONFIG_WNM
656	if (mgmt->u.action.category == WLAN_ACTION_WNM) {
657		ieee802_11_rx_wnm_action_ap(hapd, mgmt, drv_mgmt->frame_len);
658	}
659#endif /* CONFIG_WNM */
660}
661
662
663#ifdef NEED_AP_MLME
664
665#define HAPD_BROADCAST ((struct hostapd_data *) -1)
666
667static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
668					    const u8 *bssid)
669{
670	size_t i;
671
672	if (bssid == NULL)
673		return NULL;
674	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
675	    bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
676		return HAPD_BROADCAST;
677
678	for (i = 0; i < iface->num_bss; i++) {
679		if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
680			return iface->bss[i];
681	}
682
683	return NULL;
684}
685
686
687static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
688					const u8 *bssid, const u8 *addr,
689					int wds)
690{
691	hapd = get_hapd_bssid(hapd->iface, bssid);
692	if (hapd == NULL || hapd == HAPD_BROADCAST)
693		return;
694
695	ieee802_11_rx_from_unknown(hapd, addr, wds);
696}
697
698
699static int hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
700{
701	struct hostapd_iface *iface = hapd->iface;
702	const struct ieee80211_hdr *hdr;
703	const u8 *bssid;
704	struct hostapd_frame_info fi;
705	int ret;
706
707#ifdef CONFIG_TESTING_OPTIONS
708	if (hapd->ext_mgmt_frame_handling) {
709		size_t hex_len = 2 * rx_mgmt->frame_len + 1;
710		char *hex = os_malloc(hex_len);
711		if (hex) {
712			wpa_snprintf_hex(hex, hex_len, rx_mgmt->frame,
713					 rx_mgmt->frame_len);
714			wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex);
715			os_free(hex);
716		}
717		return 1;
718	}
719#endif /* CONFIG_TESTING_OPTIONS */
720
721	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
722	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
723	if (bssid == NULL)
724		return 0;
725
726	hapd = get_hapd_bssid(iface, bssid);
727	if (hapd == NULL) {
728		u16 fc;
729		fc = le_to_host16(hdr->frame_control);
730
731		/*
732		 * Drop frames to unknown BSSIDs except for Beacon frames which
733		 * could be used to update neighbor information.
734		 */
735		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
736		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
737			hapd = iface->bss[0];
738		else
739			return 0;
740	}
741
742	os_memset(&fi, 0, sizeof(fi));
743	fi.datarate = rx_mgmt->datarate;
744	fi.ssi_signal = rx_mgmt->ssi_signal;
745
746	if (hapd == HAPD_BROADCAST) {
747		size_t i;
748		ret = 0;
749		for (i = 0; i < iface->num_bss; i++) {
750			/* if bss is set, driver will call this function for
751			 * each bss individually. */
752			if (rx_mgmt->drv_priv &&
753			    (iface->bss[i]->drv_priv != rx_mgmt->drv_priv))
754				continue;
755
756			if (ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
757					    rx_mgmt->frame_len, &fi) > 0)
758				ret = 1;
759		}
760	} else
761		ret = ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len,
762				      &fi);
763
764	random_add_randomness(&fi, sizeof(fi));
765
766	return ret;
767}
768
769
770static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
771			       size_t len, u16 stype, int ok)
772{
773	struct ieee80211_hdr *hdr;
774	hdr = (struct ieee80211_hdr *) buf;
775	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
776	if (hapd == NULL || hapd == HAPD_BROADCAST)
777		return;
778	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
779}
780
781#endif /* NEED_AP_MLME */
782
783
784static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
785{
786	struct sta_info *sta = ap_get_sta(hapd, addr);
787	if (sta)
788		return 0;
789
790	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
791		   " - adding a new STA", MAC2STR(addr));
792	sta = ap_sta_add(hapd, addr);
793	if (sta) {
794		hostapd_new_assoc_sta(hapd, sta, 0);
795	} else {
796		wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
797			   MAC2STR(addr));
798		return -1;
799	}
800
801	return 0;
802}
803
804
805static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
806				   const u8 *data, size_t data_len)
807{
808	struct hostapd_iface *iface = hapd->iface;
809	struct sta_info *sta;
810	size_t j;
811
812	for (j = 0; j < iface->num_bss; j++) {
813		if ((sta = ap_get_sta(iface->bss[j], src))) {
814			if (sta->flags & WLAN_STA_ASSOC) {
815				hapd = iface->bss[j];
816				break;
817			}
818		}
819	}
820
821	ieee802_1x_receive(hapd, src, data, data_len);
822}
823
824
825static struct hostapd_channel_data * hostapd_get_mode_channel(
826	struct hostapd_iface *iface, unsigned int freq)
827{
828	int i;
829	struct hostapd_channel_data *chan;
830
831	for (i = 0; i < iface->current_mode->num_channels; i++) {
832		chan = &iface->current_mode->channels[i];
833		if (!chan)
834			return NULL;
835		if ((unsigned int) chan->freq == freq)
836			return chan;
837	}
838
839	return NULL;
840}
841
842
843static void hostapd_update_nf(struct hostapd_iface *iface,
844			      struct hostapd_channel_data *chan,
845			      struct freq_survey *survey)
846{
847	if (!iface->chans_surveyed) {
848		chan->min_nf = survey->nf;
849		iface->lowest_nf = survey->nf;
850	} else {
851		if (dl_list_empty(&chan->survey_list))
852			chan->min_nf = survey->nf;
853		else if (survey->nf < chan->min_nf)
854			chan->min_nf = survey->nf;
855		if (survey->nf < iface->lowest_nf)
856			iface->lowest_nf = survey->nf;
857	}
858}
859
860
861static void hostapd_event_get_survey(struct hostapd_data *hapd,
862				     struct survey_results *survey_results)
863{
864	struct hostapd_iface *iface = hapd->iface;
865	struct freq_survey *survey, *tmp;
866	struct hostapd_channel_data *chan;
867
868	if (dl_list_empty(&survey_results->survey_list)) {
869		wpa_printf(MSG_DEBUG, "No survey data received");
870		return;
871	}
872
873	dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
874			      struct freq_survey, list) {
875		chan = hostapd_get_mode_channel(iface, survey->freq);
876		if (!chan)
877			continue;
878		if (chan->flag & HOSTAPD_CHAN_DISABLED)
879			continue;
880
881		dl_list_del(&survey->list);
882		dl_list_add_tail(&chan->survey_list, &survey->list);
883
884		hostapd_update_nf(iface, chan, survey);
885
886		iface->chans_surveyed++;
887	}
888}
889
890
891#ifdef NEED_AP_MLME
892
893static void hostapd_event_iface_unavailable(struct hostapd_data *hapd)
894{
895	wpa_printf(MSG_DEBUG, "Interface %s is unavailable -- stopped",
896		   hapd->conf->iface);
897
898	if (hapd->csa_in_progress) {
899		wpa_printf(MSG_INFO, "CSA failed (%s was stopped)",
900			   hapd->conf->iface);
901		hostapd_switch_channel_fallback(hapd->iface,
902						&hapd->cs_freq_params);
903	}
904}
905
906
907static void hostapd_event_dfs_radar_detected(struct hostapd_data *hapd,
908					     struct dfs_event *radar)
909{
910	wpa_printf(MSG_DEBUG, "DFS radar detected on %d MHz", radar->freq);
911	hostapd_dfs_radar_detected(hapd->iface, radar->freq, radar->ht_enabled,
912				   radar->chan_offset, radar->chan_width,
913				   radar->cf1, radar->cf2);
914}
915
916
917static void hostapd_event_dfs_cac_finished(struct hostapd_data *hapd,
918					   struct dfs_event *radar)
919{
920	wpa_printf(MSG_DEBUG, "DFS CAC finished on %d MHz", radar->freq);
921	hostapd_dfs_complete_cac(hapd->iface, 1, radar->freq, radar->ht_enabled,
922				 radar->chan_offset, radar->chan_width,
923				 radar->cf1, radar->cf2);
924}
925
926
927static void hostapd_event_dfs_cac_aborted(struct hostapd_data *hapd,
928					  struct dfs_event *radar)
929{
930	wpa_printf(MSG_DEBUG, "DFS CAC aborted on %d MHz", radar->freq);
931	hostapd_dfs_complete_cac(hapd->iface, 0, radar->freq, radar->ht_enabled,
932				 radar->chan_offset, radar->chan_width,
933				 radar->cf1, radar->cf2);
934}
935
936
937static void hostapd_event_dfs_nop_finished(struct hostapd_data *hapd,
938					   struct dfs_event *radar)
939{
940	wpa_printf(MSG_DEBUG, "DFS NOP finished on %d MHz", radar->freq);
941	hostapd_dfs_nop_finished(hapd->iface, radar->freq, radar->ht_enabled,
942				 radar->chan_offset, radar->chan_width,
943				 radar->cf1, radar->cf2);
944}
945
946#endif /* NEED_AP_MLME */
947
948
949void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
950			  union wpa_event_data *data)
951{
952	struct hostapd_data *hapd = ctx;
953#ifndef CONFIG_NO_STDOUT_DEBUG
954	int level = MSG_DEBUG;
955
956	if (event == EVENT_RX_MGMT && data->rx_mgmt.frame &&
957	    data->rx_mgmt.frame_len >= 24) {
958		const struct ieee80211_hdr *hdr;
959		u16 fc;
960		hdr = (const struct ieee80211_hdr *) data->rx_mgmt.frame;
961		fc = le_to_host16(hdr->frame_control);
962		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
963		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
964			level = MSG_EXCESSIVE;
965		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
966		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_REQ)
967			level = MSG_EXCESSIVE;
968	}
969
970	wpa_dbg(hapd->msg_ctx, level, "Event %s (%d) received",
971		event_to_string(event), event);
972#endif /* CONFIG_NO_STDOUT_DEBUG */
973
974	switch (event) {
975	case EVENT_MICHAEL_MIC_FAILURE:
976		michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
977		break;
978	case EVENT_SCAN_RESULTS:
979		if (hapd->iface->scan_cb)
980			hapd->iface->scan_cb(hapd->iface);
981		break;
982#ifdef CONFIG_IEEE80211R
983	case EVENT_FT_RRB_RX:
984		wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
985			      data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
986		break;
987#endif /* CONFIG_IEEE80211R */
988	case EVENT_WPS_BUTTON_PUSHED:
989		hostapd_wps_button_pushed(hapd, NULL);
990		break;
991#ifdef NEED_AP_MLME
992	case EVENT_TX_STATUS:
993		switch (data->tx_status.type) {
994		case WLAN_FC_TYPE_MGMT:
995			hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
996					   data->tx_status.data_len,
997					   data->tx_status.stype,
998					   data->tx_status.ack);
999			break;
1000		case WLAN_FC_TYPE_DATA:
1001			hostapd_tx_status(hapd, data->tx_status.dst,
1002					  data->tx_status.data,
1003					  data->tx_status.data_len,
1004					  data->tx_status.ack);
1005			break;
1006		}
1007		break;
1008	case EVENT_EAPOL_TX_STATUS:
1009		hostapd_eapol_tx_status(hapd, data->eapol_tx_status.dst,
1010					data->eapol_tx_status.data,
1011					data->eapol_tx_status.data_len,
1012					data->eapol_tx_status.ack);
1013		break;
1014	case EVENT_DRIVER_CLIENT_POLL_OK:
1015		hostapd_client_poll_ok(hapd, data->client_poll.addr);
1016		break;
1017	case EVENT_RX_FROM_UNKNOWN:
1018		hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid,
1019					    data->rx_from_unknown.addr,
1020					    data->rx_from_unknown.wds);
1021		break;
1022#endif /* NEED_AP_MLME */
1023	case EVENT_RX_MGMT:
1024		if (!data->rx_mgmt.frame)
1025			break;
1026#ifdef NEED_AP_MLME
1027		if (hostapd_mgmt_rx(hapd, &data->rx_mgmt) > 0)
1028			break;
1029#endif /* NEED_AP_MLME */
1030		hostapd_action_rx(hapd, &data->rx_mgmt);
1031		break;
1032	case EVENT_RX_PROBE_REQ:
1033		if (data->rx_probe_req.sa == NULL ||
1034		    data->rx_probe_req.ie == NULL)
1035			break;
1036		hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
1037				     data->rx_probe_req.da,
1038				     data->rx_probe_req.bssid,
1039				     data->rx_probe_req.ie,
1040				     data->rx_probe_req.ie_len,
1041				     data->rx_probe_req.ssi_signal);
1042		break;
1043	case EVENT_NEW_STA:
1044		hostapd_event_new_sta(hapd, data->new_sta.addr);
1045		break;
1046	case EVENT_EAPOL_RX:
1047		hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
1048				       data->eapol_rx.data,
1049				       data->eapol_rx.data_len);
1050		break;
1051	case EVENT_ASSOC:
1052		if (!data)
1053			return;
1054		hostapd_notif_assoc(hapd, data->assoc_info.addr,
1055				    data->assoc_info.req_ies,
1056				    data->assoc_info.req_ies_len,
1057				    data->assoc_info.reassoc);
1058		break;
1059	case EVENT_DISASSOC:
1060		if (data)
1061			hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
1062		break;
1063	case EVENT_DEAUTH:
1064		if (data)
1065			hostapd_notif_disassoc(hapd, data->deauth_info.addr);
1066		break;
1067	case EVENT_STATION_LOW_ACK:
1068		if (!data)
1069			break;
1070		hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
1071		break;
1072	case EVENT_AUTH:
1073		hostapd_notif_auth(hapd, &data->auth);
1074		break;
1075	case EVENT_CH_SWITCH:
1076		if (!data)
1077			break;
1078		hostapd_event_ch_switch(hapd, data->ch_switch.freq,
1079					data->ch_switch.ht_enabled,
1080					data->ch_switch.ch_offset,
1081					data->ch_switch.ch_width,
1082					data->ch_switch.cf1,
1083					data->ch_switch.cf2);
1084		break;
1085	case EVENT_CONNECT_FAILED_REASON:
1086		if (!data)
1087			break;
1088		hostapd_event_connect_failed_reason(
1089			hapd, data->connect_failed_reason.addr,
1090			data->connect_failed_reason.code);
1091		break;
1092	case EVENT_SURVEY:
1093		hostapd_event_get_survey(hapd, &data->survey_results);
1094		break;
1095#ifdef NEED_AP_MLME
1096	case EVENT_INTERFACE_UNAVAILABLE:
1097		hostapd_event_iface_unavailable(hapd);
1098		break;
1099	case EVENT_DFS_RADAR_DETECTED:
1100		if (!data)
1101			break;
1102		hostapd_event_dfs_radar_detected(hapd, &data->dfs_event);
1103		break;
1104	case EVENT_DFS_CAC_FINISHED:
1105		if (!data)
1106			break;
1107		hostapd_event_dfs_cac_finished(hapd, &data->dfs_event);
1108		break;
1109	case EVENT_DFS_CAC_ABORTED:
1110		if (!data)
1111			break;
1112		hostapd_event_dfs_cac_aborted(hapd, &data->dfs_event);
1113		break;
1114	case EVENT_DFS_NOP_FINISHED:
1115		if (!data)
1116			break;
1117		hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
1118		break;
1119	case EVENT_CHANNEL_LIST_CHANGED:
1120		/* channel list changed (regulatory?), update channel list */
1121		/* TODO: check this. hostapd_get_hw_features() initializes
1122		 * too much stuff. */
1123		/* hostapd_get_hw_features(hapd->iface); */
1124		hostapd_channel_list_updated(
1125			hapd->iface, data->channel_list_changed.initiator);
1126		break;
1127#endif /* NEED_AP_MLME */
1128	default:
1129		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
1130		break;
1131	}
1132}
1133
1134#endif /* HOSTAPD */
1135