Home | History | Annotate | Download | only in drivers
      1 /*
      2  * WPA Supplicant - driver interaction with BSD net80211 layer
      3  * Copyright (c) 2004, Sam Leffler <sam (at) errno.com>
      4  * Copyright (c) 2004, 2Wire, Inc
      5  *
      6  * This program is free software; you can redistribute it and/or modify
      7  * it under the terms of the GNU General Public License version 2 as
      8  * published by the Free Software Foundation.
      9  *
     10  * Alternatively, this software may be distributed under the terms of BSD
     11  * license.
     12  *
     13  * See README and COPYING for more details.
     14  */
     15 
     16 #include "includes.h"
     17 #include <sys/ioctl.h>
     18 #include <sys/sysctl.h>
     19 
     20 #include "common.h"
     21 #include "driver.h"
     22 #include "eloop.h"
     23 #include "common/ieee802_11_defs.h"
     24 #include "common/wpa_common.h"
     25 
     26 #include <net/if.h>
     27 #include <net/if_media.h>
     28 
     29 #ifdef __NetBSD__
     30 #include <net/if_ether.h>
     31 #else
     32 #include <net/ethernet.h>
     33 #endif
     34 #include <net/route.h>
     35 
     36 #ifdef __DragonFly__
     37 #include <netproto/802_11/ieee80211_ioctl.h>
     38 #include <netproto/802_11/ieee80211_dragonfly.h>
     39 #else /* __DragonFly__ */
     40 #ifdef __GLIBC__
     41 #include <netinet/ether.h>
     42 #endif /* __GLIBC__ */
     43 #include <net80211/ieee80211.h>
     44 #include <net80211/ieee80211_ioctl.h>
     45 #include <net80211/ieee80211_crypto.h>
     46 #endif /* __DragonFly__ || __GLIBC__ */
     47 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
     48 #include <net80211/ieee80211_freebsd.h>
     49 #endif
     50 #if __NetBSD__
     51 #include <net80211/ieee80211_netbsd.h>
     52 #endif
     53 
     54 #include "l2_packet/l2_packet.h"
     55 
     56 struct bsd_driver_data {
     57 	struct hostapd_data *hapd;	/* back pointer */
     58 
     59 	int	sock;			/* open socket for 802.11 ioctls */
     60 	struct l2_packet_data *sock_xmit;/* raw packet xmit socket */
     61 	int	route;			/* routing socket for events */
     62 	char	ifname[IFNAMSIZ+1];	/* interface name */
     63 	unsigned int ifindex;		/* interface index */
     64 	void	*ctx;
     65 	struct wpa_driver_capa capa;	/* driver capability */
     66 	int	is_ap;			/* Access point mode */
     67 	int	prev_roaming;	/* roaming state to restore on deinit */
     68 	int	prev_privacy;	/* privacy state to restore on deinit */
     69 	int	prev_wpa;	/* wpa state to restore on deinit */
     70 };
     71 
     72 /* Generic functions for hostapd and wpa_supplicant */
     73 
     74 static int
     75 bsd_set80211(void *priv, int op, int val, const void *arg, int arg_len)
     76 {
     77 	struct bsd_driver_data *drv = priv;
     78 	struct ieee80211req ireq;
     79 
     80 	os_memset(&ireq, 0, sizeof(ireq));
     81 	os_strlcpy(ireq.i_name, drv->ifname, sizeof(ireq.i_name));
     82 	ireq.i_type = op;
     83 	ireq.i_val = val;
     84 	ireq.i_data = (void *) arg;
     85 	ireq.i_len = arg_len;
     86 
     87 	if (ioctl(drv->sock, SIOCS80211, &ireq) < 0) {
     88 		wpa_printf(MSG_ERROR, "ioctl[SIOCS80211, op=%u, val=%u, "
     89 			   "arg_len=%u]: %s", op, val, arg_len,
     90 			   strerror(errno));
     91 		return -1;
     92 	}
     93 	return 0;
     94 }
     95 
     96 static int
     97 bsd_get80211(void *priv, struct ieee80211req *ireq, int op, void *arg,
     98 	     int arg_len)
     99 {
    100 	struct bsd_driver_data *drv = priv;
    101 
    102 	os_memset(ireq, 0, sizeof(*ireq));
    103 	os_strlcpy(ireq->i_name, drv->ifname, sizeof(ireq->i_name));
    104 	ireq->i_type = op;
    105 	ireq->i_len = arg_len;
    106 	ireq->i_data = arg;
    107 
    108 	if (ioctl(drv->sock, SIOCG80211, ireq) < 0) {
    109 		wpa_printf(MSG_ERROR, "ioctl[SIOCS80211, op=%u, "
    110 			   "arg_len=%u]: %s", op, arg_len, strerror(errno));
    111 		return -1;
    112 	}
    113 	return 0;
    114 }
    115 
    116 static int
    117 get80211var(struct bsd_driver_data *drv, int op, void *arg, int arg_len)
    118 {
    119 	struct ieee80211req ireq;
    120 
    121 	if (bsd_get80211(drv, &ireq, op, arg, arg_len) < 0)
    122 		return -1;
    123 	return ireq.i_len;
    124 }
    125 
    126 static int
    127 set80211var(struct bsd_driver_data *drv, int op, const void *arg, int arg_len)
    128 {
    129 	return bsd_set80211(drv, op, 0, arg, arg_len);
    130 }
    131 
    132 static int
    133 set80211param(struct bsd_driver_data *drv, int op, int arg)
    134 {
    135 	return bsd_set80211(drv, op, arg, NULL, 0);
    136 }
    137 
    138 static int
    139 bsd_get_ssid(void *priv, u8 *ssid, int len)
    140 {
    141 	struct bsd_driver_data *drv = priv;
    142 #ifdef SIOCG80211NWID
    143 	struct ieee80211_nwid nwid;
    144 	struct ifreq ifr;
    145 
    146 	os_memset(&ifr, 0, sizeof(ifr));
    147 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
    148 	ifr.ifr_data = (void *)&nwid;
    149 	if (ioctl(drv->sock, SIOCG80211NWID, &ifr) < 0 ||
    150 	    nwid.i_len > IEEE80211_NWID_LEN)
    151 		return -1;
    152 	os_memcpy(ssid, nwid.i_nwid, nwid.i_len);
    153 	return nwid.i_len;
    154 #else
    155 	return get80211var(drv, IEEE80211_IOC_SSID, ssid, IEEE80211_NWID_LEN);
    156 #endif
    157 }
    158 
    159 static int
    160 bsd_set_ssid(void *priv, const u8 *ssid, int ssid_len)
    161 {
    162 	struct bsd_driver_data *drv = priv;
    163 #ifdef SIOCS80211NWID
    164 	struct ieee80211_nwid nwid;
    165 	struct ifreq ifr;
    166 
    167 	os_memcpy(nwid.i_nwid, ssid, ssid_len);
    168 	nwid.i_len = ssid_len;
    169 	os_memset(&ifr, 0, sizeof(ifr));
    170 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
    171 	ifr.ifr_data = (void *)&nwid;
    172 	return ioctl(drv->sock, SIOCS80211NWID, &ifr);
    173 #else
    174 	return set80211var(drv, IEEE80211_IOC_SSID, ssid, ssid_len);
    175 #endif
    176 }
    177 
    178 static int
    179 bsd_get_if_media(void *priv)
    180 {
    181 	struct bsd_driver_data *drv = priv;
    182 	struct ifmediareq ifmr;
    183 
    184 	os_memset(&ifmr, 0, sizeof(ifmr));
    185 	os_strlcpy(ifmr.ifm_name, drv->ifname, sizeof(ifmr.ifm_name));
    186 
    187 	if (ioctl(drv->sock, SIOCGIFMEDIA, &ifmr) < 0) {
    188 		wpa_printf(MSG_ERROR, "%s: SIOCGIFMEDIA %s", __func__,
    189 			   strerror(errno));
    190 		return -1;
    191 	}
    192 
    193 	return ifmr.ifm_current;
    194 }
    195 
    196 static int
    197 bsd_set_if_media(void *priv, int media)
    198 {
    199 	struct bsd_driver_data *drv = priv;
    200 	struct ifreq ifr;
    201 
    202 	os_memset(&ifr, 0, sizeof(ifr));
    203 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
    204 	ifr.ifr_media = media;
    205 
    206 	if (ioctl(drv->sock, SIOCSIFMEDIA, &ifr) < 0) {
    207 		wpa_printf(MSG_ERROR, "%s: SIOCSIFMEDIA %s", __func__,
    208 			   strerror(errno));
    209 		return -1;
    210 	}
    211 
    212 	return 0;
    213 }
    214 
    215 static int
    216 bsd_set_mediaopt(void *priv, uint32_t mask, uint32_t mode)
    217 {
    218 	int media = bsd_get_if_media(priv);
    219 
    220 	if (media < 0)
    221 		return -1;
    222 	media &= ~mask;
    223 	media |= mode;
    224 	if (bsd_set_if_media(priv, media) < 0)
    225 		return -1;
    226 	return 0;
    227 }
    228 
    229 static int
    230 bsd_del_key(void *priv, const u8 *addr, int key_idx)
    231 {
    232 	struct ieee80211req_del_key wk;
    233 
    234 	os_memset(&wk, 0, sizeof(wk));
    235 	if (addr == NULL) {
    236 		wpa_printf(MSG_DEBUG, "%s: key_idx=%d", __func__, key_idx);
    237 		wk.idk_keyix = key_idx;
    238 	} else {
    239 		wpa_printf(MSG_DEBUG, "%s: addr=" MACSTR, __func__,
    240 			   MAC2STR(addr));
    241 		os_memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
    242 		wk.idk_keyix = (u_int8_t) IEEE80211_KEYIX_NONE;	/* XXX */
    243 	}
    244 
    245 	return set80211var(priv, IEEE80211_IOC_DELKEY, &wk, sizeof(wk));
    246 }
    247 
    248 static int
    249 bsd_send_mlme_param(void *priv, const u8 op, const u16 reason, const u8 *addr)
    250 {
    251 	struct ieee80211req_mlme mlme;
    252 
    253 	os_memset(&mlme, 0, sizeof(mlme));
    254 	mlme.im_op = op;
    255 	mlme.im_reason = reason;
    256 	os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
    257 	return set80211var(priv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme));
    258 }
    259 
    260 static int
    261 bsd_ctrl_iface(void *priv, int enable)
    262 {
    263 	struct bsd_driver_data *drv = priv;
    264 	struct ifreq ifr;
    265 
    266 	os_memset(&ifr, 0, sizeof(ifr));
    267 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
    268 
    269 	if (ioctl(drv->sock, SIOCGIFFLAGS, &ifr) < 0) {
    270 		perror("ioctl[SIOCGIFFLAGS]");
    271 		return -1;
    272 	}
    273 
    274 	if (enable)
    275 		ifr.ifr_flags |= IFF_UP;
    276 	else
    277 		ifr.ifr_flags &= ~IFF_UP;
    278 
    279 	if (ioctl(drv->sock, SIOCSIFFLAGS, &ifr) < 0) {
    280 		perror("ioctl[SIOCSIFFLAGS]");
    281 		return -1;
    282 	}
    283 
    284 	return 0;
    285 }
    286 
    287 static int
    288 bsd_set_key(const char *ifname, void *priv, enum wpa_alg alg,
    289 	    const unsigned char *addr, int key_idx, int set_tx, const u8 *seq,
    290 	    size_t seq_len, const u8 *key, size_t key_len)
    291 {
    292 	struct ieee80211req_key wk;
    293 
    294 	wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
    295 		   "seq_len=%zu key_len=%zu", __func__, alg, addr, key_idx,
    296 		   set_tx, seq_len, key_len);
    297 
    298 	if (alg == WPA_ALG_NONE) {
    299 #ifndef HOSTAPD
    300 		if (addr == NULL || is_broadcast_ether_addr(addr))
    301 			return bsd_del_key(priv, NULL, key_idx);
    302 		else
    303 #endif /* HOSTAPD */
    304 			return bsd_del_key(priv, addr, key_idx);
    305 	}
    306 
    307 	os_memset(&wk, 0, sizeof(wk));
    308 	switch (alg) {
    309 	case WPA_ALG_WEP:
    310 		wk.ik_type = IEEE80211_CIPHER_WEP;
    311 		break;
    312 	case WPA_ALG_TKIP:
    313 		wk.ik_type = IEEE80211_CIPHER_TKIP;
    314 		break;
    315 	case WPA_ALG_CCMP:
    316 		wk.ik_type = IEEE80211_CIPHER_AES_CCM;
    317 		break;
    318 	default:
    319 		wpa_printf(MSG_ERROR, "%s: unknown alg=%d", __func__, alg);
    320 		return -1;
    321 	}
    322 
    323 	wk.ik_flags = IEEE80211_KEY_RECV;
    324 	if (set_tx)
    325 		wk.ik_flags |= IEEE80211_KEY_XMIT;
    326 
    327 	if (addr == NULL) {
    328 		os_memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
    329 		wk.ik_keyix = key_idx;
    330 	} else {
    331 		os_memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
    332 		/*
    333 		 * Deduce whether group/global or unicast key by checking
    334 		 * the address (yech).  Note also that we can only mark global
    335 		 * keys default; doing this for a unicast key is an error.
    336 		 */
    337 		if (is_broadcast_ether_addr(addr)) {
    338 			wk.ik_flags |= IEEE80211_KEY_GROUP;
    339 			wk.ik_keyix = key_idx;
    340 		} else {
    341 			wk.ik_keyix = key_idx == 0 ? IEEE80211_KEYIX_NONE :
    342 				key_idx;
    343 		}
    344 	}
    345 	if (wk.ik_keyix != IEEE80211_KEYIX_NONE && set_tx)
    346 		wk.ik_flags |= IEEE80211_KEY_DEFAULT;
    347 	wk.ik_keylen = key_len;
    348 	if (seq) {
    349 #ifdef WORDS_BIGENDIAN
    350 		/*
    351 		 * wk.ik_keyrsc is in host byte order (big endian), need to
    352 		 * swap it to match with the byte order used in WPA.
    353 		 */
    354 		int i;
    355 		u8 *keyrsc = (u8 *) &wk.ik_keyrsc;
    356 		for (i = 0; i < seq_len; i++)
    357 			keyrsc[WPA_KEY_RSC_LEN - i - 1] = seq[i];
    358 #else /* WORDS_BIGENDIAN */
    359 		os_memcpy(&wk.ik_keyrsc, seq, seq_len);
    360 #endif /* WORDS_BIGENDIAN */
    361 	}
    362 	os_memcpy(wk.ik_keydata, key, key_len);
    363 
    364 	return set80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk));
    365 }
    366 
    367 static int
    368 bsd_configure_wpa(void *priv, struct wpa_bss_params *params)
    369 {
    370 #ifndef IEEE80211_IOC_APPIE
    371 	static const char *ciphernames[] =
    372 		{ "WEP", "TKIP", "AES-OCB", "AES-CCM", "CKIP", "NONE" };
    373 	int v;
    374 
    375 	switch (params->wpa_group) {
    376 	case WPA_CIPHER_CCMP:
    377 		v = IEEE80211_CIPHER_AES_CCM;
    378 		break;
    379 	case WPA_CIPHER_TKIP:
    380 		v = IEEE80211_CIPHER_TKIP;
    381 		break;
    382 	case WPA_CIPHER_WEP104:
    383 		v = IEEE80211_CIPHER_WEP;
    384 		break;
    385 	case WPA_CIPHER_WEP40:
    386 		v = IEEE80211_CIPHER_WEP;
    387 		break;
    388 	case WPA_CIPHER_NONE:
    389 		v = IEEE80211_CIPHER_NONE;
    390 		break;
    391 	default:
    392 		printf("Unknown group key cipher %u\n",
    393 			params->wpa_group);
    394 		return -1;
    395 	}
    396 	wpa_printf(MSG_DEBUG, "%s: group key cipher=%s (%u)",
    397 		   __func__, ciphernames[v], v);
    398 	if (set80211param(priv, IEEE80211_IOC_MCASTCIPHER, v)) {
    399 		printf("Unable to set group key cipher to %u (%s)\n",
    400 			v, ciphernames[v]);
    401 		return -1;
    402 	}
    403 	if (v == IEEE80211_CIPHER_WEP) {
    404 		/* key length is done only for specific ciphers */
    405 		v = (params->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
    406 		if (set80211param(priv, IEEE80211_IOC_MCASTKEYLEN, v)) {
    407 			printf("Unable to set group key length to %u\n", v);
    408 			return -1;
    409 		}
    410 	}
    411 
    412 	v = 0;
    413 	if (params->wpa_pairwise & WPA_CIPHER_CCMP)
    414 		v |= 1<<IEEE80211_CIPHER_AES_CCM;
    415 	if (params->wpa_pairwise & WPA_CIPHER_TKIP)
    416 		v |= 1<<IEEE80211_CIPHER_TKIP;
    417 	if (params->wpa_pairwise & WPA_CIPHER_NONE)
    418 		v |= 1<<IEEE80211_CIPHER_NONE;
    419 	wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
    420 	if (set80211param(priv, IEEE80211_IOC_UCASTCIPHERS, v)) {
    421 		printf("Unable to set pairwise key ciphers to 0x%x\n", v);
    422 		return -1;
    423 	}
    424 
    425 	wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
    426 		   __func__, params->wpa_key_mgmt);
    427 	if (set80211param(priv, IEEE80211_IOC_KEYMGTALGS,
    428 			  params->wpa_key_mgmt)) {
    429 		printf("Unable to set key management algorithms to 0x%x\n",
    430 			params->wpa_key_mgmt);
    431 		return -1;
    432 	}
    433 
    434 	v = 0;
    435 	if (params->rsn_preauth)
    436 		v |= BIT(0);
    437 	wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
    438 		   __func__, params->rsn_preauth);
    439 	if (set80211param(priv, IEEE80211_IOC_RSNCAPS, v)) {
    440 		printf("Unable to set RSN capabilities to 0x%x\n", v);
    441 		return -1;
    442 	}
    443 #endif /* IEEE80211_IOC_APPIE */
    444 
    445 	wpa_printf(MSG_DEBUG, "%s: enable WPA= 0x%x", __func__, params->wpa);
    446 	if (set80211param(priv, IEEE80211_IOC_WPA, params->wpa)) {
    447 		printf("Unable to set WPA to %u\n", params->wpa);
    448 		return -1;
    449 	}
    450 	return 0;
    451 }
    452 
    453 static int
    454 bsd_set_ieee8021x(void *priv, struct wpa_bss_params *params)
    455 {
    456 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, params->enabled);
    457 
    458 	if (!params->enabled) {
    459 		/* XXX restore state */
    460 		return set80211param(priv, IEEE80211_IOC_AUTHMODE,
    461 				     IEEE80211_AUTH_AUTO);
    462 	}
    463 	if (!params->wpa && !params->ieee802_1x) {
    464 		wpa_printf(MSG_ERROR, "%s: No 802.1X or WPA enabled",
    465 			   __func__);
    466 		return -1;
    467 	}
    468 	if (params->wpa && bsd_configure_wpa(priv, params) != 0) {
    469 		wpa_printf(MSG_ERROR, "%s: Failed to configure WPA state",
    470 			   __func__);
    471 		return -1;
    472 	}
    473 	if (set80211param(priv, IEEE80211_IOC_AUTHMODE,
    474 		(params->wpa ? IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
    475 		wpa_printf(MSG_ERROR, "%s: Failed to enable WPA/802.1X",
    476 			   __func__);
    477 		return -1;
    478 	}
    479 	return bsd_ctrl_iface(priv, 1);
    480 }
    481 
    482 static int
    483 bsd_set_sta_authorized(void *priv, const u8 *addr,
    484 		       int total_flags, int flags_or, int flags_and)
    485 {
    486 	int authorized = -1;
    487 
    488 	/* For now, only support setting Authorized flag */
    489 	if (flags_or & WPA_STA_AUTHORIZED)
    490 		authorized = 1;
    491 	if (!(flags_and & WPA_STA_AUTHORIZED))
    492 		authorized = 0;
    493 
    494 	if (authorized < 0)
    495 		return 0;
    496 
    497 	return bsd_send_mlme_param(priv, authorized ?
    498 				   IEEE80211_MLME_AUTHORIZE :
    499 				   IEEE80211_MLME_UNAUTHORIZE, 0, addr);
    500 }
    501 
    502 static void
    503 bsd_new_sta(void *priv, void *ctx, u8 addr[IEEE80211_ADDR_LEN])
    504 {
    505 	struct ieee80211req_wpaie ie;
    506 	int ielen = 0;
    507 	u8 *iebuf = NULL;
    508 
    509 	/*
    510 	 * Fetch and validate any negotiated WPA/RSN parameters.
    511 	 */
    512 	memset(&ie, 0, sizeof(ie));
    513 	memcpy(ie.wpa_macaddr, addr, IEEE80211_ADDR_LEN);
    514 	if (get80211var(priv, IEEE80211_IOC_WPAIE, &ie, sizeof(ie)) < 0) {
    515 		printf("Failed to get WPA/RSN information element.\n");
    516 		goto no_ie;
    517 	}
    518 	iebuf = ie.wpa_ie;
    519 	ielen = ie.wpa_ie[1];
    520 	if (ielen == 0)
    521 		iebuf = NULL;
    522 	else
    523 		ielen += 2;
    524 
    525 no_ie:
    526 	drv_event_assoc(ctx, addr, iebuf, ielen, 0);
    527 }
    528 
    529 static int
    530 bsd_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
    531 	       int encrypt, const u8 *own_addr, u32 flags)
    532 {
    533 	struct bsd_driver_data *drv = priv;
    534 
    535 	wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", data, data_len);
    536 
    537 	return l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, data,
    538 			      data_len);
    539 }
    540 
    541 static int
    542 bsd_set_freq(void *priv, struct hostapd_freq_params *freq)
    543 {
    544 	struct bsd_driver_data *drv = priv;
    545 #ifdef SIOCS80211CHANNEL
    546 	struct ieee80211chanreq creq;
    547 #endif /* SIOCS80211CHANNEL */
    548 	u32 mode;
    549 	int channel = freq->channel;
    550 
    551 	if (channel < 14) {
    552 		mode =
    553 #ifdef CONFIG_IEEE80211N
    554 			freq->ht_enabled ? IFM_IEEE80211_11NG :
    555 #endif /* CONFIG_IEEE80211N */
    556 		        IFM_IEEE80211_11G;
    557 	} else if (channel == 14) {
    558 		mode = IFM_IEEE80211_11B;
    559 	} else {
    560 		mode =
    561 #ifdef CONFIG_IEEE80211N
    562 			freq->ht_enabled ? IFM_IEEE80211_11NA :
    563 #endif /* CONFIG_IEEE80211N */
    564 			IFM_IEEE80211_11A;
    565 	}
    566 	if (bsd_set_mediaopt(drv, IFM_MMASK, mode) < 0) {
    567 		wpa_printf(MSG_ERROR, "%s: failed to set modulation mode",
    568 			   __func__);
    569 		return -1;
    570 	}
    571 
    572 #ifdef SIOCS80211CHANNEL
    573 	os_memset(&creq, 0, sizeof(creq));
    574 	os_strlcpy(creq.i_name, drv->ifname, sizeof(creq.i_name));
    575 	creq.i_channel = (u_int16_t)channel;
    576 	return ioctl(drv->sock, SIOCS80211CHANNEL, &creq);
    577 #else /* SIOCS80211CHANNEL */
    578 	return set80211param(priv, IEEE80211_IOC_CHANNEL, channel);
    579 #endif /* SIOCS80211CHANNEL */
    580 }
    581 
    582 static int
    583 bsd_set_opt_ie(void *priv, const u8 *ie, size_t ie_len)
    584 {
    585 #ifdef IEEE80211_IOC_APPIE
    586 	wpa_printf(MSG_DEBUG, "%s: set WPA+RSN ie (len %lu)", __func__,
    587 		   (unsigned long)ie_len);
    588 	return bsd_set80211(priv, IEEE80211_IOC_APPIE, IEEE80211_APPIE_WPA,
    589 			    ie, ie_len);
    590 #endif /* IEEE80211_IOC_APPIE */
    591 	return 0;
    592 }
    593 
    594 static int
    595 rtbuf_len(void)
    596 {
    597 	size_t len;
    598 
    599 	int mib[6] = {CTL_NET, AF_ROUTE, 0, AF_INET, NET_RT_DUMP, 0};
    600 
    601 	if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0) {
    602 		wpa_printf(MSG_WARNING, "%s failed: %s\n", __func__,
    603 			   strerror(errno));
    604 		len = 2048;
    605 	}
    606 
    607 	return len;
    608 }
    609 
    610 #ifdef HOSTAPD
    611 
    612 /*
    613  * Avoid conflicts with hostapd definitions by undefining couple of defines
    614  * from net80211 header files.
    615  */
    616 #undef RSN_VERSION
    617 #undef WPA_VERSION
    618 #undef WPA_OUI_TYPE
    619 
    620 static int bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
    621 			  int reason_code);
    622 
    623 static const char *
    624 ether_sprintf(const u8 *addr)
    625 {
    626 	static char buf[sizeof(MACSTR)];
    627 
    628 	if (addr != NULL)
    629 		snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
    630 	else
    631 		snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
    632 	return buf;
    633 }
    634 
    635 static int
    636 bsd_set_privacy(void *priv, int enabled)
    637 {
    638 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
    639 
    640 	return set80211param(priv, IEEE80211_IOC_PRIVACY, enabled);
    641 }
    642 
    643 static int
    644 bsd_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
    645 	       u8 *seq)
    646 {
    647 	struct ieee80211req_key wk;
    648 
    649 	wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
    650 		   __func__, ether_sprintf(addr), idx);
    651 
    652 	memset(&wk, 0, sizeof(wk));
    653 	if (addr == NULL)
    654 		memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
    655 	else
    656 		memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
    657 	wk.ik_keyix = idx;
    658 
    659 	if (get80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk)) < 0) {
    660 		printf("Failed to get encryption.\n");
    661 		return -1;
    662 	}
    663 
    664 #ifdef WORDS_BIGENDIAN
    665 	{
    666 		/*
    667 		 * wk.ik_keytsc is in host byte order (big endian), need to
    668 		 * swap it to match with the byte order used in WPA.
    669 		 */
    670 		int i;
    671 		u8 tmp[WPA_KEY_RSC_LEN];
    672 		memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
    673 		for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
    674 			seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
    675 		}
    676 	}
    677 #else /* WORDS_BIGENDIAN */
    678 	memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
    679 #endif /* WORDS_BIGENDIAN */
    680 	return 0;
    681 }
    682 
    683 
    684 static int
    685 bsd_flush(void *priv)
    686 {
    687 	u8 allsta[IEEE80211_ADDR_LEN];
    688 
    689 	memset(allsta, 0xff, IEEE80211_ADDR_LEN);
    690 	return bsd_sta_deauth(priv, NULL, allsta, IEEE80211_REASON_AUTH_LEAVE);
    691 }
    692 
    693 
    694 static int
    695 bsd_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
    696 			 const u8 *addr)
    697 {
    698 	struct ieee80211req_sta_stats stats;
    699 
    700 	memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
    701 	if (get80211var(priv, IEEE80211_IOC_STA_STATS, &stats, sizeof(stats))
    702 	    > 0) {
    703 		/* XXX? do packets counts include non-data frames? */
    704 		data->rx_packets = stats.is_stats.ns_rx_data;
    705 		data->rx_bytes = stats.is_stats.ns_rx_bytes;
    706 		data->tx_packets = stats.is_stats.ns_tx_data;
    707 		data->tx_bytes = stats.is_stats.ns_tx_bytes;
    708 	}
    709 	return 0;
    710 }
    711 
    712 static int
    713 bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr, int reason_code)
    714 {
    715 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
    716 				   addr);
    717 }
    718 
    719 static int
    720 bsd_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
    721 		 int reason_code)
    722 {
    723 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DISASSOC, reason_code,
    724 				   addr);
    725 }
    726 
    727 static void
    728 bsd_wireless_event_receive(int sock, void *ctx, void *sock_ctx)
    729 {
    730 	struct bsd_driver_data *drv = ctx;
    731 	char *buf;
    732 	struct if_announcemsghdr *ifan;
    733 	struct rt_msghdr *rtm;
    734 	struct ieee80211_michael_event *mic;
    735 	struct ieee80211_join_event *join;
    736 	struct ieee80211_leave_event *leave;
    737 	int n, len;
    738 	union wpa_event_data data;
    739 
    740 	len = rtbuf_len();
    741 
    742 	buf = os_malloc(len);
    743 	if (buf == NULL) {
    744 		wpa_printf(MSG_ERROR, "%s os_malloc() failed\n", __func__);
    745 		return;
    746 	}
    747 
    748 	n = read(sock, buf, len);
    749 	if (n < 0) {
    750 		if (errno != EINTR && errno != EAGAIN)
    751 			wpa_printf(MSG_ERROR, "%s read() failed: %s\n",
    752 				   __func__, strerror(errno));
    753 		os_free(buf);
    754 		return;
    755 	}
    756 
    757 	rtm = (struct rt_msghdr *) buf;
    758 	if (rtm->rtm_version != RTM_VERSION) {
    759 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
    760 			   rtm->rtm_version);
    761 		os_free(buf);
    762 		return;
    763 	}
    764 	ifan = (struct if_announcemsghdr *) rtm;
    765 	switch (rtm->rtm_type) {
    766 	case RTM_IEEE80211:
    767 		switch (ifan->ifan_what) {
    768 		case RTM_IEEE80211_ASSOC:
    769 		case RTM_IEEE80211_REASSOC:
    770 		case RTM_IEEE80211_DISASSOC:
    771 		case RTM_IEEE80211_SCAN:
    772 			break;
    773 		case RTM_IEEE80211_LEAVE:
    774 			leave = (struct ieee80211_leave_event *) &ifan[1];
    775 			drv_event_disassoc(drv->hapd, leave->iev_addr);
    776 			break;
    777 		case RTM_IEEE80211_JOIN:
    778 #ifdef RTM_IEEE80211_REJOIN
    779 		case RTM_IEEE80211_REJOIN:
    780 #endif
    781 			join = (struct ieee80211_join_event *) &ifan[1];
    782 			bsd_new_sta(drv, drv->hapd, join->iev_addr);
    783 			break;
    784 		case RTM_IEEE80211_REPLAY:
    785 			/* ignore */
    786 			break;
    787 		case RTM_IEEE80211_MICHAEL:
    788 			mic = (struct ieee80211_michael_event *) &ifan[1];
    789 			wpa_printf(MSG_DEBUG,
    790 				"Michael MIC failure wireless event: "
    791 				"keyix=%u src_addr=" MACSTR, mic->iev_keyix,
    792 				MAC2STR(mic->iev_src));
    793 			os_memset(&data, 0, sizeof(data));
    794 			data.michael_mic_failure.unicast = 1;
    795 			data.michael_mic_failure.src = mic->iev_src;
    796 			wpa_supplicant_event(drv->hapd,
    797 					     EVENT_MICHAEL_MIC_FAILURE, &data);
    798 			break;
    799 		}
    800 		break;
    801 	}
    802 	os_free(buf);
    803 }
    804 
    805 static void
    806 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
    807 {
    808 	struct bsd_driver_data *drv = ctx;
    809 	drv_event_eapol_rx(drv->hapd, src_addr, buf, len);
    810 }
    811 
    812 static void *
    813 bsd_init(struct hostapd_data *hapd, struct wpa_init_params *params)
    814 {
    815 	struct bsd_driver_data *drv;
    816 
    817 	drv = os_zalloc(sizeof(struct bsd_driver_data));
    818 	if (drv == NULL) {
    819 		printf("Could not allocate memory for bsd driver data\n");
    820 		goto bad;
    821 	}
    822 
    823 	drv->hapd = hapd;
    824 	drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
    825 	if (drv->sock < 0) {
    826 		perror("socket[PF_INET,SOCK_DGRAM]");
    827 		goto bad;
    828 	}
    829 	os_strlcpy(drv->ifname, params->ifname, sizeof(drv->ifname));
    830 
    831 	drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
    832 					handle_read, drv, 0);
    833 	if (drv->sock_xmit == NULL)
    834 		goto bad;
    835 	if (l2_packet_get_own_addr(drv->sock_xmit, params->own_addr))
    836 		goto bad;
    837 
    838 	/* mark down during setup */
    839 	if (bsd_ctrl_iface(drv, 0) < 0)
    840 		goto bad;
    841 
    842 	drv->route = socket(PF_ROUTE, SOCK_RAW, 0);
    843 	if (drv->route < 0) {
    844 		perror("socket(PF_ROUTE,SOCK_RAW)");
    845 		goto bad;
    846 	}
    847 	eloop_register_read_sock(drv->route, bsd_wireless_event_receive, drv,
    848 				 NULL);
    849 
    850 	if (bsd_set_mediaopt(drv, IFM_OMASK, IFM_IEEE80211_HOSTAP) < 0) {
    851 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
    852 			   __func__);
    853 		goto bad;
    854 	}
    855 
    856 	return drv;
    857 bad:
    858 	if (drv->sock_xmit != NULL)
    859 		l2_packet_deinit(drv->sock_xmit);
    860 	if (drv->sock >= 0)
    861 		close(drv->sock);
    862 	if (drv != NULL)
    863 		os_free(drv);
    864 	return NULL;
    865 }
    866 
    867 
    868 static void
    869 bsd_deinit(void *priv)
    870 {
    871 	struct bsd_driver_data *drv = priv;
    872 
    873 	if (drv->route >= 0) {
    874 		eloop_unregister_read_sock(drv->route);
    875 		close(drv->route);
    876 	}
    877 	bsd_ctrl_iface(drv, 0);
    878 	if (drv->sock >= 0)
    879 		close(drv->sock);
    880 	if (drv->sock_xmit != NULL)
    881 		l2_packet_deinit(drv->sock_xmit);
    882 	os_free(drv);
    883 }
    884 
    885 #else /* HOSTAPD */
    886 
    887 static int
    888 get80211param(struct bsd_driver_data *drv, int op)
    889 {
    890 	struct ieee80211req ireq;
    891 
    892 	if (bsd_get80211(drv, &ireq, op, NULL, 0) < 0)
    893 		return -1;
    894 	return ireq.i_val;
    895 }
    896 
    897 static int
    898 wpa_driver_bsd_get_bssid(void *priv, u8 *bssid)
    899 {
    900 	struct bsd_driver_data *drv = priv;
    901 #ifdef SIOCG80211BSSID
    902 	struct ieee80211_bssid bs;
    903 
    904 	os_strlcpy(bs.i_name, drv->ifname, sizeof(bs.i_name));
    905 	if (ioctl(drv->sock, SIOCG80211BSSID, &bs) < 0)
    906 		return -1;
    907 	os_memcpy(bssid, bs.i_bssid, sizeof(bs.i_bssid));
    908 	return 0;
    909 #else
    910 	return get80211var(drv, IEEE80211_IOC_BSSID,
    911 		bssid, IEEE80211_ADDR_LEN) < 0 ? -1 : 0;
    912 #endif
    913 }
    914 
    915 static int
    916 wpa_driver_bsd_get_ssid(void *priv, u8 *ssid)
    917 {
    918 	struct bsd_driver_data *drv = priv;
    919 	return bsd_get_ssid(drv, ssid, 0);
    920 }
    921 
    922 static int
    923 wpa_driver_bsd_set_wpa_ie(struct bsd_driver_data *drv, const u8 *wpa_ie,
    924 			  size_t wpa_ie_len)
    925 {
    926 #ifdef IEEE80211_IOC_APPIE
    927 	return bsd_set_opt_ie(drv, wpa_ie, wpa_ie_len);
    928 #else /* IEEE80211_IOC_APPIE */
    929 	return set80211var(drv, IEEE80211_IOC_OPTIE, wpa_ie, wpa_ie_len);
    930 #endif /* IEEE80211_IOC_APPIE */
    931 }
    932 
    933 static int
    934 wpa_driver_bsd_set_wpa_internal(void *priv, int wpa, int privacy)
    935 {
    936 	int ret = 0;
    937 
    938 	wpa_printf(MSG_DEBUG, "%s: wpa=%d privacy=%d",
    939 		__FUNCTION__, wpa, privacy);
    940 
    941 	if (!wpa && wpa_driver_bsd_set_wpa_ie(priv, NULL, 0) < 0)
    942 		ret = -1;
    943 	if (set80211param(priv, IEEE80211_IOC_PRIVACY, privacy) < 0)
    944 		ret = -1;
    945 	if (set80211param(priv, IEEE80211_IOC_WPA, wpa) < 0)
    946 		ret = -1;
    947 
    948 	return ret;
    949 }
    950 
    951 static int
    952 wpa_driver_bsd_set_wpa(void *priv, int enabled)
    953 {
    954 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
    955 
    956 	return wpa_driver_bsd_set_wpa_internal(priv, enabled ? 3 : 0, enabled);
    957 }
    958 
    959 static int
    960 wpa_driver_bsd_set_countermeasures(void *priv, int enabled)
    961 {
    962 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
    963 	return set80211param(priv, IEEE80211_IOC_COUNTERMEASURES, enabled);
    964 }
    965 
    966 
    967 static int
    968 wpa_driver_bsd_set_drop_unencrypted(void *priv, int enabled)
    969 {
    970 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
    971 	return set80211param(priv, IEEE80211_IOC_DROPUNENCRYPTED, enabled);
    972 }
    973 
    974 static int
    975 wpa_driver_bsd_deauthenticate(void *priv, const u8 *addr, int reason_code)
    976 {
    977 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
    978 				   addr);
    979 }
    980 
    981 static int
    982 wpa_driver_bsd_disassociate(void *priv, const u8 *addr, int reason_code)
    983 {
    984 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DISASSOC, reason_code,
    985 				   addr);
    986 }
    987 
    988 static int
    989 wpa_driver_bsd_set_auth_alg(void *priv, int auth_alg)
    990 {
    991 	int authmode;
    992 
    993 	if ((auth_alg & WPA_AUTH_ALG_OPEN) &&
    994 	    (auth_alg & WPA_AUTH_ALG_SHARED))
    995 		authmode = IEEE80211_AUTH_AUTO;
    996 	else if (auth_alg & WPA_AUTH_ALG_SHARED)
    997 		authmode = IEEE80211_AUTH_SHARED;
    998 	else
    999 		authmode = IEEE80211_AUTH_OPEN;
   1000 
   1001 	return set80211param(priv, IEEE80211_IOC_AUTHMODE, authmode);
   1002 }
   1003 
   1004 static void
   1005 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
   1006 {
   1007 	struct bsd_driver_data *drv = ctx;
   1008 
   1009 	drv_event_eapol_rx(drv->ctx, src_addr, buf, len);
   1010 }
   1011 
   1012 static int
   1013 wpa_driver_bsd_associate(void *priv, struct wpa_driver_associate_params *params)
   1014 {
   1015 	struct bsd_driver_data *drv = priv;
   1016 	struct ieee80211req_mlme mlme;
   1017 	u32 mode;
   1018 	int privacy;
   1019 	int ret = 0;
   1020 
   1021 	wpa_printf(MSG_DEBUG,
   1022 		"%s: ssid '%.*s' wpa ie len %u pairwise %u group %u key mgmt %u"
   1023 		, __func__
   1024 		   , (unsigned int) params->ssid_len, params->ssid
   1025 		, (unsigned int) params->wpa_ie_len
   1026 		, params->pairwise_suite
   1027 		, params->group_suite
   1028 		, params->key_mgmt_suite
   1029 	);
   1030 
   1031 	switch (params->mode) {
   1032 	case IEEE80211_MODE_INFRA:
   1033 		mode = 0 /* STA */;
   1034 		break;
   1035 	case IEEE80211_MODE_IBSS:
   1036 		mode = IFM_IEEE80211_IBSS;
   1037 		break;
   1038 	case IEEE80211_MODE_AP:
   1039 		mode = IFM_IEEE80211_HOSTAP;
   1040 		break;
   1041 	default:
   1042 		wpa_printf(MSG_ERROR, "%s: unknown operation mode", __func__);
   1043 		return -1;
   1044 	}
   1045 	if (bsd_set_mediaopt(drv, IFM_OMASK, mode) < 0) {
   1046 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
   1047 			   __func__);
   1048 		return -1;
   1049 	}
   1050 
   1051 	if (params->mode == IEEE80211_MODE_AP) {
   1052 		drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
   1053 						handle_read, drv, 0);
   1054 		if (drv->sock_xmit == NULL)
   1055 			return -1;
   1056 		drv->is_ap = 1;
   1057 		return 0;
   1058 	}
   1059 
   1060 	if (wpa_driver_bsd_set_drop_unencrypted(drv, params->drop_unencrypted)
   1061 	    < 0)
   1062 		ret = -1;
   1063 	if (wpa_driver_bsd_set_auth_alg(drv, params->auth_alg) < 0)
   1064 		ret = -1;
   1065 	/* XXX error handling is wrong but unclear what to do... */
   1066 	if (wpa_driver_bsd_set_wpa_ie(drv, params->wpa_ie, params->wpa_ie_len) < 0)
   1067 		return -1;
   1068 
   1069 	privacy = !(params->pairwise_suite == CIPHER_NONE &&
   1070 	    params->group_suite == CIPHER_NONE &&
   1071 	    params->key_mgmt_suite == KEY_MGMT_NONE &&
   1072 	    params->wpa_ie_len == 0);
   1073 	wpa_printf(MSG_DEBUG, "%s: set PRIVACY %u", __func__, privacy);
   1074 
   1075 	if (set80211param(drv, IEEE80211_IOC_PRIVACY, privacy) < 0)
   1076 		return -1;
   1077 
   1078 	if (params->wpa_ie_len &&
   1079 	    set80211param(drv, IEEE80211_IOC_WPA,
   1080 			  params->wpa_ie[0] == WLAN_EID_RSN ? 2 : 1) < 0)
   1081 		return -1;
   1082 
   1083 	os_memset(&mlme, 0, sizeof(mlme));
   1084 	mlme.im_op = IEEE80211_MLME_ASSOC;
   1085 	if (params->ssid != NULL)
   1086 		os_memcpy(mlme.im_ssid, params->ssid, params->ssid_len);
   1087 	mlme.im_ssid_len = params->ssid_len;
   1088 	if (params->bssid != NULL)
   1089 		os_memcpy(mlme.im_macaddr, params->bssid, IEEE80211_ADDR_LEN);
   1090 	if (set80211var(drv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme)) < 0)
   1091 		return -1;
   1092 	return ret;
   1093 }
   1094 
   1095 static int
   1096 wpa_driver_bsd_scan(void *priv, struct wpa_driver_scan_params *params)
   1097 {
   1098 	struct bsd_driver_data *drv = priv;
   1099 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
   1100 	struct ieee80211_scan_req sr;
   1101 	int i;
   1102 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
   1103 
   1104 	if (bsd_set_mediaopt(drv, IFM_OMASK, 0 /* STA */) < 0) {
   1105 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
   1106 			   __func__);
   1107 		return -1;
   1108 	}
   1109 
   1110 	if (set80211param(drv, IEEE80211_IOC_ROAMING,
   1111 			  IEEE80211_ROAMING_MANUAL) < 0) {
   1112 		wpa_printf(MSG_ERROR, "%s: failed to set "
   1113 			   "wpa_supplicant-based roaming: %s", __func__,
   1114 			   strerror(errno));
   1115 		return -1;
   1116 	}
   1117 
   1118 	if (wpa_driver_bsd_set_wpa(drv, 1) < 0) {
   1119 		wpa_printf(MSG_ERROR, "%s: failed to set wpa: %s", __func__,
   1120 			   strerror(errno));
   1121 		return -1;
   1122 	}
   1123 
   1124 	/* NB: interface must be marked UP to do a scan */
   1125 	if (bsd_ctrl_iface(drv, 1) < 0)
   1126 		return -1;
   1127 
   1128 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
   1129 	os_memset(&sr, 0, sizeof(sr));
   1130 	sr.sr_flags = IEEE80211_IOC_SCAN_ACTIVE | IEEE80211_IOC_SCAN_ONCE |
   1131 		IEEE80211_IOC_SCAN_NOJOIN;
   1132 	sr.sr_duration = IEEE80211_IOC_SCAN_FOREVER;
   1133 	if (params->num_ssids > 0) {
   1134 		sr.sr_nssid = params->num_ssids;
   1135 #if 0
   1136 		/* Boundary check is done by upper layer */
   1137 		if (sr.sr_nssid > IEEE80211_IOC_SCAN_MAX_SSID)
   1138 			sr.sr_nssid = IEEE80211_IOC_SCAN_MAX_SSID;
   1139 #endif
   1140 
   1141 		/* NB: check scan cache first */
   1142 		sr.sr_flags |= IEEE80211_IOC_SCAN_CHECK;
   1143 	}
   1144 	for (i = 0; i < sr.sr_nssid; i++) {
   1145 		sr.sr_ssid[i].len = params->ssids[i].ssid_len;
   1146 		os_memcpy(sr.sr_ssid[i].ssid, params->ssids[i].ssid,
   1147 			  sr.sr_ssid[i].len);
   1148 	}
   1149 
   1150 	/* NB: net80211 delivers a scan complete event so no need to poll */
   1151 	return set80211var(drv, IEEE80211_IOC_SCAN_REQ, &sr, sizeof(sr));
   1152 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
   1153 	/* set desired ssid before scan */
   1154 	if (bsd_set_ssid(drv, params->ssids[0].ssid,
   1155 			 params->ssids[0].ssid_len) < 0)
   1156 		return -1;
   1157 
   1158 	/* NB: net80211 delivers a scan complete event so no need to poll */
   1159 	return set80211param(drv, IEEE80211_IOC_SCAN_REQ, 0);
   1160 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
   1161 }
   1162 
   1163 static void
   1164 wpa_driver_bsd_event_receive(int sock, void *ctx, void *sock_ctx)
   1165 {
   1166 	struct bsd_driver_data *drv = sock_ctx;
   1167 	char *buf;
   1168 	struct if_announcemsghdr *ifan;
   1169 	struct if_msghdr *ifm;
   1170 	struct rt_msghdr *rtm;
   1171 	union wpa_event_data event;
   1172 	struct ieee80211_michael_event *mic;
   1173 	struct ieee80211_leave_event *leave;
   1174 	struct ieee80211_join_event *join;
   1175 	int n, len;
   1176 
   1177 	len = rtbuf_len();
   1178 
   1179 	buf = os_malloc(len);
   1180 	if (buf == NULL) {
   1181 		wpa_printf(MSG_ERROR, "%s os_malloc() failed\n", __func__);
   1182 		return;
   1183 	}
   1184 
   1185 	n = read(sock, buf, len);
   1186 	if (n < 0) {
   1187 		if (errno != EINTR && errno != EAGAIN)
   1188 			wpa_printf(MSG_ERROR, "%s read() failed: %s\n",
   1189 				   __func__, strerror(errno));
   1190 		os_free(buf);
   1191 		return;
   1192 	}
   1193 
   1194 	rtm = (struct rt_msghdr *) buf;
   1195 	if (rtm->rtm_version != RTM_VERSION) {
   1196 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
   1197 			   rtm->rtm_version);
   1198 		os_free(buf);
   1199 		return;
   1200 	}
   1201 	os_memset(&event, 0, sizeof(event));
   1202 	switch (rtm->rtm_type) {
   1203 	case RTM_IFANNOUNCE:
   1204 		ifan = (struct if_announcemsghdr *) rtm;
   1205 		if (ifan->ifan_index != drv->ifindex)
   1206 			break;
   1207 		os_strlcpy(event.interface_status.ifname, drv->ifname,
   1208 			   sizeof(event.interface_status.ifname));
   1209 		switch (ifan->ifan_what) {
   1210 		case IFAN_DEPARTURE:
   1211 			event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
   1212 		default:
   1213 			os_free(buf);
   1214 			return;
   1215 		}
   1216 		wpa_printf(MSG_DEBUG, "RTM_IFANNOUNCE: Interface '%s' %s",
   1217 			   event.interface_status.ifname,
   1218 			   ifan->ifan_what == IFAN_DEPARTURE ?
   1219 				"removed" : "added");
   1220 		wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
   1221 		break;
   1222 	case RTM_IEEE80211:
   1223 		ifan = (struct if_announcemsghdr *) rtm;
   1224 		if (ifan->ifan_index != drv->ifindex)
   1225 			break;
   1226 		switch (ifan->ifan_what) {
   1227 		case RTM_IEEE80211_ASSOC:
   1228 		case RTM_IEEE80211_REASSOC:
   1229 			if (drv->is_ap)
   1230 				break;
   1231 			wpa_supplicant_event(ctx, EVENT_ASSOC, NULL);
   1232 			break;
   1233 		case RTM_IEEE80211_DISASSOC:
   1234 			if (drv->is_ap)
   1235 				break;
   1236 			wpa_supplicant_event(ctx, EVENT_DISASSOC, NULL);
   1237 			break;
   1238 		case RTM_IEEE80211_SCAN:
   1239 			if (drv->is_ap)
   1240 				break;
   1241 			wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, NULL);
   1242 			break;
   1243 		case RTM_IEEE80211_LEAVE:
   1244 			leave = (struct ieee80211_leave_event *) &ifan[1];
   1245 			drv_event_disassoc(ctx, leave->iev_addr);
   1246 			break;
   1247 		case RTM_IEEE80211_JOIN:
   1248 #ifdef RTM_IEEE80211_REJOIN
   1249 		case RTM_IEEE80211_REJOIN:
   1250 #endif
   1251 			join = (struct ieee80211_join_event *) &ifan[1];
   1252 			bsd_new_sta(drv, ctx, join->iev_addr);
   1253 			break;
   1254 		case RTM_IEEE80211_REPLAY:
   1255 			/* ignore */
   1256 			break;
   1257 		case RTM_IEEE80211_MICHAEL:
   1258 			mic = (struct ieee80211_michael_event *) &ifan[1];
   1259 			wpa_printf(MSG_DEBUG,
   1260 				"Michael MIC failure wireless event: "
   1261 				"keyix=%u src_addr=" MACSTR, mic->iev_keyix,
   1262 				MAC2STR(mic->iev_src));
   1263 
   1264 			os_memset(&event, 0, sizeof(event));
   1265 			event.michael_mic_failure.unicast =
   1266 				!IEEE80211_IS_MULTICAST(mic->iev_dst);
   1267 			wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE,
   1268 				&event);
   1269 			break;
   1270 		}
   1271 		break;
   1272 	case RTM_IFINFO:
   1273 		ifm = (struct if_msghdr *) rtm;
   1274 		if (ifm->ifm_index != drv->ifindex)
   1275 			break;
   1276 		if ((rtm->rtm_flags & RTF_UP) == 0) {
   1277 			os_strlcpy(event.interface_status.ifname, drv->ifname,
   1278 				   sizeof(event.interface_status.ifname));
   1279 			event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
   1280 			wpa_printf(MSG_DEBUG, "RTM_IFINFO: Interface '%s' DOWN",
   1281 				   event.interface_status.ifname);
   1282 			wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
   1283 		}
   1284 		break;
   1285 	}
   1286 	os_free(buf);
   1287 }
   1288 
   1289 static void
   1290 wpa_driver_bsd_add_scan_entry(struct wpa_scan_results *res,
   1291 			      struct ieee80211req_scan_result *sr)
   1292 {
   1293 	struct wpa_scan_res *result, **tmp;
   1294 	size_t extra_len;
   1295 	u8 *pos;
   1296 
   1297 	extra_len = 2 + sr->isr_ssid_len;
   1298 	extra_len += 2 + sr->isr_nrates;
   1299 	extra_len += 3; /* ERP IE */
   1300 	extra_len += sr->isr_ie_len;
   1301 
   1302 	result = os_zalloc(sizeof(*result) + extra_len);
   1303 	if (result == NULL)
   1304 		return;
   1305 	os_memcpy(result->bssid, sr->isr_bssid, ETH_ALEN);
   1306 	result->freq = sr->isr_freq;
   1307 	result->beacon_int = sr->isr_intval;
   1308 	result->caps = sr->isr_capinfo;
   1309 	result->qual = sr->isr_rssi;
   1310 	result->noise = sr->isr_noise;
   1311 
   1312 	pos = (u8 *)(result + 1);
   1313 
   1314 	*pos++ = WLAN_EID_SSID;
   1315 	*pos++ = sr->isr_ssid_len;
   1316 	os_memcpy(pos, sr + 1, sr->isr_ssid_len);
   1317 	pos += sr->isr_ssid_len;
   1318 
   1319 	/*
   1320 	 * Deal all rates as supported rate.
   1321 	 * Because net80211 doesn't report extended supported rate or not.
   1322 	 */
   1323 	*pos++ = WLAN_EID_SUPP_RATES;
   1324 	*pos++ = sr->isr_nrates;
   1325 	os_memcpy(pos, sr->isr_rates, sr->isr_nrates);
   1326 	pos += sr->isr_nrates;
   1327 
   1328 	*pos++ = WLAN_EID_ERP_INFO;
   1329 	*pos++ = 1;
   1330 	*pos++ = sr->isr_erp;
   1331 
   1332 	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len, sr->isr_ie_len);
   1333 	pos += sr->isr_ie_len;
   1334 
   1335 	result->ie_len = pos - (u8 *)(result + 1);
   1336 
   1337 	tmp = os_realloc(res->res,
   1338 			 (res->num + 1) * sizeof(struct wpa_scan_res *));
   1339 	if (tmp == NULL) {
   1340 		os_free(result);
   1341 		return;
   1342 	}
   1343 	tmp[res->num++] = result;
   1344 	res->res = tmp;
   1345 }
   1346 
   1347 struct wpa_scan_results *
   1348 wpa_driver_bsd_get_scan_results2(void *priv)
   1349 {
   1350 	struct ieee80211req_scan_result *sr;
   1351 	struct wpa_scan_results *res;
   1352 	int len, rest;
   1353 	uint8_t buf[24*1024], *pos;
   1354 
   1355 	len = get80211var(priv, IEEE80211_IOC_SCAN_RESULTS, buf, 24*1024);
   1356 	if (len < 0)
   1357 		return NULL;
   1358 
   1359 	res = os_zalloc(sizeof(*res));
   1360 	if (res == NULL)
   1361 		return NULL;
   1362 
   1363 	pos = buf;
   1364 	rest = len;
   1365 	while (rest >= sizeof(struct ieee80211req_scan_result)) {
   1366 		sr = (struct ieee80211req_scan_result *)pos;
   1367 		wpa_driver_bsd_add_scan_entry(res, sr);
   1368 		pos += sr->isr_len;
   1369 		rest -= sr->isr_len;
   1370 	}
   1371 
   1372 	wpa_printf(MSG_DEBUG, "Received %d bytes of scan results (%lu BSSes)",
   1373 		   len, (unsigned long)res->num);
   1374 
   1375 	return res;
   1376 }
   1377 
   1378 static int wpa_driver_bsd_capa(struct bsd_driver_data *drv)
   1379 {
   1380 #ifdef IEEE80211_IOC_DEVCAPS
   1381 /* kernel definitions copied from net80211/ieee80211_var.h */
   1382 #define IEEE80211_CIPHER_WEP            0
   1383 #define IEEE80211_CIPHER_TKIP           1
   1384 #define IEEE80211_CIPHER_AES_CCM        3
   1385 #define IEEE80211_CRYPTO_WEP            (1<<IEEE80211_CIPHER_WEP)
   1386 #define IEEE80211_CRYPTO_TKIP           (1<<IEEE80211_CIPHER_TKIP)
   1387 #define IEEE80211_CRYPTO_AES_CCM        (1<<IEEE80211_CIPHER_AES_CCM)
   1388 #define IEEE80211_C_HOSTAP      0x00000400      /* CAPABILITY: HOSTAP avail */
   1389 #define IEEE80211_C_WPA1        0x00800000      /* CAPABILITY: WPA1 avail */
   1390 #define IEEE80211_C_WPA2        0x01000000      /* CAPABILITY: WPA2 avail */
   1391 	struct ieee80211_devcaps_req devcaps;
   1392 
   1393 	if (get80211var(drv, IEEE80211_IOC_DEVCAPS, &devcaps,
   1394 			sizeof(devcaps)) < 0) {
   1395 		wpa_printf(MSG_ERROR, "failed to IEEE80211_IOC_DEVCAPS: %s",
   1396 			   strerror(errno));
   1397 		return -1;
   1398 	}
   1399 
   1400 	wpa_printf(MSG_DEBUG, "%s: drivercaps=0x%08x,cryptocaps=0x%08x",
   1401 		   __func__, devcaps.dc_drivercaps, devcaps.dc_cryptocaps);
   1402 
   1403 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA1)
   1404 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
   1405 			WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
   1406 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA2)
   1407 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
   1408 			WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
   1409 
   1410 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_WEP)
   1411 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
   1412 			WPA_DRIVER_CAPA_ENC_WEP104;
   1413 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_TKIP)
   1414 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
   1415 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_AES_CCM)
   1416 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
   1417 
   1418 	if (devcaps.dc_drivercaps & IEEE80211_C_HOSTAP)
   1419 		drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
   1420 #undef IEEE80211_CIPHER_WEP
   1421 #undef IEEE80211_CIPHER_TKIP
   1422 #undef IEEE80211_CIPHER_AES_CCM
   1423 #undef IEEE80211_CRYPTO_WEP
   1424 #undef IEEE80211_CRYPTO_TKIP
   1425 #undef IEEE80211_CRYPTO_AES_CCM
   1426 #undef IEEE80211_C_HOSTAP
   1427 #undef IEEE80211_C_WPA1
   1428 #undef IEEE80211_C_WPA2
   1429 #else /* IEEE80211_IOC_DEVCAPS */
   1430 	/* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
   1431 	drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
   1432 		WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
   1433 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
   1434 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
   1435 	drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
   1436 		WPA_DRIVER_CAPA_ENC_WEP104 |
   1437 		WPA_DRIVER_CAPA_ENC_TKIP |
   1438 		WPA_DRIVER_CAPA_ENC_CCMP;
   1439 	drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
   1440 #endif /* IEEE80211_IOC_DEVCAPS */
   1441 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
   1442 	drv->capa.max_scan_ssids = IEEE80211_IOC_SCAN_MAX_SSID;
   1443 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
   1444 	drv->capa.max_scan_ssids = 1;
   1445 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
   1446 	drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
   1447 		WPA_DRIVER_AUTH_SHARED |
   1448 		WPA_DRIVER_AUTH_LEAP;
   1449 	return 0;
   1450 }
   1451 
   1452 static void *
   1453 wpa_driver_bsd_init(void *ctx, const char *ifname)
   1454 {
   1455 #define	GETPARAM(drv, param, v) \
   1456 	(((v) = get80211param(drv, param)) != -1)
   1457 	struct bsd_driver_data *drv;
   1458 
   1459 	drv = os_zalloc(sizeof(*drv));
   1460 	if (drv == NULL)
   1461 		return NULL;
   1462 	/*
   1463 	 * NB: We require the interface name be mappable to an index.
   1464 	 *     This implies we do not support having wpa_supplicant
   1465 	 *     wait for an interface to appear.  This seems ok; that
   1466 	 *     doesn't belong here; it's really the job of devd.
   1467 	 */
   1468 	drv->ifindex = if_nametoindex(ifname);
   1469 	if (drv->ifindex == 0) {
   1470 		wpa_printf(MSG_DEBUG, "%s: interface %s does not exist",
   1471 			   __func__, ifname);
   1472 		goto fail1;
   1473 	}
   1474 	drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
   1475 	if (drv->sock < 0)
   1476 		goto fail1;
   1477 	drv->route = socket(PF_ROUTE, SOCK_RAW, 0);
   1478 	if (drv->route < 0)
   1479 		goto fail;
   1480 	eloop_register_read_sock(drv->route,
   1481 		wpa_driver_bsd_event_receive, ctx, drv);
   1482 
   1483 	drv->ctx = ctx;
   1484 	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
   1485 
   1486 	/* Down interface during setup. */
   1487 	if (bsd_ctrl_iface(drv, 0) < 0)
   1488 		goto fail;
   1489 
   1490 	if (!GETPARAM(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming)) {
   1491 		wpa_printf(MSG_DEBUG, "%s: failed to get roaming state: %s",
   1492 			__func__, strerror(errno));
   1493 		goto fail;
   1494 	}
   1495 	if (!GETPARAM(drv, IEEE80211_IOC_PRIVACY, drv->prev_privacy)) {
   1496 		wpa_printf(MSG_DEBUG, "%s: failed to get privacy state: %s",
   1497 			__func__, strerror(errno));
   1498 		goto fail;
   1499 	}
   1500 	if (!GETPARAM(drv, IEEE80211_IOC_WPA, drv->prev_wpa)) {
   1501 		wpa_printf(MSG_DEBUG, "%s: failed to get wpa state: %s",
   1502 			__func__, strerror(errno));
   1503 		goto fail;
   1504 	}
   1505 
   1506 	if (wpa_driver_bsd_capa(drv))
   1507 		goto fail;
   1508 
   1509 	return drv;
   1510 fail:
   1511 	close(drv->sock);
   1512 fail1:
   1513 	os_free(drv);
   1514 	return NULL;
   1515 #undef GETPARAM
   1516 }
   1517 
   1518 static void
   1519 wpa_driver_bsd_deinit(void *priv)
   1520 {
   1521 	struct bsd_driver_data *drv = priv;
   1522 
   1523 	wpa_driver_bsd_set_wpa(drv, 0);
   1524 	eloop_unregister_read_sock(drv->route);
   1525 
   1526 	/* NB: mark interface down */
   1527 	bsd_ctrl_iface(drv, 0);
   1528 
   1529 	wpa_driver_bsd_set_wpa_internal(drv, drv->prev_wpa, drv->prev_privacy);
   1530 	if (set80211param(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming) < 0)
   1531 		wpa_printf(MSG_DEBUG, "%s: failed to restore roaming state",
   1532 			__func__);
   1533 
   1534 	if (drv->sock_xmit != NULL)
   1535 		l2_packet_deinit(drv->sock_xmit);
   1536 	(void) close(drv->route);		/* ioctl socket */
   1537 	(void) close(drv->sock);		/* event socket */
   1538 	os_free(drv);
   1539 }
   1540 
   1541 static int
   1542 wpa_driver_bsd_get_capa(void *priv, struct wpa_driver_capa *capa)
   1543 {
   1544 	struct bsd_driver_data *drv = priv;
   1545 
   1546 	os_memcpy(capa, &drv->capa, sizeof(*capa));
   1547 	return 0;
   1548 }
   1549 #endif /* HOSTAPD */
   1550 
   1551 
   1552 const struct wpa_driver_ops wpa_driver_bsd_ops = {
   1553 	.name			= "bsd",
   1554 	.desc			= "BSD 802.11 support",
   1555 #ifdef HOSTAPD
   1556 	.hapd_init		= bsd_init,
   1557 	.hapd_deinit		= bsd_deinit,
   1558 	.set_privacy		= bsd_set_privacy,
   1559 	.get_seqnum		= bsd_get_seqnum,
   1560 	.flush			= bsd_flush,
   1561 	.read_sta_data		= bsd_read_sta_driver_data,
   1562 	.sta_disassoc		= bsd_sta_disassoc,
   1563 	.sta_deauth		= bsd_sta_deauth,
   1564 #else /* HOSTAPD */
   1565 	.init			= wpa_driver_bsd_init,
   1566 	.deinit			= wpa_driver_bsd_deinit,
   1567 	.get_bssid		= wpa_driver_bsd_get_bssid,
   1568 	.get_ssid		= wpa_driver_bsd_get_ssid,
   1569 	.set_countermeasures	= wpa_driver_bsd_set_countermeasures,
   1570 	.scan2			= wpa_driver_bsd_scan,
   1571 	.get_scan_results2	= wpa_driver_bsd_get_scan_results2,
   1572 	.deauthenticate		= wpa_driver_bsd_deauthenticate,
   1573 	.disassociate		= wpa_driver_bsd_disassociate,
   1574 	.associate		= wpa_driver_bsd_associate,
   1575 	.get_capa		= wpa_driver_bsd_get_capa,
   1576 #endif /* HOSTAPD */
   1577 	.set_freq		= bsd_set_freq,
   1578 	.set_key		= bsd_set_key,
   1579 	.set_ieee8021x		= bsd_set_ieee8021x,
   1580 	.hapd_set_ssid		= bsd_set_ssid,
   1581 	.hapd_get_ssid		= bsd_get_ssid,
   1582 	.hapd_send_eapol	= bsd_send_eapol,
   1583 	.sta_set_flags		= bsd_set_sta_authorized,
   1584 	.set_generic_elem	= bsd_set_opt_ie,
   1585 };
   1586