1 /* 2 * hostapd / Callback functions for driver wrappers 3 * Copyright (c) 2002-2013, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "utils/eloop.h" 13 #include "radius/radius.h" 14 #include "drivers/driver.h" 15 #include "common/ieee802_11_defs.h" 16 #include "common/ieee802_11_common.h" 17 #include "common/wpa_ctrl.h" 18 #include "crypto/random.h" 19 #include "p2p/p2p.h" 20 #include "wps/wps.h" 21 #include "wnm_ap.h" 22 #include "hostapd.h" 23 #include "ieee802_11.h" 24 #include "sta_info.h" 25 #include "accounting.h" 26 #include "tkip_countermeasures.h" 27 #include "ieee802_1x.h" 28 #include "wpa_auth.h" 29 #include "wps_hostapd.h" 30 #include "ap_drv_ops.h" 31 #include "ap_config.h" 32 #include "hw_features.h" 33 #include "dfs.h" 34 #include "beacon.h" 35 36 37 int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, 38 const u8 *req_ies, size_t req_ies_len, int reassoc) 39 { 40 struct sta_info *sta; 41 int new_assoc, res; 42 struct ieee802_11_elems elems; 43 const u8 *ie; 44 size_t ielen; 45 #ifdef CONFIG_IEEE80211R 46 u8 buf[sizeof(struct ieee80211_mgmt) + 1024]; 47 u8 *p = buf; 48 #endif /* CONFIG_IEEE80211R */ 49 u16 reason = WLAN_REASON_UNSPECIFIED; 50 u16 status = WLAN_STATUS_SUCCESS; 51 const u8 *p2p_dev_addr = NULL; 52 53 if (addr == NULL) { 54 /* 55 * This could potentially happen with unexpected event from the 56 * driver wrapper. This was seen at least in one case where the 57 * driver ended up being set to station mode while hostapd was 58 * running, so better make sure we stop processing such an 59 * event here. 60 */ 61 wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with " 62 "no address"); 63 return -1; 64 } 65 random_add_randomness(addr, ETH_ALEN); 66 67 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 68 HOSTAPD_LEVEL_INFO, "associated"); 69 70 ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0); 71 if (elems.wps_ie) { 72 ie = elems.wps_ie - 2; 73 ielen = elems.wps_ie_len + 2; 74 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq"); 75 } else if (elems.rsn_ie) { 76 ie = elems.rsn_ie - 2; 77 ielen = elems.rsn_ie_len + 2; 78 wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq"); 79 } else if (elems.wpa_ie) { 80 ie = elems.wpa_ie - 2; 81 ielen = elems.wpa_ie_len + 2; 82 wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq"); 83 #ifdef CONFIG_HS20 84 } else if (elems.osen) { 85 ie = elems.osen - 2; 86 ielen = elems.osen_len + 2; 87 wpa_printf(MSG_DEBUG, "STA included OSEN IE in (Re)AssocReq"); 88 #endif /* CONFIG_HS20 */ 89 } else { 90 ie = NULL; 91 ielen = 0; 92 wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in " 93 "(Re)AssocReq"); 94 } 95 96 sta = ap_get_sta(hapd, addr); 97 if (sta) { 98 ap_sta_no_session_timeout(hapd, sta); 99 accounting_sta_stop(hapd, sta); 100 101 /* 102 * Make sure that the previously registered inactivity timer 103 * will not remove the STA immediately. 104 */ 105 sta->timeout_next = STA_NULLFUNC; 106 } else { 107 sta = ap_sta_add(hapd, addr); 108 if (sta == NULL) { 109 hostapd_drv_sta_disassoc(hapd, addr, 110 WLAN_REASON_DISASSOC_AP_BUSY); 111 return -1; 112 } 113 } 114 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2); 115 116 #ifdef CONFIG_P2P 117 if (elems.p2p) { 118 wpabuf_free(sta->p2p_ie); 119 sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, 120 P2P_IE_VENDOR_TYPE); 121 if (sta->p2p_ie) 122 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie); 123 } 124 #endif /* CONFIG_P2P */ 125 126 #ifdef CONFIG_IEEE80211N 127 #ifdef NEED_AP_MLME 128 if (elems.ht_capabilities && 129 elems.ht_capabilities_len >= 130 sizeof(struct ieee80211_ht_capabilities) && 131 (hapd->iface->conf->ht_capab & 132 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) { 133 struct ieee80211_ht_capabilities *ht_cap = 134 (struct ieee80211_ht_capabilities *) 135 elems.ht_capabilities; 136 137 if (le_to_host16(ht_cap->ht_capabilities_info) & 138 HT_CAP_INFO_40MHZ_INTOLERANT) 139 ht40_intolerant_add(hapd->iface, sta); 140 } 141 #endif /* NEED_AP_MLME */ 142 #endif /* CONFIG_IEEE80211N */ 143 144 #ifdef CONFIG_INTERWORKING 145 if (elems.ext_capab && elems.ext_capab_len > 4) { 146 if (elems.ext_capab[4] & 0x01) 147 sta->qos_map_enabled = 1; 148 } 149 #endif /* CONFIG_INTERWORKING */ 150 151 #ifdef CONFIG_HS20 152 wpabuf_free(sta->hs20_ie); 153 if (elems.hs20 && elems.hs20_len > 4) { 154 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4, 155 elems.hs20_len - 4); 156 } else 157 sta->hs20_ie = NULL; 158 #endif /* CONFIG_HS20 */ 159 160 if (hapd->conf->wpa) { 161 if (ie == NULL || ielen == 0) { 162 #ifdef CONFIG_WPS 163 if (hapd->conf->wps_state) { 164 wpa_printf(MSG_DEBUG, "STA did not include " 165 "WPA/RSN IE in (Re)Association " 166 "Request - possible WPS use"); 167 sta->flags |= WLAN_STA_MAYBE_WPS; 168 goto skip_wpa_check; 169 } 170 #endif /* CONFIG_WPS */ 171 172 wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA"); 173 return -1; 174 } 175 #ifdef CONFIG_WPS 176 if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 && 177 os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) { 178 struct wpabuf *wps; 179 sta->flags |= WLAN_STA_WPS; 180 wps = ieee802_11_vendor_ie_concat(ie, ielen, 181 WPS_IE_VENDOR_TYPE); 182 if (wps) { 183 if (wps_is_20(wps)) { 184 wpa_printf(MSG_DEBUG, "WPS: STA " 185 "supports WPS 2.0"); 186 sta->flags |= WLAN_STA_WPS2; 187 } 188 wpabuf_free(wps); 189 } 190 goto skip_wpa_check; 191 } 192 #endif /* CONFIG_WPS */ 193 194 if (sta->wpa_sm == NULL) 195 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 196 sta->addr, 197 p2p_dev_addr); 198 if (sta->wpa_sm == NULL) { 199 wpa_printf(MSG_ERROR, "Failed to initialize WPA state " 200 "machine"); 201 return -1; 202 } 203 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm, 204 ie, ielen, 205 elems.mdie, elems.mdie_len); 206 if (res != WPA_IE_OK) { 207 wpa_printf(MSG_DEBUG, "WPA/RSN information element " 208 "rejected? (res %u)", res); 209 wpa_hexdump(MSG_DEBUG, "IE", ie, ielen); 210 if (res == WPA_INVALID_GROUP) { 211 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID; 212 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID; 213 } else if (res == WPA_INVALID_PAIRWISE) { 214 reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID; 215 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 216 } else if (res == WPA_INVALID_AKMP) { 217 reason = WLAN_REASON_AKMP_NOT_VALID; 218 status = WLAN_STATUS_AKMP_NOT_VALID; 219 } 220 #ifdef CONFIG_IEEE80211W 221 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) { 222 reason = WLAN_REASON_INVALID_IE; 223 status = WLAN_STATUS_INVALID_IE; 224 } else if (res == WPA_INVALID_MGMT_GROUP_CIPHER) { 225 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID; 226 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID; 227 } 228 #endif /* CONFIG_IEEE80211W */ 229 else { 230 reason = WLAN_REASON_INVALID_IE; 231 status = WLAN_STATUS_INVALID_IE; 232 } 233 goto fail; 234 } 235 #ifdef CONFIG_IEEE80211W 236 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && 237 sta->sa_query_count > 0) 238 ap_check_sa_query_timeout(hapd, sta); 239 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && 240 (sta->auth_alg != WLAN_AUTH_FT)) { 241 /* 242 * STA has already been associated with MFP and SA 243 * Query timeout has not been reached. Reject the 244 * association attempt temporarily and start SA Query, 245 * if one is not pending. 246 */ 247 248 if (sta->sa_query_count == 0) 249 ap_sta_start_sa_query(hapd, sta); 250 251 #ifdef CONFIG_IEEE80211R 252 status = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY; 253 254 p = hostapd_eid_assoc_comeback_time(hapd, sta, p); 255 256 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, 257 p - buf); 258 #endif /* CONFIG_IEEE80211R */ 259 return 0; 260 } 261 262 if (wpa_auth_uses_mfp(sta->wpa_sm)) 263 sta->flags |= WLAN_STA_MFP; 264 else 265 sta->flags &= ~WLAN_STA_MFP; 266 #endif /* CONFIG_IEEE80211W */ 267 268 #ifdef CONFIG_IEEE80211R 269 if (sta->auth_alg == WLAN_AUTH_FT) { 270 status = wpa_ft_validate_reassoc(sta->wpa_sm, req_ies, 271 req_ies_len); 272 if (status != WLAN_STATUS_SUCCESS) { 273 if (status == WLAN_STATUS_INVALID_PMKID) 274 reason = WLAN_REASON_INVALID_IE; 275 if (status == WLAN_STATUS_INVALID_MDIE) 276 reason = WLAN_REASON_INVALID_IE; 277 if (status == WLAN_STATUS_INVALID_FTIE) 278 reason = WLAN_REASON_INVALID_IE; 279 goto fail; 280 } 281 } 282 #endif /* CONFIG_IEEE80211R */ 283 } else if (hapd->conf->wps_state) { 284 #ifdef CONFIG_WPS 285 struct wpabuf *wps; 286 if (req_ies) 287 wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, 288 WPS_IE_VENDOR_TYPE); 289 else 290 wps = NULL; 291 #ifdef CONFIG_WPS_STRICT 292 if (wps && wps_validate_assoc_req(wps) < 0) { 293 reason = WLAN_REASON_INVALID_IE; 294 status = WLAN_STATUS_INVALID_IE; 295 wpabuf_free(wps); 296 goto fail; 297 } 298 #endif /* CONFIG_WPS_STRICT */ 299 if (wps) { 300 sta->flags |= WLAN_STA_WPS; 301 if (wps_is_20(wps)) { 302 wpa_printf(MSG_DEBUG, "WPS: STA supports " 303 "WPS 2.0"); 304 sta->flags |= WLAN_STA_WPS2; 305 } 306 } else 307 sta->flags |= WLAN_STA_MAYBE_WPS; 308 wpabuf_free(wps); 309 #endif /* CONFIG_WPS */ 310 #ifdef CONFIG_HS20 311 } else if (hapd->conf->osen) { 312 if (elems.osen == NULL) { 313 hostapd_logger( 314 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, 315 HOSTAPD_LEVEL_INFO, 316 "No HS 2.0 OSEN element in association request"); 317 return WLAN_STATUS_INVALID_IE; 318 } 319 320 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association"); 321 if (sta->wpa_sm == NULL) 322 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 323 sta->addr, NULL); 324 if (sta->wpa_sm == NULL) { 325 wpa_printf(MSG_WARNING, "Failed to initialize WPA " 326 "state machine"); 327 return WLAN_STATUS_UNSPECIFIED_FAILURE; 328 } 329 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm, 330 elems.osen - 2, elems.osen_len + 2) < 0) 331 return WLAN_STATUS_INVALID_IE; 332 #endif /* CONFIG_HS20 */ 333 } 334 #ifdef CONFIG_WPS 335 skip_wpa_check: 336 #endif /* CONFIG_WPS */ 337 338 #ifdef CONFIG_IEEE80211R 339 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, buf, sizeof(buf), 340 sta->auth_alg, req_ies, req_ies_len); 341 342 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); 343 #else /* CONFIG_IEEE80211R */ 344 /* Keep compiler silent about unused variables */ 345 if (status) { 346 } 347 #endif /* CONFIG_IEEE80211R */ 348 349 new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0; 350 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC; 351 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; 352 353 if (reassoc && (sta->auth_alg == WLAN_AUTH_FT)) 354 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT); 355 else 356 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC); 357 358 hostapd_new_assoc_sta(hapd, sta, !new_assoc); 359 360 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1); 361 362 #ifdef CONFIG_P2P 363 if (req_ies) { 364 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, 365 req_ies, req_ies_len); 366 } 367 #endif /* CONFIG_P2P */ 368 369 return 0; 370 371 fail: 372 #ifdef CONFIG_IEEE80211R 373 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); 374 #endif /* CONFIG_IEEE80211R */ 375 hostapd_drv_sta_disassoc(hapd, sta->addr, reason); 376 ap_free_sta(hapd, sta); 377 return -1; 378 } 379 380 381 void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr) 382 { 383 struct sta_info *sta; 384 385 if (addr == NULL) { 386 /* 387 * This could potentially happen with unexpected event from the 388 * driver wrapper. This was seen at least in one case where the 389 * driver ended up reporting a station mode event while hostapd 390 * was running, so better make sure we stop processing such an 391 * event here. 392 */ 393 wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event " 394 "with no address"); 395 return; 396 } 397 398 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 399 HOSTAPD_LEVEL_INFO, "disassociated"); 400 401 sta = ap_get_sta(hapd, addr); 402 if (sta == NULL) { 403 wpa_printf(MSG_DEBUG, "Disassociation notification for " 404 "unknown STA " MACSTR, MAC2STR(addr)); 405 return; 406 } 407 408 ap_sta_set_authorized(hapd, sta, 0); 409 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); 410 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC); 411 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; 412 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); 413 ap_free_sta(hapd, sta); 414 } 415 416 417 void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr) 418 { 419 struct sta_info *sta = ap_get_sta(hapd, addr); 420 421 if (!sta || !hapd->conf->disassoc_low_ack) 422 return; 423 424 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 425 HOSTAPD_LEVEL_INFO, "disconnected due to excessive " 426 "missing ACKs"); 427 hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK); 428 if (sta) 429 ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK); 430 } 431 432 433 void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht, 434 int offset, int width, int cf1, int cf2) 435 { 436 #ifdef NEED_AP_MLME 437 int channel, chwidth, seg0_idx = 0, seg1_idx = 0; 438 439 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, 440 HOSTAPD_LEVEL_INFO, "driver had channel switch: " 441 "freq=%d, ht=%d, offset=%d, width=%d, cf1=%d, cf2=%d", 442 freq, ht, offset, width, cf1, cf2); 443 444 hapd->iface->freq = freq; 445 446 channel = hostapd_hw_get_channel(hapd, freq); 447 if (!channel) { 448 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, 449 HOSTAPD_LEVEL_WARNING, "driver switched to " 450 "bad channel!"); 451 return; 452 } 453 454 switch (width) { 455 case CHAN_WIDTH_80: 456 chwidth = VHT_CHANWIDTH_80MHZ; 457 break; 458 case CHAN_WIDTH_80P80: 459 chwidth = VHT_CHANWIDTH_80P80MHZ; 460 break; 461 case CHAN_WIDTH_160: 462 chwidth = VHT_CHANWIDTH_160MHZ; 463 break; 464 case CHAN_WIDTH_20_NOHT: 465 case CHAN_WIDTH_20: 466 case CHAN_WIDTH_40: 467 default: 468 chwidth = VHT_CHANWIDTH_USE_HT; 469 break; 470 } 471 472 switch (hapd->iface->current_mode->mode) { 473 case HOSTAPD_MODE_IEEE80211A: 474 if (cf1 > 5000) 475 seg0_idx = (cf1 - 5000) / 5; 476 if (cf2 > 5000) 477 seg1_idx = (cf2 - 5000) / 5; 478 break; 479 default: 480 seg0_idx = hostapd_hw_get_channel(hapd, cf1); 481 seg1_idx = hostapd_hw_get_channel(hapd, cf2); 482 break; 483 } 484 485 hapd->iconf->channel = channel; 486 hapd->iconf->ieee80211n = ht; 487 hapd->iconf->secondary_channel = offset; 488 hapd->iconf->vht_oper_chwidth = chwidth; 489 hapd->iconf->vht_oper_centr_freq_seg0_idx = seg0_idx; 490 hapd->iconf->vht_oper_centr_freq_seg1_idx = seg1_idx; 491 492 if (hapd->csa_in_progress && 493 freq == hapd->cs_freq_params.freq) { 494 hostapd_cleanup_cs_params(hapd); 495 ieee802_11_set_beacon(hapd); 496 497 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d", 498 freq); 499 } 500 #endif /* NEED_AP_MLME */ 501 } 502 503 504 void hostapd_event_connect_failed_reason(struct hostapd_data *hapd, 505 const u8 *addr, int reason_code) 506 { 507 switch (reason_code) { 508 case MAX_CLIENT_REACHED: 509 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_MAX_STA MACSTR, 510 MAC2STR(addr)); 511 break; 512 case BLOCKED_CLIENT: 513 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_BLOCKED_STA MACSTR, 514 MAC2STR(addr)); 515 break; 516 } 517 } 518 519 520 int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da, 521 const u8 *bssid, const u8 *ie, size_t ie_len, 522 int ssi_signal) 523 { 524 size_t i; 525 int ret = 0; 526 527 if (sa == NULL || ie == NULL) 528 return -1; 529 530 random_add_randomness(sa, ETH_ALEN); 531 for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) { 532 if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx, 533 sa, da, bssid, ie, ie_len, 534 ssi_signal) > 0) { 535 ret = 1; 536 break; 537 } 538 } 539 return ret; 540 } 541 542 543 #ifdef HOSTAPD 544 545 #ifdef CONFIG_IEEE80211R 546 static void hostapd_notify_auth_ft_finish(void *ctx, const u8 *dst, 547 const u8 *bssid, 548 u16 auth_transaction, u16 status, 549 const u8 *ies, size_t ies_len) 550 { 551 struct hostapd_data *hapd = ctx; 552 struct sta_info *sta; 553 554 sta = ap_get_sta(hapd, dst); 555 if (sta == NULL) 556 return; 557 558 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211, 559 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)"); 560 sta->flags |= WLAN_STA_AUTH; 561 562 hostapd_sta_auth(hapd, dst, auth_transaction, status, ies, ies_len); 563 } 564 #endif /* CONFIG_IEEE80211R */ 565 566 567 static void hostapd_notif_auth(struct hostapd_data *hapd, 568 struct auth_info *rx_auth) 569 { 570 struct sta_info *sta; 571 u16 status = WLAN_STATUS_SUCCESS; 572 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN]; 573 size_t resp_ies_len = 0; 574 575 sta = ap_get_sta(hapd, rx_auth->peer); 576 if (!sta) { 577 sta = ap_sta_add(hapd, rx_auth->peer); 578 if (sta == NULL) { 579 status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; 580 goto fail; 581 } 582 } 583 sta->flags &= ~WLAN_STA_PREAUTH; 584 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0); 585 #ifdef CONFIG_IEEE80211R 586 if (rx_auth->auth_type == WLAN_AUTH_FT && hapd->wpa_auth) { 587 sta->auth_alg = WLAN_AUTH_FT; 588 if (sta->wpa_sm == NULL) 589 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 590 sta->addr, NULL); 591 if (sta->wpa_sm == NULL) { 592 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA " 593 "state machine"); 594 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 595 goto fail; 596 } 597 wpa_ft_process_auth(sta->wpa_sm, rx_auth->bssid, 598 rx_auth->auth_transaction, rx_auth->ies, 599 rx_auth->ies_len, 600 hostapd_notify_auth_ft_finish, hapd); 601 return; 602 } 603 #endif /* CONFIG_IEEE80211R */ 604 fail: 605 hostapd_sta_auth(hapd, rx_auth->peer, rx_auth->auth_transaction + 1, 606 status, resp_ies, resp_ies_len); 607 } 608 609 610 static void hostapd_action_rx(struct hostapd_data *hapd, 611 struct rx_mgmt *drv_mgmt) 612 { 613 struct ieee80211_mgmt *mgmt; 614 struct sta_info *sta; 615 size_t plen __maybe_unused; 616 u16 fc; 617 618 if (drv_mgmt->frame_len < 24 + 1) 619 return; 620 621 plen = drv_mgmt->frame_len - 24 - 1; 622 623 mgmt = (struct ieee80211_mgmt *) drv_mgmt->frame; 624 fc = le_to_host16(mgmt->frame_control); 625 if (WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION) 626 return; /* handled by the driver */ 627 628 wpa_printf(MSG_DEBUG, "RX_ACTION cat %d action plen %d", 629 mgmt->u.action.category, (int) plen); 630 631 sta = ap_get_sta(hapd, mgmt->sa); 632 if (sta == NULL) { 633 wpa_printf(MSG_DEBUG, "%s: station not found", __func__); 634 return; 635 } 636 #ifdef CONFIG_IEEE80211R 637 if (mgmt->u.action.category == WLAN_ACTION_FT) { 638 const u8 *payload = drv_mgmt->frame + 24 + 1; 639 wpa_ft_action_rx(sta->wpa_sm, payload, plen); 640 } 641 #endif /* CONFIG_IEEE80211R */ 642 #ifdef CONFIG_IEEE80211W 643 if (mgmt->u.action.category == WLAN_ACTION_SA_QUERY && plen >= 4) { 644 ieee802_11_sa_query_action( 645 hapd, mgmt->sa, 646 mgmt->u.action.u.sa_query_resp.action, 647 mgmt->u.action.u.sa_query_resp.trans_id); 648 } 649 #endif /* CONFIG_IEEE80211W */ 650 #ifdef CONFIG_WNM 651 if (mgmt->u.action.category == WLAN_ACTION_WNM) { 652 ieee802_11_rx_wnm_action_ap(hapd, mgmt, drv_mgmt->frame_len); 653 } 654 #endif /* CONFIG_WNM */ 655 } 656 657 658 #ifdef NEED_AP_MLME 659 660 #define HAPD_BROADCAST ((struct hostapd_data *) -1) 661 662 static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface, 663 const u8 *bssid) 664 { 665 size_t i; 666 667 if (bssid == NULL) 668 return NULL; 669 if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff && 670 bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff) 671 return HAPD_BROADCAST; 672 673 for (i = 0; i < iface->num_bss; i++) { 674 if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) 675 return iface->bss[i]; 676 } 677 678 return NULL; 679 } 680 681 682 static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd, 683 const u8 *bssid, const u8 *addr, 684 int wds) 685 { 686 hapd = get_hapd_bssid(hapd->iface, bssid); 687 if (hapd == NULL || hapd == HAPD_BROADCAST) 688 return; 689 690 ieee802_11_rx_from_unknown(hapd, addr, wds); 691 } 692 693 694 static int hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt) 695 { 696 struct hostapd_iface *iface = hapd->iface; 697 const struct ieee80211_hdr *hdr; 698 const u8 *bssid; 699 struct hostapd_frame_info fi; 700 int ret; 701 702 #ifdef CONFIG_TESTING_OPTIONS 703 if (hapd->ext_mgmt_frame_handling) { 704 size_t hex_len = 2 * rx_mgmt->frame_len + 1; 705 char *hex = os_malloc(hex_len); 706 if (hex) { 707 wpa_snprintf_hex(hex, hex_len, rx_mgmt->frame, 708 rx_mgmt->frame_len); 709 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex); 710 os_free(hex); 711 } 712 return 1; 713 } 714 #endif /* CONFIG_TESTING_OPTIONS */ 715 716 hdr = (const struct ieee80211_hdr *) rx_mgmt->frame; 717 bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len); 718 if (bssid == NULL) 719 return 0; 720 721 hapd = get_hapd_bssid(iface, bssid); 722 if (hapd == NULL) { 723 u16 fc; 724 fc = le_to_host16(hdr->frame_control); 725 726 /* 727 * Drop frames to unknown BSSIDs except for Beacon frames which 728 * could be used to update neighbor information. 729 */ 730 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 731 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) 732 hapd = iface->bss[0]; 733 else 734 return 0; 735 } 736 737 os_memset(&fi, 0, sizeof(fi)); 738 fi.datarate = rx_mgmt->datarate; 739 fi.ssi_signal = rx_mgmt->ssi_signal; 740 741 if (hapd == HAPD_BROADCAST) { 742 size_t i; 743 ret = 0; 744 for (i = 0; i < iface->num_bss; i++) { 745 /* if bss is set, driver will call this function for 746 * each bss individually. */ 747 if (rx_mgmt->drv_priv && 748 (iface->bss[i]->drv_priv != rx_mgmt->drv_priv)) 749 continue; 750 751 if (ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame, 752 rx_mgmt->frame_len, &fi) > 0) 753 ret = 1; 754 } 755 } else 756 ret = ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, 757 &fi); 758 759 random_add_randomness(&fi, sizeof(fi)); 760 761 return ret; 762 } 763 764 765 static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf, 766 size_t len, u16 stype, int ok) 767 { 768 struct ieee80211_hdr *hdr; 769 hdr = (struct ieee80211_hdr *) buf; 770 hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len)); 771 if (hapd == NULL || hapd == HAPD_BROADCAST) 772 return; 773 ieee802_11_mgmt_cb(hapd, buf, len, stype, ok); 774 } 775 776 #endif /* NEED_AP_MLME */ 777 778 779 static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr) 780 { 781 struct sta_info *sta = ap_get_sta(hapd, addr); 782 if (sta) 783 return 0; 784 785 wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR 786 " - adding a new STA", MAC2STR(addr)); 787 sta = ap_sta_add(hapd, addr); 788 if (sta) { 789 hostapd_new_assoc_sta(hapd, sta, 0); 790 } else { 791 wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR, 792 MAC2STR(addr)); 793 return -1; 794 } 795 796 return 0; 797 } 798 799 800 static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src, 801 const u8 *data, size_t data_len) 802 { 803 struct hostapd_iface *iface = hapd->iface; 804 struct sta_info *sta; 805 size_t j; 806 807 for (j = 0; j < iface->num_bss; j++) { 808 if ((sta = ap_get_sta(iface->bss[j], src))) { 809 if (sta->flags & WLAN_STA_ASSOC) { 810 hapd = iface->bss[j]; 811 break; 812 } 813 } 814 } 815 816 ieee802_1x_receive(hapd, src, data, data_len); 817 } 818 819 820 static struct hostapd_channel_data * hostapd_get_mode_channel( 821 struct hostapd_iface *iface, unsigned int freq) 822 { 823 int i; 824 struct hostapd_channel_data *chan; 825 826 for (i = 0; i < iface->current_mode->num_channels; i++) { 827 chan = &iface->current_mode->channels[i]; 828 if (!chan) 829 return NULL; 830 if ((unsigned int) chan->freq == freq) 831 return chan; 832 } 833 834 return NULL; 835 } 836 837 838 static void hostapd_update_nf(struct hostapd_iface *iface, 839 struct hostapd_channel_data *chan, 840 struct freq_survey *survey) 841 { 842 if (!iface->chans_surveyed) { 843 chan->min_nf = survey->nf; 844 iface->lowest_nf = survey->nf; 845 } else { 846 if (dl_list_empty(&chan->survey_list)) 847 chan->min_nf = survey->nf; 848 else if (survey->nf < chan->min_nf) 849 chan->min_nf = survey->nf; 850 if (survey->nf < iface->lowest_nf) 851 iface->lowest_nf = survey->nf; 852 } 853 } 854 855 856 static void hostapd_event_get_survey(struct hostapd_data *hapd, 857 struct survey_results *survey_results) 858 { 859 struct hostapd_iface *iface = hapd->iface; 860 struct freq_survey *survey, *tmp; 861 struct hostapd_channel_data *chan; 862 863 if (dl_list_empty(&survey_results->survey_list)) { 864 wpa_printf(MSG_DEBUG, "No survey data received"); 865 return; 866 } 867 868 dl_list_for_each_safe(survey, tmp, &survey_results->survey_list, 869 struct freq_survey, list) { 870 chan = hostapd_get_mode_channel(iface, survey->freq); 871 if (!chan) 872 continue; 873 if (chan->flag & HOSTAPD_CHAN_DISABLED) 874 continue; 875 876 dl_list_del(&survey->list); 877 dl_list_add_tail(&chan->survey_list, &survey->list); 878 879 hostapd_update_nf(iface, chan, survey); 880 881 iface->chans_surveyed++; 882 } 883 } 884 885 886 #ifdef NEED_AP_MLME 887 888 static void hostapd_event_iface_unavailable(struct hostapd_data *hapd) 889 { 890 wpa_printf(MSG_DEBUG, "Interface %s is unavailable -- stopped", 891 hapd->conf->iface); 892 893 if (hapd->csa_in_progress) { 894 wpa_printf(MSG_INFO, "CSA failed (%s was stopped)", 895 hapd->conf->iface); 896 hostapd_switch_channel_fallback(hapd->iface, 897 &hapd->cs_freq_params); 898 } 899 } 900 901 902 static void hostapd_event_dfs_radar_detected(struct hostapd_data *hapd, 903 struct dfs_event *radar) 904 { 905 wpa_printf(MSG_DEBUG, "DFS radar detected on %d MHz", radar->freq); 906 hostapd_dfs_radar_detected(hapd->iface, radar->freq, radar->ht_enabled, 907 radar->chan_offset, radar->chan_width, 908 radar->cf1, radar->cf2); 909 } 910 911 912 static void hostapd_event_dfs_cac_finished(struct hostapd_data *hapd, 913 struct dfs_event *radar) 914 { 915 wpa_printf(MSG_DEBUG, "DFS CAC finished on %d MHz", radar->freq); 916 hostapd_dfs_complete_cac(hapd->iface, 1, radar->freq, radar->ht_enabled, 917 radar->chan_offset, radar->chan_width, 918 radar->cf1, radar->cf2); 919 } 920 921 922 static void hostapd_event_dfs_cac_aborted(struct hostapd_data *hapd, 923 struct dfs_event *radar) 924 { 925 wpa_printf(MSG_DEBUG, "DFS CAC aborted on %d MHz", radar->freq); 926 hostapd_dfs_complete_cac(hapd->iface, 0, radar->freq, radar->ht_enabled, 927 radar->chan_offset, radar->chan_width, 928 radar->cf1, radar->cf2); 929 } 930 931 932 static void hostapd_event_dfs_nop_finished(struct hostapd_data *hapd, 933 struct dfs_event *radar) 934 { 935 wpa_printf(MSG_DEBUG, "DFS NOP finished on %d MHz", radar->freq); 936 hostapd_dfs_nop_finished(hapd->iface, radar->freq, radar->ht_enabled, 937 radar->chan_offset, radar->chan_width, 938 radar->cf1, radar->cf2); 939 } 940 941 #endif /* NEED_AP_MLME */ 942 943 944 void wpa_supplicant_event(void *ctx, enum wpa_event_type event, 945 union wpa_event_data *data) 946 { 947 struct hostapd_data *hapd = ctx; 948 #ifndef CONFIG_NO_STDOUT_DEBUG 949 int level = MSG_DEBUG; 950 951 if (event == EVENT_RX_MGMT && data->rx_mgmt.frame && 952 data->rx_mgmt.frame_len >= 24) { 953 const struct ieee80211_hdr *hdr; 954 u16 fc; 955 hdr = (const struct ieee80211_hdr *) data->rx_mgmt.frame; 956 fc = le_to_host16(hdr->frame_control); 957 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 958 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) 959 level = MSG_EXCESSIVE; 960 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 961 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_REQ) 962 level = MSG_EXCESSIVE; 963 } 964 965 wpa_dbg(hapd->msg_ctx, level, "Event %s (%d) received", 966 event_to_string(event), event); 967 #endif /* CONFIG_NO_STDOUT_DEBUG */ 968 969 switch (event) { 970 case EVENT_MICHAEL_MIC_FAILURE: 971 michael_mic_failure(hapd, data->michael_mic_failure.src, 1); 972 break; 973 case EVENT_SCAN_RESULTS: 974 if (hapd->iface->scan_cb) 975 hapd->iface->scan_cb(hapd->iface); 976 break; 977 #ifdef CONFIG_IEEE80211R 978 case EVENT_FT_RRB_RX: 979 wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src, 980 data->ft_rrb_rx.data, data->ft_rrb_rx.data_len); 981 break; 982 #endif /* CONFIG_IEEE80211R */ 983 case EVENT_WPS_BUTTON_PUSHED: 984 hostapd_wps_button_pushed(hapd, NULL); 985 break; 986 #ifdef NEED_AP_MLME 987 case EVENT_TX_STATUS: 988 switch (data->tx_status.type) { 989 case WLAN_FC_TYPE_MGMT: 990 hostapd_mgmt_tx_cb(hapd, data->tx_status.data, 991 data->tx_status.data_len, 992 data->tx_status.stype, 993 data->tx_status.ack); 994 break; 995 case WLAN_FC_TYPE_DATA: 996 hostapd_tx_status(hapd, data->tx_status.dst, 997 data->tx_status.data, 998 data->tx_status.data_len, 999 data->tx_status.ack); 1000 break; 1001 } 1002 break; 1003 case EVENT_EAPOL_TX_STATUS: 1004 hostapd_eapol_tx_status(hapd, data->eapol_tx_status.dst, 1005 data->eapol_tx_status.data, 1006 data->eapol_tx_status.data_len, 1007 data->eapol_tx_status.ack); 1008 break; 1009 case EVENT_DRIVER_CLIENT_POLL_OK: 1010 hostapd_client_poll_ok(hapd, data->client_poll.addr); 1011 break; 1012 case EVENT_RX_FROM_UNKNOWN: 1013 hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid, 1014 data->rx_from_unknown.addr, 1015 data->rx_from_unknown.wds); 1016 break; 1017 #endif /* NEED_AP_MLME */ 1018 case EVENT_RX_MGMT: 1019 if (!data->rx_mgmt.frame) 1020 break; 1021 #ifdef NEED_AP_MLME 1022 if (hostapd_mgmt_rx(hapd, &data->rx_mgmt) > 0) 1023 break; 1024 #endif /* NEED_AP_MLME */ 1025 hostapd_action_rx(hapd, &data->rx_mgmt); 1026 break; 1027 case EVENT_RX_PROBE_REQ: 1028 if (data->rx_probe_req.sa == NULL || 1029 data->rx_probe_req.ie == NULL) 1030 break; 1031 hostapd_probe_req_rx(hapd, data->rx_probe_req.sa, 1032 data->rx_probe_req.da, 1033 data->rx_probe_req.bssid, 1034 data->rx_probe_req.ie, 1035 data->rx_probe_req.ie_len, 1036 data->rx_probe_req.ssi_signal); 1037 break; 1038 case EVENT_NEW_STA: 1039 hostapd_event_new_sta(hapd, data->new_sta.addr); 1040 break; 1041 case EVENT_EAPOL_RX: 1042 hostapd_event_eapol_rx(hapd, data->eapol_rx.src, 1043 data->eapol_rx.data, 1044 data->eapol_rx.data_len); 1045 break; 1046 case EVENT_ASSOC: 1047 hostapd_notif_assoc(hapd, data->assoc_info.addr, 1048 data->assoc_info.req_ies, 1049 data->assoc_info.req_ies_len, 1050 data->assoc_info.reassoc); 1051 break; 1052 case EVENT_DISASSOC: 1053 if (data) 1054 hostapd_notif_disassoc(hapd, data->disassoc_info.addr); 1055 break; 1056 case EVENT_DEAUTH: 1057 if (data) 1058 hostapd_notif_disassoc(hapd, data->deauth_info.addr); 1059 break; 1060 case EVENT_STATION_LOW_ACK: 1061 if (!data) 1062 break; 1063 hostapd_event_sta_low_ack(hapd, data->low_ack.addr); 1064 break; 1065 case EVENT_AUTH: 1066 hostapd_notif_auth(hapd, &data->auth); 1067 break; 1068 case EVENT_CH_SWITCH: 1069 if (!data) 1070 break; 1071 hostapd_event_ch_switch(hapd, data->ch_switch.freq, 1072 data->ch_switch.ht_enabled, 1073 data->ch_switch.ch_offset, 1074 data->ch_switch.ch_width, 1075 data->ch_switch.cf1, 1076 data->ch_switch.cf2); 1077 break; 1078 case EVENT_CONNECT_FAILED_REASON: 1079 if (!data) 1080 break; 1081 hostapd_event_connect_failed_reason( 1082 hapd, data->connect_failed_reason.addr, 1083 data->connect_failed_reason.code); 1084 break; 1085 case EVENT_SURVEY: 1086 hostapd_event_get_survey(hapd, &data->survey_results); 1087 break; 1088 #ifdef NEED_AP_MLME 1089 case EVENT_INTERFACE_UNAVAILABLE: 1090 hostapd_event_iface_unavailable(hapd); 1091 break; 1092 case EVENT_DFS_RADAR_DETECTED: 1093 if (!data) 1094 break; 1095 hostapd_event_dfs_radar_detected(hapd, &data->dfs_event); 1096 break; 1097 case EVENT_DFS_CAC_FINISHED: 1098 if (!data) 1099 break; 1100 hostapd_event_dfs_cac_finished(hapd, &data->dfs_event); 1101 break; 1102 case EVENT_DFS_CAC_ABORTED: 1103 if (!data) 1104 break; 1105 hostapd_event_dfs_cac_aborted(hapd, &data->dfs_event); 1106 break; 1107 case EVENT_DFS_NOP_FINISHED: 1108 if (!data) 1109 break; 1110 hostapd_event_dfs_nop_finished(hapd, &data->dfs_event); 1111 break; 1112 case EVENT_CHANNEL_LIST_CHANGED: 1113 /* channel list changed (regulatory?), update channel list */ 1114 /* TODO: check this. hostapd_get_hw_features() initializes 1115 * too much stuff. */ 1116 /* hostapd_get_hw_features(hapd->iface); */ 1117 hostapd_channel_list_updated( 1118 hapd->iface, data->channel_list_changed.initiator); 1119 break; 1120 #endif /* NEED_AP_MLME */ 1121 default: 1122 wpa_printf(MSG_DEBUG, "Unknown event %d", event); 1123 break; 1124 } 1125 } 1126 1127 #endif /* HOSTAPD */ 1128
