1 /* 2 * hostapd / Callback functions for driver wrappers 3 * Copyright (c) 2002-2013, Jouni Malinen <j (at) w1.fi> 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "utils/eloop.h" 13 #include "radius/radius.h" 14 #include "drivers/driver.h" 15 #include "common/ieee802_11_defs.h" 16 #include "common/ieee802_11_common.h" 17 #include "common/wpa_ctrl.h" 18 #include "crypto/random.h" 19 #include "p2p/p2p.h" 20 #include "wps/wps.h" 21 #include "wnm_ap.h" 22 #include "hostapd.h" 23 #include "ieee802_11.h" 24 #include "sta_info.h" 25 #include "accounting.h" 26 #include "tkip_countermeasures.h" 27 #include "ieee802_1x.h" 28 #include "wpa_auth.h" 29 #include "wps_hostapd.h" 30 #include "ap_drv_ops.h" 31 #include "ap_config.h" 32 #include "hw_features.h" 33 #include "dfs.h" 34 #include "beacon.h" 35 36 37 int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr, 38 const u8 *req_ies, size_t req_ies_len, int reassoc) 39 { 40 struct sta_info *sta; 41 int new_assoc, res; 42 struct ieee802_11_elems elems; 43 const u8 *ie; 44 size_t ielen; 45 #ifdef CONFIG_IEEE80211R 46 u8 buf[sizeof(struct ieee80211_mgmt) + 1024]; 47 u8 *p = buf; 48 #endif /* CONFIG_IEEE80211R */ 49 u16 reason = WLAN_REASON_UNSPECIFIED; 50 u16 status = WLAN_STATUS_SUCCESS; 51 const u8 *p2p_dev_addr = NULL; 52 53 if (addr == NULL) { 54 /* 55 * This could potentially happen with unexpected event from the 56 * driver wrapper. This was seen at least in one case where the 57 * driver ended up being set to station mode while hostapd was 58 * running, so better make sure we stop processing such an 59 * event here. 60 */ 61 wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with " 62 "no address"); 63 return -1; 64 } 65 random_add_randomness(addr, ETH_ALEN); 66 67 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 68 HOSTAPD_LEVEL_INFO, "associated"); 69 70 ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0); 71 if (elems.wps_ie) { 72 ie = elems.wps_ie - 2; 73 ielen = elems.wps_ie_len + 2; 74 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq"); 75 } else if (elems.rsn_ie) { 76 ie = elems.rsn_ie - 2; 77 ielen = elems.rsn_ie_len + 2; 78 wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq"); 79 } else if (elems.wpa_ie) { 80 ie = elems.wpa_ie - 2; 81 ielen = elems.wpa_ie_len + 2; 82 wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq"); 83 #ifdef CONFIG_HS20 84 } else if (elems.osen) { 85 ie = elems.osen - 2; 86 ielen = elems.osen_len + 2; 87 wpa_printf(MSG_DEBUG, "STA included OSEN IE in (Re)AssocReq"); 88 #endif /* CONFIG_HS20 */ 89 } else { 90 ie = NULL; 91 ielen = 0; 92 wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in " 93 "(Re)AssocReq"); 94 } 95 96 sta = ap_get_sta(hapd, addr); 97 if (sta) { 98 ap_sta_no_session_timeout(hapd, sta); 99 accounting_sta_stop(hapd, sta); 100 101 /* 102 * Make sure that the previously registered inactivity timer 103 * will not remove the STA immediately. 104 */ 105 sta->timeout_next = STA_NULLFUNC; 106 } else { 107 sta = ap_sta_add(hapd, addr); 108 if (sta == NULL) { 109 hostapd_drv_sta_disassoc(hapd, addr, 110 WLAN_REASON_DISASSOC_AP_BUSY); 111 return -1; 112 } 113 } 114 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2); 115 116 #ifdef CONFIG_P2P 117 if (elems.p2p) { 118 wpabuf_free(sta->p2p_ie); 119 sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, 120 P2P_IE_VENDOR_TYPE); 121 if (sta->p2p_ie) 122 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie); 123 } 124 #endif /* CONFIG_P2P */ 125 126 #ifdef CONFIG_IEEE80211N 127 #ifdef NEED_AP_MLME 128 if (elems.ht_capabilities && 129 elems.ht_capabilities_len >= 130 sizeof(struct ieee80211_ht_capabilities) && 131 (hapd->iface->conf->ht_capab & 132 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET)) { 133 struct ieee80211_ht_capabilities *ht_cap = 134 (struct ieee80211_ht_capabilities *) 135 elems.ht_capabilities; 136 137 if (le_to_host16(ht_cap->ht_capabilities_info) & 138 HT_CAP_INFO_40MHZ_INTOLERANT) 139 ht40_intolerant_add(hapd->iface, sta); 140 } 141 #endif /* NEED_AP_MLME */ 142 #endif /* CONFIG_IEEE80211N */ 143 144 #ifdef CONFIG_INTERWORKING 145 if (elems.ext_capab && elems.ext_capab_len > 4) { 146 if (elems.ext_capab[4] & 0x01) 147 sta->qos_map_enabled = 1; 148 } 149 #endif /* CONFIG_INTERWORKING */ 150 151 #ifdef CONFIG_HS20 152 wpabuf_free(sta->hs20_ie); 153 if (elems.hs20 && elems.hs20_len > 4) { 154 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4, 155 elems.hs20_len - 4); 156 } else 157 sta->hs20_ie = NULL; 158 #endif /* CONFIG_HS20 */ 159 160 if (hapd->conf->wpa) { 161 if (ie == NULL || ielen == 0) { 162 #ifdef CONFIG_WPS 163 if (hapd->conf->wps_state) { 164 wpa_printf(MSG_DEBUG, "STA did not include " 165 "WPA/RSN IE in (Re)Association " 166 "Request - possible WPS use"); 167 sta->flags |= WLAN_STA_MAYBE_WPS; 168 goto skip_wpa_check; 169 } 170 #endif /* CONFIG_WPS */ 171 172 wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA"); 173 return -1; 174 } 175 #ifdef CONFIG_WPS 176 if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 && 177 os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) { 178 struct wpabuf *wps; 179 sta->flags |= WLAN_STA_WPS; 180 wps = ieee802_11_vendor_ie_concat(ie, ielen, 181 WPS_IE_VENDOR_TYPE); 182 if (wps) { 183 if (wps_is_20(wps)) { 184 wpa_printf(MSG_DEBUG, "WPS: STA " 185 "supports WPS 2.0"); 186 sta->flags |= WLAN_STA_WPS2; 187 } 188 wpabuf_free(wps); 189 } 190 goto skip_wpa_check; 191 } 192 #endif /* CONFIG_WPS */ 193 194 if (sta->wpa_sm == NULL) 195 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 196 sta->addr, 197 p2p_dev_addr); 198 if (sta->wpa_sm == NULL) { 199 wpa_printf(MSG_ERROR, "Failed to initialize WPA state " 200 "machine"); 201 return -1; 202 } 203 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm, 204 ie, ielen, 205 elems.mdie, elems.mdie_len); 206 if (res != WPA_IE_OK) { 207 wpa_printf(MSG_DEBUG, "WPA/RSN information element " 208 "rejected? (res %u)", res); 209 wpa_hexdump(MSG_DEBUG, "IE", ie, ielen); 210 if (res == WPA_INVALID_GROUP) { 211 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID; 212 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID; 213 } else if (res == WPA_INVALID_PAIRWISE) { 214 reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID; 215 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 216 } else if (res == WPA_INVALID_AKMP) { 217 reason = WLAN_REASON_AKMP_NOT_VALID; 218 status = WLAN_STATUS_AKMP_NOT_VALID; 219 } 220 #ifdef CONFIG_IEEE80211W 221 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) { 222 reason = WLAN_REASON_INVALID_IE; 223 status = WLAN_STATUS_INVALID_IE; 224 } else if (res == WPA_INVALID_MGMT_GROUP_CIPHER) { 225 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID; 226 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID; 227 } 228 #endif /* CONFIG_IEEE80211W */ 229 else { 230 reason = WLAN_REASON_INVALID_IE; 231 status = WLAN_STATUS_INVALID_IE; 232 } 233 goto fail; 234 } 235 #ifdef CONFIG_IEEE80211W 236 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && 237 sta->sa_query_count > 0) 238 ap_check_sa_query_timeout(hapd, sta); 239 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out && 240 (sta->auth_alg != WLAN_AUTH_FT)) { 241 /* 242 * STA has already been associated with MFP and SA 243 * Query timeout has not been reached. Reject the 244 * association attempt temporarily and start SA Query, 245 * if one is not pending. 246 */ 247 248 if (sta->sa_query_count == 0) 249 ap_sta_start_sa_query(hapd, sta); 250 251 #ifdef CONFIG_IEEE80211R 252 status = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY; 253 254 p = hostapd_eid_assoc_comeback_time(hapd, sta, p); 255 256 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, 257 p - buf); 258 #endif /* CONFIG_IEEE80211R */ 259 return 0; 260 } 261 262 if (wpa_auth_uses_mfp(sta->wpa_sm)) 263 sta->flags |= WLAN_STA_MFP; 264 else 265 sta->flags &= ~WLAN_STA_MFP; 266 #endif /* CONFIG_IEEE80211W */ 267 268 #ifdef CONFIG_IEEE80211R 269 if (sta->auth_alg == WLAN_AUTH_FT) { 270 status = wpa_ft_validate_reassoc(sta->wpa_sm, req_ies, 271 req_ies_len); 272 if (status != WLAN_STATUS_SUCCESS) { 273 if (status == WLAN_STATUS_INVALID_PMKID) 274 reason = WLAN_REASON_INVALID_IE; 275 if (status == WLAN_STATUS_INVALID_MDIE) 276 reason = WLAN_REASON_INVALID_IE; 277 if (status == WLAN_STATUS_INVALID_FTIE) 278 reason = WLAN_REASON_INVALID_IE; 279 goto fail; 280 } 281 } 282 #endif /* CONFIG_IEEE80211R */ 283 } else if (hapd->conf->wps_state) { 284 #ifdef CONFIG_WPS 285 struct wpabuf *wps; 286 if (req_ies) 287 wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len, 288 WPS_IE_VENDOR_TYPE); 289 else 290 wps = NULL; 291 #ifdef CONFIG_WPS_STRICT 292 if (wps && wps_validate_assoc_req(wps) < 0) { 293 reason = WLAN_REASON_INVALID_IE; 294 status = WLAN_STATUS_INVALID_IE; 295 wpabuf_free(wps); 296 goto fail; 297 } 298 #endif /* CONFIG_WPS_STRICT */ 299 if (wps) { 300 sta->flags |= WLAN_STA_WPS; 301 if (wps_is_20(wps)) { 302 wpa_printf(MSG_DEBUG, "WPS: STA supports " 303 "WPS 2.0"); 304 sta->flags |= WLAN_STA_WPS2; 305 } 306 } else 307 sta->flags |= WLAN_STA_MAYBE_WPS; 308 wpabuf_free(wps); 309 #endif /* CONFIG_WPS */ 310 #ifdef CONFIG_HS20 311 } else if (hapd->conf->osen) { 312 if (elems.osen == NULL) { 313 hostapd_logger( 314 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211, 315 HOSTAPD_LEVEL_INFO, 316 "No HS 2.0 OSEN element in association request"); 317 return WLAN_STATUS_INVALID_IE; 318 } 319 320 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association"); 321 if (sta->wpa_sm == NULL) 322 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 323 sta->addr, NULL); 324 if (sta->wpa_sm == NULL) { 325 wpa_printf(MSG_WARNING, "Failed to initialize WPA " 326 "state machine"); 327 return WLAN_STATUS_UNSPECIFIED_FAILURE; 328 } 329 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm, 330 elems.osen - 2, elems.osen_len + 2) < 0) 331 return WLAN_STATUS_INVALID_IE; 332 #endif /* CONFIG_HS20 */ 333 } 334 #ifdef CONFIG_WPS 335 skip_wpa_check: 336 #endif /* CONFIG_WPS */ 337 338 #ifdef CONFIG_IEEE80211R 339 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, buf, sizeof(buf), 340 sta->auth_alg, req_ies, req_ies_len); 341 342 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); 343 344 if (sta->auth_alg == WLAN_AUTH_FT) 345 ap_sta_set_authorized(hapd, sta, 1); 346 #else /* CONFIG_IEEE80211R */ 347 /* Keep compiler silent about unused variables */ 348 if (status) { 349 } 350 #endif /* CONFIG_IEEE80211R */ 351 352 new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0; 353 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC; 354 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE; 355 356 hostapd_set_sta_flags(hapd, sta); 357 358 if (reassoc && (sta->auth_alg == WLAN_AUTH_FT)) 359 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT); 360 else 361 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC); 362 363 hostapd_new_assoc_sta(hapd, sta, !new_assoc); 364 365 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1); 366 367 #ifdef CONFIG_P2P 368 if (req_ies) { 369 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, 370 req_ies, req_ies_len); 371 } 372 #endif /* CONFIG_P2P */ 373 374 return 0; 375 376 fail: 377 #ifdef CONFIG_IEEE80211R 378 hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf); 379 #endif /* CONFIG_IEEE80211R */ 380 hostapd_drv_sta_disassoc(hapd, sta->addr, reason); 381 ap_free_sta(hapd, sta); 382 return -1; 383 } 384 385 386 void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr) 387 { 388 struct sta_info *sta; 389 390 if (addr == NULL) { 391 /* 392 * This could potentially happen with unexpected event from the 393 * driver wrapper. This was seen at least in one case where the 394 * driver ended up reporting a station mode event while hostapd 395 * was running, so better make sure we stop processing such an 396 * event here. 397 */ 398 wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event " 399 "with no address"); 400 return; 401 } 402 403 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 404 HOSTAPD_LEVEL_INFO, "disassociated"); 405 406 sta = ap_get_sta(hapd, addr); 407 if (sta == NULL) { 408 wpa_printf(MSG_DEBUG, "Disassociation notification for " 409 "unknown STA " MACSTR, MAC2STR(addr)); 410 return; 411 } 412 413 ap_sta_set_authorized(hapd, sta, 0); 414 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC); 415 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC); 416 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST; 417 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0); 418 ap_free_sta(hapd, sta); 419 } 420 421 422 void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr) 423 { 424 struct sta_info *sta = ap_get_sta(hapd, addr); 425 426 if (!sta || !hapd->conf->disassoc_low_ack) 427 return; 428 429 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211, 430 HOSTAPD_LEVEL_INFO, "disconnected due to excessive " 431 "missing ACKs"); 432 hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK); 433 if (sta) 434 ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK); 435 } 436 437 438 void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht, 439 int offset, int width, int cf1, int cf2) 440 { 441 #ifdef NEED_AP_MLME 442 int channel, chwidth, seg0_idx = 0, seg1_idx = 0; 443 444 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, 445 HOSTAPD_LEVEL_INFO, "driver had channel switch: " 446 "freq=%d, ht=%d, offset=%d, width=%d, cf1=%d, cf2=%d", 447 freq, ht, offset, width, cf1, cf2); 448 449 hapd->iface->freq = freq; 450 451 channel = hostapd_hw_get_channel(hapd, freq); 452 if (!channel) { 453 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211, 454 HOSTAPD_LEVEL_WARNING, "driver switched to " 455 "bad channel!"); 456 return; 457 } 458 459 switch (width) { 460 case CHAN_WIDTH_80: 461 chwidth = VHT_CHANWIDTH_80MHZ; 462 break; 463 case CHAN_WIDTH_80P80: 464 chwidth = VHT_CHANWIDTH_80P80MHZ; 465 break; 466 case CHAN_WIDTH_160: 467 chwidth = VHT_CHANWIDTH_160MHZ; 468 break; 469 case CHAN_WIDTH_20_NOHT: 470 case CHAN_WIDTH_20: 471 case CHAN_WIDTH_40: 472 default: 473 chwidth = VHT_CHANWIDTH_USE_HT; 474 break; 475 } 476 477 switch (hapd->iface->current_mode->mode) { 478 case HOSTAPD_MODE_IEEE80211A: 479 if (cf1 > 5000) 480 seg0_idx = (cf1 - 5000) / 5; 481 if (cf2 > 5000) 482 seg1_idx = (cf2 - 5000) / 5; 483 break; 484 default: 485 seg0_idx = hostapd_hw_get_channel(hapd, cf1); 486 seg1_idx = hostapd_hw_get_channel(hapd, cf2); 487 break; 488 } 489 490 hapd->iconf->channel = channel; 491 hapd->iconf->ieee80211n = ht; 492 hapd->iconf->secondary_channel = offset; 493 hapd->iconf->vht_oper_chwidth = chwidth; 494 hapd->iconf->vht_oper_centr_freq_seg0_idx = seg0_idx; 495 hapd->iconf->vht_oper_centr_freq_seg1_idx = seg1_idx; 496 497 if (hapd->csa_in_progress && 498 freq == hapd->cs_freq_params.freq) { 499 hostapd_cleanup_cs_params(hapd); 500 ieee802_11_set_beacon(hapd); 501 502 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d", 503 freq); 504 } 505 #endif /* NEED_AP_MLME */ 506 } 507 508 509 void hostapd_event_connect_failed_reason(struct hostapd_data *hapd, 510 const u8 *addr, int reason_code) 511 { 512 switch (reason_code) { 513 case MAX_CLIENT_REACHED: 514 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_MAX_STA MACSTR, 515 MAC2STR(addr)); 516 break; 517 case BLOCKED_CLIENT: 518 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_BLOCKED_STA MACSTR, 519 MAC2STR(addr)); 520 break; 521 } 522 } 523 524 525 int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da, 526 const u8 *bssid, const u8 *ie, size_t ie_len, 527 int ssi_signal) 528 { 529 size_t i; 530 int ret = 0; 531 532 if (sa == NULL || ie == NULL) 533 return -1; 534 535 random_add_randomness(sa, ETH_ALEN); 536 for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) { 537 if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx, 538 sa, da, bssid, ie, ie_len, 539 ssi_signal) > 0) { 540 ret = 1; 541 break; 542 } 543 } 544 return ret; 545 } 546 547 548 #ifdef HOSTAPD 549 550 #ifdef CONFIG_IEEE80211R 551 static void hostapd_notify_auth_ft_finish(void *ctx, const u8 *dst, 552 const u8 *bssid, 553 u16 auth_transaction, u16 status, 554 const u8 *ies, size_t ies_len) 555 { 556 struct hostapd_data *hapd = ctx; 557 struct sta_info *sta; 558 559 sta = ap_get_sta(hapd, dst); 560 if (sta == NULL) 561 return; 562 563 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211, 564 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)"); 565 sta->flags |= WLAN_STA_AUTH; 566 567 hostapd_sta_auth(hapd, dst, auth_transaction, status, ies, ies_len); 568 } 569 #endif /* CONFIG_IEEE80211R */ 570 571 572 static void hostapd_notif_auth(struct hostapd_data *hapd, 573 struct auth_info *rx_auth) 574 { 575 struct sta_info *sta; 576 u16 status = WLAN_STATUS_SUCCESS; 577 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN]; 578 size_t resp_ies_len = 0; 579 580 sta = ap_get_sta(hapd, rx_auth->peer); 581 if (!sta) { 582 sta = ap_sta_add(hapd, rx_auth->peer); 583 if (sta == NULL) { 584 status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA; 585 goto fail; 586 } 587 } 588 sta->flags &= ~WLAN_STA_PREAUTH; 589 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0); 590 #ifdef CONFIG_IEEE80211R 591 if (rx_auth->auth_type == WLAN_AUTH_FT && hapd->wpa_auth) { 592 sta->auth_alg = WLAN_AUTH_FT; 593 if (sta->wpa_sm == NULL) 594 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, 595 sta->addr, NULL); 596 if (sta->wpa_sm == NULL) { 597 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA " 598 "state machine"); 599 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 600 goto fail; 601 } 602 wpa_ft_process_auth(sta->wpa_sm, rx_auth->bssid, 603 rx_auth->auth_transaction, rx_auth->ies, 604 rx_auth->ies_len, 605 hostapd_notify_auth_ft_finish, hapd); 606 return; 607 } 608 #endif /* CONFIG_IEEE80211R */ 609 fail: 610 hostapd_sta_auth(hapd, rx_auth->peer, rx_auth->auth_transaction + 1, 611 status, resp_ies, resp_ies_len); 612 } 613 614 615 static void hostapd_action_rx(struct hostapd_data *hapd, 616 struct rx_mgmt *drv_mgmt) 617 { 618 struct ieee80211_mgmt *mgmt; 619 struct sta_info *sta; 620 size_t plen __maybe_unused; 621 u16 fc; 622 623 if (drv_mgmt->frame_len < 24 + 1) 624 return; 625 626 plen = drv_mgmt->frame_len - 24 - 1; 627 628 mgmt = (struct ieee80211_mgmt *) drv_mgmt->frame; 629 fc = le_to_host16(mgmt->frame_control); 630 if (WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION) 631 return; /* handled by the driver */ 632 633 wpa_printf(MSG_DEBUG, "RX_ACTION cat %d action plen %d", 634 mgmt->u.action.category, (int) plen); 635 636 sta = ap_get_sta(hapd, mgmt->sa); 637 if (sta == NULL) { 638 wpa_printf(MSG_DEBUG, "%s: station not found", __func__); 639 return; 640 } 641 #ifdef CONFIG_IEEE80211R 642 if (mgmt->u.action.category == WLAN_ACTION_FT) { 643 const u8 *payload = drv_mgmt->frame + 24 + 1; 644 wpa_ft_action_rx(sta->wpa_sm, payload, plen); 645 } 646 #endif /* CONFIG_IEEE80211R */ 647 #ifdef CONFIG_IEEE80211W 648 if (mgmt->u.action.category == WLAN_ACTION_SA_QUERY && plen >= 4) { 649 ieee802_11_sa_query_action( 650 hapd, mgmt->sa, 651 mgmt->u.action.u.sa_query_resp.action, 652 mgmt->u.action.u.sa_query_resp.trans_id); 653 } 654 #endif /* CONFIG_IEEE80211W */ 655 #ifdef CONFIG_WNM 656 if (mgmt->u.action.category == WLAN_ACTION_WNM) { 657 ieee802_11_rx_wnm_action_ap(hapd, mgmt, drv_mgmt->frame_len); 658 } 659 #endif /* CONFIG_WNM */ 660 } 661 662 663 #ifdef NEED_AP_MLME 664 665 #define HAPD_BROADCAST ((struct hostapd_data *) -1) 666 667 static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface, 668 const u8 *bssid) 669 { 670 size_t i; 671 672 if (bssid == NULL) 673 return NULL; 674 if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff && 675 bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff) 676 return HAPD_BROADCAST; 677 678 for (i = 0; i < iface->num_bss; i++) { 679 if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) 680 return iface->bss[i]; 681 } 682 683 return NULL; 684 } 685 686 687 static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd, 688 const u8 *bssid, const u8 *addr, 689 int wds) 690 { 691 hapd = get_hapd_bssid(hapd->iface, bssid); 692 if (hapd == NULL || hapd == HAPD_BROADCAST) 693 return; 694 695 ieee802_11_rx_from_unknown(hapd, addr, wds); 696 } 697 698 699 static int hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt) 700 { 701 struct hostapd_iface *iface = hapd->iface; 702 const struct ieee80211_hdr *hdr; 703 const u8 *bssid; 704 struct hostapd_frame_info fi; 705 int ret; 706 707 #ifdef CONFIG_TESTING_OPTIONS 708 if (hapd->ext_mgmt_frame_handling) { 709 size_t hex_len = 2 * rx_mgmt->frame_len + 1; 710 char *hex = os_malloc(hex_len); 711 if (hex) { 712 wpa_snprintf_hex(hex, hex_len, rx_mgmt->frame, 713 rx_mgmt->frame_len); 714 wpa_msg(hapd->msg_ctx, MSG_INFO, "MGMT-RX %s", hex); 715 os_free(hex); 716 } 717 return 1; 718 } 719 #endif /* CONFIG_TESTING_OPTIONS */ 720 721 hdr = (const struct ieee80211_hdr *) rx_mgmt->frame; 722 bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len); 723 if (bssid == NULL) 724 return 0; 725 726 hapd = get_hapd_bssid(iface, bssid); 727 if (hapd == NULL) { 728 u16 fc; 729 fc = le_to_host16(hdr->frame_control); 730 731 /* 732 * Drop frames to unknown BSSIDs except for Beacon frames which 733 * could be used to update neighbor information. 734 */ 735 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 736 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) 737 hapd = iface->bss[0]; 738 else 739 return 0; 740 } 741 742 os_memset(&fi, 0, sizeof(fi)); 743 fi.datarate = rx_mgmt->datarate; 744 fi.ssi_signal = rx_mgmt->ssi_signal; 745 746 if (hapd == HAPD_BROADCAST) { 747 size_t i; 748 ret = 0; 749 for (i = 0; i < iface->num_bss; i++) { 750 /* if bss is set, driver will call this function for 751 * each bss individually. */ 752 if (rx_mgmt->drv_priv && 753 (iface->bss[i]->drv_priv != rx_mgmt->drv_priv)) 754 continue; 755 756 if (ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame, 757 rx_mgmt->frame_len, &fi) > 0) 758 ret = 1; 759 } 760 } else 761 ret = ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, 762 &fi); 763 764 random_add_randomness(&fi, sizeof(fi)); 765 766 return ret; 767 } 768 769 770 static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf, 771 size_t len, u16 stype, int ok) 772 { 773 struct ieee80211_hdr *hdr; 774 hdr = (struct ieee80211_hdr *) buf; 775 hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len)); 776 if (hapd == NULL || hapd == HAPD_BROADCAST) 777 return; 778 ieee802_11_mgmt_cb(hapd, buf, len, stype, ok); 779 } 780 781 #endif /* NEED_AP_MLME */ 782 783 784 static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr) 785 { 786 struct sta_info *sta = ap_get_sta(hapd, addr); 787 if (sta) 788 return 0; 789 790 wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR 791 " - adding a new STA", MAC2STR(addr)); 792 sta = ap_sta_add(hapd, addr); 793 if (sta) { 794 hostapd_new_assoc_sta(hapd, sta, 0); 795 } else { 796 wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR, 797 MAC2STR(addr)); 798 return -1; 799 } 800 801 return 0; 802 } 803 804 805 static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src, 806 const u8 *data, size_t data_len) 807 { 808 struct hostapd_iface *iface = hapd->iface; 809 struct sta_info *sta; 810 size_t j; 811 812 for (j = 0; j < iface->num_bss; j++) { 813 if ((sta = ap_get_sta(iface->bss[j], src))) { 814 if (sta->flags & WLAN_STA_ASSOC) { 815 hapd = iface->bss[j]; 816 break; 817 } 818 } 819 } 820 821 ieee802_1x_receive(hapd, src, data, data_len); 822 } 823 824 825 static struct hostapd_channel_data * hostapd_get_mode_channel( 826 struct hostapd_iface *iface, unsigned int freq) 827 { 828 int i; 829 struct hostapd_channel_data *chan; 830 831 for (i = 0; i < iface->current_mode->num_channels; i++) { 832 chan = &iface->current_mode->channels[i]; 833 if (!chan) 834 return NULL; 835 if ((unsigned int) chan->freq == freq) 836 return chan; 837 } 838 839 return NULL; 840 } 841 842 843 static void hostapd_update_nf(struct hostapd_iface *iface, 844 struct hostapd_channel_data *chan, 845 struct freq_survey *survey) 846 { 847 if (!iface->chans_surveyed) { 848 chan->min_nf = survey->nf; 849 iface->lowest_nf = survey->nf; 850 } else { 851 if (dl_list_empty(&chan->survey_list)) 852 chan->min_nf = survey->nf; 853 else if (survey->nf < chan->min_nf) 854 chan->min_nf = survey->nf; 855 if (survey->nf < iface->lowest_nf) 856 iface->lowest_nf = survey->nf; 857 } 858 } 859 860 861 static void hostapd_event_get_survey(struct hostapd_data *hapd, 862 struct survey_results *survey_results) 863 { 864 struct hostapd_iface *iface = hapd->iface; 865 struct freq_survey *survey, *tmp; 866 struct hostapd_channel_data *chan; 867 868 if (dl_list_empty(&survey_results->survey_list)) { 869 wpa_printf(MSG_DEBUG, "No survey data received"); 870 return; 871 } 872 873 dl_list_for_each_safe(survey, tmp, &survey_results->survey_list, 874 struct freq_survey, list) { 875 chan = hostapd_get_mode_channel(iface, survey->freq); 876 if (!chan) 877 continue; 878 if (chan->flag & HOSTAPD_CHAN_DISABLED) 879 continue; 880 881 dl_list_del(&survey->list); 882 dl_list_add_tail(&chan->survey_list, &survey->list); 883 884 hostapd_update_nf(iface, chan, survey); 885 886 iface->chans_surveyed++; 887 } 888 } 889 890 891 #ifdef NEED_AP_MLME 892 893 static void hostapd_event_iface_unavailable(struct hostapd_data *hapd) 894 { 895 wpa_printf(MSG_DEBUG, "Interface %s is unavailable -- stopped", 896 hapd->conf->iface); 897 898 if (hapd->csa_in_progress) { 899 wpa_printf(MSG_INFO, "CSA failed (%s was stopped)", 900 hapd->conf->iface); 901 hostapd_switch_channel_fallback(hapd->iface, 902 &hapd->cs_freq_params); 903 } 904 } 905 906 907 static void hostapd_event_dfs_radar_detected(struct hostapd_data *hapd, 908 struct dfs_event *radar) 909 { 910 wpa_printf(MSG_DEBUG, "DFS radar detected on %d MHz", radar->freq); 911 hostapd_dfs_radar_detected(hapd->iface, radar->freq, radar->ht_enabled, 912 radar->chan_offset, radar->chan_width, 913 radar->cf1, radar->cf2); 914 } 915 916 917 static void hostapd_event_dfs_cac_finished(struct hostapd_data *hapd, 918 struct dfs_event *radar) 919 { 920 wpa_printf(MSG_DEBUG, "DFS CAC finished on %d MHz", radar->freq); 921 hostapd_dfs_complete_cac(hapd->iface, 1, radar->freq, radar->ht_enabled, 922 radar->chan_offset, radar->chan_width, 923 radar->cf1, radar->cf2); 924 } 925 926 927 static void hostapd_event_dfs_cac_aborted(struct hostapd_data *hapd, 928 struct dfs_event *radar) 929 { 930 wpa_printf(MSG_DEBUG, "DFS CAC aborted on %d MHz", radar->freq); 931 hostapd_dfs_complete_cac(hapd->iface, 0, radar->freq, radar->ht_enabled, 932 radar->chan_offset, radar->chan_width, 933 radar->cf1, radar->cf2); 934 } 935 936 937 static void hostapd_event_dfs_nop_finished(struct hostapd_data *hapd, 938 struct dfs_event *radar) 939 { 940 wpa_printf(MSG_DEBUG, "DFS NOP finished on %d MHz", radar->freq); 941 hostapd_dfs_nop_finished(hapd->iface, radar->freq, radar->ht_enabled, 942 radar->chan_offset, radar->chan_width, 943 radar->cf1, radar->cf2); 944 } 945 946 #endif /* NEED_AP_MLME */ 947 948 949 void wpa_supplicant_event(void *ctx, enum wpa_event_type event, 950 union wpa_event_data *data) 951 { 952 struct hostapd_data *hapd = ctx; 953 #ifndef CONFIG_NO_STDOUT_DEBUG 954 int level = MSG_DEBUG; 955 956 if (event == EVENT_RX_MGMT && data->rx_mgmt.frame && 957 data->rx_mgmt.frame_len >= 24) { 958 const struct ieee80211_hdr *hdr; 959 u16 fc; 960 hdr = (const struct ieee80211_hdr *) data->rx_mgmt.frame; 961 fc = le_to_host16(hdr->frame_control); 962 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 963 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) 964 level = MSG_EXCESSIVE; 965 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && 966 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_REQ) 967 level = MSG_EXCESSIVE; 968 } 969 970 wpa_dbg(hapd->msg_ctx, level, "Event %s (%d) received", 971 event_to_string(event), event); 972 #endif /* CONFIG_NO_STDOUT_DEBUG */ 973 974 switch (event) { 975 case EVENT_MICHAEL_MIC_FAILURE: 976 michael_mic_failure(hapd, data->michael_mic_failure.src, 1); 977 break; 978 case EVENT_SCAN_RESULTS: 979 if (hapd->iface->scan_cb) 980 hapd->iface->scan_cb(hapd->iface); 981 break; 982 #ifdef CONFIG_IEEE80211R 983 case EVENT_FT_RRB_RX: 984 wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src, 985 data->ft_rrb_rx.data, data->ft_rrb_rx.data_len); 986 break; 987 #endif /* CONFIG_IEEE80211R */ 988 case EVENT_WPS_BUTTON_PUSHED: 989 hostapd_wps_button_pushed(hapd, NULL); 990 break; 991 #ifdef NEED_AP_MLME 992 case EVENT_TX_STATUS: 993 switch (data->tx_status.type) { 994 case WLAN_FC_TYPE_MGMT: 995 hostapd_mgmt_tx_cb(hapd, data->tx_status.data, 996 data->tx_status.data_len, 997 data->tx_status.stype, 998 data->tx_status.ack); 999 break; 1000 case WLAN_FC_TYPE_DATA: 1001 hostapd_tx_status(hapd, data->tx_status.dst, 1002 data->tx_status.data, 1003 data->tx_status.data_len, 1004 data->tx_status.ack); 1005 break; 1006 } 1007 break; 1008 case EVENT_EAPOL_TX_STATUS: 1009 hostapd_eapol_tx_status(hapd, data->eapol_tx_status.dst, 1010 data->eapol_tx_status.data, 1011 data->eapol_tx_status.data_len, 1012 data->eapol_tx_status.ack); 1013 break; 1014 case EVENT_DRIVER_CLIENT_POLL_OK: 1015 hostapd_client_poll_ok(hapd, data->client_poll.addr); 1016 break; 1017 case EVENT_RX_FROM_UNKNOWN: 1018 hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid, 1019 data->rx_from_unknown.addr, 1020 data->rx_from_unknown.wds); 1021 break; 1022 #endif /* NEED_AP_MLME */ 1023 case EVENT_RX_MGMT: 1024 if (!data->rx_mgmt.frame) 1025 break; 1026 #ifdef NEED_AP_MLME 1027 if (hostapd_mgmt_rx(hapd, &data->rx_mgmt) > 0) 1028 break; 1029 #endif /* NEED_AP_MLME */ 1030 hostapd_action_rx(hapd, &data->rx_mgmt); 1031 break; 1032 case EVENT_RX_PROBE_REQ: 1033 if (data->rx_probe_req.sa == NULL || 1034 data->rx_probe_req.ie == NULL) 1035 break; 1036 hostapd_probe_req_rx(hapd, data->rx_probe_req.sa, 1037 data->rx_probe_req.da, 1038 data->rx_probe_req.bssid, 1039 data->rx_probe_req.ie, 1040 data->rx_probe_req.ie_len, 1041 data->rx_probe_req.ssi_signal); 1042 break; 1043 case EVENT_NEW_STA: 1044 hostapd_event_new_sta(hapd, data->new_sta.addr); 1045 break; 1046 case EVENT_EAPOL_RX: 1047 hostapd_event_eapol_rx(hapd, data->eapol_rx.src, 1048 data->eapol_rx.data, 1049 data->eapol_rx.data_len); 1050 break; 1051 case EVENT_ASSOC: 1052 if (!data) 1053 return; 1054 hostapd_notif_assoc(hapd, data->assoc_info.addr, 1055 data->assoc_info.req_ies, 1056 data->assoc_info.req_ies_len, 1057 data->assoc_info.reassoc); 1058 break; 1059 case EVENT_DISASSOC: 1060 if (data) 1061 hostapd_notif_disassoc(hapd, data->disassoc_info.addr); 1062 break; 1063 case EVENT_DEAUTH: 1064 if (data) 1065 hostapd_notif_disassoc(hapd, data->deauth_info.addr); 1066 break; 1067 case EVENT_STATION_LOW_ACK: 1068 if (!data) 1069 break; 1070 hostapd_event_sta_low_ack(hapd, data->low_ack.addr); 1071 break; 1072 case EVENT_AUTH: 1073 hostapd_notif_auth(hapd, &data->auth); 1074 break; 1075 case EVENT_CH_SWITCH: 1076 if (!data) 1077 break; 1078 hostapd_event_ch_switch(hapd, data->ch_switch.freq, 1079 data->ch_switch.ht_enabled, 1080 data->ch_switch.ch_offset, 1081 data->ch_switch.ch_width, 1082 data->ch_switch.cf1, 1083 data->ch_switch.cf2); 1084 break; 1085 case EVENT_CONNECT_FAILED_REASON: 1086 if (!data) 1087 break; 1088 hostapd_event_connect_failed_reason( 1089 hapd, data->connect_failed_reason.addr, 1090 data->connect_failed_reason.code); 1091 break; 1092 case EVENT_SURVEY: 1093 hostapd_event_get_survey(hapd, &data->survey_results); 1094 break; 1095 #ifdef NEED_AP_MLME 1096 case EVENT_INTERFACE_UNAVAILABLE: 1097 hostapd_event_iface_unavailable(hapd); 1098 break; 1099 case EVENT_DFS_RADAR_DETECTED: 1100 if (!data) 1101 break; 1102 hostapd_event_dfs_radar_detected(hapd, &data->dfs_event); 1103 break; 1104 case EVENT_DFS_CAC_FINISHED: 1105 if (!data) 1106 break; 1107 hostapd_event_dfs_cac_finished(hapd, &data->dfs_event); 1108 break; 1109 case EVENT_DFS_CAC_ABORTED: 1110 if (!data) 1111 break; 1112 hostapd_event_dfs_cac_aborted(hapd, &data->dfs_event); 1113 break; 1114 case EVENT_DFS_NOP_FINISHED: 1115 if (!data) 1116 break; 1117 hostapd_event_dfs_nop_finished(hapd, &data->dfs_event); 1118 break; 1119 case EVENT_CHANNEL_LIST_CHANGED: 1120 /* channel list changed (regulatory?), update channel list */ 1121 /* TODO: check this. hostapd_get_hw_features() initializes 1122 * too much stuff. */ 1123 /* hostapd_get_hw_features(hapd->iface); */ 1124 hostapd_channel_list_updated( 1125 hapd->iface, data->channel_list_changed.initiator); 1126 break; 1127 #endif /* NEED_AP_MLME */ 1128 default: 1129 wpa_printf(MSG_DEBUG, "Unknown event %d", event); 1130 break; 1131 } 1132 } 1133 1134 #endif /* HOSTAPD */ 1135
