]> git.ipfire.org Git - thirdparty/hostap.git/blob - src/ap/drv_callbacks.c
WPS: Fix WPS IE processing
[thirdparty/hostap.git] / src / ap / drv_callbacks.c
1 /*
2 * hostapd / Callback functions for driver wrappers
3 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
4 *
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
8 *
9 * Alternatively, this software may be distributed under the terms of BSD
10 * license.
11 *
12 * See README and COPYING for more details.
13 */
14
15 #include "utils/includes.h"
16
17 #include "utils/common.h"
18 #include "radius/radius.h"
19 #include "drivers/driver.h"
20 #include "common/ieee802_11_defs.h"
21 #include "common/ieee802_11_common.h"
22 #include "common/wpa_ctrl.h"
23 #include "crypto/random.h"
24 #include "p2p/p2p.h"
25 #include "wps/wps.h"
26 #include "hostapd.h"
27 #include "ieee802_11.h"
28 #include "sta_info.h"
29 #include "accounting.h"
30 #include "tkip_countermeasures.h"
31 #include "iapp.h"
32 #include "ieee802_1x.h"
33 #include "wpa_auth.h"
34 #include "wmm.h"
35 #include "wps_hostapd.h"
36 #include "ap_drv_ops.h"
37 #include "ap_config.h"
38
39
40 int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
41 const u8 *ie, size_t ielen, int reassoc)
42 {
43 struct sta_info *sta;
44 int new_assoc, res;
45 struct ieee802_11_elems elems;
46 #if defined(CONFIG_P2P) || defined(CONFIG_WPS)
47 const u8 *all_ies = ie;
48 size_t all_ies_len = ielen;
49 #endif /* CONFIG_P2P || CONFIG_WPS */
50
51 if (addr == NULL) {
52 /*
53 * This could potentially happen with unexpected event from the
54 * driver wrapper. This was seen at least in one case where the
55 * driver ended up being set to station mode while hostapd was
56 * running, so better make sure we stop processing such an
57 * event here.
58 */
59 wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
60 "no address");
61 return -1;
62 }
63 random_add_randomness(addr, ETH_ALEN);
64
65 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
66 HOSTAPD_LEVEL_INFO, "associated");
67
68 ieee802_11_parse_elems(ie, ielen, &elems, 0);
69 if (elems.wps_ie) {
70 ie = elems.wps_ie - 2;
71 ielen = elems.wps_ie_len + 2;
72 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
73 } else if (elems.rsn_ie) {
74 ie = elems.rsn_ie - 2;
75 ielen = elems.rsn_ie_len + 2;
76 wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
77 } else if (elems.wpa_ie) {
78 ie = elems.wpa_ie - 2;
79 ielen = elems.wpa_ie_len + 2;
80 wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
81 } else {
82 ie = NULL;
83 ielen = 0;
84 wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
85 "(Re)AssocReq");
86 }
87
88 sta = ap_get_sta(hapd, addr);
89 if (sta) {
90 accounting_sta_stop(hapd, sta);
91 } else {
92 sta = ap_sta_add(hapd, addr);
93 if (sta == NULL)
94 return -1;
95 }
96 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
97
98 #ifdef CONFIG_P2P
99 if (elems.p2p) {
100 wpabuf_free(sta->p2p_ie);
101 sta->p2p_ie = ieee802_11_vendor_ie_concat(all_ies, all_ies_len,
102 P2P_IE_VENDOR_TYPE);
103 }
104 #endif /* CONFIG_P2P */
105
106 if (hapd->conf->wpa) {
107 if (ie == NULL || ielen == 0) {
108 #ifdef CONFIG_WPS
109 if (hapd->conf->wps_state) {
110 wpa_printf(MSG_DEBUG, "STA did not include "
111 "WPA/RSN IE in (Re)Association "
112 "Request - possible WPS use");
113 sta->flags |= WLAN_STA_MAYBE_WPS;
114 goto skip_wpa_check;
115 }
116 #endif /* CONFIG_WPS */
117
118 wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
119 return -1;
120 }
121 #ifdef CONFIG_WPS
122 if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
123 os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
124 struct wpabuf *wps;
125 sta->flags |= WLAN_STA_WPS;
126 wps = ieee802_11_vendor_ie_concat(ie, ielen,
127 WPS_IE_VENDOR_TYPE);
128 if (wps) {
129 if (wps_is_20(wps)) {
130 wpa_printf(MSG_DEBUG, "WPS: STA "
131 "supports WPS 2.0");
132 sta->flags |= WLAN_STA_WPS2;
133 }
134 wpabuf_free(wps);
135 }
136 goto skip_wpa_check;
137 }
138 #endif /* CONFIG_WPS */
139
140 if (sta->wpa_sm == NULL)
141 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
142 sta->addr);
143 if (sta->wpa_sm == NULL) {
144 wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
145 "machine");
146 return -1;
147 }
148 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
149 ie, ielen, NULL, 0);
150 if (res != WPA_IE_OK) {
151 int resp;
152 wpa_printf(MSG_DEBUG, "WPA/RSN information element "
153 "rejected? (res %u)", res);
154 wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
155 if (res == WPA_INVALID_GROUP)
156 resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
157 else if (res == WPA_INVALID_PAIRWISE)
158 resp = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
159 else if (res == WPA_INVALID_AKMP)
160 resp = WLAN_REASON_AKMP_NOT_VALID;
161 #ifdef CONFIG_IEEE80211W
162 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
163 resp = WLAN_REASON_INVALID_IE;
164 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
165 resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
166 #endif /* CONFIG_IEEE80211W */
167 else
168 resp = WLAN_REASON_INVALID_IE;
169 hostapd_drv_sta_disassoc(hapd, sta->addr, resp);
170 ap_free_sta(hapd, sta);
171 return -1;
172 }
173 } else if (hapd->conf->wps_state) {
174 #ifdef CONFIG_WPS
175 struct wpabuf *wps;
176 if (all_ies)
177 wps = ieee802_11_vendor_ie_concat(all_ies, all_ies_len,
178 WPS_IE_VENDOR_TYPE);
179 else
180 wps = NULL;
181 #ifdef CONFIG_WPS_STRICT
182 if (wps && wps_validate_assoc_req(wps) < 0) {
183 hostapd_drv_sta_disassoc(hapd, sta->addr,
184 WLAN_REASON_INVALID_IE);
185 ap_free_sta(hapd, sta);
186 wpabuf_free(wps);
187 return -1;
188 }
189 #endif /* CONFIG_WPS_STRICT */
190 if (wps) {
191 sta->flags |= WLAN_STA_WPS;
192 if (wps_is_20(wps)) {
193 wpa_printf(MSG_DEBUG, "WPS: STA supports "
194 "WPS 2.0");
195 sta->flags |= WLAN_STA_WPS2;
196 }
197 } else
198 sta->flags |= WLAN_STA_MAYBE_WPS;
199 wpabuf_free(wps);
200 #endif /* CONFIG_WPS */
201 }
202 #ifdef CONFIG_WPS
203 skip_wpa_check:
204 #endif /* CONFIG_WPS */
205
206 new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
207 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
208 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
209
210 hostapd_new_assoc_sta(hapd, sta, !new_assoc);
211
212 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
213
214 #ifdef CONFIG_P2P
215 p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
216 all_ies, all_ies_len);
217 #endif /* CONFIG_P2P */
218
219 return 0;
220 }
221
222
223 void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
224 {
225 struct sta_info *sta;
226
227 if (addr == NULL) {
228 /*
229 * This could potentially happen with unexpected event from the
230 * driver wrapper. This was seen at least in one case where the
231 * driver ended up reporting a station mode event while hostapd
232 * was running, so better make sure we stop processing such an
233 * event here.
234 */
235 wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
236 "with no address");
237 return;
238 }
239
240 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
241 HOSTAPD_LEVEL_INFO, "disassociated");
242
243 sta = ap_get_sta(hapd, addr);
244 if (sta == NULL) {
245 wpa_printf(MSG_DEBUG, "Disassociation notification for "
246 "unknown STA " MACSTR, MAC2STR(addr));
247 return;
248 }
249
250 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
251 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
252 MAC2STR(sta->addr));
253 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
254 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
255 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
256 ap_free_sta(hapd, sta);
257 }
258
259
260 void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
261 {
262 struct sta_info *sta = ap_get_sta(hapd, addr);
263
264 if (!sta || !hapd->conf->disassoc_low_ack)
265 return;
266
267 hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
268 HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
269 "missing ACKs");
270 hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
271 if (sta)
272 ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
273 }
274
275
276 int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da,
277 const u8 *bssid, const u8 *ie, size_t ie_len)
278 {
279 size_t i;
280 int ret = 0;
281
282 if (sa == NULL || ie == NULL)
283 return -1;
284
285 random_add_randomness(sa, ETH_ALEN);
286 for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
287 if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
288 sa, da, bssid, ie, ie_len) > 0) {
289 ret = 1;
290 break;
291 }
292 }
293 return ret;
294 }
295
296
297 #ifdef HOSTAPD
298
299 #ifdef NEED_AP_MLME
300
301 static const u8 * get_hdr_bssid(const struct ieee80211_hdr *hdr, size_t len)
302 {
303 u16 fc, type, stype;
304
305 /*
306 * PS-Poll frames are 16 bytes. All other frames are
307 * 24 bytes or longer.
308 */
309 if (len < 16)
310 return NULL;
311
312 fc = le_to_host16(hdr->frame_control);
313 type = WLAN_FC_GET_TYPE(fc);
314 stype = WLAN_FC_GET_STYPE(fc);
315
316 switch (type) {
317 case WLAN_FC_TYPE_DATA:
318 if (len < 24)
319 return NULL;
320 switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
321 case WLAN_FC_FROMDS | WLAN_FC_TODS:
322 case WLAN_FC_TODS:
323 return hdr->addr1;
324 case WLAN_FC_FROMDS:
325 return hdr->addr2;
326 default:
327 return NULL;
328 }
329 case WLAN_FC_TYPE_CTRL:
330 if (stype != WLAN_FC_STYPE_PSPOLL)
331 return NULL;
332 return hdr->addr1;
333 case WLAN_FC_TYPE_MGMT:
334 return hdr->addr3;
335 default:
336 return NULL;
337 }
338 }
339
340
341 #define HAPD_BROADCAST ((struct hostapd_data *) -1)
342
343 static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
344 const u8 *bssid)
345 {
346 size_t i;
347
348 if (bssid == NULL)
349 return NULL;
350 if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
351 bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
352 return HAPD_BROADCAST;
353
354 for (i = 0; i < iface->num_bss; i++) {
355 if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
356 return iface->bss[i];
357 }
358
359 return NULL;
360 }
361
362
363 static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
364 const u8 *frame, size_t len)
365 {
366 const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) frame;
367 u16 fc = le_to_host16(hdr->frame_control);
368 hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
369 if (hapd == NULL || hapd == HAPD_BROADCAST)
370 return;
371
372 ieee802_11_rx_from_unknown(hapd, hdr->addr2,
373 (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
374 (WLAN_FC_TODS | WLAN_FC_FROMDS));
375 }
376
377
378 static void hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
379 {
380 struct hostapd_iface *iface = hapd->iface;
381 const struct ieee80211_hdr *hdr;
382 const u8 *bssid;
383 struct hostapd_frame_info fi;
384
385 hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
386 bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
387 if (bssid == NULL)
388 return;
389
390 hapd = get_hapd_bssid(iface, bssid);
391 if (hapd == NULL) {
392 u16 fc;
393 fc = le_to_host16(hdr->frame_control);
394
395 /*
396 * Drop frames to unknown BSSIDs except for Beacon frames which
397 * could be used to update neighbor information.
398 */
399 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
400 WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
401 hapd = iface->bss[0];
402 else
403 return;
404 }
405
406 os_memset(&fi, 0, sizeof(fi));
407 fi.datarate = rx_mgmt->datarate;
408 fi.ssi_signal = rx_mgmt->ssi_signal;
409
410 if (hapd == HAPD_BROADCAST) {
411 size_t i;
412 for (i = 0; i < iface->num_bss; i++)
413 ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
414 rx_mgmt->frame_len, &fi);
415 } else
416 ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);
417
418 random_add_randomness(&fi, sizeof(fi));
419 }
420
421
422 static void hostapd_rx_action(struct hostapd_data *hapd,
423 struct rx_action *rx_action)
424 {
425 struct rx_mgmt rx_mgmt;
426 u8 *buf;
427 struct ieee80211_hdr *hdr;
428
429 wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
430 " BSSID=" MACSTR " category=%u",
431 MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
432 MAC2STR(rx_action->bssid), rx_action->category);
433 wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
434 rx_action->data, rx_action->len);
435
436 buf = os_zalloc(24 + 1 + rx_action->len);
437 if (buf == NULL)
438 return;
439 hdr = (struct ieee80211_hdr *) buf;
440 hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
441 WLAN_FC_STYPE_ACTION);
442 if (rx_action->category == WLAN_ACTION_SA_QUERY) {
443 /*
444 * Assume frame was protected; it would have been dropped if
445 * not.
446 */
447 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
448 }
449 os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
450 os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
451 os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
452 buf[24] = rx_action->category;
453 os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
454 os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
455 rx_mgmt.frame = buf;
456 rx_mgmt.frame_len = 24 + 1 + rx_action->len;
457 hostapd_mgmt_rx(hapd, &rx_mgmt);
458 os_free(buf);
459 }
460
461
462 static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
463 size_t len, u16 stype, int ok)
464 {
465 struct ieee80211_hdr *hdr;
466 hdr = (struct ieee80211_hdr *) buf;
467 hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
468 if (hapd == NULL || hapd == HAPD_BROADCAST)
469 return;
470 ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
471 }
472
473 #endif /* NEED_AP_MLME */
474
475
476 static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
477 {
478 struct sta_info *sta = ap_get_sta(hapd, addr);
479 if (sta)
480 return 0;
481
482 wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
483 " - adding a new STA", MAC2STR(addr));
484 sta = ap_sta_add(hapd, addr);
485 if (sta) {
486 hostapd_new_assoc_sta(hapd, sta, 0);
487 } else {
488 wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
489 MAC2STR(addr));
490 return -1;
491 }
492
493 return 0;
494 }
495
496
497 static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
498 const u8 *data, size_t data_len)
499 {
500 struct hostapd_iface *iface = hapd->iface;
501 size_t j;
502
503 for (j = 0; j < iface->num_bss; j++) {
504 if (ap_get_sta(iface->bss[j], src)) {
505 hapd = iface->bss[j];
506 break;
507 }
508 }
509
510 ieee802_1x_receive(hapd, src, data, data_len);
511 }
512
513
514 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
515 union wpa_event_data *data)
516 {
517 struct hostapd_data *hapd = ctx;
518
519 switch (event) {
520 case EVENT_MICHAEL_MIC_FAILURE:
521 michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
522 break;
523 case EVENT_SCAN_RESULTS:
524 if (hapd->iface->scan_cb)
525 hapd->iface->scan_cb(hapd->iface);
526 break;
527 #ifdef CONFIG_IEEE80211R
528 case EVENT_FT_RRB_RX:
529 wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
530 data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
531 break;
532 #endif /* CONFIG_IEEE80211R */
533 case EVENT_WPS_BUTTON_PUSHED:
534 hostapd_wps_button_pushed(hapd, NULL);
535 break;
536 #ifdef NEED_AP_MLME
537 case EVENT_TX_STATUS:
538 switch (data->tx_status.type) {
539 case WLAN_FC_TYPE_MGMT:
540 hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
541 data->tx_status.data_len,
542 data->tx_status.stype,
543 data->tx_status.ack);
544 break;
545 case WLAN_FC_TYPE_DATA:
546 hostapd_tx_status(hapd, data->tx_status.dst,
547 data->tx_status.data,
548 data->tx_status.data_len,
549 data->tx_status.ack);
550 break;
551 }
552 break;
553 case EVENT_RX_FROM_UNKNOWN:
554 hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.frame,
555 data->rx_from_unknown.len);
556 break;
557 case EVENT_RX_MGMT:
558 hostapd_mgmt_rx(hapd, &data->rx_mgmt);
559 break;
560 #endif /* NEED_AP_MLME */
561 case EVENT_RX_PROBE_REQ:
562 if (data->rx_probe_req.sa == NULL ||
563 data->rx_probe_req.ie == NULL)
564 break;
565 hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
566 data->rx_probe_req.da,
567 data->rx_probe_req.bssid,
568 data->rx_probe_req.ie,
569 data->rx_probe_req.ie_len);
570 break;
571 case EVENT_NEW_STA:
572 hostapd_event_new_sta(hapd, data->new_sta.addr);
573 break;
574 case EVENT_EAPOL_RX:
575 hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
576 data->eapol_rx.data,
577 data->eapol_rx.data_len);
578 break;
579 case EVENT_ASSOC:
580 hostapd_notif_assoc(hapd, data->assoc_info.addr,
581 data->assoc_info.req_ies,
582 data->assoc_info.req_ies_len,
583 data->assoc_info.reassoc);
584 break;
585 case EVENT_DISASSOC:
586 if (data)
587 hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
588 break;
589 case EVENT_DEAUTH:
590 if (data)
591 hostapd_notif_disassoc(hapd, data->deauth_info.addr);
592 break;
593 case EVENT_STATION_LOW_ACK:
594 if (!data)
595 break;
596 hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
597 break;
598 #ifdef NEED_AP_MLME
599 case EVENT_RX_ACTION:
600 if (data->rx_action.da == NULL || data->rx_action.sa == NULL ||
601 data->rx_action.bssid == NULL)
602 break;
603 hostapd_rx_action(hapd, &data->rx_action);
604 break;
605 #endif /* NEED_AP_MLME */
606 default:
607 wpa_printf(MSG_DEBUG, "Unknown event %d", event);
608 break;
609 }
610 }
611
612 #endif /* HOSTAPD */