]> git.ipfire.org Git - thirdparty/hostap.git/blob - src/ap/ieee802_11.c
projects / thirdparty / hostap.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
hostapd: Add more authentication error case debugging
[thirdparty/hostap.git] / src / ap / ieee802_11.c
1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #ifndef CONFIG_NATIVE_WINDOWS
12
13 #include "utils/common.h"
14 #include "utils/eloop.h"
15 #include "crypto/crypto.h"
16 #include "crypto/sha256.h"
17 #include "crypto/sha384.h"
18 #include "crypto/sha512.h"
19 #include "crypto/random.h"
20 #include "common/ieee802_11_defs.h"
21 #include "common/ieee802_11_common.h"
22 #include "common/wpa_ctrl.h"
23 #include "common/sae.h"
24 #include "radius/radius.h"
25 #include "radius/radius_client.h"
26 #include "p2p/p2p.h"
27 #include "wps/wps.h"
28 #include "fst/fst.h"
29 #include "hostapd.h"
30 #include "beacon.h"
31 #include "ieee802_11_auth.h"
32 #include "sta_info.h"
33 #include "ieee802_1x.h"
34 #include "wpa_auth.h"
35 #include "pmksa_cache_auth.h"
36 #include "wmm.h"
37 #include "ap_list.h"
38 #include "accounting.h"
39 #include "ap_config.h"
40 #include "ap_mlme.h"
41 #include "p2p_hostapd.h"
42 #include "ap_drv_ops.h"
43 #include "wnm_ap.h"
44 #include "hw_features.h"
45 #include "ieee802_11.h"
46 #include "dfs.h"
47 #include "mbo_ap.h"
48 #include "rrm.h"
49 #include "taxonomy.h"
50 #include "fils_hlp.h"
51 #include "dpp_hostapd.h"
52 #include "gas_query_ap.h"
53
54
55 #ifdef CONFIG_FILS
56 static struct wpabuf *
57 prepare_auth_resp_fils(struct hostapd_data *hapd,
58 struct sta_info *sta, u16 *resp,
59 struct rsn_pmksa_cache_entry *pmksa,
60 struct wpabuf *erp_resp,
61 const u8 *msk, size_t msk_len,
62 int *is_pub);
63 #endif /* CONFIG_FILS */
64
65 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
66 {
67 u8 *pos = eid;
68 int i, num, count;
69
70 if (hapd->iface->current_rates == NULL)
71 return eid;
72
73 *pos++ = WLAN_EID_SUPP_RATES;
74 num = hapd->iface->num_rates;
75 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
76 num++;
77 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
78 num++;
79 if (num > 8) {
80 /* rest of the rates are encoded in Extended supported
81 * rates element */
82 num = 8;
83 }
84
85 *pos++ = num;
86 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
87 i++) {
88 count++;
89 *pos = hapd->iface->current_rates[i].rate / 5;
90 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
91 *pos |= 0x80;
92 pos++;
93 }
94
95 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
96 count++;
97 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
98 }
99
100 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
101 count++;
102 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
103 }
104
105 return pos;
106 }
107
108
109 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
110 {
111 u8 *pos = eid;
112 int i, num, count;
113
114 if (hapd->iface->current_rates == NULL)
115 return eid;
116
117 num = hapd->iface->num_rates;
118 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
119 num++;
120 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
121 num++;
122 if (num <= 8)
123 return eid;
124 num -= 8;
125
126 *pos++ = WLAN_EID_EXT_SUPP_RATES;
127 *pos++ = num;
128 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
129 i++) {
130 count++;
131 if (count <= 8)
132 continue; /* already in SuppRates IE */
133 *pos = hapd->iface->current_rates[i].rate / 5;
134 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
135 *pos |= 0x80;
136 pos++;
137 }
138
139 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
140 count++;
141 if (count > 8)
142 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
143 }
144
145 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
146 count++;
147 if (count > 8)
148 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
149 }
150
151 return pos;
152 }
153
154
155 u16 hostapd_own_capab_info(struct hostapd_data *hapd)
156 {
157 int capab = WLAN_CAPABILITY_ESS;
158 int privacy;
159 int dfs;
160 int i;
161
162 /* Check if any of configured channels require DFS */
163 dfs = hostapd_is_dfs_required(hapd->iface);
164 if (dfs < 0) {
165 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
166 dfs);
167 dfs = 0;
168 }
169
170 if (hapd->iface->num_sta_no_short_preamble == 0 &&
171 hapd->iconf->preamble == SHORT_PREAMBLE)
172 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
173
174 privacy = hapd->conf->ssid.wep.keys_set;
175
176 if (hapd->conf->ieee802_1x &&
177 (hapd->conf->default_wep_key_len ||
178 hapd->conf->individual_wep_key_len))
179 privacy = 1;
180
181 if (hapd->conf->wpa)
182 privacy = 1;
183
184 #ifdef CONFIG_HS20
185 if (hapd->conf->osen)
186 privacy = 1;
187 #endif /* CONFIG_HS20 */
188
189 if (privacy)
190 capab |= WLAN_CAPABILITY_PRIVACY;
191
192 if (hapd->iface->current_mode &&
193 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
194 hapd->iface->num_sta_no_short_slot_time == 0)
195 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
196
197 /*
198 * Currently, Spectrum Management capability bit is set when directly
199 * requested in configuration by spectrum_mgmt_required or when AP is
200 * running on DFS channel.
201 * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
202 */
203 if (hapd->iface->current_mode &&
204 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
205 (hapd->iconf->spectrum_mgmt_required || dfs))
206 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
207
208 for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
209 if (hapd->conf->radio_measurements[i]) {
210 capab |= IEEE80211_CAP_RRM;
211 break;
212 }
213 }
214
215 return capab;
216 }
217
218
219 #ifndef CONFIG_NO_RC4
220 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
221 u16 auth_transaction, const u8 *challenge,
222 int iswep)
223 {
224 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
225 HOSTAPD_LEVEL_DEBUG,
226 "authentication (shared key, transaction %d)",
227 auth_transaction);
228
229 if (auth_transaction == 1) {
230 if (!sta->challenge) {
231 /* Generate a pseudo-random challenge */
232 u8 key[8];
233
234 sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
235 if (sta->challenge == NULL)
236 return WLAN_STATUS_UNSPECIFIED_FAILURE;
237
238 if (os_get_random(key, sizeof(key)) < 0) {
239 os_free(sta->challenge);
240 sta->challenge = NULL;
241 return WLAN_STATUS_UNSPECIFIED_FAILURE;
242 }
243
244 rc4_skip(key, sizeof(key), 0,
245 sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
246 }
247 return 0;
248 }
249
250 if (auth_transaction != 3)
251 return WLAN_STATUS_UNSPECIFIED_FAILURE;
252
253 /* Transaction 3 */
254 if (!iswep || !sta->challenge || !challenge ||
255 os_memcmp_const(sta->challenge, challenge,
256 WLAN_AUTH_CHALLENGE_LEN)) {
257 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
258 HOSTAPD_LEVEL_INFO,
259 "shared key authentication - invalid "
260 "challenge-response");
261 return WLAN_STATUS_CHALLENGE_FAIL;
262 }
263
264 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
265 HOSTAPD_LEVEL_DEBUG,
266 "authentication OK (shared key)");
267 sta->flags |= WLAN_STA_AUTH;
268 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
269 os_free(sta->challenge);
270 sta->challenge = NULL;
271
272 return 0;
273 }
274 #endif /* CONFIG_NO_RC4 */
275
276
277 static int send_auth_reply(struct hostapd_data *hapd,
278 const u8 *dst, const u8 *bssid,
279 u16 auth_alg, u16 auth_transaction, u16 resp,
280 const u8 *ies, size_t ies_len, const char *dbg)
281 {
282 struct ieee80211_mgmt *reply;
283 u8 *buf;
284 size_t rlen;
285 int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
286
287 rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
288 buf = os_zalloc(rlen);
289 if (buf == NULL)
290 return -1;
291
292 reply = (struct ieee80211_mgmt *) buf;
293 reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
294 WLAN_FC_STYPE_AUTH);
295 os_memcpy(reply->da, dst, ETH_ALEN);
296 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
297 os_memcpy(reply->bssid, bssid, ETH_ALEN);
298
299 reply->u.auth.auth_alg = host_to_le16(auth_alg);
300 reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
301 reply->u.auth.status_code = host_to_le16(resp);
302
303 if (ies && ies_len)
304 os_memcpy(reply->u.auth.variable, ies, ies_len);
305
306 wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
307 " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu) (dbg=%s)",
308 MAC2STR(dst), auth_alg, auth_transaction,
309 resp, (unsigned long) ies_len, dbg);
310 if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
311 wpa_printf(MSG_INFO, "send_auth_reply: send failed");
312 else
313 reply_res = WLAN_STATUS_SUCCESS;
314
315 os_free(buf);
316
317 return reply_res;
318 }
319
320
321 #ifdef CONFIG_IEEE80211R_AP
322 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
323 u16 auth_transaction, u16 status,
324 const u8 *ies, size_t ies_len)
325 {
326 struct hostapd_data *hapd = ctx;
327 struct sta_info *sta;
328 int reply_res;
329
330 reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT,
331 auth_transaction, status, ies, ies_len,
332 "auth-ft-finish");
333
334 sta = ap_get_sta(hapd, dst);
335 if (sta == NULL)
336 return;
337
338 if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
339 status != WLAN_STATUS_SUCCESS)) {
340 hostapd_drv_sta_remove(hapd, sta->addr);
341 sta->added_unassoc = 0;
342 return;
343 }
344
345 if (status != WLAN_STATUS_SUCCESS)
346 return;
347
348 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
349 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
350 sta->flags |= WLAN_STA_AUTH;
351 mlme_authenticate_indication(hapd, sta);
352 }
353 #endif /* CONFIG_IEEE80211R_AP */
354
355
356 #ifdef CONFIG_SAE
357
358 static void sae_set_state(struct sta_info *sta, enum sae_state state,
359 const char *reason)
360 {
361 wpa_printf(MSG_DEBUG, "SAE: State %s -> %s for peer " MACSTR " (%s)",
362 sae_state_txt(sta->sae->state), sae_state_txt(state),
363 MAC2STR(sta->addr), reason);
364 sta->sae->state = state;
365 }
366
367
368 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
369 struct sta_info *sta, int update)
370 {
371 struct wpabuf *buf;
372 const char *password;
373
374 password = hapd->conf->sae_password;
375 if (!password)
376 password = hapd->conf->ssid.wpa_passphrase;
377 if (!password) {
378 wpa_printf(MSG_DEBUG, "SAE: No password available");
379 return NULL;
380 }
381
382 if (update &&
383 sae_prepare_commit(hapd->own_addr, sta->addr,
384 (u8 *) password, os_strlen(password),
385 sta->sae) < 0) {
386 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
387 return NULL;
388 }
389
390 buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN);
391 if (buf == NULL)
392 return NULL;
393 sae_write_commit(sta->sae, buf, sta->sae->tmp ?
394 sta->sae->tmp->anti_clogging_token : NULL);
395
396 return buf;
397 }
398
399
400 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
401 struct sta_info *sta)
402 {
403 struct wpabuf *buf;
404
405 buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
406 if (buf == NULL)
407 return NULL;
408
409 sae_write_confirm(sta->sae, buf);
410
411 return buf;
412 }
413
414
415 static int auth_sae_send_commit(struct hostapd_data *hapd,
416 struct sta_info *sta,
417 const u8 *bssid, int update)
418 {
419 struct wpabuf *data;
420 int reply_res;
421
422 data = auth_build_sae_commit(hapd, sta, update);
423 if (data == NULL)
424 return WLAN_STATUS_UNSPECIFIED_FAILURE;
425
426 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1,
427 WLAN_STATUS_SUCCESS, wpabuf_head(data),
428 wpabuf_len(data), "sae-send-commit");
429
430 wpabuf_free(data);
431
432 return reply_res;
433 }
434
435
436 static int auth_sae_send_confirm(struct hostapd_data *hapd,
437 struct sta_info *sta,
438 const u8 *bssid)
439 {
440 struct wpabuf *data;
441 int reply_res;
442
443 data = auth_build_sae_confirm(hapd, sta);
444 if (data == NULL)
445 return WLAN_STATUS_UNSPECIFIED_FAILURE;
446
447 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2,
448 WLAN_STATUS_SUCCESS, wpabuf_head(data),
449 wpabuf_len(data), "sae-send-confirm");
450
451 wpabuf_free(data);
452
453 return reply_res;
454 }
455
456
457 static int use_sae_anti_clogging(struct hostapd_data *hapd)
458 {
459 struct sta_info *sta;
460 unsigned int open = 0;
461
462 if (hapd->conf->sae_anti_clogging_threshold == 0)
463 return 1;
464
465 for (sta = hapd->sta_list; sta; sta = sta->next) {
466 if (!sta->sae)
467 continue;
468 if (sta->sae->state != SAE_COMMITTED &&
469 sta->sae->state != SAE_CONFIRMED)
470 continue;
471 open++;
472 if (open >= hapd->conf->sae_anti_clogging_threshold)
473 return 1;
474 }
475
476 return 0;
477 }
478
479
480 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
481 const u8 *token, size_t token_len)
482 {
483 u8 mac[SHA256_MAC_LEN];
484
485 if (token_len != SHA256_MAC_LEN)
486 return -1;
487 if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
488 addr, ETH_ALEN, mac) < 0 ||
489 os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0)
490 return -1;
491
492 return 0;
493 }
494
495
496 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
497 int group, const u8 *addr)
498 {
499 struct wpabuf *buf;
500 u8 *token;
501 struct os_reltime now;
502
503 os_get_reltime(&now);
504 if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
505 os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
506 if (random_get_bytes(hapd->sae_token_key,
507 sizeof(hapd->sae_token_key)) < 0)
508 return NULL;
509 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
510 hapd->sae_token_key, sizeof(hapd->sae_token_key));
511 hapd->last_sae_token_key_update = now;
512 }
513
514 buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
515 if (buf == NULL)
516 return NULL;
517
518 wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
519
520 token = wpabuf_put(buf, SHA256_MAC_LEN);
521 hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
522 addr, ETH_ALEN, token);
523
524 return buf;
525 }
526
527
528 static int sae_check_big_sync(struct hostapd_data *hapd, struct sta_info *sta)
529 {
530 if (sta->sae->sync > hapd->conf->sae_sync) {
531 sae_set_state(sta, SAE_NOTHING, "Sync > dot11RSNASAESync");
532 sta->sae->sync = 0;
533 return -1;
534 }
535 return 0;
536 }
537
538
539 static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
540 {
541 struct hostapd_data *hapd = eloop_ctx;
542 struct sta_info *sta = eloop_data;
543 int ret;
544
545 if (sae_check_big_sync(hapd, sta))
546 return;
547 sta->sae->sync++;
548 wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
549 " (sync=%d state=%s)",
550 MAC2STR(sta->addr), sta->sae->sync,
551 sae_state_txt(sta->sae->state));
552
553 switch (sta->sae->state) {
554 case SAE_COMMITTED:
555 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
556 eloop_register_timeout(0,
557 hapd->dot11RSNASAERetransPeriod * 1000,
558 auth_sae_retransmit_timer, hapd, sta);
559 break;
560 case SAE_CONFIRMED:
561 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
562 eloop_register_timeout(0,
563 hapd->dot11RSNASAERetransPeriod * 1000,
564 auth_sae_retransmit_timer, hapd, sta);
565 break;
566 default:
567 ret = -1;
568 break;
569 }
570
571 if (ret != WLAN_STATUS_SUCCESS)
572 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
573 }
574
575
576 void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
577 {
578 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
579 }
580
581
582 static void sae_set_retransmit_timer(struct hostapd_data *hapd,
583 struct sta_info *sta)
584 {
585 if (!(hapd->conf->mesh & MESH_ENABLED))
586 return;
587
588 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
589 eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
590 auth_sae_retransmit_timer, hapd, sta);
591 }
592
593
594 void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
595 {
596 sta->flags |= WLAN_STA_AUTH;
597 sta->auth_alg = WLAN_AUTH_SAE;
598 mlme_authenticate_indication(hapd, sta);
599 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
600 sae_set_state(sta, SAE_ACCEPTED, "Accept Confirm");
601 wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
602 sta->sae->pmk, sta->sae->pmkid);
603 }
604
605
606 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
607 const u8 *bssid, u8 auth_transaction)
608 {
609 int ret;
610
611 if (auth_transaction != 1 && auth_transaction != 2)
612 return WLAN_STATUS_UNSPECIFIED_FAILURE;
613
614 wpa_printf(MSG_DEBUG, "SAE: Peer " MACSTR " state=%s auth_trans=%u",
615 MAC2STR(sta->addr), sae_state_txt(sta->sae->state),
616 auth_transaction);
617 switch (sta->sae->state) {
618 case SAE_NOTHING:
619 if (auth_transaction == 1) {
620 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
621 if (ret)
622 return ret;
623 sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
624
625 if (sae_process_commit(sta->sae) < 0)
626 return WLAN_STATUS_UNSPECIFIED_FAILURE;
627
628 /*
629 * In mesh case, both Commit and Confirm can be sent
630 * immediately. In infrastructure BSS, only a single
631 * Authentication frame (Commit) is expected from the AP
632 * here and the second one (Confirm) will be sent once
633 * the STA has sent its second Authentication frame
634 * (Confirm).
635 */
636 if (hapd->conf->mesh & MESH_ENABLED) {
637 /*
638 * Send both Commit and Confirm immediately
639 * based on SAE finite state machine
640 * Nothing -> Confirm transition.
641 */
642 ret = auth_sae_send_confirm(hapd, sta, bssid);
643 if (ret)
644 return ret;
645 sae_set_state(sta, SAE_CONFIRMED,
646 "Sent Confirm (mesh)");
647 } else {
648 /*
649 * For infrastructure BSS, send only the Commit
650 * message now to get alternating sequence of
651 * Authentication frames between the AP and STA.
652 * Confirm will be sent in
653 * Committed -> Confirmed/Accepted transition
654 * when receiving Confirm from STA.
655 */
656 }
657 sta->sae->sync = 0;
658 sae_set_retransmit_timer(hapd, sta);
659 } else {
660 hostapd_logger(hapd, sta->addr,
661 HOSTAPD_MODULE_IEEE80211,
662 HOSTAPD_LEVEL_DEBUG,
663 "SAE confirm before commit");
664 }
665 break;
666 case SAE_COMMITTED:
667 sae_clear_retransmit_timer(hapd, sta);
668 if (auth_transaction == 1) {
669 if (sae_process_commit(sta->sae) < 0)
670 return WLAN_STATUS_UNSPECIFIED_FAILURE;
671
672 ret = auth_sae_send_confirm(hapd, sta, bssid);
673 if (ret)
674 return ret;
675 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
676 sta->sae->sync = 0;
677 sae_set_retransmit_timer(hapd, sta);
678 } else if (hapd->conf->mesh & MESH_ENABLED) {
679 /*
680 * In mesh case, follow SAE finite state machine and
681 * send Commit now, if sync count allows.
682 */
683 if (sae_check_big_sync(hapd, sta))
684 return WLAN_STATUS_SUCCESS;
685 sta->sae->sync++;
686
687 ret = auth_sae_send_commit(hapd, sta, bssid, 0);
688 if (ret)
689 return ret;
690
691 sae_set_retransmit_timer(hapd, sta);
692 } else {
693 /*
694 * For instructure BSS, send the postponed Confirm from
695 * Nothing -> Confirmed transition that was reduced to
696 * Nothing -> Committed above.
697 */
698 ret = auth_sae_send_confirm(hapd, sta, bssid);
699 if (ret)
700 return ret;
701
702 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
703
704 /*
705 * Since this was triggered on Confirm RX, run another
706 * step to get to Accepted without waiting for
707 * additional events.
708 */
709 return sae_sm_step(hapd, sta, bssid, auth_transaction);
710 }
711 break;
712 case SAE_CONFIRMED:
713 sae_clear_retransmit_timer(hapd, sta);
714 if (auth_transaction == 1) {
715 if (sae_check_big_sync(hapd, sta))
716 return WLAN_STATUS_SUCCESS;
717 sta->sae->sync++;
718
719 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
720 if (ret)
721 return ret;
722
723 if (sae_process_commit(sta->sae) < 0)
724 return WLAN_STATUS_UNSPECIFIED_FAILURE;
725
726 ret = auth_sae_send_confirm(hapd, sta, bssid);
727 if (ret)
728 return ret;
729
730 sae_set_retransmit_timer(hapd, sta);
731 } else {
732 sta->sae->send_confirm = 0xffff;
733 sae_accept_sta(hapd, sta);
734 }
735 break;
736 case SAE_ACCEPTED:
737 if (auth_transaction == 1) {
738 wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
739 ") doing reauthentication",
740 MAC2STR(sta->addr));
741 ap_free_sta(hapd, sta);
742 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
743 } else {
744 if (sae_check_big_sync(hapd, sta))
745 return WLAN_STATUS_SUCCESS;
746 sta->sae->sync++;
747
748 ret = auth_sae_send_confirm(hapd, sta, bssid);
749 sae_clear_temp_data(sta->sae);
750 if (ret)
751 return ret;
752 }
753 break;
754 default:
755 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
756 sta->sae->state);
757 return WLAN_STATUS_UNSPECIFIED_FAILURE;
758 }
759 return WLAN_STATUS_SUCCESS;
760 }
761
762
763 static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
764 {
765 struct sae_data *sae = sta->sae;
766 int i, *groups = hapd->conf->sae_groups;
767
768 if (sae->state != SAE_COMMITTED)
769 return;
770
771 wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
772
773 for (i = 0; groups && groups[i] > 0; i++) {
774 if (sae->group == groups[i])
775 break;
776 }
777
778 if (!groups || groups[i] <= 0) {
779 wpa_printf(MSG_DEBUG,
780 "SAE: Previously selected group not found from the current configuration");
781 return;
782 }
783
784 for (;;) {
785 i++;
786 if (groups[i] <= 0) {
787 wpa_printf(MSG_DEBUG,
788 "SAE: No alternative group enabled");
789 return;
790 }
791
792 if (sae_set_group(sae, groups[i]) < 0)
793 continue;
794
795 break;
796 }
797 wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
798 }
799
800
801 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
802 const struct ieee80211_mgmt *mgmt, size_t len,
803 u16 auth_transaction, u16 status_code)
804 {
805 int resp = WLAN_STATUS_SUCCESS;
806 struct wpabuf *data = NULL;
807
808 #ifdef CONFIG_TESTING_OPTIONS
809 if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
810 const u8 *pos, *end;
811
812 wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
813 pos = mgmt->u.auth.variable;
814 end = ((const u8 *) mgmt) + len;
815 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
816 auth_transaction, resp, pos, end - pos,
817 "auth-sae-reflection-attack");
818 goto remove_sta;
819 }
820
821 if (hapd->conf->sae_commit_override && auth_transaction == 1) {
822 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
823 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
824 auth_transaction, resp,
825 wpabuf_head(hapd->conf->sae_commit_override),
826 wpabuf_len(hapd->conf->sae_commit_override),
827 "sae-commit-override");
828 goto remove_sta;
829 }
830 #endif /* CONFIG_TESTING_OPTIONS */
831 if (!sta->sae) {
832 if (auth_transaction != 1 ||
833 status_code != WLAN_STATUS_SUCCESS) {
834 resp = -1;
835 goto remove_sta;
836 }
837 sta->sae = os_zalloc(sizeof(*sta->sae));
838 if (!sta->sae) {
839 resp = -1;
840 goto remove_sta;
841 }
842 sae_set_state(sta, SAE_NOTHING, "Init");
843 sta->sae->sync = 0;
844 }
845
846 if (sta->mesh_sae_pmksa_caching) {
847 wpa_printf(MSG_DEBUG,
848 "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
849 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
850 sta->mesh_sae_pmksa_caching = 0;
851 }
852
853 if (auth_transaction == 1) {
854 const u8 *token = NULL, *pos, *end;
855 size_t token_len = 0;
856 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
857 HOSTAPD_LEVEL_DEBUG,
858 "start SAE authentication (RX commit, status=%u)",
859 status_code);
860
861 if ((hapd->conf->mesh & MESH_ENABLED) &&
862 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
863 sta->sae->tmp) {
864 pos = mgmt->u.auth.variable;
865 end = ((const u8 *) mgmt) + len;
866 if (pos + sizeof(le16) > end) {
867 wpa_printf(MSG_ERROR,
868 "SAE: Too short anti-clogging token request");
869 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
870 goto reply;
871 }
872 resp = sae_group_allowed(sta->sae,
873 hapd->conf->sae_groups,
874 WPA_GET_LE16(pos));
875 if (resp != WLAN_STATUS_SUCCESS) {
876 wpa_printf(MSG_ERROR,
877 "SAE: Invalid group in anti-clogging token request");
878 goto reply;
879 }
880 pos += sizeof(le16);
881
882 wpabuf_free(sta->sae->tmp->anti_clogging_token);
883 sta->sae->tmp->anti_clogging_token =
884 wpabuf_alloc_copy(pos, end - pos);
885 if (sta->sae->tmp->anti_clogging_token == NULL) {
886 wpa_printf(MSG_ERROR,
887 "SAE: Failed to alloc for anti-clogging token");
888 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
889 goto remove_sta;
890 }
891
892 /*
893 * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
894 * is 76, a new Commit Message shall be constructed
895 * with the Anti-Clogging Token from the received
896 * Authentication frame, and the commit-scalar and
897 * COMMIT-ELEMENT previously sent.
898 */
899 resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0);
900 if (resp != WLAN_STATUS_SUCCESS) {
901 wpa_printf(MSG_ERROR,
902 "SAE: Failed to send commit message");
903 goto remove_sta;
904 }
905 sae_set_state(sta, SAE_COMMITTED,
906 "Sent Commit (anti-clogging token case in mesh)");
907 sta->sae->sync = 0;
908 sae_set_retransmit_timer(hapd, sta);
909 return;
910 }
911
912 if ((hapd->conf->mesh & MESH_ENABLED) &&
913 status_code ==
914 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
915 sta->sae->tmp) {
916 wpa_printf(MSG_DEBUG,
917 "SAE: Peer did not accept our SAE group");
918 sae_pick_next_group(hapd, sta);
919 goto remove_sta;
920 }
921
922 if (status_code != WLAN_STATUS_SUCCESS)
923 goto remove_sta;
924
925 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
926 ((const u8 *) mgmt) + len -
927 mgmt->u.auth.variable, &token,
928 &token_len, hapd->conf->sae_groups);
929 if (resp == SAE_SILENTLY_DISCARD) {
930 wpa_printf(MSG_DEBUG,
931 "SAE: Drop commit message from " MACSTR " due to reflection attack",
932 MAC2STR(sta->addr));
933 goto remove_sta;
934 }
935 if (token && check_sae_token(hapd, sta->addr, token, token_len)
936 < 0) {
937 wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
938 "incorrect token from " MACSTR,
939 MAC2STR(sta->addr));
940 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
941 goto remove_sta;
942 }
943
944 if (resp != WLAN_STATUS_SUCCESS)
945 goto reply;
946
947 if (!token && use_sae_anti_clogging(hapd)) {
948 wpa_printf(MSG_DEBUG,
949 "SAE: Request anti-clogging token from "
950 MACSTR, MAC2STR(sta->addr));
951 data = auth_build_token_req(hapd, sta->sae->group,
952 sta->addr);
953 resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
954 if (hapd->conf->mesh & MESH_ENABLED)
955 sae_set_state(sta, SAE_NOTHING,
956 "Request anti-clogging token case in mesh");
957 goto reply;
958 }
959
960 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
961 } else if (auth_transaction == 2) {
962 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
963 HOSTAPD_LEVEL_DEBUG,
964 "SAE authentication (RX confirm, status=%u)",
965 status_code);
966 if (status_code != WLAN_STATUS_SUCCESS)
967 goto remove_sta;
968 if (sta->sae->state >= SAE_CONFIRMED ||
969 !(hapd->conf->mesh & MESH_ENABLED)) {
970 const u8 *var;
971 size_t var_len;
972 u16 peer_send_confirm;
973
974 var = mgmt->u.auth.variable;
975 var_len = ((u8 *) mgmt) + len - mgmt->u.auth.variable;
976 if (var_len < 2) {
977 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
978 goto reply;
979 }
980
981 peer_send_confirm = WPA_GET_LE16(var);
982
983 if (sta->sae->state == SAE_ACCEPTED &&
984 (peer_send_confirm <= sta->sae->rc ||
985 peer_send_confirm == 0xffff)) {
986 wpa_printf(MSG_DEBUG,
987 "SAE: Silently ignore unexpected Confirm from peer "
988 MACSTR
989 " (peer-send-confirm=%u Rc=%u)",
990 MAC2STR(sta->addr),
991 peer_send_confirm, sta->sae->rc);
992 return;
993 }
994
995 if (sae_check_confirm(sta->sae, var, var_len) < 0) {
996 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
997 goto reply;
998 }
999 sta->sae->rc = peer_send_confirm;
1000 }
1001 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
1002 } else {
1003 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1004 HOSTAPD_LEVEL_DEBUG,
1005 "unexpected SAE authentication transaction %u (status=%u)",
1006 auth_transaction, status_code);
1007 if (status_code != WLAN_STATUS_SUCCESS)
1008 goto remove_sta;
1009 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1010 }
1011
1012 reply:
1013 if (resp != WLAN_STATUS_SUCCESS) {
1014 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
1015 auth_transaction, resp,
1016 data ? wpabuf_head(data) : (u8 *) "",
1017 data ? wpabuf_len(data) : 0, "auth-sae");
1018 }
1019
1020 remove_sta:
1021 if (sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
1022 status_code != WLAN_STATUS_SUCCESS)) {
1023 hostapd_drv_sta_remove(hapd, sta->addr);
1024 sta->added_unassoc = 0;
1025 }
1026 wpabuf_free(data);
1027 }
1028
1029
1030 /**
1031 * auth_sae_init_committed - Send COMMIT and start SAE in committed state
1032 * @hapd: BSS data for the device initiating the authentication
1033 * @sta: the peer to which commit authentication frame is sent
1034 *
1035 * This function implements Init event handling (IEEE Std 802.11-2012,
1036 * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
1037 * sta->sae structure should be initialized appropriately via a call to
1038 * sae_prepare_commit().
1039 */
1040 int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
1041 {
1042 int ret;
1043
1044 if (!sta->sae || !sta->sae->tmp)
1045 return -1;
1046
1047 if (sta->sae->state != SAE_NOTHING)
1048 return -1;
1049
1050 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
1051 if (ret)
1052 return -1;
1053
1054 sae_set_state(sta, SAE_COMMITTED, "Init and sent commit");
1055 sta->sae->sync = 0;
1056 sae_set_retransmit_timer(hapd, sta);
1057
1058 return 0;
1059 }
1060
1061 #endif /* CONFIG_SAE */
1062
1063
1064 static u16 wpa_res_to_status_code(int res)
1065 {
1066 if (res == WPA_INVALID_GROUP)
1067 return WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1068 if (res == WPA_INVALID_PAIRWISE)
1069 return WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1070 if (res == WPA_INVALID_AKMP)
1071 return WLAN_STATUS_AKMP_NOT_VALID;
1072 if (res == WPA_ALLOC_FAIL)
1073 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1074 #ifdef CONFIG_IEEE80211W
1075 if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1076 return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1077 if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1078 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1079 #endif /* CONFIG_IEEE80211W */
1080 if (res == WPA_INVALID_MDIE)
1081 return WLAN_STATUS_INVALID_MDIE;
1082 if (res == WPA_INVALID_PMKID)
1083 return WLAN_STATUS_INVALID_PMKID;
1084 if (res != WPA_IE_OK)
1085 return WLAN_STATUS_INVALID_IE;
1086 return WLAN_STATUS_SUCCESS;
1087 }
1088
1089
1090 #ifdef CONFIG_FILS
1091
1092 static void handle_auth_fils_finish(struct hostapd_data *hapd,
1093 struct sta_info *sta, u16 resp,
1094 struct wpabuf *data, int pub);
1095
1096 void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta,
1097 const u8 *pos, size_t len, u16 auth_alg,
1098 u16 auth_transaction, u16 status_code,
1099 void (*cb)(struct hostapd_data *hapd,
1100 struct sta_info *sta, u16 resp,
1101 struct wpabuf *data, int pub))
1102 {
1103 u16 resp = WLAN_STATUS_SUCCESS;
1104 const u8 *end;
1105 struct ieee802_11_elems elems;
1106 int res;
1107 struct wpa_ie_data rsn;
1108 struct rsn_pmksa_cache_entry *pmksa = NULL;
1109
1110 if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS)
1111 return;
1112
1113 end = pos + len;
1114
1115 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
1116 pos, end - pos);
1117
1118 /* TODO: FILS PK */
1119 #ifdef CONFIG_FILS_SK_PFS
1120 if (auth_alg == WLAN_AUTH_FILS_SK_PFS) {
1121 u16 group;
1122 struct wpabuf *pub;
1123 size_t elem_len;
1124
1125 /* Using FILS PFS */
1126
1127 /* Finite Cyclic Group */
1128 if (end - pos < 2) {
1129 wpa_printf(MSG_DEBUG,
1130 "FILS: No room for Finite Cyclic Group");
1131 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1132 goto fail;
1133 }
1134 group = WPA_GET_LE16(pos);
1135 pos += 2;
1136 if (group != hapd->conf->fils_dh_group) {
1137 wpa_printf(MSG_DEBUG,
1138 "FILS: Unsupported Finite Cyclic Group: %u (expected %u)",
1139 group, hapd->conf->fils_dh_group);
1140 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1141 goto fail;
1142 }
1143
1144 crypto_ecdh_deinit(sta->fils_ecdh);
1145 sta->fils_ecdh = crypto_ecdh_init(group);
1146 if (!sta->fils_ecdh) {
1147 wpa_printf(MSG_INFO,
1148 "FILS: Could not initialize ECDH with group %d",
1149 group);
1150 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1151 goto fail;
1152 }
1153
1154 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1155 if (!pub) {
1156 wpa_printf(MSG_DEBUG,
1157 "FILS: Failed to derive ECDH public key");
1158 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1159 goto fail;
1160 }
1161 elem_len = wpabuf_len(pub);
1162 wpabuf_free(pub);
1163
1164 /* Element */
1165 if ((size_t) (end - pos) < elem_len) {
1166 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
1167 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1168 goto fail;
1169 }
1170
1171 wpabuf_free(sta->fils_g_sta);
1172 sta->fils_g_sta = wpabuf_alloc_copy(pos, elem_len);
1173 wpabuf_clear_free(sta->fils_dh_ss);
1174 sta->fils_dh_ss = crypto_ecdh_set_peerkey(sta->fils_ecdh, 1,
1175 pos, elem_len);
1176 if (!sta->fils_dh_ss) {
1177 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
1178 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1179 goto fail;
1180 }
1181 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", sta->fils_dh_ss);
1182 pos += elem_len;
1183 } else {
1184 crypto_ecdh_deinit(sta->fils_ecdh);
1185 sta->fils_ecdh = NULL;
1186 wpabuf_clear_free(sta->fils_dh_ss);
1187 sta->fils_dh_ss = NULL;
1188 }
1189 #endif /* CONFIG_FILS_SK_PFS */
1190
1191 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
1192 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
1193 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
1194 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1195 goto fail;
1196 }
1197
1198 /* RSNE */
1199 wpa_hexdump(MSG_DEBUG, "FILS: RSN element",
1200 elems.rsn_ie, elems.rsn_ie_len);
1201 if (!elems.rsn_ie ||
1202 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
1203 &rsn) < 0) {
1204 wpa_printf(MSG_DEBUG, "FILS: No valid RSN element");
1205 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1206 goto fail;
1207 }
1208
1209 if (!sta->wpa_sm)
1210 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr,
1211 NULL);
1212 if (!sta->wpa_sm) {
1213 wpa_printf(MSG_DEBUG,
1214 "FILS: Failed to initialize RSN state machine");
1215 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1216 goto fail;
1217 }
1218
1219 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1220 elems.rsn_ie - 2, elems.rsn_ie_len + 2,
1221 elems.mdie, elems.mdie_len, NULL, 0);
1222 resp = wpa_res_to_status_code(res);
1223 if (resp != WLAN_STATUS_SUCCESS)
1224 goto fail;
1225
1226 if (!elems.fils_nonce) {
1227 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
1228 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1229 goto fail;
1230 }
1231 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", elems.fils_nonce,
1232 FILS_NONCE_LEN);
1233 os_memcpy(sta->fils_snonce, elems.fils_nonce, FILS_NONCE_LEN);
1234
1235 /* PMKID List */
1236 if (rsn.pmkid && rsn.num_pmkid > 0) {
1237 u8 num;
1238 const u8 *pmkid;
1239
1240 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
1241 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
1242
1243 pmkid = rsn.pmkid;
1244 num = rsn.num_pmkid;
1245 while (num) {
1246 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
1247 pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr,
1248 pmkid);
1249 if (pmksa)
1250 break;
1251 pmksa = wpa_auth_pmksa_get_fils_cache_id(hapd->wpa_auth,
1252 sta->addr,
1253 pmkid);
1254 if (pmksa)
1255 break;
1256 pmkid += PMKID_LEN;
1257 num--;
1258 }
1259 }
1260 if (pmksa && wpa_auth_sta_key_mgmt(sta->wpa_sm) != pmksa->akmp) {
1261 wpa_printf(MSG_DEBUG,
1262 "FILS: Matching PMKSA cache entry has different AKMP (0x%x != 0x%x) - ignore",
1263 wpa_auth_sta_key_mgmt(sta->wpa_sm), pmksa->akmp);
1264 pmksa = NULL;
1265 }
1266 if (pmksa)
1267 wpa_printf(MSG_DEBUG, "FILS: Found matching PMKSA cache entry");
1268
1269 /* FILS Session */
1270 if (!elems.fils_session) {
1271 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
1272 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1273 goto fail;
1274 }
1275 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
1276 FILS_SESSION_LEN);
1277 os_memcpy(sta->fils_session, elems.fils_session, FILS_SESSION_LEN);
1278
1279 /* FILS Wrapped Data */
1280 if (elems.fils_wrapped_data) {
1281 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
1282 elems.fils_wrapped_data,
1283 elems.fils_wrapped_data_len);
1284 if (!pmksa) {
1285 #ifndef CONFIG_NO_RADIUS
1286 if (!sta->eapol_sm) {
1287 sta->eapol_sm =
1288 ieee802_1x_alloc_eapol_sm(hapd, sta);
1289 }
1290 wpa_printf(MSG_DEBUG,
1291 "FILS: Forward EAP-Initiate/Re-auth to authentication server");
1292 ieee802_1x_encapsulate_radius(
1293 hapd, sta, elems.fils_wrapped_data,
1294 elems.fils_wrapped_data_len);
1295 sta->fils_pending_cb = cb;
1296 wpa_printf(MSG_DEBUG,
1297 "FILS: Will send Authentication frame once the response from authentication server is available");
1298 sta->flags |= WLAN_STA_PENDING_FILS_ERP;
1299 /* Calculate pending PMKID here so that we do not need
1300 * to maintain a copy of the EAP-Initiate/Reauth
1301 * message. */
1302 if (fils_pmkid_erp(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1303 elems.fils_wrapped_data,
1304 elems.fils_wrapped_data_len,
1305 sta->fils_erp_pmkid) == 0)
1306 sta->fils_erp_pmkid_set = 1;
1307 return;
1308 #else /* CONFIG_NO_RADIUS */
1309 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1310 goto fail;
1311 #endif /* CONFIG_NO_RADIUS */
1312 }
1313 }
1314
1315 fail:
1316 if (cb) {
1317 struct wpabuf *data;
1318 int pub = 0;
1319
1320 data = prepare_auth_resp_fils(hapd, sta, &resp, pmksa, NULL,
1321 NULL, 0, &pub);
1322 if (!data) {
1323 wpa_printf(MSG_DEBUG,
1324 "%s: prepare_auth_resp_fils() returned failure",
1325 __func__);
1326 }
1327
1328 cb(hapd, sta, resp, data, pub);
1329 }
1330 }
1331
1332
1333 static struct wpabuf *
1334 prepare_auth_resp_fils(struct hostapd_data *hapd,
1335 struct sta_info *sta, u16 *resp,
1336 struct rsn_pmksa_cache_entry *pmksa,
1337 struct wpabuf *erp_resp,
1338 const u8 *msk, size_t msk_len,
1339 int *is_pub)
1340 {
1341 u8 fils_nonce[FILS_NONCE_LEN];
1342 size_t ielen;
1343 struct wpabuf *data = NULL;
1344 const u8 *ie;
1345 u8 *ie_buf = NULL;
1346 const u8 *pmk = NULL;
1347 size_t pmk_len = 0;
1348 u8 pmk_buf[PMK_LEN_MAX];
1349 struct wpabuf *pub = NULL;
1350
1351 if (*resp != WLAN_STATUS_SUCCESS)
1352 goto fail;
1353
1354 ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen);
1355 if (!ie) {
1356 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1357 goto fail;
1358 }
1359
1360 if (pmksa) {
1361 /* Add PMKID of the selected PMKSA into RSNE */
1362 ie_buf = os_malloc(ielen + 2 + 2 + PMKID_LEN);
1363 if (!ie_buf) {
1364 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1365 goto fail;
1366 }
1367
1368 os_memcpy(ie_buf, ie, ielen);
1369 if (wpa_insert_pmkid(ie_buf, &ielen, pmksa->pmkid) < 0) {
1370 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1371 goto fail;
1372 }
1373 ie = ie_buf;
1374 }
1375
1376 if (random_get_bytes(fils_nonce, FILS_NONCE_LEN) < 0) {
1377 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1378 goto fail;
1379 }
1380 wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS Nonce",
1381 fils_nonce, FILS_NONCE_LEN);
1382
1383 #ifdef CONFIG_FILS_SK_PFS
1384 if (sta->fils_dh_ss && sta->fils_ecdh) {
1385 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1386 if (!pub) {
1387 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1388 goto fail;
1389 }
1390 }
1391 #endif /* CONFIG_FILS_SK_PFS */
1392
1393 data = wpabuf_alloc(1000 + ielen + (pub ? wpabuf_len(pub) : 0));
1394 if (!data) {
1395 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1396 goto fail;
1397 }
1398
1399 /* TODO: FILS PK */
1400 #ifdef CONFIG_FILS_SK_PFS
1401 if (pub) {
1402 /* Finite Cyclic Group */
1403 wpabuf_put_le16(data, hapd->conf->fils_dh_group);
1404
1405 /* Element */
1406 wpabuf_put_buf(data, pub);
1407 }
1408 #endif /* CONFIG_FILS_SK_PFS */
1409
1410 /* RSNE */
1411 wpabuf_put_data(data, ie, ielen);
1412
1413 /* MDE when using FILS+FT (already included in ie,ielen with RSNE) */
1414
1415 #ifdef CONFIG_IEEE80211R_AP
1416 if (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm))) {
1417 /* FTE[R1KH-ID,R0KH-ID] when using FILS+FT */
1418 int res;
1419
1420 res = wpa_auth_write_fte(hapd->wpa_auth, wpabuf_put(data, 0),
1421 wpabuf_tailroom(data));
1422 if (res < 0) {
1423 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1424 goto fail;
1425 }
1426 wpabuf_put(data, res);
1427 }
1428 #endif /* CONFIG_IEEE80211R_AP */
1429
1430 /* FILS Nonce */
1431 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1432 wpabuf_put_u8(data, 1 + FILS_NONCE_LEN); /* Length */
1433 /* Element ID Extension */
1434 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_NONCE);
1435 wpabuf_put_data(data, fils_nonce, FILS_NONCE_LEN);
1436
1437 /* FILS Session */
1438 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1439 wpabuf_put_u8(data, 1 + FILS_SESSION_LEN); /* Length */
1440 /* Element ID Extension */
1441 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_SESSION);
1442 wpabuf_put_data(data, sta->fils_session, FILS_SESSION_LEN);
1443
1444 /* FILS Wrapped Data */
1445 if (!pmksa && erp_resp) {
1446 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1447 wpabuf_put_u8(data, 1 + wpabuf_len(erp_resp)); /* Length */
1448 /* Element ID Extension */
1449 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_WRAPPED_DATA);
1450 wpabuf_put_buf(data, erp_resp);
1451
1452 if (fils_rmsk_to_pmk(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1453 msk, msk_len, sta->fils_snonce, fils_nonce,
1454 sta->fils_dh_ss ?
1455 wpabuf_head(sta->fils_dh_ss) : NULL,
1456 sta->fils_dh_ss ?
1457 wpabuf_len(sta->fils_dh_ss) : 0,
1458 pmk_buf, &pmk_len)) {
1459 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK");
1460 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1461 wpabuf_free(data);
1462 data = NULL;
1463 goto fail;
1464 }
1465 pmk = pmk_buf;
1466
1467 /* Don't use DHss in PTK derivation if PMKSA caching is not
1468 * used. */
1469 wpabuf_clear_free(sta->fils_dh_ss);
1470 sta->fils_dh_ss = NULL;
1471
1472 if (sta->fils_erp_pmkid_set) {
1473 /* TODO: get PMKLifetime from WPA parameters */
1474 unsigned int dot11RSNAConfigPMKLifetime = 43200;
1475
1476 sta->fils_erp_pmkid_set = 0;
1477 if (wpa_auth_pmksa_add2(
1478 hapd->wpa_auth, sta->addr,
1479 pmk, pmk_len,
1480 sta->fils_erp_pmkid,
1481 sta->session_timeout_set ?
1482 sta->session_timeout :
1483 dot11RSNAConfigPMKLifetime,
1484 wpa_auth_sta_key_mgmt(sta->wpa_sm)) < 0) {
1485 wpa_printf(MSG_ERROR,
1486 "FILS: Failed to add PMKSA cache entry based on ERP");
1487 }
1488 }
1489 } else if (pmksa) {
1490 pmk = pmksa->pmk;
1491 pmk_len = pmksa->pmk_len;
1492 }
1493
1494 if (!pmk) {
1495 wpa_printf(MSG_DEBUG, "FILS: No PMK available");
1496 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1497 wpabuf_free(data);
1498 data = NULL;
1499 goto fail;
1500 }
1501
1502 if (fils_auth_pmk_to_ptk(sta->wpa_sm, pmk, pmk_len,
1503 sta->fils_snonce, fils_nonce,
1504 sta->fils_dh_ss ?
1505 wpabuf_head(sta->fils_dh_ss) : NULL,
1506 sta->fils_dh_ss ?
1507 wpabuf_len(sta->fils_dh_ss) : 0,
1508 sta->fils_g_sta, pub) < 0) {
1509 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1510 wpabuf_free(data);
1511 data = NULL;
1512 goto fail;
1513 }
1514
1515 fail:
1516 if (is_pub)
1517 *is_pub = pub != NULL;
1518 os_free(ie_buf);
1519 wpabuf_free(pub);
1520 wpabuf_clear_free(sta->fils_dh_ss);
1521 sta->fils_dh_ss = NULL;
1522 #ifdef CONFIG_FILS_SK_PFS
1523 crypto_ecdh_deinit(sta->fils_ecdh);
1524 sta->fils_ecdh = NULL;
1525 #endif /* CONFIG_FILS_SK_PFS */
1526 return data;
1527 }
1528
1529
1530 static void handle_auth_fils_finish(struct hostapd_data *hapd,
1531 struct sta_info *sta, u16 resp,
1532 struct wpabuf *data, int pub)
1533 {
1534 u16 auth_alg;
1535
1536 auth_alg = (pub ||
1537 resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) ?
1538 WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
1539 send_auth_reply(hapd, sta->addr, hapd->own_addr, auth_alg, 2, resp,
1540 data ? wpabuf_head(data) : (u8 *) "",
1541 data ? wpabuf_len(data) : 0, "auth-fils-finish");
1542 wpabuf_free(data);
1543
1544 if (resp == WLAN_STATUS_SUCCESS) {
1545 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1546 HOSTAPD_LEVEL_DEBUG,
1547 "authentication OK (FILS)");
1548 sta->flags |= WLAN_STA_AUTH;
1549 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1550 sta->auth_alg = pub ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
1551 mlme_authenticate_indication(hapd, sta);
1552 }
1553 }
1554
1555
1556 void ieee802_11_finish_fils_auth(struct hostapd_data *hapd,
1557 struct sta_info *sta, int success,
1558 struct wpabuf *erp_resp,
1559 const u8 *msk, size_t msk_len)
1560 {
1561 struct wpabuf *data;
1562 int pub = 0;
1563 u16 resp;
1564
1565 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
1566
1567 if (!sta->fils_pending_cb)
1568 return;
1569 resp = success ? WLAN_STATUS_SUCCESS : WLAN_STATUS_UNSPECIFIED_FAILURE;
1570 data = prepare_auth_resp_fils(hapd, sta, &resp, NULL, erp_resp,
1571 msk, msk_len, &pub);
1572 if (!data) {
1573 wpa_printf(MSG_DEBUG,
1574 "%s: prepare_auth_resp_fils() returned failure",
1575 __func__);
1576 }
1577 sta->fils_pending_cb(hapd, sta, resp, data, pub);
1578 }
1579
1580 #endif /* CONFIG_FILS */
1581
1582
1583 int
1584 ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr,
1585 const u8 *msg, size_t len, u32 *session_timeout,
1586 u32 *acct_interim_interval,
1587 struct vlan_description *vlan_id,
1588 struct hostapd_sta_wpa_psk_short **psk,
1589 char **identity, char **radius_cui, int is_probe_req)
1590 {
1591 int res;
1592
1593 os_memset(vlan_id, 0, sizeof(*vlan_id));
1594 res = hostapd_allowed_address(hapd, addr, msg, len,
1595 session_timeout, acct_interim_interval,
1596 vlan_id, psk, identity, radius_cui,
1597 is_probe_req);
1598
1599 if (res == HOSTAPD_ACL_REJECT) {
1600 wpa_printf(MSG_INFO,
1601 "Station " MACSTR " not allowed to authenticate",
1602 MAC2STR(addr));
1603 return HOSTAPD_ACL_REJECT;
1604 }
1605
1606 if (res == HOSTAPD_ACL_PENDING) {
1607 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
1608 " waiting for an external authentication",
1609 MAC2STR(addr));
1610 /* Authentication code will re-send the authentication frame
1611 * after it has received (and cached) information from the
1612 * external source. */
1613 return HOSTAPD_ACL_PENDING;
1614 }
1615
1616 return res;
1617 }
1618
1619
1620 static int
1621 ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
1622 int res, u32 session_timeout,
1623 u32 acct_interim_interval,
1624 struct vlan_description *vlan_id,
1625 struct hostapd_sta_wpa_psk_short **psk,
1626 char **identity, char **radius_cui)
1627 {
1628 if (vlan_id->notempty &&
1629 !hostapd_vlan_valid(hapd->conf->vlan, vlan_id)) {
1630 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1631 HOSTAPD_LEVEL_INFO,
1632 "Invalid VLAN %d%s received from RADIUS server",
1633 vlan_id->untagged,
1634 vlan_id->tagged[0] ? "+" : "");
1635 return -1;
1636 }
1637 if (ap_sta_set_vlan(hapd, sta, vlan_id) < 0)
1638 return -1;
1639 if (sta->vlan_id)
1640 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1641 HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1642
1643 hostapd_free_psk_list(sta->psk);
1644 if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1645 sta->psk = *psk;
1646 *psk = NULL;
1647 } else {
1648 sta->psk = NULL;
1649 }
1650
1651 sta->identity = *identity;
1652 *identity = NULL;
1653 sta->radius_cui = *radius_cui;
1654 *radius_cui = NULL;
1655
1656 if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
1657 sta->acct_interim_interval = acct_interim_interval;
1658 if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
1659 ap_sta_session_timeout(hapd, sta, session_timeout);
1660 else
1661 ap_sta_no_session_timeout(hapd, sta);
1662
1663 return 0;
1664 }
1665
1666
1667 static void handle_auth(struct hostapd_data *hapd,
1668 const struct ieee80211_mgmt *mgmt, size_t len)
1669 {
1670 u16 auth_alg, auth_transaction, status_code;
1671 u16 resp = WLAN_STATUS_SUCCESS;
1672 struct sta_info *sta = NULL;
1673 int res, reply_res;
1674 u16 fc;
1675 const u8 *challenge = NULL;
1676 u32 session_timeout, acct_interim_interval;
1677 struct vlan_description vlan_id;
1678 struct hostapd_sta_wpa_psk_short *psk = NULL;
1679 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
1680 size_t resp_ies_len = 0;
1681 char *identity = NULL;
1682 char *radius_cui = NULL;
1683 u16 seq_ctrl;
1684
1685 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1686 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
1687 (unsigned long) len);
1688 return;
1689 }
1690
1691 #ifdef CONFIG_TESTING_OPTIONS
1692 if (hapd->iconf->ignore_auth_probability > 0.0 &&
1693 drand48() < hapd->iconf->ignore_auth_probability) {
1694 wpa_printf(MSG_INFO,
1695 "TESTING: ignoring auth frame from " MACSTR,
1696 MAC2STR(mgmt->sa));
1697 return;
1698 }
1699 #endif /* CONFIG_TESTING_OPTIONS */
1700
1701 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1702 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1703 status_code = le_to_host16(mgmt->u.auth.status_code);
1704 fc = le_to_host16(mgmt->frame_control);
1705 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
1706
1707 if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
1708 2 + WLAN_AUTH_CHALLENGE_LEN &&
1709 mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
1710 mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
1711 challenge = &mgmt->u.auth.variable[2];
1712
1713 wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
1714 "auth_transaction=%d status_code=%d wep=%d%s "
1715 "seq_ctrl=0x%x%s",
1716 MAC2STR(mgmt->sa), auth_alg, auth_transaction,
1717 status_code, !!(fc & WLAN_FC_ISWEP),
1718 challenge ? " challenge" : "",
1719 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1720
1721 #ifdef CONFIG_NO_RC4
1722 if (auth_alg == WLAN_AUTH_SHARED_KEY) {
1723 wpa_printf(MSG_INFO,
1724 "Unsupported authentication algorithm (%d)",
1725 auth_alg);
1726 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1727 goto fail;
1728 }
1729 #endif /* CONFIG_NO_RC4 */
1730
1731 if (hapd->tkip_countermeasures) {
1732 wpa_printf(MSG_DEBUG,
1733 "Ongoing TKIP countermeasures (Michael MIC failure) - reject authentication");
1734 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1735 goto fail;
1736 }
1737
1738 if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
1739 auth_alg == WLAN_AUTH_OPEN) ||
1740 #ifdef CONFIG_IEEE80211R_AP
1741 (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
1742 auth_alg == WLAN_AUTH_FT) ||
1743 #endif /* CONFIG_IEEE80211R_AP */
1744 #ifdef CONFIG_SAE
1745 (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1746 auth_alg == WLAN_AUTH_SAE) ||
1747 #endif /* CONFIG_SAE */
1748 #ifdef CONFIG_FILS
1749 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
1750 auth_alg == WLAN_AUTH_FILS_SK) ||
1751 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
1752 hapd->conf->fils_dh_group &&
1753 auth_alg == WLAN_AUTH_FILS_SK_PFS) ||
1754 #endif /* CONFIG_FILS */
1755 ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
1756 auth_alg == WLAN_AUTH_SHARED_KEY))) {
1757 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
1758 auth_alg);
1759 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1760 goto fail;
1761 }
1762
1763 if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
1764 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
1765 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
1766 auth_transaction);
1767 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1768 goto fail;
1769 }
1770
1771 if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
1772 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1773 MAC2STR(mgmt->sa));
1774 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1775 goto fail;
1776 }
1777
1778 if (hapd->conf->no_auth_if_seen_on) {
1779 struct hostapd_data *other;
1780
1781 other = sta_track_seen_on(hapd->iface, mgmt->sa,
1782 hapd->conf->no_auth_if_seen_on);
1783 if (other) {
1784 u8 *pos;
1785 u32 info;
1786 u8 op_class, channel, phytype;
1787
1788 wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
1789 MACSTR " since STA has been seen on %s",
1790 hapd->conf->iface, MAC2STR(mgmt->sa),
1791 hapd->conf->no_auth_if_seen_on);
1792
1793 resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
1794 pos = &resp_ies[0];
1795 *pos++ = WLAN_EID_NEIGHBOR_REPORT;
1796 *pos++ = 13;
1797 os_memcpy(pos, other->own_addr, ETH_ALEN);
1798 pos += ETH_ALEN;
1799 info = 0; /* TODO: BSSID Information */
1800 WPA_PUT_LE32(pos, info);
1801 pos += 4;
1802 if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
1803 phytype = 8; /* dmg */
1804 else if (other->iconf->ieee80211ac)
1805 phytype = 9; /* vht */
1806 else if (other->iconf->ieee80211n)
1807 phytype = 7; /* ht */
1808 else if (other->iconf->hw_mode ==
1809 HOSTAPD_MODE_IEEE80211A)
1810 phytype = 4; /* ofdm */
1811 else if (other->iconf->hw_mode ==
1812 HOSTAPD_MODE_IEEE80211G)
1813 phytype = 6; /* erp */
1814 else
1815 phytype = 5; /* hrdsss */
1816 if (ieee80211_freq_to_channel_ext(
1817 hostapd_hw_get_freq(other,
1818 other->iconf->channel),
1819 other->iconf->secondary_channel,
1820 other->iconf->ieee80211ac,
1821 &op_class, &channel) == NUM_HOSTAPD_MODES) {
1822 op_class = 0;
1823 channel = other->iconf->channel;
1824 }
1825 *pos++ = op_class;
1826 *pos++ = channel;
1827 *pos++ = phytype;
1828 resp_ies_len = pos - &resp_ies[0];
1829 goto fail;
1830 }
1831 }
1832
1833 res = ieee802_11_allowed_address(
1834 hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout,
1835 &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui,
1836 0);
1837 if (res == HOSTAPD_ACL_REJECT) {
1838 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1839 "Ignore Authentication frame from " MACSTR
1840 " due to ACL reject", MAC2STR(mgmt->sa));
1841 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1842 goto fail;
1843 }
1844 if (res == HOSTAPD_ACL_PENDING)
1845 return;
1846
1847 sta = ap_get_sta(hapd, mgmt->sa);
1848 if (sta) {
1849 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
1850 if ((fc & WLAN_FC_RETRY) &&
1851 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1852 sta->last_seq_ctrl == seq_ctrl &&
1853 sta->last_subtype == WLAN_FC_STYPE_AUTH) {
1854 hostapd_logger(hapd, sta->addr,
1855 HOSTAPD_MODULE_IEEE80211,
1856 HOSTAPD_LEVEL_DEBUG,
1857 "Drop repeated authentication frame seq_ctrl=0x%x",
1858 seq_ctrl);
1859 return;
1860 }
1861 #ifdef CONFIG_MESH
1862 if ((hapd->conf->mesh & MESH_ENABLED) &&
1863 sta->plink_state == PLINK_BLOCKED) {
1864 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1865 " is blocked - drop Authentication frame",
1866 MAC2STR(mgmt->sa));
1867 return;
1868 }
1869 #endif /* CONFIG_MESH */
1870 } else {
1871 #ifdef CONFIG_MESH
1872 if (hapd->conf->mesh & MESH_ENABLED) {
1873 /* if the mesh peer is not available, we don't do auth.
1874 */
1875 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1876 " not yet known - drop Authentication frame",
1877 MAC2STR(mgmt->sa));
1878 /*
1879 * Save a copy of the frame so that it can be processed
1880 * if a new peer entry is added shortly after this.
1881 */
1882 wpabuf_free(hapd->mesh_pending_auth);
1883 hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
1884 os_get_reltime(&hapd->mesh_pending_auth_time);
1885 return;
1886 }
1887 #endif /* CONFIG_MESH */
1888
1889 sta = ap_sta_add(hapd, mgmt->sa);
1890 if (!sta) {
1891 wpa_printf(MSG_DEBUG, "ap_sta_add() failed");
1892 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1893 goto fail;
1894 }
1895 }
1896 sta->last_seq_ctrl = seq_ctrl;
1897 sta->last_subtype = WLAN_FC_STYPE_AUTH;
1898
1899 res = ieee802_11_set_radius_info(
1900 hapd, sta, res, session_timeout, acct_interim_interval,
1901 &vlan_id, &psk, &identity, &radius_cui);
1902 if (res) {
1903 wpa_printf(MSG_DEBUG, "ieee802_11_set_radius_info() failed");
1904 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1905 goto fail;
1906 }
1907
1908 sta->flags &= ~WLAN_STA_PREAUTH;
1909 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
1910
1911 /*
1912 * If the driver supports full AP client state, add a station to the
1913 * driver before sending authentication reply to make sure the driver
1914 * has resources, and not to go through the entire authentication and
1915 * association handshake, and fail it at the end.
1916 *
1917 * If this is not the first transaction, in a multi-step authentication
1918 * algorithm, the station already exists in the driver
1919 * (sta->added_unassoc = 1) so skip it.
1920 *
1921 * In mesh mode, the station was already added to the driver when the
1922 * NEW_PEER_CANDIDATE event is received.
1923 *
1924 * If PMF was negotiated for the existing association, skip this to
1925 * avoid dropping the STA entry and the associated keys. This is needed
1926 * to allow the original connection work until the attempt can complete
1927 * (re)association, so that unprotected Authentication frame cannot be
1928 * used to bypass PMF protection.
1929 */
1930 if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
1931 (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) &&
1932 !(hapd->conf->mesh & MESH_ENABLED) &&
1933 !(sta->added_unassoc)) {
1934 /*
1935 * If a station that is already associated to the AP, is trying
1936 * to authenticate again, remove the STA entry, in order to make
1937 * sure the STA PS state gets cleared and configuration gets
1938 * updated. To handle this, station's added_unassoc flag is
1939 * cleared once the station has completed association.
1940 */
1941 hostapd_drv_sta_remove(hapd, sta->addr);
1942 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
1943 WLAN_STA_AUTHORIZED);
1944
1945 if (hostapd_sta_add(hapd, sta->addr, 0, 0, NULL, 0, 0,
1946 NULL, NULL, sta->flags, 0, 0, 0, 0)) {
1947 hostapd_logger(hapd, sta->addr,
1948 HOSTAPD_MODULE_IEEE80211,
1949 HOSTAPD_LEVEL_NOTICE,
1950 "Could not add STA to kernel driver");
1951 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1952 goto fail;
1953 }
1954
1955 sta->added_unassoc = 1;
1956 }
1957
1958 switch (auth_alg) {
1959 case WLAN_AUTH_OPEN:
1960 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1961 HOSTAPD_LEVEL_DEBUG,
1962 "authentication OK (open system)");
1963 sta->flags |= WLAN_STA_AUTH;
1964 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1965 sta->auth_alg = WLAN_AUTH_OPEN;
1966 mlme_authenticate_indication(hapd, sta);
1967 break;
1968 #ifndef CONFIG_NO_RC4
1969 case WLAN_AUTH_SHARED_KEY:
1970 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
1971 fc & WLAN_FC_ISWEP);
1972 if (resp != 0)
1973 wpa_printf(MSG_DEBUG,
1974 "auth_shared_key() failed: status=%d", resp);
1975 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
1976 mlme_authenticate_indication(hapd, sta);
1977 if (sta->challenge && auth_transaction == 1) {
1978 resp_ies[0] = WLAN_EID_CHALLENGE;
1979 resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
1980 os_memcpy(resp_ies + 2, sta->challenge,
1981 WLAN_AUTH_CHALLENGE_LEN);
1982 resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
1983 }
1984 break;
1985 #endif /* CONFIG_NO_RC4 */
1986 #ifdef CONFIG_IEEE80211R_AP
1987 case WLAN_AUTH_FT:
1988 sta->auth_alg = WLAN_AUTH_FT;
1989 if (sta->wpa_sm == NULL)
1990 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
1991 sta->addr, NULL);
1992 if (sta->wpa_sm == NULL) {
1993 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
1994 "state machine");
1995 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1996 goto fail;
1997 }
1998 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
1999 auth_transaction, mgmt->u.auth.variable,
2000 len - IEEE80211_HDRLEN -
2001 sizeof(mgmt->u.auth),
2002 handle_auth_ft_finish, hapd);
2003 /* handle_auth_ft_finish() callback will complete auth. */
2004 return;
2005 #endif /* CONFIG_IEEE80211R_AP */
2006 #ifdef CONFIG_SAE
2007 case WLAN_AUTH_SAE:
2008 #ifdef CONFIG_MESH
2009 if (status_code == WLAN_STATUS_SUCCESS &&
2010 hapd->conf->mesh & MESH_ENABLED) {
2011 if (sta->wpa_sm == NULL)
2012 sta->wpa_sm =
2013 wpa_auth_sta_init(hapd->wpa_auth,
2014 sta->addr, NULL);
2015 if (sta->wpa_sm == NULL) {
2016 wpa_printf(MSG_DEBUG,
2017 "SAE: Failed to initialize WPA state machine");
2018 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2019 goto fail;
2020 }
2021 }
2022 #endif /* CONFIG_MESH */
2023 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
2024 status_code);
2025 return;
2026 #endif /* CONFIG_SAE */
2027 #ifdef CONFIG_FILS
2028 case WLAN_AUTH_FILS_SK:
2029 case WLAN_AUTH_FILS_SK_PFS:
2030 handle_auth_fils(hapd, sta, mgmt->u.auth.variable,
2031 len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth),
2032 auth_alg, auth_transaction, status_code,
2033 handle_auth_fils_finish);
2034 return;
2035 #endif /* CONFIG_FILS */
2036 }
2037
2038 fail:
2039 os_free(identity);
2040 os_free(radius_cui);
2041 hostapd_free_psk_list(psk);
2042
2043 reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
2044 auth_transaction + 1, resp, resp_ies,
2045 resp_ies_len, "handle-auth");
2046
2047 if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
2048 reply_res != WLAN_STATUS_SUCCESS)) {
2049 hostapd_drv_sta_remove(hapd, sta->addr);
2050 sta->added_unassoc = 0;
2051 }
2052 }
2053
2054
2055 int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
2056 {
2057 int i, j = 32, aid;
2058
2059 /* get a unique AID */
2060 if (sta->aid > 0) {
2061 wpa_printf(MSG_DEBUG, " old AID %d", sta->aid);
2062 return 0;
2063 }
2064
2065 if (TEST_FAIL())
2066 return -1;
2067
2068 for (i = 0; i < AID_WORDS; i++) {
2069 if (hapd->sta_aid[i] == (u32) -1)
2070 continue;
2071 for (j = 0; j < 32; j++) {
2072 if (!(hapd->sta_aid[i] & BIT(j)))
2073 break;
2074 }
2075 if (j < 32)
2076 break;
2077 }
2078 if (j == 32)
2079 return -1;
2080 aid = i * 32 + j + 1;
2081 if (aid > 2007)
2082 return -1;
2083
2084 sta->aid = aid;
2085 hapd->sta_aid[i] |= BIT(j);
2086 wpa_printf(MSG_DEBUG, " new AID %d", sta->aid);
2087 return 0;
2088 }
2089
2090
2091 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
2092 const u8 *ssid_ie, size_t ssid_ie_len)
2093 {
2094 if (ssid_ie == NULL)
2095 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2096
2097 if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
2098 os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
2099 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2100 HOSTAPD_LEVEL_INFO,
2101 "Station tried to associate with unknown SSID "
2102 "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
2103 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2104 }
2105
2106 return WLAN_STATUS_SUCCESS;
2107 }
2108
2109
2110 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
2111 const u8 *wmm_ie, size_t wmm_ie_len)
2112 {
2113 sta->flags &= ~WLAN_STA_WMM;
2114 sta->qosinfo = 0;
2115 if (wmm_ie && hapd->conf->wmm_enabled) {
2116 struct wmm_information_element *wmm;
2117
2118 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
2119 hostapd_logger(hapd, sta->addr,
2120 HOSTAPD_MODULE_WPA,
2121 HOSTAPD_LEVEL_DEBUG,
2122 "invalid WMM element in association "
2123 "request");
2124 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2125 }
2126
2127 sta->flags |= WLAN_STA_WMM;
2128 wmm = (struct wmm_information_element *) wmm_ie;
2129 sta->qosinfo = wmm->qos_info;
2130 }
2131 return WLAN_STATUS_SUCCESS;
2132 }
2133
2134
2135 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
2136 struct ieee802_11_elems *elems)
2137 {
2138 /* Supported rates not used in IEEE 802.11ad/DMG */
2139 if (hapd->iface->current_mode &&
2140 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD)
2141 return WLAN_STATUS_SUCCESS;
2142
2143 if (!elems->supp_rates) {
2144 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2145 HOSTAPD_LEVEL_DEBUG,
2146 "No supported rates element in AssocReq");
2147 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2148 }
2149
2150 if (elems->supp_rates_len + elems->ext_supp_rates_len >
2151 sizeof(sta->supported_rates)) {
2152 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2153 HOSTAPD_LEVEL_DEBUG,
2154 "Invalid supported rates element length %d+%d",
2155 elems->supp_rates_len,
2156 elems->ext_supp_rates_len);
2157 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2158 }
2159
2160 sta->supported_rates_len = merge_byte_arrays(
2161 sta->supported_rates, sizeof(sta->supported_rates),
2162 elems->supp_rates, elems->supp_rates_len,
2163 elems->ext_supp_rates, elems->ext_supp_rates_len);
2164
2165 return WLAN_STATUS_SUCCESS;
2166 }
2167
2168
2169 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
2170 const u8 *ext_capab_ie, size_t ext_capab_ie_len)
2171 {
2172 #ifdef CONFIG_INTERWORKING
2173 /* check for QoS Map support */
2174 if (ext_capab_ie_len >= 5) {
2175 if (ext_capab_ie[4] & 0x01)
2176 sta->qos_map_enabled = 1;
2177 }
2178 #endif /* CONFIG_INTERWORKING */
2179
2180 if (ext_capab_ie_len > 0) {
2181 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
2182 os_free(sta->ext_capability);
2183 sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
2184 if (sta->ext_capability) {
2185 sta->ext_capability[0] = ext_capab_ie_len;
2186 os_memcpy(sta->ext_capability + 1, ext_capab_ie,
2187 ext_capab_ie_len);
2188 }
2189 }
2190
2191 return WLAN_STATUS_SUCCESS;
2192 }
2193
2194
2195 #ifdef CONFIG_OWE
2196
2197 static int owe_group_supported(struct hostapd_data *hapd, u16 group)
2198 {
2199 int i;
2200 int *groups = hapd->conf->owe_groups;
2201
2202 if (group != 19 && group != 20 && group != 21)
2203 return 0;
2204
2205 if (!groups)
2206 return 1;
2207
2208 for (i = 0; groups[i] > 0; i++) {
2209 if (groups[i] == group)
2210 return 1;
2211 }
2212
2213 return 0;
2214 }
2215
2216
2217 static u16 owe_process_assoc_req(struct hostapd_data *hapd,
2218 struct sta_info *sta, const u8 *owe_dh,
2219 u8 owe_dh_len)
2220 {
2221 struct wpabuf *secret, *pub, *hkey;
2222 int res;
2223 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
2224 const char *info = "OWE Key Generation";
2225 const u8 *addr[2];
2226 size_t len[2];
2227 u16 group;
2228 size_t hash_len, prime_len;
2229
2230 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
2231 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
2232 return WLAN_STATUS_SUCCESS;
2233 }
2234
2235 group = WPA_GET_LE16(owe_dh);
2236 if (!owe_group_supported(hapd, group)) {
2237 wpa_printf(MSG_DEBUG, "OWE: Unsupported DH group %u", group);
2238 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2239 }
2240 if (group == 19)
2241 prime_len = 32;
2242 else if (group == 20)
2243 prime_len = 48;
2244 else if (group == 21)
2245 prime_len = 66;
2246 else
2247 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2248
2249 crypto_ecdh_deinit(sta->owe_ecdh);
2250 sta->owe_ecdh = crypto_ecdh_init(group);
2251 if (!sta->owe_ecdh)
2252 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2253 sta->owe_group = group;
2254
2255 secret = crypto_ecdh_set_peerkey(sta->owe_ecdh, 0, owe_dh + 2,
2256 owe_dh_len - 2);
2257 secret = wpabuf_zeropad(secret, prime_len);
2258 if (!secret) {
2259 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
2260 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2261 }
2262 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
2263
2264 /* prk = HKDF-extract(C | A | group, z) */
2265
2266 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
2267 if (!pub) {
2268 wpabuf_clear_free(secret);
2269 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2270 }
2271
2272 /* PMKID = Truncate-128(Hash(C | A)) */
2273 addr[0] = owe_dh + 2;
2274 len[0] = owe_dh_len - 2;
2275 addr[1] = wpabuf_head(pub);
2276 len[1] = wpabuf_len(pub);
2277 if (group == 19) {
2278 res = sha256_vector(2, addr, len, pmkid);
2279 hash_len = SHA256_MAC_LEN;
2280 } else if (group == 20) {
2281 res = sha384_vector(2, addr, len, pmkid);
2282 hash_len = SHA384_MAC_LEN;
2283 } else if (group == 21) {
2284 res = sha512_vector(2, addr, len, pmkid);
2285 hash_len = SHA512_MAC_LEN;
2286 } else {
2287 wpabuf_free(pub);
2288 wpabuf_clear_free(secret);
2289 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2290 }
2291 pub = wpabuf_zeropad(pub, prime_len);
2292 if (res < 0 || !pub) {
2293 wpabuf_free(pub);
2294 wpabuf_clear_free(secret);
2295 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2296 }
2297
2298 hkey = wpabuf_alloc(owe_dh_len - 2 + wpabuf_len(pub) + 2);
2299 if (!hkey) {
2300 wpabuf_free(pub);
2301 wpabuf_clear_free(secret);
2302 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2303 }
2304
2305 wpabuf_put_data(hkey, owe_dh + 2, owe_dh_len - 2); /* C */
2306 wpabuf_put_buf(hkey, pub); /* A */
2307 wpabuf_free(pub);
2308 wpabuf_put_le16(hkey, group); /* group */
2309 if (group == 19)
2310 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
2311 wpabuf_head(secret), wpabuf_len(secret), prk);
2312 else if (group == 20)
2313 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
2314 wpabuf_head(secret), wpabuf_len(secret), prk);
2315 else if (group == 21)
2316 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
2317 wpabuf_head(secret), wpabuf_len(secret), prk);
2318 wpabuf_clear_free(hkey);
2319 wpabuf_clear_free(secret);
2320 if (res < 0)
2321 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2322
2323 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
2324
2325 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
2326
2327 os_free(sta->owe_pmk);
2328 sta->owe_pmk = os_malloc(hash_len);
2329 if (!sta->owe_pmk) {
2330 os_memset(prk, 0, SHA512_MAC_LEN);
2331 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2332 }
2333
2334 if (group == 19)
2335 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
2336 os_strlen(info), sta->owe_pmk, hash_len);
2337 else if (group == 20)
2338 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
2339 os_strlen(info), sta->owe_pmk, hash_len);
2340 else if (group == 21)
2341 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
2342 os_strlen(info), sta->owe_pmk, hash_len);
2343 os_memset(prk, 0, SHA512_MAC_LEN);
2344 if (res < 0) {
2345 os_free(sta->owe_pmk);
2346 sta->owe_pmk = NULL;
2347 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2348 }
2349 sta->owe_pmk_len = hash_len;
2350
2351 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sta->owe_pmk, sta->owe_pmk_len);
2352 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
2353 wpa_auth_pmksa_add2(hapd->wpa_auth, sta->addr, sta->owe_pmk,
2354 sta->owe_pmk_len, pmkid, 0, WPA_KEY_MGMT_OWE);
2355
2356 return WLAN_STATUS_SUCCESS;
2357 }
2358
2359 #endif /* CONFIG_OWE */
2360
2361
2362 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
2363 const u8 *ies, size_t ies_len, int reassoc)
2364 {
2365 struct ieee802_11_elems elems;
2366 u16 resp;
2367 const u8 *wpa_ie;
2368 size_t wpa_ie_len;
2369 const u8 *p2p_dev_addr = NULL;
2370
2371 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
2372 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2373 HOSTAPD_LEVEL_INFO, "Station sent an invalid "
2374 "association request");
2375 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2376 }
2377
2378 resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
2379 if (resp != WLAN_STATUS_SUCCESS)
2380 return resp;
2381 resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
2382 if (resp != WLAN_STATUS_SUCCESS)
2383 return resp;
2384 resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
2385 if (resp != WLAN_STATUS_SUCCESS)
2386 return resp;
2387 resp = copy_supp_rates(hapd, sta, &elems);
2388 if (resp != WLAN_STATUS_SUCCESS)
2389 return resp;
2390 #ifdef CONFIG_IEEE80211N
2391 resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
2392 if (resp != WLAN_STATUS_SUCCESS)
2393 return resp;
2394 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
2395 !(sta->flags & WLAN_STA_HT)) {
2396 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2397 HOSTAPD_LEVEL_INFO, "Station does not support "
2398 "mandatory HT PHY - reject association");
2399 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
2400 }
2401 #endif /* CONFIG_IEEE80211N */
2402
2403 #ifdef CONFIG_IEEE80211AC
2404 if (hapd->iconf->ieee80211ac) {
2405 resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
2406 if (resp != WLAN_STATUS_SUCCESS)
2407 return resp;
2408
2409 resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
2410 if (resp != WLAN_STATUS_SUCCESS)
2411 return resp;
2412 }
2413
2414 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
2415 !(sta->flags & WLAN_STA_VHT)) {
2416 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2417 HOSTAPD_LEVEL_INFO, "Station does not support "
2418 "mandatory VHT PHY - reject association");
2419 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
2420 }
2421
2422 if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
2423 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
2424 elems.vendor_vht_len);
2425 if (resp != WLAN_STATUS_SUCCESS)
2426 return resp;
2427 }
2428 #endif /* CONFIG_IEEE80211AC */
2429
2430 #ifdef CONFIG_P2P
2431 if (elems.p2p) {
2432 wpabuf_free(sta->p2p_ie);
2433 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2434 P2P_IE_VENDOR_TYPE);
2435 if (sta->p2p_ie)
2436 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
2437 } else {
2438 wpabuf_free(sta->p2p_ie);
2439 sta->p2p_ie = NULL;
2440 }
2441 #endif /* CONFIG_P2P */
2442
2443 if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
2444 wpa_ie = elems.rsn_ie;
2445 wpa_ie_len = elems.rsn_ie_len;
2446 } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
2447 elems.wpa_ie) {
2448 wpa_ie = elems.wpa_ie;
2449 wpa_ie_len = elems.wpa_ie_len;
2450 } else {
2451 wpa_ie = NULL;
2452 wpa_ie_len = 0;
2453 }
2454
2455 #ifdef CONFIG_WPS
2456 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
2457 if (hapd->conf->wps_state && elems.wps_ie) {
2458 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
2459 "Request - assume WPS is used");
2460 sta->flags |= WLAN_STA_WPS;
2461 wpabuf_free(sta->wps_ie);
2462 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2463 WPS_IE_VENDOR_TYPE);
2464 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
2465 wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
2466 sta->flags |= WLAN_STA_WPS2;
2467 }
2468 wpa_ie = NULL;
2469 wpa_ie_len = 0;
2470 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
2471 wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
2472 "(Re)Association Request - reject");
2473 return WLAN_STATUS_INVALID_IE;
2474 }
2475 } else if (hapd->conf->wps_state && wpa_ie == NULL) {
2476 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
2477 "(Re)Association Request - possible WPS use");
2478 sta->flags |= WLAN_STA_MAYBE_WPS;
2479 } else
2480 #endif /* CONFIG_WPS */
2481 if (hapd->conf->wpa && wpa_ie == NULL) {
2482 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2483 HOSTAPD_LEVEL_INFO,
2484 "No WPA/RSN IE in association request");
2485 return WLAN_STATUS_INVALID_IE;
2486 }
2487
2488 if (hapd->conf->wpa && wpa_ie) {
2489 int res;
2490 wpa_ie -= 2;
2491 wpa_ie_len += 2;
2492 if (sta->wpa_sm == NULL)
2493 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
2494 sta->addr,
2495 p2p_dev_addr);
2496 if (sta->wpa_sm == NULL) {
2497 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
2498 "state machine");
2499 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2500 }
2501 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
2502 wpa_ie, wpa_ie_len,
2503 elems.mdie, elems.mdie_len,
2504 elems.owe_dh, elems.owe_dh_len);
2505 resp = wpa_res_to_status_code(res);
2506 if (resp != WLAN_STATUS_SUCCESS)
2507 return resp;
2508 #ifdef CONFIG_IEEE80211W
2509 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
2510 sta->sa_query_count > 0)
2511 ap_check_sa_query_timeout(hapd, sta);
2512 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
2513 (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
2514 /*
2515 * STA has already been associated with MFP and SA
2516 * Query timeout has not been reached. Reject the
2517 * association attempt temporarily and start SA Query,
2518 * if one is not pending.
2519 */
2520
2521 if (sta->sa_query_count == 0)
2522 ap_sta_start_sa_query(hapd, sta);
2523
2524 return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
2525 }
2526
2527 if (wpa_auth_uses_mfp(sta->wpa_sm))
2528 sta->flags |= WLAN_STA_MFP;
2529 else
2530 sta->flags &= ~WLAN_STA_MFP;
2531 #endif /* CONFIG_IEEE80211W */
2532
2533 #ifdef CONFIG_IEEE80211R_AP
2534 if (sta->auth_alg == WLAN_AUTH_FT) {
2535 if (!reassoc) {
2536 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
2537 "to use association (not "
2538 "re-association) with FT auth_alg",
2539 MAC2STR(sta->addr));
2540 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2541 }
2542
2543 resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
2544 ies_len);
2545 if (resp != WLAN_STATUS_SUCCESS)
2546 return resp;
2547 }
2548 #endif /* CONFIG_IEEE80211R_AP */
2549
2550 #ifdef CONFIG_SAE
2551 if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae &&
2552 sta->sae->state == SAE_ACCEPTED)
2553 wpa_auth_add_sae_pmkid(sta->wpa_sm, sta->sae->pmkid);
2554
2555 if (wpa_auth_uses_sae(sta->wpa_sm) &&
2556 sta->auth_alg == WLAN_AUTH_OPEN) {
2557 struct rsn_pmksa_cache_entry *sa;
2558 sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
2559 if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
2560 wpa_printf(MSG_DEBUG,
2561 "SAE: No PMKSA cache entry found for "
2562 MACSTR, MAC2STR(sta->addr));
2563 return WLAN_STATUS_INVALID_PMKID;
2564 }
2565 wpa_printf(MSG_DEBUG, "SAE: " MACSTR
2566 " using PMKSA caching", MAC2STR(sta->addr));
2567 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
2568 sta->auth_alg != WLAN_AUTH_SAE &&
2569 !(sta->auth_alg == WLAN_AUTH_FT &&
2570 wpa_auth_uses_ft_sae(sta->wpa_sm))) {
2571 wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
2572 "SAE AKM after non-SAE auth_alg %u",
2573 MAC2STR(sta->addr), sta->auth_alg);
2574 return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
2575 }
2576 #endif /* CONFIG_SAE */
2577
2578 #ifdef CONFIG_OWE
2579 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
2580 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE &&
2581 elems.owe_dh) {
2582 resp = owe_process_assoc_req(hapd, sta, elems.owe_dh,
2583 elems.owe_dh_len);
2584 if (resp != WLAN_STATUS_SUCCESS)
2585 return resp;
2586 }
2587 #endif /* CONFIG_OWE */
2588
2589 #ifdef CONFIG_IEEE80211N
2590 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
2591 wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
2592 hostapd_logger(hapd, sta->addr,
2593 HOSTAPD_MODULE_IEEE80211,
2594 HOSTAPD_LEVEL_INFO,
2595 "Station tried to use TKIP with HT "
2596 "association");
2597 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
2598 }
2599 #endif /* CONFIG_IEEE80211N */
2600 #ifdef CONFIG_HS20
2601 } else if (hapd->conf->osen) {
2602 if (elems.osen == NULL) {
2603 hostapd_logger(
2604 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2605 HOSTAPD_LEVEL_INFO,
2606 "No HS 2.0 OSEN element in association request");
2607 return WLAN_STATUS_INVALID_IE;
2608 }
2609
2610 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
2611 if (sta->wpa_sm == NULL)
2612 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
2613 sta->addr, NULL);
2614 if (sta->wpa_sm == NULL) {
2615 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
2616 "state machine");
2617 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2618 }
2619 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
2620 elems.osen - 2, elems.osen_len + 2) < 0)
2621 return WLAN_STATUS_INVALID_IE;
2622 #endif /* CONFIG_HS20 */
2623 } else
2624 wpa_auth_sta_no_wpa(sta->wpa_sm);
2625
2626 #ifdef CONFIG_P2P
2627 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
2628 #endif /* CONFIG_P2P */
2629
2630 #ifdef CONFIG_HS20
2631 wpabuf_free(sta->hs20_ie);
2632 if (elems.hs20 && elems.hs20_len > 4) {
2633 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
2634 elems.hs20_len - 4);
2635 } else
2636 sta->hs20_ie = NULL;
2637 #endif /* CONFIG_HS20 */
2638
2639 #ifdef CONFIG_FST
2640 wpabuf_free(sta->mb_ies);
2641 if (hapd->iface->fst)
2642 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
2643 else
2644 sta->mb_ies = NULL;
2645 #endif /* CONFIG_FST */
2646
2647 #ifdef CONFIG_MBO
2648 mbo_ap_check_sta_assoc(hapd, sta, &elems);
2649
2650 if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) &&
2651 elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) &&
2652 hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
2653 wpa_printf(MSG_INFO,
2654 "MBO: Reject WPA2 association without PMF");
2655 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2656 }
2657 #endif /* CONFIG_MBO */
2658
2659 ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
2660 elems.supp_op_classes_len);
2661
2662 if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
2663 elems.rrm_enabled &&
2664 elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
2665 os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
2666 sizeof(sta->rrm_enabled_capa));
2667
2668 if (elems.power_capab) {
2669 sta->min_tx_power = elems.power_capab[0];
2670 sta->max_tx_power = elems.power_capab[1];
2671 sta->power_capab = 1;
2672 } else {
2673 sta->power_capab = 0;
2674 }
2675
2676 return WLAN_STATUS_SUCCESS;
2677 }
2678
2679
2680 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
2681 u16 reason_code)
2682 {
2683 int send_len;
2684 struct ieee80211_mgmt reply;
2685
2686 os_memset(&reply, 0, sizeof(reply));
2687 reply.frame_control =
2688 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
2689 os_memcpy(reply.da, addr, ETH_ALEN);
2690 os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
2691 os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
2692
2693 send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
2694 reply.u.deauth.reason_code = host_to_le16(reason_code);
2695
2696 if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
2697 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
2698 strerror(errno));
2699 }
2700
2701
2702 static int add_associated_sta(struct hostapd_data *hapd,
2703 struct sta_info *sta)
2704 {
2705 struct ieee80211_ht_capabilities ht_cap;
2706 struct ieee80211_vht_capabilities vht_cap;
2707 int set = 1;
2708
2709 /*
2710 * Remove the STA entry to ensure the STA PS state gets cleared and
2711 * configuration gets updated. This is relevant for cases, such as
2712 * FT-over-the-DS, where a station re-associates back to the same AP but
2713 * skips the authentication flow, or if working with a driver that
2714 * does not support full AP client state.
2715 *
2716 * Skip this if the STA has already completed FT reassociation and the
2717 * TK has been configured since the TX/RX PN must not be reset to 0 for
2718 * the same key.
2719 */
2720 if (!sta->added_unassoc &&
2721 (!(sta->flags & WLAN_STA_AUTHORIZED) ||
2722 (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
2723 !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
2724 hostapd_drv_sta_remove(hapd, sta->addr);
2725 wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
2726 set = 0;
2727 }
2728
2729 #ifdef CONFIG_IEEE80211N
2730 if (sta->flags & WLAN_STA_HT)
2731 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
2732 #endif /* CONFIG_IEEE80211N */
2733 #ifdef CONFIG_IEEE80211AC
2734 if (sta->flags & WLAN_STA_VHT)
2735 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
2736 #endif /* CONFIG_IEEE80211AC */
2737
2738 /*
2739 * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
2740 * will be set when the ACK frame for the (Re)Association Response frame
2741 * is processed (TX status driver event).
2742 */
2743 if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
2744 sta->supported_rates, sta->supported_rates_len,
2745 sta->listen_interval,
2746 sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
2747 sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
2748 sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
2749 sta->vht_opmode, sta->p2p_ie ? 1 : 0,
2750 set)) {
2751 hostapd_logger(hapd, sta->addr,
2752 HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
2753 "Could not %s STA to kernel driver",
2754 set ? "set" : "add");
2755
2756 if (sta->added_unassoc) {
2757 hostapd_drv_sta_remove(hapd, sta->addr);
2758 sta->added_unassoc = 0;
2759 }
2760
2761 return -1;
2762 }
2763
2764 sta->added_unassoc = 0;
2765
2766 return 0;
2767 }
2768
2769
2770 static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
2771 const u8 *addr, u16 status_code, int reassoc,
2772 const u8 *ies, size_t ies_len)
2773 {
2774 int send_len;
2775 u8 *buf;
2776 size_t buflen;
2777 struct ieee80211_mgmt *reply;
2778 u8 *p;
2779 u16 res = WLAN_STATUS_SUCCESS;
2780
2781 buflen = sizeof(struct ieee80211_mgmt) + 1024;
2782 #ifdef CONFIG_FILS
2783 if (sta && sta->fils_hlp_resp)
2784 buflen += wpabuf_len(sta->fils_hlp_resp);
2785 #endif /* CONFIG_FILS */
2786 #ifdef CONFIG_OWE
2787 if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
2788 buflen += 150;
2789 #endif /* CONFIG_OWE */
2790 buf = os_zalloc(buflen);
2791 if (!buf) {
2792 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2793 goto done;
2794 }
2795 reply = (struct ieee80211_mgmt *) buf;
2796 reply->frame_control =
2797 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2798 (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
2799 WLAN_FC_STYPE_ASSOC_RESP));
2800 os_memcpy(reply->da, addr, ETH_ALEN);
2801 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
2802 os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
2803
2804 send_len = IEEE80211_HDRLEN;
2805 send_len += sizeof(reply->u.assoc_resp);
2806 reply->u.assoc_resp.capab_info =
2807 host_to_le16(hostapd_own_capab_info(hapd));
2808 reply->u.assoc_resp.status_code = host_to_le16(status_code);
2809
2810 reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0) |
2811 BIT(14) | BIT(15));
2812 /* Supported rates */
2813 p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
2814 /* Extended supported rates */
2815 p = hostapd_eid_ext_supp_rates(hapd, p);
2816
2817 #ifdef CONFIG_IEEE80211R_AP
2818 if (sta && status_code == WLAN_STATUS_SUCCESS) {
2819 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
2820 * Transition Information, RSN, [RIC Response] */
2821 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
2822 buf + buflen - p,
2823 sta->auth_alg, ies, ies_len);
2824 }
2825 #endif /* CONFIG_IEEE80211R_AP */
2826
2827 #ifdef CONFIG_OWE
2828 if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
2829 p = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, p,
2830 buf + buflen - p,
2831 ies, ies_len);
2832 #endif /* CONFIG_OWE */
2833
2834 #ifdef CONFIG_IEEE80211W
2835 if (sta && status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
2836 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
2837 #endif /* CONFIG_IEEE80211W */
2838
2839 #ifdef CONFIG_IEEE80211N
2840 p = hostapd_eid_ht_capabilities(hapd, p);
2841 p = hostapd_eid_ht_operation(hapd, p);
2842 #endif /* CONFIG_IEEE80211N */
2843
2844 #ifdef CONFIG_IEEE80211AC
2845 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
2846 u32 nsts = 0, sta_nsts;
2847
2848 if (sta && hapd->conf->use_sta_nsts && sta->vht_capabilities) {
2849 struct ieee80211_vht_capabilities *capa;
2850
2851 nsts = (hapd->iface->conf->vht_capab >>
2852 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
2853 capa = sta->vht_capabilities;
2854 sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
2855 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
2856
2857 if (nsts < sta_nsts)
2858 nsts = 0;
2859 else
2860 nsts = sta_nsts;
2861 }
2862 p = hostapd_eid_vht_capabilities(hapd, p, nsts);
2863 p = hostapd_eid_vht_operation(hapd, p);
2864 }
2865 #endif /* CONFIG_IEEE80211AC */
2866
2867 p = hostapd_eid_ext_capab(hapd, p);
2868 p = hostapd_eid_bss_max_idle_period(hapd, p);
2869 if (sta && sta->qos_map_enabled)
2870 p = hostapd_eid_qos_map_set(hapd, p);
2871
2872 #ifdef CONFIG_FST
2873 if (hapd->iface->fst_ies) {
2874 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
2875 wpabuf_len(hapd->iface->fst_ies));
2876 p += wpabuf_len(hapd->iface->fst_ies);
2877 }
2878 #endif /* CONFIG_FST */
2879
2880 #ifdef CONFIG_IEEE80211AC
2881 if (sta && hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
2882 p = hostapd_eid_vendor_vht(hapd, p);
2883 #endif /* CONFIG_IEEE80211AC */
2884
2885 if (sta && (sta->flags & WLAN_STA_WMM))
2886 p = hostapd_eid_wmm(hapd, p);
2887
2888 #ifdef CONFIG_WPS
2889 if (sta &&
2890 ((sta->flags & WLAN_STA_WPS) ||
2891 ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa))) {
2892 struct wpabuf *wps = wps_build_assoc_resp_ie();
2893 if (wps) {
2894 os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
2895 p += wpabuf_len(wps);
2896 wpabuf_free(wps);
2897 }
2898 }
2899 #endif /* CONFIG_WPS */
2900
2901 #ifdef CONFIG_P2P
2902 if (sta && sta->p2p_ie && hapd->p2p_group) {
2903 struct wpabuf *p2p_resp_ie;
2904 enum p2p_status_code status;
2905 switch (status_code) {
2906 case WLAN_STATUS_SUCCESS:
2907 status = P2P_SC_SUCCESS;
2908 break;
2909 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
2910 status = P2P_SC_FAIL_LIMIT_REACHED;
2911 break;
2912 default:
2913 status = P2P_SC_FAIL_INVALID_PARAMS;
2914 break;
2915 }
2916 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
2917 if (p2p_resp_ie) {
2918 os_memcpy(p, wpabuf_head(p2p_resp_ie),
2919 wpabuf_len(p2p_resp_ie));
2920 p += wpabuf_len(p2p_resp_ie);
2921 wpabuf_free(p2p_resp_ie);
2922 }
2923 }
2924 #endif /* CONFIG_P2P */
2925
2926 #ifdef CONFIG_P2P_MANAGER
2927 if (hapd->conf->p2p & P2P_MANAGE)
2928 p = hostapd_eid_p2p_manage(hapd, p);
2929 #endif /* CONFIG_P2P_MANAGER */
2930
2931 p = hostapd_eid_mbo(hapd, p, buf + buflen - p);
2932
2933 if (hapd->conf->assocresp_elements &&
2934 (size_t) (buf + buflen - p) >=
2935 wpabuf_len(hapd->conf->assocresp_elements)) {
2936 os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
2937 wpabuf_len(hapd->conf->assocresp_elements));
2938 p += wpabuf_len(hapd->conf->assocresp_elements);
2939 }
2940
2941 send_len += p - reply->u.assoc_resp.variable;
2942
2943 #ifdef CONFIG_FILS
2944 if (sta &&
2945 (sta->auth_alg == WLAN_AUTH_FILS_SK ||
2946 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
2947 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
2948 status_code == WLAN_STATUS_SUCCESS) {
2949 struct ieee802_11_elems elems;
2950
2951 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
2952 ParseFailed || !elems.fils_session) {
2953 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2954 goto done;
2955 }
2956
2957 /* FILS Session */
2958 *p++ = WLAN_EID_EXTENSION; /* Element ID */
2959 *p++ = 1 + FILS_SESSION_LEN; /* Length */
2960 *p++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */
2961 os_memcpy(p, elems.fils_session, FILS_SESSION_LEN);
2962 send_len += 2 + 1 + FILS_SESSION_LEN;
2963
2964 send_len = fils_encrypt_assoc(sta->wpa_sm, buf, send_len,
2965 buflen, sta->fils_hlp_resp);
2966 if (send_len < 0) {
2967 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2968 goto done;
2969 }
2970 }
2971 #endif /* CONFIG_FILS */
2972
2973 #ifdef CONFIG_OWE
2974 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
2975 sta && sta->owe_ecdh &&
2976 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE) {
2977 struct wpabuf *pub;
2978
2979 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
2980 if (!pub) {
2981 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2982 goto done;
2983 }
2984 /* OWE Diffie-Hellman Parameter element */
2985 *p++ = WLAN_EID_EXTENSION; /* Element ID */
2986 *p++ = 1 + 2 + wpabuf_len(pub); /* Length */
2987 *p++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */
2988 WPA_PUT_LE16(p, sta->owe_group);
2989 p += 2;
2990 os_memcpy(p, wpabuf_head(pub), wpabuf_len(pub));
2991 p += wpabuf_len(pub);
2992 send_len += 3 + 2 + wpabuf_len(pub);
2993 wpabuf_free(pub);
2994 }
2995 #endif /* CONFIG_OWE */
2996
2997 if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
2998 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
2999 strerror(errno));
3000 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3001 }
3002
3003 done:
3004 os_free(buf);
3005 return res;
3006 }
3007
3008
3009 #ifdef CONFIG_OWE
3010 u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta,
3011 const u8 *owe_dh, u8 owe_dh_len,
3012 u8 *owe_buf, size_t owe_buf_len, u16 *reason)
3013 {
3014 #ifdef CONFIG_TESTING_OPTIONS
3015 if (hapd->conf->own_ie_override) {
3016 wpa_printf(MSG_DEBUG, "OWE: Using IE override");
3017 *reason = WLAN_STATUS_SUCCESS;
3018 return wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3019 owe_buf_len, NULL, 0);
3020 }
3021 #endif /* CONFIG_TESTING_OPTIONS */
3022
3023 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
3024 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
3025 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3026 owe_buf_len, NULL, 0);
3027 *reason = WLAN_STATUS_SUCCESS;
3028 return owe_buf;
3029 }
3030
3031 *reason = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len);
3032 if (*reason != WLAN_STATUS_SUCCESS)
3033 return NULL;
3034
3035 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3036 owe_buf_len, NULL, 0);
3037
3038 if (sta->owe_ecdh && owe_buf) {
3039 struct wpabuf *pub;
3040
3041 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
3042 if (!pub) {
3043 *reason = WLAN_STATUS_UNSPECIFIED_FAILURE;
3044 return owe_buf;
3045 }
3046
3047 /* OWE Diffie-Hellman Parameter element */
3048 *owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */
3049 *owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */
3050 *owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension
3051 */
3052 WPA_PUT_LE16(owe_buf, sta->owe_group);
3053 owe_buf += 2;
3054 os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub));
3055 owe_buf += wpabuf_len(pub);
3056 wpabuf_free(pub);
3057 }
3058
3059 return owe_buf;
3060 }
3061 #endif /* CONFIG_OWE */
3062
3063
3064 #ifdef CONFIG_FILS
3065
3066 void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta)
3067 {
3068 u16 reply_res;
3069
3070 wpa_printf(MSG_DEBUG, "FILS: Finish association with " MACSTR,
3071 MAC2STR(sta->addr));
3072 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3073 if (!sta->fils_pending_assoc_req)
3074 return;
3075 reply_res = send_assoc_resp(hapd, sta, sta->addr, WLAN_STATUS_SUCCESS,
3076 sta->fils_pending_assoc_is_reassoc,
3077 sta->fils_pending_assoc_req,
3078 sta->fils_pending_assoc_req_len);
3079 os_free(sta->fils_pending_assoc_req);
3080 sta->fils_pending_assoc_req = NULL;
3081 sta->fils_pending_assoc_req_len = 0;
3082 wpabuf_free(sta->fils_hlp_resp);
3083 sta->fils_hlp_resp = NULL;
3084 wpabuf_free(sta->hlp_dhcp_discover);
3085 sta->hlp_dhcp_discover = NULL;
3086
3087 /*
3088 * Remove the station in case transmission of a success response fails.
3089 * At this point the station was already added associated to the driver.
3090 */
3091 if (reply_res != WLAN_STATUS_SUCCESS)
3092 hostapd_drv_sta_remove(hapd, sta->addr);
3093 }
3094
3095
3096 void fils_hlp_timeout(void *eloop_ctx, void *eloop_data)
3097 {
3098 struct hostapd_data *hapd = eloop_ctx;
3099 struct sta_info *sta = eloop_data;
3100
3101 wpa_printf(MSG_DEBUG,
3102 "FILS: HLP response timeout - continue with association response for "
3103 MACSTR, MAC2STR(sta->addr));
3104 if (sta->fils_drv_assoc_finish)
3105 hostapd_notify_assoc_fils_finish(hapd, sta);
3106 else
3107 fils_hlp_finish_assoc(hapd, sta);
3108 }
3109
3110 #endif /* CONFIG_FILS */
3111
3112
3113 static void handle_assoc(struct hostapd_data *hapd,
3114 const struct ieee80211_mgmt *mgmt, size_t len,
3115 int reassoc)
3116 {
3117 u16 capab_info, listen_interval, seq_ctrl, fc;
3118 u16 resp = WLAN_STATUS_SUCCESS, reply_res;
3119 const u8 *pos;
3120 int left, i;
3121 struct sta_info *sta;
3122 u8 *tmp = NULL;
3123 struct hostapd_sta_wpa_psk_short *psk = NULL;
3124 char *identity = NULL;
3125 char *radius_cui = NULL;
3126 #ifdef CONFIG_FILS
3127 int delay_assoc = 0;
3128 #endif /* CONFIG_FILS */
3129
3130 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
3131 sizeof(mgmt->u.assoc_req))) {
3132 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
3133 reassoc, (unsigned long) len);
3134 return;
3135 }
3136
3137 #ifdef CONFIG_TESTING_OPTIONS
3138 if (reassoc) {
3139 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
3140 drand48() < hapd->iconf->ignore_reassoc_probability) {
3141 wpa_printf(MSG_INFO,
3142 "TESTING: ignoring reassoc request from "
3143 MACSTR, MAC2STR(mgmt->sa));
3144 return;
3145 }
3146 } else {
3147 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
3148 drand48() < hapd->iconf->ignore_assoc_probability) {
3149 wpa_printf(MSG_INFO,
3150 "TESTING: ignoring assoc request from "
3151 MACSTR, MAC2STR(mgmt->sa));
3152 return;
3153 }
3154 }
3155 #endif /* CONFIG_TESTING_OPTIONS */
3156
3157 fc = le_to_host16(mgmt->frame_control);
3158 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
3159
3160 if (reassoc) {
3161 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
3162 listen_interval = le_to_host16(
3163 mgmt->u.reassoc_req.listen_interval);
3164 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
3165 " capab_info=0x%02x listen_interval=%d current_ap="
3166 MACSTR " seq_ctrl=0x%x%s",
3167 MAC2STR(mgmt->sa), capab_info, listen_interval,
3168 MAC2STR(mgmt->u.reassoc_req.current_ap),
3169 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
3170 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
3171 pos = mgmt->u.reassoc_req.variable;
3172 } else {
3173 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
3174 listen_interval = le_to_host16(
3175 mgmt->u.assoc_req.listen_interval);
3176 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
3177 " capab_info=0x%02x listen_interval=%d "
3178 "seq_ctrl=0x%x%s",
3179 MAC2STR(mgmt->sa), capab_info, listen_interval,
3180 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
3181 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
3182 pos = mgmt->u.assoc_req.variable;
3183 }
3184
3185 sta = ap_get_sta(hapd, mgmt->sa);
3186 #ifdef CONFIG_IEEE80211R_AP
3187 if (sta && sta->auth_alg == WLAN_AUTH_FT &&
3188 (sta->flags & WLAN_STA_AUTH) == 0) {
3189 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
3190 "prior to authentication since it is using "
3191 "over-the-DS FT", MAC2STR(mgmt->sa));
3192
3193 /*
3194 * Mark station as authenticated, to avoid adding station
3195 * entry in the driver as associated and not authenticated
3196 */
3197 sta->flags |= WLAN_STA_AUTH;
3198 } else
3199 #endif /* CONFIG_IEEE80211R_AP */
3200 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
3201 if (hapd->iface->current_mode &&
3202 hapd->iface->current_mode->mode ==
3203 HOSTAPD_MODE_IEEE80211AD) {
3204 int acl_res;
3205 u32 session_timeout, acct_interim_interval;
3206 struct vlan_description vlan_id;
3207
3208 acl_res = ieee802_11_allowed_address(
3209 hapd, mgmt->sa, (const u8 *) mgmt, len,
3210 &session_timeout, &acct_interim_interval,
3211 &vlan_id, &psk, &identity, &radius_cui, 0);
3212 if (acl_res == HOSTAPD_ACL_REJECT) {
3213 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
3214 "Ignore Association Request frame from "
3215 MACSTR " due to ACL reject",
3216 MAC2STR(mgmt->sa));
3217 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3218 goto fail;
3219 }
3220 if (acl_res == HOSTAPD_ACL_PENDING)
3221 return;
3222
3223 /* DMG/IEEE 802.11ad does not use authentication.
3224 * Allocate sta entry upon association. */
3225 sta = ap_sta_add(hapd, mgmt->sa);
3226 if (!sta) {
3227 hostapd_logger(hapd, mgmt->sa,
3228 HOSTAPD_MODULE_IEEE80211,
3229 HOSTAPD_LEVEL_INFO,
3230 "Failed to add STA");
3231 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3232 goto fail;
3233 }
3234
3235 acl_res = ieee802_11_set_radius_info(
3236 hapd, sta, acl_res, session_timeout,
3237 acct_interim_interval, &vlan_id, &psk,
3238 &identity, &radius_cui);
3239 if (acl_res) {
3240 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3241 goto fail;
3242 }
3243
3244 hostapd_logger(hapd, sta->addr,
3245 HOSTAPD_MODULE_IEEE80211,
3246 HOSTAPD_LEVEL_DEBUG,
3247 "Skip authentication for DMG/IEEE 802.11ad");
3248 sta->flags |= WLAN_STA_AUTH;
3249 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
3250 sta->auth_alg = WLAN_AUTH_OPEN;
3251 } else {
3252 hostapd_logger(hapd, mgmt->sa,
3253 HOSTAPD_MODULE_IEEE80211,
3254 HOSTAPD_LEVEL_INFO,
3255 "Station tried to associate before authentication (aid=%d flags=0x%x)",
3256 sta ? sta->aid : -1,
3257 sta ? sta->flags : 0);
3258 send_deauth(hapd, mgmt->sa,
3259 WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
3260 return;
3261 }
3262 }
3263
3264 if ((fc & WLAN_FC_RETRY) &&
3265 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
3266 sta->last_seq_ctrl == seq_ctrl &&
3267 sta->last_subtype == (reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3268 WLAN_FC_STYPE_ASSOC_REQ)) {
3269 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3270 HOSTAPD_LEVEL_DEBUG,
3271 "Drop repeated association frame seq_ctrl=0x%x",
3272 seq_ctrl);
3273 return;
3274 }
3275 sta->last_seq_ctrl = seq_ctrl;
3276 sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3277 WLAN_FC_STYPE_ASSOC_REQ;
3278
3279 if (hapd->tkip_countermeasures) {
3280 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3281 goto fail;
3282 }
3283
3284 if (listen_interval > hapd->conf->max_listen_interval) {
3285 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3286 HOSTAPD_LEVEL_DEBUG,
3287 "Too large Listen Interval (%d)",
3288 listen_interval);
3289 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
3290 goto fail;
3291 }
3292
3293 #ifdef CONFIG_MBO
3294 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
3295 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3296 goto fail;
3297 }
3298 #endif /* CONFIG_MBO */
3299
3300 /*
3301 * sta->capability is used in check_assoc_ies() for RRM enabled
3302 * capability element.
3303 */
3304 sta->capability = capab_info;
3305
3306 #ifdef CONFIG_FILS
3307 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3308 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3309 sta->auth_alg == WLAN_AUTH_FILS_PK) {
3310 int res;
3311
3312 /* The end of the payload is encrypted. Need to decrypt it
3313 * before parsing. */
3314
3315 tmp = os_memdup(pos, left);
3316 if (!tmp) {
3317 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3318 goto fail;
3319 }
3320
3321 res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
3322 len, tmp, left);
3323 if (res < 0) {
3324 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3325 goto fail;
3326 }
3327 pos = tmp;
3328 left = res;
3329 }
3330 #endif /* CONFIG_FILS */
3331
3332 /* followed by SSID and Supported rates; and HT capabilities if 802.11n
3333 * is used */
3334 resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
3335 if (resp != WLAN_STATUS_SUCCESS)
3336 goto fail;
3337
3338 if (hostapd_get_aid(hapd, sta) < 0) {
3339 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3340 HOSTAPD_LEVEL_INFO, "No room for more AIDs");
3341 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3342 goto fail;
3343 }
3344
3345 sta->listen_interval = listen_interval;
3346
3347 if (hapd->iface->current_mode &&
3348 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
3349 sta->flags |= WLAN_STA_NONERP;
3350 for (i = 0; i < sta->supported_rates_len; i++) {
3351 if ((sta->supported_rates[i] & 0x7f) > 22) {
3352 sta->flags &= ~WLAN_STA_NONERP;
3353 break;
3354 }
3355 }
3356 if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
3357 sta->nonerp_set = 1;
3358 hapd->iface->num_sta_non_erp++;
3359 if (hapd->iface->num_sta_non_erp == 1)
3360 ieee802_11_set_beacons(hapd->iface);
3361 }
3362
3363 if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
3364 !sta->no_short_slot_time_set) {
3365 sta->no_short_slot_time_set = 1;
3366 hapd->iface->num_sta_no_short_slot_time++;
3367 if (hapd->iface->current_mode &&
3368 hapd->iface->current_mode->mode ==
3369 HOSTAPD_MODE_IEEE80211G &&
3370 hapd->iface->num_sta_no_short_slot_time == 1)
3371 ieee802_11_set_beacons(hapd->iface);
3372 }
3373
3374 if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3375 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
3376 else
3377 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3378
3379 if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
3380 !sta->no_short_preamble_set) {
3381 sta->no_short_preamble_set = 1;
3382 hapd->iface->num_sta_no_short_preamble++;
3383 if (hapd->iface->current_mode &&
3384 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
3385 && hapd->iface->num_sta_no_short_preamble == 1)
3386 ieee802_11_set_beacons(hapd->iface);
3387 }
3388
3389 #ifdef CONFIG_IEEE80211N
3390 update_ht_state(hapd, sta);
3391 #endif /* CONFIG_IEEE80211N */
3392
3393 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3394 HOSTAPD_LEVEL_DEBUG,
3395 "association OK (aid %d)", sta->aid);
3396 /* Station will be marked associated, after it acknowledges AssocResp
3397 */
3398 sta->flags |= WLAN_STA_ASSOC_REQ_OK;
3399
3400 #ifdef CONFIG_IEEE80211W
3401 if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
3402 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
3403 "SA Query procedure", reassoc ? "re" : "");
3404 /* TODO: Send a protected Disassociate frame to the STA using
3405 * the old key and Reason Code "Previous Authentication no
3406 * longer valid". Make sure this is only sent protected since
3407 * unprotected frame would be received by the STA that is now
3408 * trying to associate.
3409 */
3410 }
3411 #endif /* CONFIG_IEEE80211W */
3412
3413 /* Make sure that the previously registered inactivity timer will not
3414 * remove the STA immediately. */
3415 sta->timeout_next = STA_NULLFUNC;
3416
3417 #ifdef CONFIG_TAXONOMY
3418 taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
3419 #endif /* CONFIG_TAXONOMY */
3420
3421 sta->pending_wds_enable = 0;
3422
3423 #ifdef CONFIG_FILS
3424 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3425 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3426 sta->auth_alg == WLAN_AUTH_FILS_PK) {
3427 if (fils_process_hlp(hapd, sta, pos, left) > 0)
3428 delay_assoc = 1;
3429 }
3430 #endif /* CONFIG_FILS */
3431
3432 fail:
3433 os_free(identity);
3434 os_free(radius_cui);
3435 hostapd_free_psk_list(psk);
3436
3437 /*
3438 * In case of a successful response, add the station to the driver.
3439 * Otherwise, the kernel may ignore Data frames before we process the
3440 * ACK frame (TX status). In case of a failure, this station will be
3441 * removed.
3442 *
3443 * Note that this is not compliant with the IEEE 802.11 standard that
3444 * states that a non-AP station should transition into the
3445 * authenticated/associated state only after the station acknowledges
3446 * the (Re)Association Response frame. However, still do this as:
3447 *
3448 * 1. In case the station does not acknowledge the (Re)Association
3449 * Response frame, it will be removed.
3450 * 2. Data frames will be dropped in the kernel until the station is
3451 * set into authorized state, and there are no significant known
3452 * issues with processing other non-Data Class 3 frames during this
3453 * window.
3454 */
3455 if (resp == WLAN_STATUS_SUCCESS && sta && add_associated_sta(hapd, sta))
3456 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3457
3458 #ifdef CONFIG_FILS
3459 if (sta) {
3460 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3461 os_free(sta->fils_pending_assoc_req);
3462 sta->fils_pending_assoc_req = NULL;
3463 sta->fils_pending_assoc_req_len = 0;
3464 wpabuf_free(sta->fils_hlp_resp);
3465 sta->fils_hlp_resp = NULL;
3466 }
3467 if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS) {
3468 sta->fils_pending_assoc_req = tmp;
3469 sta->fils_pending_assoc_req_len = left;
3470 sta->fils_pending_assoc_is_reassoc = reassoc;
3471 sta->fils_drv_assoc_finish = 0;
3472 wpa_printf(MSG_DEBUG,
3473 "FILS: Waiting for HLP processing before sending (Re)Association Response frame to "
3474 MACSTR, MAC2STR(sta->addr));
3475 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3476 eloop_register_timeout(0, hapd->conf->fils_hlp_wait_time * 1024,
3477 fils_hlp_timeout, hapd, sta);
3478 return;
3479 }
3480 #endif /* CONFIG_FILS */
3481
3482 reply_res = send_assoc_resp(hapd, sta, mgmt->sa, resp, reassoc, pos,
3483 left);
3484 os_free(tmp);
3485
3486 /*
3487 * Remove the station in case tranmission of a success response fails
3488 * (the STA was added associated to the driver) or if the station was
3489 * previously added unassociated.
3490 */
3491 if (sta && ((reply_res != WLAN_STATUS_SUCCESS &&
3492 resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc)) {
3493 hostapd_drv_sta_remove(hapd, sta->addr);
3494 sta->added_unassoc = 0;
3495 }
3496 }
3497
3498
3499 static void handle_disassoc(struct hostapd_data *hapd,
3500 const struct ieee80211_mgmt *mgmt, size_t len)
3501 {
3502 struct sta_info *sta;
3503
3504 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
3505 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
3506 (unsigned long) len);
3507 return;
3508 }
3509
3510 wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
3511 MAC2STR(mgmt->sa),
3512 le_to_host16(mgmt->u.disassoc.reason_code));
3513
3514 sta = ap_get_sta(hapd, mgmt->sa);
3515 if (sta == NULL) {
3516 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
3517 MAC2STR(mgmt->sa));
3518 return;
3519 }
3520
3521 ap_sta_set_authorized(hapd, sta, 0);
3522 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
3523 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
3524 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
3525 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3526 HOSTAPD_LEVEL_INFO, "disassociated");
3527 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
3528 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
3529 /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
3530 * authenticated. */
3531 accounting_sta_stop(hapd, sta);
3532 ieee802_1x_free_station(hapd, sta);
3533 if (sta->ipaddr)
3534 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
3535 ap_sta_ip6addr_del(hapd, sta);
3536 hostapd_drv_sta_remove(hapd, sta->addr);
3537 sta->added_unassoc = 0;
3538
3539 if (sta->timeout_next == STA_NULLFUNC ||
3540 sta->timeout_next == STA_DISASSOC) {
3541 sta->timeout_next = STA_DEAUTH;
3542 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
3543 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
3544 hapd, sta);
3545 }
3546
3547 mlme_disassociate_indication(
3548 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
3549
3550 /* DMG/IEEE 802.11ad does not use deauthication. Deallocate sta upon
3551 * disassociation. */
3552 if (hapd->iface->current_mode &&
3553 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
3554 sta->flags &= ~WLAN_STA_AUTH;
3555 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
3556 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3557 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
3558 ap_free_sta(hapd, sta);
3559 }
3560 }
3561
3562
3563 static void handle_deauth(struct hostapd_data *hapd,
3564 const struct ieee80211_mgmt *mgmt, size_t len)
3565 {
3566 struct sta_info *sta;
3567
3568 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
3569 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
3570 "payload (len=%lu)", (unsigned long) len);
3571 return;
3572 }
3573
3574 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
3575 " reason_code=%d",
3576 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
3577
3578 sta = ap_get_sta(hapd, mgmt->sa);
3579 if (sta == NULL) {
3580 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
3581 "to deauthenticate, but it is not authenticated",
3582 MAC2STR(mgmt->sa));
3583 return;
3584 }
3585
3586 ap_sta_set_authorized(hapd, sta, 0);
3587 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
3588 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
3589 WLAN_STA_ASSOC_REQ_OK);
3590 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
3591 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3592 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
3593 mlme_deauthenticate_indication(
3594 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
3595 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
3596 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
3597 ap_free_sta(hapd, sta);
3598 }
3599
3600
3601 static void handle_beacon(struct hostapd_data *hapd,
3602 const struct ieee80211_mgmt *mgmt, size_t len,
3603 struct hostapd_frame_info *fi)
3604 {
3605 struct ieee802_11_elems elems;
3606
3607 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
3608 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
3609 (unsigned long) len);
3610 return;
3611 }
3612
3613 (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
3614 len - (IEEE80211_HDRLEN +
3615 sizeof(mgmt->u.beacon)), &elems,
3616 0);
3617
3618 ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
3619 }
3620
3621
3622 #ifdef CONFIG_IEEE80211W
3623
3624 static int hostapd_sa_query_action(struct hostapd_data *hapd,
3625 const struct ieee80211_mgmt *mgmt,
3626 size_t len)
3627 {
3628 const u8 *end;
3629
3630 end = mgmt->u.action.u.sa_query_resp.trans_id +
3631 WLAN_SA_QUERY_TR_ID_LEN;
3632 if (((u8 *) mgmt) + len < end) {
3633 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
3634 "frame (len=%lu)", (unsigned long) len);
3635 return 0;
3636 }
3637
3638 ieee802_11_sa_query_action(hapd, mgmt->sa,
3639 mgmt->u.action.u.sa_query_resp.action,
3640 mgmt->u.action.u.sa_query_resp.trans_id);
3641 return 1;
3642 }
3643
3644
3645 static int robust_action_frame(u8 category)
3646 {
3647 return category != WLAN_ACTION_PUBLIC &&
3648 category != WLAN_ACTION_HT;
3649 }
3650 #endif /* CONFIG_IEEE80211W */
3651
3652
3653 static int handle_action(struct hostapd_data *hapd,
3654 const struct ieee80211_mgmt *mgmt, size_t len,
3655 unsigned int freq)
3656 {
3657 struct sta_info *sta;
3658 sta = ap_get_sta(hapd, mgmt->sa);
3659
3660 if (len < IEEE80211_HDRLEN + 1) {
3661 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3662 HOSTAPD_LEVEL_DEBUG,
3663 "handle_action - too short payload (len=%lu)",
3664 (unsigned long) len);
3665 return 0;
3666 }
3667
3668 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
3669 (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
3670 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
3671 "frame (category=%u) from unassociated STA " MACSTR,
3672 mgmt->u.action.category, MAC2STR(mgmt->sa));
3673 return 0;
3674 }
3675
3676 #ifdef CONFIG_IEEE80211W
3677 if (sta && (sta->flags & WLAN_STA_MFP) &&
3678 !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
3679 robust_action_frame(mgmt->u.action.category)) {
3680 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3681 HOSTAPD_LEVEL_DEBUG,
3682 "Dropped unprotected Robust Action frame from "
3683 "an MFP STA");
3684 return 0;
3685 }
3686 #endif /* CONFIG_IEEE80211W */
3687
3688 if (sta) {
3689 u16 fc = le_to_host16(mgmt->frame_control);
3690 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
3691
3692 if ((fc & WLAN_FC_RETRY) &&
3693 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
3694 sta->last_seq_ctrl == seq_ctrl &&
3695 sta->last_subtype == WLAN_FC_STYPE_ACTION) {
3696 hostapd_logger(hapd, sta->addr,
3697 HOSTAPD_MODULE_IEEE80211,
3698 HOSTAPD_LEVEL_DEBUG,
3699 "Drop repeated action frame seq_ctrl=0x%x",
3700 seq_ctrl);
3701 return 1;
3702 }
3703
3704 sta->last_seq_ctrl = seq_ctrl;
3705 sta->last_subtype = WLAN_FC_STYPE_ACTION;
3706 }
3707
3708 switch (mgmt->u.action.category) {
3709 #ifdef CONFIG_IEEE80211R_AP
3710 case WLAN_ACTION_FT:
3711 if (!sta ||
3712 wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
3713 len - IEEE80211_HDRLEN))
3714 break;
3715 return 1;
3716 #endif /* CONFIG_IEEE80211R_AP */
3717 case WLAN_ACTION_WMM:
3718 hostapd_wmm_action(hapd, mgmt, len);
3719 return 1;
3720 #ifdef CONFIG_IEEE80211W
3721 case WLAN_ACTION_SA_QUERY:
3722 return hostapd_sa_query_action(hapd, mgmt, len);
3723 #endif /* CONFIG_IEEE80211W */
3724 #ifdef CONFIG_WNM_AP
3725 case WLAN_ACTION_WNM:
3726 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
3727 return 1;
3728 #endif /* CONFIG_WNM_AP */
3729 #ifdef CONFIG_FST
3730 case WLAN_ACTION_FST:
3731 if (hapd->iface->fst)
3732 fst_rx_action(hapd->iface->fst, mgmt, len);
3733 else
3734 wpa_printf(MSG_DEBUG,
3735 "FST: Ignore FST Action frame - no FST attached");
3736 return 1;
3737 #endif /* CONFIG_FST */
3738 case WLAN_ACTION_PUBLIC:
3739 case WLAN_ACTION_PROTECTED_DUAL:
3740 #ifdef CONFIG_IEEE80211N
3741 if (len >= IEEE80211_HDRLEN + 2 &&
3742 mgmt->u.action.u.public_action.action ==
3743 WLAN_PA_20_40_BSS_COEX) {
3744 hostapd_2040_coex_action(hapd, mgmt, len);
3745 return 1;
3746 }
3747 #endif /* CONFIG_IEEE80211N */
3748 #ifdef CONFIG_DPP
3749 if (len >= IEEE80211_HDRLEN + 6 &&
3750 mgmt->u.action.u.vs_public_action.action ==
3751 WLAN_PA_VENDOR_SPECIFIC &&
3752 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
3753 OUI_WFA &&
3754 mgmt->u.action.u.vs_public_action.variable[0] ==
3755 DPP_OUI_TYPE) {
3756 const u8 *pos, *end;
3757
3758 pos = mgmt->u.action.u.vs_public_action.oui;
3759 end = ((const u8 *) mgmt) + len;
3760 hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos,
3761 freq);
3762 return 1;
3763 }
3764 if (len >= IEEE80211_HDRLEN + 2 &&
3765 (mgmt->u.action.u.public_action.action ==
3766 WLAN_PA_GAS_INITIAL_RESP ||
3767 mgmt->u.action.u.public_action.action ==
3768 WLAN_PA_GAS_COMEBACK_RESP)) {
3769 const u8 *pos, *end;
3770
3771 pos = &mgmt->u.action.u.public_action.action;
3772 end = ((const u8 *) mgmt) + len;
3773 gas_query_ap_rx(hapd->gas, mgmt->sa,
3774 mgmt->u.action.category,
3775 pos, end - pos, hapd->iface->freq);
3776 return 1;
3777 }
3778 #endif /* CONFIG_DPP */
3779 if (hapd->public_action_cb) {
3780 hapd->public_action_cb(hapd->public_action_cb_ctx,
3781 (u8 *) mgmt, len,
3782 hapd->iface->freq);
3783 }
3784 if (hapd->public_action_cb2) {
3785 hapd->public_action_cb2(hapd->public_action_cb2_ctx,
3786 (u8 *) mgmt, len,
3787 hapd->iface->freq);
3788 }
3789 if (hapd->public_action_cb || hapd->public_action_cb2)
3790 return 1;
3791 break;
3792 case WLAN_ACTION_VENDOR_SPECIFIC:
3793 if (hapd->vendor_action_cb) {
3794 if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
3795 (u8 *) mgmt, len,
3796 hapd->iface->freq) == 0)
3797 return 1;
3798 }
3799 break;
3800 case WLAN_ACTION_RADIO_MEASUREMENT:
3801 hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
3802 return 1;
3803 }
3804
3805 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3806 HOSTAPD_LEVEL_DEBUG,
3807 "handle_action - unknown action category %d or invalid "
3808 "frame",
3809 mgmt->u.action.category);
3810 if (!is_multicast_ether_addr(mgmt->da) &&
3811 !(mgmt->u.action.category & 0x80) &&
3812 !is_multicast_ether_addr(mgmt->sa)) {
3813 struct ieee80211_mgmt *resp;
3814
3815 /*
3816 * IEEE 802.11-REVma/D9.0 - 7.3.1.11
3817 * Return the Action frame to the source without change
3818 * except that MSB of the Category set to 1.
3819 */
3820 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
3821 "frame back to sender");
3822 resp = os_memdup(mgmt, len);
3823 if (resp == NULL)
3824 return 0;
3825 os_memcpy(resp->da, resp->sa, ETH_ALEN);
3826 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
3827 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
3828 resp->u.action.category |= 0x80;
3829
3830 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
3831 wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
3832 "Action frame");
3833 }
3834 os_free(resp);
3835 }
3836
3837 return 1;
3838 }
3839
3840
3841 /**
3842 * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
3843 * @hapd: hostapd BSS data structure (the BSS to which the management frame was
3844 * sent to)
3845 * @buf: management frame data (starting from IEEE 802.11 header)
3846 * @len: length of frame data in octets
3847 * @fi: meta data about received frame (signal level, etc.)
3848 *
3849 * Process all incoming IEEE 802.11 management frames. This will be called for
3850 * each frame received from the kernel driver through wlan#ap interface. In
3851 * addition, it can be called to re-inserted pending frames (e.g., when using
3852 * external RADIUS server as an MAC ACL).
3853 */
3854 int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
3855 struct hostapd_frame_info *fi)
3856 {
3857 struct ieee80211_mgmt *mgmt;
3858 u16 fc, stype;
3859 int ret = 0;
3860 unsigned int freq;
3861 int ssi_signal = fi ? fi->ssi_signal : 0;
3862
3863 if (len < 24)
3864 return 0;
3865
3866 if (fi && fi->freq)
3867 freq = fi->freq;
3868 else
3869 freq = hapd->iface->freq;
3870
3871 mgmt = (struct ieee80211_mgmt *) buf;
3872 fc = le_to_host16(mgmt->frame_control);
3873 stype = WLAN_FC_GET_STYPE(fc);
3874
3875 if (stype == WLAN_FC_STYPE_BEACON) {
3876 handle_beacon(hapd, mgmt, len, fi);
3877 return 1;
3878 }
3879
3880 if (!is_broadcast_ether_addr(mgmt->bssid) &&
3881 #ifdef CONFIG_P2P
3882 /* Invitation responses can be sent with the peer MAC as BSSID */
3883 !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
3884 stype == WLAN_FC_STYPE_ACTION) &&
3885 #endif /* CONFIG_P2P */
3886 #ifdef CONFIG_MESH
3887 !(hapd->conf->mesh & MESH_ENABLED) &&
3888 #endif /* CONFIG_MESH */
3889 os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
3890 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
3891 MAC2STR(mgmt->bssid));
3892 return 0;
3893 }
3894
3895
3896 if (stype == WLAN_FC_STYPE_PROBE_REQ) {
3897 handle_probe_req(hapd, mgmt, len, ssi_signal);
3898 return 1;
3899 }
3900
3901 if ((!is_broadcast_ether_addr(mgmt->da) ||
3902 stype != WLAN_FC_STYPE_ACTION) &&
3903 os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
3904 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3905 HOSTAPD_LEVEL_DEBUG,
3906 "MGMT: DA=" MACSTR " not our address",
3907 MAC2STR(mgmt->da));
3908 return 0;
3909 }
3910
3911 if (hapd->iconf->track_sta_max_num)
3912 sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
3913
3914 switch (stype) {
3915 case WLAN_FC_STYPE_AUTH:
3916 wpa_printf(MSG_DEBUG, "mgmt::auth");
3917 handle_auth(hapd, mgmt, len);
3918 ret = 1;
3919 break;
3920 case WLAN_FC_STYPE_ASSOC_REQ:
3921 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
3922 handle_assoc(hapd, mgmt, len, 0);
3923 ret = 1;
3924 break;
3925 case WLAN_FC_STYPE_REASSOC_REQ:
3926 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
3927 handle_assoc(hapd, mgmt, len, 1);
3928 ret = 1;
3929 break;
3930 case WLAN_FC_STYPE_DISASSOC:
3931 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
3932 handle_disassoc(hapd, mgmt, len);
3933 ret = 1;
3934 break;
3935 case WLAN_FC_STYPE_DEAUTH:
3936 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
3937 handle_deauth(hapd, mgmt, len);
3938 ret = 1;
3939 break;
3940 case WLAN_FC_STYPE_ACTION:
3941 wpa_printf(MSG_DEBUG, "mgmt::action");
3942 ret = handle_action(hapd, mgmt, len, freq);
3943 break;
3944 default:
3945 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3946 HOSTAPD_LEVEL_DEBUG,
3947 "unknown mgmt frame subtype %d", stype);
3948 break;
3949 }
3950
3951 return ret;
3952 }
3953
3954
3955 static void handle_auth_cb(struct hostapd_data *hapd,
3956 const struct ieee80211_mgmt *mgmt,
3957 size_t len, int ok)
3958 {
3959 u16 auth_alg, auth_transaction, status_code;
3960 struct sta_info *sta;
3961
3962 sta = ap_get_sta(hapd, mgmt->da);
3963 if (!sta) {
3964 wpa_printf(MSG_INFO, "handle_auth_cb: STA " MACSTR " not found",
3965 MAC2STR(mgmt->da));
3966 return;
3967 }
3968
3969 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
3970 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
3971 status_code = le_to_host16(mgmt->u.auth.status_code);
3972
3973 if (!ok) {
3974 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
3975 HOSTAPD_LEVEL_NOTICE,
3976 "did not acknowledge authentication response");
3977 goto fail;
3978 }
3979
3980 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
3981 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
3982 (unsigned long) len);
3983 goto fail;
3984 }
3985
3986 if (status_code == WLAN_STATUS_SUCCESS &&
3987 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
3988 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
3989 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3990 HOSTAPD_LEVEL_INFO, "authenticated");
3991 sta->flags |= WLAN_STA_AUTH;
3992 if (sta->added_unassoc)
3993 hostapd_set_sta_flags(hapd, sta);
3994 return;
3995 }
3996
3997 fail:
3998 if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) {
3999 hostapd_drv_sta_remove(hapd, sta->addr);
4000 sta->added_unassoc = 0;
4001 }
4002 }
4003
4004
4005 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
4006 struct sta_info *sta,
4007 char *ifname_wds)
4008 {
4009 int i;
4010 struct hostapd_ssid *ssid = &hapd->conf->ssid;
4011
4012 if (hapd->conf->ieee802_1x || hapd->conf->wpa)
4013 return;
4014
4015 for (i = 0; i < 4; i++) {
4016 if (ssid->wep.key[i] &&
4017 hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
4018 i == ssid->wep.idx, NULL, 0,
4019 ssid->wep.key[i], ssid->wep.len[i])) {
4020 wpa_printf(MSG_WARNING,
4021 "Could not set WEP keys for WDS interface; %s",
4022 ifname_wds);
4023 break;
4024 }
4025 }
4026 }
4027
4028
4029 static void handle_assoc_cb(struct hostapd_data *hapd,
4030 const struct ieee80211_mgmt *mgmt,
4031 size_t len, int reassoc, int ok)
4032 {
4033 u16 status;
4034 struct sta_info *sta;
4035 int new_assoc = 1;
4036
4037 sta = ap_get_sta(hapd, mgmt->da);
4038 if (!sta) {
4039 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
4040 MAC2STR(mgmt->da));
4041 return;
4042 }
4043
4044 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
4045 sizeof(mgmt->u.assoc_resp))) {
4046 wpa_printf(MSG_INFO,
4047 "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
4048 reassoc, (unsigned long) len);
4049 hostapd_drv_sta_remove(hapd, sta->addr);
4050 return;
4051 }
4052
4053 if (reassoc)
4054 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
4055 else
4056 status = le_to_host16(mgmt->u.assoc_resp.status_code);
4057
4058 if (!ok) {
4059 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
4060 HOSTAPD_LEVEL_DEBUG,
4061 "did not acknowledge association response");
4062 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
4063 /* The STA is added only in case of SUCCESS */
4064 if (status == WLAN_STATUS_SUCCESS)
4065 hostapd_drv_sta_remove(hapd, sta->addr);
4066
4067 return;
4068 }
4069
4070 if (status != WLAN_STATUS_SUCCESS)
4071 return;
4072
4073 /* Stop previous accounting session, if one is started, and allocate
4074 * new session id for the new session. */
4075 accounting_sta_stop(hapd, sta);
4076
4077 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4078 HOSTAPD_LEVEL_INFO,
4079 "associated (aid %d)",
4080 sta->aid);
4081
4082 if (sta->flags & WLAN_STA_ASSOC)
4083 new_assoc = 0;
4084 sta->flags |= WLAN_STA_ASSOC;
4085 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
4086 if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
4087 !hapd->conf->osen) ||
4088 sta->auth_alg == WLAN_AUTH_FILS_SK ||
4089 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4090 sta->auth_alg == WLAN_AUTH_FILS_PK ||
4091 sta->auth_alg == WLAN_AUTH_FT) {
4092 /*
4093 * Open, static WEP, FT protocol, or FILS; no separate
4094 * authorization step.
4095 */
4096 ap_sta_set_authorized(hapd, sta, 1);
4097 }
4098
4099 if (reassoc)
4100 mlme_reassociate_indication(hapd, sta);
4101 else
4102 mlme_associate_indication(hapd, sta);
4103
4104 #ifdef CONFIG_IEEE80211W
4105 sta->sa_query_timed_out = 0;
4106 #endif /* CONFIG_IEEE80211W */
4107
4108 if (sta->eapol_sm == NULL) {
4109 /*
4110 * This STA does not use RADIUS server for EAP authentication,
4111 * so bind it to the selected VLAN interface now, since the
4112 * interface selection is not going to change anymore.
4113 */
4114 if (ap_sta_bind_vlan(hapd, sta) < 0)
4115 return;
4116 } else if (sta->vlan_id) {
4117 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
4118 if (ap_sta_bind_vlan(hapd, sta) < 0)
4119 return;
4120 }
4121
4122 hostapd_set_sta_flags(hapd, sta);
4123
4124 if (!(sta->flags & WLAN_STA_WDS) && sta->pending_wds_enable) {
4125 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for STA "
4126 MACSTR " based on pending request",
4127 MAC2STR(sta->addr));
4128 sta->pending_wds_enable = 0;
4129 sta->flags |= WLAN_STA_WDS;
4130 }
4131
4132 if (sta->flags & WLAN_STA_WDS) {
4133 int ret;
4134 char ifname_wds[IFNAMSIZ + 1];
4135
4136 wpa_printf(MSG_DEBUG, "Reenable 4-address WDS mode for STA "
4137 MACSTR " (aid %u)",
4138 MAC2STR(sta->addr), sta->aid);
4139 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
4140 sta->aid, 1);
4141 if (!ret)
4142 hostapd_set_wds_encryption(hapd, sta, ifname_wds);
4143 }
4144
4145 if (sta->auth_alg == WLAN_AUTH_FT)
4146 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
4147 else
4148 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
4149 hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
4150 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
4151
4152 #ifdef CONFIG_FILS
4153 if ((sta->auth_alg == WLAN_AUTH_FILS_SK ||
4154 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4155 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
4156 fils_set_tk(sta->wpa_sm) < 0) {
4157 wpa_printf(MSG_DEBUG, "FILS: TK configuration failed");
4158 ap_sta_disconnect(hapd, sta, sta->addr,
4159 WLAN_REASON_UNSPECIFIED);
4160 return;
4161 }
4162 #endif /* CONFIG_FILS */
4163
4164 if (sta->pending_eapol_rx) {
4165 struct os_reltime now, age;
4166
4167 os_get_reltime(&now);
4168 os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
4169 if (age.sec == 0 && age.usec < 200000) {
4170 wpa_printf(MSG_DEBUG,
4171 "Process pending EAPOL frame that was received from " MACSTR " just before association notification",
4172 MAC2STR(sta->addr));
4173 ieee802_1x_receive(
4174 hapd, mgmt->da,
4175 wpabuf_head(sta->pending_eapol_rx->buf),
4176 wpabuf_len(sta->pending_eapol_rx->buf));
4177 }
4178 wpabuf_free(sta->pending_eapol_rx->buf);
4179 os_free(sta->pending_eapol_rx);
4180 sta->pending_eapol_rx = NULL;
4181 }
4182 }
4183
4184
4185 static void handle_deauth_cb(struct hostapd_data *hapd,
4186 const struct ieee80211_mgmt *mgmt,
4187 size_t len, int ok)
4188 {
4189 struct sta_info *sta;
4190 if (is_multicast_ether_addr(mgmt->da))
4191 return;
4192 sta = ap_get_sta(hapd, mgmt->da);
4193 if (!sta) {
4194 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
4195 " not found", MAC2STR(mgmt->da));
4196 return;
4197 }
4198 if (ok)
4199 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
4200 MAC2STR(sta->addr));
4201 else
4202 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4203 "deauth", MAC2STR(sta->addr));
4204
4205 ap_sta_deauth_cb(hapd, sta);
4206 }
4207
4208
4209 static void handle_disassoc_cb(struct hostapd_data *hapd,
4210 const struct ieee80211_mgmt *mgmt,
4211 size_t len, int ok)
4212 {
4213 struct sta_info *sta;
4214 if (is_multicast_ether_addr(mgmt->da))
4215 return;
4216 sta = ap_get_sta(hapd, mgmt->da);
4217 if (!sta) {
4218 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
4219 " not found", MAC2STR(mgmt->da));
4220 return;
4221 }
4222 if (ok)
4223 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
4224 MAC2STR(sta->addr));
4225 else
4226 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4227 "disassoc", MAC2STR(sta->addr));
4228
4229 ap_sta_disassoc_cb(hapd, sta);
4230 }
4231
4232
4233 static void handle_action_cb(struct hostapd_data *hapd,
4234 const struct ieee80211_mgmt *mgmt,
4235 size_t len, int ok)
4236 {
4237 struct sta_info *sta;
4238 const struct rrm_measurement_report_element *report;
4239
4240 if (is_multicast_ether_addr(mgmt->da))
4241 return;
4242 #ifdef CONFIG_DPP
4243 if (len >= IEEE80211_HDRLEN + 6 &&
4244 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4245 mgmt->u.action.u.vs_public_action.action ==
4246 WLAN_PA_VENDOR_SPECIFIC &&
4247 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
4248 OUI_WFA &&
4249 mgmt->u.action.u.vs_public_action.variable[0] ==
4250 DPP_OUI_TYPE) {
4251 const u8 *pos, *end;
4252
4253 pos = &mgmt->u.action.u.vs_public_action.variable[1];
4254 end = ((const u8 *) mgmt) + len;
4255 hostapd_dpp_tx_status(hapd, mgmt->da, pos, end - pos, ok);
4256 return;
4257 }
4258 if (len >= IEEE80211_HDRLEN + 2 &&
4259 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4260 (mgmt->u.action.u.public_action.action ==
4261 WLAN_PA_GAS_INITIAL_REQ ||
4262 mgmt->u.action.u.public_action.action ==
4263 WLAN_PA_GAS_COMEBACK_REQ)) {
4264 const u8 *pos, *end;
4265
4266 pos = mgmt->u.action.u.public_action.variable;
4267 end = ((const u8 *) mgmt) + len;
4268 gas_query_ap_tx_status(hapd->gas, mgmt->da, pos, end - pos, ok);
4269 return;
4270 }
4271 #endif /* CONFIG_DPP */
4272 sta = ap_get_sta(hapd, mgmt->da);
4273 if (!sta) {
4274 wpa_printf(MSG_DEBUG, "handle_action_cb: STA " MACSTR
4275 " not found", MAC2STR(mgmt->da));
4276 return;
4277 }
4278
4279 if (len < 24 + 5 + sizeof(*report))
4280 return;
4281 report = (const struct rrm_measurement_report_element *)
4282 &mgmt->u.action.u.rrm.variable[2];
4283 if (mgmt->u.action.category == WLAN_ACTION_RADIO_MEASUREMENT &&
4284 mgmt->u.action.u.rrm.action == WLAN_RRM_RADIO_MEASUREMENT_REQUEST &&
4285 report->eid == WLAN_EID_MEASURE_REQUEST &&
4286 report->len >= 3 &&
4287 report->type == MEASURE_TYPE_BEACON)
4288 hostapd_rrm_beacon_req_tx_status(hapd, mgmt, len, ok);
4289 }
4290
4291
4292 /**
4293 * ieee802_11_mgmt_cb - Process management frame TX status callback
4294 * @hapd: hostapd BSS data structure (the BSS from which the management frame
4295 * was sent from)
4296 * @buf: management frame data (starting from IEEE 802.11 header)
4297 * @len: length of frame data in octets
4298 * @stype: management frame subtype from frame control field
4299 * @ok: Whether the frame was ACK'ed
4300 */
4301 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
4302 u16 stype, int ok)
4303 {
4304 const struct ieee80211_mgmt *mgmt;
4305 mgmt = (const struct ieee80211_mgmt *) buf;
4306
4307 #ifdef CONFIG_TESTING_OPTIONS
4308 if (hapd->ext_mgmt_frame_handling) {
4309 size_t hex_len = 2 * len + 1;
4310 char *hex = os_malloc(hex_len);
4311
4312 if (hex) {
4313 wpa_snprintf_hex(hex, hex_len, buf, len);
4314 wpa_msg(hapd->msg_ctx, MSG_INFO,
4315 "MGMT-TX-STATUS stype=%u ok=%d buf=%s",
4316 stype, ok, hex);
4317 os_free(hex);
4318 }
4319 return;
4320 }
4321 #endif /* CONFIG_TESTING_OPTIONS */
4322
4323 switch (stype) {
4324 case WLAN_FC_STYPE_AUTH:
4325 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
4326 handle_auth_cb(hapd, mgmt, len, ok);
4327 break;
4328 case WLAN_FC_STYPE_ASSOC_RESP:
4329 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
4330 handle_assoc_cb(hapd, mgmt, len, 0, ok);
4331 break;
4332 case WLAN_FC_STYPE_REASSOC_RESP:
4333 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
4334 handle_assoc_cb(hapd, mgmt, len, 1, ok);
4335 break;
4336 case WLAN_FC_STYPE_PROBE_RESP:
4337 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok);
4338 break;
4339 case WLAN_FC_STYPE_DEAUTH:
4340 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
4341 handle_deauth_cb(hapd, mgmt, len, ok);
4342 break;
4343 case WLAN_FC_STYPE_DISASSOC:
4344 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
4345 handle_disassoc_cb(hapd, mgmt, len, ok);
4346 break;
4347 case WLAN_FC_STYPE_ACTION:
4348 wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok);
4349 handle_action_cb(hapd, mgmt, len, ok);
4350 break;
4351 default:
4352 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
4353 break;
4354 }
4355 }
4356
4357
4358 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
4359 {
4360 /* TODO */
4361 return 0;
4362 }
4363
4364
4365 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
4366 char *buf, size_t buflen)
4367 {
4368 /* TODO */
4369 return 0;
4370 }
4371
4372
4373 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
4374 const u8 *buf, size_t len, int ack)
4375 {
4376 struct sta_info *sta;
4377 struct hostapd_iface *iface = hapd->iface;
4378
4379 sta = ap_get_sta(hapd, addr);
4380 if (sta == NULL && iface->num_bss > 1) {
4381 size_t j;
4382 for (j = 0; j < iface->num_bss; j++) {
4383 hapd = iface->bss[j];
4384 sta = ap_get_sta(hapd, addr);
4385 if (sta)
4386 break;
4387 }
4388 }
4389 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
4390 return;
4391 if (sta->flags & WLAN_STA_PENDING_POLL) {
4392 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
4393 "activity poll", MAC2STR(sta->addr),
4394 ack ? "ACKed" : "did not ACK");
4395 if (ack)
4396 sta->flags &= ~WLAN_STA_PENDING_POLL;
4397 }
4398
4399 ieee802_1x_tx_status(hapd, sta, buf, len, ack);
4400 }
4401
4402
4403 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
4404 const u8 *data, size_t len, int ack)
4405 {
4406 struct sta_info *sta;
4407 struct hostapd_iface *iface = hapd->iface;
4408
4409 sta = ap_get_sta(hapd, dst);
4410 if (sta == NULL && iface->num_bss > 1) {
4411 size_t j;
4412 for (j = 0; j < iface->num_bss; j++) {
4413 hapd = iface->bss[j];
4414 sta = ap_get_sta(hapd, dst);
4415 if (sta)
4416 break;
4417 }
4418 }
4419 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
4420 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
4421 MACSTR " that is not currently associated",
4422 MAC2STR(dst));
4423 return;
4424 }
4425
4426 ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
4427 }
4428
4429
4430 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
4431 {
4432 struct sta_info *sta;
4433 struct hostapd_iface *iface = hapd->iface;
4434
4435 sta = ap_get_sta(hapd, addr);
4436 if (sta == NULL && iface->num_bss > 1) {
4437 size_t j;
4438 for (j = 0; j < iface->num_bss; j++) {
4439 hapd = iface->bss[j];
4440 sta = ap_get_sta(hapd, addr);
4441 if (sta)
4442 break;
4443 }
4444 }
4445 if (sta == NULL)
4446 return;
4447 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
4448 MAC2STR(sta->addr));
4449 if (!(sta->flags & WLAN_STA_PENDING_POLL))
4450 return;
4451
4452 wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
4453 "activity poll", MAC2STR(sta->addr));
4454 sta->flags &= ~WLAN_STA_PENDING_POLL;
4455 }
4456
4457
4458 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
4459 int wds)
4460 {
4461 struct sta_info *sta;
4462
4463 sta = ap_get_sta(hapd, src);
4464 if (sta &&
4465 ((sta->flags & WLAN_STA_ASSOC) ||
4466 ((sta->flags & WLAN_STA_ASSOC_REQ_OK) && wds))) {
4467 if (!hapd->conf->wds_sta)
4468 return;
4469
4470 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK)) ==
4471 WLAN_STA_ASSOC_REQ_OK) {
4472 wpa_printf(MSG_DEBUG,
4473 "Postpone 4-address WDS mode enabling for STA "
4474 MACSTR " since TX status for AssocResp is not yet known",
4475 MAC2STR(sta->addr));
4476 sta->pending_wds_enable = 1;
4477 return;
4478 }
4479
4480 if (wds && !(sta->flags & WLAN_STA_WDS)) {
4481 int ret;
4482 char ifname_wds[IFNAMSIZ + 1];
4483
4484 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
4485 "STA " MACSTR " (aid %u)",
4486 MAC2STR(sta->addr), sta->aid);
4487 sta->flags |= WLAN_STA_WDS;
4488 ret = hostapd_set_wds_sta(hapd, ifname_wds,
4489 sta->addr, sta->aid, 1);
4490 if (!ret)
4491 hostapd_set_wds_encryption(hapd, sta,
4492 ifname_wds);
4493 }
4494 return;
4495 }
4496
4497 wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
4498 MACSTR, MAC2STR(src));
4499 if (is_multicast_ether_addr(src)) {
4500 /* Broadcast bit set in SA?! Ignore the frame silently. */
4501 return;
4502 }
4503
4504 if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
4505 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
4506 "already been sent, but no TX status yet known - "
4507 "ignore Class 3 frame issue with " MACSTR,
4508 MAC2STR(src));
4509 return;
4510 }
4511
4512 if (sta && (sta->flags & WLAN_STA_AUTH))
4513 hostapd_drv_sta_disassoc(
4514 hapd, src,
4515 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
4516 else
4517 hostapd_drv_sta_deauth(
4518 hapd, src,
4519 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
4520 }
4521
4522
4523 #endif /* CONFIG_NATIVE_WINDOWS */
Unnamed repository; edit this file 'description' to name the repository.