]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/ap/ap_config.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
HE: Dynamically turn on TWT responder support
[thirdparty/hostap.git] / src / ap / ap_config.c
CommitLineData
6fc6879b 1/*
41d719d6 2 * hostapd / Configuration helper functions
08081ad8 3 * Copyright (c) 2003-2014, Jouni Malinen <j@w1.fi>
6fc6879b 4 *
0f3d578e
JM		 5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
6fc6879b
JM		 7 */
8
6226e38d 9#include "utils/includes.h"
6fc6879b 10
6226e38d 11#include "utils/common.h"
03da66bd 12#include "crypto/sha1.h"
d501c27c 13#include "crypto/tls.h"
6fc6879b 14#include "radius/radius_client.h"
df84268a 15#include "common/ieee802_11_defs.h"
29c832d0 16#include "common/ieee802_1x_defs.h"
41d719d6 17#include "common/eapol_common.h"
91d91abf 18#include "common/dhcp.h"
43b20b43 19#include "common/sae.h"
03da66bd
JM		 20#include "eap_common/eap_wsc_common.h"
21#include "eap_server/eap.h"
6226e38d 22#include "wpa_auth.h"
97234b50 23#include "sta_info.h"
ef721751 24#include "airtime_policy.h"
6226e38d 25#include "ap_config.h"
6fc6879b
JM		 26
27
6fc6879b
JM		 28static void hostapd_config_free_vlan(struct hostapd_bss_config *bss)
29{
30 struct hostapd_vlan *vlan, *prev;
31
32 vlan = bss->vlan;
33 prev = NULL;
34 while (vlan) {
35 prev = vlan;
36 vlan = vlan->next;
37 os_free(prev);
38 }
39
40 bss->vlan = NULL;
41}
42
43
6f234c1e
JM		 44#ifndef DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES
45#define DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES 0
46#endif /* DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES */
47
41d719d6 48void hostapd_config_defaults_bss(struct hostapd_bss_config *bss)
6fc6879b 49{
695dbbea
JM		 50 dl_list_init(&bss->anqp_elem);
51
6fc6879b
JM		 52 bss->logger_syslog_level = HOSTAPD_LEVEL_INFO;
53 bss->logger_stdout_level = HOSTAPD_LEVEL_INFO;
54 bss->logger_syslog = (unsigned int) -1;
55 bss->logger_stdout = (unsigned int) -1;
56
57 bss->auth_algs = WPA_AUTH_ALG_OPEN | WPA_AUTH_ALG_SHARED;
58
59 bss->wep_rekeying_period = 300;
60 /* use key0 in individual key and key1 in broadcast key */
61 bss->broadcast_key_idx_min = 1;
62 bss->broadcast_key_idx_max = 2;
63 bss->eap_reauth_period = 3600;
64
65 bss->wpa_group_rekey = 600;
66 bss->wpa_gmk_rekey = 86400;
41f140d3
GK		 67 bss->wpa_group_update_count = 4;
68 bss->wpa_pairwise_update_count = 4;
6f234c1e
JM		 69 bss->wpa_disable_eapol_key_retries =
70 DEFAULT_WPA_DISABLE_EAPOL_KEY_RETRIES;
6fc6879b
JM		 71 bss->wpa_key_mgmt = WPA_KEY_MGMT_PSK;
72 bss->wpa_pairwise = WPA_CIPHER_TKIP;
73 bss->wpa_group = WPA_CIPHER_TKIP;
74 bss->rsn_pairwise = 0;
75
76 bss->max_num_sta = MAX_STA_COUNT;
77
78 bss->dtim_period = 2;
79
80 bss->radius_server_auth_port = 1812;
7b0f5500 81 bss->eap_sim_db_timeout = 1;
6bb11c7a 82 bss->eap_sim_id = 3;
6fc6879b
JM		 83 bss->ap_max_inactivity = AP_MAX_INACTIVITY;
84 bss->eapol_version = EAPOL_VERSION;
b0194fe0
JM		 85
86 bss->max_listen_interval = 65535;
5d22a1d5 87
df684d82
DH		 88 bss->pwd_group = 19; /* ECC: GF(p=256) */
89
45c94154
JM		 90 bss->assoc_sa_query_max_timeout = 1000;
91 bss->assoc_sa_query_retry_timeout = 201;
8dd9f9cd 92 bss->group_mgmt_cipher = WPA_CIPHER_AES_128_CMAC;
1e5839e0 93#ifdef EAP_SERVER_FAST
378eae5e
JM		 94 /* both anonymous and authenticated provisioning */
95 bss->eap_fast_prov = 3;
a11c90a6
JM		 96 bss->pac_key_lifetime = 7 * 24 * 60 * 60;
97 bss->pac_key_refresh_time = 1 * 24 * 60 * 60;
1e5839e0 98#endif /* EAP_SERVER_FAST */
d2da2249
JB		 99
100 /* Set to -1 as defaults depends on HT in setup */
101 bss->wmm_enabled = -1;
d7956add 102
4ec1fd8e 103#ifdef CONFIG_IEEE80211R_AP
d7956add 104 bss->ft_over_ds = 1;
3a46cf93
MB		 105 bss->rkh_pos_timeout = 86400;
106 bss->rkh_neg_timeout = 60;
107 bss->rkh_pull_timeout = 1000;
108 bss->rkh_pull_retries = 4;
83fe4bd3 109 bss->r0_key_lifetime = 1209600;
4ec1fd8e 110#endif /* CONFIG_IEEE80211R_AP */
bde7ba6c
JM		 111
112 bss->radius_das_time_window = 300;
d136c376
JM		 113
114 bss->sae_anti_clogging_threshold = 5;
d8b841eb 115 bss->sae_sync = 5;
26bf70e3 116
2977f519
JM		 117 bss->gas_frag_limit = 1400;
118
26bf70e3
JM		 119#ifdef CONFIG_FILS
120 dl_list_init(&bss->fils_realms);
91d91abf
JM		 121 bss->fils_hlp_wait_time = 30;
122 bss->dhcp_server_port = DHCP_SERVER_PORT;
123 bss->dhcp_relay_port = DHCP_SERVER_PORT;
26bf70e3 124#endif /* CONFIG_FILS */
57a2aaca
JM		 125
126 bss->broadcast_deauth = 1;
941caed9
JM		 127
128#ifdef CONFIG_MBO
129 bss->mbo_cell_data_conn_pref = -1;
130#endif /* CONFIG_MBO */
d501c27c
JM		 131
132 /* Disable TLS v1.3 by default for now to avoid interoperability issue.
133 * This can be enabled by default once the implementation has been fully
134 * completed and tested with other implementations. */
135 bss->tls_flags = TLS_CONN_DISABLE_TLSv1_3;
678d8410 136
8d76e0ad
JM		 137 bss->max_auth_rounds = 100;
138 bss->max_auth_rounds_short = 50;
139
678d8410 140 bss->send_probe_response = 1;
6ae04d7b
JM		 141
142#ifdef CONFIG_HS20
143 bss->hs20_release = (HS20_VERSION >> 4) + 1;
144#endif /* CONFIG_HS20 */
dd5d325b 145
29c832d0 146#ifdef CONFIG_MACSEC
147 bss->mka_priority = DEFAULT_PRIO_NOT_KEY_SERVER;
148 bss->macsec_port = 1;
149#endif /* CONFIG_MACSEC */
150
dd5d325b
SV		 151 /* Default to strict CRL checking. */
152 bss->check_crl_strict = 1;
6fc6879b
JM		 153}
154
155
89111f3b 156struct hostapd_config * hostapd_config_defaults(void)
6fc6879b 157{
d2da2249
JB		 158#define ecw2cw(ecw) ((1 << (ecw)) - 1)
159
6fc6879b
JM		 160 struct hostapd_config *conf;
161 struct hostapd_bss_config *bss;
594cf8b9 162 const int aCWmin = 4, aCWmax = 10;
3ae0800c 163 const struct hostapd_wmm_ac_params ac_bk =
6fc6879b 164 { aCWmin, aCWmax, 7, 0, 0 }; /* background traffic */
3ae0800c 165 const struct hostapd_wmm_ac_params ac_be =
6fc6879b 166 { aCWmin, aCWmax, 3, 0, 0 }; /* best effort traffic */
3ae0800c 167 const struct hostapd_wmm_ac_params ac_vi = /* video traffic */
f4e3860f 168 { aCWmin - 1, aCWmin, 2, 3008 / 32, 0 };
3ae0800c 169 const struct hostapd_wmm_ac_params ac_vo = /* voice traffic */
f4e3860f 170 { aCWmin - 2, aCWmin - 1, 2, 1504 / 32, 0 };
d2da2249
JB		 171 const struct hostapd_tx_queue_params txq_bk =
172 { 7, ecw2cw(aCWmin), ecw2cw(aCWmax), 0 };
173 const struct hostapd_tx_queue_params txq_be =
174 { 3, ecw2cw(aCWmin), 4 * (ecw2cw(aCWmin) + 1) - 1, 0};
175 const struct hostapd_tx_queue_params txq_vi =
176 { 1, (ecw2cw(aCWmin) + 1) / 2 - 1, ecw2cw(aCWmin), 30};
177 const struct hostapd_tx_queue_params txq_vo =
178 { 1, (ecw2cw(aCWmin) + 1) / 4 - 1,
179 (ecw2cw(aCWmin) + 1) / 2 - 1, 15};
180
181#undef ecw2cw
6fc6879b
JM		 182
183 conf = os_zalloc(sizeof(*conf));
184 bss = os_zalloc(sizeof(*bss));
185 if (conf == NULL || bss == NULL) {
10656fc2
JM		 186 wpa_printf(MSG_ERROR, "Failed to allocate memory for "
187 "configuration data.");
6fc6879b
JM		 188 os_free(conf);
189 os_free(bss);
190 return NULL;
191 }
ebd79f07
JM		 192 conf->bss = os_calloc(1, sizeof(struct hostapd_bss_config *));
193 if (conf->bss == NULL) {
194 os_free(conf);
195 os_free(bss);
196 return NULL;
197 }
198 conf->bss[0] = bss;
6fc6879b 199
6fc6879b
JM		 200 bss->radius = os_zalloc(sizeof(*bss->radius));
201 if (bss->radius == NULL) {
04c366cb 202 os_free(conf->bss);
6fc6879b
JM		 203 os_free(conf);
204 os_free(bss);
205 return NULL;
206 }
207
208 hostapd_config_defaults_bss(bss);
209
210 conf->num_bss = 1;
6fc6879b
JM		 211
212 conf->beacon_int = 100;
bf0021ed
JM		 213 conf->rts_threshold = -2; /* use driver default: 2347 */
214 conf->fragm_threshold = -2; /* user driver default: 2346 */
e0392f82
S		 215 /* Set to invalid value means do not add Power Constraint IE */
216 conf->local_pwr_constraint = -1;
6fc6879b 217
3ae0800c
JM		 218 conf->wmm_ac_params[0] = ac_be;
219 conf->wmm_ac_params[1] = ac_bk;
220 conf->wmm_ac_params[2] = ac_vi;
221 conf->wmm_ac_params[3] = ac_vo;
6fc6879b 222
d2da2249
JB		 223 conf->tx_queue[0] = txq_vo;
224 conf->tx_queue[1] = txq_vi;
225 conf->tx_queue[2] = txq_be;
226 conf->tx_queue[3] = txq_bk;
227
fc14f567 228 conf->ht_capab = HT_CAP_INFO_SMPS_DISABLED;
de9289c8 229
f1b44874
SE		 230 conf->ap_table_max_size = 255;
231 conf->ap_table_expiration_time = 60;
a65a9b8d 232 conf->track_sta_max_age = 180;
f1b44874 233
c2aff6b1 234#ifdef CONFIG_TESTING_OPTIONS
06df2aa6
JM		 235 conf->ignore_probe_probability = 0.0;
236 conf->ignore_auth_probability = 0.0;
237 conf->ignore_assoc_probability = 0.0;
238 conf->ignore_reassoc_probability = 0.0;
239 conf->corrupt_gtk_rekey_mic_probability = 0.0;
2b6e1216 240 conf->ecsa_ie_only = 0;
c2aff6b1
JB		 241#endif /* CONFIG_TESTING_OPTIONS */
242
857d9422
MM		 243 conf->acs = 0;
244 conf->acs_ch_list.num = 0;
50f4f2a0
MK		 245#ifdef CONFIG_ACS
246 conf->acs_num_scans = 5;
247#endif /* CONFIG_ACS */
248
83f30fab
JC		 249#ifdef CONFIG_IEEE80211AX
250 conf->he_op.he_rts_threshold = HE_OPERATION_RTS_THRESHOLD_MASK >>
251 HE_OPERATION_RTS_THRESHOLD_OFFSET;
4f3f3380
JC		 252 /* Set default basic MCS/NSS set to single stream MCS 0-7 */
253 conf->he_op.he_basic_mcs_nss_set = 0xfffc;
0cb39f4f
JC		 254 conf->he_op.he_bss_color_disabled = 1;
255 conf->he_op.he_bss_color_partial = 0;
256 conf->he_op.he_bss_color = 1;
83f30fab
JC		 257#endif /* CONFIG_IEEE80211AX */
258
ff936bc7
JM		 259 /* The third octet of the country string uses an ASCII space character
260 * by default to indicate that the regulations encompass all
261 * environments for the current frequency band in the country. */
262 conf->country[2] = ' ';
263
076f1ea1
BL		 264 conf->rssi_reject_assoc_rssi = 0;
265 conf->rssi_reject_assoc_timeout = 30;
266
ef721751
THJ		 267#ifdef CONFIG_AIRTIME_POLICY
268 conf->airtime_update_interval = AIRTIME_DEFAULT_UPDATE_INTERVAL;
269#endif /* CONFIG_AIRTIME_POLICY */
270
6fc6879b
JM		 271 return conf;
272}
273
274
275int hostapd_mac_comp(const void *a, const void *b)
276{
277 return os_memcmp(a, b, sizeof(macaddr));
278}
279
280
6fc6879b
JM		 281static int hostapd_config_read_wpa_psk(const char *fname,
282 struct hostapd_ssid *ssid)
283{
284 FILE *f;
285 char buf[128], *pos;
ec5c39a5
MK		 286 const char *keyid;
287 char *context;
288 char *context2;
289 char *token;
290 char *name;
291 char *value;
6fc6879b
JM		 292 int line = 0, ret = 0, len, ok;
293 u8 addr[ETH_ALEN];
294 struct hostapd_wpa_psk *psk;
295
296 if (!fname)
297 return 0;
298
299 f = fopen(fname, "r");
300 if (!f) {
10656fc2 301 wpa_printf(MSG_ERROR, "WPA PSK file '%s' not found.", fname);
6fc6879b
JM		 302 return -1;
303 }
304
305 while (fgets(buf, sizeof(buf), f)) {
dbfa691d 306 int vlan_id = 0;
fde8e794 307 int wps = 0;
dbfa691d 308
6fc6879b
JM		 309 line++;
310
311 if (buf[0] == '#')
312 continue;
313 pos = buf;
314 while (*pos != '\0') {
315 if (*pos == '\n') {
316 *pos = '\0';
317 break;
318 }
319 pos++;
320 }
321 if (buf[0] == '\0')
322 continue;
323
ec5c39a5
MK		 324 context = NULL;
325 keyid = NULL;
326 while ((token = str_token(buf, " ", &context))) {
327 if (!os_strchr(token, '='))
328 break;
329 context2 = NULL;
330 name = str_token(token, "=", &context2);
2fae58fd
JM		 331 if (!name)
332 break;
ec5c39a5
MK		 333 value = str_token(token, "", &context2);
334 if (!value)
335 value = "";
336 if (!os_strcmp(name, "keyid")) {
337 keyid = value;
fde8e794
TJ		 338 } else if (!os_strcmp(name, "wps")) {
339 wps = atoi(value);
dbfa691d
JM		 340 } else if (!os_strcmp(name, "vlanid")) {
341 vlan_id = atoi(value);
ec5c39a5
MK		 342 } else {
343 wpa_printf(MSG_ERROR,
344 "Unrecognized '%s=%s' on line %d in '%s'",
345 name, value, line, fname);
346 ret = -1;
347 break;
348 }
349 }
350
351 if (ret == -1)
352 break;
353
354 if (!token)
355 token = "";
356 if (hwaddr_aton(token, addr)) {
b27ed050
JM		 357 wpa_printf(MSG_ERROR,
358 "Invalid MAC address '%s' on line %d in '%s'",
359 token, line, fname);
6fc6879b
JM		 360 ret = -1;
361 break;
362 }
363
364 psk = os_zalloc(sizeof(*psk));
365 if (psk == NULL) {
10656fc2 366 wpa_printf(MSG_ERROR, "WPA PSK allocation failed");
6fc6879b
JM		 367 ret = -1;
368 break;
369 }
dbfa691d 370 psk->vlan_id = vlan_id;
a8e16edc 371 if (is_zero_ether_addr(addr))
6fc6879b
JM		 372 psk->group = 1;
373 else
374 os_memcpy(psk->addr, addr, ETH_ALEN);
375
ec5c39a5
MK		 376 pos = str_token(buf, "", &context);
377 if (!pos) {
10656fc2
JM		 378 wpa_printf(MSG_ERROR, "No PSK on line %d in '%s'",
379 line, fname);
6fc6879b
JM		 380 os_free(psk);
381 ret = -1;
382 break;
383 }
6fc6879b
JM		 384
385 ok = 0;
386 len = os_strlen(pos);
83818087
JM		 387 if (len == 2 * PMK_LEN &&
388 hexstr2bin(pos, psk->psk, PMK_LEN) == 0)
6fc6879b 389 ok = 1;
f5da5810
JM		 390 else if (len >= 8 && len < 64 &&
391 pbkdf2_sha1(pos, ssid->ssid, ssid->ssid_len,
392 4096, psk->psk, PMK_LEN) == 0)
6fc6879b 393 ok = 1;
6fc6879b 394 if (!ok) {
b27ed050
JM		 395 wpa_printf(MSG_ERROR,
396 "Invalid PSK '%s' on line %d in '%s'",
397 pos, line, fname);
6fc6879b
JM		 398 os_free(psk);
399 ret = -1;
400 break;
401 }
402
ec5c39a5
MK		 403 if (keyid) {
404 len = os_strlcpy(psk->keyid, keyid, sizeof(psk->keyid));
405 if ((size_t) len >= sizeof(psk->keyid)) {
406 wpa_printf(MSG_ERROR,
407 "PSK keyid too long on line %d in '%s'",
408 line, fname);
409 os_free(psk);
410 ret = -1;
411 break;
412 }
413 }
414
fde8e794
TJ		 415 psk->wps = wps;
416
6fc6879b
JM		 417 psk->next = ssid->wpa_psk;
418 ssid->wpa_psk = psk;
419 }
420
421 fclose(f);
422
423 return ret;
424}
425
426
0ae687bd
JM		 427static int hostapd_derive_psk(struct hostapd_ssid *ssid)
428{
429 ssid->wpa_psk = os_zalloc(sizeof(struct hostapd_wpa_psk));
430 if (ssid->wpa_psk == NULL) {
431 wpa_printf(MSG_ERROR, "Unable to alloc space for PSK");
432 return -1;
433 }
434 wpa_hexdump_ascii(MSG_DEBUG, "SSID",
435 (u8 *) ssid->ssid, ssid->ssid_len);
436 wpa_hexdump_ascii_key(MSG_DEBUG, "PSK (ASCII passphrase)",
437 (u8 *) ssid->wpa_passphrase,
438 os_strlen(ssid->wpa_passphrase));
439 pbkdf2_sha1(ssid->wpa_passphrase,
440 ssid->ssid, ssid->ssid_len,
441 4096, ssid->wpa_psk->psk, PMK_LEN);
442 wpa_hexdump_key(MSG_DEBUG, "PSK (from passphrase)",
443 ssid->wpa_psk->psk, PMK_LEN);
444 return 0;
445}
446
447
43b20b43
JM		 448int hostapd_setup_sae_pt(struct hostapd_bss_config *conf)
449{
450#ifdef CONFIG_SAE
451 struct hostapd_ssid *ssid = &conf->ssid;
452 struct sae_password_entry *pw;
453
e36a5894 454 if ((conf->sae_pwe == 0 && !hostapd_sae_pw_id_in_use(conf)) ||
641d79f1 455 conf->sae_pwe == 3 ||
e36a5894 456 !wpa_key_mgmt_sae(conf->wpa_key_mgmt))
43b20b43
JM		 457 return 0; /* PT not needed */
458
459 sae_deinit_pt(ssid->pt);
460 ssid->pt = NULL;
461 if (ssid->wpa_passphrase) {
462 ssid->pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
463 ssid->ssid_len,
464 (const u8 *) ssid->wpa_passphrase,
465 os_strlen(ssid->wpa_passphrase),
466 NULL);
467 if (!ssid->pt)
468 return -1;
469 }
470
471 for (pw = conf->sae_passwords; pw; pw = pw->next) {
472 sae_deinit_pt(pw->pt);
473 pw->pt = sae_derive_pt(conf->sae_groups, ssid->ssid,
474 ssid->ssid_len,
475 (const u8 *) pw->password,
476 os_strlen(pw->password),
477 pw->identifier);
478 if (!pw->pt)
479 return -1;
480 }
481#endif /* CONFIG_SAE */
482
483 return 0;
484}
485
486
6fc6879b
JM		 487int hostapd_setup_wpa_psk(struct hostapd_bss_config *conf)
488{
489 struct hostapd_ssid *ssid = &conf->ssid;
490
43b20b43
JM		 491 if (hostapd_setup_sae_pt(conf) < 0)
492 return -1;
493
6fc6879b
JM		 494 if (ssid->wpa_passphrase != NULL) {
495 if (ssid->wpa_psk != NULL) {
0ae687bd
JM		 496 wpa_printf(MSG_DEBUG, "Using pre-configured WPA PSK "
497 "instead of passphrase");
498 } else {
499 wpa_printf(MSG_DEBUG, "Deriving WPA PSK based on "
500 "passphrase");
501 if (hostapd_derive_psk(ssid) < 0)
502 return -1;
6fc6879b 503 }
6fc6879b 504 ssid->wpa_psk->group = 1;
6fc6879b
JM		 505 }
506
34e29dfd 507 return hostapd_config_read_wpa_psk(ssid->wpa_psk_file, &conf->ssid);
6fc6879b
JM		 508}
509
510
6fc6879b
JM		 511static void hostapd_config_free_radius(struct hostapd_radius_server *servers,
512 int num_servers)
513{
514 int i;
515
516 for (i = 0; i < num_servers; i++) {
517 os_free(servers[i].shared_secret);
518 }
519 os_free(servers);
520}
521
522
af35e7af
JM		 523struct hostapd_radius_attr *
524hostapd_config_get_radius_attr(struct hostapd_radius_attr *attr, u8 type)
525{
526 for (; attr; attr = attr->next) {
527 if (attr->type == type)
528 return attr;
529 }
530 return NULL;
531}
532
533
74707def
TB		 534struct hostapd_radius_attr * hostapd_parse_radius_attr(const char *value)
535{
536 const char *pos;
537 char syntax;
538 struct hostapd_radius_attr *attr;
539 size_t len;
540
541 attr = os_zalloc(sizeof(*attr));
542 if (!attr)
543 return NULL;
544
545 attr->type = atoi(value);
546
547 pos = os_strchr(value, ':');
548 if (!pos) {
549 attr->val = wpabuf_alloc(1);
550 if (!attr->val) {
551 os_free(attr);
552 return NULL;
553 }
554 wpabuf_put_u8(attr->val, 0);
555 return attr;
556 }
557
558 pos++;
559 if (pos[0] == '\0' || pos[1] != ':') {
560 os_free(attr);
561 return NULL;
562 }
563 syntax = *pos++;
564 pos++;
565
566 switch (syntax) {
567 case 's':
568 attr->val = wpabuf_alloc_copy(pos, os_strlen(pos));
569 break;
570 case 'x':
571 len = os_strlen(pos);
572 if (len & 1)
573 break;
574 len /= 2;
575 attr->val = wpabuf_alloc(len);
576 if (!attr->val)
577 break;
578 if (hexstr2bin(pos, wpabuf_put(attr->val, len), len) < 0) {
579 wpabuf_free(attr->val);
580 os_free(attr);
581 return NULL;
582 }
583 break;
584 case 'd':
585 attr->val = wpabuf_alloc(4);
586 if (attr->val)
587 wpabuf_put_be32(attr->val, atoi(pos));
588 break;
589 default:
590 os_free(attr);
591 return NULL;
592 }
593
594 if (!attr->val) {
595 os_free(attr);
596 return NULL;
597 }
598
599 return attr;
600}
601
602
f4111ff3 603void hostapd_config_free_radius_attr(struct hostapd_radius_attr *attr)
af35e7af
JM		 604{
605 struct hostapd_radius_attr *prev;
606
607 while (attr) {
608 prev = attr;
609 attr = attr->next;
610 wpabuf_free(prev->val);
611 os_free(prev);
612 }
613}
614
615
d0ee16ed 616void hostapd_config_free_eap_user(struct hostapd_eap_user *user)
6fc6879b 617{
d0ee16ed 618 hostapd_config_free_radius_attr(user->accept_attr);
6fc6879b 619 os_free(user->identity);
b7175b4d 620 bin_clear_free(user->password, user->password_len);
d52ead3d 621 bin_clear_free(user->salt, user->salt_len);
6fc6879b
JM		 622 os_free(user);
623}
624
625
78022c83
JM		 626void hostapd_config_free_eap_users(struct hostapd_eap_user *user)
627{
628 struct hostapd_eap_user *prev_user;
629
630 while (user) {
631 prev_user = user;
632 user = user->next;
633 hostapd_config_free_eap_user(prev_user);
634 }
635}
636
637
6fc6879b
JM		 638static void hostapd_config_free_wep(struct hostapd_wep_keys *keys)
639{
640 int i;
641 for (i = 0; i < NUM_WEP_KEYS; i++) {
b7175b4d 642 bin_clear_free(keys->key[i], keys->len[i]);
6fc6879b
JM		 643 keys->key[i] = NULL;
644 }
645}
646
647
891dfb33
ST		 648void hostapd_config_clear_wpa_psk(struct hostapd_wpa_psk **l)
649{
650 struct hostapd_wpa_psk *psk, *tmp;
651
652 for (psk = *l; psk;) {
653 tmp = psk;
654 psk = psk->next;
655 bin_clear_free(tmp, sizeof(*tmp));
656 }
657 *l = NULL;
658}
659
660
695dbbea
JM		 661static void hostapd_config_free_anqp_elem(struct hostapd_bss_config *conf)
662{
663 struct anqp_element *elem;
664
665 while ((elem = dl_list_first(&conf->anqp_elem, struct anqp_element,
666 list))) {
667 dl_list_del(&elem->list);
668 wpabuf_free(elem->payload);
669 os_free(elem);
670 }
671}
672
673
26bf70e3
JM		 674static void hostapd_config_free_fils_realms(struct hostapd_bss_config *conf)
675{
676#ifdef CONFIG_FILS
677 struct fils_realm *realm;
678
679 while ((realm = dl_list_first(&conf->fils_realms, struct fils_realm,
680 list))) {
681 dl_list_del(&realm->list);
682 os_free(realm);
683 }
684#endif /* CONFIG_FILS */
685}
686
687
9be19d0b
JM		 688static void hostapd_config_free_sae_passwords(struct hostapd_bss_config *conf)
689{
690 struct sae_password_entry *pw, *tmp;
691
692 pw = conf->sae_passwords;
693 conf->sae_passwords = NULL;
694 while (pw) {
695 tmp = pw;
696 pw = pw->next;
697 str_clear_free(tmp->password);
698 os_free(tmp->identifier);
43b20b43
JM		 699#ifdef CONFIG_SAE
700 sae_deinit_pt(tmp->pt);
701#endif /* CONFIG_SAE */
9be19d0b
JM		 702 os_free(tmp);
703 }
704}
705
706
e00f780e
JM		 707#ifdef CONFIG_DPP2
708static void hostapd_dpp_controller_conf_free(struct dpp_controller_conf *conf)
709{
710 struct dpp_controller_conf *prev;
711
712 while (conf) {
713 prev = conf;
714 conf = conf->next;
715 os_free(prev);
716 }
717}
718#endif /* CONFIG_DPP2 */
719
720
55920658 721void hostapd_config_free_bss(struct hostapd_bss_config *conf)
6fc6879b 722{
a00ace9f
AO		 723#if defined(CONFIG_WPS) || defined(CONFIG_HS20)
724 size_t i;
725#endif
726
6fc6879b
JM		 727 if (conf == NULL)
728 return;
729
891dfb33 730 hostapd_config_clear_wpa_psk(&conf->ssid.wpa_psk);
6fc6879b 731
b7175b4d 732 str_clear_free(conf->ssid.wpa_passphrase);
6fc6879b 733 os_free(conf->ssid.wpa_psk_file);
43dd46b3 734 hostapd_config_free_wep(&conf->ssid.wep);
6fc6879b
JM		 735#ifdef CONFIG_FULL_DYNAMIC_VLAN
736 os_free(conf->ssid.vlan_tagged_interface);
737#endif /* CONFIG_FULL_DYNAMIC_VLAN */
43b20b43
JM		 738#ifdef CONFIG_SAE
739 sae_deinit_pt(conf->ssid.pt);
740#endif /* CONFIG_SAE */
6fc6879b 741
78022c83 742 hostapd_config_free_eap_users(conf->eap_user);
ee431d77 743 os_free(conf->eap_user_sqlite);
6fc6879b 744
6fc6879b 745 os_free(conf->eap_req_id_text);
2a5156a6 746 os_free(conf->erp_domain);
6fc6879b
JM		 747 os_free(conf->accept_mac);
748 os_free(conf->deny_mac);
749 os_free(conf->nas_identifier);
5afaa067
JM		 750 if (conf->radius) {
751 hostapd_config_free_radius(conf->radius->auth_servers,
752 conf->radius->num_auth_servers);
753 hostapd_config_free_radius(conf->radius->acct_servers,
754 conf->radius->num_acct_servers);
755 }
af35e7af
JM		 756 hostapd_config_free_radius_attr(conf->radius_auth_req_attr);
757 hostapd_config_free_radius_attr(conf->radius_acct_req_attr);
f4111ff3 758 os_free(conf->radius_req_attr_sqlite);
6fc6879b
JM		 759 os_free(conf->rsn_preauth_interfaces);
760 os_free(conf->ctrl_interface);
761 os_free(conf->ca_cert);
762 os_free(conf->server_cert);
e2722bf8 763 os_free(conf->server_cert2);
6fc6879b 764 os_free(conf->private_key);
e2722bf8 765 os_free(conf->private_key2);
6fc6879b 766 os_free(conf->private_key_passwd);
e2722bf8 767 os_free(conf->private_key_passwd2);
841205a1 768 os_free(conf->check_cert_subject);
080585c0 769 os_free(conf->ocsp_stapling_response);
5addb0df 770 os_free(conf->ocsp_stapling_response_multi);
6fc6879b 771 os_free(conf->dh_file);
f8995f8f 772 os_free(conf->openssl_ciphers);
d01203ca 773 os_free(conf->openssl_ecdh_curves);
6fc6879b
JM		 774 os_free(conf->pac_opaque_encr_key);
775 os_free(conf->eap_fast_a_id);
2d867244 776 os_free(conf->eap_fast_a_id_info);
6fc6879b
JM		 777 os_free(conf->eap_sim_db);
778 os_free(conf->radius_server_clients);
6fc6879b 779 os_free(conf->radius);
b031338c 780 os_free(conf->radius_das_shared_secret);
6fc6879b 781 hostapd_config_free_vlan(conf);
39b97072
JM		 782 os_free(conf->time_zone);
783
4ec1fd8e 784#ifdef CONFIG_IEEE80211R_AP
6fc6879b
JM		 785 {
786 struct ft_remote_r0kh *r0kh, *r0kh_prev;
787 struct ft_remote_r1kh *r1kh, *r1kh_prev;
788
789 r0kh = conf->r0kh_list;
790 conf->r0kh_list = NULL;
791 while (r0kh) {
792 r0kh_prev = r0kh;
793 r0kh = r0kh->next;
794 os_free(r0kh_prev);
795 }
796
797 r1kh = conf->r1kh_list;
798 conf->r1kh_list = NULL;
799 while (r1kh) {
800 r1kh_prev = r1kh;
801 r1kh = r1kh->next;
802 os_free(r1kh_prev);
803 }
804 }
4ec1fd8e 805#endif /* CONFIG_IEEE80211R_AP */
ad08c363
JM		 806
807#ifdef CONFIG_WPS
808 os_free(conf->wps_pin_requests);
809 os_free(conf->device_name);
810 os_free(conf->manufacturer);
811 os_free(conf->model_name);
812 os_free(conf->model_number);
813 os_free(conf->serial_number);
ad08c363
JM		 814 os_free(conf->config_methods);
815 os_free(conf->ap_pin);
62966253 816 os_free(conf->extra_cred);
4c29cae9 817 os_free(conf->ap_settings);
66819b07
DL		 818 hostapd_config_clear_wpa_psk(&conf->multi_ap_backhaul_ssid.wpa_psk);
819 str_clear_free(conf->multi_ap_backhaul_ssid.wpa_passphrase);
f620268f
JM		 820 os_free(conf->upnp_iface);
821 os_free(conf->friendly_name);
822 os_free(conf->manufacturer_url);
823 os_free(conf->model_description);
824 os_free(conf->model_url);
825 os_free(conf->upc);
a00ace9f
AO		 826 for (i = 0; i < MAX_WPS_VENDOR_EXTENSIONS; i++)
827 wpabuf_free(conf->wps_vendor_ext[i]);
3d41dd7c 828 wpabuf_free(conf->wps_application_ext);
ffdaa05a
JM		 829 wpabuf_free(conf->wps_nfc_dh_pubkey);
830 wpabuf_free(conf->wps_nfc_dh_privkey);
831 wpabuf_free(conf->wps_nfc_dev_pw);
ad08c363 832#endif /* CONFIG_WPS */
4b2a77ab
JM		 833
834 os_free(conf->roaming_consortium);
648cc711 835 os_free(conf->venue_name);
7e1d3ee9 836 os_free(conf->venue_url);
8047b186 837 os_free(conf->nai_realm_data);
550a3958 838 os_free(conf->network_auth_type);
7515adb2 839 os_free(conf->anqp_3gpp_cell_net);
26fac8b6 840 os_free(conf->domain_name);
695dbbea 841 hostapd_config_free_anqp_elem(conf);
505a3694
JM		 842
843#ifdef CONFIG_RADIUS_TEST
844 os_free(conf->dump_msk_file);
845#endif /* CONFIG_RADIUS_TEST */
df5934f1
JK		 846
847#ifdef CONFIG_HS20
a9277e85 848 os_free(conf->hs20_oper_friendly_name);
4065a309 849 os_free(conf->hs20_wan_metrics);
5ccc54aa 850 os_free(conf->hs20_connection_capability);
df5934f1 851 os_free(conf->hs20_operating_class);
f7bd7a01 852 os_free(conf->hs20_icons);
ae6d15c7 853 if (conf->hs20_osu_providers) {
ae6d15c7
JM		 854 for (i = 0; i < conf->hs20_osu_providers_count; i++) {
855 struct hs20_osu_provider *p;
856 size_t j;
857 p = &conf->hs20_osu_providers[i];
858 os_free(p->friendly_name);
859 os_free(p->server_uri);
860 os_free(p->method_list);
861 for (j = 0; j < p->icons_count; j++)
862 os_free(p->icons[j]);
863 os_free(p->icons);
864 os_free(p->osu_nai);
cad810a9 865 os_free(p->osu_nai2);
ae6d15c7
JM		 866 os_free(p->service_desc);
867 }
868 os_free(conf->hs20_osu_providers);
869 }
0e450db2 870 if (conf->hs20_operator_icon) {
0e450db2
JM		 871 for (i = 0; i < conf->hs20_operator_icon_count; i++)
872 os_free(conf->hs20_operator_icon[i]);
873 os_free(conf->hs20_operator_icon);
874 }
8d2a9921 875 os_free(conf->subscr_remediation_url);
7bd8c76a 876 os_free(conf->hs20_sim_provisioning_url);
6cb8f4f3 877 os_free(conf->t_c_filename);
8760b984 878 os_free(conf->t_c_server_url);
df5934f1 879#endif /* CONFIG_HS20 */
b52f084c
JM		 880
881 wpabuf_free(conf->vendor_elements);
a9112270 882 wpabuf_free(conf->assocresp_elements);
625f202a
JM		 883
884 os_free(conf->sae_groups);
91cc34bf
JM		 885#ifdef CONFIG_OWE
886 os_free(conf->owe_groups);
887#endif /* CONFIG_OWE */
67fe933d 888
88cb27c7
DS		 889 os_free(conf->wowlan_triggers);
890
67fe933d 891 os_free(conf->server_id);
ebd79f07 892
bc02843e
JM		 893#ifdef CONFIG_TESTING_OPTIONS
894 wpabuf_free(conf->own_ie_override);
3648d8a1 895 wpabuf_free(conf->sae_commit_override);
f2c4b44b 896 wpabuf_free(conf->rsnxe_override_eapol);
8d84c75f
JM		 897 wpabuf_free(conf->gtk_rsc_override);
898 wpabuf_free(conf->igtk_rsc_override);
bc02843e
JM		 899#endif /* CONFIG_TESTING_OPTIONS */
900
964f64e2 901 os_free(conf->no_probe_resp_if_seen_on);
0e2412d0 902 os_free(conf->no_auth_if_seen_on);
964f64e2 903
26bf70e3
JM		 904 hostapd_config_free_fils_realms(conf);
905
56c75495 906#ifdef CONFIG_DPP
5a5639b0
JM		 907 os_free(conf->dpp_name);
908 os_free(conf->dpp_mud_url);
56c75495
JM		 909 os_free(conf->dpp_connector);
910 wpabuf_free(conf->dpp_netaccesskey);
911 wpabuf_free(conf->dpp_csign);
e00f780e
JM		 912#ifdef CONFIG_DPP2
913 hostapd_dpp_controller_conf_free(conf->dpp_controller);
914#endif /* CONFIG_DPP2 */
56c75495
JM		 915#endif /* CONFIG_DPP */
916
9be19d0b 917 hostapd_config_free_sae_passwords(conf);
2377c1ca 918
ef721751
THJ		 919#ifdef CONFIG_AIRTIME_POLICY
920 {
921 struct airtime_sta_weight *wt, *wt_prev;
922
923 wt = conf->airtime_weight_list;
924 conf->airtime_weight_list = NULL;
925 while (wt) {
926 wt_prev = wt;
927 wt = wt->next;
928 os_free(wt_prev);
929 }
930 }
931#endif /* CONFIG_AIRTIME_POLICY */
932
ebd79f07 933 os_free(conf);
6fc6879b
JM		 934}
935
936
1c6e69cc
JM		 937/**
938 * hostapd_config_free - Free hostapd configuration
939 * @conf: Configuration data from hostapd_config_read().
940 */
6fc6879b
JM		 941void hostapd_config_free(struct hostapd_config *conf)
942{
943 size_t i;
944
945 if (conf == NULL)
946 return;
947
948 for (i = 0; i < conf->num_bss; i++)
ebd79f07 949 hostapd_config_free_bss(conf->bss[i]);
6fc6879b 950 os_free(conf->bss);
79d6c85f
JM		 951 os_free(conf->supported_rates);
952 os_free(conf->basic_rates);
857d9422 953 os_free(conf->acs_ch_list.range);
59bb7264 954 os_free(conf->acs_freq_list.range);
0ecff8d7 955 os_free(conf->driver_params);
68fa00c3
JM		 956#ifdef CONFIG_ACS
957 os_free(conf->acs_chan_bias);
958#endif /* CONFIG_ACS */
74e982d8
DS		 959 wpabuf_free(conf->lci);
960 wpabuf_free(conf->civic);
6fc6879b
JM		 961
962 os_free(conf);
963}
964
965
1c6e69cc
JM		 966/**
967 * hostapd_maclist_found - Find a MAC address from a list
968 * @list: MAC address list
969 * @num_entries: Number of addresses in the list
970 * @addr: Address to search for
971 * @vlan_id: Buffer for returning VLAN ID or %NULL if not needed
972 * Returns: 1 if address is in the list or 0 if not.
973 *
974 * Perform a binary search for given MAC address from a pre-sorted list.
975 */
271d2830 976int hostapd_maclist_found(struct mac_acl_entry *list, int num_entries,
1889af2e 977 const u8 *addr, struct vlan_description *vlan_id)
6fc6879b
JM		 978{
979 int start, end, middle, res;
980
981 start = 0;
982 end = num_entries - 1;
983
984 while (start <= end) {
985 middle = (start + end) / 2;
271d2830
JM		 986 res = os_memcmp(list[middle].addr, addr, ETH_ALEN);
987 if (res == 0) {
988 if (vlan_id)
989 *vlan_id = list[middle].vlan_id;
6fc6879b 990 return 1;
271d2830 991 }
6fc6879b
JM		 992 if (res < 0)
993 start = middle + 1;
994 else
995 end = middle - 1;
996 }
997
998 return 0;
999}
1000
1001
1002int hostapd_rate_found(int *list, int rate)
1003{
1004 int i;
1005
1006 if (list == NULL)
1007 return 0;
1008
1009 for (i = 0; list[i] >= 0; i++)
1010 if (list[i] == rate)
1011 return 1;
1012
1013 return 0;
1014}
1015
1016
1889af2e
MB		 1017int hostapd_vlan_valid(struct hostapd_vlan *vlan,
1018 struct vlan_description *vlan_desc)
6fc6879b
JM		 1019{
1020 struct hostapd_vlan *v = vlan;
8e44c192 1021 int i;
1889af2e 1022
8e44c192 1023 if (!vlan_desc->notempty || vlan_desc->untagged < 0 ||
1889af2e
MB		 1024 vlan_desc->untagged > MAX_VLAN_ID)
1025 return 0;
8e44c192
MB		 1026 for (i = 0; i < MAX_NUM_TAGGED_VLAN; i++) {
1027 if (vlan_desc->tagged[i] < 0 ||
1028 vlan_desc->tagged[i] > MAX_VLAN_ID)
1029 return 0;
1030 }
1031 if (!vlan_desc->untagged && !vlan_desc->tagged[0])
1032 return 0;
1889af2e 1033
6fc6879b 1034 while (v) {
1889af2e
MB		 1035 if (!vlan_compare(&v->vlan_desc, vlan_desc) ||
1036 v->vlan_id == VLAN_ID_WILDCARD)
80ebfd95
MB		 1037 return 1;
1038 v = v->next;
1039 }
1040 return 0;
1041}
1042
1043
1044const char * hostapd_get_vlan_id_ifname(struct hostapd_vlan *vlan, int vlan_id)
1045{
1046 struct hostapd_vlan *v = vlan;
1047 while (v) {
1048 if (v->vlan_id == vlan_id)
6fc6879b
JM		 1049 return v->ifname;
1050 v = v->next;
1051 }
1052 return NULL;
1053}
1054
1055
1056const u8 * hostapd_get_psk(const struct hostapd_bss_config *conf,
759fd76b 1057 const u8 *addr, const u8 *p2p_dev_addr,
dbfa691d 1058 const u8 *prev_psk, int *vlan_id)
6fc6879b
JM		 1059{
1060 struct hostapd_wpa_psk *psk;
1061 int next_ok = prev_psk == NULL;
1062
dbfa691d
JM		 1063 if (vlan_id)
1064 *vlan_id = 0;
1065
dc87541e 1066 if (p2p_dev_addr && !is_zero_ether_addr(p2p_dev_addr)) {
759fd76b
JM		 1067 wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR
1068 " p2p_dev_addr=" MACSTR " prev_psk=%p",
1069 MAC2STR(addr), MAC2STR(p2p_dev_addr), prev_psk);
dc87541e 1070 addr = NULL; /* Use P2P Device Address for matching */
759fd76b
JM		 1071 } else {
1072 wpa_printf(MSG_DEBUG, "Searching a PSK for " MACSTR
1073 " prev_psk=%p",
1074 MAC2STR(addr), prev_psk);
1075 }
1076
6fc6879b
JM		 1077 for (psk = conf->ssid.wpa_psk; psk != NULL; psk = psk->next) {
1078 if (next_ok &&
759fd76b
JM		 1079 (psk->group ||
1080 (addr && os_memcmp(psk->addr, addr, ETH_ALEN) == 0) ||
1081 (!addr && p2p_dev_addr &&
1082 os_memcmp(psk->p2p_dev_addr, p2p_dev_addr, ETH_ALEN) ==
dbfa691d
JM		 1083 0))) {
1084 if (vlan_id)
1085 *vlan_id = psk->vlan_id;
6fc6879b 1086 return psk->psk;
dbfa691d 1087 }
6fc6879b
JM		 1088
1089 if (psk->psk == prev_psk)
1090 next_ok = 1;
1091 }
1092
1093 return NULL;
1094}
eff0fd1e
JM		 1095
1096
1097static int hostapd_config_check_bss(struct hostapd_bss_config *bss,
08081ad8
JM		 1098 struct hostapd_config *conf,
1099 int full_config)
eff0fd1e 1100{
08081ad8 1101 if (full_config && bss->ieee802_1x && !bss->eap_server &&
eff0fd1e
JM		 1102 !bss->radius->auth_servers) {
1103 wpa_printf(MSG_ERROR, "Invalid IEEE 802.1X configuration (no "
1104 "EAP authenticator configured).");
1105 return -1;
1106 }
1107
1108 if (bss->wpa) {
1109 int wep, i;
1110
1111 wep = bss->default_wep_key_len > 0 ||
1112 bss->individual_wep_key_len > 0;
1113 for (i = 0; i < NUM_WEP_KEYS; i++) {
1114 if (bss->ssid.wep.keys_set) {
1115 wep = 1;
1116 break;
1117 }
1118 }
1119
1120 if (wep) {
1121 wpa_printf(MSG_ERROR, "WEP configuration in a WPA network is not supported");
1122 return -1;
1123 }
1124 }
1125
08081ad8
JM		 1126 if (full_config && bss->wpa &&
1127 bss->wpa_psk_radius != PSK_RADIUS_IGNORED &&
eff0fd1e
JM		 1128 bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH) {
1129 wpa_printf(MSG_ERROR, "WPA-PSK using RADIUS enabled, but no "
1130 "RADIUS checking (macaddr_acl=2) enabled.");
1131 return -1;
1132 }
1133
08081ad8 1134 if (full_config && bss->wpa && (bss->wpa_key_mgmt & WPA_KEY_MGMT_PSK) &&
eff0fd1e
JM		 1135 bss->ssid.wpa_psk == NULL && bss->ssid.wpa_passphrase == NULL &&
1136 bss->ssid.wpa_psk_file == NULL &&
1137 (bss->wpa_psk_radius != PSK_RADIUS_REQUIRED ||
1138 bss->macaddr_acl != USE_EXTERNAL_RADIUS_AUTH)) {
1139 wpa_printf(MSG_ERROR, "WPA-PSK enabled, but PSK or passphrase "
1140 "is not configured.");
1141 return -1;
1142 }
1143
902c07a7 1144 if (full_config && !is_zero_ether_addr(bss->bssid)) {
eff0fd1e
JM		 1145 size_t i;
1146
1147 for (i = 0; i < conf->num_bss; i++) {
1148 if (conf->bss[i] != bss &&
1149 (hostapd_mac_comp(conf->bss[i]->bssid,
1150 bss->bssid) == 0)) {
1151 wpa_printf(MSG_ERROR, "Duplicate BSSID " MACSTR
1152 " on interface '%s' and '%s'.",
1153 MAC2STR(bss->bssid),
1154 conf->bss[i]->iface, bss->iface);
1155 return -1;
1156 }
1157 }
1158 }
1159
4ec1fd8e 1160#ifdef CONFIG_IEEE80211R_AP
08081ad8 1161 if (full_config && wpa_key_mgmt_ft(bss->wpa_key_mgmt) &&
eff0fd1e
JM		 1162 (bss->nas_identifier == NULL ||
1163 os_strlen(bss->nas_identifier) < 1 ||
1164 os_strlen(bss->nas_identifier) > FT_R0KH_ID_MAX_LEN)) {
1165 wpa_printf(MSG_ERROR, "FT (IEEE 802.11r) requires "
1166 "nas_identifier to be configured as a 1..48 octet "
1167 "string");
1168 return -1;
1169 }
4ec1fd8e 1170#endif /* CONFIG_IEEE80211R_AP */
eff0fd1e
JM		 1171
1172#ifdef CONFIG_IEEE80211N
08081ad8
JM		 1173 if (full_config && conf->ieee80211n &&
1174 conf->hw_mode == HOSTAPD_MODE_IEEE80211B) {
eff0fd1e
JM		 1175 bss->disable_11n = 1;
1176 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) in 11b mode is not "
8c6f4a5a 1177 "allowed, disabling HT capabilities");
eff0fd1e
JM		 1178 }
1179
08081ad8 1180 if (full_config && conf->ieee80211n &&
eff0fd1e
JM		 1181 bss->ssid.security_policy == SECURITY_STATIC_WEP) {
1182 bss->disable_11n = 1;
1183 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WEP is not "
1184 "allowed, disabling HT capabilities");
1185 }
1186
08081ad8 1187 if (full_config && conf->ieee80211n && bss->wpa &&
eff0fd1e 1188 !(bss->wpa_pairwise & WPA_CIPHER_CCMP) &&
30675c34
JM		 1189 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1190 WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256)))
1191 {
eff0fd1e
JM		 1192 bss->disable_11n = 1;
1193 wpa_printf(MSG_ERROR, "HT (IEEE 802.11n) with WPA/WPA2 "
1194 "requires CCMP/GCMP to be enabled, disabling HT "
1195 "capabilities");
1196 }
1197#endif /* CONFIG_IEEE80211N */
1198
551817a5
WG		 1199#ifdef CONFIG_IEEE80211AC
1200 if (full_config && conf->ieee80211ac &&
1201 bss->ssid.security_policy == SECURITY_STATIC_WEP) {
1202 bss->disable_11ac = 1;
1203 wpa_printf(MSG_ERROR,
1204 "VHT (IEEE 802.11ac) with WEP is not allowed, disabling VHT capabilities");
1205 }
59d7cff7
FM		 1206
1207 if (full_config && conf->ieee80211ac && bss->wpa &&
1208 !(bss->wpa_pairwise & WPA_CIPHER_CCMP) &&
1209 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1210 WPA_CIPHER_CCMP_256 | WPA_CIPHER_GCMP_256)))
1211 {
1212 bss->disable_11ac = 1;
1213 wpa_printf(MSG_ERROR,
1214 "VHT (IEEE 802.11ac) with WPA/WPA2 requires CCMP/GCMP to be enabled, disabling VHT capabilities");
1215 }
551817a5
WG		 1216#endif /* CONFIG_IEEE80211AC */
1217
c201f93a 1218#ifdef CONFIG_WPS
08081ad8 1219 if (full_config && bss->wps_state && bss->ignore_broadcast_ssid) {
eff0fd1e
JM		 1220 wpa_printf(MSG_INFO, "WPS: ignore_broadcast_ssid "
1221 "configuration forced WPS to be disabled");
1222 bss->wps_state = 0;
1223 }
1224
08081ad8
JM		 1225 if (full_config && bss->wps_state &&
1226 bss->ssid.wep.keys_set && bss->wpa == 0) {
eff0fd1e
JM		 1227 wpa_printf(MSG_INFO, "WPS: WEP configuration forced WPS to be "
1228 "disabled");
1229 bss->wps_state = 0;
1230 }
1231
08081ad8 1232 if (full_config && bss->wps_state && bss->wpa &&
eff0fd1e 1233 (!(bss->wpa & 2) ||
a2660890
SSG		 1234 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1235 WPA_CIPHER_CCMP_256 |
1236 WPA_CIPHER_GCMP_256)))) {
eff0fd1e 1237 wpa_printf(MSG_INFO, "WPS: WPA/TKIP configuration without "
01a02593 1238 "WPA2/CCMP/GCMP forced WPS to be disabled");
eff0fd1e
JM		 1239 bss->wps_state = 0;
1240 }
c201f93a 1241#endif /* CONFIG_WPS */
eff0fd1e
JM		 1242
1243#ifdef CONFIG_HS20
08081ad8 1244 if (full_config && bss->hs20 &&
eff0fd1e 1245 (!(bss->wpa & 2) ||
30675c34
JM		 1246 !(bss->rsn_pairwise & (WPA_CIPHER_CCMP | WPA_CIPHER_GCMP |
1247 WPA_CIPHER_CCMP_256 |
1248 WPA_CIPHER_GCMP_256)))) {
eff0fd1e
JM		 1249 wpa_printf(MSG_ERROR, "HS 2.0: WPA2-Enterprise/CCMP "
1250 "configuration is required for Hotspot 2.0 "
1251 "functionality");
1252 return -1;
1253 }
1254#endif /* CONFIG_HS20 */
1255
4c572281
JM		 1256#ifdef CONFIG_MBO
1257 if (full_config && bss->mbo_enabled && (bss->wpa & 2) &&
1258 bss->ieee80211w == NO_MGMT_FRAME_PROTECTION) {
1259 wpa_printf(MSG_ERROR,
1260 "MBO: PMF needs to be enabled whenever using WPA2 with MBO");
1261 return -1;
1262 }
1263#endif /* CONFIG_MBO */
1264
9c55fdb0
MV		 1265#ifdef CONFIG_OCV
1266 if (full_config && bss->ieee80211w == NO_MGMT_FRAME_PROTECTION &&
1267 bss->ocv) {
1268 wpa_printf(MSG_ERROR,
1269 "OCV: PMF needs to be enabled whenever using OCV");
1270 return -1;
1271 }
1272#endif /* CONFIG_OCV */
1273
eff0fd1e
JM		 1274 return 0;
1275}
1276
1277
8884ce03
MM		 1278static int hostapd_config_check_cw(struct hostapd_config *conf, int queue)
1279{
1280 int tx_cwmin = conf->tx_queue[queue].cwmin;
1281 int tx_cwmax = conf->tx_queue[queue].cwmax;
1282 int ac_cwmin = conf->wmm_ac_params[queue].cwmin;
1283 int ac_cwmax = conf->wmm_ac_params[queue].cwmax;
1284
1285 if (tx_cwmin > tx_cwmax) {
1286 wpa_printf(MSG_ERROR,
1287 "Invalid TX queue cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)",
1288 tx_cwmin, tx_cwmax);
1289 return -1;
1290 }
1291 if (ac_cwmin > ac_cwmax) {
1292 wpa_printf(MSG_ERROR,
1293 "Invalid WMM AC cwMin/cwMax values. cwMin(%d) greater than cwMax(%d)",
1294 ac_cwmin, ac_cwmax);
1295 return -1;
1296 }
1297 return 0;
1298}
1299
1300
08081ad8 1301int hostapd_config_check(struct hostapd_config *conf, int full_config)
eff0fd1e
JM		 1302{
1303 size_t i;
1304
08081ad8
JM		 1305 if (full_config && conf->ieee80211d &&
1306 (!conf->country[0] || !conf->country[1])) {
eff0fd1e
JM		 1307 wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11d without "
1308 "setting the country_code");
1309 return -1;
1310 }
1311
08081ad8 1312 if (full_config && conf->ieee80211h && !conf->ieee80211d) {
eff0fd1e
JM		 1313 wpa_printf(MSG_ERROR, "Cannot enable IEEE 802.11h without "
1314 "IEEE 802.11d enabled");
1315 return -1;
1316 }
1317
e0392f82
S		 1318 if (full_config && conf->local_pwr_constraint != -1 &&
1319 !conf->ieee80211d) {
1320 wpa_printf(MSG_ERROR, "Cannot add Power Constraint element without Country element");
1321 return -1;
1322 }
1323
3d7ad2f6
C		 1324 if (full_config && conf->spectrum_mgmt_required &&
1325 conf->local_pwr_constraint == -1) {
1326 wpa_printf(MSG_ERROR, "Cannot set Spectrum Management bit without Country and Power Constraint elements");
1327 return -1;
1328 }
1329
ef721751
THJ		 1330#ifdef CONFIG_AIRTIME_POLICY
1331 if (full_config && conf->airtime_mode > AIRTIME_MODE_STATIC &&
1332 !conf->airtime_update_interval) {
1333 wpa_printf(MSG_ERROR, "Airtime update interval cannot be zero");
1334 return -1;
1335 }
1336#endif /* CONFIG_AIRTIME_POLICY */
8884ce03
MM		 1337 for (i = 0; i < NUM_TX_QUEUES; i++) {
1338 if (hostapd_config_check_cw(conf, i))
1339 return -1;
1340 }
1341
eff0fd1e 1342 for (i = 0; i < conf->num_bss; i++) {
08081ad8 1343 if (hostapd_config_check_bss(conf->bss[i], conf, full_config))
eff0fd1e
JM		 1344 return -1;
1345 }
1346
1347 return 0;
1348}
1349
1350
5d67bf15
JM		 1351void hostapd_set_security_params(struct hostapd_bss_config *bss,
1352 int full_config)
eff0fd1e
JM		 1353{
1354 if (bss->individual_wep_key_len == 0) {
1355 /* individual keys are not use; can use key idx0 for
1356 * broadcast keys */
1357 bss->broadcast_key_idx_min = 0;
1358 }
1359
1360 if ((bss->wpa & 2) && bss->rsn_pairwise == 0)
1361 bss->rsn_pairwise = bss->wpa_pairwise;
27781c0a
JM		 1362 if (bss->group_cipher)
1363 bss->wpa_group = bss->group_cipher;
1364 else
1365 bss->wpa_group = wpa_select_ap_group_cipher(bss->wpa,
1366 bss->wpa_pairwise,
1367 bss->rsn_pairwise);
90f837b0
JM		 1368 if (!bss->wpa_group_rekey_set)
1369 bss->wpa_group_rekey = bss->wpa_group == WPA_CIPHER_TKIP ?
1370 600 : 86400;
eff0fd1e 1371
5d67bf15
JM		 1372 if (full_config) {
1373 bss->radius->auth_server = bss->radius->auth_servers;
1374 bss->radius->acct_server = bss->radius->acct_servers;
1375 }
eff0fd1e
JM		 1376
1377 if (bss->wpa && bss->ieee802_1x) {
1378 bss->ssid.security_policy = SECURITY_WPA;
1379 } else if (bss->wpa) {
1380 bss->ssid.security_policy = SECURITY_WPA_PSK;
1381 } else if (bss->ieee802_1x) {
1382 int cipher = WPA_CIPHER_NONE;
1383 bss->ssid.security_policy = SECURITY_IEEE_802_1X;
1384 bss->ssid.wep.default_len = bss->default_wep_key_len;
13a3a20d 1385 if (full_config && bss->default_wep_key_len) {
eff0fd1e
JM		 1386 cipher = bss->default_wep_key_len >= 13 ?
1387 WPA_CIPHER_WEP104 : WPA_CIPHER_WEP40;
13a3a20d
JM		 1388 } else if (full_config && bss->ssid.wep.keys_set) {
1389 if (bss->ssid.wep.len[0] >= 13)
1390 cipher = WPA_CIPHER_WEP104;
1391 else
1392 cipher = WPA_CIPHER_WEP40;
1393 }
eff0fd1e
JM		 1394 bss->wpa_group = cipher;
1395 bss->wpa_pairwise = cipher;
1396 bss->rsn_pairwise = cipher;
13a3a20d
JM		 1397 if (full_config)
1398 bss->wpa_key_mgmt = WPA_KEY_MGMT_IEEE8021X_NO_WPA;
eff0fd1e
JM		 1399 } else if (bss->ssid.wep.keys_set) {
1400 int cipher = WPA_CIPHER_WEP40;
1401 if (bss->ssid.wep.len[0] >= 13)
1402 cipher = WPA_CIPHER_WEP104;
1403 bss->ssid.security_policy = SECURITY_STATIC_WEP;
1404 bss->wpa_group = cipher;
1405 bss->wpa_pairwise = cipher;
1406 bss->rsn_pairwise = cipher;
13a3a20d
JM		 1407 if (full_config)
1408 bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE;
a14896e8
JM		 1409 } else if (bss->osen) {
1410 bss->ssid.security_policy = SECURITY_OSEN;
1411 bss->wpa_group = WPA_CIPHER_CCMP;
1412 bss->wpa_pairwise = 0;
1413 bss->rsn_pairwise = WPA_CIPHER_CCMP;
eff0fd1e
JM		 1414 } else {
1415 bss->ssid.security_policy = SECURITY_PLAINTEXT;
29767152
JM		 1416 if (full_config) {
1417 bss->wpa_group = WPA_CIPHER_NONE;
1418 bss->wpa_pairwise = WPA_CIPHER_NONE;
1419 bss->rsn_pairwise = WPA_CIPHER_NONE;
13a3a20d 1420 bss->wpa_key_mgmt = WPA_KEY_MGMT_NONE;
29767152 1421 }
eff0fd1e
JM		 1422 }
1423}
42d30863
JM		 1424
1425
1426int hostapd_sae_pw_id_in_use(struct hostapd_bss_config *conf)
1427{
1428 int with_id = 0, without_id = 0;
1429 struct sae_password_entry *pw;
1430
1431 if (conf->ssid.wpa_passphrase)
1432 without_id = 1;
1433
1434 for (pw = conf->sae_passwords; pw; pw = pw->next) {
1435 if (pw->identifier)
1436 with_id = 1;
1437 else
1438 without_id = 1;
1439 if (with_id && without_id)
1440 break;
1441 }
1442
1443 if (with_id && !without_id)
1444 return 2;
1445 return with_id;
1446}
Unnamed repository; edit this file 'description' to name the repository.