[thirdparty/hostap.git] / src / ap / drv_callbacks.c

/*
 * hostapd / Callback functions for driver wrappers
 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Alternatively, this software may be distributed under the terms of BSD
 * license.
 *
 * See README and COPYING for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "radius/radius.h"
#include "drivers/driver.h"
#include "common/ieee802_11_defs.h"
#include "common/ieee802_11_common.h"
#include "common/wpa_ctrl.h"
#include "crypto/random.h"
#include "p2p/p2p.h"
#include "wps/wps.h"
#include "hostapd.h"
#include "ieee802_11.h"
#include "sta_info.h"
#include "accounting.h"
#include "tkip_countermeasures.h"
#include "iapp.h"
#include "ieee802_1x.h"
#include "wpa_auth.h"
#include "wmm.h"
#include "wps_hostapd.h"
#include "ap_drv_ops.h"
#include "ap_config.h"


int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
			const u8 *ie, size_t ielen, int reassoc)
{
	struct sta_info *sta;
	int new_assoc, res;
	struct ieee802_11_elems elems;
#ifdef CONFIG_P2P
	const u8 *all_ies = ie;
	size_t all_ies_len = ielen;
#endif /* CONFIG_P2P */

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up being set to station mode while hostapd was
		 * running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
			   "no address");
		return -1;
	}
	random_add_randomness(addr, ETH_ALEN);

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "associated");

	ieee802_11_parse_elems(ie, ielen, &elems, 0);
	if (elems.wps_ie) {
		ie = elems.wps_ie - 2;
		ielen = elems.wps_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	} else if (elems.rsn_ie) {
		ie = elems.rsn_ie - 2;
		ielen = elems.rsn_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	} else if (elems.wpa_ie) {
		ie = elems.wpa_ie - 2;
		ielen = elems.wpa_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	} else {
		ie = NULL;
		ielen = 0;
		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
			   "(Re)AssocReq");
	}

	sta = ap_get_sta(hapd, addr);
	if (sta) {
		accounting_sta_stop(hapd, sta);
	} else {
		sta = ap_sta_add(hapd, addr);
		if (sta == NULL)
			return -1;
	}
	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);

#ifdef CONFIG_P2P
	if (elems.p2p) {
		wpabuf_free(sta->p2p_ie);
		sta->p2p_ie = ieee802_11_vendor_ie_concat(all_ies, all_ies_len,
							  P2P_IE_VENDOR_TYPE);
	}
#endif /* CONFIG_P2P */

	if (hapd->conf->wpa) {
		if (ie == NULL || ielen == 0) {
			if (hapd->conf->wps_state) {
				wpa_printf(MSG_DEBUG, "STA did not include "
					   "WPA/RSN IE in (Re)Association "
					   "Request - possible WPS use");
				sta->flags |= WLAN_STA_MAYBE_WPS;
				goto skip_wpa_check;
			}

			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
			return -1;
		}
		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
		    os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
			sta->flags |= WLAN_STA_WPS;
			goto skip_wpa_check;
		}

		if (sta->wpa_sm == NULL)
			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
							sta->addr);
		if (sta->wpa_sm == NULL) {
			wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
				   "machine");
			return -1;
		}
		res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
					  ie, ielen, NULL, 0);
		if (res != WPA_IE_OK) {
			int resp;
			wpa_printf(MSG_DEBUG, "WPA/RSN information element "
				   "rejected? (res %u)", res);
			wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
			if (res == WPA_INVALID_GROUP)
				resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_PAIRWISE)
				resp = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_AKMP)
				resp = WLAN_REASON_AKMP_NOT_VALID;
#ifdef CONFIG_IEEE80211W
			else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
				resp = WLAN_REASON_INVALID_IE;
			else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
				resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
#endif /* CONFIG_IEEE80211W */
			else
				resp = WLAN_REASON_INVALID_IE;
			hostapd_drv_sta_disassoc(hapd, sta->addr, resp);
			ap_free_sta(hapd, sta);
			return -1;
		}
	} else if (hapd->conf->wps_state) {
#ifdef CONFIG_WPS_STRICT
		if (ie) {
			struct wpabuf *wps;
			wps = ieee802_11_vendor_ie_concat(ie, ielen,
							  WPS_IE_VENDOR_TYPE);
			if (wps && wps_validate_assoc_req(wps) < 0) {
				hostapd_drv_sta_disassoc(
					hapd, sta->addr,
					WLAN_REASON_INVALID_IE);
				ap_free_sta(hapd, sta);
				wpabuf_free(wps);
				return -1;
			}
			wpabuf_free(wps);
		}
#endif /* CONFIG_WPS_STRICT */
		if (ie && ielen > 4 && ie[0] == 0xdd && ie[1] >= 4 &&
		    os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
			sta->flags |= WLAN_STA_WPS;
		} else
			sta->flags |= WLAN_STA_MAYBE_WPS;
	}
skip_wpa_check:

	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);

	hostapd_new_assoc_sta(hapd, sta, !new_assoc);

	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);

#ifdef CONFIG_P2P
	p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
			      all_ies, all_ies_len);
#endif /* CONFIG_P2P */

	return 0;
}


void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta;

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up reporting a station mode event while hostapd
		 * was running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
			   "with no address");
		return;
	}

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disassociated");

	sta = ap_get_sta(hapd, addr);
	if (sta == NULL) {
		wpa_printf(MSG_DEBUG, "Disassociation notification for "
			   "unknown STA " MACSTR, MAC2STR(addr));
		return;
	}

	sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
		MAC2STR(sta->addr));
	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	ap_free_sta(hapd, sta);
}


void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);

	if (!sta || !hapd->conf->disassoc_low_ack)
		return;

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
		       "missing ACKs");
	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	if (sta)
		ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
}


int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa,
			 const u8 *ie, size_t ie_len)
{
	size_t i;
	int ret = 0;

	if (sa == NULL || ie == NULL)
		return -1;

	random_add_randomness(sa, ETH_ALEN);
	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
		if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
					    sa, ie, ie_len) > 0) {
			ret = 1;
			break;
		}
	}
	return ret;
}


#ifdef HOSTAPD

#ifdef NEED_AP_MLME

static const u8 * get_hdr_bssid(const struct ieee80211_hdr *hdr, size_t len)
{
	u16 fc, type, stype;

	/*
	 * PS-Poll frames are 16 bytes. All other frames are
	 * 24 bytes or longer.
	 */
	if (len < 16)
		return NULL;

	fc = le_to_host16(hdr->frame_control);
	type = WLAN_FC_GET_TYPE(fc);
	stype = WLAN_FC_GET_STYPE(fc);

	switch (type) {
	case WLAN_FC_TYPE_DATA:
		if (len < 24)
			return NULL;
		switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
		case WLAN_FC_FROMDS | WLAN_FC_TODS:
		case WLAN_FC_TODS:
			return hdr->addr1;
		case WLAN_FC_FROMDS:
			return hdr->addr2;
		default:
			return NULL;
		}
	case WLAN_FC_TYPE_CTRL:
		if (stype != WLAN_FC_STYPE_PSPOLL)
			return NULL;
		return hdr->addr1;
	case WLAN_FC_TYPE_MGMT:
		return hdr->addr3;
	default:
		return NULL;
	}
}


#define HAPD_BROADCAST ((struct hostapd_data *) -1)

static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
					    const u8 *bssid)
{
	size_t i;

	if (bssid == NULL)
		return NULL;
	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	    bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
		return HAPD_BROADCAST;

	for (i = 0; i < iface->num_bss; i++) {
		if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
			return iface->bss[i];
	}

	return NULL;
}


static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
					const u8 *frame, size_t len)
{
	const struct ieee80211_hdr *hdr = (const struct ieee80211_hdr *) frame;
	u16 fc = le_to_host16(hdr->frame_control);
	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;

	ieee802_11_rx_from_unknown(hapd, hdr->addr2,
				   (fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) ==
				   (WLAN_FC_TODS | WLAN_FC_FROMDS));
}


static void hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
{
	struct hostapd_iface *iface = hapd->iface;
	const struct ieee80211_hdr *hdr;
	const u8 *bssid;
	struct hostapd_frame_info fi;

	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
	if (bssid == NULL)
		return;

	hapd = get_hapd_bssid(iface, bssid);
	if (hapd == NULL) {
		u16 fc;
		fc = le_to_host16(hdr->frame_control);

		/*
		 * Drop frames to unknown BSSIDs except for Beacon frames which
		 * could be used to update neighbor information.
		 */
		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
			hapd = iface->bss[0];
		else
			return;
	}

	os_memset(&fi, 0, sizeof(fi));
	fi.datarate = rx_mgmt->datarate;
	fi.ssi_signal = rx_mgmt->ssi_signal;

	if (hapd == HAPD_BROADCAST) {
		size_t i;
		for (i = 0; i < iface->num_bss; i++)
			ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
					rx_mgmt->frame_len, &fi);
	} else
		ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);

	random_add_randomness(&fi, sizeof(fi));
}


static void hostapd_rx_action(struct hostapd_data *hapd,
			      struct rx_action *rx_action)
{
	struct rx_mgmt rx_mgmt;
	u8 *buf;
	struct ieee80211_hdr *hdr;

	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
		   " BSSID=" MACSTR " category=%u",
		   MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
		   MAC2STR(rx_action->bssid), rx_action->category);
	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
		    rx_action->data, rx_action->len);

	buf = os_zalloc(24 + 1 + rx_action->len);
	if (buf == NULL)
		return;
	hdr = (struct ieee80211_hdr *) buf;
	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
					  WLAN_FC_STYPE_ACTION);
	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
		/*
		 * Assume frame was protected; it would have been dropped if
		 * not.
		 */
		hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
	}
	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	buf[24] = rx_action->category;
	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	rx_mgmt.frame = buf;
	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	hostapd_mgmt_rx(hapd, &rx_mgmt);
	os_free(buf);
}


static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
			       size_t len, u16 stype, int ok)
{
	struct ieee80211_hdr *hdr;
	hdr = (struct ieee80211_hdr *) buf;
	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;
	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
}

#endif /* NEED_AP_MLME */


static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);
	if (sta)
		return 0;

	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
		   " - adding a new STA", MAC2STR(addr));
	sta = ap_sta_add(hapd, addr);
	if (sta) {
		hostapd_new_assoc_sta(hapd, sta, 0);
	} else {
		wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
			   MAC2STR(addr));
		return -1;
	}

	return 0;
}


static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
				   const u8 *data, size_t data_len)
{
	struct hostapd_iface *iface = hapd->iface;
	size_t j;

	for (j = 0; j < iface->num_bss; j++) {
		if (ap_get_sta(iface->bss[j], src)) {
			hapd = iface->bss[j];
			break;
		}
	}

	ieee802_1x_receive(hapd, src, data, data_len);
}


void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
			  union wpa_event_data *data)
{
	struct hostapd_data *hapd = ctx;

	switch (event) {
	case EVENT_MICHAEL_MIC_FAILURE:
		michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
		break;
	case EVENT_SCAN_RESULTS:
		if (hapd->iface->scan_cb)
			hapd->iface->scan_cb(hapd->iface);
		break;
#ifdef CONFIG_IEEE80211R
	case EVENT_FT_RRB_RX:
		wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
			      data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
		break;
#endif /* CONFIG_IEEE80211R */
	case EVENT_WPS_BUTTON_PUSHED:
		hostapd_wps_button_pushed(hapd, NULL);
		break;
#ifdef NEED_AP_MLME
	case EVENT_TX_STATUS:
		switch (data->tx_status.type) {
		case WLAN_FC_TYPE_MGMT:
			hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
					   data->tx_status.data_len,
					   data->tx_status.stype,
					   data->tx_status.ack);
			break;
		case WLAN_FC_TYPE_DATA:
			hostapd_tx_status(hapd, data->tx_status.dst,
					  data->tx_status.data,
					  data->tx_status.data_len,
					  data->tx_status.ack);
			break;
		}
		break;
	case EVENT_RX_FROM_UNKNOWN:
		hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.frame,
					    data->rx_from_unknown.len);
		break;
	case EVENT_RX_MGMT:
		hostapd_mgmt_rx(hapd, &data->rx_mgmt);
		break;
#endif /* NEED_AP_MLME */
	case EVENT_RX_PROBE_REQ:
		if (data->rx_probe_req.sa == NULL ||
		    data->rx_probe_req.ie == NULL)
			break;
		hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
				     data->rx_probe_req.ie,
				     data->rx_probe_req.ie_len);
		break;
	case EVENT_NEW_STA:
		hostapd_event_new_sta(hapd, data->new_sta.addr);
		break;
	case EVENT_EAPOL_RX:
		hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
				       data->eapol_rx.data,
				       data->eapol_rx.data_len);
		break;
	case EVENT_ASSOC:
		hostapd_notif_assoc(hapd, data->assoc_info.addr,
				    data->assoc_info.req_ies,
				    data->assoc_info.req_ies_len,
				    data->assoc_info.reassoc);
		break;
	case EVENT_DISASSOC:
		if (data)
			hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
		break;
	case EVENT_DEAUTH:
		if (data)
			hostapd_notif_disassoc(hapd, data->deauth_info.addr);
		break;
	case EVENT_STATION_LOW_ACK:
		if (!data)
			break;
		hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
		break;
#ifdef NEED_AP_MLME
	case EVENT_RX_ACTION:
		if (data->rx_action.da == NULL || data->rx_action.sa == NULL ||
		    data->rx_action.bssid == NULL)
			break;
		hostapd_rx_action(hapd, &data->rx_action);
		break;
#endif /* NEED_AP_MLME */
	default:
		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
		break;
	}
}

#endif /* HOSTAPD */
Commit	Line	Data
b5b969e9 JM	1	/*
	2	* hostapd / Callback functions for driver wrappers
	3	* Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*
	9	* Alternatively, this software may be distributed under the terms of BSD
	10	* license.
	11	*
	12	* See README and COPYING for more details.
	13	*/
	14
6226e38d	15	#include "utils/includes.h"
b5b969e9	16
6226e38d	17	#include "utils/common.h"
b5b969e9	18	#include "radius/radius.h"
6e6e8c31	19	#include "drivers/driver.h"
81f4f619	20	#include "common/ieee802_11_defs.h"
c41a1095	21	#include "common/ieee802_11_common.h"
9a3cb18d	22	#include "common/wpa_ctrl.h"
bbb921da	23	#include "crypto/random.h"
ef796391	24	#include "p2p/p2p.h"
54f489be	25	#include "wps/wps.h"
6226e38d JM	26	#include "hostapd.h"
	27	#include "ieee802_11.h"
	28	#include "sta_info.h"
	29	#include "accounting.h"
	30	#include "tkip_countermeasures.h"
	31	#include "iapp.h"
	32	#include "ieee802_1x.h"
	33	#include "wpa_auth.h"
	34	#include "wmm.h"
	35	#include "wps_hostapd.h"
51e2a27a	36	#include "ap_drv_ops.h"
8b06c1ed	37	#include "ap_config.h"
b5b969e9 JM	38
b5b969e9 JM	39
b5b969e9	40	int hostapd_notif_assoc(struct hostapd_data hapd, const u8 addr,
39b08b5f	41	const u8 *ie, size_t ielen, int reassoc)
b5b969e9 JM	42	{
	43	struct sta_info *sta;
	44	int new_assoc, res;
c41a1095	45	struct ieee802_11_elems elems;
b305c684 JM	46	#ifdef CONFIG_P2P
	47	const u8 *all_ies = ie;
	48	size_t all_ies_len = ielen;
	49	#endif /* CONFIG_P2P */
b5b969e9	50
68532a9c JM	51	if (addr == NULL) {
	52	/*
	53	* This could potentially happen with unexpected event from the
	54	* driver wrapper. This was seen at least in one case where the
	55	* driver ended up being set to station mode while hostapd was
	56	* running, so better make sure we stop processing such an
	57	* event here.
	58	*/
	59	wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
	60	"no address");
	61	return -1;
	62	}
bbb921da	63	random_add_randomness(addr, ETH_ALEN);
68532a9c	64
b5b969e9 JM	65	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	66	HOSTAPD_LEVEL_INFO, "associated");
	67
c41a1095 JM	68	ieee802_11_parse_elems(ie, ielen, &elems, 0);
	69	if (elems.wps_ie) {
	70	ie = elems.wps_ie - 2;
	71	ielen = elems.wps_ie_len + 2;
	72	wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	73	} else if (elems.rsn_ie) {
	74	ie = elems.rsn_ie - 2;
	75	ielen = elems.rsn_ie_len + 2;
	76	wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	77	} else if (elems.wpa_ie) {
	78	ie = elems.wpa_ie - 2;
	79	ielen = elems.wpa_ie_len + 2;
	80	wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	81	} else {
	82	ie = NULL;
	83	ielen = 0;
	84	wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
	85	"(Re)AssocReq");
	86	}
	87
b5b969e9 JM	88	sta = ap_get_sta(hapd, addr);
	89	if (sta) {
	90	accounting_sta_stop(hapd, sta);
	91	} else {
	92	sta = ap_sta_add(hapd, addr);
	93	if (sta == NULL)
	94	return -1;
	95	}
	96	sta->flags &= ~(WLAN_STA_WPS \| WLAN_STA_MAYBE_WPS);
	97
b305c684 JM	98	#ifdef CONFIG_P2P
	99	if (elems.p2p) {
	100	wpabuf_free(sta->p2p_ie);
	101	sta->p2p_ie = ieee802_11_vendor_ie_concat(all_ies, all_ies_len,
	102	P2P_IE_VENDOR_TYPE);
	103	}
	104	#endif /* CONFIG_P2P */
	105
b5b969e9 JM	106	if (hapd->conf->wpa) {
	107	if (ie == NULL \|\| ielen == 0) {
	108	if (hapd->conf->wps_state) {
	109	wpa_printf(MSG_DEBUG, "STA did not include "
	110	"WPA/RSN IE in (Re)Association "
	111	"Request - possible WPS use");
	112	sta->flags \|= WLAN_STA_MAYBE_WPS;
	113	goto skip_wpa_check;
	114	}
	115
	116	wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
	117	return -1;
	118	}
	119	if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
	120	os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
	121	sta->flags \|= WLAN_STA_WPS;
	122	goto skip_wpa_check;
	123	}
	124
	125	if (sta->wpa_sm == NULL)
	126	sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
	127	sta->addr);
	128	if (sta->wpa_sm == NULL) {
	129	wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
	130	"machine");
	131	return -1;
	132	}
	133	res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
	134	ie, ielen, NULL, 0);
	135	if (res != WPA_IE_OK) {
355d36a7	136	int resp;
b5b969e9 JM	137	wpa_printf(MSG_DEBUG, "WPA/RSN information element "
	138	"rejected? (res %u)", res);
	139	wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
355d36a7 AT	140	if (res == WPA_INVALID_GROUP)
	141	resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
	142	else if (res == WPA_INVALID_PAIRWISE)
	143	resp = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
	144	else if (res == WPA_INVALID_AKMP)
	145	resp = WLAN_REASON_AKMP_NOT_VALID;
	146	#ifdef CONFIG_IEEE80211W
	147	else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
	148	resp = WLAN_REASON_INVALID_IE;
	149	else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
	150	resp = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
	151	#endif /* CONFIG_IEEE80211W */
	152	else
	153	resp = WLAN_REASON_INVALID_IE;
51e2a27a	154	hostapd_drv_sta_disassoc(hapd, sta->addr, resp);
355d36a7	155	ap_free_sta(hapd, sta);
b5b969e9 JM	156	return -1;
b5b969e9 JM	157	}
a9aca28b	158	} else if (hapd->conf->wps_state) {
54f489be	159	#ifdef CONFIG_WPS_STRICT
6e432d3f JM	160	if (ie) {
	161	struct wpabuf *wps;
	162	wps = ieee802_11_vendor_ie_concat(ie, ielen,
	163	WPS_IE_VENDOR_TYPE);
	164	if (wps && wps_validate_assoc_req(wps) < 0) {
	165	hostapd_drv_sta_disassoc(
	166	hapd, sta->addr,
	167	WLAN_REASON_INVALID_IE);
	168	ap_free_sta(hapd, sta);
	169	wpabuf_free(wps);
	170	return -1;
	171	}
54f489be	172	wpabuf_free(wps);
54f489be	173	}
54f489be	174	#endif /* CONFIG_WPS_STRICT */
a9aca28b JM	175	if (ie && ielen > 4 && ie[0] == 0xdd && ie[1] >= 4 &&
	176	os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
	177	sta->flags \|= WLAN_STA_WPS;
	178	} else
	179	sta->flags \|= WLAN_STA_MAYBE_WPS;
b5b969e9 JM	180	}
	181	skip_wpa_check:
	182
	183	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	184	sta->flags \|= WLAN_STA_AUTH \| WLAN_STA_ASSOC;
	185	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
	186
	187	hostapd_new_assoc_sta(hapd, sta, !new_assoc);
	188
	189	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
	190
ef796391	191	#ifdef CONFIG_P2P
3f4ce13f JM	192	p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
3f4ce13f JM	193	all_ies, all_ies_len);
ef796391 JM	194	#endif /* CONFIG_P2P */
ef796391 JM	195
b5b969e9 JM	196	return 0;
	197	}
	198
	199
	200	void hostapd_notif_disassoc(struct hostapd_data hapd, const u8 addr)
	201	{
	202	struct sta_info *sta;
	203
83e843e8 JM	204	if (addr == NULL) {
	205	/*
	206	* This could potentially happen with unexpected event from the
	207	* driver wrapper. This was seen at least in one case where the
	208	* driver ended up reporting a station mode event while hostapd
	209	* was running, so better make sure we stop processing such an
	210	* event here.
	211	*/
	212	wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
	213	"with no address");
1f4c7b6b	214	return;
83e843e8 JM	215	}
83e843e8 JM	216
b5b969e9 JM	217	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	218	HOSTAPD_LEVEL_INFO, "disassociated");
	219
	220	sta = ap_get_sta(hapd, addr);
	221	if (sta == NULL) {
	222	wpa_printf(MSG_DEBUG, "Disassociation notification for "
	223	"unknown STA " MACSTR, MAC2STR(addr));
	224	return;
	225	}
	226
	227	sta->flags &= ~(WLAN_STA_AUTH \| WLAN_STA_ASSOC);
9a3cb18d JM	228	wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
9a3cb18d JM	229	MAC2STR(sta->addr));
b5b969e9 JM	230	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	231	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	232	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	233	ap_free_sta(hapd, sta);
	234	}
	235
	236
0d7e5a3a JB	237	void hostapd_event_sta_low_ack(struct hostapd_data hapd, const u8 addr)
	238	{
	239	struct sta_info *sta = ap_get_sta(hapd, addr);
	240
	241	if (!sta \|\| !hapd->conf->disassoc_low_ack)
	242	return;
	243
	244	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	245	HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
	246	"missing ACKs");
	247	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	248	if (sta)
	249	ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
	250	}
	251
	252
e67b55fb JM	253	int hostapd_probe_req_rx(struct hostapd_data hapd, const u8 sa,
	254	const u8 *ie, size_t ie_len)
	255	{
	256	size_t i;
	257	int ret = 0;
	258
b211f3eb JM	259	if (sa == NULL \|\| ie == NULL)
	260	return -1;
	261
	262	random_add_randomness(sa, ETH_ALEN);
e67b55fb JM	263	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
	264	if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
	265	sa, ie, ie_len) > 0) {
	266	ret = 1;
	267	break;
	268	}
	269	}
	270	return ret;
	271	}
	272
	273
f8b1f695 JM	274	#ifdef HOSTAPD
f8b1f695 JM	275
fe6bdb77	276	#ifdef NEED_AP_MLME
f8b1f695 JM	277
	278	static const u8 * get_hdr_bssid(const struct ieee80211_hdr *hdr, size_t len)
	279	{
	280	u16 fc, type, stype;
	281
	282	/*
	283	* PS-Poll frames are 16 bytes. All other frames are
	284	* 24 bytes or longer.
	285	*/
	286	if (len < 16)
	287	return NULL;
	288
	289	fc = le_to_host16(hdr->frame_control);
	290	type = WLAN_FC_GET_TYPE(fc);
	291	stype = WLAN_FC_GET_STYPE(fc);
	292
	293	switch (type) {
	294	case WLAN_FC_TYPE_DATA:
	295	if (len < 24)
	296	return NULL;
	297	switch (fc & (WLAN_FC_FROMDS \| WLAN_FC_TODS)) {
fbbfcbac	298	case WLAN_FC_FROMDS \| WLAN_FC_TODS:
f8b1f695 JM	299	case WLAN_FC_TODS:
	300	return hdr->addr1;
	301	case WLAN_FC_FROMDS:
	302	return hdr->addr2;
	303	default:
	304	return NULL;
	305	}
	306	case WLAN_FC_TYPE_CTRL:
	307	if (stype != WLAN_FC_STYPE_PSPOLL)
	308	return NULL;
	309	return hdr->addr1;
	310	case WLAN_FC_TYPE_MGMT:
	311	return hdr->addr3;
	312	default:
	313	return NULL;
	314	}
	315	}
	316
	317
	318	#define HAPD_BROADCAST ((struct hostapd_data *) -1)
	319
	320	static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
	321	const u8 *bssid)
	322	{
	323	size_t i;
	324
	325	if (bssid == NULL)
	326	return NULL;
	327	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	328	bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
	329	return HAPD_BROADCAST;
	330
	331	for (i = 0; i < iface->num_bss; i++) {
	332	if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
	333	return iface->bss[i];
	334	}
	335
	336	return NULL;
	337	}
	338
	339
	340	static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
0d9fc3d8	341	const u8 *frame, size_t len)
f8b1f695	342	{
0d9fc3d8	343	const struct ieee80211_hdr hdr = (const struct ieee80211_hdr ) frame;
fbbfcbac	344	u16 fc = le_to_host16(hdr->frame_control);
f8b1f695 JM	345	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	346	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	347	return;
	348
fbbfcbac FF	349	ieee802_11_rx_from_unknown(hapd, hdr->addr2,
	350	(fc & (WLAN_FC_TODS \| WLAN_FC_FROMDS)) ==
	351	(WLAN_FC_TODS \| WLAN_FC_FROMDS));
f8b1f695 JM	352	}
	353
	354
2a8b7416	355	static void hostapd_mgmt_rx(struct hostapd_data hapd, struct rx_mgmt rx_mgmt)
b5b969e9	356	{
4b9841d3	357	struct hostapd_iface *iface = hapd->iface;
b57e086c	358	const struct ieee80211_hdr *hdr;
4b9841d3	359	const u8 *bssid;
2a8b7416	360	struct hostapd_frame_info fi;
4b9841d3	361
2a8b7416 JM	362	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
2a8b7416 JM	363	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
4b9841d3 JM	364	if (bssid == NULL)
	365	return;
	366
	367	hapd = get_hapd_bssid(iface, bssid);
	368	if (hapd == NULL) {
	369	u16 fc;
	370	fc = le_to_host16(hdr->frame_control);
	371
	372	/*
	373	* Drop frames to unknown BSSIDs except for Beacon frames which
	374	* could be used to update neighbor information.
	375	*/
	376	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
	377	WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
	378	hapd = iface->bss[0];
	379	else
	380	return;
	381	}
	382
2a8b7416 JM	383	os_memset(&fi, 0, sizeof(fi));
	384	fi.datarate = rx_mgmt->datarate;
	385	fi.ssi_signal = rx_mgmt->ssi_signal;
	386
4b9841d3 JM	387	if (hapd == HAPD_BROADCAST) {
	388	size_t i;
	389	for (i = 0; i < iface->num_bss; i++)
2a8b7416 JM	390	ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
2a8b7416 JM	391	rx_mgmt->frame_len, &fi);
4b9841d3	392	} else
2a8b7416	393	ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);
bbb921da JM	394
bbb921da JM	395	random_add_randomness(&fi, sizeof(fi));
b5b969e9 JM	396	}
	397
	398
9e2704c3 JM	399	static void hostapd_rx_action(struct hostapd_data *hapd,
	400	struct rx_action *rx_action)
	401	{
	402	struct rx_mgmt rx_mgmt;
	403	u8 *buf;
	404	struct ieee80211_hdr *hdr;
	405
	406	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
	407	" BSSID=" MACSTR " category=%u",
	408	MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
	409	MAC2STR(rx_action->bssid), rx_action->category);
	410	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
	411	rx_action->data, rx_action->len);
	412
	413	buf = os_zalloc(24 + 1 + rx_action->len);
	414	if (buf == NULL)
	415	return;
	416	hdr = (struct ieee80211_hdr *) buf;
	417	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
	418	WLAN_FC_STYPE_ACTION);
	419	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
	420	/*
	421	* Assume frame was protected; it would have been dropped if
	422	* not.
	423	*/
	424	hdr->frame_control \|= host_to_le16(WLAN_FC_ISWEP);
	425	}
	426	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	427	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	428	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	429	buf[24] = rx_action->category;
	430	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	431	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	432	rx_mgmt.frame = buf;
	433	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	434	hostapd_mgmt_rx(hapd, &rx_mgmt);
	435	os_free(buf);
	436	}
	437
	438
f8b1f695 JM	439	static void hostapd_mgmt_tx_cb(struct hostapd_data hapd, const u8 buf,
f8b1f695 JM	440	size_t len, u16 stype, int ok)
b5b969e9	441	{
4b9841d3 JM	442	struct ieee80211_hdr *hdr;
	443	hdr = (struct ieee80211_hdr *) buf;
	444	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	445	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	446	return;
b5b969e9 JM	447	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
b5b969e9 JM	448	}
f82ef4d8	449
f8b1f695	450	#endif /* NEED_AP_MLME */
ad1e68e6 JM	451
ad1e68e6 JM	452
a8e0505b JM	453	static int hostapd_event_new_sta(struct hostapd_data hapd, const u8 addr)
	454	{
	455	struct sta_info *sta = ap_get_sta(hapd, addr);
	456	if (sta)
	457	return 0;
	458
	459	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
	460	" - adding a new STA", MAC2STR(addr));
	461	sta = ap_sta_add(hapd, addr);
	462	if (sta) {
	463	hostapd_new_assoc_sta(hapd, sta, 0);
	464	} else {
	465	wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
	466	MAC2STR(addr));
	467	return -1;
	468	}
	469
	470	return 0;
	471	}
	472
	473
	474	static void hostapd_event_eapol_rx(struct hostapd_data hapd, const u8 src,
	475	const u8 *data, size_t data_len)
	476	{
	477	struct hostapd_iface *iface = hapd->iface;
	478	size_t j;
	479
	480	for (j = 0; j < iface->num_bss; j++) {
	481	if (ap_get_sta(iface->bss[j], src)) {
	482	hapd = iface->bss[j];
	483	break;
	484	}
	485	}
	486
	487	ieee802_1x_receive(hapd, src, data, data_len);
	488	}
	489
	490
9646a8ab	491	void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
ad1e68e6 JM	492	union wpa_event_data *data)
	493	{
	494	struct hostapd_data *hapd = ctx;
	495
	496	switch (event) {
	497	case EVENT_MICHAEL_MIC_FAILURE:
	498	michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
	499	break;
	500	case EVENT_SCAN_RESULTS:
	501	if (hapd->iface->scan_cb)
	502	hapd->iface->scan_cb(hapd->iface);
	503	break;
08fd8c15	504	#ifdef CONFIG_IEEE80211R
f2dab64e	505	case EVENT_FT_RRB_RX:
08fd8c15 JM	506	wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
	507	data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
	508	break;
	509	#endif /* CONFIG_IEEE80211R */
fcf0f87d	510	case EVENT_WPS_BUTTON_PUSHED:
d601247c	511	hostapd_wps_button_pushed(hapd, NULL);
fcf0f87d	512	break;
f8b1f695 JM	513	#ifdef NEED_AP_MLME
	514	case EVENT_TX_STATUS:
	515	switch (data->tx_status.type) {
	516	case WLAN_FC_TYPE_MGMT:
	517	hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
	518	data->tx_status.data_len,
	519	data->tx_status.stype,
	520	data->tx_status.ack);
	521	break;
	522	case WLAN_FC_TYPE_DATA:
	523	hostapd_tx_status(hapd, data->tx_status.dst,
	524	data->tx_status.data,
	525	data->tx_status.data_len,
	526	data->tx_status.ack);
	527	break;
	528	}
	529	break;
	530	case EVENT_RX_FROM_UNKNOWN:
0d9fc3d8	531	hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.frame,
f8b1f695 JM	532	data->rx_from_unknown.len);
	533	break;
	534	case EVENT_RX_MGMT:
2a8b7416	535	hostapd_mgmt_rx(hapd, &data->rx_mgmt);
f8b1f695 JM	536	break;
f8b1f695 JM	537	#endif /* NEED_AP_MLME */
a0e0d3bb	538	case EVENT_RX_PROBE_REQ:
b211f3eb JM	539	if (data->rx_probe_req.sa == NULL \|\|
	540	data->rx_probe_req.ie == NULL)
	541	break;
a0e0d3bb JM	542	hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
	543	data->rx_probe_req.ie,
	544	data->rx_probe_req.ie_len);
	545	break;
a70a5d6d	546	case EVENT_NEW_STA:
a8e0505b JM	547	hostapd_event_new_sta(hapd, data->new_sta.addr);
	548	break;
	549	case EVENT_EAPOL_RX:
	550	hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
	551	data->eapol_rx.data,
	552	data->eapol_rx.data_len);
	553	break;
1d041bec JM	554	case EVENT_ASSOC:
	555	hostapd_notif_assoc(hapd, data->assoc_info.addr,
	556	data->assoc_info.req_ies,
39b08b5f SP	557	data->assoc_info.req_ies_len,
39b08b5f SP	558	data->assoc_info.reassoc);
1d041bec JM	559	break;
	560	case EVENT_DISASSOC:
	561	if (data)
	562	hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
	563	break;
	564	case EVENT_DEAUTH:
	565	if (data)
	566	hostapd_notif_disassoc(hapd, data->deauth_info.addr);
	567	break;
0d7e5a3a JB	568	case EVENT_STATION_LOW_ACK:
	569	if (!data)
	570	break;
	571	hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
	572	break;
7cc7307d	573	#ifdef NEED_AP_MLME
9e2704c3 JM	574	case EVENT_RX_ACTION:
	575	if (data->rx_action.da == NULL \|\| data->rx_action.sa == NULL \|\|
	576	data->rx_action.bssid == NULL)
	577	break;
	578	hostapd_rx_action(hapd, &data->rx_action);
	579	break;
7cc7307d	580	#endif /* NEED_AP_MLME */
ad1e68e6 JM	581	default:
	582	wpa_printf(MSG_DEBUG, "Unknown event %d", event);
	583	break;
	584	}
	585	}
f8b1f695 JM	586
f8b1f695 JM	587	#endif /* HOSTAPD */