[thirdparty/hostap.git] / src / ap / drv_callbacks.c

/*
 * hostapd / Callback functions for driver wrappers
 * Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
 *
 * This program is free software; you can redistribute it and/or modify
 * it under the terms of the GNU General Public License version 2 as
 * published by the Free Software Foundation.
 *
 * Alternatively, this software may be distributed under the terms of BSD
 * license.
 *
 * See README and COPYING for more details.
 */

#include "utils/includes.h"

#include "utils/common.h"
#include "radius/radius.h"
#include "drivers/driver.h"
#include "common/ieee802_11_defs.h"
#include "common/ieee802_11_common.h"
#include "crypto/random.h"
#include "p2p/p2p.h"
#include "wps/wps.h"
#include "hostapd.h"
#include "ieee802_11.h"
#include "sta_info.h"
#include "accounting.h"
#include "tkip_countermeasures.h"
#include "ieee802_1x.h"
#include "wpa_auth.h"
#include "wps_hostapd.h"
#include "ap_drv_ops.h"
#include "ap_config.h"


int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
			const u8 *req_ies, size_t req_ies_len, int reassoc)
{
	struct sta_info *sta;
	int new_assoc, res;
	struct ieee802_11_elems elems;
	const u8 *ie;
	size_t ielen;
	u16 reason = WLAN_REASON_UNSPECIFIED;

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up being set to station mode while hostapd was
		 * running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
			   "no address");
		return -1;
	}
	random_add_randomness(addr, ETH_ALEN);

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "associated");

	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
	if (elems.wps_ie) {
		ie = elems.wps_ie - 2;
		ielen = elems.wps_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	} else if (elems.rsn_ie) {
		ie = elems.rsn_ie - 2;
		ielen = elems.rsn_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	} else if (elems.wpa_ie) {
		ie = elems.wpa_ie - 2;
		ielen = elems.wpa_ie_len + 2;
		wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	} else {
		ie = NULL;
		ielen = 0;
		wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
			   "(Re)AssocReq");
	}

	sta = ap_get_sta(hapd, addr);
	if (sta) {
		accounting_sta_stop(hapd, sta);
	} else {
		sta = ap_sta_add(hapd, addr);
		if (sta == NULL)
			return -1;
	}
	sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);

#ifdef CONFIG_P2P
	if (elems.p2p) {
		wpabuf_free(sta->p2p_ie);
		sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
							  P2P_IE_VENDOR_TYPE);
	}
#endif /* CONFIG_P2P */

	if (hapd->conf->wpa) {
		if (ie == NULL || ielen == 0) {
#ifdef CONFIG_WPS
			if (hapd->conf->wps_state) {
				wpa_printf(MSG_DEBUG, "STA did not include "
					   "WPA/RSN IE in (Re)Association "
					   "Request - possible WPS use");
				sta->flags |= WLAN_STA_MAYBE_WPS;
				goto skip_wpa_check;
			}
#endif /* CONFIG_WPS */

			wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
			return -1;
		}
#ifdef CONFIG_WPS
		if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
		    os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
			struct wpabuf *wps;
			sta->flags |= WLAN_STA_WPS;
			wps = ieee802_11_vendor_ie_concat(ie, ielen,
							  WPS_IE_VENDOR_TYPE);
			if (wps) {
				if (wps_is_20(wps)) {
					wpa_printf(MSG_DEBUG, "WPS: STA "
						   "supports WPS 2.0");
					sta->flags |= WLAN_STA_WPS2;
				}
				wpabuf_free(wps);
			}
			goto skip_wpa_check;
		}
#endif /* CONFIG_WPS */

		if (sta->wpa_sm == NULL)
			sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
							sta->addr);
		if (sta->wpa_sm == NULL) {
			wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
				   "machine");
			return -1;
		}
		res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
					  ie, ielen, NULL, 0);
		if (res != WPA_IE_OK) {
			wpa_printf(MSG_DEBUG, "WPA/RSN information element "
				   "rejected? (res %u)", res);
			wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
			if (res == WPA_INVALID_GROUP)
				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_PAIRWISE)
				reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
			else if (res == WPA_INVALID_AKMP)
				reason = WLAN_REASON_AKMP_NOT_VALID;
#ifdef CONFIG_IEEE80211W
			else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
				reason = WLAN_REASON_INVALID_IE;
			else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
				reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
#endif /* CONFIG_IEEE80211W */
			else
				reason = WLAN_REASON_INVALID_IE;
			goto fail;
		}
	} else if (hapd->conf->wps_state) {
#ifdef CONFIG_WPS
		struct wpabuf *wps;
		if (req_ies)
			wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
							  WPS_IE_VENDOR_TYPE);
		else
			wps = NULL;
#ifdef CONFIG_WPS_STRICT
		if (wps && wps_validate_assoc_req(wps) < 0) {
			reason = WLAN_REASON_INVALID_IE;
			wpabuf_free(wps);
			goto fail;
		}
#endif /* CONFIG_WPS_STRICT */
		if (wps) {
			sta->flags |= WLAN_STA_WPS;
			if (wps_is_20(wps)) {
				wpa_printf(MSG_DEBUG, "WPS: STA supports "
					   "WPS 2.0");
				sta->flags |= WLAN_STA_WPS2;
			}
		} else
			sta->flags |= WLAN_STA_MAYBE_WPS;
		wpabuf_free(wps);
#endif /* CONFIG_WPS */
	}
#ifdef CONFIG_WPS
skip_wpa_check:
#endif /* CONFIG_WPS */

	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);

	hostapd_new_assoc_sta(hapd, sta, !new_assoc);

	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);

#ifdef CONFIG_P2P
	if (req_ies) {
		p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
				      req_ies, req_ies_len);
	}
#endif /* CONFIG_P2P */

	return 0;

fail:
	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
	ap_free_sta(hapd, sta);
	return -1;
}


void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta;

	if (addr == NULL) {
		/*
		 * This could potentially happen with unexpected event from the
		 * driver wrapper. This was seen at least in one case where the
		 * driver ended up reporting a station mode event while hostapd
		 * was running, so better make sure we stop processing such an
		 * event here.
		 */
		wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
			   "with no address");
		return;
	}

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disassociated");

	sta = ap_get_sta(hapd, addr);
	if (sta == NULL) {
		wpa_printf(MSG_DEBUG, "Disassociation notification for "
			   "unknown STA " MACSTR, MAC2STR(addr));
		return;
	}

	ap_sta_set_authorized(hapd, sta, 0);
	sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	ap_free_sta(hapd, sta);
}


void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);

	if (!sta || !hapd->conf->disassoc_low_ack)
		return;

	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
		       HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
		       "missing ACKs");
	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	if (sta)
		ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
}


int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da,
			 const u8 *bssid, const u8 *ie, size_t ie_len)
{
	size_t i;
	int ret = 0;

	if (sa == NULL || ie == NULL)
		return -1;

	random_add_randomness(sa, ETH_ALEN);
	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
		if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
					    sa, da, bssid, ie, ie_len) > 0) {
			ret = 1;
			break;
		}
	}
	return ret;
}


#ifdef HOSTAPD

#ifdef NEED_AP_MLME

#define HAPD_BROADCAST ((struct hostapd_data *) -1)

static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
					    const u8 *bssid)
{
	size_t i;

	if (bssid == NULL)
		return NULL;
	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	    bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
		return HAPD_BROADCAST;

	for (i = 0; i < iface->num_bss; i++) {
		if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
			return iface->bss[i];
	}

	return NULL;
}


static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
					const u8 *bssid, const u8 *addr,
					int wds)
{
	hapd = get_hapd_bssid(hapd->iface, bssid);
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;

	ieee802_11_rx_from_unknown(hapd, addr, wds);
}


static void hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
{
	struct hostapd_iface *iface = hapd->iface;
	const struct ieee80211_hdr *hdr;
	const u8 *bssid;
	struct hostapd_frame_info fi;

	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
	if (bssid == NULL)
		return;

	hapd = get_hapd_bssid(iface, bssid);
	if (hapd == NULL) {
		u16 fc;
		fc = le_to_host16(hdr->frame_control);

		/*
		 * Drop frames to unknown BSSIDs except for Beacon frames which
		 * could be used to update neighbor information.
		 */
		if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
		    WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
			hapd = iface->bss[0];
		else
			return;
	}

	os_memset(&fi, 0, sizeof(fi));
	fi.datarate = rx_mgmt->datarate;
	fi.ssi_signal = rx_mgmt->ssi_signal;

	if (hapd == HAPD_BROADCAST) {
		size_t i;
		for (i = 0; i < iface->num_bss; i++)
			ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
					rx_mgmt->frame_len, &fi);
	} else
		ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);

	random_add_randomness(&fi, sizeof(fi));
}


static void hostapd_rx_action(struct hostapd_data *hapd,
			      struct rx_action *rx_action)
{
	struct rx_mgmt rx_mgmt;
	u8 *buf;
	struct ieee80211_hdr *hdr;

	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
		   " BSSID=" MACSTR " category=%u",
		   MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
		   MAC2STR(rx_action->bssid), rx_action->category);
	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
		    rx_action->data, rx_action->len);

	buf = os_zalloc(24 + 1 + rx_action->len);
	if (buf == NULL)
		return;
	hdr = (struct ieee80211_hdr *) buf;
	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
					  WLAN_FC_STYPE_ACTION);
	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
		/*
		 * Assume frame was protected; it would have been dropped if
		 * not.
		 */
		hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
	}
	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	buf[24] = rx_action->category;
	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	rx_mgmt.frame = buf;
	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	hostapd_mgmt_rx(hapd, &rx_mgmt);
	os_free(buf);
}


static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
			       size_t len, u16 stype, int ok)
{
	struct ieee80211_hdr *hdr;
	hdr = (struct ieee80211_hdr *) buf;
	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	if (hapd == NULL || hapd == HAPD_BROADCAST)
		return;
	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
}

#endif /* NEED_AP_MLME */


static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
{
	struct sta_info *sta = ap_get_sta(hapd, addr);
	if (sta)
		return 0;

	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
		   " - adding a new STA", MAC2STR(addr));
	sta = ap_sta_add(hapd, addr);
	if (sta) {
		hostapd_new_assoc_sta(hapd, sta, 0);
	} else {
		wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
			   MAC2STR(addr));
		return -1;
	}

	return 0;
}


static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
				   const u8 *data, size_t data_len)
{
	struct hostapd_iface *iface = hapd->iface;
	size_t j;

	for (j = 0; j < iface->num_bss; j++) {
		if (ap_get_sta(iface->bss[j], src)) {
			hapd = iface->bss[j];
			break;
		}
	}

	ieee802_1x_receive(hapd, src, data, data_len);
}


void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
			  union wpa_event_data *data)
{
	struct hostapd_data *hapd = ctx;

	switch (event) {
	case EVENT_MICHAEL_MIC_FAILURE:
		michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
		break;
	case EVENT_SCAN_RESULTS:
		if (hapd->iface->scan_cb)
			hapd->iface->scan_cb(hapd->iface);
		break;
#ifdef CONFIG_IEEE80211R
	case EVENT_FT_RRB_RX:
		wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
			      data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
		break;
#endif /* CONFIG_IEEE80211R */
	case EVENT_WPS_BUTTON_PUSHED:
		hostapd_wps_button_pushed(hapd, NULL);
		break;
#ifdef NEED_AP_MLME
	case EVENT_TX_STATUS:
		switch (data->tx_status.type) {
		case WLAN_FC_TYPE_MGMT:
			hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
					   data->tx_status.data_len,
					   data->tx_status.stype,
					   data->tx_status.ack);
			break;
		case WLAN_FC_TYPE_DATA:
			hostapd_tx_status(hapd, data->tx_status.dst,
					  data->tx_status.data,
					  data->tx_status.data_len,
					  data->tx_status.ack);
			break;
		}
		break;
	case EVENT_DRIVER_CLIENT_POLL_OK:
		hostapd_client_poll_ok(hapd, data->client_poll.addr);
		break;
	case EVENT_RX_FROM_UNKNOWN:
		hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid,
					    data->rx_from_unknown.addr,
					    data->rx_from_unknown.wds);
		break;
	case EVENT_RX_MGMT:
		hostapd_mgmt_rx(hapd, &data->rx_mgmt);
		break;
#endif /* NEED_AP_MLME */
	case EVENT_RX_PROBE_REQ:
		if (data->rx_probe_req.sa == NULL ||
		    data->rx_probe_req.ie == NULL)
			break;
		hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
				     data->rx_probe_req.da,
				     data->rx_probe_req.bssid,
				     data->rx_probe_req.ie,
				     data->rx_probe_req.ie_len);
		break;
	case EVENT_NEW_STA:
		hostapd_event_new_sta(hapd, data->new_sta.addr);
		break;
	case EVENT_EAPOL_RX:
		hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
				       data->eapol_rx.data,
				       data->eapol_rx.data_len);
		break;
	case EVENT_ASSOC:
		hostapd_notif_assoc(hapd, data->assoc_info.addr,
				    data->assoc_info.req_ies,
				    data->assoc_info.req_ies_len,
				    data->assoc_info.reassoc);
		break;
	case EVENT_DISASSOC:
		if (data)
			hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
		break;
	case EVENT_DEAUTH:
		if (data)
			hostapd_notif_disassoc(hapd, data->deauth_info.addr);
		break;
	case EVENT_STATION_LOW_ACK:
		if (!data)
			break;
		hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
		break;
#ifdef NEED_AP_MLME
	case EVENT_RX_ACTION:
		if (data->rx_action.da == NULL || data->rx_action.sa == NULL ||
		    data->rx_action.bssid == NULL)
			break;
		hostapd_rx_action(hapd, &data->rx_action);
		break;
#endif /* NEED_AP_MLME */
	default:
		wpa_printf(MSG_DEBUG, "Unknown event %d", event);
		break;
	}
}

#endif /* HOSTAPD */
Commit	Line	Data
b5b969e9 JM	1	/*
	2	* hostapd / Callback functions for driver wrappers
	3	* Copyright (c) 2002-2009, Jouni Malinen <j@w1.fi>
	4	*
	5	* This program is free software; you can redistribute it and/or modify
	6	* it under the terms of the GNU General Public License version 2 as
	7	* published by the Free Software Foundation.
	8	*
	9	* Alternatively, this software may be distributed under the terms of BSD
	10	* license.
	11	*
	12	* See README and COPYING for more details.
	13	*/
	14
6226e38d	15	#include "utils/includes.h"
b5b969e9	16
6226e38d	17	#include "utils/common.h"
b5b969e9	18	#include "radius/radius.h"
6e6e8c31	19	#include "drivers/driver.h"
81f4f619	20	#include "common/ieee802_11_defs.h"
c41a1095	21	#include "common/ieee802_11_common.h"
bbb921da	22	#include "crypto/random.h"
ef796391	23	#include "p2p/p2p.h"
54f489be	24	#include "wps/wps.h"
6226e38d JM	25	#include "hostapd.h"
	26	#include "ieee802_11.h"
	27	#include "sta_info.h"
	28	#include "accounting.h"
	29	#include "tkip_countermeasures.h"
6226e38d JM	30	#include "ieee802_1x.h"
6226e38d JM	31	#include "wpa_auth.h"
6226e38d	32	#include "wps_hostapd.h"
51e2a27a	33	#include "ap_drv_ops.h"
8b06c1ed	34	#include "ap_config.h"
b5b969e9 JM	35
b5b969e9 JM	36
b5b969e9	37	int hostapd_notif_assoc(struct hostapd_data hapd, const u8 addr,
2bb20281	38	const u8 *req_ies, size_t req_ies_len, int reassoc)
b5b969e9 JM	39	{
	40	struct sta_info *sta;
	41	int new_assoc, res;
c41a1095	42	struct ieee802_11_elems elems;
2bb20281 JM	43	const u8 *ie;
2bb20281 JM	44	size_t ielen;
08a74e6a	45	u16 reason = WLAN_REASON_UNSPECIFIED;
b5b969e9	46
68532a9c JM	47	if (addr == NULL) {
	48	/*
	49	* This could potentially happen with unexpected event from the
	50	* driver wrapper. This was seen at least in one case where the
	51	* driver ended up being set to station mode while hostapd was
	52	* running, so better make sure we stop processing such an
	53	* event here.
	54	*/
	55	wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
	56	"no address");
	57	return -1;
	58	}
bbb921da	59	random_add_randomness(addr, ETH_ALEN);
68532a9c	60
b5b969e9 JM	61	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	62	HOSTAPD_LEVEL_INFO, "associated");
	63
2bb20281	64	ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
c41a1095 JM	65	if (elems.wps_ie) {
	66	ie = elems.wps_ie - 2;
	67	ielen = elems.wps_ie_len + 2;
	68	wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
	69	} else if (elems.rsn_ie) {
	70	ie = elems.rsn_ie - 2;
	71	ielen = elems.rsn_ie_len + 2;
	72	wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
	73	} else if (elems.wpa_ie) {
	74	ie = elems.wpa_ie - 2;
	75	ielen = elems.wpa_ie_len + 2;
	76	wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
	77	} else {
	78	ie = NULL;
	79	ielen = 0;
	80	wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
	81	"(Re)AssocReq");
	82	}
	83
b5b969e9 JM	84	sta = ap_get_sta(hapd, addr);
	85	if (sta) {
	86	accounting_sta_stop(hapd, sta);
	87	} else {
	88	sta = ap_sta_add(hapd, addr);
	89	if (sta == NULL)
	90	return -1;
	91	}
17f6b900	92	sta->flags &= ~(WLAN_STA_WPS \| WLAN_STA_MAYBE_WPS \| WLAN_STA_WPS2);
b5b969e9	93
b305c684 JM	94	#ifdef CONFIG_P2P
	95	if (elems.p2p) {
	96	wpabuf_free(sta->p2p_ie);
2bb20281	97	sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
b305c684 JM	98	P2P_IE_VENDOR_TYPE);
	99	}
	100	#endif /* CONFIG_P2P */
	101
b5b969e9 JM	102	if (hapd->conf->wpa) {
b5b969e9 JM	103	if (ie == NULL \|\| ielen == 0) {
633d4469	104	#ifdef CONFIG_WPS
b5b969e9 JM	105	if (hapd->conf->wps_state) {
	106	wpa_printf(MSG_DEBUG, "STA did not include "
	107	"WPA/RSN IE in (Re)Association "
	108	"Request - possible WPS use");
	109	sta->flags \|= WLAN_STA_MAYBE_WPS;
	110	goto skip_wpa_check;
	111	}
633d4469	112	#endif /* CONFIG_WPS */
b5b969e9 JM	113
	114	wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
	115	return -1;
	116	}
633d4469	117	#ifdef CONFIG_WPS
b5b969e9 JM	118	if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
b5b969e9 JM	119	os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
17f6b900	120	struct wpabuf *wps;
b5b969e9	121	sta->flags \|= WLAN_STA_WPS;
17f6b900 JM	122	wps = ieee802_11_vendor_ie_concat(ie, ielen,
	123	WPS_IE_VENDOR_TYPE);
	124	if (wps) {
	125	if (wps_is_20(wps)) {
	126	wpa_printf(MSG_DEBUG, "WPS: STA "
	127	"supports WPS 2.0");
	128	sta->flags \|= WLAN_STA_WPS2;
	129	}
	130	wpabuf_free(wps);
	131	}
b5b969e9 JM	132	goto skip_wpa_check;
b5b969e9 JM	133	}
633d4469	134	#endif /* CONFIG_WPS */
b5b969e9 JM	135
	136	if (sta->wpa_sm == NULL)
	137	sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
	138	sta->addr);
	139	if (sta->wpa_sm == NULL) {
	140	wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
	141	"machine");
	142	return -1;
	143	}
	144	res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
	145	ie, ielen, NULL, 0);
	146	if (res != WPA_IE_OK) {
	147	wpa_printf(MSG_DEBUG, "WPA/RSN information element "
	148	"rejected? (res %u)", res);
	149	wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
355d36a7	150	if (res == WPA_INVALID_GROUP)
08a74e6a	151	reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
355d36a7	152	else if (res == WPA_INVALID_PAIRWISE)
08a74e6a	153	reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
355d36a7	154	else if (res == WPA_INVALID_AKMP)
08a74e6a	155	reason = WLAN_REASON_AKMP_NOT_VALID;
355d36a7 AT	156	#ifdef CONFIG_IEEE80211W
355d36a7 AT	157	else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
08a74e6a	158	reason = WLAN_REASON_INVALID_IE;
355d36a7	159	else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
08a74e6a	160	reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
355d36a7 AT	161	#endif /* CONFIG_IEEE80211W */
355d36a7 AT	162	else
08a74e6a JM	163	reason = WLAN_REASON_INVALID_IE;
08a74e6a JM	164	goto fail;
b5b969e9	165	}
a9aca28b	166	} else if (hapd->conf->wps_state) {
633d4469	167	#ifdef CONFIG_WPS
17f6b900	168	struct wpabuf *wps;
2bb20281 JM	169	if (req_ies)
2bb20281 JM	170	wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
fa15d405 JM	171	WPS_IE_VENDOR_TYPE);
	172	else
	173	wps = NULL;
54f489be	174	#ifdef CONFIG_WPS_STRICT
fa15d405	175	if (wps && wps_validate_assoc_req(wps) < 0) {
08a74e6a	176	reason = WLAN_REASON_INVALID_IE;
fa15d405	177	wpabuf_free(wps);
08a74e6a	178	goto fail;
54f489be	179	}
54f489be	180	#endif /* CONFIG_WPS_STRICT */
fa15d405	181	if (wps) {
a9aca28b	182	sta->flags \|= WLAN_STA_WPS;
fa15d405	183	if (wps_is_20(wps)) {
17f6b900 JM	184	wpa_printf(MSG_DEBUG, "WPS: STA supports "
	185	"WPS 2.0");
	186	sta->flags \|= WLAN_STA_WPS2;
	187	}
a9aca28b JM	188	} else
a9aca28b JM	189	sta->flags \|= WLAN_STA_MAYBE_WPS;
17f6b900	190	wpabuf_free(wps);
633d4469	191	#endif /* CONFIG_WPS */
b5b969e9	192	}
633d4469	193	#ifdef CONFIG_WPS
b5b969e9	194	skip_wpa_check:
633d4469	195	#endif /* CONFIG_WPS */
b5b969e9 JM	196
	197	new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
	198	sta->flags \|= WLAN_STA_AUTH \| WLAN_STA_ASSOC;
	199	wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
	200
	201	hostapd_new_assoc_sta(hapd, sta, !new_assoc);
	202
	203	ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
	204
ef796391	205	#ifdef CONFIG_P2P
99c01af9 JM	206	if (req_ies) {
	207	p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
	208	req_ies, req_ies_len);
	209	}
ef796391 JM	210	#endif /* CONFIG_P2P */
ef796391 JM	211
b5b969e9	212	return 0;
08a74e6a JM	213
	214	fail:
	215	hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
	216	ap_free_sta(hapd, sta);
	217	return -1;
b5b969e9 JM	218	}
	219
	220
	221	void hostapd_notif_disassoc(struct hostapd_data hapd, const u8 addr)
	222	{
	223	struct sta_info *sta;
	224
83e843e8 JM	225	if (addr == NULL) {
	226	/*
	227	* This could potentially happen with unexpected event from the
	228	* driver wrapper. This was seen at least in one case where the
	229	* driver ended up reporting a station mode event while hostapd
	230	* was running, so better make sure we stop processing such an
	231	* event here.
	232	*/
	233	wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
	234	"with no address");
1f4c7b6b	235	return;
83e843e8 JM	236	}
83e843e8 JM	237
b5b969e9 JM	238	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	239	HOSTAPD_LEVEL_INFO, "disassociated");
	240
	241	sta = ap_get_sta(hapd, addr);
	242	if (sta == NULL) {
	243	wpa_printf(MSG_DEBUG, "Disassociation notification for "
	244	"unknown STA " MACSTR, MAC2STR(addr));
	245	return;
	246	}
	247
ae055af4	248	ap_sta_set_authorized(hapd, sta, 0);
b5b969e9 JM	249	sta->flags &= ~(WLAN_STA_AUTH \| WLAN_STA_ASSOC);
	250	wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
	251	sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
	252	ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
	253	ap_free_sta(hapd, sta);
	254	}
	255
	256
0d7e5a3a JB	257	void hostapd_event_sta_low_ack(struct hostapd_data hapd, const u8 addr)
	258	{
	259	struct sta_info *sta = ap_get_sta(hapd, addr);
	260
	261	if (!sta \|\| !hapd->conf->disassoc_low_ack)
	262	return;
	263
	264	hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
	265	HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
	266	"missing ACKs");
	267	hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
	268	if (sta)
	269	ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
	270	}
	271
	272
04a85e44 JM	273	int hostapd_probe_req_rx(struct hostapd_data hapd, const u8 sa, const u8 *da,
04a85e44 JM	274	const u8 bssid, const u8 ie, size_t ie_len)
e67b55fb JM	275	{
	276	size_t i;
	277	int ret = 0;
	278
b211f3eb JM	279	if (sa == NULL \|\| ie == NULL)
	280	return -1;
	281
	282	random_add_randomness(sa, ETH_ALEN);
e67b55fb JM	283	for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
e67b55fb JM	284	if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
04a85e44	285	sa, da, bssid, ie, ie_len) > 0) {
e67b55fb JM	286	ret = 1;
	287	break;
	288	}
	289	}
	290	return ret;
	291	}
	292
	293
f8b1f695 JM	294	#ifdef HOSTAPD
f8b1f695 JM	295
fe6bdb77	296	#ifdef NEED_AP_MLME
f8b1f695	297
f8b1f695 JM	298	#define HAPD_BROADCAST ((struct hostapd_data *) -1)
	299
	300	static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
	301	const u8 *bssid)
	302	{
	303	size_t i;
	304
	305	if (bssid == NULL)
	306	return NULL;
	307	if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
	308	bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
	309	return HAPD_BROADCAST;
	310
	311	for (i = 0; i < iface->num_bss; i++) {
	312	if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
	313	return iface->bss[i];
	314	}
	315
	316	return NULL;
	317	}
	318
	319
	320	static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
9b90955e JB	321	const u8 bssid, const u8 addr,
9b90955e JB	322	int wds)
f8b1f695	323	{
9b90955e	324	hapd = get_hapd_bssid(hapd->iface, bssid);
f8b1f695 JM	325	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	326	return;
	327
9b90955e	328	ieee802_11_rx_from_unknown(hapd, addr, wds);
f8b1f695 JM	329	}
	330
	331
2a8b7416	332	static void hostapd_mgmt_rx(struct hostapd_data hapd, struct rx_mgmt rx_mgmt)
b5b969e9	333	{
4b9841d3	334	struct hostapd_iface *iface = hapd->iface;
b57e086c	335	const struct ieee80211_hdr *hdr;
4b9841d3	336	const u8 *bssid;
2a8b7416	337	struct hostapd_frame_info fi;
4b9841d3	338
2a8b7416 JM	339	hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
2a8b7416 JM	340	bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
4b9841d3 JM	341	if (bssid == NULL)
	342	return;
	343
	344	hapd = get_hapd_bssid(iface, bssid);
	345	if (hapd == NULL) {
	346	u16 fc;
	347	fc = le_to_host16(hdr->frame_control);
	348
	349	/*
	350	* Drop frames to unknown BSSIDs except for Beacon frames which
	351	* could be used to update neighbor information.
	352	*/
	353	if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
	354	WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
	355	hapd = iface->bss[0];
	356	else
	357	return;
	358	}
	359
2a8b7416 JM	360	os_memset(&fi, 0, sizeof(fi));
	361	fi.datarate = rx_mgmt->datarate;
	362	fi.ssi_signal = rx_mgmt->ssi_signal;
	363
4b9841d3 JM	364	if (hapd == HAPD_BROADCAST) {
	365	size_t i;
	366	for (i = 0; i < iface->num_bss; i++)
2a8b7416 JM	367	ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
2a8b7416 JM	368	rx_mgmt->frame_len, &fi);
4b9841d3	369	} else
2a8b7416	370	ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);
bbb921da JM	371
bbb921da JM	372	random_add_randomness(&fi, sizeof(fi));
b5b969e9 JM	373	}
	374
	375
9e2704c3 JM	376	static void hostapd_rx_action(struct hostapd_data *hapd,
	377	struct rx_action *rx_action)
	378	{
	379	struct rx_mgmt rx_mgmt;
	380	u8 *buf;
	381	struct ieee80211_hdr *hdr;
	382
	383	wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
	384	" BSSID=" MACSTR " category=%u",
	385	MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
	386	MAC2STR(rx_action->bssid), rx_action->category);
	387	wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
	388	rx_action->data, rx_action->len);
	389
	390	buf = os_zalloc(24 + 1 + rx_action->len);
	391	if (buf == NULL)
	392	return;
	393	hdr = (struct ieee80211_hdr *) buf;
	394	hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
	395	WLAN_FC_STYPE_ACTION);
	396	if (rx_action->category == WLAN_ACTION_SA_QUERY) {
	397	/*
	398	* Assume frame was protected; it would have been dropped if
	399	* not.
	400	*/
	401	hdr->frame_control \|= host_to_le16(WLAN_FC_ISWEP);
	402	}
	403	os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
	404	os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
	405	os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
	406	buf[24] = rx_action->category;
	407	os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
	408	os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
	409	rx_mgmt.frame = buf;
	410	rx_mgmt.frame_len = 24 + 1 + rx_action->len;
	411	hostapd_mgmt_rx(hapd, &rx_mgmt);
	412	os_free(buf);
	413	}
	414
	415
f8b1f695 JM	416	static void hostapd_mgmt_tx_cb(struct hostapd_data hapd, const u8 buf,
f8b1f695 JM	417	size_t len, u16 stype, int ok)
b5b969e9	418	{
4b9841d3 JM	419	struct ieee80211_hdr *hdr;
	420	hdr = (struct ieee80211_hdr *) buf;
	421	hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
	422	if (hapd == NULL \|\| hapd == HAPD_BROADCAST)
	423	return;
b5b969e9 JM	424	ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
b5b969e9 JM	425	}
f82ef4d8	426
f8b1f695	427	#endif /* NEED_AP_MLME */
ad1e68e6 JM	428
ad1e68e6 JM	429
a8e0505b JM	430	static int hostapd_event_new_sta(struct hostapd_data hapd, const u8 addr)
	431	{
	432	struct sta_info *sta = ap_get_sta(hapd, addr);
	433	if (sta)
	434	return 0;
	435
	436	wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
	437	" - adding a new STA", MAC2STR(addr));
	438	sta = ap_sta_add(hapd, addr);
	439	if (sta) {
	440	hostapd_new_assoc_sta(hapd, sta, 0);
	441	} else {
	442	wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
	443	MAC2STR(addr));
	444	return -1;
	445	}
	446
	447	return 0;
	448	}
	449
	450
	451	static void hostapd_event_eapol_rx(struct hostapd_data hapd, const u8 src,
	452	const u8 *data, size_t data_len)
	453	{
	454	struct hostapd_iface *iface = hapd->iface;
	455	size_t j;
	456
	457	for (j = 0; j < iface->num_bss; j++) {
	458	if (ap_get_sta(iface->bss[j], src)) {
	459	hapd = iface->bss[j];
	460	break;
	461	}
	462	}
	463
	464	ieee802_1x_receive(hapd, src, data, data_len);
	465	}
	466
	467
9646a8ab	468	void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
ad1e68e6 JM	469	union wpa_event_data *data)
	470	{
	471	struct hostapd_data *hapd = ctx;
	472
	473	switch (event) {
	474	case EVENT_MICHAEL_MIC_FAILURE:
	475	michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
	476	break;
	477	case EVENT_SCAN_RESULTS:
	478	if (hapd->iface->scan_cb)
	479	hapd->iface->scan_cb(hapd->iface);
	480	break;
08fd8c15	481	#ifdef CONFIG_IEEE80211R
f2dab64e	482	case EVENT_FT_RRB_RX:
08fd8c15 JM	483	wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
	484	data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
	485	break;
	486	#endif /* CONFIG_IEEE80211R */
fcf0f87d	487	case EVENT_WPS_BUTTON_PUSHED:
d601247c	488	hostapd_wps_button_pushed(hapd, NULL);
fcf0f87d	489	break;
f8b1f695 JM	490	#ifdef NEED_AP_MLME
	491	case EVENT_TX_STATUS:
	492	switch (data->tx_status.type) {
	493	case WLAN_FC_TYPE_MGMT:
	494	hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
	495	data->tx_status.data_len,
	496	data->tx_status.stype,
	497	data->tx_status.ack);
	498	break;
	499	case WLAN_FC_TYPE_DATA:
	500	hostapd_tx_status(hapd, data->tx_status.dst,
	501	data->tx_status.data,
	502	data->tx_status.data_len,
	503	data->tx_status.ack);
	504	break;
	505	}
	506	break;
bcf24348 JB	507	case EVENT_DRIVER_CLIENT_POLL_OK:
	508	hostapd_client_poll_ok(hapd, data->client_poll.addr);
	509	break;
f8b1f695	510	case EVENT_RX_FROM_UNKNOWN:
9b90955e JB	511	hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid,
	512	data->rx_from_unknown.addr,
	513	data->rx_from_unknown.wds);
f8b1f695 JM	514	break;
f8b1f695 JM	515	case EVENT_RX_MGMT:
2a8b7416	516	hostapd_mgmt_rx(hapd, &data->rx_mgmt);
f8b1f695 JM	517	break;
f8b1f695 JM	518	#endif /* NEED_AP_MLME */
a0e0d3bb	519	case EVENT_RX_PROBE_REQ:
b211f3eb JM	520	if (data->rx_probe_req.sa == NULL \|\|
	521	data->rx_probe_req.ie == NULL)
	522	break;
a0e0d3bb	523	hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
04a85e44 JM	524	data->rx_probe_req.da,
04a85e44 JM	525	data->rx_probe_req.bssid,
a0e0d3bb JM	526	data->rx_probe_req.ie,
	527	data->rx_probe_req.ie_len);
	528	break;
a70a5d6d	529	case EVENT_NEW_STA:
a8e0505b JM	530	hostapd_event_new_sta(hapd, data->new_sta.addr);
	531	break;
	532	case EVENT_EAPOL_RX:
	533	hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
	534	data->eapol_rx.data,
	535	data->eapol_rx.data_len);
	536	break;
1d041bec JM	537	case EVENT_ASSOC:
	538	hostapd_notif_assoc(hapd, data->assoc_info.addr,
	539	data->assoc_info.req_ies,
39b08b5f SP	540	data->assoc_info.req_ies_len,
39b08b5f SP	541	data->assoc_info.reassoc);
1d041bec JM	542	break;
	543	case EVENT_DISASSOC:
	544	if (data)
	545	hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
	546	break;
	547	case EVENT_DEAUTH:
	548	if (data)
	549	hostapd_notif_disassoc(hapd, data->deauth_info.addr);
	550	break;
0d7e5a3a JB	551	case EVENT_STATION_LOW_ACK:
	552	if (!data)
	553	break;
	554	hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
	555	break;
7cc7307d	556	#ifdef NEED_AP_MLME
9e2704c3 JM	557	case EVENT_RX_ACTION:
	558	if (data->rx_action.da == NULL \|\| data->rx_action.sa == NULL \|\|
	559	data->rx_action.bssid == NULL)
	560	break;
	561	hostapd_rx_action(hapd, &data->rx_action);
	562	break;
7cc7307d	563	#endif /* NEED_AP_MLME */
ad1e68e6 JM	564	default:
	565	wpa_printf(MSG_DEBUG, "Unknown event %d", event);
	566	break;
	567	}
	568	}
f8b1f695 JM	569
f8b1f695 JM	570	#endif /* HOSTAPD */