src/ap/drv_callbacks.c

   1 /*
   2  * hostapd / Callback functions for driver wrappers
   3  * Copyright (c) 2002-2013, Jouni Malinen <j@w1.fi>
   4  *
   5  * This software may be distributed under the terms of the BSD license.
   6  * See README for more details.
   7  */
   8
   9 #include "utils/includes.h"
  10
  11 #include "utils/common.h"
  12 #include "radius/radius.h"
  13 #include "drivers/driver.h"
  14 #include "common/ieee802_11_defs.h"
  15 #include "common/ieee802_11_common.h"
  16 #include "common/wpa_ctrl.h"
  17 #include "crypto/random.h"
  18 #include "p2p/p2p.h"
  19 #include "wps/wps.h"
  20 #include "wnm_ap.h"
  21 #include "hostapd.h"
  22 #include "ieee802_11.h"
  23 #include "sta_info.h"
  24 #include "accounting.h"
  25 #include "tkip_countermeasures.h"
  26 #include "ieee802_1x.h"
  27 #include "wpa_auth.h"
  28 #include "wps_hostapd.h"
  29 #include "ap_drv_ops.h"
  30 #include "ap_config.h"
  31 #include "hw_features.h"
  32 #include "dfs.h"
  33
  34
  35 int hostapd_notif_assoc(struct hostapd_data *hapd, const u8 *addr,
  36                         const u8 *req_ies, size_t req_ies_len, int reassoc)
  37 {
  38         struct sta_info *sta;
  39         int new_assoc, res;
  40         struct ieee802_11_elems elems;
  41         const u8 *ie;
  42         size_t ielen;
  43 #ifdef CONFIG_IEEE80211R
  44         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
  45         u8 *p = buf;
  46 #endif /* CONFIG_IEEE80211R */
  47         u16 reason = WLAN_REASON_UNSPECIFIED;
  48         u16 status = WLAN_STATUS_SUCCESS;
  49         const u8 *p2p_dev_addr = NULL;
  50
  51         if (addr == NULL) {
  52                 /*
  53                  * This could potentially happen with unexpected event from the
  54                  * driver wrapper. This was seen at least in one case where the
  55                  * driver ended up being set to station mode while hostapd was
  56                  * running, so better make sure we stop processing such an
  57                  * event here.
  58                  */
  59                 wpa_printf(MSG_DEBUG, "hostapd_notif_assoc: Skip event with "
  60                            "no address");
  61                 return -1;
  62         }
  63         random_add_randomness(addr, ETH_ALEN);
  64
  65         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
  66                        HOSTAPD_LEVEL_INFO, "associated");
  67
  68         ieee802_11_parse_elems(req_ies, req_ies_len, &elems, 0);
  69         if (elems.wps_ie) {
  70                 ie = elems.wps_ie - 2;
  71                 ielen = elems.wps_ie_len + 2;
  72                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)AssocReq");
  73         } else if (elems.rsn_ie) {
  74                 ie = elems.rsn_ie - 2;
  75                 ielen = elems.rsn_ie_len + 2;
  76                 wpa_printf(MSG_DEBUG, "STA included RSN IE in (Re)AssocReq");
  77         } else if (elems.wpa_ie) {
  78                 ie = elems.wpa_ie - 2;
  79                 ielen = elems.wpa_ie_len + 2;
  80                 wpa_printf(MSG_DEBUG, "STA included WPA IE in (Re)AssocReq");
  81         } else {
  82                 ie = NULL;
  83                 ielen = 0;
  84                 wpa_printf(MSG_DEBUG, "STA did not include WPS/RSN/WPA IE in "
  85                            "(Re)AssocReq");
  86         }
  87
  88         sta = ap_get_sta(hapd, addr);
  89         if (sta) {
  90                 ap_sta_no_session_timeout(hapd, sta);
  91                 accounting_sta_stop(hapd, sta);
  92
  93                 /*
  94                  * Make sure that the previously registered inactivity timer
  95                  * will not remove the STA immediately.
  96                  */
  97                 sta->timeout_next = STA_NULLFUNC;
  98         } else {
  99                 sta = ap_sta_add(hapd, addr);
 100                 if (sta == NULL) {
 101                         hostapd_drv_sta_disassoc(hapd, addr,
 102                                                  WLAN_REASON_DISASSOC_AP_BUSY);
 103                         return -1;
 104                 }
 105         }
 106         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
 107
 108 #ifdef CONFIG_P2P
 109         if (elems.p2p) {
 110                 wpabuf_free(sta->p2p_ie);
 111                 sta->p2p_ie = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
 112                                                           P2P_IE_VENDOR_TYPE);
 113                 if (sta->p2p_ie)
 114                         p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
 115         }
 116 #endif /* CONFIG_P2P */
 117
 118 #ifdef CONFIG_INTERWORKING
 119         if (elems.ext_capab && elems.ext_capab_len > 4) {
 120                 if (elems.ext_capab[4] & 0x01)
 121                         sta->qos_map_enabled = 1;
 122         }
 123 #endif /* CONFIG_INTERWORKING */
 124
 125 #ifdef CONFIG_HS20
 126         wpabuf_free(sta->hs20_ie);
 127         if (elems.hs20 && elems.hs20_len > 4) {
 128                 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
 129                                                  elems.hs20_len - 4);
 130         } else
 131                 sta->hs20_ie = NULL;
 132 #endif /* CONFIG_HS20 */
 133
 134         if (hapd->conf->wpa) {
 135                 if (ie == NULL || ielen == 0) {
 136 #ifdef CONFIG_WPS
 137                         if (hapd->conf->wps_state) {
 138                                 wpa_printf(MSG_DEBUG, "STA did not include "
 139                                            "WPA/RSN IE in (Re)Association "
 140                                            "Request - possible WPS use");
 141                                 sta->flags |= WLAN_STA_MAYBE_WPS;
 142                                 goto skip_wpa_check;
 143                         }
 144 #endif /* CONFIG_WPS */
 145
 146                         wpa_printf(MSG_DEBUG, "No WPA/RSN IE from STA");
 147                         return -1;
 148                 }
 149 #ifdef CONFIG_WPS
 150                 if (hapd->conf->wps_state && ie[0] == 0xdd && ie[1] >= 4 &&
 151                     os_memcmp(ie + 2, "\x00\x50\xf2\x04", 4) == 0) {
 152                         struct wpabuf *wps;
 153                         sta->flags |= WLAN_STA_WPS;
 154                         wps = ieee802_11_vendor_ie_concat(ie, ielen,
 155                                                           WPS_IE_VENDOR_TYPE);
 156                         if (wps) {
 157                                 if (wps_is_20(wps)) {
 158                                         wpa_printf(MSG_DEBUG, "WPS: STA "
 159                                                    "supports WPS 2.0");
 160                                         sta->flags |= WLAN_STA_WPS2;
 161                                 }
 162                                 wpabuf_free(wps);
 163                         }
 164                         goto skip_wpa_check;
 165                 }
 166 #endif /* CONFIG_WPS */
 167
 168                 if (sta->wpa_sm == NULL)
 169                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 170                                                         sta->addr,
 171                                                         p2p_dev_addr);
 172                 if (sta->wpa_sm == NULL) {
 173                         wpa_printf(MSG_ERROR, "Failed to initialize WPA state "
 174                                    "machine");
 175                         return -1;
 176                 }
 177                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
 178                                           ie, ielen,
 179                                           elems.mdie, elems.mdie_len);
 180                 if (res != WPA_IE_OK) {
 181                         wpa_printf(MSG_DEBUG, "WPA/RSN information element "
 182                                    "rejected? (res %u)", res);
 183                         wpa_hexdump(MSG_DEBUG, "IE", ie, ielen);
 184                         if (res == WPA_INVALID_GROUP) {
 185                                 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
 186                                 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 187                         } else if (res == WPA_INVALID_PAIRWISE) {
 188                                 reason = WLAN_REASON_PAIRWISE_CIPHER_NOT_VALID;
 189                                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 190                         } else if (res == WPA_INVALID_AKMP) {
 191                                 reason = WLAN_REASON_AKMP_NOT_VALID;
 192                                 status = WLAN_STATUS_AKMP_NOT_VALID;
 193                         }
 194 #ifdef CONFIG_IEEE80211W
 195                         else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION) {
 196                                 reason = WLAN_REASON_INVALID_IE;
 197                                 status = WLAN_STATUS_INVALID_IE;
 198                         } else if (res == WPA_INVALID_MGMT_GROUP_CIPHER) {
 199                                 reason = WLAN_REASON_GROUP_CIPHER_NOT_VALID;
 200                                 status = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 201                         }
 202 #endif /* CONFIG_IEEE80211W */
 203                         else {
 204                                 reason = WLAN_REASON_INVALID_IE;
 205                                 status = WLAN_STATUS_INVALID_IE;
 206                         }
 207                         goto fail;
 208                 }
 209 #ifdef CONFIG_IEEE80211W
 210                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 211                     sta->sa_query_count > 0)
 212                         ap_check_sa_query_timeout(hapd, sta);
 213                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 214                     (sta->auth_alg != WLAN_AUTH_FT)) {
 215                         /*
 216                          * STA has already been associated with MFP and SA
 217                          * Query timeout has not been reached. Reject the
 218                          * association attempt temporarily and start SA Query,
 219                          * if one is not pending.
 220                          */
 221
 222                         if (sta->sa_query_count == 0)
 223                                 ap_sta_start_sa_query(hapd, sta);
 224
 225 #ifdef CONFIG_IEEE80211R
 226                         status = WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
 227
 228                         p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
 229
 230                         hostapd_sta_assoc(hapd, addr, reassoc, status, buf,
 231                                           p - buf);
 232 #endif /* CONFIG_IEEE80211R */
 233                         return 0;
 234                 }
 235
 236                 if (wpa_auth_uses_mfp(sta->wpa_sm))
 237                         sta->flags |= WLAN_STA_MFP;
 238                 else
 239                         sta->flags &= ~WLAN_STA_MFP;
 240 #endif /* CONFIG_IEEE80211W */
 241
 242 #ifdef CONFIG_IEEE80211R
 243                 if (sta->auth_alg == WLAN_AUTH_FT) {
 244                         status = wpa_ft_validate_reassoc(sta->wpa_sm, req_ies,
 245                                                          req_ies_len);
 246                         if (status != WLAN_STATUS_SUCCESS) {
 247                                 if (status == WLAN_STATUS_INVALID_PMKID)
 248                                         reason = WLAN_REASON_INVALID_IE;
 249                                 if (status == WLAN_STATUS_INVALID_MDIE)
 250                                         reason = WLAN_REASON_INVALID_IE;
 251                                 if (status == WLAN_STATUS_INVALID_FTIE)
 252                                         reason = WLAN_REASON_INVALID_IE;
 253                                 goto fail;
 254                         }
 255                 }
 256 #endif /* CONFIG_IEEE80211R */
 257         } else if (hapd->conf->wps_state) {
 258 #ifdef CONFIG_WPS
 259                 struct wpabuf *wps;
 260                 if (req_ies)
 261                         wps = ieee802_11_vendor_ie_concat(req_ies, req_ies_len,
 262                                                           WPS_IE_VENDOR_TYPE);
 263                 else
 264                         wps = NULL;
 265 #ifdef CONFIG_WPS_STRICT
 266                 if (wps && wps_validate_assoc_req(wps) < 0) {
 267                         reason = WLAN_REASON_INVALID_IE;
 268                         status = WLAN_STATUS_INVALID_IE;
 269                         wpabuf_free(wps);
 270                         goto fail;
 271                 }
 272 #endif /* CONFIG_WPS_STRICT */
 273                 if (wps) {
 274                         sta->flags |= WLAN_STA_WPS;
 275                         if (wps_is_20(wps)) {
 276                                 wpa_printf(MSG_DEBUG, "WPS: STA supports "
 277                                            "WPS 2.0");
 278                                 sta->flags |= WLAN_STA_WPS2;
 279                         }
 280                 } else
 281                         sta->flags |= WLAN_STA_MAYBE_WPS;
 282                 wpabuf_free(wps);
 283 #endif /* CONFIG_WPS */
 284         }
 285 #ifdef CONFIG_WPS
 286 skip_wpa_check:
 287 #endif /* CONFIG_WPS */
 288
 289 #ifdef CONFIG_IEEE80211R
 290         p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, buf, sizeof(buf),
 291                                         sta->auth_alg, req_ies, req_ies_len);
 292
 293         hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf);
 294 #else /* CONFIG_IEEE80211R */
 295         /* Keep compiler silent about unused variables */
 296         if (status) {
 297         }
 298 #endif /* CONFIG_IEEE80211R */
 299
 300         new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
 301         sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
 302         sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
 303
 304         if (reassoc && (sta->auth_alg == WLAN_AUTH_FT))
 305                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
 306         else
 307                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
 308
 309         hostapd_new_assoc_sta(hapd, sta, !new_assoc);
 310
 311         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
 312
 313 #ifdef CONFIG_P2P
 314         if (req_ies) {
 315                 p2p_group_notif_assoc(hapd->p2p_group, sta->addr,
 316                                       req_ies, req_ies_len);
 317         }
 318 #endif /* CONFIG_P2P */
 319
 320         return 0;
 321
 322 fail:
 323 #ifdef CONFIG_IEEE80211R
 324         hostapd_sta_assoc(hapd, addr, reassoc, status, buf, p - buf);
 325 #endif /* CONFIG_IEEE80211R */
 326         hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
 327         ap_free_sta(hapd, sta);
 328         return -1;
 329 }
 330
 331
 332 void hostapd_notif_disassoc(struct hostapd_data *hapd, const u8 *addr)
 333 {
 334         struct sta_info *sta;
 335
 336         if (addr == NULL) {
 337                 /*
 338                  * This could potentially happen with unexpected event from the
 339                  * driver wrapper. This was seen at least in one case where the
 340                  * driver ended up reporting a station mode event while hostapd
 341                  * was running, so better make sure we stop processing such an
 342                  * event here.
 343                  */
 344                 wpa_printf(MSG_DEBUG, "hostapd_notif_disassoc: Skip event "
 345                            "with no address");
 346                 return;
 347         }
 348
 349         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
 350                        HOSTAPD_LEVEL_INFO, "disassociated");
 351
 352         sta = ap_get_sta(hapd, addr);
 353         if (sta == NULL) {
 354                 wpa_printf(MSG_DEBUG, "Disassociation notification for "
 355                            "unknown STA " MACSTR, MAC2STR(addr));
 356                 return;
 357         }
 358
 359         ap_sta_set_authorized(hapd, sta, 0);
 360         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 361         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
 362         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 363         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
 364         ap_free_sta(hapd, sta);
 365 }
 366
 367
 368 void hostapd_event_sta_low_ack(struct hostapd_data *hapd, const u8 *addr)
 369 {
 370         struct sta_info *sta = ap_get_sta(hapd, addr);
 371
 372         if (!sta || !hapd->conf->disassoc_low_ack)
 373                 return;
 374
 375         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
 376                        HOSTAPD_LEVEL_INFO, "disconnected due to excessive "
 377                        "missing ACKs");
 378         hostapd_drv_sta_disassoc(hapd, addr, WLAN_REASON_DISASSOC_LOW_ACK);
 379         if (sta)
 380                 ap_sta_disassociate(hapd, sta, WLAN_REASON_DISASSOC_LOW_ACK);
 381 }
 382
 383
 384 void hostapd_event_ch_switch(struct hostapd_data *hapd, int freq, int ht,
 385                              int offset, int width, int cf1, int cf2)
 386 {
 387 #ifdef NEED_AP_MLME
 388         int channel, chwidth, seg0_idx = 0, seg1_idx = 0;
 389
 390         hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
 391                        HOSTAPD_LEVEL_INFO, "driver had channel switch: "
 392                        "freq=%d, ht=%d, offset=%d, width=%d, cf1=%d, cf2=%d",
 393                        freq, ht, offset, width, cf1, cf2);
 394
 395         hapd->iface->freq = freq;
 396
 397         channel = hostapd_hw_get_channel(hapd, freq);
 398         if (!channel) {
 399                 hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
 400                                HOSTAPD_LEVEL_WARNING, "driver switched to "
 401                                "bad channel!");
 402                 return;
 403         }
 404
 405         switch (width) {
 406         case CHAN_WIDTH_80:
 407                 chwidth = VHT_CHANWIDTH_80MHZ;
 408                 break;
 409         case CHAN_WIDTH_80P80:
 410                 chwidth = VHT_CHANWIDTH_80P80MHZ;
 411                 break;
 412         case CHAN_WIDTH_160:
 413                 chwidth = VHT_CHANWIDTH_160MHZ;
 414                 break;
 415         case CHAN_WIDTH_20_NOHT:
 416         case CHAN_WIDTH_20:
 417         case CHAN_WIDTH_40:
 418         default:
 419                 chwidth = VHT_CHANWIDTH_USE_HT;
 420                 break;
 421         }
 422
 423         switch (hapd->iface->current_mode->mode) {
 424         case HOSTAPD_MODE_IEEE80211A:
 425                 if (cf1 > 5000)
 426                         seg0_idx = (cf1 - 5000) / 5;
 427                 if (cf2 > 5000)
 428                         seg1_idx = (cf2 - 5000) / 5;
 429                 break;
 430         default:
 431                 seg0_idx = hostapd_hw_get_channel(hapd, cf1);
 432                 seg1_idx = hostapd_hw_get_channel(hapd, cf2);
 433                 break;
 434         }
 435
 436         hapd->iconf->channel = channel;
 437         hapd->iconf->ieee80211n = ht;
 438         hapd->iconf->secondary_channel = offset;
 439         hapd->iconf->vht_oper_chwidth = chwidth;
 440         hapd->iconf->vht_oper_centr_freq_seg0_idx = seg0_idx;
 441         hapd->iconf->vht_oper_centr_freq_seg1_idx = seg1_idx;
 442
 443         if (hapd->iface->csa_in_progress &&
 444             freq == hapd->iface->cs_freq_params.freq) {
 445                 hostapd_cleanup_cs_params(hapd);
 446
 447                 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_CSA_FINISHED "freq=%d",
 448                         freq);
 449         }
 450 #endif /* NEED_AP_MLME */
 451 }
 452
 453
 454 void hostapd_event_connect_failed_reason(struct hostapd_data *hapd,
 455                                          const u8 *addr, int reason_code)
 456 {
 457         switch (reason_code) {
 458         case MAX_CLIENT_REACHED:
 459                 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_MAX_STA MACSTR,
 460                         MAC2STR(addr));
 461                 break;
 462         case BLOCKED_CLIENT:
 463                 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_REJECTED_BLOCKED_STA MACSTR,
 464                         MAC2STR(addr));
 465                 break;
 466         }
 467 }
 468
 469
 470 int hostapd_probe_req_rx(struct hostapd_data *hapd, const u8 *sa, const u8 *da,
 471                          const u8 *bssid, const u8 *ie, size_t ie_len,
 472                          int ssi_signal)
 473 {
 474         size_t i;
 475         int ret = 0;
 476
 477         if (sa == NULL || ie == NULL)
 478                 return -1;
 479
 480         random_add_randomness(sa, ETH_ALEN);
 481         for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++) {
 482                 if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
 483                                             sa, da, bssid, ie, ie_len,
 484                                             ssi_signal) > 0) {
 485                         ret = 1;
 486                         break;
 487                 }
 488         }
 489         return ret;
 490 }
 491
 492
 493 #ifdef HOSTAPD
 494
 495 #ifdef CONFIG_IEEE80211R
 496 static void hostapd_notify_auth_ft_finish(void *ctx, const u8 *dst,
 497                                           const u8 *bssid,
 498                                           u16 auth_transaction, u16 status,
 499                                           const u8 *ies, size_t ies_len)
 500 {
 501         struct hostapd_data *hapd = ctx;
 502         struct sta_info *sta;
 503
 504         sta = ap_get_sta(hapd, dst);
 505         if (sta == NULL)
 506                 return;
 507
 508         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 509                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 510         sta->flags |= WLAN_STA_AUTH;
 511
 512         hostapd_sta_auth(hapd, dst, auth_transaction, status, ies, ies_len);
 513 }
 514 #endif /* CONFIG_IEEE80211R */
 515
 516
 517 static void hostapd_notif_auth(struct hostapd_data *hapd,
 518                                struct auth_info *rx_auth)
 519 {
 520         struct sta_info *sta;
 521         u16 status = WLAN_STATUS_SUCCESS;
 522         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 523         size_t resp_ies_len = 0;
 524
 525         sta = ap_get_sta(hapd, rx_auth->peer);
 526         if (!sta) {
 527                 sta = ap_sta_add(hapd, rx_auth->peer);
 528                 if (sta == NULL) {
 529                         status = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 530                         goto fail;
 531                 }
 532         }
 533         sta->flags &= ~WLAN_STA_PREAUTH;
 534         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 535 #ifdef CONFIG_IEEE80211R
 536         if (rx_auth->auth_type == WLAN_AUTH_FT && hapd->wpa_auth) {
 537                 sta->auth_alg = WLAN_AUTH_FT;
 538                 if (sta->wpa_sm == NULL)
 539                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 540                                                         sta->addr, NULL);
 541                 if (sta->wpa_sm == NULL) {
 542                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
 543                                    "state machine");
 544                         status = WLAN_STATUS_UNSPECIFIED_FAILURE;
 545                         goto fail;
 546                 }
 547                 wpa_ft_process_auth(sta->wpa_sm, rx_auth->bssid,
 548                                     rx_auth->auth_transaction, rx_auth->ies,
 549                                     rx_auth->ies_len,
 550                                     hostapd_notify_auth_ft_finish, hapd);
 551                 return;
 552         }
 553 #endif /* CONFIG_IEEE80211R */
 554 fail:
 555         hostapd_sta_auth(hapd, rx_auth->peer, rx_auth->auth_transaction + 1,
 556                          status, resp_ies, resp_ies_len);
 557 }
 558
 559
 560 static void hostapd_action_rx(struct hostapd_data *hapd,
 561                               struct rx_action *action)
 562 {
 563         struct sta_info *sta;
 564
 565         wpa_printf(MSG_DEBUG, "RX_ACTION cat %d action plen %d",
 566                    action->category, (int) action->len);
 567
 568         sta = ap_get_sta(hapd, action->sa);
 569         if (sta == NULL) {
 570                 wpa_printf(MSG_DEBUG, "%s: station not found", __func__);
 571                 return;
 572         }
 573 #ifdef CONFIG_IEEE80211R
 574         if (action->category == WLAN_ACTION_FT) {
 575                 wpa_printf(MSG_DEBUG, "%s: FT_ACTION length %d",
 576                            __func__, (int) action->len);
 577                 wpa_ft_action_rx(sta->wpa_sm, action->data, action->len);
 578         }
 579 #endif /* CONFIG_IEEE80211R */
 580 #ifdef CONFIG_IEEE80211W
 581         if (action->category == WLAN_ACTION_SA_QUERY && action->len >= 4) {
 582                 wpa_printf(MSG_DEBUG, "%s: SA_QUERY_ACTION length %d",
 583                            __func__, (int) action->len);
 584                 ieee802_11_sa_query_action(hapd, action->sa,
 585                                            *(action->data + 1),
 586                                            action->data + 2);
 587         }
 588 #endif /* CONFIG_IEEE80211W */
 589 #ifdef CONFIG_WNM
 590         if (action->category == WLAN_ACTION_WNM) {
 591                 wpa_printf(MSG_DEBUG, "%s: WNM_ACTION length %d",
 592                            __func__, (int) action->len);
 593                 ieee802_11_rx_wnm_action_ap(hapd, action);
 594         }
 595 #endif /* CONFIG_WNM */
 596 }
 597
 598
 599 #ifdef NEED_AP_MLME
 600
 601 #define HAPD_BROADCAST ((struct hostapd_data *) -1)
 602
 603 static struct hostapd_data * get_hapd_bssid(struct hostapd_iface *iface,
 604                                             const u8 *bssid)
 605 {
 606         size_t i;
 607
 608         if (bssid == NULL)
 609                 return NULL;
 610         if (bssid[0] == 0xff && bssid[1] == 0xff && bssid[2] == 0xff &&
 611             bssid[3] == 0xff && bssid[4] == 0xff && bssid[5] == 0xff)
 612                 return HAPD_BROADCAST;
 613
 614         for (i = 0; i < iface->num_bss; i++) {
 615                 if (os_memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0)
 616                         return iface->bss[i];
 617         }
 618
 619         return NULL;
 620 }
 621
 622
 623 static void hostapd_rx_from_unknown_sta(struct hostapd_data *hapd,
 624                                         const u8 *bssid, const u8 *addr,
 625                                         int wds)
 626 {
 627         hapd = get_hapd_bssid(hapd->iface, bssid);
 628         if (hapd == NULL || hapd == HAPD_BROADCAST)
 629                 return;
 630
 631         ieee802_11_rx_from_unknown(hapd, addr, wds);
 632 }
 633
 634
 635 static void hostapd_mgmt_rx(struct hostapd_data *hapd, struct rx_mgmt *rx_mgmt)
 636 {
 637         struct hostapd_iface *iface = hapd->iface;
 638         const struct ieee80211_hdr *hdr;
 639         const u8 *bssid;
 640         struct hostapd_frame_info fi;
 641
 642         hdr = (const struct ieee80211_hdr *) rx_mgmt->frame;
 643         bssid = get_hdr_bssid(hdr, rx_mgmt->frame_len);
 644         if (bssid == NULL)
 645                 return;
 646
 647         hapd = get_hapd_bssid(iface, bssid);
 648         if (hapd == NULL) {
 649                 u16 fc;
 650                 fc = le_to_host16(hdr->frame_control);
 651
 652                 /*
 653                  * Drop frames to unknown BSSIDs except for Beacon frames which
 654                  * could be used to update neighbor information.
 655                  */
 656                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 657                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
 658                         hapd = iface->bss[0];
 659                 else
 660                         return;
 661         }
 662
 663         os_memset(&fi, 0, sizeof(fi));
 664         fi.datarate = rx_mgmt->datarate;
 665         fi.ssi_signal = rx_mgmt->ssi_signal;
 666
 667         if (hapd == HAPD_BROADCAST) {
 668                 size_t i;
 669                 for (i = 0; i < iface->num_bss; i++)
 670                         ieee802_11_mgmt(iface->bss[i], rx_mgmt->frame,
 671                                         rx_mgmt->frame_len, &fi);
 672         } else
 673                 ieee802_11_mgmt(hapd, rx_mgmt->frame, rx_mgmt->frame_len, &fi);
 674
 675         random_add_randomness(&fi, sizeof(fi));
 676 }
 677
 678
 679 static void hostapd_rx_action(struct hostapd_data *hapd,
 680                               struct rx_action *rx_action)
 681 {
 682         struct rx_mgmt rx_mgmt;
 683         u8 *buf;
 684         struct ieee80211_hdr *hdr;
 685
 686         wpa_printf(MSG_DEBUG, "EVENT_RX_ACTION DA=" MACSTR " SA=" MACSTR
 687                    " BSSID=" MACSTR " category=%u",
 688                    MAC2STR(rx_action->da), MAC2STR(rx_action->sa),
 689                    MAC2STR(rx_action->bssid), rx_action->category);
 690         wpa_hexdump(MSG_MSGDUMP, "Received action frame contents",
 691                     rx_action->data, rx_action->len);
 692
 693         buf = os_zalloc(24 + 1 + rx_action->len);
 694         if (buf == NULL)
 695                 return;
 696         hdr = (struct ieee80211_hdr *) buf;
 697         hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 698                                           WLAN_FC_STYPE_ACTION);
 699         if (rx_action->category == WLAN_ACTION_SA_QUERY) {
 700                 /*
 701                  * Assume frame was protected; it would have been dropped if
 702                  * not.
 703                  */
 704                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 705         }
 706         os_memcpy(hdr->addr1, rx_action->da, ETH_ALEN);
 707         os_memcpy(hdr->addr2, rx_action->sa, ETH_ALEN);
 708         os_memcpy(hdr->addr3, rx_action->bssid, ETH_ALEN);
 709         buf[24] = rx_action->category;
 710         os_memcpy(buf + 24 + 1, rx_action->data, rx_action->len);
 711         os_memset(&rx_mgmt, 0, sizeof(rx_mgmt));
 712         rx_mgmt.frame = buf;
 713         rx_mgmt.frame_len = 24 + 1 + rx_action->len;
 714         hostapd_mgmt_rx(hapd, &rx_mgmt);
 715         os_free(buf);
 716 }
 717
 718
 719 static void hostapd_mgmt_tx_cb(struct hostapd_data *hapd, const u8 *buf,
 720                                size_t len, u16 stype, int ok)
 721 {
 722         struct ieee80211_hdr *hdr;
 723         hdr = (struct ieee80211_hdr *) buf;
 724         hapd = get_hapd_bssid(hapd->iface, get_hdr_bssid(hdr, len));
 725         if (hapd == NULL || hapd == HAPD_BROADCAST)
 726                 return;
 727         ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
 728 }
 729
 730 #endif /* NEED_AP_MLME */
 731
 732
 733 static int hostapd_event_new_sta(struct hostapd_data *hapd, const u8 *addr)
 734 {
 735         struct sta_info *sta = ap_get_sta(hapd, addr);
 736         if (sta)
 737                 return 0;
 738
 739         wpa_printf(MSG_DEBUG, "Data frame from unknown STA " MACSTR
 740                    " - adding a new STA", MAC2STR(addr));
 741         sta = ap_sta_add(hapd, addr);
 742         if (sta) {
 743                 hostapd_new_assoc_sta(hapd, sta, 0);
 744         } else {
 745                 wpa_printf(MSG_DEBUG, "Failed to add STA entry for " MACSTR,
 746                            MAC2STR(addr));
 747                 return -1;
 748         }
 749
 750         return 0;
 751 }
 752
 753
 754 static void hostapd_event_eapol_rx(struct hostapd_data *hapd, const u8 *src,
 755                                    const u8 *data, size_t data_len)
 756 {
 757         struct hostapd_iface *iface = hapd->iface;
 758         struct sta_info *sta;
 759         size_t j;
 760
 761         for (j = 0; j < iface->num_bss; j++) {
 762                 if ((sta = ap_get_sta(iface->bss[j], src))) {
 763                         if (sta->flags & WLAN_STA_ASSOC) {
 764                                 hapd = iface->bss[j];
 765                                 break;
 766                         }
 767                 }
 768         }
 769
 770         ieee802_1x_receive(hapd, src, data, data_len);
 771 }
 772
 773
 774 static struct hostapd_channel_data * hostapd_get_mode_channel(
 775         struct hostapd_iface *iface, unsigned int freq)
 776 {
 777         int i;
 778         struct hostapd_channel_data *chan;
 779
 780         for (i = 0; i < iface->current_mode->num_channels; i++) {
 781                 chan = &iface->current_mode->channels[i];
 782                 if (!chan)
 783                         return NULL;
 784                 if ((unsigned int) chan->freq == freq)
 785                         return chan;
 786         }
 787
 788         return NULL;
 789 }
 790
 791
 792 static void hostapd_update_nf(struct hostapd_iface *iface,
 793                               struct hostapd_channel_data *chan,
 794                               struct freq_survey *survey)
 795 {
 796         if (!iface->chans_surveyed) {
 797                 chan->min_nf = survey->nf;
 798                 iface->lowest_nf = survey->nf;
 799         } else {
 800                 if (dl_list_empty(&chan->survey_list))
 801                         chan->min_nf = survey->nf;
 802                 else if (survey->nf < chan->min_nf)
 803                         chan->min_nf = survey->nf;
 804                 if (survey->nf < iface->lowest_nf)
 805                         iface->lowest_nf = survey->nf;
 806         }
 807 }
 808
 809
 810 static void hostapd_event_get_survey(struct hostapd_data *hapd,
 811                                      struct survey_results *survey_results)
 812 {
 813         struct hostapd_iface *iface = hapd->iface;
 814         struct freq_survey *survey, *tmp;
 815         struct hostapd_channel_data *chan;
 816
 817         if (dl_list_empty(&survey_results->survey_list)) {
 818                 wpa_printf(MSG_DEBUG, "No survey data received");
 819                 return;
 820         }
 821
 822         dl_list_for_each_safe(survey, tmp, &survey_results->survey_list,
 823                               struct freq_survey, list) {
 824                 chan = hostapd_get_mode_channel(iface, survey->freq);
 825                 if (!chan)
 826                         continue;
 827                 if (chan->flag & HOSTAPD_CHAN_DISABLED)
 828                         continue;
 829
 830                 dl_list_del(&survey->list);
 831                 dl_list_add_tail(&chan->survey_list, &survey->list);
 832
 833                 hostapd_update_nf(iface, chan, survey);
 834
 835                 iface->chans_surveyed++;
 836         }
 837 }
 838
 839
 840 #ifdef NEED_AP_MLME
 841
 842 static void hostapd_event_dfs_radar_detected(struct hostapd_data *hapd,
 843                                              struct dfs_event *radar)
 844 {
 845         wpa_printf(MSG_DEBUG, "DFS radar detected on %d MHz", radar->freq);
 846         hostapd_dfs_radar_detected(hapd->iface, radar->freq, radar->ht_enabled,
 847                                    radar->chan_offset, radar->chan_width,
 848                                    radar->cf1, radar->cf2);
 849 }
 850
 851
 852 static void hostapd_event_dfs_cac_finished(struct hostapd_data *hapd,
 853                                            struct dfs_event *radar)
 854 {
 855         wpa_printf(MSG_DEBUG, "DFS CAC finished on %d MHz", radar->freq);
 856         hostapd_dfs_complete_cac(hapd->iface, 1, radar->freq, radar->ht_enabled,
 857                                  radar->chan_offset, radar->chan_width,
 858                                  radar->cf1, radar->cf2);
 859 }
 860
 861
 862 static void hostapd_event_dfs_cac_aborted(struct hostapd_data *hapd,
 863                                           struct dfs_event *radar)
 864 {
 865         wpa_printf(MSG_DEBUG, "DFS CAC aborted on %d MHz", radar->freq);
 866         hostapd_dfs_complete_cac(hapd->iface, 0, radar->freq, radar->ht_enabled,
 867                                  radar->chan_offset, radar->chan_width,
 868                                  radar->cf1, radar->cf2);
 869 }
 870
 871
 872 static void hostapd_event_dfs_nop_finished(struct hostapd_data *hapd,
 873                                            struct dfs_event *radar)
 874 {
 875         wpa_printf(MSG_DEBUG, "DFS NOP finished on %d MHz", radar->freq);
 876         hostapd_dfs_nop_finished(hapd->iface, radar->freq, radar->ht_enabled,
 877                                  radar->chan_offset, radar->chan_width,
 878                                  radar->cf1, radar->cf2);
 879 }
 880
 881 #endif /* NEED_AP_MLME */
 882
 883
 884 void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
 885                           union wpa_event_data *data)
 886 {
 887         struct hostapd_data *hapd = ctx;
 888 #ifndef CONFIG_NO_STDOUT_DEBUG
 889         int level = MSG_DEBUG;
 890
 891         if (event == EVENT_RX_MGMT && data->rx_mgmt.frame &&
 892             data->rx_mgmt.frame_len >= 24) {
 893                 const struct ieee80211_hdr *hdr;
 894                 u16 fc;
 895                 hdr = (const struct ieee80211_hdr *) data->rx_mgmt.frame;
 896                 fc = le_to_host16(hdr->frame_control);
 897                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 898                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON)
 899                         level = MSG_EXCESSIVE;
 900                 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 901                     WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_REQ)
 902                         level = MSG_EXCESSIVE;
 903         }
 904
 905         wpa_dbg(hapd->msg_ctx, level, "Event %s (%d) received",
 906                 event_to_string(event), event);
 907 #endif /* CONFIG_NO_STDOUT_DEBUG */
 908
 909         switch (event) {
 910         case EVENT_MICHAEL_MIC_FAILURE:
 911                 michael_mic_failure(hapd, data->michael_mic_failure.src, 1);
 912                 break;
 913         case EVENT_SCAN_RESULTS:
 914                 if (hapd->iface->scan_cb)
 915                         hapd->iface->scan_cb(hapd->iface);
 916                 break;
 917 #ifdef CONFIG_IEEE80211R
 918         case EVENT_FT_RRB_RX:
 919                 wpa_ft_rrb_rx(hapd->wpa_auth, data->ft_rrb_rx.src,
 920                               data->ft_rrb_rx.data, data->ft_rrb_rx.data_len);
 921                 break;
 922 #endif /* CONFIG_IEEE80211R */
 923         case EVENT_WPS_BUTTON_PUSHED:
 924                 hostapd_wps_button_pushed(hapd, NULL);
 925                 break;
 926 #ifdef NEED_AP_MLME
 927         case EVENT_TX_STATUS:
 928                 switch (data->tx_status.type) {
 929                 case WLAN_FC_TYPE_MGMT:
 930                         hostapd_mgmt_tx_cb(hapd, data->tx_status.data,
 931                                            data->tx_status.data_len,
 932                                            data->tx_status.stype,
 933                                            data->tx_status.ack);
 934                         break;
 935                 case WLAN_FC_TYPE_DATA:
 936                         hostapd_tx_status(hapd, data->tx_status.dst,
 937                                           data->tx_status.data,
 938                                           data->tx_status.data_len,
 939                                           data->tx_status.ack);
 940                         break;
 941                 }
 942                 break;
 943         case EVENT_EAPOL_TX_STATUS:
 944                 hostapd_eapol_tx_status(hapd, data->eapol_tx_status.dst,
 945                                         data->eapol_tx_status.data,
 946                                         data->eapol_tx_status.data_len,
 947                                         data->eapol_tx_status.ack);
 948                 break;
 949         case EVENT_DRIVER_CLIENT_POLL_OK:
 950                 hostapd_client_poll_ok(hapd, data->client_poll.addr);
 951                 break;
 952         case EVENT_RX_FROM_UNKNOWN:
 953                 hostapd_rx_from_unknown_sta(hapd, data->rx_from_unknown.bssid,
 954                                             data->rx_from_unknown.addr,
 955                                             data->rx_from_unknown.wds);
 956                 break;
 957         case EVENT_RX_MGMT:
 958                 hostapd_mgmt_rx(hapd, &data->rx_mgmt);
 959                 break;
 960 #endif /* NEED_AP_MLME */
 961         case EVENT_RX_PROBE_REQ:
 962                 if (data->rx_probe_req.sa == NULL ||
 963                     data->rx_probe_req.ie == NULL)
 964                         break;
 965                 hostapd_probe_req_rx(hapd, data->rx_probe_req.sa,
 966                                      data->rx_probe_req.da,
 967                                      data->rx_probe_req.bssid,
 968                                      data->rx_probe_req.ie,
 969                                      data->rx_probe_req.ie_len,
 970                                      data->rx_probe_req.ssi_signal);
 971                 break;
 972         case EVENT_NEW_STA:
 973                 hostapd_event_new_sta(hapd, data->new_sta.addr);
 974                 break;
 975         case EVENT_EAPOL_RX:
 976                 hostapd_event_eapol_rx(hapd, data->eapol_rx.src,
 977                                        data->eapol_rx.data,
 978                                        data->eapol_rx.data_len);
 979                 break;
 980         case EVENT_ASSOC:
 981                 hostapd_notif_assoc(hapd, data->assoc_info.addr,
 982                                     data->assoc_info.req_ies,
 983                                     data->assoc_info.req_ies_len,
 984                                     data->assoc_info.reassoc);
 985                 break;
 986         case EVENT_DISASSOC:
 987                 if (data)
 988                         hostapd_notif_disassoc(hapd, data->disassoc_info.addr);
 989                 break;
 990         case EVENT_DEAUTH:
 991                 if (data)
 992                         hostapd_notif_disassoc(hapd, data->deauth_info.addr);
 993                 break;
 994         case EVENT_STATION_LOW_ACK:
 995                 if (!data)
 996                         break;
 997                 hostapd_event_sta_low_ack(hapd, data->low_ack.addr);
 998                 break;
 999         case EVENT_RX_ACTION:
1000                 if (data->rx_action.da == NULL || data->rx_action.sa == NULL ||
1001                     data->rx_action.bssid == NULL)
1002                         break;
1003 #ifdef NEED_AP_MLME
1004                 hostapd_rx_action(hapd, &data->rx_action);
1005 #endif /* NEED_AP_MLME */
1006                 hostapd_action_rx(hapd, &data->rx_action);
1007                 break;
1008         case EVENT_AUTH:
1009                 hostapd_notif_auth(hapd, &data->auth);
1010                 break;
1011         case EVENT_CH_SWITCH:
1012                 if (!data)
1013                         break;
1014                 hostapd_event_ch_switch(hapd, data->ch_switch.freq,
1015                                         data->ch_switch.ht_enabled,
1016                                         data->ch_switch.ch_offset,
1017                                         data->ch_switch.ch_width,
1018                                         data->ch_switch.cf1,
1019                                         data->ch_switch.cf2);
1020                 break;
1021         case EVENT_CONNECT_FAILED_REASON:
1022                 if (!data)
1023                         break;
1024                 hostapd_event_connect_failed_reason(
1025                         hapd, data->connect_failed_reason.addr,
1026                         data->connect_failed_reason.code);
1027                 break;
1028         case EVENT_SURVEY:
1029                 hostapd_event_get_survey(hapd, &data->survey_results);
1030                 break;
1031 #ifdef NEED_AP_MLME
1032         case EVENT_DFS_RADAR_DETECTED:
1033                 if (!data)
1034                         break;
1035                 hostapd_event_dfs_radar_detected(hapd, &data->dfs_event);
1036                 break;
1037         case EVENT_DFS_CAC_FINISHED:
1038                 if (!data)
1039                         break;
1040                 hostapd_event_dfs_cac_finished(hapd, &data->dfs_event);
1041                 break;
1042         case EVENT_DFS_CAC_ABORTED:
1043                 if (!data)
1044                         break;
1045                 hostapd_event_dfs_cac_aborted(hapd, &data->dfs_event);
1046                 break;
1047         case EVENT_DFS_NOP_FINISHED:
1048                 if (!data)
1049                         break;
1050                 hostapd_event_dfs_nop_finished(hapd, &data->dfs_event);
1051                 break;
1052         case EVENT_CHANNEL_LIST_CHANGED:
1053                 /* channel list changed (regulatory?), update channel list */
1054                 /* TODO: check this. hostapd_get_hw_features() initializes
1055                  * too much stuff. */
1056                 /* hostapd_get_hw_features(hapd->iface); */
1057                 hostapd_channel_list_updated(
1058                         hapd->iface, data->channel_list_changed.initiator);
1059                 break;
1060 #endif /* NEED_AP_MLME */
1061         default:
1062                 wpa_printf(MSG_DEBUG, "Unknown event %d", event);
1063                 break;
1064         }
1065 }
1066
1067 #endif /* HOSTAPD */