]> git.ipfire.org Git - thirdparty/hostap.git/blob - src/ap/ieee802_11.c
projects / thirdparty / hostap.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
FILS: Do not process FILS HLP request again while previous one is pending
[thirdparty/hostap.git] / src / ap / ieee802_11.c
1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #ifndef CONFIG_NATIVE_WINDOWS
12
13 #include "utils/common.h"
14 #include "utils/eloop.h"
15 #include "crypto/crypto.h"
16 #include "crypto/sha256.h"
17 #include "crypto/sha384.h"
18 #include "crypto/sha512.h"
19 #include "crypto/random.h"
20 #include "common/ieee802_11_defs.h"
21 #include "common/ieee802_11_common.h"
22 #include "common/wpa_ctrl.h"
23 #include "common/sae.h"
24 #include "radius/radius.h"
25 #include "radius/radius_client.h"
26 #include "p2p/p2p.h"
27 #include "wps/wps.h"
28 #include "fst/fst.h"
29 #include "hostapd.h"
30 #include "beacon.h"
31 #include "ieee802_11_auth.h"
32 #include "sta_info.h"
33 #include "ieee802_1x.h"
34 #include "wpa_auth.h"
35 #include "pmksa_cache_auth.h"
36 #include "wmm.h"
37 #include "ap_list.h"
38 #include "accounting.h"
39 #include "ap_config.h"
40 #include "ap_mlme.h"
41 #include "p2p_hostapd.h"
42 #include "ap_drv_ops.h"
43 #include "wnm_ap.h"
44 #include "hw_features.h"
45 #include "ieee802_11.h"
46 #include "dfs.h"
47 #include "mbo_ap.h"
48 #include "rrm.h"
49 #include "taxonomy.h"
50 #include "fils_hlp.h"
51 #include "dpp_hostapd.h"
52 #include "gas_query_ap.h"
53
54
55 #ifdef CONFIG_FILS
56 static struct wpabuf *
57 prepare_auth_resp_fils(struct hostapd_data *hapd,
58 struct sta_info *sta, u16 *resp,
59 struct rsn_pmksa_cache_entry *pmksa,
60 struct wpabuf *erp_resp,
61 const u8 *msk, size_t msk_len,
62 int *is_pub);
63 #endif /* CONFIG_FILS */
64
65 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
66 {
67 u8 *pos = eid;
68 int i, num, count;
69
70 if (hapd->iface->current_rates == NULL)
71 return eid;
72
73 *pos++ = WLAN_EID_SUPP_RATES;
74 num = hapd->iface->num_rates;
75 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
76 num++;
77 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
78 num++;
79 if (num > 8) {
80 /* rest of the rates are encoded in Extended supported
81 * rates element */
82 num = 8;
83 }
84
85 *pos++ = num;
86 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
87 i++) {
88 count++;
89 *pos = hapd->iface->current_rates[i].rate / 5;
90 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
91 *pos |= 0x80;
92 pos++;
93 }
94
95 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
96 count++;
97 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
98 }
99
100 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
101 count++;
102 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
103 }
104
105 return pos;
106 }
107
108
109 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
110 {
111 u8 *pos = eid;
112 int i, num, count;
113
114 if (hapd->iface->current_rates == NULL)
115 return eid;
116
117 num = hapd->iface->num_rates;
118 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
119 num++;
120 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
121 num++;
122 if (num <= 8)
123 return eid;
124 num -= 8;
125
126 *pos++ = WLAN_EID_EXT_SUPP_RATES;
127 *pos++ = num;
128 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
129 i++) {
130 count++;
131 if (count <= 8)
132 continue; /* already in SuppRates IE */
133 *pos = hapd->iface->current_rates[i].rate / 5;
134 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
135 *pos |= 0x80;
136 pos++;
137 }
138
139 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
140 count++;
141 if (count > 8)
142 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
143 }
144
145 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
146 count++;
147 if (count > 8)
148 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
149 }
150
151 return pos;
152 }
153
154
155 u16 hostapd_own_capab_info(struct hostapd_data *hapd)
156 {
157 int capab = WLAN_CAPABILITY_ESS;
158 int privacy;
159 int dfs;
160 int i;
161
162 /* Check if any of configured channels require DFS */
163 dfs = hostapd_is_dfs_required(hapd->iface);
164 if (dfs < 0) {
165 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
166 dfs);
167 dfs = 0;
168 }
169
170 if (hapd->iface->num_sta_no_short_preamble == 0 &&
171 hapd->iconf->preamble == SHORT_PREAMBLE)
172 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
173
174 privacy = hapd->conf->ssid.wep.keys_set;
175
176 if (hapd->conf->ieee802_1x &&
177 (hapd->conf->default_wep_key_len ||
178 hapd->conf->individual_wep_key_len))
179 privacy = 1;
180
181 if (hapd->conf->wpa)
182 privacy = 1;
183
184 #ifdef CONFIG_HS20
185 if (hapd->conf->osen)
186 privacy = 1;
187 #endif /* CONFIG_HS20 */
188
189 if (privacy)
190 capab |= WLAN_CAPABILITY_PRIVACY;
191
192 if (hapd->iface->current_mode &&
193 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
194 hapd->iface->num_sta_no_short_slot_time == 0)
195 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
196
197 /*
198 * Currently, Spectrum Management capability bit is set when directly
199 * requested in configuration by spectrum_mgmt_required or when AP is
200 * running on DFS channel.
201 * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
202 */
203 if (hapd->iface->current_mode &&
204 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
205 (hapd->iconf->spectrum_mgmt_required || dfs))
206 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
207
208 for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
209 if (hapd->conf->radio_measurements[i]) {
210 capab |= IEEE80211_CAP_RRM;
211 break;
212 }
213 }
214
215 return capab;
216 }
217
218
219 #ifndef CONFIG_NO_RC4
220 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
221 u16 auth_transaction, const u8 *challenge,
222 int iswep)
223 {
224 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
225 HOSTAPD_LEVEL_DEBUG,
226 "authentication (shared key, transaction %d)",
227 auth_transaction);
228
229 if (auth_transaction == 1) {
230 if (!sta->challenge) {
231 /* Generate a pseudo-random challenge */
232 u8 key[8];
233
234 sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
235 if (sta->challenge == NULL)
236 return WLAN_STATUS_UNSPECIFIED_FAILURE;
237
238 if (os_get_random(key, sizeof(key)) < 0) {
239 os_free(sta->challenge);
240 sta->challenge = NULL;
241 return WLAN_STATUS_UNSPECIFIED_FAILURE;
242 }
243
244 rc4_skip(key, sizeof(key), 0,
245 sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
246 }
247 return 0;
248 }
249
250 if (auth_transaction != 3)
251 return WLAN_STATUS_UNSPECIFIED_FAILURE;
252
253 /* Transaction 3 */
254 if (!iswep || !sta->challenge || !challenge ||
255 os_memcmp_const(sta->challenge, challenge,
256 WLAN_AUTH_CHALLENGE_LEN)) {
257 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
258 HOSTAPD_LEVEL_INFO,
259 "shared key authentication - invalid "
260 "challenge-response");
261 return WLAN_STATUS_CHALLENGE_FAIL;
262 }
263
264 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
265 HOSTAPD_LEVEL_DEBUG,
266 "authentication OK (shared key)");
267 sta->flags |= WLAN_STA_AUTH;
268 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
269 os_free(sta->challenge);
270 sta->challenge = NULL;
271
272 return 0;
273 }
274 #endif /* CONFIG_NO_RC4 */
275
276
277 static int send_auth_reply(struct hostapd_data *hapd,
278 const u8 *dst, const u8 *bssid,
279 u16 auth_alg, u16 auth_transaction, u16 resp,
280 const u8 *ies, size_t ies_len, const char *dbg)
281 {
282 struct ieee80211_mgmt *reply;
283 u8 *buf;
284 size_t rlen;
285 int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
286
287 rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
288 buf = os_zalloc(rlen);
289 if (buf == NULL)
290 return -1;
291
292 reply = (struct ieee80211_mgmt *) buf;
293 reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
294 WLAN_FC_STYPE_AUTH);
295 os_memcpy(reply->da, dst, ETH_ALEN);
296 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
297 os_memcpy(reply->bssid, bssid, ETH_ALEN);
298
299 reply->u.auth.auth_alg = host_to_le16(auth_alg);
300 reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
301 reply->u.auth.status_code = host_to_le16(resp);
302
303 if (ies && ies_len)
304 os_memcpy(reply->u.auth.variable, ies, ies_len);
305
306 wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
307 " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu) (dbg=%s)",
308 MAC2STR(dst), auth_alg, auth_transaction,
309 resp, (unsigned long) ies_len, dbg);
310 if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
311 wpa_printf(MSG_INFO, "send_auth_reply: send failed");
312 else
313 reply_res = WLAN_STATUS_SUCCESS;
314
315 os_free(buf);
316
317 return reply_res;
318 }
319
320
321 #ifdef CONFIG_IEEE80211R_AP
322 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
323 u16 auth_transaction, u16 status,
324 const u8 *ies, size_t ies_len)
325 {
326 struct hostapd_data *hapd = ctx;
327 struct sta_info *sta;
328 int reply_res;
329
330 reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT,
331 auth_transaction, status, ies, ies_len,
332 "auth-ft-finish");
333
334 sta = ap_get_sta(hapd, dst);
335 if (sta == NULL)
336 return;
337
338 if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
339 status != WLAN_STATUS_SUCCESS)) {
340 hostapd_drv_sta_remove(hapd, sta->addr);
341 sta->added_unassoc = 0;
342 return;
343 }
344
345 if (status != WLAN_STATUS_SUCCESS)
346 return;
347
348 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
349 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
350 sta->flags |= WLAN_STA_AUTH;
351 mlme_authenticate_indication(hapd, sta);
352 }
353 #endif /* CONFIG_IEEE80211R_AP */
354
355
356 #ifdef CONFIG_SAE
357
358 static void sae_set_state(struct sta_info *sta, enum sae_state state,
359 const char *reason)
360 {
361 wpa_printf(MSG_DEBUG, "SAE: State %s -> %s for peer " MACSTR " (%s)",
362 sae_state_txt(sta->sae->state), sae_state_txt(state),
363 MAC2STR(sta->addr), reason);
364 sta->sae->state = state;
365 }
366
367
368 static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
369 struct sta_info *sta, int update)
370 {
371 struct wpabuf *buf;
372 const char *password = NULL;
373 struct sae_password_entry *pw;
374 const char *rx_id = NULL;
375
376 if (sta->sae->tmp)
377 rx_id = sta->sae->tmp->pw_id;
378
379 for (pw = hapd->conf->sae_passwords; pw; pw = pw->next) {
380 if (!is_broadcast_ether_addr(pw->peer_addr) &&
381 os_memcmp(pw->peer_addr, sta->addr, ETH_ALEN) != 0)
382 continue;
383 if ((rx_id && !pw->identifier) || (!rx_id && pw->identifier))
384 continue;
385 if (rx_id && pw->identifier &&
386 os_strcmp(rx_id, pw->identifier) != 0)
387 continue;
388 password = pw->password;
389 break;
390 }
391 if (!password)
392 password = hapd->conf->ssid.wpa_passphrase;
393 if (!password) {
394 wpa_printf(MSG_DEBUG, "SAE: No password available");
395 return NULL;
396 }
397
398 if (update &&
399 sae_prepare_commit(hapd->own_addr, sta->addr,
400 (u8 *) password, os_strlen(password), rx_id,
401 sta->sae) < 0) {
402 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
403 return NULL;
404 }
405
406 buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN +
407 (rx_id ? 3 + os_strlen(rx_id) : 0));
408 if (buf == NULL)
409 return NULL;
410 sae_write_commit(sta->sae, buf, sta->sae->tmp ?
411 sta->sae->tmp->anti_clogging_token : NULL, rx_id);
412
413 return buf;
414 }
415
416
417 static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
418 struct sta_info *sta)
419 {
420 struct wpabuf *buf;
421
422 buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
423 if (buf == NULL)
424 return NULL;
425
426 sae_write_confirm(sta->sae, buf);
427
428 return buf;
429 }
430
431
432 static int auth_sae_send_commit(struct hostapd_data *hapd,
433 struct sta_info *sta,
434 const u8 *bssid, int update)
435 {
436 struct wpabuf *data;
437 int reply_res;
438
439 data = auth_build_sae_commit(hapd, sta, update);
440 if (!data && sta->sae->tmp && sta->sae->tmp->pw_id)
441 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER;
442 if (data == NULL)
443 return WLAN_STATUS_UNSPECIFIED_FAILURE;
444
445 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1,
446 WLAN_STATUS_SUCCESS, wpabuf_head(data),
447 wpabuf_len(data), "sae-send-commit");
448
449 wpabuf_free(data);
450
451 return reply_res;
452 }
453
454
455 static int auth_sae_send_confirm(struct hostapd_data *hapd,
456 struct sta_info *sta,
457 const u8 *bssid)
458 {
459 struct wpabuf *data;
460 int reply_res;
461
462 data = auth_build_sae_confirm(hapd, sta);
463 if (data == NULL)
464 return WLAN_STATUS_UNSPECIFIED_FAILURE;
465
466 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2,
467 WLAN_STATUS_SUCCESS, wpabuf_head(data),
468 wpabuf_len(data), "sae-send-confirm");
469
470 wpabuf_free(data);
471
472 return reply_res;
473 }
474
475
476 static int use_sae_anti_clogging(struct hostapd_data *hapd)
477 {
478 struct sta_info *sta;
479 unsigned int open = 0;
480
481 if (hapd->conf->sae_anti_clogging_threshold == 0)
482 return 1;
483
484 for (sta = hapd->sta_list; sta; sta = sta->next) {
485 if (!sta->sae)
486 continue;
487 if (sta->sae->state != SAE_COMMITTED &&
488 sta->sae->state != SAE_CONFIRMED)
489 continue;
490 open++;
491 if (open >= hapd->conf->sae_anti_clogging_threshold)
492 return 1;
493 }
494
495 return 0;
496 }
497
498
499 static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
500 const u8 *token, size_t token_len)
501 {
502 u8 mac[SHA256_MAC_LEN];
503
504 if (token_len != SHA256_MAC_LEN)
505 return -1;
506 if (hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
507 addr, ETH_ALEN, mac) < 0 ||
508 os_memcmp_const(token, mac, SHA256_MAC_LEN) != 0)
509 return -1;
510
511 return 0;
512 }
513
514
515 static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
516 int group, const u8 *addr)
517 {
518 struct wpabuf *buf;
519 u8 *token;
520 struct os_reltime now;
521
522 os_get_reltime(&now);
523 if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
524 os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60)) {
525 if (random_get_bytes(hapd->sae_token_key,
526 sizeof(hapd->sae_token_key)) < 0)
527 return NULL;
528 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
529 hapd->sae_token_key, sizeof(hapd->sae_token_key));
530 hapd->last_sae_token_key_update = now;
531 }
532
533 buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
534 if (buf == NULL)
535 return NULL;
536
537 wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
538
539 token = wpabuf_put(buf, SHA256_MAC_LEN);
540 hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
541 addr, ETH_ALEN, token);
542
543 return buf;
544 }
545
546
547 static int sae_check_big_sync(struct hostapd_data *hapd, struct sta_info *sta)
548 {
549 if (sta->sae->sync > hapd->conf->sae_sync) {
550 sae_set_state(sta, SAE_NOTHING, "Sync > dot11RSNASAESync");
551 sta->sae->sync = 0;
552 return -1;
553 }
554 return 0;
555 }
556
557
558 static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
559 {
560 struct hostapd_data *hapd = eloop_ctx;
561 struct sta_info *sta = eloop_data;
562 int ret;
563
564 if (sae_check_big_sync(hapd, sta))
565 return;
566 sta->sae->sync++;
567 wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
568 " (sync=%d state=%s)",
569 MAC2STR(sta->addr), sta->sae->sync,
570 sae_state_txt(sta->sae->state));
571
572 switch (sta->sae->state) {
573 case SAE_COMMITTED:
574 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
575 eloop_register_timeout(0,
576 hapd->dot11RSNASAERetransPeriod * 1000,
577 auth_sae_retransmit_timer, hapd, sta);
578 break;
579 case SAE_CONFIRMED:
580 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
581 eloop_register_timeout(0,
582 hapd->dot11RSNASAERetransPeriod * 1000,
583 auth_sae_retransmit_timer, hapd, sta);
584 break;
585 default:
586 ret = -1;
587 break;
588 }
589
590 if (ret != WLAN_STATUS_SUCCESS)
591 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
592 }
593
594
595 void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
596 {
597 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
598 }
599
600
601 static void sae_set_retransmit_timer(struct hostapd_data *hapd,
602 struct sta_info *sta)
603 {
604 if (!(hapd->conf->mesh & MESH_ENABLED))
605 return;
606
607 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
608 eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
609 auth_sae_retransmit_timer, hapd, sta);
610 }
611
612
613 void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
614 {
615 sta->flags |= WLAN_STA_AUTH;
616 sta->auth_alg = WLAN_AUTH_SAE;
617 mlme_authenticate_indication(hapd, sta);
618 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
619 sae_set_state(sta, SAE_ACCEPTED, "Accept Confirm");
620 wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
621 sta->sae->pmk, sta->sae->pmkid);
622 }
623
624
625 static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
626 const u8 *bssid, u8 auth_transaction)
627 {
628 int ret;
629
630 if (auth_transaction != 1 && auth_transaction != 2)
631 return WLAN_STATUS_UNSPECIFIED_FAILURE;
632
633 wpa_printf(MSG_DEBUG, "SAE: Peer " MACSTR " state=%s auth_trans=%u",
634 MAC2STR(sta->addr), sae_state_txt(sta->sae->state),
635 auth_transaction);
636 switch (sta->sae->state) {
637 case SAE_NOTHING:
638 if (auth_transaction == 1) {
639 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
640 if (ret)
641 return ret;
642 sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
643
644 if (sae_process_commit(sta->sae) < 0)
645 return WLAN_STATUS_UNSPECIFIED_FAILURE;
646
647 /*
648 * In mesh case, both Commit and Confirm can be sent
649 * immediately. In infrastructure BSS, only a single
650 * Authentication frame (Commit) is expected from the AP
651 * here and the second one (Confirm) will be sent once
652 * the STA has sent its second Authentication frame
653 * (Confirm).
654 */
655 if (hapd->conf->mesh & MESH_ENABLED) {
656 /*
657 * Send both Commit and Confirm immediately
658 * based on SAE finite state machine
659 * Nothing -> Confirm transition.
660 */
661 ret = auth_sae_send_confirm(hapd, sta, bssid);
662 if (ret)
663 return ret;
664 sae_set_state(sta, SAE_CONFIRMED,
665 "Sent Confirm (mesh)");
666 } else {
667 /*
668 * For infrastructure BSS, send only the Commit
669 * message now to get alternating sequence of
670 * Authentication frames between the AP and STA.
671 * Confirm will be sent in
672 * Committed -> Confirmed/Accepted transition
673 * when receiving Confirm from STA.
674 */
675 }
676 sta->sae->sync = 0;
677 sae_set_retransmit_timer(hapd, sta);
678 } else {
679 hostapd_logger(hapd, sta->addr,
680 HOSTAPD_MODULE_IEEE80211,
681 HOSTAPD_LEVEL_DEBUG,
682 "SAE confirm before commit");
683 }
684 break;
685 case SAE_COMMITTED:
686 sae_clear_retransmit_timer(hapd, sta);
687 if (auth_transaction == 1) {
688 if (sae_process_commit(sta->sae) < 0)
689 return WLAN_STATUS_UNSPECIFIED_FAILURE;
690
691 ret = auth_sae_send_confirm(hapd, sta, bssid);
692 if (ret)
693 return ret;
694 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
695 sta->sae->sync = 0;
696 sae_set_retransmit_timer(hapd, sta);
697 } else if (hapd->conf->mesh & MESH_ENABLED) {
698 /*
699 * In mesh case, follow SAE finite state machine and
700 * send Commit now, if sync count allows.
701 */
702 if (sae_check_big_sync(hapd, sta))
703 return WLAN_STATUS_SUCCESS;
704 sta->sae->sync++;
705
706 ret = auth_sae_send_commit(hapd, sta, bssid, 0);
707 if (ret)
708 return ret;
709
710 sae_set_retransmit_timer(hapd, sta);
711 } else {
712 /*
713 * For instructure BSS, send the postponed Confirm from
714 * Nothing -> Confirmed transition that was reduced to
715 * Nothing -> Committed above.
716 */
717 ret = auth_sae_send_confirm(hapd, sta, bssid);
718 if (ret)
719 return ret;
720
721 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
722
723 /*
724 * Since this was triggered on Confirm RX, run another
725 * step to get to Accepted without waiting for
726 * additional events.
727 */
728 return sae_sm_step(hapd, sta, bssid, auth_transaction);
729 }
730 break;
731 case SAE_CONFIRMED:
732 sae_clear_retransmit_timer(hapd, sta);
733 if (auth_transaction == 1) {
734 if (sae_check_big_sync(hapd, sta))
735 return WLAN_STATUS_SUCCESS;
736 sta->sae->sync++;
737
738 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
739 if (ret)
740 return ret;
741
742 if (sae_process_commit(sta->sae) < 0)
743 return WLAN_STATUS_UNSPECIFIED_FAILURE;
744
745 ret = auth_sae_send_confirm(hapd, sta, bssid);
746 if (ret)
747 return ret;
748
749 sae_set_retransmit_timer(hapd, sta);
750 } else {
751 sta->sae->send_confirm = 0xffff;
752 sae_accept_sta(hapd, sta);
753 }
754 break;
755 case SAE_ACCEPTED:
756 if (auth_transaction == 1 &&
757 (hapd->conf->mesh & MESH_ENABLED)) {
758 wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
759 ") doing reauthentication",
760 MAC2STR(sta->addr));
761 ap_free_sta(hapd, sta);
762 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
763 } else if (auth_transaction == 1) {
764 wpa_printf(MSG_DEBUG, "SAE: Start reauthentication");
765 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
766 if (ret)
767 return ret;
768 sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
769
770 if (sae_process_commit(sta->sae) < 0)
771 return WLAN_STATUS_UNSPECIFIED_FAILURE;
772 sta->sae->sync = 0;
773 sae_set_retransmit_timer(hapd, sta);
774 } else {
775 if (sae_check_big_sync(hapd, sta))
776 return WLAN_STATUS_SUCCESS;
777 sta->sae->sync++;
778
779 ret = auth_sae_send_confirm(hapd, sta, bssid);
780 sae_clear_temp_data(sta->sae);
781 if (ret)
782 return ret;
783 }
784 break;
785 default:
786 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
787 sta->sae->state);
788 return WLAN_STATUS_UNSPECIFIED_FAILURE;
789 }
790 return WLAN_STATUS_SUCCESS;
791 }
792
793
794 static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
795 {
796 struct sae_data *sae = sta->sae;
797 int i, *groups = hapd->conf->sae_groups;
798
799 if (sae->state != SAE_COMMITTED)
800 return;
801
802 wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
803
804 for (i = 0; groups && groups[i] > 0; i++) {
805 if (sae->group == groups[i])
806 break;
807 }
808
809 if (!groups || groups[i] <= 0) {
810 wpa_printf(MSG_DEBUG,
811 "SAE: Previously selected group not found from the current configuration");
812 return;
813 }
814
815 for (;;) {
816 i++;
817 if (groups[i] <= 0) {
818 wpa_printf(MSG_DEBUG,
819 "SAE: No alternative group enabled");
820 return;
821 }
822
823 if (sae_set_group(sae, groups[i]) < 0)
824 continue;
825
826 break;
827 }
828 wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
829 }
830
831
832 static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
833 const struct ieee80211_mgmt *mgmt, size_t len,
834 u16 auth_transaction, u16 status_code)
835 {
836 int resp = WLAN_STATUS_SUCCESS;
837 struct wpabuf *data = NULL;
838
839 #ifdef CONFIG_TESTING_OPTIONS
840 if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
841 const u8 *pos, *end;
842
843 wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
844 pos = mgmt->u.auth.variable;
845 end = ((const u8 *) mgmt) + len;
846 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
847 auth_transaction, resp, pos, end - pos,
848 "auth-sae-reflection-attack");
849 goto remove_sta;
850 }
851
852 if (hapd->conf->sae_commit_override && auth_transaction == 1) {
853 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
854 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
855 auth_transaction, resp,
856 wpabuf_head(hapd->conf->sae_commit_override),
857 wpabuf_len(hapd->conf->sae_commit_override),
858 "sae-commit-override");
859 goto remove_sta;
860 }
861 #endif /* CONFIG_TESTING_OPTIONS */
862 if (!sta->sae) {
863 if (auth_transaction != 1 ||
864 status_code != WLAN_STATUS_SUCCESS) {
865 resp = -1;
866 goto remove_sta;
867 }
868 sta->sae = os_zalloc(sizeof(*sta->sae));
869 if (!sta->sae) {
870 resp = -1;
871 goto remove_sta;
872 }
873 sae_set_state(sta, SAE_NOTHING, "Init");
874 sta->sae->sync = 0;
875 }
876
877 if (sta->mesh_sae_pmksa_caching) {
878 wpa_printf(MSG_DEBUG,
879 "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
880 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
881 sta->mesh_sae_pmksa_caching = 0;
882 }
883
884 if (auth_transaction == 1) {
885 const u8 *token = NULL, *pos, *end;
886 size_t token_len = 0;
887 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
888 HOSTAPD_LEVEL_DEBUG,
889 "start SAE authentication (RX commit, status=%u)",
890 status_code);
891
892 if ((hapd->conf->mesh & MESH_ENABLED) &&
893 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
894 sta->sae->tmp) {
895 pos = mgmt->u.auth.variable;
896 end = ((const u8 *) mgmt) + len;
897 if (pos + sizeof(le16) > end) {
898 wpa_printf(MSG_ERROR,
899 "SAE: Too short anti-clogging token request");
900 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
901 goto reply;
902 }
903 resp = sae_group_allowed(sta->sae,
904 hapd->conf->sae_groups,
905 WPA_GET_LE16(pos));
906 if (resp != WLAN_STATUS_SUCCESS) {
907 wpa_printf(MSG_ERROR,
908 "SAE: Invalid group in anti-clogging token request");
909 goto reply;
910 }
911 pos += sizeof(le16);
912
913 wpabuf_free(sta->sae->tmp->anti_clogging_token);
914 sta->sae->tmp->anti_clogging_token =
915 wpabuf_alloc_copy(pos, end - pos);
916 if (sta->sae->tmp->anti_clogging_token == NULL) {
917 wpa_printf(MSG_ERROR,
918 "SAE: Failed to alloc for anti-clogging token");
919 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
920 goto remove_sta;
921 }
922
923 /*
924 * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
925 * is 76, a new Commit Message shall be constructed
926 * with the Anti-Clogging Token from the received
927 * Authentication frame, and the commit-scalar and
928 * COMMIT-ELEMENT previously sent.
929 */
930 resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0);
931 if (resp != WLAN_STATUS_SUCCESS) {
932 wpa_printf(MSG_ERROR,
933 "SAE: Failed to send commit message");
934 goto remove_sta;
935 }
936 sae_set_state(sta, SAE_COMMITTED,
937 "Sent Commit (anti-clogging token case in mesh)");
938 sta->sae->sync = 0;
939 sae_set_retransmit_timer(hapd, sta);
940 return;
941 }
942
943 if ((hapd->conf->mesh & MESH_ENABLED) &&
944 status_code ==
945 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
946 sta->sae->tmp) {
947 wpa_printf(MSG_DEBUG,
948 "SAE: Peer did not accept our SAE group");
949 sae_pick_next_group(hapd, sta);
950 goto remove_sta;
951 }
952
953 if (status_code != WLAN_STATUS_SUCCESS)
954 goto remove_sta;
955
956 if (!(hapd->conf->mesh & MESH_ENABLED) &&
957 sta->sae->state == SAE_COMMITTED) {
958 /* This is needed in the infrastructure BSS case to
959 * address a sequence where a STA entry may remain in
960 * hostapd across two attempts to do SAE authentication
961 * by the same STA. The second attempt may end up trying
962 * to use a different group and that would not be
963 * allowed if we remain in Committed state with the
964 * previously set parameters. */
965 sae_set_state(sta, SAE_NOTHING,
966 "Clear existing state to allow restart");
967 sae_clear_data(sta->sae);
968 }
969
970 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
971 ((const u8 *) mgmt) + len -
972 mgmt->u.auth.variable, &token,
973 &token_len, hapd->conf->sae_groups);
974 if (resp == SAE_SILENTLY_DISCARD) {
975 wpa_printf(MSG_DEBUG,
976 "SAE: Drop commit message from " MACSTR " due to reflection attack",
977 MAC2STR(sta->addr));
978 goto remove_sta;
979 }
980
981 if (resp == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
982 wpa_msg(hapd->msg_ctx, MSG_INFO,
983 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER
984 MACSTR, MAC2STR(sta->addr));
985 sae_clear_retransmit_timer(hapd, sta);
986 sae_set_state(sta, SAE_NOTHING,
987 "Unknown Password Identifier");
988 goto remove_sta;
989 }
990
991 if (token && check_sae_token(hapd, sta->addr, token, token_len)
992 < 0) {
993 wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
994 "incorrect token from " MACSTR,
995 MAC2STR(sta->addr));
996 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
997 goto remove_sta;
998 }
999
1000 if (resp != WLAN_STATUS_SUCCESS)
1001 goto reply;
1002
1003 if (!token && use_sae_anti_clogging(hapd)) {
1004 wpa_printf(MSG_DEBUG,
1005 "SAE: Request anti-clogging token from "
1006 MACSTR, MAC2STR(sta->addr));
1007 data = auth_build_token_req(hapd, sta->sae->group,
1008 sta->addr);
1009 resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
1010 if (hapd->conf->mesh & MESH_ENABLED)
1011 sae_set_state(sta, SAE_NOTHING,
1012 "Request anti-clogging token case in mesh");
1013 goto reply;
1014 }
1015
1016 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
1017 } else if (auth_transaction == 2) {
1018 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1019 HOSTAPD_LEVEL_DEBUG,
1020 "SAE authentication (RX confirm, status=%u)",
1021 status_code);
1022 if (status_code != WLAN_STATUS_SUCCESS)
1023 goto remove_sta;
1024 if (sta->sae->state >= SAE_CONFIRMED ||
1025 !(hapd->conf->mesh & MESH_ENABLED)) {
1026 const u8 *var;
1027 size_t var_len;
1028 u16 peer_send_confirm;
1029
1030 var = mgmt->u.auth.variable;
1031 var_len = ((u8 *) mgmt) + len - mgmt->u.auth.variable;
1032 if (var_len < 2) {
1033 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1034 goto reply;
1035 }
1036
1037 peer_send_confirm = WPA_GET_LE16(var);
1038
1039 if (sta->sae->state == SAE_ACCEPTED &&
1040 (peer_send_confirm <= sta->sae->rc ||
1041 peer_send_confirm == 0xffff)) {
1042 wpa_printf(MSG_DEBUG,
1043 "SAE: Silently ignore unexpected Confirm from peer "
1044 MACSTR
1045 " (peer-send-confirm=%u Rc=%u)",
1046 MAC2STR(sta->addr),
1047 peer_send_confirm, sta->sae->rc);
1048 return;
1049 }
1050
1051 if (sae_check_confirm(sta->sae, var, var_len) < 0) {
1052 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1053 goto reply;
1054 }
1055 sta->sae->rc = peer_send_confirm;
1056 }
1057 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction);
1058 } else {
1059 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1060 HOSTAPD_LEVEL_DEBUG,
1061 "unexpected SAE authentication transaction %u (status=%u)",
1062 auth_transaction, status_code);
1063 if (status_code != WLAN_STATUS_SUCCESS)
1064 goto remove_sta;
1065 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1066 }
1067
1068 reply:
1069 if (resp != WLAN_STATUS_SUCCESS) {
1070 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
1071 auth_transaction, resp,
1072 data ? wpabuf_head(data) : (u8 *) "",
1073 data ? wpabuf_len(data) : 0, "auth-sae");
1074 }
1075
1076 remove_sta:
1077 if (sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
1078 status_code != WLAN_STATUS_SUCCESS)) {
1079 hostapd_drv_sta_remove(hapd, sta->addr);
1080 sta->added_unassoc = 0;
1081 }
1082 wpabuf_free(data);
1083 }
1084
1085
1086 /**
1087 * auth_sae_init_committed - Send COMMIT and start SAE in committed state
1088 * @hapd: BSS data for the device initiating the authentication
1089 * @sta: the peer to which commit authentication frame is sent
1090 *
1091 * This function implements Init event handling (IEEE Std 802.11-2012,
1092 * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
1093 * sta->sae structure should be initialized appropriately via a call to
1094 * sae_prepare_commit().
1095 */
1096 int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
1097 {
1098 int ret;
1099
1100 if (!sta->sae || !sta->sae->tmp)
1101 return -1;
1102
1103 if (sta->sae->state != SAE_NOTHING)
1104 return -1;
1105
1106 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
1107 if (ret)
1108 return -1;
1109
1110 sae_set_state(sta, SAE_COMMITTED, "Init and sent commit");
1111 sta->sae->sync = 0;
1112 sae_set_retransmit_timer(hapd, sta);
1113
1114 return 0;
1115 }
1116
1117 #endif /* CONFIG_SAE */
1118
1119
1120 static u16 wpa_res_to_status_code(int res)
1121 {
1122 if (res == WPA_INVALID_GROUP)
1123 return WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1124 if (res == WPA_INVALID_PAIRWISE)
1125 return WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1126 if (res == WPA_INVALID_AKMP)
1127 return WLAN_STATUS_AKMP_NOT_VALID;
1128 if (res == WPA_ALLOC_FAIL)
1129 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1130 #ifdef CONFIG_IEEE80211W
1131 if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1132 return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1133 if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
1134 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
1135 #endif /* CONFIG_IEEE80211W */
1136 if (res == WPA_INVALID_MDIE)
1137 return WLAN_STATUS_INVALID_MDIE;
1138 if (res == WPA_INVALID_PMKID)
1139 return WLAN_STATUS_INVALID_PMKID;
1140 if (res != WPA_IE_OK)
1141 return WLAN_STATUS_INVALID_IE;
1142 return WLAN_STATUS_SUCCESS;
1143 }
1144
1145
1146 #ifdef CONFIG_FILS
1147
1148 static void handle_auth_fils_finish(struct hostapd_data *hapd,
1149 struct sta_info *sta, u16 resp,
1150 struct wpabuf *data, int pub);
1151
1152 void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta,
1153 const u8 *pos, size_t len, u16 auth_alg,
1154 u16 auth_transaction, u16 status_code,
1155 void (*cb)(struct hostapd_data *hapd,
1156 struct sta_info *sta, u16 resp,
1157 struct wpabuf *data, int pub))
1158 {
1159 u16 resp = WLAN_STATUS_SUCCESS;
1160 const u8 *end;
1161 struct ieee802_11_elems elems;
1162 int res;
1163 struct wpa_ie_data rsn;
1164 struct rsn_pmksa_cache_entry *pmksa = NULL;
1165
1166 if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS)
1167 return;
1168
1169 end = pos + len;
1170
1171 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
1172 pos, end - pos);
1173
1174 /* TODO: FILS PK */
1175 #ifdef CONFIG_FILS_SK_PFS
1176 if (auth_alg == WLAN_AUTH_FILS_SK_PFS) {
1177 u16 group;
1178 struct wpabuf *pub;
1179 size_t elem_len;
1180
1181 /* Using FILS PFS */
1182
1183 /* Finite Cyclic Group */
1184 if (end - pos < 2) {
1185 wpa_printf(MSG_DEBUG,
1186 "FILS: No room for Finite Cyclic Group");
1187 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1188 goto fail;
1189 }
1190 group = WPA_GET_LE16(pos);
1191 pos += 2;
1192 if (group != hapd->conf->fils_dh_group) {
1193 wpa_printf(MSG_DEBUG,
1194 "FILS: Unsupported Finite Cyclic Group: %u (expected %u)",
1195 group, hapd->conf->fils_dh_group);
1196 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1197 goto fail;
1198 }
1199
1200 crypto_ecdh_deinit(sta->fils_ecdh);
1201 sta->fils_ecdh = crypto_ecdh_init(group);
1202 if (!sta->fils_ecdh) {
1203 wpa_printf(MSG_INFO,
1204 "FILS: Could not initialize ECDH with group %d",
1205 group);
1206 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1207 goto fail;
1208 }
1209
1210 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1211 if (!pub) {
1212 wpa_printf(MSG_DEBUG,
1213 "FILS: Failed to derive ECDH public key");
1214 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1215 goto fail;
1216 }
1217 elem_len = wpabuf_len(pub);
1218 wpabuf_free(pub);
1219
1220 /* Element */
1221 if ((size_t) (end - pos) < elem_len) {
1222 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
1223 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1224 goto fail;
1225 }
1226
1227 wpabuf_free(sta->fils_g_sta);
1228 sta->fils_g_sta = wpabuf_alloc_copy(pos, elem_len);
1229 wpabuf_clear_free(sta->fils_dh_ss);
1230 sta->fils_dh_ss = crypto_ecdh_set_peerkey(sta->fils_ecdh, 1,
1231 pos, elem_len);
1232 if (!sta->fils_dh_ss) {
1233 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
1234 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1235 goto fail;
1236 }
1237 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", sta->fils_dh_ss);
1238 pos += elem_len;
1239 } else {
1240 crypto_ecdh_deinit(sta->fils_ecdh);
1241 sta->fils_ecdh = NULL;
1242 wpabuf_clear_free(sta->fils_dh_ss);
1243 sta->fils_dh_ss = NULL;
1244 }
1245 #endif /* CONFIG_FILS_SK_PFS */
1246
1247 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
1248 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
1249 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
1250 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1251 goto fail;
1252 }
1253
1254 /* RSNE */
1255 wpa_hexdump(MSG_DEBUG, "FILS: RSN element",
1256 elems.rsn_ie, elems.rsn_ie_len);
1257 if (!elems.rsn_ie ||
1258 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
1259 &rsn) < 0) {
1260 wpa_printf(MSG_DEBUG, "FILS: No valid RSN element");
1261 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1262 goto fail;
1263 }
1264
1265 if (!sta->wpa_sm)
1266 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr,
1267 NULL);
1268 if (!sta->wpa_sm) {
1269 wpa_printf(MSG_DEBUG,
1270 "FILS: Failed to initialize RSN state machine");
1271 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1272 goto fail;
1273 }
1274
1275 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
1276 elems.rsn_ie - 2, elems.rsn_ie_len + 2,
1277 elems.mdie, elems.mdie_len, NULL, 0);
1278 resp = wpa_res_to_status_code(res);
1279 if (resp != WLAN_STATUS_SUCCESS)
1280 goto fail;
1281
1282 if (!elems.fils_nonce) {
1283 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
1284 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1285 goto fail;
1286 }
1287 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", elems.fils_nonce,
1288 FILS_NONCE_LEN);
1289 os_memcpy(sta->fils_snonce, elems.fils_nonce, FILS_NONCE_LEN);
1290
1291 /* PMKID List */
1292 if (rsn.pmkid && rsn.num_pmkid > 0) {
1293 u8 num;
1294 const u8 *pmkid;
1295
1296 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
1297 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
1298
1299 pmkid = rsn.pmkid;
1300 num = rsn.num_pmkid;
1301 while (num) {
1302 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
1303 pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr,
1304 pmkid);
1305 if (pmksa)
1306 break;
1307 pmksa = wpa_auth_pmksa_get_fils_cache_id(hapd->wpa_auth,
1308 sta->addr,
1309 pmkid);
1310 if (pmksa)
1311 break;
1312 pmkid += PMKID_LEN;
1313 num--;
1314 }
1315 }
1316 if (pmksa && wpa_auth_sta_key_mgmt(sta->wpa_sm) != pmksa->akmp) {
1317 wpa_printf(MSG_DEBUG,
1318 "FILS: Matching PMKSA cache entry has different AKMP (0x%x != 0x%x) - ignore",
1319 wpa_auth_sta_key_mgmt(sta->wpa_sm), pmksa->akmp);
1320 pmksa = NULL;
1321 }
1322 if (pmksa)
1323 wpa_printf(MSG_DEBUG, "FILS: Found matching PMKSA cache entry");
1324
1325 /* FILS Session */
1326 if (!elems.fils_session) {
1327 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
1328 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1329 goto fail;
1330 }
1331 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
1332 FILS_SESSION_LEN);
1333 os_memcpy(sta->fils_session, elems.fils_session, FILS_SESSION_LEN);
1334
1335 /* FILS Wrapped Data */
1336 if (elems.fils_wrapped_data) {
1337 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
1338 elems.fils_wrapped_data,
1339 elems.fils_wrapped_data_len);
1340 if (!pmksa) {
1341 #ifndef CONFIG_NO_RADIUS
1342 if (!sta->eapol_sm) {
1343 sta->eapol_sm =
1344 ieee802_1x_alloc_eapol_sm(hapd, sta);
1345 }
1346 wpa_printf(MSG_DEBUG,
1347 "FILS: Forward EAP-Initiate/Re-auth to authentication server");
1348 ieee802_1x_encapsulate_radius(
1349 hapd, sta, elems.fils_wrapped_data,
1350 elems.fils_wrapped_data_len);
1351 sta->fils_pending_cb = cb;
1352 wpa_printf(MSG_DEBUG,
1353 "FILS: Will send Authentication frame once the response from authentication server is available");
1354 sta->flags |= WLAN_STA_PENDING_FILS_ERP;
1355 /* Calculate pending PMKID here so that we do not need
1356 * to maintain a copy of the EAP-Initiate/Reauth
1357 * message. */
1358 if (fils_pmkid_erp(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1359 elems.fils_wrapped_data,
1360 elems.fils_wrapped_data_len,
1361 sta->fils_erp_pmkid) == 0)
1362 sta->fils_erp_pmkid_set = 1;
1363 return;
1364 #else /* CONFIG_NO_RADIUS */
1365 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1366 goto fail;
1367 #endif /* CONFIG_NO_RADIUS */
1368 }
1369 }
1370
1371 fail:
1372 if (cb) {
1373 struct wpabuf *data;
1374 int pub = 0;
1375
1376 data = prepare_auth_resp_fils(hapd, sta, &resp, pmksa, NULL,
1377 NULL, 0, &pub);
1378 if (!data) {
1379 wpa_printf(MSG_DEBUG,
1380 "%s: prepare_auth_resp_fils() returned failure",
1381 __func__);
1382 }
1383
1384 cb(hapd, sta, resp, data, pub);
1385 }
1386 }
1387
1388
1389 static struct wpabuf *
1390 prepare_auth_resp_fils(struct hostapd_data *hapd,
1391 struct sta_info *sta, u16 *resp,
1392 struct rsn_pmksa_cache_entry *pmksa,
1393 struct wpabuf *erp_resp,
1394 const u8 *msk, size_t msk_len,
1395 int *is_pub)
1396 {
1397 u8 fils_nonce[FILS_NONCE_LEN];
1398 size_t ielen;
1399 struct wpabuf *data = NULL;
1400 const u8 *ie;
1401 u8 *ie_buf = NULL;
1402 const u8 *pmk = NULL;
1403 size_t pmk_len = 0;
1404 u8 pmk_buf[PMK_LEN_MAX];
1405 struct wpabuf *pub = NULL;
1406
1407 if (*resp != WLAN_STATUS_SUCCESS)
1408 goto fail;
1409
1410 ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen);
1411 if (!ie) {
1412 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1413 goto fail;
1414 }
1415
1416 if (pmksa) {
1417 /* Add PMKID of the selected PMKSA into RSNE */
1418 ie_buf = os_malloc(ielen + 2 + 2 + PMKID_LEN);
1419 if (!ie_buf) {
1420 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1421 goto fail;
1422 }
1423
1424 os_memcpy(ie_buf, ie, ielen);
1425 if (wpa_insert_pmkid(ie_buf, &ielen, pmksa->pmkid) < 0) {
1426 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1427 goto fail;
1428 }
1429 ie = ie_buf;
1430 }
1431
1432 if (random_get_bytes(fils_nonce, FILS_NONCE_LEN) < 0) {
1433 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1434 goto fail;
1435 }
1436 wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS Nonce",
1437 fils_nonce, FILS_NONCE_LEN);
1438
1439 #ifdef CONFIG_FILS_SK_PFS
1440 if (sta->fils_dh_ss && sta->fils_ecdh) {
1441 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1442 if (!pub) {
1443 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1444 goto fail;
1445 }
1446 }
1447 #endif /* CONFIG_FILS_SK_PFS */
1448
1449 data = wpabuf_alloc(1000 + ielen + (pub ? wpabuf_len(pub) : 0));
1450 if (!data) {
1451 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1452 goto fail;
1453 }
1454
1455 /* TODO: FILS PK */
1456 #ifdef CONFIG_FILS_SK_PFS
1457 if (pub) {
1458 /* Finite Cyclic Group */
1459 wpabuf_put_le16(data, hapd->conf->fils_dh_group);
1460
1461 /* Element */
1462 wpabuf_put_buf(data, pub);
1463 }
1464 #endif /* CONFIG_FILS_SK_PFS */
1465
1466 /* RSNE */
1467 wpabuf_put_data(data, ie, ielen);
1468
1469 /* MDE when using FILS+FT (already included in ie,ielen with RSNE) */
1470
1471 #ifdef CONFIG_IEEE80211R_AP
1472 if (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm))) {
1473 /* FTE[R1KH-ID,R0KH-ID] when using FILS+FT */
1474 int res;
1475 int use_sha384 = wpa_key_mgmt_sha384(
1476 wpa_auth_sta_key_mgmt(sta->wpa_sm));
1477
1478 res = wpa_auth_write_fte(hapd->wpa_auth, use_sha384,
1479 wpabuf_put(data, 0),
1480 wpabuf_tailroom(data));
1481 if (res < 0) {
1482 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1483 goto fail;
1484 }
1485 wpabuf_put(data, res);
1486 }
1487 #endif /* CONFIG_IEEE80211R_AP */
1488
1489 /* FILS Nonce */
1490 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1491 wpabuf_put_u8(data, 1 + FILS_NONCE_LEN); /* Length */
1492 /* Element ID Extension */
1493 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_NONCE);
1494 wpabuf_put_data(data, fils_nonce, FILS_NONCE_LEN);
1495
1496 /* FILS Session */
1497 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1498 wpabuf_put_u8(data, 1 + FILS_SESSION_LEN); /* Length */
1499 /* Element ID Extension */
1500 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_SESSION);
1501 wpabuf_put_data(data, sta->fils_session, FILS_SESSION_LEN);
1502
1503 /* FILS Wrapped Data */
1504 if (!pmksa && erp_resp) {
1505 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1506 wpabuf_put_u8(data, 1 + wpabuf_len(erp_resp)); /* Length */
1507 /* Element ID Extension */
1508 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_WRAPPED_DATA);
1509 wpabuf_put_buf(data, erp_resp);
1510
1511 if (fils_rmsk_to_pmk(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1512 msk, msk_len, sta->fils_snonce, fils_nonce,
1513 sta->fils_dh_ss ?
1514 wpabuf_head(sta->fils_dh_ss) : NULL,
1515 sta->fils_dh_ss ?
1516 wpabuf_len(sta->fils_dh_ss) : 0,
1517 pmk_buf, &pmk_len)) {
1518 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK");
1519 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1520 wpabuf_free(data);
1521 data = NULL;
1522 goto fail;
1523 }
1524 pmk = pmk_buf;
1525
1526 /* Don't use DHss in PTK derivation if PMKSA caching is not
1527 * used. */
1528 wpabuf_clear_free(sta->fils_dh_ss);
1529 sta->fils_dh_ss = NULL;
1530
1531 if (sta->fils_erp_pmkid_set) {
1532 /* TODO: get PMKLifetime from WPA parameters */
1533 unsigned int dot11RSNAConfigPMKLifetime = 43200;
1534 int session_timeout;
1535
1536 session_timeout = dot11RSNAConfigPMKLifetime;
1537 if (sta->session_timeout_set) {
1538 struct os_reltime now, diff;
1539
1540 os_get_reltime(&now);
1541 os_reltime_sub(&sta->session_timeout, &now,
1542 &diff);
1543 session_timeout = diff.sec;
1544 }
1545
1546 sta->fils_erp_pmkid_set = 0;
1547 if (wpa_auth_pmksa_add2(
1548 hapd->wpa_auth, sta->addr,
1549 pmk, pmk_len,
1550 sta->fils_erp_pmkid,
1551 session_timeout,
1552 wpa_auth_sta_key_mgmt(sta->wpa_sm)) < 0) {
1553 wpa_printf(MSG_ERROR,
1554 "FILS: Failed to add PMKSA cache entry based on ERP");
1555 }
1556 }
1557 } else if (pmksa) {
1558 pmk = pmksa->pmk;
1559 pmk_len = pmksa->pmk_len;
1560 }
1561
1562 if (!pmk) {
1563 wpa_printf(MSG_DEBUG, "FILS: No PMK available");
1564 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1565 wpabuf_free(data);
1566 data = NULL;
1567 goto fail;
1568 }
1569
1570 if (fils_auth_pmk_to_ptk(sta->wpa_sm, pmk, pmk_len,
1571 sta->fils_snonce, fils_nonce,
1572 sta->fils_dh_ss ?
1573 wpabuf_head(sta->fils_dh_ss) : NULL,
1574 sta->fils_dh_ss ?
1575 wpabuf_len(sta->fils_dh_ss) : 0,
1576 sta->fils_g_sta, pub) < 0) {
1577 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1578 wpabuf_free(data);
1579 data = NULL;
1580 goto fail;
1581 }
1582
1583 fail:
1584 if (is_pub)
1585 *is_pub = pub != NULL;
1586 os_free(ie_buf);
1587 wpabuf_free(pub);
1588 wpabuf_clear_free(sta->fils_dh_ss);
1589 sta->fils_dh_ss = NULL;
1590 #ifdef CONFIG_FILS_SK_PFS
1591 crypto_ecdh_deinit(sta->fils_ecdh);
1592 sta->fils_ecdh = NULL;
1593 #endif /* CONFIG_FILS_SK_PFS */
1594 return data;
1595 }
1596
1597
1598 static void handle_auth_fils_finish(struct hostapd_data *hapd,
1599 struct sta_info *sta, u16 resp,
1600 struct wpabuf *data, int pub)
1601 {
1602 u16 auth_alg;
1603
1604 auth_alg = (pub ||
1605 resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) ?
1606 WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
1607 send_auth_reply(hapd, sta->addr, hapd->own_addr, auth_alg, 2, resp,
1608 data ? wpabuf_head(data) : (u8 *) "",
1609 data ? wpabuf_len(data) : 0, "auth-fils-finish");
1610 wpabuf_free(data);
1611
1612 if (resp == WLAN_STATUS_SUCCESS) {
1613 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1614 HOSTAPD_LEVEL_DEBUG,
1615 "authentication OK (FILS)");
1616 sta->flags |= WLAN_STA_AUTH;
1617 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1618 sta->auth_alg = pub ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
1619 mlme_authenticate_indication(hapd, sta);
1620 }
1621 }
1622
1623
1624 void ieee802_11_finish_fils_auth(struct hostapd_data *hapd,
1625 struct sta_info *sta, int success,
1626 struct wpabuf *erp_resp,
1627 const u8 *msk, size_t msk_len)
1628 {
1629 struct wpabuf *data;
1630 int pub = 0;
1631 u16 resp;
1632
1633 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
1634
1635 if (!sta->fils_pending_cb)
1636 return;
1637 resp = success ? WLAN_STATUS_SUCCESS : WLAN_STATUS_UNSPECIFIED_FAILURE;
1638 data = prepare_auth_resp_fils(hapd, sta, &resp, NULL, erp_resp,
1639 msk, msk_len, &pub);
1640 if (!data) {
1641 wpa_printf(MSG_DEBUG,
1642 "%s: prepare_auth_resp_fils() returned failure",
1643 __func__);
1644 }
1645 sta->fils_pending_cb(hapd, sta, resp, data, pub);
1646 }
1647
1648 #endif /* CONFIG_FILS */
1649
1650
1651 int
1652 ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr,
1653 const u8 *msg, size_t len, u32 *session_timeout,
1654 u32 *acct_interim_interval,
1655 struct vlan_description *vlan_id,
1656 struct hostapd_sta_wpa_psk_short **psk,
1657 char **identity, char **radius_cui, int is_probe_req)
1658 {
1659 int res;
1660
1661 os_memset(vlan_id, 0, sizeof(*vlan_id));
1662 res = hostapd_allowed_address(hapd, addr, msg, len,
1663 session_timeout, acct_interim_interval,
1664 vlan_id, psk, identity, radius_cui,
1665 is_probe_req);
1666
1667 if (res == HOSTAPD_ACL_REJECT) {
1668 if (!is_probe_req)
1669 wpa_printf(MSG_DEBUG,
1670 "Station " MACSTR
1671 " not allowed to authenticate",
1672 MAC2STR(addr));
1673 return HOSTAPD_ACL_REJECT;
1674 }
1675
1676 if (res == HOSTAPD_ACL_PENDING) {
1677 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
1678 " waiting for an external authentication",
1679 MAC2STR(addr));
1680 /* Authentication code will re-send the authentication frame
1681 * after it has received (and cached) information from the
1682 * external source. */
1683 return HOSTAPD_ACL_PENDING;
1684 }
1685
1686 return res;
1687 }
1688
1689
1690 static int
1691 ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
1692 int res, u32 session_timeout,
1693 u32 acct_interim_interval,
1694 struct vlan_description *vlan_id,
1695 struct hostapd_sta_wpa_psk_short **psk,
1696 char **identity, char **radius_cui)
1697 {
1698 if (vlan_id->notempty &&
1699 !hostapd_vlan_valid(hapd->conf->vlan, vlan_id)) {
1700 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1701 HOSTAPD_LEVEL_INFO,
1702 "Invalid VLAN %d%s received from RADIUS server",
1703 vlan_id->untagged,
1704 vlan_id->tagged[0] ? "+" : "");
1705 return -1;
1706 }
1707 if (ap_sta_set_vlan(hapd, sta, vlan_id) < 0)
1708 return -1;
1709 if (sta->vlan_id)
1710 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1711 HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1712
1713 hostapd_free_psk_list(sta->psk);
1714 if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1715 sta->psk = *psk;
1716 *psk = NULL;
1717 } else {
1718 sta->psk = NULL;
1719 }
1720
1721 os_free(sta->identity);
1722 sta->identity = *identity;
1723 *identity = NULL;
1724
1725 os_free(sta->radius_cui);
1726 sta->radius_cui = *radius_cui;
1727 *radius_cui = NULL;
1728
1729 if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
1730 sta->acct_interim_interval = acct_interim_interval;
1731 if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT) {
1732 sta->session_timeout_set = 1;
1733 os_get_reltime(&sta->session_timeout);
1734 sta->session_timeout.sec += session_timeout;
1735 ap_sta_session_timeout(hapd, sta, session_timeout);
1736 } else {
1737 sta->session_timeout_set = 0;
1738 ap_sta_no_session_timeout(hapd, sta);
1739 }
1740
1741 return 0;
1742 }
1743
1744
1745 static void handle_auth(struct hostapd_data *hapd,
1746 const struct ieee80211_mgmt *mgmt, size_t len)
1747 {
1748 u16 auth_alg, auth_transaction, status_code;
1749 u16 resp = WLAN_STATUS_SUCCESS;
1750 struct sta_info *sta = NULL;
1751 int res, reply_res;
1752 u16 fc;
1753 const u8 *challenge = NULL;
1754 u32 session_timeout, acct_interim_interval;
1755 struct vlan_description vlan_id;
1756 struct hostapd_sta_wpa_psk_short *psk = NULL;
1757 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
1758 size_t resp_ies_len = 0;
1759 char *identity = NULL;
1760 char *radius_cui = NULL;
1761 u16 seq_ctrl;
1762
1763 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1764 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
1765 (unsigned long) len);
1766 return;
1767 }
1768
1769 #ifdef CONFIG_TESTING_OPTIONS
1770 if (hapd->iconf->ignore_auth_probability > 0.0 &&
1771 drand48() < hapd->iconf->ignore_auth_probability) {
1772 wpa_printf(MSG_INFO,
1773 "TESTING: ignoring auth frame from " MACSTR,
1774 MAC2STR(mgmt->sa));
1775 return;
1776 }
1777 #endif /* CONFIG_TESTING_OPTIONS */
1778
1779 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1780 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1781 status_code = le_to_host16(mgmt->u.auth.status_code);
1782 fc = le_to_host16(mgmt->frame_control);
1783 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
1784
1785 if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
1786 2 + WLAN_AUTH_CHALLENGE_LEN &&
1787 mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
1788 mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
1789 challenge = &mgmt->u.auth.variable[2];
1790
1791 wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
1792 "auth_transaction=%d status_code=%d wep=%d%s "
1793 "seq_ctrl=0x%x%s",
1794 MAC2STR(mgmt->sa), auth_alg, auth_transaction,
1795 status_code, !!(fc & WLAN_FC_ISWEP),
1796 challenge ? " challenge" : "",
1797 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
1798
1799 #ifdef CONFIG_NO_RC4
1800 if (auth_alg == WLAN_AUTH_SHARED_KEY) {
1801 wpa_printf(MSG_INFO,
1802 "Unsupported authentication algorithm (%d)",
1803 auth_alg);
1804 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1805 goto fail;
1806 }
1807 #endif /* CONFIG_NO_RC4 */
1808
1809 if (hapd->tkip_countermeasures) {
1810 wpa_printf(MSG_DEBUG,
1811 "Ongoing TKIP countermeasures (Michael MIC failure) - reject authentication");
1812 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1813 goto fail;
1814 }
1815
1816 if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
1817 auth_alg == WLAN_AUTH_OPEN) ||
1818 #ifdef CONFIG_IEEE80211R_AP
1819 (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
1820 auth_alg == WLAN_AUTH_FT) ||
1821 #endif /* CONFIG_IEEE80211R_AP */
1822 #ifdef CONFIG_SAE
1823 (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1824 auth_alg == WLAN_AUTH_SAE) ||
1825 #endif /* CONFIG_SAE */
1826 #ifdef CONFIG_FILS
1827 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
1828 auth_alg == WLAN_AUTH_FILS_SK) ||
1829 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
1830 hapd->conf->fils_dh_group &&
1831 auth_alg == WLAN_AUTH_FILS_SK_PFS) ||
1832 #endif /* CONFIG_FILS */
1833 ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
1834 auth_alg == WLAN_AUTH_SHARED_KEY))) {
1835 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
1836 auth_alg);
1837 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
1838 goto fail;
1839 }
1840
1841 if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
1842 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
1843 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
1844 auth_transaction);
1845 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1846 goto fail;
1847 }
1848
1849 if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
1850 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
1851 MAC2STR(mgmt->sa));
1852 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1853 goto fail;
1854 }
1855
1856 if (hapd->conf->no_auth_if_seen_on) {
1857 struct hostapd_data *other;
1858
1859 other = sta_track_seen_on(hapd->iface, mgmt->sa,
1860 hapd->conf->no_auth_if_seen_on);
1861 if (other) {
1862 u8 *pos;
1863 u32 info;
1864 u8 op_class, channel, phytype;
1865
1866 wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
1867 MACSTR " since STA has been seen on %s",
1868 hapd->conf->iface, MAC2STR(mgmt->sa),
1869 hapd->conf->no_auth_if_seen_on);
1870
1871 resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
1872 pos = &resp_ies[0];
1873 *pos++ = WLAN_EID_NEIGHBOR_REPORT;
1874 *pos++ = 13;
1875 os_memcpy(pos, other->own_addr, ETH_ALEN);
1876 pos += ETH_ALEN;
1877 info = 0; /* TODO: BSSID Information */
1878 WPA_PUT_LE32(pos, info);
1879 pos += 4;
1880 if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
1881 phytype = 8; /* dmg */
1882 else if (other->iconf->ieee80211ac)
1883 phytype = 9; /* vht */
1884 else if (other->iconf->ieee80211n)
1885 phytype = 7; /* ht */
1886 else if (other->iconf->hw_mode ==
1887 HOSTAPD_MODE_IEEE80211A)
1888 phytype = 4; /* ofdm */
1889 else if (other->iconf->hw_mode ==
1890 HOSTAPD_MODE_IEEE80211G)
1891 phytype = 6; /* erp */
1892 else
1893 phytype = 5; /* hrdsss */
1894 if (ieee80211_freq_to_channel_ext(
1895 hostapd_hw_get_freq(other,
1896 other->iconf->channel),
1897 other->iconf->secondary_channel,
1898 other->iconf->ieee80211ac,
1899 &op_class, &channel) == NUM_HOSTAPD_MODES) {
1900 op_class = 0;
1901 channel = other->iconf->channel;
1902 }
1903 *pos++ = op_class;
1904 *pos++ = channel;
1905 *pos++ = phytype;
1906 resp_ies_len = pos - &resp_ies[0];
1907 goto fail;
1908 }
1909 }
1910
1911 res = ieee802_11_allowed_address(
1912 hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout,
1913 &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui,
1914 0);
1915 if (res == HOSTAPD_ACL_REJECT) {
1916 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1917 "Ignore Authentication frame from " MACSTR
1918 " due to ACL reject", MAC2STR(mgmt->sa));
1919 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1920 goto fail;
1921 }
1922 if (res == HOSTAPD_ACL_PENDING)
1923 return;
1924
1925 sta = ap_get_sta(hapd, mgmt->sa);
1926 if (sta) {
1927 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
1928 if ((fc & WLAN_FC_RETRY) &&
1929 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
1930 sta->last_seq_ctrl == seq_ctrl &&
1931 sta->last_subtype == WLAN_FC_STYPE_AUTH) {
1932 hostapd_logger(hapd, sta->addr,
1933 HOSTAPD_MODULE_IEEE80211,
1934 HOSTAPD_LEVEL_DEBUG,
1935 "Drop repeated authentication frame seq_ctrl=0x%x",
1936 seq_ctrl);
1937 return;
1938 }
1939 #ifdef CONFIG_MESH
1940 if ((hapd->conf->mesh & MESH_ENABLED) &&
1941 sta->plink_state == PLINK_BLOCKED) {
1942 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1943 " is blocked - drop Authentication frame",
1944 MAC2STR(mgmt->sa));
1945 return;
1946 }
1947 #endif /* CONFIG_MESH */
1948 } else {
1949 #ifdef CONFIG_MESH
1950 if (hapd->conf->mesh & MESH_ENABLED) {
1951 /* if the mesh peer is not available, we don't do auth.
1952 */
1953 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
1954 " not yet known - drop Authentication frame",
1955 MAC2STR(mgmt->sa));
1956 /*
1957 * Save a copy of the frame so that it can be processed
1958 * if a new peer entry is added shortly after this.
1959 */
1960 wpabuf_free(hapd->mesh_pending_auth);
1961 hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
1962 os_get_reltime(&hapd->mesh_pending_auth_time);
1963 return;
1964 }
1965 #endif /* CONFIG_MESH */
1966
1967 sta = ap_sta_add(hapd, mgmt->sa);
1968 if (!sta) {
1969 wpa_printf(MSG_DEBUG, "ap_sta_add() failed");
1970 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
1971 goto fail;
1972 }
1973 }
1974 sta->last_seq_ctrl = seq_ctrl;
1975 sta->last_subtype = WLAN_FC_STYPE_AUTH;
1976
1977 res = ieee802_11_set_radius_info(
1978 hapd, sta, res, session_timeout, acct_interim_interval,
1979 &vlan_id, &psk, &identity, &radius_cui);
1980 if (res) {
1981 wpa_printf(MSG_DEBUG, "ieee802_11_set_radius_info() failed");
1982 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1983 goto fail;
1984 }
1985
1986 sta->flags &= ~WLAN_STA_PREAUTH;
1987 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
1988
1989 /*
1990 * If the driver supports full AP client state, add a station to the
1991 * driver before sending authentication reply to make sure the driver
1992 * has resources, and not to go through the entire authentication and
1993 * association handshake, and fail it at the end.
1994 *
1995 * If this is not the first transaction, in a multi-step authentication
1996 * algorithm, the station already exists in the driver
1997 * (sta->added_unassoc = 1) so skip it.
1998 *
1999 * In mesh mode, the station was already added to the driver when the
2000 * NEW_PEER_CANDIDATE event is received.
2001 *
2002 * If PMF was negotiated for the existing association, skip this to
2003 * avoid dropping the STA entry and the associated keys. This is needed
2004 * to allow the original connection work until the attempt can complete
2005 * (re)association, so that unprotected Authentication frame cannot be
2006 * used to bypass PMF protection.
2007 */
2008 if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
2009 (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) &&
2010 !(hapd->conf->mesh & MESH_ENABLED) &&
2011 !(sta->added_unassoc)) {
2012 /*
2013 * If a station that is already associated to the AP, is trying
2014 * to authenticate again, remove the STA entry, in order to make
2015 * sure the STA PS state gets cleared and configuration gets
2016 * updated. To handle this, station's added_unassoc flag is
2017 * cleared once the station has completed association.
2018 */
2019 ap_sta_set_authorized(hapd, sta, 0);
2020 hostapd_drv_sta_remove(hapd, sta->addr);
2021 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
2022 WLAN_STA_AUTHORIZED);
2023
2024 if (hostapd_sta_add(hapd, sta->addr, 0, 0, NULL, 0, 0,
2025 NULL, NULL, sta->flags, 0, 0, 0, 0)) {
2026 hostapd_logger(hapd, sta->addr,
2027 HOSTAPD_MODULE_IEEE80211,
2028 HOSTAPD_LEVEL_NOTICE,
2029 "Could not add STA to kernel driver");
2030 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2031 goto fail;
2032 }
2033
2034 sta->added_unassoc = 1;
2035 }
2036
2037 switch (auth_alg) {
2038 case WLAN_AUTH_OPEN:
2039 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2040 HOSTAPD_LEVEL_DEBUG,
2041 "authentication OK (open system)");
2042 sta->flags |= WLAN_STA_AUTH;
2043 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
2044 sta->auth_alg = WLAN_AUTH_OPEN;
2045 mlme_authenticate_indication(hapd, sta);
2046 break;
2047 #ifndef CONFIG_NO_RC4
2048 case WLAN_AUTH_SHARED_KEY:
2049 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
2050 fc & WLAN_FC_ISWEP);
2051 if (resp != 0)
2052 wpa_printf(MSG_DEBUG,
2053 "auth_shared_key() failed: status=%d", resp);
2054 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
2055 mlme_authenticate_indication(hapd, sta);
2056 if (sta->challenge && auth_transaction == 1) {
2057 resp_ies[0] = WLAN_EID_CHALLENGE;
2058 resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
2059 os_memcpy(resp_ies + 2, sta->challenge,
2060 WLAN_AUTH_CHALLENGE_LEN);
2061 resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
2062 }
2063 break;
2064 #endif /* CONFIG_NO_RC4 */
2065 #ifdef CONFIG_IEEE80211R_AP
2066 case WLAN_AUTH_FT:
2067 sta->auth_alg = WLAN_AUTH_FT;
2068 if (sta->wpa_sm == NULL)
2069 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
2070 sta->addr, NULL);
2071 if (sta->wpa_sm == NULL) {
2072 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
2073 "state machine");
2074 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2075 goto fail;
2076 }
2077 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
2078 auth_transaction, mgmt->u.auth.variable,
2079 len - IEEE80211_HDRLEN -
2080 sizeof(mgmt->u.auth),
2081 handle_auth_ft_finish, hapd);
2082 /* handle_auth_ft_finish() callback will complete auth. */
2083 return;
2084 #endif /* CONFIG_IEEE80211R_AP */
2085 #ifdef CONFIG_SAE
2086 case WLAN_AUTH_SAE:
2087 #ifdef CONFIG_MESH
2088 if (status_code == WLAN_STATUS_SUCCESS &&
2089 hapd->conf->mesh & MESH_ENABLED) {
2090 if (sta->wpa_sm == NULL)
2091 sta->wpa_sm =
2092 wpa_auth_sta_init(hapd->wpa_auth,
2093 sta->addr, NULL);
2094 if (sta->wpa_sm == NULL) {
2095 wpa_printf(MSG_DEBUG,
2096 "SAE: Failed to initialize WPA state machine");
2097 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2098 goto fail;
2099 }
2100 }
2101 #endif /* CONFIG_MESH */
2102 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
2103 status_code);
2104 return;
2105 #endif /* CONFIG_SAE */
2106 #ifdef CONFIG_FILS
2107 case WLAN_AUTH_FILS_SK:
2108 case WLAN_AUTH_FILS_SK_PFS:
2109 handle_auth_fils(hapd, sta, mgmt->u.auth.variable,
2110 len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth),
2111 auth_alg, auth_transaction, status_code,
2112 handle_auth_fils_finish);
2113 return;
2114 #endif /* CONFIG_FILS */
2115 }
2116
2117 fail:
2118 os_free(identity);
2119 os_free(radius_cui);
2120 hostapd_free_psk_list(psk);
2121
2122 reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
2123 auth_transaction + 1, resp, resp_ies,
2124 resp_ies_len, "handle-auth");
2125
2126 if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
2127 reply_res != WLAN_STATUS_SUCCESS)) {
2128 hostapd_drv_sta_remove(hapd, sta->addr);
2129 sta->added_unassoc = 0;
2130 }
2131 }
2132
2133
2134 int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
2135 {
2136 int i, j = 32, aid;
2137
2138 /* get a unique AID */
2139 if (sta->aid > 0) {
2140 wpa_printf(MSG_DEBUG, " old AID %d", sta->aid);
2141 return 0;
2142 }
2143
2144 if (TEST_FAIL())
2145 return -1;
2146
2147 for (i = 0; i < AID_WORDS; i++) {
2148 if (hapd->sta_aid[i] == (u32) -1)
2149 continue;
2150 for (j = 0; j < 32; j++) {
2151 if (!(hapd->sta_aid[i] & BIT(j)))
2152 break;
2153 }
2154 if (j < 32)
2155 break;
2156 }
2157 if (j == 32)
2158 return -1;
2159 aid = i * 32 + j + 1;
2160 if (aid > 2007)
2161 return -1;
2162
2163 sta->aid = aid;
2164 hapd->sta_aid[i] |= BIT(j);
2165 wpa_printf(MSG_DEBUG, " new AID %d", sta->aid);
2166 return 0;
2167 }
2168
2169
2170 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
2171 const u8 *ssid_ie, size_t ssid_ie_len)
2172 {
2173 if (ssid_ie == NULL)
2174 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2175
2176 if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
2177 os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
2178 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2179 HOSTAPD_LEVEL_INFO,
2180 "Station tried to associate with unknown SSID "
2181 "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
2182 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2183 }
2184
2185 return WLAN_STATUS_SUCCESS;
2186 }
2187
2188
2189 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
2190 const u8 *wmm_ie, size_t wmm_ie_len)
2191 {
2192 sta->flags &= ~WLAN_STA_WMM;
2193 sta->qosinfo = 0;
2194 if (wmm_ie && hapd->conf->wmm_enabled) {
2195 struct wmm_information_element *wmm;
2196
2197 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
2198 hostapd_logger(hapd, sta->addr,
2199 HOSTAPD_MODULE_WPA,
2200 HOSTAPD_LEVEL_DEBUG,
2201 "invalid WMM element in association "
2202 "request");
2203 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2204 }
2205
2206 sta->flags |= WLAN_STA_WMM;
2207 wmm = (struct wmm_information_element *) wmm_ie;
2208 sta->qosinfo = wmm->qos_info;
2209 }
2210 return WLAN_STATUS_SUCCESS;
2211 }
2212
2213
2214 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
2215 struct ieee802_11_elems *elems)
2216 {
2217 /* Supported rates not used in IEEE 802.11ad/DMG */
2218 if (hapd->iface->current_mode &&
2219 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD)
2220 return WLAN_STATUS_SUCCESS;
2221
2222 if (!elems->supp_rates) {
2223 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2224 HOSTAPD_LEVEL_DEBUG,
2225 "No supported rates element in AssocReq");
2226 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2227 }
2228
2229 if (elems->supp_rates_len + elems->ext_supp_rates_len >
2230 sizeof(sta->supported_rates)) {
2231 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2232 HOSTAPD_LEVEL_DEBUG,
2233 "Invalid supported rates element length %d+%d",
2234 elems->supp_rates_len,
2235 elems->ext_supp_rates_len);
2236 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2237 }
2238
2239 sta->supported_rates_len = merge_byte_arrays(
2240 sta->supported_rates, sizeof(sta->supported_rates),
2241 elems->supp_rates, elems->supp_rates_len,
2242 elems->ext_supp_rates, elems->ext_supp_rates_len);
2243
2244 return WLAN_STATUS_SUCCESS;
2245 }
2246
2247
2248 static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
2249 const u8 *ext_capab_ie, size_t ext_capab_ie_len)
2250 {
2251 #ifdef CONFIG_INTERWORKING
2252 /* check for QoS Map support */
2253 if (ext_capab_ie_len >= 5) {
2254 if (ext_capab_ie[4] & 0x01)
2255 sta->qos_map_enabled = 1;
2256 }
2257 #endif /* CONFIG_INTERWORKING */
2258
2259 if (ext_capab_ie_len > 0) {
2260 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
2261 os_free(sta->ext_capability);
2262 sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
2263 if (sta->ext_capability) {
2264 sta->ext_capability[0] = ext_capab_ie_len;
2265 os_memcpy(sta->ext_capability + 1, ext_capab_ie,
2266 ext_capab_ie_len);
2267 }
2268 }
2269
2270 return WLAN_STATUS_SUCCESS;
2271 }
2272
2273
2274 #ifdef CONFIG_OWE
2275
2276 static int owe_group_supported(struct hostapd_data *hapd, u16 group)
2277 {
2278 int i;
2279 int *groups = hapd->conf->owe_groups;
2280
2281 if (group != 19 && group != 20 && group != 21)
2282 return 0;
2283
2284 if (!groups)
2285 return 1;
2286
2287 for (i = 0; groups[i] > 0; i++) {
2288 if (groups[i] == group)
2289 return 1;
2290 }
2291
2292 return 0;
2293 }
2294
2295
2296 static u16 owe_process_assoc_req(struct hostapd_data *hapd,
2297 struct sta_info *sta, const u8 *owe_dh,
2298 u8 owe_dh_len)
2299 {
2300 struct wpabuf *secret, *pub, *hkey;
2301 int res;
2302 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
2303 const char *info = "OWE Key Generation";
2304 const u8 *addr[2];
2305 size_t len[2];
2306 u16 group;
2307 size_t hash_len, prime_len;
2308
2309 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
2310 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
2311 return WLAN_STATUS_SUCCESS;
2312 }
2313
2314 group = WPA_GET_LE16(owe_dh);
2315 if (!owe_group_supported(hapd, group)) {
2316 wpa_printf(MSG_DEBUG, "OWE: Unsupported DH group %u", group);
2317 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2318 }
2319 if (group == 19)
2320 prime_len = 32;
2321 else if (group == 20)
2322 prime_len = 48;
2323 else if (group == 21)
2324 prime_len = 66;
2325 else
2326 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2327
2328 crypto_ecdh_deinit(sta->owe_ecdh);
2329 sta->owe_ecdh = crypto_ecdh_init(group);
2330 if (!sta->owe_ecdh)
2331 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2332 sta->owe_group = group;
2333
2334 secret = crypto_ecdh_set_peerkey(sta->owe_ecdh, 0, owe_dh + 2,
2335 owe_dh_len - 2);
2336 secret = wpabuf_zeropad(secret, prime_len);
2337 if (!secret) {
2338 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
2339 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2340 }
2341 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
2342
2343 /* prk = HKDF-extract(C | A | group, z) */
2344
2345 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
2346 if (!pub) {
2347 wpabuf_clear_free(secret);
2348 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2349 }
2350
2351 /* PMKID = Truncate-128(Hash(C | A)) */
2352 addr[0] = owe_dh + 2;
2353 len[0] = owe_dh_len - 2;
2354 addr[1] = wpabuf_head(pub);
2355 len[1] = wpabuf_len(pub);
2356 if (group == 19) {
2357 res = sha256_vector(2, addr, len, pmkid);
2358 hash_len = SHA256_MAC_LEN;
2359 } else if (group == 20) {
2360 res = sha384_vector(2, addr, len, pmkid);
2361 hash_len = SHA384_MAC_LEN;
2362 } else if (group == 21) {
2363 res = sha512_vector(2, addr, len, pmkid);
2364 hash_len = SHA512_MAC_LEN;
2365 } else {
2366 wpabuf_free(pub);
2367 wpabuf_clear_free(secret);
2368 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2369 }
2370 pub = wpabuf_zeropad(pub, prime_len);
2371 if (res < 0 || !pub) {
2372 wpabuf_free(pub);
2373 wpabuf_clear_free(secret);
2374 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2375 }
2376
2377 hkey = wpabuf_alloc(owe_dh_len - 2 + wpabuf_len(pub) + 2);
2378 if (!hkey) {
2379 wpabuf_free(pub);
2380 wpabuf_clear_free(secret);
2381 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2382 }
2383
2384 wpabuf_put_data(hkey, owe_dh + 2, owe_dh_len - 2); /* C */
2385 wpabuf_put_buf(hkey, pub); /* A */
2386 wpabuf_free(pub);
2387 wpabuf_put_le16(hkey, group); /* group */
2388 if (group == 19)
2389 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
2390 wpabuf_head(secret), wpabuf_len(secret), prk);
2391 else if (group == 20)
2392 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
2393 wpabuf_head(secret), wpabuf_len(secret), prk);
2394 else if (group == 21)
2395 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
2396 wpabuf_head(secret), wpabuf_len(secret), prk);
2397 wpabuf_clear_free(hkey);
2398 wpabuf_clear_free(secret);
2399 if (res < 0)
2400 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2401
2402 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
2403
2404 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
2405
2406 os_free(sta->owe_pmk);
2407 sta->owe_pmk = os_malloc(hash_len);
2408 if (!sta->owe_pmk) {
2409 os_memset(prk, 0, SHA512_MAC_LEN);
2410 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2411 }
2412
2413 if (group == 19)
2414 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
2415 os_strlen(info), sta->owe_pmk, hash_len);
2416 else if (group == 20)
2417 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
2418 os_strlen(info), sta->owe_pmk, hash_len);
2419 else if (group == 21)
2420 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
2421 os_strlen(info), sta->owe_pmk, hash_len);
2422 os_memset(prk, 0, SHA512_MAC_LEN);
2423 if (res < 0) {
2424 os_free(sta->owe_pmk);
2425 sta->owe_pmk = NULL;
2426 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2427 }
2428 sta->owe_pmk_len = hash_len;
2429
2430 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sta->owe_pmk, sta->owe_pmk_len);
2431 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
2432 wpa_auth_pmksa_add2(hapd->wpa_auth, sta->addr, sta->owe_pmk,
2433 sta->owe_pmk_len, pmkid, 0, WPA_KEY_MGMT_OWE);
2434
2435 return WLAN_STATUS_SUCCESS;
2436 }
2437
2438 #endif /* CONFIG_OWE */
2439
2440
2441 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
2442 const u8 *ies, size_t ies_len, int reassoc)
2443 {
2444 struct ieee802_11_elems elems;
2445 u16 resp;
2446 const u8 *wpa_ie;
2447 size_t wpa_ie_len;
2448 const u8 *p2p_dev_addr = NULL;
2449
2450 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
2451 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2452 HOSTAPD_LEVEL_INFO, "Station sent an invalid "
2453 "association request");
2454 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2455 }
2456
2457 resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
2458 if (resp != WLAN_STATUS_SUCCESS)
2459 return resp;
2460 resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
2461 if (resp != WLAN_STATUS_SUCCESS)
2462 return resp;
2463 resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
2464 if (resp != WLAN_STATUS_SUCCESS)
2465 return resp;
2466 resp = copy_supp_rates(hapd, sta, &elems);
2467 if (resp != WLAN_STATUS_SUCCESS)
2468 return resp;
2469 #ifdef CONFIG_IEEE80211N
2470 resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
2471 if (resp != WLAN_STATUS_SUCCESS)
2472 return resp;
2473 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
2474 !(sta->flags & WLAN_STA_HT)) {
2475 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2476 HOSTAPD_LEVEL_INFO, "Station does not support "
2477 "mandatory HT PHY - reject association");
2478 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
2479 }
2480 #endif /* CONFIG_IEEE80211N */
2481
2482 #ifdef CONFIG_IEEE80211AC
2483 if (hapd->iconf->ieee80211ac) {
2484 resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
2485 if (resp != WLAN_STATUS_SUCCESS)
2486 return resp;
2487
2488 resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
2489 if (resp != WLAN_STATUS_SUCCESS)
2490 return resp;
2491 }
2492
2493 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
2494 !(sta->flags & WLAN_STA_VHT)) {
2495 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2496 HOSTAPD_LEVEL_INFO, "Station does not support "
2497 "mandatory VHT PHY - reject association");
2498 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
2499 }
2500
2501 if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
2502 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
2503 elems.vendor_vht_len);
2504 if (resp != WLAN_STATUS_SUCCESS)
2505 return resp;
2506 }
2507 #endif /* CONFIG_IEEE80211AC */
2508
2509 #ifdef CONFIG_P2P
2510 if (elems.p2p) {
2511 wpabuf_free(sta->p2p_ie);
2512 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2513 P2P_IE_VENDOR_TYPE);
2514 if (sta->p2p_ie)
2515 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
2516 } else {
2517 wpabuf_free(sta->p2p_ie);
2518 sta->p2p_ie = NULL;
2519 }
2520 #endif /* CONFIG_P2P */
2521
2522 if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
2523 wpa_ie = elems.rsn_ie;
2524 wpa_ie_len = elems.rsn_ie_len;
2525 } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
2526 elems.wpa_ie) {
2527 wpa_ie = elems.wpa_ie;
2528 wpa_ie_len = elems.wpa_ie_len;
2529 } else {
2530 wpa_ie = NULL;
2531 wpa_ie_len = 0;
2532 }
2533
2534 #ifdef CONFIG_WPS
2535 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
2536 if (hapd->conf->wps_state && elems.wps_ie) {
2537 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
2538 "Request - assume WPS is used");
2539 sta->flags |= WLAN_STA_WPS;
2540 wpabuf_free(sta->wps_ie);
2541 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2542 WPS_IE_VENDOR_TYPE);
2543 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
2544 wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
2545 sta->flags |= WLAN_STA_WPS2;
2546 }
2547 wpa_ie = NULL;
2548 wpa_ie_len = 0;
2549 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
2550 wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
2551 "(Re)Association Request - reject");
2552 return WLAN_STATUS_INVALID_IE;
2553 }
2554 } else if (hapd->conf->wps_state && wpa_ie == NULL) {
2555 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
2556 "(Re)Association Request - possible WPS use");
2557 sta->flags |= WLAN_STA_MAYBE_WPS;
2558 } else
2559 #endif /* CONFIG_WPS */
2560 if (hapd->conf->wpa && wpa_ie == NULL) {
2561 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2562 HOSTAPD_LEVEL_INFO,
2563 "No WPA/RSN IE in association request");
2564 return WLAN_STATUS_INVALID_IE;
2565 }
2566
2567 if (hapd->conf->wpa && wpa_ie) {
2568 int res;
2569 wpa_ie -= 2;
2570 wpa_ie_len += 2;
2571 if (sta->wpa_sm == NULL)
2572 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
2573 sta->addr,
2574 p2p_dev_addr);
2575 if (sta->wpa_sm == NULL) {
2576 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
2577 "state machine");
2578 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2579 }
2580 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
2581 wpa_ie, wpa_ie_len,
2582 elems.mdie, elems.mdie_len,
2583 elems.owe_dh, elems.owe_dh_len);
2584 resp = wpa_res_to_status_code(res);
2585 if (resp != WLAN_STATUS_SUCCESS)
2586 return resp;
2587 #ifdef CONFIG_IEEE80211W
2588 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_MFP)) ==
2589 (WLAN_STA_ASSOC | WLAN_STA_MFP) &&
2590 !sta->sa_query_timed_out &&
2591 sta->sa_query_count > 0)
2592 ap_check_sa_query_timeout(hapd, sta);
2593 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_MFP)) ==
2594 (WLAN_STA_ASSOC | WLAN_STA_MFP) &&
2595 !sta->sa_query_timed_out &&
2596 (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
2597 /*
2598 * STA has already been associated with MFP and SA
2599 * Query timeout has not been reached. Reject the
2600 * association attempt temporarily and start SA Query,
2601 * if one is not pending.
2602 */
2603
2604 if (sta->sa_query_count == 0)
2605 ap_sta_start_sa_query(hapd, sta);
2606
2607 return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
2608 }
2609
2610 if (wpa_auth_uses_mfp(sta->wpa_sm))
2611 sta->flags |= WLAN_STA_MFP;
2612 else
2613 sta->flags &= ~WLAN_STA_MFP;
2614 #endif /* CONFIG_IEEE80211W */
2615
2616 #ifdef CONFIG_IEEE80211R_AP
2617 if (sta->auth_alg == WLAN_AUTH_FT) {
2618 if (!reassoc) {
2619 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
2620 "to use association (not "
2621 "re-association) with FT auth_alg",
2622 MAC2STR(sta->addr));
2623 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2624 }
2625
2626 resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
2627 ies_len);
2628 if (resp != WLAN_STATUS_SUCCESS)
2629 return resp;
2630 }
2631 #endif /* CONFIG_IEEE80211R_AP */
2632
2633 #ifdef CONFIG_SAE
2634 if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae &&
2635 sta->sae->state == SAE_ACCEPTED)
2636 wpa_auth_add_sae_pmkid(sta->wpa_sm, sta->sae->pmkid);
2637
2638 if (wpa_auth_uses_sae(sta->wpa_sm) &&
2639 sta->auth_alg == WLAN_AUTH_OPEN) {
2640 struct rsn_pmksa_cache_entry *sa;
2641 sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
2642 if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
2643 wpa_printf(MSG_DEBUG,
2644 "SAE: No PMKSA cache entry found for "
2645 MACSTR, MAC2STR(sta->addr));
2646 return WLAN_STATUS_INVALID_PMKID;
2647 }
2648 wpa_printf(MSG_DEBUG, "SAE: " MACSTR
2649 " using PMKSA caching", MAC2STR(sta->addr));
2650 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
2651 sta->auth_alg != WLAN_AUTH_SAE &&
2652 !(sta->auth_alg == WLAN_AUTH_FT &&
2653 wpa_auth_uses_ft_sae(sta->wpa_sm))) {
2654 wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
2655 "SAE AKM after non-SAE auth_alg %u",
2656 MAC2STR(sta->addr), sta->auth_alg);
2657 return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
2658 }
2659 #endif /* CONFIG_SAE */
2660
2661 #ifdef CONFIG_OWE
2662 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
2663 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE &&
2664 elems.owe_dh) {
2665 resp = owe_process_assoc_req(hapd, sta, elems.owe_dh,
2666 elems.owe_dh_len);
2667 if (resp != WLAN_STATUS_SUCCESS)
2668 return resp;
2669 }
2670 #endif /* CONFIG_OWE */
2671
2672 #ifdef CONFIG_IEEE80211N
2673 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
2674 wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
2675 hostapd_logger(hapd, sta->addr,
2676 HOSTAPD_MODULE_IEEE80211,
2677 HOSTAPD_LEVEL_INFO,
2678 "Station tried to use TKIP with HT "
2679 "association");
2680 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
2681 }
2682 #endif /* CONFIG_IEEE80211N */
2683 #ifdef CONFIG_HS20
2684 } else if (hapd->conf->osen) {
2685 if (elems.osen == NULL) {
2686 hostapd_logger(
2687 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2688 HOSTAPD_LEVEL_INFO,
2689 "No HS 2.0 OSEN element in association request");
2690 return WLAN_STATUS_INVALID_IE;
2691 }
2692
2693 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
2694 if (sta->wpa_sm == NULL)
2695 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
2696 sta->addr, NULL);
2697 if (sta->wpa_sm == NULL) {
2698 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
2699 "state machine");
2700 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2701 }
2702 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
2703 elems.osen - 2, elems.osen_len + 2) < 0)
2704 return WLAN_STATUS_INVALID_IE;
2705 #endif /* CONFIG_HS20 */
2706 } else
2707 wpa_auth_sta_no_wpa(sta->wpa_sm);
2708
2709 #ifdef CONFIG_P2P
2710 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
2711 #endif /* CONFIG_P2P */
2712
2713 #ifdef CONFIG_HS20
2714 wpabuf_free(sta->hs20_ie);
2715 if (elems.hs20 && elems.hs20_len > 4) {
2716 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
2717 elems.hs20_len - 4);
2718 } else
2719 sta->hs20_ie = NULL;
2720
2721 wpabuf_free(sta->roaming_consortium);
2722 if (elems.roaming_cons_sel)
2723 sta->roaming_consortium = wpabuf_alloc_copy(
2724 elems.roaming_cons_sel + 4,
2725 elems.roaming_cons_sel_len - 4);
2726 else
2727 sta->roaming_consortium = NULL;
2728 #endif /* CONFIG_HS20 */
2729
2730 #ifdef CONFIG_FST
2731 wpabuf_free(sta->mb_ies);
2732 if (hapd->iface->fst)
2733 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
2734 else
2735 sta->mb_ies = NULL;
2736 #endif /* CONFIG_FST */
2737
2738 #ifdef CONFIG_MBO
2739 mbo_ap_check_sta_assoc(hapd, sta, &elems);
2740
2741 if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) &&
2742 elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) &&
2743 hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
2744 wpa_printf(MSG_INFO,
2745 "MBO: Reject WPA2 association without PMF");
2746 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2747 }
2748 #endif /* CONFIG_MBO */
2749
2750 ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
2751 elems.supp_op_classes_len);
2752
2753 if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
2754 elems.rrm_enabled &&
2755 elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
2756 os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
2757 sizeof(sta->rrm_enabled_capa));
2758
2759 if (elems.power_capab) {
2760 sta->min_tx_power = elems.power_capab[0];
2761 sta->max_tx_power = elems.power_capab[1];
2762 sta->power_capab = 1;
2763 } else {
2764 sta->power_capab = 0;
2765 }
2766
2767 return WLAN_STATUS_SUCCESS;
2768 }
2769
2770
2771 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
2772 u16 reason_code)
2773 {
2774 int send_len;
2775 struct ieee80211_mgmt reply;
2776
2777 os_memset(&reply, 0, sizeof(reply));
2778 reply.frame_control =
2779 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
2780 os_memcpy(reply.da, addr, ETH_ALEN);
2781 os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
2782 os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
2783
2784 send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
2785 reply.u.deauth.reason_code = host_to_le16(reason_code);
2786
2787 if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
2788 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
2789 strerror(errno));
2790 }
2791
2792
2793 static int add_associated_sta(struct hostapd_data *hapd,
2794 struct sta_info *sta)
2795 {
2796 struct ieee80211_ht_capabilities ht_cap;
2797 struct ieee80211_vht_capabilities vht_cap;
2798 int set = 1;
2799
2800 /*
2801 * Remove the STA entry to ensure the STA PS state gets cleared and
2802 * configuration gets updated. This is relevant for cases, such as
2803 * FT-over-the-DS, where a station re-associates back to the same AP but
2804 * skips the authentication flow, or if working with a driver that
2805 * does not support full AP client state.
2806 *
2807 * Skip this if the STA has already completed FT reassociation and the
2808 * TK has been configured since the TX/RX PN must not be reset to 0 for
2809 * the same key.
2810 */
2811 if (!sta->added_unassoc &&
2812 (!(sta->flags & WLAN_STA_AUTHORIZED) ||
2813 (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
2814 !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
2815 hostapd_drv_sta_remove(hapd, sta->addr);
2816 wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
2817 set = 0;
2818 }
2819
2820 #ifdef CONFIG_IEEE80211N
2821 if (sta->flags & WLAN_STA_HT)
2822 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
2823 #endif /* CONFIG_IEEE80211N */
2824 #ifdef CONFIG_IEEE80211AC
2825 if (sta->flags & WLAN_STA_VHT)
2826 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
2827 #endif /* CONFIG_IEEE80211AC */
2828
2829 /*
2830 * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
2831 * will be set when the ACK frame for the (Re)Association Response frame
2832 * is processed (TX status driver event).
2833 */
2834 if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
2835 sta->supported_rates, sta->supported_rates_len,
2836 sta->listen_interval,
2837 sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
2838 sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
2839 sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
2840 sta->vht_opmode, sta->p2p_ie ? 1 : 0,
2841 set)) {
2842 hostapd_logger(hapd, sta->addr,
2843 HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
2844 "Could not %s STA to kernel driver",
2845 set ? "set" : "add");
2846
2847 if (sta->added_unassoc) {
2848 hostapd_drv_sta_remove(hapd, sta->addr);
2849 sta->added_unassoc = 0;
2850 }
2851
2852 return -1;
2853 }
2854
2855 sta->added_unassoc = 0;
2856
2857 return 0;
2858 }
2859
2860
2861 static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
2862 const u8 *addr, u16 status_code, int reassoc,
2863 const u8 *ies, size_t ies_len)
2864 {
2865 int send_len;
2866 u8 *buf;
2867 size_t buflen;
2868 struct ieee80211_mgmt *reply;
2869 u8 *p;
2870 u16 res = WLAN_STATUS_SUCCESS;
2871
2872 buflen = sizeof(struct ieee80211_mgmt) + 1024;
2873 #ifdef CONFIG_FILS
2874 if (sta && sta->fils_hlp_resp)
2875 buflen += wpabuf_len(sta->fils_hlp_resp);
2876 #endif /* CONFIG_FILS */
2877 #ifdef CONFIG_OWE
2878 if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
2879 buflen += 150;
2880 #endif /* CONFIG_OWE */
2881 buf = os_zalloc(buflen);
2882 if (!buf) {
2883 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2884 goto done;
2885 }
2886 reply = (struct ieee80211_mgmt *) buf;
2887 reply->frame_control =
2888 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2889 (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
2890 WLAN_FC_STYPE_ASSOC_RESP));
2891 os_memcpy(reply->da, addr, ETH_ALEN);
2892 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
2893 os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
2894
2895 send_len = IEEE80211_HDRLEN;
2896 send_len += sizeof(reply->u.assoc_resp);
2897 reply->u.assoc_resp.capab_info =
2898 host_to_le16(hostapd_own_capab_info(hapd));
2899 reply->u.assoc_resp.status_code = host_to_le16(status_code);
2900
2901 reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0) |
2902 BIT(14) | BIT(15));
2903 /* Supported rates */
2904 p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
2905 /* Extended supported rates */
2906 p = hostapd_eid_ext_supp_rates(hapd, p);
2907
2908 #ifdef CONFIG_IEEE80211R_AP
2909 if (sta && status_code == WLAN_STATUS_SUCCESS) {
2910 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
2911 * Transition Information, RSN, [RIC Response] */
2912 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
2913 buf + buflen - p,
2914 sta->auth_alg, ies, ies_len);
2915 if (!p) {
2916 wpa_printf(MSG_DEBUG,
2917 "FT: Failed to write AssocResp IEs");
2918 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
2919 goto done;
2920 }
2921 }
2922 #endif /* CONFIG_IEEE80211R_AP */
2923
2924 #ifdef CONFIG_OWE
2925 if (sta && status_code == WLAN_STATUS_SUCCESS &&
2926 (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
2927 p = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, p,
2928 buf + buflen - p,
2929 ies, ies_len);
2930 #endif /* CONFIG_OWE */
2931
2932 #ifdef CONFIG_IEEE80211W
2933 if (sta && status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
2934 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
2935 #endif /* CONFIG_IEEE80211W */
2936
2937 #ifdef CONFIG_IEEE80211N
2938 p = hostapd_eid_ht_capabilities(hapd, p);
2939 p = hostapd_eid_ht_operation(hapd, p);
2940 #endif /* CONFIG_IEEE80211N */
2941
2942 #ifdef CONFIG_IEEE80211AC
2943 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
2944 u32 nsts = 0, sta_nsts;
2945
2946 if (sta && hapd->conf->use_sta_nsts && sta->vht_capabilities) {
2947 struct ieee80211_vht_capabilities *capa;
2948
2949 nsts = (hapd->iface->conf->vht_capab >>
2950 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
2951 capa = sta->vht_capabilities;
2952 sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
2953 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
2954
2955 if (nsts < sta_nsts)
2956 nsts = 0;
2957 else
2958 nsts = sta_nsts;
2959 }
2960 p = hostapd_eid_vht_capabilities(hapd, p, nsts);
2961 p = hostapd_eid_vht_operation(hapd, p);
2962 }
2963 #endif /* CONFIG_IEEE80211AC */
2964
2965 p = hostapd_eid_ext_capab(hapd, p);
2966 p = hostapd_eid_bss_max_idle_period(hapd, p);
2967 if (sta && sta->qos_map_enabled)
2968 p = hostapd_eid_qos_map_set(hapd, p);
2969
2970 #ifdef CONFIG_FST
2971 if (hapd->iface->fst_ies) {
2972 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
2973 wpabuf_len(hapd->iface->fst_ies));
2974 p += wpabuf_len(hapd->iface->fst_ies);
2975 }
2976 #endif /* CONFIG_FST */
2977
2978 #ifdef CONFIG_IEEE80211AC
2979 if (sta && hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
2980 p = hostapd_eid_vendor_vht(hapd, p);
2981 #endif /* CONFIG_IEEE80211AC */
2982
2983 if (sta && (sta->flags & WLAN_STA_WMM))
2984 p = hostapd_eid_wmm(hapd, p);
2985
2986 #ifdef CONFIG_WPS
2987 if (sta &&
2988 ((sta->flags & WLAN_STA_WPS) ||
2989 ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa))) {
2990 struct wpabuf *wps = wps_build_assoc_resp_ie();
2991 if (wps) {
2992 os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
2993 p += wpabuf_len(wps);
2994 wpabuf_free(wps);
2995 }
2996 }
2997 #endif /* CONFIG_WPS */
2998
2999 #ifdef CONFIG_P2P
3000 if (sta && sta->p2p_ie && hapd->p2p_group) {
3001 struct wpabuf *p2p_resp_ie;
3002 enum p2p_status_code status;
3003 switch (status_code) {
3004 case WLAN_STATUS_SUCCESS:
3005 status = P2P_SC_SUCCESS;
3006 break;
3007 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
3008 status = P2P_SC_FAIL_LIMIT_REACHED;
3009 break;
3010 default:
3011 status = P2P_SC_FAIL_INVALID_PARAMS;
3012 break;
3013 }
3014 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
3015 if (p2p_resp_ie) {
3016 os_memcpy(p, wpabuf_head(p2p_resp_ie),
3017 wpabuf_len(p2p_resp_ie));
3018 p += wpabuf_len(p2p_resp_ie);
3019 wpabuf_free(p2p_resp_ie);
3020 }
3021 }
3022 #endif /* CONFIG_P2P */
3023
3024 #ifdef CONFIG_P2P_MANAGER
3025 if (hapd->conf->p2p & P2P_MANAGE)
3026 p = hostapd_eid_p2p_manage(hapd, p);
3027 #endif /* CONFIG_P2P_MANAGER */
3028
3029 p = hostapd_eid_mbo(hapd, p, buf + buflen - p);
3030
3031 if (hapd->conf->assocresp_elements &&
3032 (size_t) (buf + buflen - p) >=
3033 wpabuf_len(hapd->conf->assocresp_elements)) {
3034 os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
3035 wpabuf_len(hapd->conf->assocresp_elements));
3036 p += wpabuf_len(hapd->conf->assocresp_elements);
3037 }
3038
3039 send_len += p - reply->u.assoc_resp.variable;
3040
3041 #ifdef CONFIG_FILS
3042 if (sta &&
3043 (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3044 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3045 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
3046 status_code == WLAN_STATUS_SUCCESS) {
3047 struct ieee802_11_elems elems;
3048
3049 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
3050 ParseFailed || !elems.fils_session) {
3051 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3052 goto done;
3053 }
3054
3055 /* FILS Session */
3056 *p++ = WLAN_EID_EXTENSION; /* Element ID */
3057 *p++ = 1 + FILS_SESSION_LEN; /* Length */
3058 *p++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */
3059 os_memcpy(p, elems.fils_session, FILS_SESSION_LEN);
3060 send_len += 2 + 1 + FILS_SESSION_LEN;
3061
3062 send_len = fils_encrypt_assoc(sta->wpa_sm, buf, send_len,
3063 buflen, sta->fils_hlp_resp);
3064 if (send_len < 0) {
3065 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3066 goto done;
3067 }
3068 }
3069 #endif /* CONFIG_FILS */
3070
3071 #ifdef CONFIG_OWE
3072 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
3073 sta && sta->owe_ecdh && status_code == WLAN_STATUS_SUCCESS &&
3074 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE) {
3075 struct wpabuf *pub;
3076
3077 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
3078 if (!pub) {
3079 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3080 goto done;
3081 }
3082 /* OWE Diffie-Hellman Parameter element */
3083 *p++ = WLAN_EID_EXTENSION; /* Element ID */
3084 *p++ = 1 + 2 + wpabuf_len(pub); /* Length */
3085 *p++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */
3086 WPA_PUT_LE16(p, sta->owe_group);
3087 p += 2;
3088 os_memcpy(p, wpabuf_head(pub), wpabuf_len(pub));
3089 p += wpabuf_len(pub);
3090 send_len += 3 + 2 + wpabuf_len(pub);
3091 wpabuf_free(pub);
3092 }
3093 #endif /* CONFIG_OWE */
3094
3095 if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
3096 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
3097 strerror(errno));
3098 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3099 }
3100
3101 done:
3102 os_free(buf);
3103 return res;
3104 }
3105
3106
3107 #ifdef CONFIG_OWE
3108 u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta,
3109 const u8 *owe_dh, u8 owe_dh_len,
3110 u8 *owe_buf, size_t owe_buf_len, u16 *reason)
3111 {
3112 #ifdef CONFIG_TESTING_OPTIONS
3113 if (hapd->conf->own_ie_override) {
3114 wpa_printf(MSG_DEBUG, "OWE: Using IE override");
3115 *reason = WLAN_STATUS_SUCCESS;
3116 return wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3117 owe_buf_len, NULL, 0);
3118 }
3119 #endif /* CONFIG_TESTING_OPTIONS */
3120
3121 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
3122 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
3123 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3124 owe_buf_len, NULL, 0);
3125 *reason = WLAN_STATUS_SUCCESS;
3126 return owe_buf;
3127 }
3128
3129 *reason = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len);
3130 if (*reason != WLAN_STATUS_SUCCESS)
3131 return NULL;
3132
3133 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3134 owe_buf_len, NULL, 0);
3135
3136 if (sta->owe_ecdh && owe_buf) {
3137 struct wpabuf *pub;
3138
3139 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
3140 if (!pub) {
3141 *reason = WLAN_STATUS_UNSPECIFIED_FAILURE;
3142 return owe_buf;
3143 }
3144
3145 /* OWE Diffie-Hellman Parameter element */
3146 *owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */
3147 *owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */
3148 *owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension
3149 */
3150 WPA_PUT_LE16(owe_buf, sta->owe_group);
3151 owe_buf += 2;
3152 os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub));
3153 owe_buf += wpabuf_len(pub);
3154 wpabuf_free(pub);
3155 }
3156
3157 return owe_buf;
3158 }
3159 #endif /* CONFIG_OWE */
3160
3161
3162 #ifdef CONFIG_FILS
3163
3164 void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta)
3165 {
3166 u16 reply_res;
3167
3168 wpa_printf(MSG_DEBUG, "FILS: Finish association with " MACSTR,
3169 MAC2STR(sta->addr));
3170 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3171 if (!sta->fils_pending_assoc_req)
3172 return;
3173 reply_res = send_assoc_resp(hapd, sta, sta->addr, WLAN_STATUS_SUCCESS,
3174 sta->fils_pending_assoc_is_reassoc,
3175 sta->fils_pending_assoc_req,
3176 sta->fils_pending_assoc_req_len);
3177 os_free(sta->fils_pending_assoc_req);
3178 sta->fils_pending_assoc_req = NULL;
3179 sta->fils_pending_assoc_req_len = 0;
3180 wpabuf_free(sta->fils_hlp_resp);
3181 sta->fils_hlp_resp = NULL;
3182 wpabuf_free(sta->hlp_dhcp_discover);
3183 sta->hlp_dhcp_discover = NULL;
3184
3185 /*
3186 * Remove the station in case transmission of a success response fails.
3187 * At this point the station was already added associated to the driver.
3188 */
3189 if (reply_res != WLAN_STATUS_SUCCESS)
3190 hostapd_drv_sta_remove(hapd, sta->addr);
3191 }
3192
3193
3194 void fils_hlp_timeout(void *eloop_ctx, void *eloop_data)
3195 {
3196 struct hostapd_data *hapd = eloop_ctx;
3197 struct sta_info *sta = eloop_data;
3198
3199 wpa_printf(MSG_DEBUG,
3200 "FILS: HLP response timeout - continue with association response for "
3201 MACSTR, MAC2STR(sta->addr));
3202 if (sta->fils_drv_assoc_finish)
3203 hostapd_notify_assoc_fils_finish(hapd, sta);
3204 else
3205 fils_hlp_finish_assoc(hapd, sta);
3206 }
3207
3208 #endif /* CONFIG_FILS */
3209
3210
3211 static void handle_assoc(struct hostapd_data *hapd,
3212 const struct ieee80211_mgmt *mgmt, size_t len,
3213 int reassoc)
3214 {
3215 u16 capab_info, listen_interval, seq_ctrl, fc;
3216 u16 resp = WLAN_STATUS_SUCCESS, reply_res;
3217 const u8 *pos;
3218 int left, i;
3219 struct sta_info *sta;
3220 u8 *tmp = NULL;
3221 struct hostapd_sta_wpa_psk_short *psk = NULL;
3222 char *identity = NULL;
3223 char *radius_cui = NULL;
3224 #ifdef CONFIG_FILS
3225 int delay_assoc = 0;
3226 #endif /* CONFIG_FILS */
3227
3228 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
3229 sizeof(mgmt->u.assoc_req))) {
3230 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
3231 reassoc, (unsigned long) len);
3232 return;
3233 }
3234
3235 #ifdef CONFIG_TESTING_OPTIONS
3236 if (reassoc) {
3237 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
3238 drand48() < hapd->iconf->ignore_reassoc_probability) {
3239 wpa_printf(MSG_INFO,
3240 "TESTING: ignoring reassoc request from "
3241 MACSTR, MAC2STR(mgmt->sa));
3242 return;
3243 }
3244 } else {
3245 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
3246 drand48() < hapd->iconf->ignore_assoc_probability) {
3247 wpa_printf(MSG_INFO,
3248 "TESTING: ignoring assoc request from "
3249 MACSTR, MAC2STR(mgmt->sa));
3250 return;
3251 }
3252 }
3253 #endif /* CONFIG_TESTING_OPTIONS */
3254
3255 fc = le_to_host16(mgmt->frame_control);
3256 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
3257
3258 if (reassoc) {
3259 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
3260 listen_interval = le_to_host16(
3261 mgmt->u.reassoc_req.listen_interval);
3262 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
3263 " capab_info=0x%02x listen_interval=%d current_ap="
3264 MACSTR " seq_ctrl=0x%x%s",
3265 MAC2STR(mgmt->sa), capab_info, listen_interval,
3266 MAC2STR(mgmt->u.reassoc_req.current_ap),
3267 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
3268 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
3269 pos = mgmt->u.reassoc_req.variable;
3270 } else {
3271 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
3272 listen_interval = le_to_host16(
3273 mgmt->u.assoc_req.listen_interval);
3274 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
3275 " capab_info=0x%02x listen_interval=%d "
3276 "seq_ctrl=0x%x%s",
3277 MAC2STR(mgmt->sa), capab_info, listen_interval,
3278 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
3279 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
3280 pos = mgmt->u.assoc_req.variable;
3281 }
3282
3283 sta = ap_get_sta(hapd, mgmt->sa);
3284 #ifdef CONFIG_IEEE80211R_AP
3285 if (sta && sta->auth_alg == WLAN_AUTH_FT &&
3286 (sta->flags & WLAN_STA_AUTH) == 0) {
3287 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
3288 "prior to authentication since it is using "
3289 "over-the-DS FT", MAC2STR(mgmt->sa));
3290
3291 /*
3292 * Mark station as authenticated, to avoid adding station
3293 * entry in the driver as associated and not authenticated
3294 */
3295 sta->flags |= WLAN_STA_AUTH;
3296 } else
3297 #endif /* CONFIG_IEEE80211R_AP */
3298 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
3299 if (hapd->iface->current_mode &&
3300 hapd->iface->current_mode->mode ==
3301 HOSTAPD_MODE_IEEE80211AD) {
3302 int acl_res;
3303 u32 session_timeout, acct_interim_interval;
3304 struct vlan_description vlan_id;
3305
3306 acl_res = ieee802_11_allowed_address(
3307 hapd, mgmt->sa, (const u8 *) mgmt, len,
3308 &session_timeout, &acct_interim_interval,
3309 &vlan_id, &psk, &identity, &radius_cui, 0);
3310 if (acl_res == HOSTAPD_ACL_REJECT) {
3311 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
3312 "Ignore Association Request frame from "
3313 MACSTR " due to ACL reject",
3314 MAC2STR(mgmt->sa));
3315 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3316 goto fail;
3317 }
3318 if (acl_res == HOSTAPD_ACL_PENDING)
3319 return;
3320
3321 /* DMG/IEEE 802.11ad does not use authentication.
3322 * Allocate sta entry upon association. */
3323 sta = ap_sta_add(hapd, mgmt->sa);
3324 if (!sta) {
3325 hostapd_logger(hapd, mgmt->sa,
3326 HOSTAPD_MODULE_IEEE80211,
3327 HOSTAPD_LEVEL_INFO,
3328 "Failed to add STA");
3329 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3330 goto fail;
3331 }
3332
3333 acl_res = ieee802_11_set_radius_info(
3334 hapd, sta, acl_res, session_timeout,
3335 acct_interim_interval, &vlan_id, &psk,
3336 &identity, &radius_cui);
3337 if (acl_res) {
3338 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3339 goto fail;
3340 }
3341
3342 hostapd_logger(hapd, sta->addr,
3343 HOSTAPD_MODULE_IEEE80211,
3344 HOSTAPD_LEVEL_DEBUG,
3345 "Skip authentication for DMG/IEEE 802.11ad");
3346 sta->flags |= WLAN_STA_AUTH;
3347 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
3348 sta->auth_alg = WLAN_AUTH_OPEN;
3349 } else {
3350 hostapd_logger(hapd, mgmt->sa,
3351 HOSTAPD_MODULE_IEEE80211,
3352 HOSTAPD_LEVEL_INFO,
3353 "Station tried to associate before authentication (aid=%d flags=0x%x)",
3354 sta ? sta->aid : -1,
3355 sta ? sta->flags : 0);
3356 send_deauth(hapd, mgmt->sa,
3357 WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
3358 return;
3359 }
3360 }
3361
3362 if ((fc & WLAN_FC_RETRY) &&
3363 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
3364 sta->last_seq_ctrl == seq_ctrl &&
3365 sta->last_subtype == (reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3366 WLAN_FC_STYPE_ASSOC_REQ)) {
3367 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3368 HOSTAPD_LEVEL_DEBUG,
3369 "Drop repeated association frame seq_ctrl=0x%x",
3370 seq_ctrl);
3371 return;
3372 }
3373 sta->last_seq_ctrl = seq_ctrl;
3374 sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3375 WLAN_FC_STYPE_ASSOC_REQ;
3376
3377 if (hapd->tkip_countermeasures) {
3378 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3379 goto fail;
3380 }
3381
3382 if (listen_interval > hapd->conf->max_listen_interval) {
3383 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3384 HOSTAPD_LEVEL_DEBUG,
3385 "Too large Listen Interval (%d)",
3386 listen_interval);
3387 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
3388 goto fail;
3389 }
3390
3391 #ifdef CONFIG_MBO
3392 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
3393 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3394 goto fail;
3395 }
3396 #endif /* CONFIG_MBO */
3397
3398 /*
3399 * sta->capability is used in check_assoc_ies() for RRM enabled
3400 * capability element.
3401 */
3402 sta->capability = capab_info;
3403
3404 #ifdef CONFIG_FILS
3405 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3406 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3407 sta->auth_alg == WLAN_AUTH_FILS_PK) {
3408 int res;
3409
3410 /* The end of the payload is encrypted. Need to decrypt it
3411 * before parsing. */
3412
3413 tmp = os_memdup(pos, left);
3414 if (!tmp) {
3415 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3416 goto fail;
3417 }
3418
3419 res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
3420 len, tmp, left);
3421 if (res < 0) {
3422 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3423 goto fail;
3424 }
3425 pos = tmp;
3426 left = res;
3427 }
3428 #endif /* CONFIG_FILS */
3429
3430 /* followed by SSID and Supported rates; and HT capabilities if 802.11n
3431 * is used */
3432 resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
3433 if (resp != WLAN_STATUS_SUCCESS)
3434 goto fail;
3435
3436 if (hostapd_get_aid(hapd, sta) < 0) {
3437 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3438 HOSTAPD_LEVEL_INFO, "No room for more AIDs");
3439 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3440 goto fail;
3441 }
3442
3443 sta->listen_interval = listen_interval;
3444
3445 if (hapd->iface->current_mode &&
3446 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
3447 sta->flags |= WLAN_STA_NONERP;
3448 for (i = 0; i < sta->supported_rates_len; i++) {
3449 if ((sta->supported_rates[i] & 0x7f) > 22) {
3450 sta->flags &= ~WLAN_STA_NONERP;
3451 break;
3452 }
3453 }
3454 if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
3455 sta->nonerp_set = 1;
3456 hapd->iface->num_sta_non_erp++;
3457 if (hapd->iface->num_sta_non_erp == 1)
3458 ieee802_11_set_beacons(hapd->iface);
3459 }
3460
3461 if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
3462 !sta->no_short_slot_time_set) {
3463 sta->no_short_slot_time_set = 1;
3464 hapd->iface->num_sta_no_short_slot_time++;
3465 if (hapd->iface->current_mode &&
3466 hapd->iface->current_mode->mode ==
3467 HOSTAPD_MODE_IEEE80211G &&
3468 hapd->iface->num_sta_no_short_slot_time == 1)
3469 ieee802_11_set_beacons(hapd->iface);
3470 }
3471
3472 if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
3473 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
3474 else
3475 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
3476
3477 if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
3478 !sta->no_short_preamble_set) {
3479 sta->no_short_preamble_set = 1;
3480 hapd->iface->num_sta_no_short_preamble++;
3481 if (hapd->iface->current_mode &&
3482 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
3483 && hapd->iface->num_sta_no_short_preamble == 1)
3484 ieee802_11_set_beacons(hapd->iface);
3485 }
3486
3487 #ifdef CONFIG_IEEE80211N
3488 update_ht_state(hapd, sta);
3489 #endif /* CONFIG_IEEE80211N */
3490
3491 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3492 HOSTAPD_LEVEL_DEBUG,
3493 "association OK (aid %d)", sta->aid);
3494 /* Station will be marked associated, after it acknowledges AssocResp
3495 */
3496 sta->flags |= WLAN_STA_ASSOC_REQ_OK;
3497
3498 #ifdef CONFIG_IEEE80211W
3499 if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
3500 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
3501 "SA Query procedure", reassoc ? "re" : "");
3502 /* TODO: Send a protected Disassociate frame to the STA using
3503 * the old key and Reason Code "Previous Authentication no
3504 * longer valid". Make sure this is only sent protected since
3505 * unprotected frame would be received by the STA that is now
3506 * trying to associate.
3507 */
3508 }
3509 #endif /* CONFIG_IEEE80211W */
3510
3511 /* Make sure that the previously registered inactivity timer will not
3512 * remove the STA immediately. */
3513 sta->timeout_next = STA_NULLFUNC;
3514
3515 #ifdef CONFIG_TAXONOMY
3516 taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
3517 #endif /* CONFIG_TAXONOMY */
3518
3519 sta->pending_wds_enable = 0;
3520
3521 #ifdef CONFIG_FILS
3522 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3523 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3524 sta->auth_alg == WLAN_AUTH_FILS_PK) {
3525 if (fils_process_hlp(hapd, sta, pos, left) > 0)
3526 delay_assoc = 1;
3527 }
3528 #endif /* CONFIG_FILS */
3529
3530 fail:
3531 os_free(identity);
3532 os_free(radius_cui);
3533 hostapd_free_psk_list(psk);
3534
3535 /*
3536 * In case of a successful response, add the station to the driver.
3537 * Otherwise, the kernel may ignore Data frames before we process the
3538 * ACK frame (TX status). In case of a failure, this station will be
3539 * removed.
3540 *
3541 * Note that this is not compliant with the IEEE 802.11 standard that
3542 * states that a non-AP station should transition into the
3543 * authenticated/associated state only after the station acknowledges
3544 * the (Re)Association Response frame. However, still do this as:
3545 *
3546 * 1. In case the station does not acknowledge the (Re)Association
3547 * Response frame, it will be removed.
3548 * 2. Data frames will be dropped in the kernel until the station is
3549 * set into authorized state, and there are no significant known
3550 * issues with processing other non-Data Class 3 frames during this
3551 * window.
3552 */
3553 if (resp == WLAN_STATUS_SUCCESS && sta && add_associated_sta(hapd, sta))
3554 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3555
3556 #ifdef CONFIG_FILS
3557 if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS &&
3558 eloop_is_timeout_registered(fils_hlp_timeout, hapd, sta) &&
3559 sta->fils_pending_assoc_req) {
3560 /* Do not reschedule fils_hlp_timeout in case the station
3561 * retransmits (Re)Association Request frame while waiting for
3562 * the previously started FILS HLP wait, so that the timeout can
3563 * be determined from the first pending attempt. */
3564 wpa_printf(MSG_DEBUG,
3565 "FILS: Continue waiting for HLP processing before sending (Re)Association Response frame to "
3566 MACSTR, MAC2STR(sta->addr));
3567 os_free(tmp);
3568 return;
3569 }
3570 if (sta) {
3571 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3572 os_free(sta->fils_pending_assoc_req);
3573 sta->fils_pending_assoc_req = NULL;
3574 sta->fils_pending_assoc_req_len = 0;
3575 wpabuf_free(sta->fils_hlp_resp);
3576 sta->fils_hlp_resp = NULL;
3577 }
3578 if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS) {
3579 sta->fils_pending_assoc_req = tmp;
3580 sta->fils_pending_assoc_req_len = left;
3581 sta->fils_pending_assoc_is_reassoc = reassoc;
3582 sta->fils_drv_assoc_finish = 0;
3583 wpa_printf(MSG_DEBUG,
3584 "FILS: Waiting for HLP processing before sending (Re)Association Response frame to "
3585 MACSTR, MAC2STR(sta->addr));
3586 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3587 eloop_register_timeout(0, hapd->conf->fils_hlp_wait_time * 1024,
3588 fils_hlp_timeout, hapd, sta);
3589 return;
3590 }
3591 #endif /* CONFIG_FILS */
3592
3593 reply_res = send_assoc_resp(hapd, sta, mgmt->sa, resp, reassoc, pos,
3594 left);
3595 os_free(tmp);
3596
3597 /*
3598 * Remove the station in case tranmission of a success response fails
3599 * (the STA was added associated to the driver) or if the station was
3600 * previously added unassociated.
3601 */
3602 if (sta && ((reply_res != WLAN_STATUS_SUCCESS &&
3603 resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc)) {
3604 hostapd_drv_sta_remove(hapd, sta->addr);
3605 sta->added_unassoc = 0;
3606 }
3607 }
3608
3609
3610 static void handle_disassoc(struct hostapd_data *hapd,
3611 const struct ieee80211_mgmt *mgmt, size_t len)
3612 {
3613 struct sta_info *sta;
3614
3615 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
3616 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
3617 (unsigned long) len);
3618 return;
3619 }
3620
3621 wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
3622 MAC2STR(mgmt->sa),
3623 le_to_host16(mgmt->u.disassoc.reason_code));
3624
3625 sta = ap_get_sta(hapd, mgmt->sa);
3626 if (sta == NULL) {
3627 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
3628 MAC2STR(mgmt->sa));
3629 return;
3630 }
3631
3632 ap_sta_set_authorized(hapd, sta, 0);
3633 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
3634 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
3635 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
3636 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3637 HOSTAPD_LEVEL_INFO, "disassociated");
3638 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
3639 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
3640 /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
3641 * authenticated. */
3642 accounting_sta_stop(hapd, sta);
3643 ieee802_1x_free_station(hapd, sta);
3644 if (sta->ipaddr)
3645 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
3646 ap_sta_ip6addr_del(hapd, sta);
3647 hostapd_drv_sta_remove(hapd, sta->addr);
3648 sta->added_unassoc = 0;
3649
3650 if (sta->timeout_next == STA_NULLFUNC ||
3651 sta->timeout_next == STA_DISASSOC) {
3652 sta->timeout_next = STA_DEAUTH;
3653 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
3654 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
3655 hapd, sta);
3656 }
3657
3658 mlme_disassociate_indication(
3659 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
3660
3661 /* DMG/IEEE 802.11ad does not use deauthication. Deallocate sta upon
3662 * disassociation. */
3663 if (hapd->iface->current_mode &&
3664 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
3665 sta->flags &= ~WLAN_STA_AUTH;
3666 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
3667 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3668 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
3669 ap_free_sta(hapd, sta);
3670 }
3671 }
3672
3673
3674 static void handle_deauth(struct hostapd_data *hapd,
3675 const struct ieee80211_mgmt *mgmt, size_t len)
3676 {
3677 struct sta_info *sta;
3678
3679 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
3680 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
3681 "payload (len=%lu)", (unsigned long) len);
3682 return;
3683 }
3684
3685 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
3686 " reason_code=%d",
3687 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
3688
3689 sta = ap_get_sta(hapd, mgmt->sa);
3690 if (sta == NULL) {
3691 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
3692 "to deauthenticate, but it is not authenticated",
3693 MAC2STR(mgmt->sa));
3694 return;
3695 }
3696
3697 ap_sta_set_authorized(hapd, sta, 0);
3698 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
3699 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
3700 WLAN_STA_ASSOC_REQ_OK);
3701 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
3702 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3703 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
3704 mlme_deauthenticate_indication(
3705 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
3706 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
3707 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
3708 ap_free_sta(hapd, sta);
3709 }
3710
3711
3712 static void handle_beacon(struct hostapd_data *hapd,
3713 const struct ieee80211_mgmt *mgmt, size_t len,
3714 struct hostapd_frame_info *fi)
3715 {
3716 struct ieee802_11_elems elems;
3717
3718 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
3719 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
3720 (unsigned long) len);
3721 return;
3722 }
3723
3724 (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
3725 len - (IEEE80211_HDRLEN +
3726 sizeof(mgmt->u.beacon)), &elems,
3727 0);
3728
3729 ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
3730 }
3731
3732
3733 #ifdef CONFIG_IEEE80211W
3734
3735 static int hostapd_sa_query_action(struct hostapd_data *hapd,
3736 const struct ieee80211_mgmt *mgmt,
3737 size_t len)
3738 {
3739 const u8 *end;
3740
3741 end = mgmt->u.action.u.sa_query_resp.trans_id +
3742 WLAN_SA_QUERY_TR_ID_LEN;
3743 if (((u8 *) mgmt) + len < end) {
3744 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
3745 "frame (len=%lu)", (unsigned long) len);
3746 return 0;
3747 }
3748
3749 ieee802_11_sa_query_action(hapd, mgmt->sa,
3750 mgmt->u.action.u.sa_query_resp.action,
3751 mgmt->u.action.u.sa_query_resp.trans_id);
3752 return 1;
3753 }
3754
3755
3756 static int robust_action_frame(u8 category)
3757 {
3758 return category != WLAN_ACTION_PUBLIC &&
3759 category != WLAN_ACTION_HT;
3760 }
3761 #endif /* CONFIG_IEEE80211W */
3762
3763
3764 static int handle_action(struct hostapd_data *hapd,
3765 const struct ieee80211_mgmt *mgmt, size_t len,
3766 unsigned int freq)
3767 {
3768 struct sta_info *sta;
3769 u8 *action __maybe_unused;
3770
3771 if (len < IEEE80211_HDRLEN + 2 + 1) {
3772 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3773 HOSTAPD_LEVEL_DEBUG,
3774 "handle_action - too short payload (len=%lu)",
3775 (unsigned long) len);
3776 return 0;
3777 }
3778
3779 action = (u8 *) &mgmt->u.action.u;
3780 wpa_printf(MSG_DEBUG, "RX_ACTION category %u action %u sa " MACSTR
3781 " da " MACSTR " len %d freq %u",
3782 mgmt->u.action.category, *action,
3783 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), (int) len, freq);
3784
3785 sta = ap_get_sta(hapd, mgmt->sa);
3786
3787 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
3788 (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
3789 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
3790 "frame (category=%u) from unassociated STA " MACSTR,
3791 mgmt->u.action.category, MAC2STR(mgmt->sa));
3792 return 0;
3793 }
3794
3795 #ifdef CONFIG_IEEE80211W
3796 if (sta && (sta->flags & WLAN_STA_MFP) &&
3797 !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
3798 robust_action_frame(mgmt->u.action.category)) {
3799 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3800 HOSTAPD_LEVEL_DEBUG,
3801 "Dropped unprotected Robust Action frame from "
3802 "an MFP STA");
3803 return 0;
3804 }
3805 #endif /* CONFIG_IEEE80211W */
3806
3807 if (sta) {
3808 u16 fc = le_to_host16(mgmt->frame_control);
3809 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
3810
3811 if ((fc & WLAN_FC_RETRY) &&
3812 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
3813 sta->last_seq_ctrl == seq_ctrl &&
3814 sta->last_subtype == WLAN_FC_STYPE_ACTION) {
3815 hostapd_logger(hapd, sta->addr,
3816 HOSTAPD_MODULE_IEEE80211,
3817 HOSTAPD_LEVEL_DEBUG,
3818 "Drop repeated action frame seq_ctrl=0x%x",
3819 seq_ctrl);
3820 return 1;
3821 }
3822
3823 sta->last_seq_ctrl = seq_ctrl;
3824 sta->last_subtype = WLAN_FC_STYPE_ACTION;
3825 }
3826
3827 switch (mgmt->u.action.category) {
3828 #ifdef CONFIG_IEEE80211R_AP
3829 case WLAN_ACTION_FT:
3830 if (!sta ||
3831 wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
3832 len - IEEE80211_HDRLEN))
3833 break;
3834 return 1;
3835 #endif /* CONFIG_IEEE80211R_AP */
3836 case WLAN_ACTION_WMM:
3837 hostapd_wmm_action(hapd, mgmt, len);
3838 return 1;
3839 #ifdef CONFIG_IEEE80211W
3840 case WLAN_ACTION_SA_QUERY:
3841 return hostapd_sa_query_action(hapd, mgmt, len);
3842 #endif /* CONFIG_IEEE80211W */
3843 #ifdef CONFIG_WNM_AP
3844 case WLAN_ACTION_WNM:
3845 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
3846 return 1;
3847 #endif /* CONFIG_WNM_AP */
3848 #ifdef CONFIG_FST
3849 case WLAN_ACTION_FST:
3850 if (hapd->iface->fst)
3851 fst_rx_action(hapd->iface->fst, mgmt, len);
3852 else
3853 wpa_printf(MSG_DEBUG,
3854 "FST: Ignore FST Action frame - no FST attached");
3855 return 1;
3856 #endif /* CONFIG_FST */
3857 case WLAN_ACTION_PUBLIC:
3858 case WLAN_ACTION_PROTECTED_DUAL:
3859 #ifdef CONFIG_IEEE80211N
3860 if (len >= IEEE80211_HDRLEN + 2 &&
3861 mgmt->u.action.u.public_action.action ==
3862 WLAN_PA_20_40_BSS_COEX) {
3863 hostapd_2040_coex_action(hapd, mgmt, len);
3864 return 1;
3865 }
3866 #endif /* CONFIG_IEEE80211N */
3867 #ifdef CONFIG_DPP
3868 if (len >= IEEE80211_HDRLEN + 6 &&
3869 mgmt->u.action.u.vs_public_action.action ==
3870 WLAN_PA_VENDOR_SPECIFIC &&
3871 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
3872 OUI_WFA &&
3873 mgmt->u.action.u.vs_public_action.variable[0] ==
3874 DPP_OUI_TYPE) {
3875 const u8 *pos, *end;
3876
3877 pos = mgmt->u.action.u.vs_public_action.oui;
3878 end = ((const u8 *) mgmt) + len;
3879 hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos,
3880 freq);
3881 return 1;
3882 }
3883 if (len >= IEEE80211_HDRLEN + 2 &&
3884 (mgmt->u.action.u.public_action.action ==
3885 WLAN_PA_GAS_INITIAL_RESP ||
3886 mgmt->u.action.u.public_action.action ==
3887 WLAN_PA_GAS_COMEBACK_RESP)) {
3888 const u8 *pos, *end;
3889
3890 pos = &mgmt->u.action.u.public_action.action;
3891 end = ((const u8 *) mgmt) + len;
3892 gas_query_ap_rx(hapd->gas, mgmt->sa,
3893 mgmt->u.action.category,
3894 pos, end - pos, hapd->iface->freq);
3895 return 1;
3896 }
3897 #endif /* CONFIG_DPP */
3898 if (hapd->public_action_cb) {
3899 hapd->public_action_cb(hapd->public_action_cb_ctx,
3900 (u8 *) mgmt, len,
3901 hapd->iface->freq);
3902 }
3903 if (hapd->public_action_cb2) {
3904 hapd->public_action_cb2(hapd->public_action_cb2_ctx,
3905 (u8 *) mgmt, len,
3906 hapd->iface->freq);
3907 }
3908 if (hapd->public_action_cb || hapd->public_action_cb2)
3909 return 1;
3910 break;
3911 case WLAN_ACTION_VENDOR_SPECIFIC:
3912 if (hapd->vendor_action_cb) {
3913 if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
3914 (u8 *) mgmt, len,
3915 hapd->iface->freq) == 0)
3916 return 1;
3917 }
3918 break;
3919 case WLAN_ACTION_RADIO_MEASUREMENT:
3920 hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
3921 return 1;
3922 }
3923
3924 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3925 HOSTAPD_LEVEL_DEBUG,
3926 "handle_action - unknown action category %d or invalid "
3927 "frame",
3928 mgmt->u.action.category);
3929 if (!is_multicast_ether_addr(mgmt->da) &&
3930 !(mgmt->u.action.category & 0x80) &&
3931 !is_multicast_ether_addr(mgmt->sa)) {
3932 struct ieee80211_mgmt *resp;
3933
3934 /*
3935 * IEEE 802.11-REVma/D9.0 - 7.3.1.11
3936 * Return the Action frame to the source without change
3937 * except that MSB of the Category set to 1.
3938 */
3939 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
3940 "frame back to sender");
3941 resp = os_memdup(mgmt, len);
3942 if (resp == NULL)
3943 return 0;
3944 os_memcpy(resp->da, resp->sa, ETH_ALEN);
3945 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
3946 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
3947 resp->u.action.category |= 0x80;
3948
3949 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
3950 wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
3951 "Action frame");
3952 }
3953 os_free(resp);
3954 }
3955
3956 return 1;
3957 }
3958
3959
3960 /**
3961 * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
3962 * @hapd: hostapd BSS data structure (the BSS to which the management frame was
3963 * sent to)
3964 * @buf: management frame data (starting from IEEE 802.11 header)
3965 * @len: length of frame data in octets
3966 * @fi: meta data about received frame (signal level, etc.)
3967 *
3968 * Process all incoming IEEE 802.11 management frames. This will be called for
3969 * each frame received from the kernel driver through wlan#ap interface. In
3970 * addition, it can be called to re-inserted pending frames (e.g., when using
3971 * external RADIUS server as an MAC ACL).
3972 */
3973 int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
3974 struct hostapd_frame_info *fi)
3975 {
3976 struct ieee80211_mgmt *mgmt;
3977 u16 fc, stype;
3978 int ret = 0;
3979 unsigned int freq;
3980 int ssi_signal = fi ? fi->ssi_signal : 0;
3981
3982 if (len < 24)
3983 return 0;
3984
3985 if (fi && fi->freq)
3986 freq = fi->freq;
3987 else
3988 freq = hapd->iface->freq;
3989
3990 mgmt = (struct ieee80211_mgmt *) buf;
3991 fc = le_to_host16(mgmt->frame_control);
3992 stype = WLAN_FC_GET_STYPE(fc);
3993
3994 if (stype == WLAN_FC_STYPE_BEACON) {
3995 handle_beacon(hapd, mgmt, len, fi);
3996 return 1;
3997 }
3998
3999 if (!is_broadcast_ether_addr(mgmt->bssid) &&
4000 #ifdef CONFIG_P2P
4001 /* Invitation responses can be sent with the peer MAC as BSSID */
4002 !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
4003 stype == WLAN_FC_STYPE_ACTION) &&
4004 #endif /* CONFIG_P2P */
4005 #ifdef CONFIG_MESH
4006 !(hapd->conf->mesh & MESH_ENABLED) &&
4007 #endif /* CONFIG_MESH */
4008 os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
4009 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
4010 MAC2STR(mgmt->bssid));
4011 return 0;
4012 }
4013
4014
4015 if (stype == WLAN_FC_STYPE_PROBE_REQ) {
4016 handle_probe_req(hapd, mgmt, len, ssi_signal);
4017 return 1;
4018 }
4019
4020 if ((!is_broadcast_ether_addr(mgmt->da) ||
4021 stype != WLAN_FC_STYPE_ACTION) &&
4022 os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
4023 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4024 HOSTAPD_LEVEL_DEBUG,
4025 "MGMT: DA=" MACSTR " not our address",
4026 MAC2STR(mgmt->da));
4027 return 0;
4028 }
4029
4030 if (hapd->iconf->track_sta_max_num)
4031 sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
4032
4033 switch (stype) {
4034 case WLAN_FC_STYPE_AUTH:
4035 wpa_printf(MSG_DEBUG, "mgmt::auth");
4036 handle_auth(hapd, mgmt, len);
4037 ret = 1;
4038 break;
4039 case WLAN_FC_STYPE_ASSOC_REQ:
4040 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
4041 handle_assoc(hapd, mgmt, len, 0);
4042 ret = 1;
4043 break;
4044 case WLAN_FC_STYPE_REASSOC_REQ:
4045 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
4046 handle_assoc(hapd, mgmt, len, 1);
4047 ret = 1;
4048 break;
4049 case WLAN_FC_STYPE_DISASSOC:
4050 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
4051 handle_disassoc(hapd, mgmt, len);
4052 ret = 1;
4053 break;
4054 case WLAN_FC_STYPE_DEAUTH:
4055 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
4056 handle_deauth(hapd, mgmt, len);
4057 ret = 1;
4058 break;
4059 case WLAN_FC_STYPE_ACTION:
4060 wpa_printf(MSG_DEBUG, "mgmt::action");
4061 ret = handle_action(hapd, mgmt, len, freq);
4062 break;
4063 default:
4064 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4065 HOSTAPD_LEVEL_DEBUG,
4066 "unknown mgmt frame subtype %d", stype);
4067 break;
4068 }
4069
4070 return ret;
4071 }
4072
4073
4074 static void handle_auth_cb(struct hostapd_data *hapd,
4075 const struct ieee80211_mgmt *mgmt,
4076 size_t len, int ok)
4077 {
4078 u16 auth_alg, auth_transaction, status_code;
4079 struct sta_info *sta;
4080
4081 sta = ap_get_sta(hapd, mgmt->da);
4082 if (!sta) {
4083 wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR
4084 " not found",
4085 MAC2STR(mgmt->da));
4086 return;
4087 }
4088
4089 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
4090 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
4091 status_code = le_to_host16(mgmt->u.auth.status_code);
4092
4093 if (!ok) {
4094 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
4095 HOSTAPD_LEVEL_NOTICE,
4096 "did not acknowledge authentication response");
4097 goto fail;
4098 }
4099
4100 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
4101 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
4102 (unsigned long) len);
4103 goto fail;
4104 }
4105
4106 if (status_code == WLAN_STATUS_SUCCESS &&
4107 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
4108 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
4109 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4110 HOSTAPD_LEVEL_INFO, "authenticated");
4111 sta->flags |= WLAN_STA_AUTH;
4112 if (sta->added_unassoc)
4113 hostapd_set_sta_flags(hapd, sta);
4114 return;
4115 }
4116
4117 fail:
4118 if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) {
4119 hostapd_drv_sta_remove(hapd, sta->addr);
4120 sta->added_unassoc = 0;
4121 }
4122 }
4123
4124
4125 static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
4126 struct sta_info *sta,
4127 char *ifname_wds)
4128 {
4129 int i;
4130 struct hostapd_ssid *ssid = &hapd->conf->ssid;
4131
4132 if (hapd->conf->ieee802_1x || hapd->conf->wpa)
4133 return;
4134
4135 for (i = 0; i < 4; i++) {
4136 if (ssid->wep.key[i] &&
4137 hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
4138 i == ssid->wep.idx, NULL, 0,
4139 ssid->wep.key[i], ssid->wep.len[i])) {
4140 wpa_printf(MSG_WARNING,
4141 "Could not set WEP keys for WDS interface; %s",
4142 ifname_wds);
4143 break;
4144 }
4145 }
4146 }
4147
4148
4149 static void handle_assoc_cb(struct hostapd_data *hapd,
4150 const struct ieee80211_mgmt *mgmt,
4151 size_t len, int reassoc, int ok)
4152 {
4153 u16 status;
4154 struct sta_info *sta;
4155 int new_assoc = 1;
4156
4157 sta = ap_get_sta(hapd, mgmt->da);
4158 if (!sta) {
4159 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
4160 MAC2STR(mgmt->da));
4161 return;
4162 }
4163
4164 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
4165 sizeof(mgmt->u.assoc_resp))) {
4166 wpa_printf(MSG_INFO,
4167 "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
4168 reassoc, (unsigned long) len);
4169 hostapd_drv_sta_remove(hapd, sta->addr);
4170 return;
4171 }
4172
4173 if (reassoc)
4174 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
4175 else
4176 status = le_to_host16(mgmt->u.assoc_resp.status_code);
4177
4178 if (!ok) {
4179 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
4180 HOSTAPD_LEVEL_DEBUG,
4181 "did not acknowledge association response");
4182 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
4183 /* The STA is added only in case of SUCCESS */
4184 if (status == WLAN_STATUS_SUCCESS)
4185 hostapd_drv_sta_remove(hapd, sta->addr);
4186
4187 return;
4188 }
4189
4190 if (status != WLAN_STATUS_SUCCESS)
4191 return;
4192
4193 /* Stop previous accounting session, if one is started, and allocate
4194 * new session id for the new session. */
4195 accounting_sta_stop(hapd, sta);
4196
4197 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4198 HOSTAPD_LEVEL_INFO,
4199 "associated (aid %d)",
4200 sta->aid);
4201
4202 if (sta->flags & WLAN_STA_ASSOC)
4203 new_assoc = 0;
4204 sta->flags |= WLAN_STA_ASSOC;
4205 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
4206 if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
4207 !hapd->conf->osen) ||
4208 sta->auth_alg == WLAN_AUTH_FILS_SK ||
4209 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4210 sta->auth_alg == WLAN_AUTH_FILS_PK ||
4211 sta->auth_alg == WLAN_AUTH_FT) {
4212 /*
4213 * Open, static WEP, FT protocol, or FILS; no separate
4214 * authorization step.
4215 */
4216 ap_sta_set_authorized(hapd, sta, 1);
4217 }
4218
4219 if (reassoc)
4220 mlme_reassociate_indication(hapd, sta);
4221 else
4222 mlme_associate_indication(hapd, sta);
4223
4224 #ifdef CONFIG_IEEE80211W
4225 sta->sa_query_timed_out = 0;
4226 #endif /* CONFIG_IEEE80211W */
4227
4228 if (sta->eapol_sm == NULL) {
4229 /*
4230 * This STA does not use RADIUS server for EAP authentication,
4231 * so bind it to the selected VLAN interface now, since the
4232 * interface selection is not going to change anymore.
4233 */
4234 if (ap_sta_bind_vlan(hapd, sta) < 0)
4235 return;
4236 } else if (sta->vlan_id) {
4237 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
4238 if (ap_sta_bind_vlan(hapd, sta) < 0)
4239 return;
4240 }
4241
4242 hostapd_set_sta_flags(hapd, sta);
4243
4244 if (!(sta->flags & WLAN_STA_WDS) && sta->pending_wds_enable) {
4245 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for STA "
4246 MACSTR " based on pending request",
4247 MAC2STR(sta->addr));
4248 sta->pending_wds_enable = 0;
4249 sta->flags |= WLAN_STA_WDS;
4250 }
4251
4252 if (sta->flags & WLAN_STA_WDS) {
4253 int ret;
4254 char ifname_wds[IFNAMSIZ + 1];
4255
4256 wpa_printf(MSG_DEBUG, "Reenable 4-address WDS mode for STA "
4257 MACSTR " (aid %u)",
4258 MAC2STR(sta->addr), sta->aid);
4259 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
4260 sta->aid, 1);
4261 if (!ret)
4262 hostapd_set_wds_encryption(hapd, sta, ifname_wds);
4263 }
4264
4265 if (sta->auth_alg == WLAN_AUTH_FT)
4266 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
4267 else
4268 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
4269 hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
4270 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
4271
4272 #ifdef CONFIG_FILS
4273 if ((sta->auth_alg == WLAN_AUTH_FILS_SK ||
4274 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4275 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
4276 fils_set_tk(sta->wpa_sm) < 0) {
4277 wpa_printf(MSG_DEBUG, "FILS: TK configuration failed");
4278 ap_sta_disconnect(hapd, sta, sta->addr,
4279 WLAN_REASON_UNSPECIFIED);
4280 return;
4281 }
4282 #endif /* CONFIG_FILS */
4283
4284 if (sta->pending_eapol_rx) {
4285 struct os_reltime now, age;
4286
4287 os_get_reltime(&now);
4288 os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
4289 if (age.sec == 0 && age.usec < 200000) {
4290 wpa_printf(MSG_DEBUG,
4291 "Process pending EAPOL frame that was received from " MACSTR " just before association notification",
4292 MAC2STR(sta->addr));
4293 ieee802_1x_receive(
4294 hapd, mgmt->da,
4295 wpabuf_head(sta->pending_eapol_rx->buf),
4296 wpabuf_len(sta->pending_eapol_rx->buf));
4297 }
4298 wpabuf_free(sta->pending_eapol_rx->buf);
4299 os_free(sta->pending_eapol_rx);
4300 sta->pending_eapol_rx = NULL;
4301 }
4302 }
4303
4304
4305 static void handle_deauth_cb(struct hostapd_data *hapd,
4306 const struct ieee80211_mgmt *mgmt,
4307 size_t len, int ok)
4308 {
4309 struct sta_info *sta;
4310 if (is_multicast_ether_addr(mgmt->da))
4311 return;
4312 sta = ap_get_sta(hapd, mgmt->da);
4313 if (!sta) {
4314 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
4315 " not found", MAC2STR(mgmt->da));
4316 return;
4317 }
4318 if (ok)
4319 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
4320 MAC2STR(sta->addr));
4321 else
4322 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4323 "deauth", MAC2STR(sta->addr));
4324
4325 ap_sta_deauth_cb(hapd, sta);
4326 }
4327
4328
4329 static void handle_disassoc_cb(struct hostapd_data *hapd,
4330 const struct ieee80211_mgmt *mgmt,
4331 size_t len, int ok)
4332 {
4333 struct sta_info *sta;
4334 if (is_multicast_ether_addr(mgmt->da))
4335 return;
4336 sta = ap_get_sta(hapd, mgmt->da);
4337 if (!sta) {
4338 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
4339 " not found", MAC2STR(mgmt->da));
4340 return;
4341 }
4342 if (ok)
4343 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
4344 MAC2STR(sta->addr));
4345 else
4346 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4347 "disassoc", MAC2STR(sta->addr));
4348
4349 ap_sta_disassoc_cb(hapd, sta);
4350 }
4351
4352
4353 static void handle_action_cb(struct hostapd_data *hapd,
4354 const struct ieee80211_mgmt *mgmt,
4355 size_t len, int ok)
4356 {
4357 struct sta_info *sta;
4358 const struct rrm_measurement_report_element *report;
4359
4360 if (is_multicast_ether_addr(mgmt->da))
4361 return;
4362 #ifdef CONFIG_DPP
4363 if (len >= IEEE80211_HDRLEN + 6 &&
4364 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4365 mgmt->u.action.u.vs_public_action.action ==
4366 WLAN_PA_VENDOR_SPECIFIC &&
4367 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
4368 OUI_WFA &&
4369 mgmt->u.action.u.vs_public_action.variable[0] ==
4370 DPP_OUI_TYPE) {
4371 const u8 *pos, *end;
4372
4373 pos = &mgmt->u.action.u.vs_public_action.variable[1];
4374 end = ((const u8 *) mgmt) + len;
4375 hostapd_dpp_tx_status(hapd, mgmt->da, pos, end - pos, ok);
4376 return;
4377 }
4378 if (len >= IEEE80211_HDRLEN + 2 &&
4379 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4380 (mgmt->u.action.u.public_action.action ==
4381 WLAN_PA_GAS_INITIAL_REQ ||
4382 mgmt->u.action.u.public_action.action ==
4383 WLAN_PA_GAS_COMEBACK_REQ)) {
4384 const u8 *pos, *end;
4385
4386 pos = mgmt->u.action.u.public_action.variable;
4387 end = ((const u8 *) mgmt) + len;
4388 gas_query_ap_tx_status(hapd->gas, mgmt->da, pos, end - pos, ok);
4389 return;
4390 }
4391 #endif /* CONFIG_DPP */
4392 sta = ap_get_sta(hapd, mgmt->da);
4393 if (!sta) {
4394 wpa_printf(MSG_DEBUG, "handle_action_cb: STA " MACSTR
4395 " not found", MAC2STR(mgmt->da));
4396 return;
4397 }
4398
4399 if (len < 24 + 5 + sizeof(*report))
4400 return;
4401 report = (const struct rrm_measurement_report_element *)
4402 &mgmt->u.action.u.rrm.variable[2];
4403 if (mgmt->u.action.category == WLAN_ACTION_RADIO_MEASUREMENT &&
4404 mgmt->u.action.u.rrm.action == WLAN_RRM_RADIO_MEASUREMENT_REQUEST &&
4405 report->eid == WLAN_EID_MEASURE_REQUEST &&
4406 report->len >= 3 &&
4407 report->type == MEASURE_TYPE_BEACON)
4408 hostapd_rrm_beacon_req_tx_status(hapd, mgmt, len, ok);
4409 }
4410
4411
4412 /**
4413 * ieee802_11_mgmt_cb - Process management frame TX status callback
4414 * @hapd: hostapd BSS data structure (the BSS from which the management frame
4415 * was sent from)
4416 * @buf: management frame data (starting from IEEE 802.11 header)
4417 * @len: length of frame data in octets
4418 * @stype: management frame subtype from frame control field
4419 * @ok: Whether the frame was ACK'ed
4420 */
4421 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
4422 u16 stype, int ok)
4423 {
4424 const struct ieee80211_mgmt *mgmt;
4425 mgmt = (const struct ieee80211_mgmt *) buf;
4426
4427 #ifdef CONFIG_TESTING_OPTIONS
4428 if (hapd->ext_mgmt_frame_handling) {
4429 size_t hex_len = 2 * len + 1;
4430 char *hex = os_malloc(hex_len);
4431
4432 if (hex) {
4433 wpa_snprintf_hex(hex, hex_len, buf, len);
4434 wpa_msg(hapd->msg_ctx, MSG_INFO,
4435 "MGMT-TX-STATUS stype=%u ok=%d buf=%s",
4436 stype, ok, hex);
4437 os_free(hex);
4438 }
4439 return;
4440 }
4441 #endif /* CONFIG_TESTING_OPTIONS */
4442
4443 switch (stype) {
4444 case WLAN_FC_STYPE_AUTH:
4445 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
4446 handle_auth_cb(hapd, mgmt, len, ok);
4447 break;
4448 case WLAN_FC_STYPE_ASSOC_RESP:
4449 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
4450 handle_assoc_cb(hapd, mgmt, len, 0, ok);
4451 break;
4452 case WLAN_FC_STYPE_REASSOC_RESP:
4453 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
4454 handle_assoc_cb(hapd, mgmt, len, 1, ok);
4455 break;
4456 case WLAN_FC_STYPE_PROBE_RESP:
4457 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok);
4458 break;
4459 case WLAN_FC_STYPE_DEAUTH:
4460 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
4461 handle_deauth_cb(hapd, mgmt, len, ok);
4462 break;
4463 case WLAN_FC_STYPE_DISASSOC:
4464 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
4465 handle_disassoc_cb(hapd, mgmt, len, ok);
4466 break;
4467 case WLAN_FC_STYPE_ACTION:
4468 wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok);
4469 handle_action_cb(hapd, mgmt, len, ok);
4470 break;
4471 default:
4472 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
4473 break;
4474 }
4475 }
4476
4477
4478 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
4479 {
4480 /* TODO */
4481 return 0;
4482 }
4483
4484
4485 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
4486 char *buf, size_t buflen)
4487 {
4488 /* TODO */
4489 return 0;
4490 }
4491
4492
4493 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
4494 const u8 *buf, size_t len, int ack)
4495 {
4496 struct sta_info *sta;
4497 struct hostapd_iface *iface = hapd->iface;
4498
4499 sta = ap_get_sta(hapd, addr);
4500 if (sta == NULL && iface->num_bss > 1) {
4501 size_t j;
4502 for (j = 0; j < iface->num_bss; j++) {
4503 hapd = iface->bss[j];
4504 sta = ap_get_sta(hapd, addr);
4505 if (sta)
4506 break;
4507 }
4508 }
4509 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
4510 return;
4511 if (sta->flags & WLAN_STA_PENDING_POLL) {
4512 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
4513 "activity poll", MAC2STR(sta->addr),
4514 ack ? "ACKed" : "did not ACK");
4515 if (ack)
4516 sta->flags &= ~WLAN_STA_PENDING_POLL;
4517 }
4518
4519 ieee802_1x_tx_status(hapd, sta, buf, len, ack);
4520 }
4521
4522
4523 void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
4524 const u8 *data, size_t len, int ack)
4525 {
4526 struct sta_info *sta;
4527 struct hostapd_iface *iface = hapd->iface;
4528
4529 sta = ap_get_sta(hapd, dst);
4530 if (sta == NULL && iface->num_bss > 1) {
4531 size_t j;
4532 for (j = 0; j < iface->num_bss; j++) {
4533 hapd = iface->bss[j];
4534 sta = ap_get_sta(hapd, dst);
4535 if (sta)
4536 break;
4537 }
4538 }
4539 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
4540 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
4541 MACSTR " that is not currently associated",
4542 MAC2STR(dst));
4543 return;
4544 }
4545
4546 ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
4547 }
4548
4549
4550 void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
4551 {
4552 struct sta_info *sta;
4553 struct hostapd_iface *iface = hapd->iface;
4554
4555 sta = ap_get_sta(hapd, addr);
4556 if (sta == NULL && iface->num_bss > 1) {
4557 size_t j;
4558 for (j = 0; j < iface->num_bss; j++) {
4559 hapd = iface->bss[j];
4560 sta = ap_get_sta(hapd, addr);
4561 if (sta)
4562 break;
4563 }
4564 }
4565 if (sta == NULL)
4566 return;
4567 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
4568 MAC2STR(sta->addr));
4569 if (!(sta->flags & WLAN_STA_PENDING_POLL))
4570 return;
4571
4572 wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
4573 "activity poll", MAC2STR(sta->addr));
4574 sta->flags &= ~WLAN_STA_PENDING_POLL;
4575 }
4576
4577
4578 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
4579 int wds)
4580 {
4581 struct sta_info *sta;
4582
4583 sta = ap_get_sta(hapd, src);
4584 if (sta &&
4585 ((sta->flags & WLAN_STA_ASSOC) ||
4586 ((sta->flags & WLAN_STA_ASSOC_REQ_OK) && wds))) {
4587 if (!hapd->conf->wds_sta)
4588 return;
4589
4590 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK)) ==
4591 WLAN_STA_ASSOC_REQ_OK) {
4592 wpa_printf(MSG_DEBUG,
4593 "Postpone 4-address WDS mode enabling for STA "
4594 MACSTR " since TX status for AssocResp is not yet known",
4595 MAC2STR(sta->addr));
4596 sta->pending_wds_enable = 1;
4597 return;
4598 }
4599
4600 if (wds && !(sta->flags & WLAN_STA_WDS)) {
4601 int ret;
4602 char ifname_wds[IFNAMSIZ + 1];
4603
4604 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
4605 "STA " MACSTR " (aid %u)",
4606 MAC2STR(sta->addr), sta->aid);
4607 sta->flags |= WLAN_STA_WDS;
4608 ret = hostapd_set_wds_sta(hapd, ifname_wds,
4609 sta->addr, sta->aid, 1);
4610 if (!ret)
4611 hostapd_set_wds_encryption(hapd, sta,
4612 ifname_wds);
4613 }
4614 return;
4615 }
4616
4617 wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
4618 MACSTR, MAC2STR(src));
4619 if (is_multicast_ether_addr(src)) {
4620 /* Broadcast bit set in SA?! Ignore the frame silently. */
4621 return;
4622 }
4623
4624 if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
4625 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
4626 "already been sent, but no TX status yet known - "
4627 "ignore Class 3 frame issue with " MACSTR,
4628 MAC2STR(src));
4629 return;
4630 }
4631
4632 if (sta && (sta->flags & WLAN_STA_AUTH))
4633 hostapd_drv_sta_disassoc(
4634 hapd, src,
4635 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
4636 else
4637 hostapd_drv_sta_deauth(
4638 hapd, src,
4639 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
4640 }
4641
4642
4643 #endif /* CONFIG_NATIVE_WINDOWS */
Unnamed repository; edit this file 'description' to name the repository.