2 * WPA Supplicant - Client mode MLME
3 * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Alternatively, this software may be distributed under the terms of BSD
14 * See README and COPYING for more details.
21 #include "config_ssid.h"
22 #include "wpa_supplicant_i.h"
24 #include "drivers/driver.h"
25 #include "ieee802_11_defs.h"
29 /* Timeouts and intervals in milliseconds */
30 #define IEEE80211_AUTH_TIMEOUT (200)
31 #define IEEE80211_AUTH_MAX_TRIES 3
32 #define IEEE80211_ASSOC_TIMEOUT (200)
33 #define IEEE80211_ASSOC_MAX_TRIES 3
34 #define IEEE80211_MONITORING_INTERVAL (2000)
35 #define IEEE80211_PROBE_INTERVAL (60000)
36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
37 #define IEEE80211_SCAN_INTERVAL (2000)
38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
41 #define IEEE80211_PROBE_DELAY (33)
42 #define IEEE80211_CHANNEL_TIME (33)
43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
54 struct ieee80211_sta_bss
{
55 struct ieee80211_sta_bss
*next
;
56 struct ieee80211_sta_bss
*hnext
;
59 u8 ssid
[MAX_SSID_LEN
];
61 u16 capability
; /* host byte order */
76 #define IEEE80211_MAX_SUPP_RATES 32
77 u8 supp_rates
[IEEE80211_MAX_SUPP_RATES
];
78 size_t supp_rates_len
;
83 struct os_time last_update
;
87 static void ieee80211_send_probe_req(struct wpa_supplicant
*wpa_s
,
89 const u8
*ssid
, size_t ssid_len
);
90 static struct ieee80211_sta_bss
*
91 ieee80211_bss_get(struct wpa_supplicant
*wpa_s
, const u8
*bssid
);
92 static int ieee80211_sta_find_ibss(struct wpa_supplicant
*wpa_s
);
93 static int ieee80211_sta_wep_configured(struct wpa_supplicant
*wpa_s
);
94 static void ieee80211_sta_timer(void *eloop_ctx
, void *timeout_ctx
);
95 static void ieee80211_sta_scan_timer(void *eloop_ctx
, void *timeout_ctx
);
98 /* Parsed Information Elements */
99 struct ieee802_11_elems
{
123 u8 ext_supp_rates_len
;
134 typedef enum { ParseOK
= 0, ParseUnknown
= 1, ParseFailed
= -1 } ParseRes
;
137 static ParseRes
ieee802_11_parse_elems(u8
*start
, size_t len
,
138 struct ieee802_11_elems
*elems
)
144 os_memset(elems
, 0, sizeof(*elems
));
155 wpa_printf(MSG_MSGDUMP
, "MLME: IEEE 802.11 element "
156 "parse failed (id=%d elen=%d left=%d)",
165 elems
->ssid_len
= elen
;
167 case WLAN_EID_SUPP_RATES
:
168 elems
->supp_rates
= pos
;
169 elems
->supp_rates_len
= elen
;
171 case WLAN_EID_FH_PARAMS
:
172 elems
->fh_params
= pos
;
173 elems
->fh_params_len
= elen
;
175 case WLAN_EID_DS_PARAMS
:
176 elems
->ds_params
= pos
;
177 elems
->ds_params_len
= elen
;
179 case WLAN_EID_CF_PARAMS
:
180 elems
->cf_params
= pos
;
181 elems
->cf_params_len
= elen
;
185 elems
->tim_len
= elen
;
187 case WLAN_EID_IBSS_PARAMS
:
188 elems
->ibss_params
= pos
;
189 elems
->ibss_params_len
= elen
;
191 case WLAN_EID_CHALLENGE
:
192 elems
->challenge
= pos
;
193 elems
->challenge_len
= elen
;
195 case WLAN_EID_VENDOR_SPECIFIC
:
196 if (elen
>= 4 && pos
[0] == 0x00 && pos
[1] == 0x50 &&
198 /* Microsoft OUI (00:50:F2) */
200 /* OUI Type 1 - WPA IE */
202 elems
->wpa_len
= elen
;
203 } else if (elen
>= 5 && pos
[3] == 2) {
205 elems
->wmm_info
= pos
;
206 elems
->wmm_info_len
= elen
;
207 } else if (pos
[4] == 1) {
208 elems
->wmm_param
= pos
;
209 elems
->wmm_param_len
= elen
;
216 elems
->rsn_len
= elen
;
218 case WLAN_EID_ERP_INFO
:
219 elems
->erp_info
= pos
;
220 elems
->erp_info_len
= elen
;
222 case WLAN_EID_EXT_SUPP_RATES
:
223 elems
->ext_supp_rates
= pos
;
224 elems
->ext_supp_rates_len
= elen
;
226 case WLAN_EID_MOBILITY_DOMAIN
:
228 elems
->mdie_len
= elen
;
230 case WLAN_EID_FAST_BSS_TRANSITION
:
232 elems
->ftie_len
= elen
;
236 wpa_printf(MSG_MSGDUMP
"MLME: IEEE 802.11 element "
237 "parse ignored unknown element (id=%d "
238 "elen=%d)", id
, elen
);
251 return unknown
? ParseUnknown
: ParseOK
;
255 static int ieee80211_sta_set_channel(struct wpa_supplicant
*wpa_s
,
256 wpa_hw_mode phymode
, int chan
,
260 struct wpa_hw_modes
*mode
;
262 for (i
= 0; i
< wpa_s
->mlme
.num_modes
; i
++) {
263 mode
= &wpa_s
->mlme
.modes
[i
];
264 if (mode
->mode
== phymode
) {
265 wpa_s
->mlme
.curr_rates
= mode
->rates
;
266 wpa_s
->mlme
.num_curr_rates
= mode
->num_rates
;
271 return wpa_drv_set_channel(wpa_s
, phymode
, chan
, freq
);
277 static int ecw2cw(int ecw
)
289 static void ieee80211_sta_wmm_params(struct wpa_supplicant
*wpa_s
,
290 u8
*wmm_param
, size_t wmm_param_len
)
296 if (wmm_param_len
< 8 || wmm_param
[5] /* version */ != 1)
298 count
= wmm_param
[6] & 0x0f;
299 if (count
== wpa_s
->mlme
.wmm_last_param_set
)
301 wpa_s
->mlme
.wmm_last_param_set
= count
;
304 left
= wmm_param_len
- 8;
308 for (; left
>= 4; left
-= 4, pos
+= 4) {
309 int aci
= (pos
[0] >> 5) & 0x03;
310 int acm
= (pos
[0] >> 4) & 0x01;
315 queue
= IEEE80211_TX_QUEUE_DATA3
;
317 wmm_acm
|= BIT(1) | BIT(2);
320 queue
= IEEE80211_TX_QUEUE_DATA1
;
322 wmm_acm
|= BIT(4) | BIT(5);
325 queue
= IEEE80211_TX_QUEUE_DATA0
;
327 wmm_acm
|= BIT(6) | BIT(7);
331 queue
= IEEE80211_TX_QUEUE_DATA2
;
333 wpa_s
->mlme
.wmm_acm
|= BIT(0) | BIT(3);
337 params
.aifs
= pos
[0] & 0x0f;
338 params
.cw_max
= ecw2cw((pos
[1] & 0xf0) >> 4);
339 params
.cw_min
= ecw2cw(pos
[1] & 0x0f);
340 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
341 params
.burst_time
= (pos
[2] | (pos
[3] << 8)) * 32 / 100;
342 wpa_printf(MSG_DEBUG
, "MLME: WMM queue=%d aci=%d acm=%d "
343 "aifs=%d cWmin=%d cWmax=%d burst=%d",
344 queue
, aci
, acm
, params
.aifs
, params
.cw_min
,
345 params
.cw_max
, params
.burst_time
);
346 /* TODO: handle ACM (block TX, fallback to next lowest allowed
348 if (local
->hw
->conf_tx(local
->mdev
, queue
, ¶ms
)) {
349 wpa_printf(MSG_DEBUG
, "MLME: failed to set TX queue "
350 "parameters for queue %d", queue
);
357 static void ieee80211_set_associated(struct wpa_supplicant
*wpa_s
, int assoc
)
359 if (wpa_s
->mlme
.associated
== assoc
&& !assoc
)
362 wpa_s
->mlme
.associated
= assoc
;
365 union wpa_event_data data
;
366 os_memset(&data
, 0, sizeof(data
));
367 wpa_s
->mlme
.prev_bssid_set
= 1;
368 os_memcpy(wpa_s
->mlme
.prev_bssid
, wpa_s
->bssid
, ETH_ALEN
);
369 data
.assoc_info
.req_ies
= wpa_s
->mlme
.assocreq_ies
;
370 data
.assoc_info
.req_ies_len
= wpa_s
->mlme
.assocreq_ies_len
;
371 data
.assoc_info
.resp_ies
= wpa_s
->mlme
.assocresp_ies
;
372 data
.assoc_info
.resp_ies_len
= wpa_s
->mlme
.assocresp_ies_len
;
373 wpa_supplicant_event(wpa_s
, EVENT_ASSOC
, &data
);
375 wpa_supplicant_event(wpa_s
, EVENT_DISASSOC
, NULL
);
377 os_get_time(&wpa_s
->mlme
.last_probe
);
381 static int ieee80211_sta_tx(struct wpa_supplicant
*wpa_s
, const u8
*buf
,
384 return wpa_drv_send_mlme(wpa_s
, buf
, len
);
388 static void ieee80211_send_auth(struct wpa_supplicant
*wpa_s
,
389 int transaction
, u8
*extra
, size_t extra_len
,
394 struct ieee80211_mgmt
*mgmt
;
396 buf
= os_malloc(sizeof(*mgmt
) + 6 + extra_len
);
398 wpa_printf(MSG_DEBUG
, "MLME: failed to allocate buffer for "
403 mgmt
= (struct ieee80211_mgmt
*) buf
;
405 os_memset(mgmt
, 0, 24 + 6);
406 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
409 mgmt
->frame_control
|= host_to_le16(WLAN_FC_ISWEP
);
410 os_memcpy(mgmt
->da
, wpa_s
->bssid
, ETH_ALEN
);
411 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
412 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
413 mgmt
->u
.auth
.auth_alg
= host_to_le16(wpa_s
->mlme
.auth_alg
);
414 mgmt
->u
.auth
.auth_transaction
= host_to_le16(transaction
);
415 wpa_s
->mlme
.auth_transaction
= transaction
+ 1;
416 mgmt
->u
.auth
.status_code
= host_to_le16(0);
418 os_memcpy(buf
+ len
, extra
, extra_len
);
422 ieee80211_sta_tx(wpa_s
, buf
, len
);
427 static void ieee80211_reschedule_timer(struct wpa_supplicant
*wpa_s
, int ms
)
429 eloop_cancel_timeout(ieee80211_sta_timer
, wpa_s
, NULL
);
430 eloop_register_timeout(ms
/ 1000, 1000 * (ms
% 1000),
431 ieee80211_sta_timer
, wpa_s
, NULL
);
435 static void ieee80211_authenticate(struct wpa_supplicant
*wpa_s
)
440 wpa_s
->mlme
.auth_tries
++;
441 if (wpa_s
->mlme
.auth_tries
> IEEE80211_AUTH_MAX_TRIES
) {
442 wpa_printf(MSG_DEBUG
, "MLME: authentication with AP " MACSTR
443 " timed out", MAC2STR(wpa_s
->bssid
));
447 wpa_s
->mlme
.state
= IEEE80211_AUTHENTICATE
;
448 wpa_printf(MSG_DEBUG
, "MLME: authenticate with AP " MACSTR
,
449 MAC2STR(wpa_s
->bssid
));
454 #ifdef CONFIG_IEEE80211R
455 if ((wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_802_1X
||
456 wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_PSK
) &&
457 wpa_s
->mlme
.ft_ies
) {
458 struct ieee80211_sta_bss
*bss
;
459 struct rsn_mdie
*mdie
= NULL
;
460 bss
= ieee80211_bss_get(wpa_s
, wpa_s
->bssid
);
461 if (bss
&& bss
->mdie_len
>= 2 + sizeof(*mdie
))
462 mdie
= (struct rsn_mdie
*) (bss
->mdie
+ 2);
464 os_memcmp(mdie
->mobility_domain
, wpa_s
->mlme
.current_md
,
465 MOBILITY_DOMAIN_ID_LEN
) == 0) {
466 wpa_printf(MSG_DEBUG
, "MLME: Trying to use FT "
468 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_FT
;
469 extra
= wpa_s
->mlme
.ft_ies
;
470 extra_len
= wpa_s
->mlme
.ft_ies_len
;
473 #endif /* CONFIG_IEEE80211R */
475 ieee80211_send_auth(wpa_s
, 1, extra
, extra_len
, 0);
477 ieee80211_reschedule_timer(wpa_s
, IEEE80211_AUTH_TIMEOUT
);
481 static void ieee80211_send_assoc(struct wpa_supplicant
*wpa_s
)
483 struct ieee80211_mgmt
*mgmt
;
487 struct ieee80211_sta_bss
*bss
;
491 if (wpa_s
->mlme
.curr_rates
== NULL
) {
492 wpa_printf(MSG_DEBUG
, "MLME: curr_rates not set for assoc");
496 buflen
= sizeof(*mgmt
) + 200 + wpa_s
->mlme
.extra_ie_len
+
497 wpa_s
->mlme
.ssid_len
;
498 #ifdef CONFIG_IEEE80211R
499 if (wpa_s
->mlme
.ft_ies
)
500 buflen
+= wpa_s
->mlme
.ft_ies_len
;
501 #endif /* CONFIG_IEEE80211R */
502 buf
= os_malloc(buflen
);
504 wpa_printf(MSG_DEBUG
, "MLME: failed to allocate buffer for "
510 capab
= wpa_s
->mlme
.capab
;
511 if (wpa_s
->mlme
.phymode
== WPA_MODE_IEEE80211G
) {
512 capab
|= WLAN_CAPABILITY_SHORT_SLOT_TIME
|
513 WLAN_CAPABILITY_SHORT_PREAMBLE
;
515 bss
= ieee80211_bss_get(wpa_s
, wpa_s
->bssid
);
517 if (bss
->capability
& WLAN_CAPABILITY_PRIVACY
)
518 capab
|= WLAN_CAPABILITY_PRIVACY
;
524 mgmt
= (struct ieee80211_mgmt
*) buf
;
526 os_memset(mgmt
, 0, 24);
527 os_memcpy(mgmt
->da
, wpa_s
->bssid
, ETH_ALEN
);
528 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
529 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
531 if (wpa_s
->mlme
.prev_bssid_set
) {
533 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
534 WLAN_FC_STYPE_REASSOC_REQ
);
535 mgmt
->u
.reassoc_req
.capab_info
= host_to_le16(capab
);
536 mgmt
->u
.reassoc_req
.listen_interval
= host_to_le16(1);
537 os_memcpy(mgmt
->u
.reassoc_req
.current_ap
,
538 wpa_s
->mlme
.prev_bssid
,
542 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
543 WLAN_FC_STYPE_ASSOC_REQ
);
544 mgmt
->u
.assoc_req
.capab_info
= host_to_le16(capab
);
545 mgmt
->u
.assoc_req
.listen_interval
= host_to_le16(1);
549 ies
= pos
= buf
+ blen
;
550 blen
+= 2 + wpa_s
->mlme
.ssid_len
;
551 *pos
++ = WLAN_EID_SSID
;
552 *pos
++ = wpa_s
->mlme
.ssid_len
;
553 os_memcpy(pos
, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
);
555 len
= wpa_s
->mlme
.num_curr_rates
;
560 *pos
++ = WLAN_EID_SUPP_RATES
;
562 for (i
= 0; i
< len
; i
++) {
563 int rate
= wpa_s
->mlme
.curr_rates
[i
].rate
;
564 *pos
++ = (u8
) (rate
/ 5);
567 if (wpa_s
->mlme
.num_curr_rates
> len
) {
569 blen
+= wpa_s
->mlme
.num_curr_rates
- len
+ 2;
570 *pos
++ = WLAN_EID_EXT_SUPP_RATES
;
571 *pos
++ = wpa_s
->mlme
.num_curr_rates
- len
;
572 for (i
= len
; i
< wpa_s
->mlme
.num_curr_rates
; i
++) {
573 int rate
= wpa_s
->mlme
.curr_rates
[i
].rate
;
574 *pos
++ = (u8
) (rate
/ 5);
578 if (wpa_s
->mlme
.extra_ie
&& wpa_s
->mlme
.auth_alg
!= WLAN_AUTH_FT
) {
580 blen
+= wpa_s
->mlme
.extra_ie_len
;
581 os_memcpy(pos
, wpa_s
->mlme
.extra_ie
, wpa_s
->mlme
.extra_ie_len
);
584 #ifdef CONFIG_IEEE80211R
585 if ((wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_802_1X
||
586 wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_PSK
) &&
587 wpa_s
->mlme
.auth_alg
!= WLAN_AUTH_FT
&&
589 bss
->mdie_len
>= 2 + sizeof(struct rsn_mdie
) &&
590 bss
->mdie
[1] >= sizeof(struct rsn_mdie
)) {
592 blen
+= 2 + sizeof(struct rsn_mdie
);
593 *pos
++ = WLAN_EID_MOBILITY_DOMAIN
;
594 *pos
++ = sizeof(struct rsn_mdie
);
595 os_memcpy(pos
, bss
->mdie
+ 2, MOBILITY_DOMAIN_ID_LEN
);
596 pos
+= MOBILITY_DOMAIN_ID_LEN
;
597 *pos
++ = 0; /* FIX: copy from the target AP's MDIE */
600 if ((wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_802_1X
||
601 wpa_s
->mlme
.key_mgmt
== KEY_MGMT_FT_PSK
) &&
602 wpa_s
->mlme
.auth_alg
== WLAN_AUTH_FT
&& wpa_s
->mlme
.ft_ies
) {
604 os_memcpy(pos
, wpa_s
->mlme
.ft_ies
, wpa_s
->mlme
.ft_ies_len
);
605 pos
+= wpa_s
->mlme
.ft_ies_len
;
606 blen
+= wpa_s
->mlme
.ft_ies_len
;
608 #endif /* CONFIG_IEEE80211R */
610 if (wmm
&& wpa_s
->mlme
.wmm_enabled
) {
613 *pos
++ = WLAN_EID_VENDOR_SPECIFIC
;
614 *pos
++ = 7; /* len */
615 *pos
++ = 0x00; /* Microsoft OUI 00:50:F2 */
618 *pos
++ = 2; /* WME */
619 *pos
++ = 0; /* WME info */
620 *pos
++ = 1; /* WME ver */
624 os_free(wpa_s
->mlme
.assocreq_ies
);
625 wpa_s
->mlme
.assocreq_ies_len
= (buf
+ blen
) - ies
;
626 wpa_s
->mlme
.assocreq_ies
= os_malloc(wpa_s
->mlme
.assocreq_ies_len
);
627 if (wpa_s
->mlme
.assocreq_ies
) {
628 os_memcpy(wpa_s
->mlme
.assocreq_ies
, ies
,
629 wpa_s
->mlme
.assocreq_ies_len
);
632 ieee80211_sta_tx(wpa_s
, buf
, blen
);
637 static void ieee80211_send_deauth(struct wpa_supplicant
*wpa_s
, u16 reason
)
641 struct ieee80211_mgmt
*mgmt
;
643 buf
= os_zalloc(sizeof(*mgmt
));
645 wpa_printf(MSG_DEBUG
, "MLME: failed to allocate buffer for "
650 mgmt
= (struct ieee80211_mgmt
*) buf
;
652 os_memcpy(mgmt
->da
, wpa_s
->bssid
, ETH_ALEN
);
653 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
654 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
655 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
656 WLAN_FC_STYPE_DEAUTH
);
658 mgmt
->u
.deauth
.reason_code
= host_to_le16(reason
);
660 ieee80211_sta_tx(wpa_s
, buf
, len
);
665 static void ieee80211_send_disassoc(struct wpa_supplicant
*wpa_s
, u16 reason
)
669 struct ieee80211_mgmt
*mgmt
;
671 buf
= os_zalloc(sizeof(*mgmt
));
673 wpa_printf(MSG_DEBUG
, "MLME: failed to allocate buffer for "
678 mgmt
= (struct ieee80211_mgmt
*) buf
;
680 os_memcpy(mgmt
->da
, wpa_s
->bssid
, ETH_ALEN
);
681 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
682 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
683 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
684 WLAN_FC_STYPE_DISASSOC
);
686 mgmt
->u
.disassoc
.reason_code
= host_to_le16(reason
);
688 ieee80211_sta_tx(wpa_s
, buf
, len
);
693 static int ieee80211_privacy_mismatch(struct wpa_supplicant
*wpa_s
)
695 struct ieee80211_sta_bss
*bss
;
698 if (wpa_s
->mlme
.mixed_cell
||
699 wpa_s
->mlme
.key_mgmt
!= KEY_MGMT_NONE
)
702 bss
= ieee80211_bss_get(wpa_s
, wpa_s
->bssid
);
706 if (ieee80211_sta_wep_configured(wpa_s
) !=
707 !!(bss
->capability
& WLAN_CAPABILITY_PRIVACY
))
714 static void ieee80211_associate(struct wpa_supplicant
*wpa_s
)
716 wpa_s
->mlme
.assoc_tries
++;
717 if (wpa_s
->mlme
.assoc_tries
> IEEE80211_ASSOC_MAX_TRIES
) {
718 wpa_printf(MSG_DEBUG
, "MLME: association with AP " MACSTR
719 " timed out", MAC2STR(wpa_s
->bssid
));
723 wpa_s
->mlme
.state
= IEEE80211_ASSOCIATE
;
724 wpa_printf(MSG_DEBUG
, "MLME: associate with AP " MACSTR
,
725 MAC2STR(wpa_s
->bssid
));
726 if (ieee80211_privacy_mismatch(wpa_s
)) {
727 wpa_printf(MSG_DEBUG
, "MLME: mismatch in privacy "
728 "configuration and mixed-cell disabled - abort "
733 ieee80211_send_assoc(wpa_s
);
735 ieee80211_reschedule_timer(wpa_s
, IEEE80211_ASSOC_TIMEOUT
);
739 static void ieee80211_associated(struct wpa_supplicant
*wpa_s
)
743 /* TODO: start monitoring current AP signal quality and number of
744 * missed beacons. Scan other channels every now and then and search
746 /* TODO: remove expired BSSes */
748 wpa_s
->mlme
.state
= IEEE80211_ASSOCIATED
;
751 sta
= sta_info_get(local
, wpa_s
->bssid
);
753 wpa_printf(MSG_DEBUG
"MLME: No STA entry for own AP " MACSTR
,
754 MAC2STR(wpa_s
->bssid
));
758 if (time_after(jiffies
,
759 sta
->last_rx
+ IEEE80211_MONITORING_INTERVAL
)) {
760 if (wpa_s
->mlme
.probereq_poll
) {
761 wpa_printf(MSG_DEBUG
"MLME: No ProbeResp from "
762 "current AP " MACSTR
" - assume "
764 MAC2STR(wpa_s
->bssid
));
767 ieee80211_send_probe_req(
769 wpa_s
->mlme
.scan_ssid
,
770 wpa_s
->mlme
.scan_ssid_len
);
771 wpa_s
->mlme
.probereq_poll
= 1;
774 wpa_s
->mlme
.probereq_poll
= 0;
775 if (time_after(jiffies
, wpa_s
->mlme
.last_probe
+
776 IEEE80211_PROBE_INTERVAL
)) {
777 wpa_s
->mlme
.last_probe
= jiffies
;
778 ieee80211_send_probe_req(wpa_s
->bssid
,
780 wpa_s
->mlme
.ssid_len
);
783 sta_info_release(local
, sta
);
789 wpa_supplicant_event(wpa_s
, EVENT_DISASSOC
, NULL
);
790 ieee80211_reschedule_timer(wpa_s
,
791 IEEE80211_MONITORING_INTERVAL
+
794 ieee80211_reschedule_timer(wpa_s
,
795 IEEE80211_MONITORING_INTERVAL
);
800 static void ieee80211_send_probe_req(struct wpa_supplicant
*wpa_s
,
802 const u8
*ssid
, size_t ssid_len
)
806 struct ieee80211_mgmt
*mgmt
;
807 u8
*pos
, *supp_rates
;
808 u8
*esupp_rates
= NULL
;
811 buf
= os_malloc(sizeof(*mgmt
) + 200 + wpa_s
->mlme
.extra_probe_ie_len
);
813 wpa_printf(MSG_DEBUG
, "MLME: failed to allocate buffer for "
818 mgmt
= (struct ieee80211_mgmt
*) buf
;
820 os_memset(mgmt
, 0, 24);
821 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
822 WLAN_FC_STYPE_PROBE_REQ
);
823 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
825 os_memcpy(mgmt
->da
, dst
, ETH_ALEN
);
826 os_memcpy(mgmt
->bssid
, dst
, ETH_ALEN
);
828 os_memset(mgmt
->da
, 0xff, ETH_ALEN
);
829 os_memset(mgmt
->bssid
, 0xff, ETH_ALEN
);
833 *pos
++ = WLAN_EID_SSID
;
835 os_memcpy(pos
, ssid
, ssid_len
);
837 supp_rates
= buf
+ len
;
839 supp_rates
[0] = WLAN_EID_SUPP_RATES
;
841 for (i
= 0; i
< wpa_s
->mlme
.num_curr_rates
; i
++) {
842 struct wpa_rate_data
*rate
= &wpa_s
->mlme
.curr_rates
[i
];
847 } else if (supp_rates
[1] == 8) {
849 esupp_rates
[0] = WLAN_EID_EXT_SUPP_RATES
;
851 pos
= &esupp_rates
[2];
858 *pos
++ = rate
->rate
/ 5;
861 if (wpa_s
->mlme
.extra_probe_ie
) {
862 os_memcpy(pos
, wpa_s
->mlme
.extra_probe_ie
,
863 wpa_s
->mlme
.extra_probe_ie_len
);
864 len
+= wpa_s
->mlme
.extra_probe_ie_len
;
867 ieee80211_sta_tx(wpa_s
, buf
, len
);
872 static int ieee80211_sta_wep_configured(struct wpa_supplicant
*wpa_s
)
875 if (sdata
== NULL
|| sdata
->default_key
== NULL
||
876 sdata
->default_key
->alg
!= ALG_WEP
)
885 static void ieee80211_auth_completed(struct wpa_supplicant
*wpa_s
)
887 wpa_printf(MSG_DEBUG
, "MLME: authenticated");
888 wpa_s
->mlme
.authenticated
= 1;
889 ieee80211_associate(wpa_s
);
893 static void ieee80211_auth_challenge(struct wpa_supplicant
*wpa_s
,
894 struct ieee80211_mgmt
*mgmt
,
896 struct ieee80211_rx_status
*rx_status
)
899 struct ieee802_11_elems elems
;
901 wpa_printf(MSG_DEBUG
, "MLME: replying to auth challenge");
902 pos
= mgmt
->u
.auth
.variable
;
903 if (ieee802_11_parse_elems(pos
, len
- (pos
- (u8
*) mgmt
), &elems
)
905 wpa_printf(MSG_DEBUG
, "MLME: failed to parse Auth(challenge)");
908 if (elems
.challenge
== NULL
) {
909 wpa_printf(MSG_DEBUG
, "MLME: no challenge IE in shared key "
913 ieee80211_send_auth(wpa_s
, 3, elems
.challenge
- 2,
914 elems
.challenge_len
+ 2, 1);
918 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant
*wpa_s
,
919 struct ieee80211_mgmt
*mgmt
,
921 struct ieee80211_rx_status
*rx_status
)
923 struct wpa_ssid
*ssid
= wpa_s
->current_ssid
;
924 u16 auth_alg
, auth_transaction
, status_code
;
927 adhoc
= ssid
&& ssid
->mode
== 1;
929 if (wpa_s
->mlme
.state
!= IEEE80211_AUTHENTICATE
&& !adhoc
) {
930 wpa_printf(MSG_DEBUG
, "MLME: authentication frame received "
931 "from " MACSTR
", but not in authenticate state - "
932 "ignored", MAC2STR(mgmt
->sa
));
937 wpa_printf(MSG_DEBUG
, "MLME: too short (%lu) authentication "
938 "frame received from " MACSTR
" - ignored",
939 (unsigned long) len
, MAC2STR(mgmt
->sa
));
943 if (!adhoc
&& os_memcmp(wpa_s
->bssid
, mgmt
->sa
, ETH_ALEN
) != 0) {
944 wpa_printf(MSG_DEBUG
, "MLME: authentication frame received "
945 "from unknown AP (SA=" MACSTR
" BSSID=" MACSTR
947 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
));
951 if (adhoc
&& os_memcmp(wpa_s
->bssid
, mgmt
->bssid
, ETH_ALEN
) != 0) {
952 wpa_printf(MSG_DEBUG
, "MLME: authentication frame received "
953 "from unknown BSSID (SA=" MACSTR
" BSSID=" MACSTR
955 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
));
959 auth_alg
= le_to_host16(mgmt
->u
.auth
.auth_alg
);
960 auth_transaction
= le_to_host16(mgmt
->u
.auth
.auth_transaction
);
961 status_code
= le_to_host16(mgmt
->u
.auth
.status_code
);
963 wpa_printf(MSG_DEBUG
, "MLME: RX authentication from " MACSTR
964 " (alg=%d transaction=%d status=%d)",
965 MAC2STR(mgmt
->sa
), auth_alg
, auth_transaction
, status_code
);
968 /* IEEE 802.11 standard does not require authentication in IBSS
969 * networks and most implementations do not seem to use it.
970 * However, try to reply to authentication attempts if someone
971 * has actually implemented this.
972 * TODO: Could implement shared key authentication. */
973 if (auth_alg
!= WLAN_AUTH_OPEN
|| auth_transaction
!= 1) {
974 wpa_printf(MSG_DEBUG
, "MLME: unexpected IBSS "
975 "authentication frame (alg=%d "
977 auth_alg
, auth_transaction
);
980 ieee80211_send_auth(wpa_s
, 2, NULL
, 0, 0);
983 if (auth_alg
!= wpa_s
->mlme
.auth_alg
||
984 auth_transaction
!= wpa_s
->mlme
.auth_transaction
) {
985 wpa_printf(MSG_DEBUG
, "MLME: unexpected authentication frame "
986 "(alg=%d transaction=%d)",
987 auth_alg
, auth_transaction
);
991 if (status_code
!= WLAN_STATUS_SUCCESS
) {
992 wpa_printf(MSG_DEBUG
, "MLME: AP denied authentication "
993 "(auth_alg=%d code=%d)", wpa_s
->mlme
.auth_alg
,
995 if (status_code
== WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG
) {
996 const int num_algs
= 3;
999 algs
[0] = algs
[1] = algs
[2] = 0xff;
1000 if (wpa_s
->mlme
.auth_algs
& IEEE80211_AUTH_ALG_OPEN
)
1001 algs
[0] = WLAN_AUTH_OPEN
;
1002 if (wpa_s
->mlme
.auth_algs
&
1003 IEEE80211_AUTH_ALG_SHARED_KEY
)
1004 algs
[1] = WLAN_AUTH_SHARED_KEY
;
1005 if (wpa_s
->mlme
.auth_algs
& IEEE80211_AUTH_ALG_LEAP
)
1006 algs
[2] = WLAN_AUTH_LEAP
;
1007 if (wpa_s
->mlme
.auth_alg
== WLAN_AUTH_OPEN
)
1009 else if (wpa_s
->mlme
.auth_alg
== WLAN_AUTH_SHARED_KEY
)
1013 for (i
= 0; i
< num_algs
; i
++) {
1015 if (pos
>= num_algs
)
1017 if (algs
[pos
] == wpa_s
->mlme
.auth_alg
||
1020 if (algs
[pos
] == WLAN_AUTH_SHARED_KEY
&&
1021 !ieee80211_sta_wep_configured(wpa_s
))
1023 wpa_s
->mlme
.auth_alg
= algs
[pos
];
1024 wpa_printf(MSG_DEBUG
, "MLME: set auth_alg=%d "
1026 wpa_s
->mlme
.auth_alg
);
1033 switch (wpa_s
->mlme
.auth_alg
) {
1034 case WLAN_AUTH_OPEN
:
1035 case WLAN_AUTH_LEAP
:
1036 ieee80211_auth_completed(wpa_s
);
1038 case WLAN_AUTH_SHARED_KEY
:
1039 if (wpa_s
->mlme
.auth_transaction
== 4)
1040 ieee80211_auth_completed(wpa_s
);
1042 ieee80211_auth_challenge(wpa_s
, mgmt
, len
,
1045 #ifdef CONFIG_IEEE80211R
1048 union wpa_event_data data
;
1049 os_memset(&data
, 0, sizeof(data
));
1050 data
.ft_ies
.ies
= mgmt
->u
.auth
.variable
;
1051 data
.ft_ies
.ies_len
= len
-
1052 (mgmt
->u
.auth
.variable
- (u8
*) mgmt
);
1053 os_memcpy(data
.ft_ies
.target_ap
, wpa_s
->bssid
, ETH_ALEN
);
1054 wpa_supplicant_event(wpa_s
, EVENT_FT_RESPONSE
, &data
);
1055 ieee80211_auth_completed(wpa_s
);
1058 #endif /* CONFIG_IEEE80211R */
1063 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant
*wpa_s
,
1064 struct ieee80211_mgmt
*mgmt
,
1066 struct ieee80211_rx_status
*rx_status
)
1071 wpa_printf(MSG_DEBUG
, "MLME: too short (%lu) deauthentication "
1072 "frame received from " MACSTR
" - ignored",
1073 (unsigned long) len
, MAC2STR(mgmt
->sa
));
1077 if (os_memcmp(wpa_s
->bssid
, mgmt
->sa
, ETH_ALEN
) != 0) {
1078 wpa_printf(MSG_DEBUG
, "MLME: deauthentication frame received "
1079 "from unknown AP (SA=" MACSTR
" BSSID=" MACSTR
1081 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
));
1085 reason_code
= le_to_host16(mgmt
->u
.deauth
.reason_code
);
1087 wpa_printf(MSG_DEBUG
, "MLME: RX deauthentication from " MACSTR
1088 " (reason=%d)", MAC2STR(mgmt
->sa
), reason_code
);
1090 if (wpa_s
->mlme
.authenticated
)
1091 wpa_printf(MSG_DEBUG
, "MLME: deauthenticated");
1093 if (wpa_s
->mlme
.state
== IEEE80211_AUTHENTICATE
||
1094 wpa_s
->mlme
.state
== IEEE80211_ASSOCIATE
||
1095 wpa_s
->mlme
.state
== IEEE80211_ASSOCIATED
) {
1096 wpa_s
->mlme
.state
= IEEE80211_AUTHENTICATE
;
1097 ieee80211_reschedule_timer(wpa_s
,
1098 IEEE80211_RETRY_AUTH_INTERVAL
);
1101 ieee80211_set_associated(wpa_s
, 0);
1102 wpa_s
->mlme
.authenticated
= 0;
1106 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant
*wpa_s
,
1107 struct ieee80211_mgmt
*mgmt
,
1109 struct ieee80211_rx_status
*rx_status
)
1114 wpa_printf(MSG_DEBUG
, "MLME: too short (%lu) disassociation "
1115 "frame received from " MACSTR
" - ignored",
1116 (unsigned long) len
, MAC2STR(mgmt
->sa
));
1120 if (os_memcmp(wpa_s
->bssid
, mgmt
->sa
, ETH_ALEN
) != 0) {
1121 wpa_printf(MSG_DEBUG
, "MLME: disassociation frame received "
1122 "from unknown AP (SA=" MACSTR
" BSSID=" MACSTR
1124 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
));
1128 reason_code
= le_to_host16(mgmt
->u
.disassoc
.reason_code
);
1130 wpa_printf(MSG_DEBUG
, "MLME: RX disassociation from " MACSTR
1131 " (reason=%d)", MAC2STR(mgmt
->sa
), reason_code
);
1133 if (wpa_s
->mlme
.associated
)
1134 wpa_printf(MSG_DEBUG
, "MLME: disassociated");
1136 if (wpa_s
->mlme
.state
== IEEE80211_ASSOCIATED
) {
1137 wpa_s
->mlme
.state
= IEEE80211_ASSOCIATE
;
1138 ieee80211_reschedule_timer(wpa_s
,
1139 IEEE80211_RETRY_AUTH_INTERVAL
);
1142 ieee80211_set_associated(wpa_s
, 0);
1146 static int ieee80211_ft_assoc_resp(struct wpa_supplicant
*wpa_s
,
1147 struct ieee802_11_elems
*elems
)
1149 #ifdef CONFIG_IEEE80211R
1150 const u8
*mobility_domain
= NULL
;
1151 const u8
*r0kh_id
= NULL
;
1152 size_t r0kh_id_len
= 0;
1153 const u8
*r1kh_id
= NULL
;
1154 struct rsn_ftie
*hdr
;
1155 const u8
*pos
, *end
;
1157 if (elems
->mdie
&& elems
->mdie_len
>= MOBILITY_DOMAIN_ID_LEN
)
1158 mobility_domain
= elems
->mdie
;
1159 if (elems
->ftie
&& elems
->ftie_len
>= sizeof(struct rsn_ftie
)) {
1160 end
= elems
->ftie
+ elems
->ftie_len
;
1161 hdr
= (struct rsn_ftie
*) elems
->ftie
;
1162 pos
= (const u8
*) (hdr
+ 1);
1163 while (pos
+ 1 < end
) {
1164 if (pos
+ 2 + pos
[1] > end
)
1166 if (pos
[0] == FTIE_SUBELEM_R1KH_ID
&&
1167 pos
[1] == FT_R1KH_ID_LEN
)
1169 else if (pos
[0] == FTIE_SUBELEM_R0KH_ID
&&
1170 pos
[1] >= 1 && pos
[1] <= FT_R0KH_ID_MAX_LEN
) {
1172 r0kh_id_len
= pos
[1];
1177 return wpa_sm_set_ft_params(wpa_s
->wpa
, mobility_domain
, r0kh_id
,
1178 r0kh_id_len
, r1kh_id
);
1179 #else /* CONFIG_IEEE80211R */
1181 #endif /* CONFIG_IEEE80211R */
1185 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant
*wpa_s
,
1186 struct ieee80211_mgmt
*mgmt
,
1188 struct ieee80211_rx_status
*rx_status
,
1193 u16 capab_info
, status_code
, aid
;
1194 struct ieee802_11_elems elems
;
1197 /* AssocResp and ReassocResp have identical structure, so process both
1198 * of them in this function. */
1200 if (wpa_s
->mlme
.state
!= IEEE80211_ASSOCIATE
) {
1201 wpa_printf(MSG_DEBUG
, "MLME: association frame received from "
1202 MACSTR
", but not in associate state - ignored",
1208 wpa_printf(MSG_DEBUG
, "MLME: too short (%lu) association "
1209 "frame received from " MACSTR
" - ignored",
1210 (unsigned long) len
, MAC2STR(mgmt
->sa
));
1214 if (os_memcmp(wpa_s
->bssid
, mgmt
->sa
, ETH_ALEN
) != 0) {
1215 wpa_printf(MSG_DEBUG
, "MLME: association frame received from "
1216 "unknown AP (SA=" MACSTR
" BSSID=" MACSTR
") - "
1217 "ignored", MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
));
1221 capab_info
= le_to_host16(mgmt
->u
.assoc_resp
.capab_info
);
1222 status_code
= le_to_host16(mgmt
->u
.assoc_resp
.status_code
);
1223 aid
= le_to_host16(mgmt
->u
.assoc_resp
.aid
);
1224 if ((aid
& (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1225 wpa_printf(MSG_DEBUG
, "MLME: invalid aid value %d; bits 15:14 "
1227 aid
&= ~(BIT(15) | BIT(14));
1229 wpa_printf(MSG_DEBUG
, "MLME: RX %sssocResp from " MACSTR
1230 " (capab=0x%x status=%d aid=%d)",
1231 reassoc
? "Rea" : "A", MAC2STR(mgmt
->sa
),
1232 capab_info
, status_code
, aid
);
1234 if (status_code
!= WLAN_STATUS_SUCCESS
) {
1235 wpa_printf(MSG_DEBUG
, "MLME: AP denied association (code=%d)",
1240 pos
= mgmt
->u
.assoc_resp
.variable
;
1241 if (ieee802_11_parse_elems(pos
, len
- (pos
- (u8
*) mgmt
), &elems
)
1243 wpa_printf(MSG_DEBUG
, "MLME: failed to parse AssocResp");
1247 if (elems
.supp_rates
== NULL
) {
1248 wpa_printf(MSG_DEBUG
, "MLME: no SuppRates element in "
1253 if (wpa_s
->mlme
.auth_alg
== WLAN_AUTH_FT
) {
1255 wpa_printf(MSG_DEBUG
, "MLME: AP tried to use "
1256 "association, not reassociation, response "
1260 if (wpa_ft_validate_reassoc_resp(
1261 wpa_s
->wpa
, pos
, len
- (pos
- (u8
*) mgmt
),
1263 wpa_printf(MSG_DEBUG
, "MLME: FT validation of Reassoc"
1267 } else if (ieee80211_ft_assoc_resp(wpa_s
, &elems
) < 0)
1270 wpa_printf(MSG_DEBUG
, "MLME: associated");
1271 wpa_s
->mlme
.aid
= aid
;
1272 wpa_s
->mlme
.ap_capab
= capab_info
;
1274 os_free(wpa_s
->mlme
.assocresp_ies
);
1275 wpa_s
->mlme
.assocresp_ies_len
= len
- (pos
- (u8
*) mgmt
);
1276 wpa_s
->mlme
.assocresp_ies
= os_malloc(wpa_s
->mlme
.assocresp_ies_len
);
1277 if (wpa_s
->mlme
.assocresp_ies
) {
1278 os_memcpy(wpa_s
->mlme
.assocresp_ies
, pos
,
1279 wpa_s
->mlme
.assocresp_ies_len
);
1282 ieee80211_set_associated(wpa_s
, 1);
1284 rates_len
= elems
.supp_rates_len
;
1285 if (rates_len
> sizeof(rates
))
1286 rates_len
= sizeof(rates
);
1287 os_memcpy(rates
, elems
.supp_rates
, rates_len
);
1288 if (elems
.ext_supp_rates
) {
1289 size_t _len
= elems
.ext_supp_rates_len
;
1290 if (_len
> sizeof(rates
) - rates_len
)
1291 _len
= sizeof(rates
) - rates_len
;
1292 os_memcpy(rates
+ rates_len
, elems
.ext_supp_rates
, _len
);
1296 if (wpa_drv_set_bssid(wpa_s
, wpa_s
->bssid
) < 0) {
1297 wpa_printf(MSG_DEBUG
, "MLME: failed to set BSSID for the "
1300 if (wpa_drv_set_ssid(wpa_s
, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
) <
1302 wpa_printf(MSG_DEBUG
, "MLME: failed to set SSID for the "
1306 /* Remove STA entry before adding a new one just in case to avoid
1307 * problems with existing configuration (e.g., keys). */
1308 wpa_drv_mlme_remove_sta(wpa_s
, wpa_s
->bssid
);
1309 if (wpa_drv_mlme_add_sta(wpa_s
, wpa_s
->bssid
, rates
, rates_len
) < 0) {
1310 wpa_printf(MSG_DEBUG
, "MLME: failed to add STA entry to the "
1317 if (elems
.wmm_param
&& wpa_s
->mlme
.wmm_enabled
) {
1318 sta
->flags
|= WLAN_STA_WME
;
1319 ieee80211_sta_wmm_params(wpa_s
, elems
.wmm_param
,
1320 elems
.wmm_param_len
);
1324 ieee80211_associated(wpa_s
);
1328 /* Caller must hold local->sta_bss_lock */
1329 static void __ieee80211_bss_hash_add(struct wpa_supplicant
*wpa_s
,
1330 struct ieee80211_sta_bss
*bss
)
1332 bss
->hnext
= wpa_s
->mlme
.sta_bss_hash
[STA_HASH(bss
->bssid
)];
1333 wpa_s
->mlme
.sta_bss_hash
[STA_HASH(bss
->bssid
)] = bss
;
1337 /* Caller must hold local->sta_bss_lock */
1338 static void __ieee80211_bss_hash_del(struct wpa_supplicant
*wpa_s
,
1339 struct ieee80211_sta_bss
*bss
)
1341 struct ieee80211_sta_bss
*b
, *prev
= NULL
;
1342 b
= wpa_s
->mlme
.sta_bss_hash
[STA_HASH(bss
->bssid
)];
1346 wpa_s
->mlme
.sta_bss_hash
[STA_HASH(bss
->bssid
)]
1349 prev
->hnext
= bss
->hnext
;
1359 static struct ieee80211_sta_bss
*
1360 ieee80211_bss_add(struct wpa_supplicant
*wpa_s
, const u8
*bssid
)
1362 struct ieee80211_sta_bss
*bss
;
1364 bss
= os_zalloc(sizeof(*bss
));
1367 os_memcpy(bss
->bssid
, bssid
, ETH_ALEN
);
1369 /* TODO: order by RSSI? */
1370 bss
->next
= wpa_s
->mlme
.sta_bss_list
;
1371 wpa_s
->mlme
.sta_bss_list
= bss
;
1372 __ieee80211_bss_hash_add(wpa_s
, bss
);
1377 static struct ieee80211_sta_bss
*
1378 ieee80211_bss_get(struct wpa_supplicant
*wpa_s
, const u8
*bssid
)
1380 struct ieee80211_sta_bss
*bss
;
1382 bss
= wpa_s
->mlme
.sta_bss_hash
[STA_HASH(bssid
)];
1384 if (os_memcmp(bss
->bssid
, bssid
, ETH_ALEN
) == 0)
1392 static void ieee80211_bss_free(struct wpa_supplicant
*wpa_s
,
1393 struct ieee80211_sta_bss
*bss
)
1395 __ieee80211_bss_hash_del(wpa_s
, bss
);
1397 os_free(bss
->wpa_ie
);
1398 os_free(bss
->rsn_ie
);
1399 os_free(bss
->wmm_ie
);
1405 static void ieee80211_bss_list_deinit(struct wpa_supplicant
*wpa_s
)
1407 struct ieee80211_sta_bss
*bss
, *prev
;
1409 bss
= wpa_s
->mlme
.sta_bss_list
;
1410 wpa_s
->mlme
.sta_bss_list
= NULL
;
1414 ieee80211_bss_free(wpa_s
, prev
);
1419 static void ieee80211_bss_info(struct wpa_supplicant
*wpa_s
,
1420 struct ieee80211_mgmt
*mgmt
,
1422 struct ieee80211_rx_status
*rx_status
,
1425 struct ieee802_11_elems elems
;
1427 int channel
, invalid
= 0, clen
;
1428 struct ieee80211_sta_bss
*bss
;
1433 if (!beacon
&& os_memcmp(mgmt
->da
, wpa_s
->own_addr
, ETH_ALEN
))
1434 return; /* ignore ProbeResp to foreign address */
1437 wpa_printf(MSG_MSGDUMP
, "MLME: RX %s from " MACSTR
" to " MACSTR
,
1438 beacon
? "Beacon" : "Probe Response",
1439 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
));
1442 baselen
= (u8
*) mgmt
->u
.beacon
.variable
- (u8
*) mgmt
;
1446 pos
= mgmt
->u
.beacon
.timestamp
;
1447 timestamp
= WPA_GET_LE64(pos
);
1450 if (local
->conf
.mode
== IW_MODE_ADHOC
&& beacon
&&
1451 os_memcmp(mgmt
->bssid
, local
->bssid
, ETH_ALEN
) == 0) {
1452 #ifdef IEEE80211_IBSS_DEBUG
1453 static unsigned long last_tsf_debug
= 0;
1455 if (local
->hw
->get_tsf
)
1456 tsf
= local
->hw
->get_tsf(local
->mdev
);
1459 if (time_after(jiffies
, last_tsf_debug
+ 5 * HZ
)) {
1460 wpa_printf(MSG_DEBUG
, "RX beacon SA=" MACSTR
" BSSID="
1461 MACSTR
" TSF=0x%llx BCN=0x%llx diff=%lld "
1463 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->bssid
),
1464 tsf
, timestamp
, tsf
- timestamp
, jiffies
);
1465 last_tsf_debug
= jiffies
;
1467 #endif /* IEEE80211_IBSS_DEBUG */
1471 ie_pos
= mgmt
->u
.beacon
.variable
;
1472 ie_len
= len
- baselen
;
1473 if (ieee802_11_parse_elems(ie_pos
, ie_len
, &elems
) == ParseFailed
)
1477 if (local
->conf
.mode
== IW_MODE_ADHOC
&& elems
.supp_rates
&&
1478 os_memcmp(mgmt
->bssid
, local
->bssid
, ETH_ALEN
) == 0 &&
1479 (sta
= sta_info_get(local
, mgmt
->sa
))) {
1480 struct ieee80211_rate
*rates
;
1482 u32 supp_rates
, prev_rates
;
1483 int i
, j
, oper_mode
;
1485 rates
= local
->curr_rates
;
1486 num_rates
= local
->num_curr_rates
;
1487 oper_mode
= wpa_s
->mlme
.sta_scanning
?
1488 local
->scan_oper_phymode
: local
->conf
.phymode
;
1489 for (i
= 0; i
< local
->hw
->num_modes
; i
++) {
1490 struct ieee80211_hw_modes
*mode
= &local
->hw
->modes
[i
];
1491 if (oper_mode
== mode
->mode
) {
1492 rates
= mode
->rates
;
1493 num_rates
= mode
->num_rates
;
1499 for (i
= 0; i
< elems
.supp_rates_len
+
1500 elems
.ext_supp_rates_len
; i
++) {
1503 if (i
< elems
.supp_rates_len
)
1504 rate
= elems
.supp_rates
[i
];
1505 else if (elems
.ext_supp_rates
)
1506 rate
= elems
.ext_supp_rates
1507 [i
- elems
.supp_rates_len
];
1508 own_rate
= 5 * (rate
& 0x7f);
1509 if (oper_mode
== MODE_ATHEROS_TURBO
)
1511 for (j
= 0; j
< num_rates
; j
++)
1512 if (rates
[j
].rate
== own_rate
)
1513 supp_rates
|= BIT(j
);
1516 prev_rates
= sta
->supp_rates
;
1517 sta
->supp_rates
&= supp_rates
;
1518 if (sta
->supp_rates
== 0) {
1519 /* No matching rates - this should not really happen.
1520 * Make sure that at least one rate is marked
1521 * supported to avoid issues with TX rate ctrl. */
1522 sta
->supp_rates
= wpa_s
->mlme
.supp_rates_bits
;
1524 if (sta
->supp_rates
!= prev_rates
) {
1525 wpa_printf(MSG_DEBUG
, "MLME: updated supp_rates set "
1526 "for " MACSTR
" based on beacon info "
1527 "(0x%x & 0x%x -> 0x%x)",
1528 MAC2STR(sta
->addr
), prev_rates
,
1529 supp_rates
, sta
->supp_rates
);
1531 sta_info_release(local
, sta
);
1535 if (elems
.ssid
== NULL
)
1538 if (elems
.ds_params
&& elems
.ds_params_len
== 1)
1539 channel
= elems
.ds_params
[0];
1541 channel
= rx_status
->channel
;
1543 bss
= ieee80211_bss_get(wpa_s
, mgmt
->bssid
);
1545 bss
= ieee80211_bss_add(wpa_s
, mgmt
->bssid
);
1550 /* TODO: order by RSSI? */
1551 spin_lock_bh(&local
->sta_bss_lock
);
1552 list_move_tail(&bss
->list
, &local
->sta_bss_list
);
1553 spin_unlock_bh(&local
->sta_bss_lock
);
1557 if (bss
->probe_resp
&& beacon
) {
1558 /* Do not allow beacon to override data from Probe Response. */
1562 bss
->beacon_int
= le_to_host16(mgmt
->u
.beacon
.beacon_int
);
1563 bss
->capability
= le_to_host16(mgmt
->u
.beacon
.capab_info
);
1565 if (bss
->ie
== NULL
|| bss
->ie_len
< ie_len
) {
1567 bss
->ie
= os_malloc(ie_len
);
1570 os_memcpy(bss
->ie
, ie_pos
, ie_len
);
1571 bss
->ie_len
= ie_len
;
1574 if (elems
.ssid
&& elems
.ssid_len
<= MAX_SSID_LEN
) {
1575 os_memcpy(bss
->ssid
, elems
.ssid
, elems
.ssid_len
);
1576 bss
->ssid_len
= elems
.ssid_len
;
1579 bss
->supp_rates_len
= 0;
1580 if (elems
.supp_rates
) {
1581 clen
= IEEE80211_MAX_SUPP_RATES
- bss
->supp_rates_len
;
1582 if (clen
> elems
.supp_rates_len
)
1583 clen
= elems
.supp_rates_len
;
1584 os_memcpy(&bss
->supp_rates
[bss
->supp_rates_len
],
1585 elems
.supp_rates
, clen
);
1586 bss
->supp_rates_len
+= clen
;
1588 if (elems
.ext_supp_rates
) {
1589 clen
= IEEE80211_MAX_SUPP_RATES
- bss
->supp_rates_len
;
1590 if (clen
> elems
.ext_supp_rates_len
)
1591 clen
= elems
.ext_supp_rates_len
;
1592 os_memcpy(&bss
->supp_rates
[bss
->supp_rates_len
],
1593 elems
.ext_supp_rates
, clen
);
1594 bss
->supp_rates_len
+= clen
;
1598 (bss
->wpa_ie
== NULL
|| bss
->wpa_ie_len
!= elems
.wpa_len
||
1599 os_memcmp(bss
->wpa_ie
, elems
.wpa
, elems
.wpa_len
))) {
1600 os_free(bss
->wpa_ie
);
1601 bss
->wpa_ie
= os_malloc(elems
.wpa_len
+ 2);
1603 os_memcpy(bss
->wpa_ie
, elems
.wpa
- 2,
1605 bss
->wpa_ie_len
= elems
.wpa_len
+ 2;
1607 bss
->wpa_ie_len
= 0;
1608 } else if (!elems
.wpa
&& bss
->wpa_ie
) {
1609 os_free(bss
->wpa_ie
);
1611 bss
->wpa_ie_len
= 0;
1615 (bss
->rsn_ie
== NULL
|| bss
->rsn_ie_len
!= elems
.rsn_len
||
1616 os_memcmp(bss
->rsn_ie
, elems
.rsn
, elems
.rsn_len
))) {
1617 os_free(bss
->rsn_ie
);
1618 bss
->rsn_ie
= os_malloc(elems
.rsn_len
+ 2);
1620 os_memcpy(bss
->rsn_ie
, elems
.rsn
- 2,
1622 bss
->rsn_ie_len
= elems
.rsn_len
+ 2;
1624 bss
->rsn_ie_len
= 0;
1625 } else if (!elems
.rsn
&& bss
->rsn_ie
) {
1626 os_free(bss
->rsn_ie
);
1628 bss
->rsn_ie_len
= 0;
1631 if (elems
.wmm_param
&&
1632 (bss
->wmm_ie
== NULL
|| bss
->wmm_ie_len
!= elems
.wmm_param_len
||
1633 os_memcmp(bss
->wmm_ie
, elems
.wmm_param
, elems
.wmm_param_len
))) {
1634 os_free(bss
->wmm_ie
);
1635 bss
->wmm_ie
= os_malloc(elems
.wmm_param_len
+ 2);
1637 os_memcpy(bss
->wmm_ie
, elems
.wmm_param
- 2,
1638 elems
.wmm_param_len
+ 2);
1639 bss
->wmm_ie_len
= elems
.wmm_param_len
+ 2;
1641 bss
->wmm_ie_len
= 0;
1642 } else if (!elems
.wmm_param
&& bss
->wmm_ie
) {
1643 os_free(bss
->wmm_ie
);
1645 bss
->wmm_ie_len
= 0;
1648 #ifdef CONFIG_IEEE80211R
1650 (bss
->mdie
== NULL
|| bss
->mdie_len
!= elems
.mdie_len
||
1651 os_memcmp(bss
->mdie
, elems
.mdie
, elems
.mdie_len
))) {
1653 bss
->mdie
= os_malloc(elems
.mdie_len
+ 2);
1655 os_memcpy(bss
->mdie
, elems
.mdie
- 2,
1656 elems
.mdie_len
+ 2);
1657 bss
->mdie_len
= elems
.mdie_len
+ 2;
1660 } else if (!elems
.mdie
&& bss
->mdie
) {
1665 #endif /* CONFIG_IEEE80211R */
1667 bss
->hw_mode
= wpa_s
->mlme
.phymode
;
1668 bss
->channel
= channel
;
1669 bss
->freq
= wpa_s
->mlme
.freq
;
1670 if (channel
!= wpa_s
->mlme
.channel
&&
1671 (wpa_s
->mlme
.phymode
== WPA_MODE_IEEE80211G
||
1672 wpa_s
->mlme
.phymode
== WPA_MODE_IEEE80211B
) &&
1673 channel
>= 1 && channel
<= 14) {
1674 static const int freq_list
[] = {
1675 2412, 2417, 2422, 2427, 2432, 2437, 2442,
1676 2447, 2452, 2457, 2462, 2467, 2472, 2484
1678 /* IEEE 802.11g/b mode can receive packets from neighboring
1679 * channels, so map the channel into frequency. */
1680 bss
->freq
= freq_list
[channel
- 1];
1682 bss
->timestamp
= timestamp
;
1683 os_get_time(&bss
->last_update
);
1684 bss
->rssi
= rx_status
->ssi
;
1690 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant
*wpa_s
,
1691 struct ieee80211_mgmt
*mgmt
,
1693 struct ieee80211_rx_status
*rx_status
)
1695 ieee80211_bss_info(wpa_s
, mgmt
, len
, rx_status
, 0);
1699 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant
*wpa_s
,
1700 struct ieee80211_mgmt
*mgmt
,
1702 struct ieee80211_rx_status
*rx_status
)
1706 struct ieee802_11_elems elems
;
1708 ieee80211_bss_info(wpa_s
, mgmt
, len
, rx_status
, 1);
1710 if (!wpa_s
->mlme
.associated
||
1711 os_memcmp(wpa_s
->bssid
, mgmt
->bssid
, ETH_ALEN
) != 0)
1714 /* Process beacon from the current BSS */
1715 baselen
= (u8
*) mgmt
->u
.beacon
.variable
- (u8
*) mgmt
;
1719 if (ieee802_11_parse_elems(mgmt
->u
.beacon
.variable
, len
- baselen
,
1720 &elems
) == ParseFailed
)
1724 if (elems
.erp_info
&& elems
.erp_info_len
>= 1) {
1726 (elems
.erp_info
[0] & ERP_INFO_USE_PROTECTION
) != 0;
1729 if (use_protection
!= !!wpa_s
->mlme
.use_protection
) {
1730 wpa_printf(MSG_DEBUG
, "MLME: CTS protection %s (BSSID=" MACSTR
1732 use_protection
? "enabled" : "disabled",
1733 MAC2STR(wpa_s
->bssid
));
1734 wpa_s
->mlme
.use_protection
= use_protection
? 1 : 0;
1735 wpa_s
->mlme
.cts_protect_erp_frames
= use_protection
;
1738 if (elems
.wmm_param
&& wpa_s
->mlme
.wmm_enabled
) {
1739 ieee80211_sta_wmm_params(wpa_s
, elems
.wmm_param
,
1740 elems
.wmm_param_len
);
1745 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant
*wpa_s
,
1746 struct ieee80211_mgmt
*mgmt
,
1748 struct ieee80211_rx_status
*rx_status
)
1750 int tx_last_beacon
, adhoc
;
1752 struct ieee80211_mgmt
*resp
;
1755 struct wpa_ssid
*ssid
= wpa_s
->current_ssid
;
1757 adhoc
= ssid
&& ssid
->mode
== 1;
1759 if (!adhoc
|| wpa_s
->mlme
.state
!= IEEE80211_IBSS_JOINED
||
1760 len
< 24 + 2 || wpa_s
->mlme
.probe_resp
== NULL
)
1764 if (local
->hw
->tx_last_beacon
)
1765 tx_last_beacon
= local
->hw
->tx_last_beacon(local
->mdev
);
1770 #ifdef IEEE80211_IBSS_DEBUG
1771 wpa_printf(MSG_DEBUG
, "MLME: RX ProbeReq SA=" MACSTR
" DA=" MACSTR
1772 " BSSID=" MACSTR
" (tx_last_beacon=%d)",
1773 MAC2STR(mgmt
->sa
), MAC2STR(mgmt
->da
),
1774 MAC2STR(mgmt
->bssid
), tx_last_beacon
);
1775 #endif /* IEEE80211_IBSS_DEBUG */
1777 if (!tx_last_beacon
)
1780 if (os_memcmp(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
) != 0 &&
1781 os_memcmp(mgmt
->bssid
, "\xff\xff\xff\xff\xff\xff", ETH_ALEN
) != 0)
1784 end
= ((u8
*) mgmt
) + len
;
1785 pos
= mgmt
->u
.probe_req
.variable
;
1786 if (pos
[0] != WLAN_EID_SSID
||
1787 pos
+ 2 + pos
[1] > end
) {
1788 wpa_printf(MSG_DEBUG
, "MLME: Invalid SSID IE in ProbeReq from "
1789 MACSTR
, MAC2STR(mgmt
->sa
));
1793 (pos
[1] != wpa_s
->mlme
.ssid_len
||
1794 os_memcmp(pos
+ 2, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
) != 0))
1796 /* Ignore ProbeReq for foreign SSID */
1801 /* Reply with ProbeResp */
1802 skb
= skb_copy(wpa_s
->mlme
.probe_resp
, GFP_ATOMIC
);
1806 resp
= (struct ieee80211_mgmt
*) skb
->data
;
1807 os_memcpy(resp
->da
, mgmt
->sa
, ETH_ALEN
);
1808 #ifdef IEEE80211_IBSS_DEBUG
1809 wpa_printf(MSG_DEBUG
, "MLME: Sending ProbeResp to " MACSTR
,
1811 #endif /* IEEE80211_IBSS_DEBUG */
1812 ieee80211_sta_tx(wpa_s
, skb
, 0, 1);
1817 #ifdef CONFIG_IEEE80211R
1818 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant
*wpa_s
,
1819 struct ieee80211_mgmt
*mgmt
,
1821 struct ieee80211_rx_status
*rx_status
)
1823 union wpa_event_data data
;
1825 u8
*sta_addr
, *target_ap_addr
;
1827 if (len
< 24 + 1 + sizeof(mgmt
->u
.action
.u
.ft_action_resp
)) {
1828 wpa_printf(MSG_DEBUG
, "MLME: Too short FT Action frame");
1833 * Only FT Action Response is needed for now since reservation
1834 * protocol is not supported.
1836 if (mgmt
->u
.action
.u
.ft_action_resp
.action
!= 2) {
1837 wpa_printf(MSG_DEBUG
, "MLME: Unexpected FT Action %d",
1838 mgmt
->u
.action
.u
.ft_action_resp
.action
);
1842 status
= le_to_host16(mgmt
->u
.action
.u
.ft_action_resp
.status_code
);
1843 sta_addr
= mgmt
->u
.action
.u
.ft_action_resp
.sta_addr
;
1844 target_ap_addr
= mgmt
->u
.action
.u
.ft_action_resp
.target_ap_addr
;
1845 wpa_printf(MSG_DEBUG
, "MLME: Received FT Action Response: STA " MACSTR
1846 " TargetAP " MACSTR
" Status Code %d",
1847 MAC2STR(sta_addr
), MAC2STR(target_ap_addr
), status
);
1848 if (os_memcmp(sta_addr
, wpa_s
->own_addr
, ETH_ALEN
) != 0) {
1849 wpa_printf(MSG_DEBUG
, "MLME: Foreign STA Address " MACSTR
1850 " in FT Action Response", MAC2STR(sta_addr
));
1856 wpa_printf(MSG_DEBUG
, "MLME: FT Action Response indicates "
1857 "failure (status code %d)", status
);
1858 /* TODO: report error to FT code(?) */
1862 os_memset(&data
, 0, sizeof(data
));
1863 data
.ft_ies
.ies
= mgmt
->u
.action
.u
.ft_action_resp
.variable
;
1864 data
.ft_ies
.ies_len
= len
- (mgmt
->u
.action
.u
.ft_action_resp
.variable
-
1866 data
.ft_ies
.ft_action
= 1;
1867 os_memcpy(data
.ft_ies
.target_ap
, target_ap_addr
, ETH_ALEN
);
1868 wpa_supplicant_event(wpa_s
, EVENT_FT_RESPONSE
, &data
);
1869 /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1871 wpa_s
->mlme
.prev_bssid_set
= 1;
1872 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_FT
;
1873 os_memcpy(wpa_s
->mlme
.prev_bssid
, wpa_s
->bssid
, ETH_ALEN
);
1874 os_memcpy(wpa_s
->bssid
, target_ap_addr
, ETH_ALEN
);
1875 ieee80211_associate(wpa_s
);
1877 #endif /* CONFIG_IEEE80211R */
1880 #ifdef CONFIG_IEEE80211W
1882 /* MLME-PING.response */
1883 static int ieee80211_sta_send_ping_resp(struct wpa_supplicant
*wpa_s
,
1884 const u8
*addr
, const u8
*trans_id
)
1886 struct ieee80211_mgmt
*mgmt
;
1890 mgmt
= os_zalloc(sizeof(*mgmt
));
1892 wpa_printf(MSG_DEBUG
, "MLME: Failed to allocate buffer for "
1893 "ping action frame");
1898 os_memcpy(mgmt
->da
, addr
, ETH_ALEN
);
1899 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
1900 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
1901 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
1902 WLAN_FC_STYPE_ACTION
);
1903 mgmt
->u
.action
.category
= WLAN_ACTION_PING
;
1904 mgmt
->u
.action
.u
.ping_resp
.action
= WLAN_PING_RESPONSE
;
1905 os_memcpy(mgmt
->u
.action
.u
.ping_resp
.trans_id
, trans_id
,
1906 WLAN_PING_TRANS_ID_LEN
);
1907 len
+= 1 + sizeof(mgmt
->u
.action
.u
.ping_resp
);
1909 res
= ieee80211_sta_tx(wpa_s
, (u8
*) mgmt
, len
);
1916 static void ieee80211_rx_mgmt_ping_action(
1917 struct wpa_supplicant
*wpa_s
, struct ieee80211_mgmt
*mgmt
, size_t len
,
1918 struct ieee80211_rx_status
*rx_status
)
1920 if (len
< 24 + 1 + sizeof(mgmt
->u
.action
.u
.ping_req
)) {
1921 wpa_printf(MSG_DEBUG
, "MLME: Too short Ping Action frame");
1925 if (mgmt
->u
.action
.u
.ping_req
.action
!= WLAN_PING_REQUEST
) {
1926 wpa_printf(MSG_DEBUG
, "MLME: Unexpected Ping Action %d",
1927 mgmt
->u
.action
.u
.ping_req
.action
);
1931 if (os_memcmp(mgmt
->sa
, wpa_s
->bssid
, ETH_ALEN
) != 0) {
1932 wpa_printf(MSG_DEBUG
, "MLME: Ignore ping from unknown source "
1933 MACSTR
, MAC2STR(mgmt
->sa
));
1937 if (wpa_s
->mlme
.state
== IEEE80211_ASSOCIATE
) {
1938 wpa_printf(MSG_DEBUG
, "MLME: Ignore ping request during "
1939 "association process");
1943 wpa_printf(MSG_DEBUG
, "MLME: Replying to ping request");
1944 ieee80211_sta_send_ping_resp(wpa_s
, mgmt
->sa
,
1945 mgmt
->u
.action
.u
.ping_req
.trans_id
);
1948 #endif /* CONFIG_IEEE80211W */
1951 static void ieee80211_rx_mgmt_action(struct wpa_supplicant
*wpa_s
,
1952 struct ieee80211_mgmt
*mgmt
,
1954 struct ieee80211_rx_status
*rx_status
)
1956 wpa_printf(MSG_DEBUG
, "MLME: received Action frame");
1961 switch (mgmt
->u
.action
.category
) {
1962 #ifdef CONFIG_IEEE80211R
1963 case WLAN_ACTION_FT
:
1964 ieee80211_rx_mgmt_ft_action(wpa_s
, mgmt
, len
, rx_status
);
1966 #endif /* CONFIG_IEEE80211R */
1967 case WLAN_ACTION_PING
:
1968 ieee80211_rx_mgmt_ping_action(wpa_s
, mgmt
, len
, rx_status
);
1970 #ifdef CONFIG_IEEE80211W
1971 #endif /* CONFIG_IEEE80211W */
1973 wpa_printf(MSG_DEBUG
, "MLME: unknown Action Category %d",
1974 mgmt
->u
.action
.category
);
1980 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant
*wpa_s
,
1981 const u8
*buf
, size_t len
,
1982 struct ieee80211_rx_status
*rx_status
)
1984 struct ieee80211_mgmt
*mgmt
;
1990 mgmt
= (struct ieee80211_mgmt
*) buf
;
1991 fc
= le_to_host16(mgmt
->frame_control
);
1993 switch (WLAN_FC_GET_STYPE(fc
)) {
1994 case WLAN_FC_STYPE_PROBE_REQ
:
1995 ieee80211_rx_mgmt_probe_req(wpa_s
, mgmt
, len
, rx_status
);
1997 case WLAN_FC_STYPE_PROBE_RESP
:
1998 ieee80211_rx_mgmt_probe_resp(wpa_s
, mgmt
, len
, rx_status
);
2000 case WLAN_FC_STYPE_BEACON
:
2001 ieee80211_rx_mgmt_beacon(wpa_s
, mgmt
, len
, rx_status
);
2003 case WLAN_FC_STYPE_AUTH
:
2004 ieee80211_rx_mgmt_auth(wpa_s
, mgmt
, len
, rx_status
);
2006 case WLAN_FC_STYPE_ASSOC_RESP
:
2007 ieee80211_rx_mgmt_assoc_resp(wpa_s
, mgmt
, len
, rx_status
, 0);
2009 case WLAN_FC_STYPE_REASSOC_RESP
:
2010 ieee80211_rx_mgmt_assoc_resp(wpa_s
, mgmt
, len
, rx_status
, 1);
2012 case WLAN_FC_STYPE_DEAUTH
:
2013 ieee80211_rx_mgmt_deauth(wpa_s
, mgmt
, len
, rx_status
);
2015 case WLAN_FC_STYPE_DISASSOC
:
2016 ieee80211_rx_mgmt_disassoc(wpa_s
, mgmt
, len
, rx_status
);
2018 case WLAN_FC_STYPE_ACTION
:
2019 ieee80211_rx_mgmt_action(wpa_s
, mgmt
, len
, rx_status
);
2022 wpa_printf(MSG_DEBUG
, "MLME: received unknown management "
2023 "frame - stype=%d", WLAN_FC_GET_STYPE(fc
));
2029 static void ieee80211_sta_rx_scan(struct wpa_supplicant
*wpa_s
,
2030 const u8
*buf
, size_t len
,
2031 struct ieee80211_rx_status
*rx_status
)
2033 struct ieee80211_mgmt
*mgmt
;
2039 mgmt
= (struct ieee80211_mgmt
*) buf
;
2040 fc
= le_to_host16(mgmt
->frame_control
);
2042 if (WLAN_FC_GET_TYPE(fc
) == WLAN_FC_TYPE_MGMT
) {
2043 if (WLAN_FC_GET_STYPE(fc
) == WLAN_FC_STYPE_PROBE_RESP
) {
2044 ieee80211_rx_mgmt_probe_resp(wpa_s
, mgmt
,
2046 } else if (WLAN_FC_GET_STYPE(fc
) == WLAN_FC_STYPE_BEACON
) {
2047 ieee80211_rx_mgmt_beacon(wpa_s
, mgmt
, len
, rx_status
);
2053 static int ieee80211_sta_active_ibss(struct wpa_supplicant
*wpa_s
)
2058 list_for_each(ptr
, &local
->sta_list
) {
2059 sta
= list_entry(ptr
, struct sta_info
, list
);
2060 if (sta
->dev
== dev
&&
2061 time_after(sta
->last_rx
+ IEEE80211_IBSS_MERGE_INTERVAL
,
2073 static void ieee80211_sta_expire(struct wpa_supplicant
*wpa_s
)
2076 list_for_each_safe(ptr
, n
, &local
->sta_list
) {
2077 sta
= list_entry(ptr
, struct sta_info
, list
);
2078 if (time_after(jiffies
, sta
->last_rx
+
2079 IEEE80211_IBSS_INACTIVITY_LIMIT
)) {
2080 wpa_printf(MSG_DEBUG
, "MLME: expiring inactive STA "
2081 MACSTR
, MAC2STR(sta
->addr
));
2082 sta_info_free(local
, sta
, 1);
2089 static void ieee80211_sta_merge_ibss(struct wpa_supplicant
*wpa_s
)
2091 ieee80211_reschedule_timer(wpa_s
, IEEE80211_IBSS_MERGE_INTERVAL
);
2093 ieee80211_sta_expire(wpa_s
);
2094 if (ieee80211_sta_active_ibss(wpa_s
))
2097 wpa_printf(MSG_DEBUG
, "MLME: No active IBSS STAs - trying to scan for "
2098 "other IBSS networks with same SSID (merge)");
2099 ieee80211_sta_req_scan(wpa_s
, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
);
2103 static void ieee80211_sta_timer(void *eloop_ctx
, void *timeout_ctx
)
2105 struct wpa_supplicant
*wpa_s
= eloop_ctx
;
2107 switch (wpa_s
->mlme
.state
) {
2108 case IEEE80211_DISABLED
:
2110 case IEEE80211_AUTHENTICATE
:
2111 ieee80211_authenticate(wpa_s
);
2113 case IEEE80211_ASSOCIATE
:
2114 ieee80211_associate(wpa_s
);
2116 case IEEE80211_ASSOCIATED
:
2117 ieee80211_associated(wpa_s
);
2119 case IEEE80211_IBSS_SEARCH
:
2120 ieee80211_sta_find_ibss(wpa_s
);
2122 case IEEE80211_IBSS_JOINED
:
2123 ieee80211_sta_merge_ibss(wpa_s
);
2126 wpa_printf(MSG_DEBUG
, "ieee80211_sta_timer: Unknown state %d",
2131 if (ieee80211_privacy_mismatch(wpa_s
)) {
2132 wpa_printf(MSG_DEBUG
, "MLME: privacy configuration mismatch "
2133 "and mixed-cell disabled - disassociate");
2135 ieee80211_send_disassoc(wpa_s
, WLAN_REASON_UNSPECIFIED
);
2136 ieee80211_set_associated(wpa_s
, 0);
2141 static void ieee80211_sta_new_auth(struct wpa_supplicant
*wpa_s
)
2143 struct wpa_ssid
*ssid
= wpa_s
->current_ssid
;
2144 if (ssid
&& ssid
->mode
!= 0)
2148 if (local
->hw
->reset_tsf
) {
2149 /* Reset own TSF to allow time synchronization work. */
2150 local
->hw
->reset_tsf(local
->mdev
);
2154 wpa_s
->mlme
.wmm_last_param_set
= -1; /* allow any WMM update */
2157 if (wpa_s
->mlme
.auth_algs
& IEEE80211_AUTH_ALG_OPEN
)
2158 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_OPEN
;
2159 else if (wpa_s
->mlme
.auth_algs
& IEEE80211_AUTH_ALG_SHARED_KEY
)
2160 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_SHARED_KEY
;
2161 else if (wpa_s
->mlme
.auth_algs
& IEEE80211_AUTH_ALG_LEAP
)
2162 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_LEAP
;
2164 wpa_s
->mlme
.auth_alg
= WLAN_AUTH_OPEN
;
2165 wpa_printf(MSG_DEBUG
, "MLME: Initial auth_alg=%d",
2166 wpa_s
->mlme
.auth_alg
);
2167 wpa_s
->mlme
.auth_transaction
= -1;
2168 wpa_s
->mlme
.auth_tries
= wpa_s
->mlme
.assoc_tries
= 0;
2169 ieee80211_authenticate(wpa_s
);
2173 static int ieee80211_ibss_allowed(struct wpa_supplicant
*wpa_s
)
2178 for (m
= 0; m
< local
->hw
->num_modes
; m
++) {
2179 struct ieee80211_hw_modes
*mode
= &local
->hw
->modes
[m
];
2180 if (mode
->mode
!= local
->conf
.phymode
)
2182 for (c
= 0; c
< mode
->num_channels
; c
++) {
2183 struct ieee80211_channel
*chan
= &mode
->channels
[c
];
2184 if (chan
->flag
& IEEE80211_CHAN_W_SCAN
&&
2185 chan
->chan
== local
->conf
.channel
) {
2186 if (chan
->flag
& IEEE80211_CHAN_W_IBSS
)
2198 static int ieee80211_sta_join_ibss(struct wpa_supplicant
*wpa_s
,
2199 struct ieee80211_sta_bss
*bss
)
2201 int res
= 0, rates
, done
= 0;
2202 struct ieee80211_mgmt
*mgmt
;
2204 struct ieee80211_tx_control control
;
2205 struct ieee80211_rate
*rate
;
2206 struct rate_control_extra extra
;
2211 /* Remove possible STA entries from other IBSS networks. */
2213 sta_info_flush(local
, NULL
);
2215 if (local
->hw
->reset_tsf
) {
2216 /* Reset own TSF to allow time synchronization work. */
2217 local
->hw
->reset_tsf(local
->mdev
);
2220 os_memcpy(wpa_s
->bssid
, bss
->bssid
, ETH_ALEN
);
2223 local
->conf
.beacon_int
= bss
->beacon_int
>= 10 ? bss
->beacon_int
: 10;
2225 sdata
->drop_unencrypted
= bss
->capability
&
2226 host_to_le16(WLAN_CAPABILITY_PRIVACY
) ? 1 : 0;
2230 os_memset(&rq
, 0, sizeof(rq
));
2231 rq
.m
= bss
->freq
* 100000;
2233 res
= ieee80211_ioctl_siwfreq(wpa_s
, NULL
, &rq
, NULL
);
2236 if (!ieee80211_ibss_allowed(wpa_s
)) {
2238 wpa_printf(MSG_DEBUG
, "MLME: IBSS not allowed on channel %d "
2239 "(%d MHz)", local
->conf
.channel
,
2245 /* Set beacon template based on scan results */
2246 buf
= os_malloc(400);
2252 mgmt
= (struct ieee80211_mgmt
*) buf
;
2253 len
+= 24 + sizeof(mgmt
->u
.beacon
);
2254 os_memset(mgmt
, 0, 24 + sizeof(mgmt
->u
.beacon
));
2255 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
2256 WLAN_FC_STYPE_BEACON
);
2257 os_memset(mgmt
->da
, 0xff, ETH_ALEN
);
2258 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
2259 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
2261 mgmt
->u
.beacon
.beacon_int
=
2262 host_to_le16(local
->conf
.beacon_int
);
2264 mgmt
->u
.beacon
.capab_info
= host_to_le16(bss
->capability
);
2267 len
+= 2 + wpa_s
->mlme
.ssid_len
;
2268 *pos
++ = WLAN_EID_SSID
;
2269 *pos
++ = wpa_s
->mlme
.ssid_len
;
2270 os_memcpy(pos
, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
);
2272 rates
= bss
->supp_rates_len
;
2277 *pos
++ = WLAN_EID_SUPP_RATES
;
2279 os_memcpy(pos
, bss
->supp_rates
, rates
);
2283 *pos
++ = WLAN_EID_DS_PARAMS
;
2285 *pos
++ = bss
->channel
;
2289 *pos
++ = WLAN_EID_IBSS_PARAMS
;
2291 /* FIX: set ATIM window based on scan results */
2295 if (bss
->supp_rates_len
> 8) {
2296 rates
= bss
->supp_rates_len
- 8;
2299 *pos
++ = WLAN_EID_EXT_SUPP_RATES
;
2301 os_memcpy(pos
, &bss
->supp_rates
[8], rates
);
2305 os_memset(&control
, 0, sizeof(control
));
2306 control
.pkt_type
= PKT_PROBE_RESP
;
2307 os_memset(&extra
, 0, sizeof(extra
));
2308 extra
.endidx
= local
->num_curr_rates
;
2309 rate
= rate_control_get_rate(wpa_s
, skb
, &extra
);
2311 wpa_printf(MSG_DEBUG
, "MLME: Failed to determine TX "
2312 "rate for IBSS beacon");
2315 control
.tx_rate
= (wpa_s
->mlme
.short_preamble
&&
2316 (rate
->flags
& IEEE80211_RATE_PREAMBLE2
)) ?
2317 rate
->val2
: rate
->val
;
2318 control
.antenna_sel
= local
->conf
.antenna_sel
;
2319 control
.power_level
= local
->conf
.power_level
;
2321 control
.retry_limit
= 1;
2322 control
.rts_cts_duration
= 0;
2326 wpa_s
->mlme
.probe_resp
= skb_copy(skb
, GFP_ATOMIC
);
2327 if (wpa_s
->mlme
.probe_resp
) {
2328 mgmt
= (struct ieee80211_mgmt
*)
2329 wpa_s
->mlme
.probe_resp
->data
;
2330 mgmt
->frame_control
=
2331 IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
2332 WLAN_FC_STYPE_PROBE_RESP
);
2334 wpa_printf(MSG_DEBUG
, "MLME: Could not allocate "
2335 "ProbeResp template for IBSS");
2338 if (local
->hw
->beacon_update
&&
2339 local
->hw
->beacon_update(wpa_s
, skb
, &control
) == 0) {
2340 wpa_printf(MSG_DEBUG
, "MLME: Configured IBSS beacon "
2341 "template based on scan results");
2346 for (i
= 0; i
< bss
->supp_rates_len
; i
++) {
2347 int rate
= (bss
->supp_rates
[i
] & 0x7f) * 5;
2348 if (local
->conf
.phymode
== MODE_ATHEROS_TURBO
)
2350 for (j
= 0; j
< local
->num_curr_rates
; j
++)
2351 if (local
->curr_rates
[j
].rate
== rate
)
2354 wpa_s
->mlme
.supp_rates_bits
= rates
;
2361 wpa_printf(MSG_DEBUG
, "MLME: Failed to configure IBSS beacon "
2365 wpa_s
->mlme
.state
= IEEE80211_IBSS_JOINED
;
2366 ieee80211_reschedule_timer(wpa_s
, IEEE80211_IBSS_MERGE_INTERVAL
);
2373 static int ieee80211_sta_create_ibss(struct wpa_supplicant
*wpa_s
)
2375 struct ieee80211_sta_bss
*bss
;
2376 u8 bssid
[ETH_ALEN
], *pos
;
2380 /* Easier testing, use fixed BSSID. */
2381 os_memset(bssid
, 0xfe, ETH_ALEN
);
2383 /* Generate random, not broadcast, locally administered BSSID. Mix in
2384 * own MAC address to make sure that devices that do not have proper
2385 * random number generator get different BSSID. */
2386 os_get_random(bssid
, ETH_ALEN
);
2387 for (i
= 0; i
< ETH_ALEN
; i
++)
2388 bssid
[i
] ^= wpa_s
->own_addr
[i
];
2393 wpa_printf(MSG_DEBUG
, "MLME: Creating new IBSS network, BSSID "
2394 MACSTR
"", MAC2STR(bssid
));
2396 bss
= ieee80211_bss_add(wpa_s
, bssid
);
2401 if (local
->conf
.beacon_int
== 0)
2402 local
->conf
.beacon_int
= 100;
2403 bss
->beacon_int
= local
->conf
.beacon_int
;
2404 bss
->hw_mode
= local
->conf
.phymode
;
2405 bss
->channel
= local
->conf
.channel
;
2406 bss
->freq
= local
->conf
.freq
;
2408 os_get_time(&bss
->last_update
);
2409 bss
->capability
= host_to_le16(WLAN_CAPABILITY_IBSS
);
2411 if (sdata
->default_key
) {
2412 bss
->capability
|= host_to_le16(WLAN_CAPABILITY_PRIVACY
);
2414 sdata
->drop_unencrypted
= 0;
2415 bss
->supp_rates_len
= local
->num_curr_rates
;
2417 pos
= bss
->supp_rates
;
2419 for (i
= 0; i
< local
->num_curr_rates
; i
++) {
2420 int rate
= local
->curr_rates
[i
].rate
;
2421 if (local
->conf
.phymode
== MODE_ATHEROS_TURBO
)
2423 *pos
++ = (u8
) (rate
/ 5);
2427 return ieee80211_sta_join_ibss(wpa_s
, bss
);
2432 static int ieee80211_sta_find_ibss(struct wpa_supplicant
*wpa_s
)
2434 struct ieee80211_sta_bss
*bss
;
2440 if (wpa_s
->mlme
.ssid_len
== 0)
2443 active_ibss
= ieee80211_sta_active_ibss(wpa_s
);
2444 #ifdef IEEE80211_IBSS_DEBUG
2445 wpa_printf(MSG_DEBUG
, "MLME: sta_find_ibss (active_ibss=%d)",
2447 #endif /* IEEE80211_IBSS_DEBUG */
2448 for (bss
= wpa_s
->mlme
.sta_bss_list
; bss
; bss
= bss
->next
) {
2449 if (wpa_s
->mlme
.ssid_len
!= bss
->ssid_len
||
2450 os_memcmp(wpa_s
->mlme
.ssid
, bss
->ssid
, bss
->ssid_len
) != 0
2451 || !(bss
->capability
& WLAN_CAPABILITY_IBSS
))
2453 #ifdef IEEE80211_IBSS_DEBUG
2454 wpa_printf(MSG_DEBUG
, " bssid=" MACSTR
" found",
2455 MAC2STR(bss
->bssid
));
2456 #endif /* IEEE80211_IBSS_DEBUG */
2457 os_memcpy(bssid
, bss
->bssid
, ETH_ALEN
);
2460 os_memcmp(bssid
, wpa_s
->bssid
, ETH_ALEN
) != 0)
2464 #ifdef IEEE80211_IBSS_DEBUG
2465 wpa_printf(MSG_DEBUG
, " sta_find_ibss: selected " MACSTR
" current "
2466 MACSTR
, MAC2STR(bssid
), MAC2STR(wpa_s
->bssid
));
2467 #endif /* IEEE80211_IBSS_DEBUG */
2468 if (found
&& os_memcmp(wpa_s
->bssid
, bssid
, ETH_ALEN
) != 0 &&
2469 (bss
= ieee80211_bss_get(wpa_s
, bssid
))) {
2470 wpa_printf(MSG_DEBUG
, "MLME: Selected IBSS BSSID " MACSTR
2471 " based on configured SSID",
2473 return ieee80211_sta_join_ibss(wpa_s
, bss
);
2475 #ifdef IEEE80211_IBSS_DEBUG
2476 wpa_printf(MSG_DEBUG
, " did not try to join ibss");
2477 #endif /* IEEE80211_IBSS_DEBUG */
2479 /* Selected IBSS not found in current scan results - try to scan */
2482 if (wpa_s
->mlme
.state
== IEEE80211_IBSS_JOINED
&&
2483 !ieee80211_sta_active_ibss(wpa_s
)) {
2484 ieee80211_reschedule_timer(wpa_s
,
2485 IEEE80211_IBSS_MERGE_INTERVAL
);
2486 } else if (time_after(jiffies
, wpa_s
->mlme
.last_scan_completed
+
2487 IEEE80211_SCAN_INTERVAL
)) {
2488 wpa_printf(MSG_DEBUG
, "MLME: Trigger new scan to find an IBSS "
2490 return ieee80211_sta_req_scan(wpa_s
->mlme
.ssid
,
2491 wpa_s
->mlme
.ssid_len
);
2492 } else if (wpa_s
->mlme
.state
!= IEEE80211_IBSS_JOINED
) {
2493 int interval
= IEEE80211_SCAN_INTERVAL
;
2495 if (time_after(jiffies
, wpa_s
->mlme
.ibss_join_req
+
2496 IEEE80211_IBSS_JOIN_TIMEOUT
)) {
2497 if (wpa_s
->mlme
.create_ibss
&&
2498 ieee80211_ibss_allowed(wpa_s
))
2499 return ieee80211_sta_create_ibss(wpa_s
);
2500 if (wpa_s
->mlme
.create_ibss
) {
2501 wpa_printf(MSG_DEBUG
, "MLME: IBSS not allowed "
2502 "on the configured channel %d "
2504 local
->conf
.channel
,
2508 /* No IBSS found - decrease scan interval and continue
2510 interval
= IEEE80211_SCAN_INTERVAL_SLOW
;
2513 wpa_s
->mlme
.state
= IEEE80211_IBSS_SEARCH
;
2514 ieee80211_reschedule_timer(wpa_s
, interval
);
2523 int ieee80211_sta_get_ssid(struct wpa_supplicant
*wpa_s
, u8
*ssid
,
2526 os_memcpy(ssid
, wpa_s
->mlme
.ssid
, wpa_s
->mlme
.ssid_len
);
2527 *len
= wpa_s
->mlme
.ssid_len
;
2532 int ieee80211_sta_associate(struct wpa_supplicant
*wpa_s
,
2533 struct wpa_driver_associate_params
*params
)
2535 struct ieee80211_sta_bss
*bss
;
2537 wpa_s
->mlme
.bssid_set
= 0;
2538 wpa_s
->mlme
.freq
= params
->freq
;
2539 if (params
->bssid
) {
2540 os_memcpy(wpa_s
->bssid
, params
->bssid
, ETH_ALEN
);
2541 if (!is_zero_ether_addr(params
->bssid
))
2542 wpa_s
->mlme
.bssid_set
= 1;
2543 bss
= ieee80211_bss_get(wpa_s
, wpa_s
->bssid
);
2545 wpa_s
->mlme
.phymode
= bss
->hw_mode
;
2546 wpa_s
->mlme
.channel
= bss
->channel
;
2547 wpa_s
->mlme
.freq
= bss
->freq
;
2552 /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2554 if (local
->hw
->conf_tx
) {
2555 struct ieee80211_tx_queue_params qparam
;
2558 os_memset(&qparam
, 0, sizeof(qparam
));
2559 /* TODO: are these ok defaults for all hw_modes? */
2562 local
->conf
.phymode
== MODE_IEEE80211B
? 31 : 15;
2563 qparam
.cw_max
= 1023;
2564 qparam
.burst_time
= 0;
2565 for (i
= IEEE80211_TX_QUEUE_DATA0
; i
< NUM_TX_DATA_QUEUES
; i
++)
2567 local
->hw
->conf_tx(wpa_s
, i
+ IEEE80211_TX_QUEUE_DATA0
,
2570 /* IBSS uses different parameters for Beacon sending */
2574 local
->hw
->conf_tx(wpa_s
, IEEE80211_TX_QUEUE_BEACON
, &qparam
);
2578 if (wpa_s
->mlme
.ssid_len
!= params
->ssid_len
||
2579 os_memcmp(wpa_s
->mlme
.ssid
, params
->ssid
, params
->ssid_len
) != 0)
2580 wpa_s
->mlme
.prev_bssid_set
= 0;
2581 os_memcpy(wpa_s
->mlme
.ssid
, params
->ssid
, params
->ssid_len
);
2582 os_memset(wpa_s
->mlme
.ssid
+ params
->ssid_len
, 0,
2583 MAX_SSID_LEN
- params
->ssid_len
);
2584 wpa_s
->mlme
.ssid_len
= params
->ssid_len
;
2585 wpa_s
->mlme
.ssid_set
= 1;
2587 os_free(wpa_s
->mlme
.extra_ie
);
2588 if (params
->wpa_ie
== NULL
|| params
->wpa_ie_len
== 0) {
2589 wpa_s
->mlme
.extra_ie
= NULL
;
2590 wpa_s
->mlme
.extra_ie_len
= 0;
2592 wpa_s
->mlme
.extra_ie
= os_malloc(params
->wpa_ie_len
);
2593 if (wpa_s
->mlme
.extra_ie
== NULL
) {
2594 wpa_s
->mlme
.extra_ie_len
= 0;
2597 os_memcpy(wpa_s
->mlme
.extra_ie
, params
->wpa_ie
,
2598 params
->wpa_ie_len
);
2599 wpa_s
->mlme
.extra_ie_len
= params
->wpa_ie_len
;
2602 wpa_s
->mlme
.key_mgmt
= params
->key_mgmt_suite
;
2604 ieee80211_sta_set_channel(wpa_s
, wpa_s
->mlme
.phymode
,
2605 wpa_s
->mlme
.channel
, wpa_s
->mlme
.freq
);
2607 if (params
->mode
== 1 && !wpa_s
->mlme
.bssid_set
) {
2608 os_get_time(&wpa_s
->mlme
.ibss_join_req
);
2609 wpa_s
->mlme
.state
= IEEE80211_IBSS_SEARCH
;
2610 return ieee80211_sta_find_ibss(wpa_s
);
2613 if (wpa_s
->mlme
.bssid_set
)
2614 ieee80211_sta_new_auth(wpa_s
);
2620 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant
*wpa_s
)
2622 wpa_s
->mlme
.scan_oper_channel
= wpa_s
->mlme
.channel
;
2623 wpa_s
->mlme
.scan_oper_freq
= wpa_s
->mlme
.freq
;
2624 wpa_s
->mlme
.scan_oper_phymode
= wpa_s
->mlme
.phymode
;
2628 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant
*wpa_s
)
2630 wpa_s
->mlme
.channel
= wpa_s
->mlme
.scan_oper_channel
;
2631 wpa_s
->mlme
.freq
= wpa_s
->mlme
.scan_oper_freq
;
2632 wpa_s
->mlme
.phymode
= wpa_s
->mlme
.scan_oper_phymode
;
2633 if (wpa_s
->mlme
.freq
== 0)
2635 return ieee80211_sta_set_channel(wpa_s
, wpa_s
->mlme
.phymode
,
2636 wpa_s
->mlme
.channel
,
2641 static int ieee80211_active_scan(struct wpa_supplicant
*wpa_s
)
2646 for (m
= 0; m
< wpa_s
->mlme
.num_modes
; m
++) {
2647 struct wpa_hw_modes
*mode
= &wpa_s
->mlme
.modes
[m
];
2648 if ((int) mode
->mode
!= (int) wpa_s
->mlme
.phymode
)
2650 for (c
= 0; c
< mode
->num_channels
; c
++) {
2651 struct wpa_channel_data
*chan
= &mode
->channels
[c
];
2652 if (chan
->flag
& WPA_CHAN_W_SCAN
&&
2653 chan
->chan
== wpa_s
->mlme
.channel
) {
2654 if (chan
->flag
& WPA_CHAN_W_ACTIVE_SCAN
)
2665 static void ieee80211_sta_scan_timer(void *eloop_ctx
, void *timeout_ctx
)
2667 struct wpa_supplicant
*wpa_s
= eloop_ctx
;
2668 struct wpa_hw_modes
*mode
;
2669 struct wpa_channel_data
*chan
;
2672 struct wpa_ssid
*ssid
= wpa_s
->current_ssid
;
2675 if (!wpa_s
->mlme
.sta_scanning
|| wpa_s
->mlme
.modes
== NULL
)
2678 adhoc
= ssid
&& ssid
->mode
== 1;
2680 switch (wpa_s
->mlme
.scan_state
) {
2681 case SCAN_SET_CHANNEL
:
2682 mode
= &wpa_s
->mlme
.modes
[wpa_s
->mlme
.scan_hw_mode_idx
];
2683 if (wpa_s
->mlme
.scan_hw_mode_idx
>=
2684 (int) wpa_s
->mlme
.num_modes
||
2685 (wpa_s
->mlme
.scan_hw_mode_idx
+ 1 ==
2686 (int) wpa_s
->mlme
.num_modes
2687 && wpa_s
->mlme
.scan_channel_idx
>= mode
->num_channels
)) {
2688 if (ieee80211_sta_restore_oper_chan(wpa_s
)) {
2689 wpa_printf(MSG_DEBUG
, "MLME: failed to "
2690 "restore operational channel after "
2693 wpa_printf(MSG_DEBUG
, "MLME: scan completed");
2694 wpa_s
->mlme
.sta_scanning
= 0;
2695 os_get_time(&wpa_s
->mlme
.last_scan_completed
);
2696 wpa_supplicant_event(wpa_s
, EVENT_SCAN_RESULTS
, NULL
);
2698 if (!wpa_s
->mlme
.bssid_set
||
2699 (wpa_s
->mlme
.state
==
2700 IEEE80211_IBSS_JOINED
&&
2701 !ieee80211_sta_active_ibss(wpa_s
)))
2702 ieee80211_sta_find_ibss(wpa_s
);
2706 skip
= !(wpa_s
->mlme
.hw_modes
& (1 << mode
->mode
));
2707 chan
= &mode
->channels
[wpa_s
->mlme
.scan_channel_idx
];
2708 if (!(chan
->flag
& WPA_CHAN_W_SCAN
) ||
2709 (adhoc
&& !(chan
->flag
& WPA_CHAN_W_IBSS
)) ||
2710 (wpa_s
->mlme
.hw_modes
& (1 << WPA_MODE_IEEE80211G
) &&
2711 mode
->mode
== WPA_MODE_IEEE80211B
&&
2712 wpa_s
->mlme
.scan_skip_11b
))
2716 wpa_printf(MSG_MSGDUMP
,
2717 "MLME: scan channel %d (%d MHz)",
2718 chan
->chan
, chan
->freq
);
2720 wpa_s
->mlme
.channel
= chan
->chan
;
2721 wpa_s
->mlme
.freq
= chan
->freq
;
2722 wpa_s
->mlme
.phymode
= mode
->mode
;
2723 if (ieee80211_sta_set_channel(wpa_s
, mode
->mode
,
2724 chan
->chan
, chan
->freq
))
2726 wpa_printf(MSG_DEBUG
, "MLME: failed to set "
2727 "channel %d (%d MHz) for scan",
2728 chan
->chan
, chan
->freq
);
2733 wpa_s
->mlme
.scan_channel_idx
++;
2734 if (wpa_s
->mlme
.scan_channel_idx
>=
2735 wpa_s
->mlme
.modes
[wpa_s
->mlme
.scan_hw_mode_idx
].
2737 wpa_s
->mlme
.scan_hw_mode_idx
++;
2738 wpa_s
->mlme
.scan_channel_idx
= 0;
2746 timeout
= IEEE80211_PROBE_DELAY
;
2747 wpa_s
->mlme
.scan_state
= SCAN_SEND_PROBE
;
2749 case SCAN_SEND_PROBE
:
2750 if (ieee80211_active_scan(wpa_s
)) {
2751 ieee80211_send_probe_req(wpa_s
, NULL
,
2752 wpa_s
->mlme
.scan_ssid
,
2753 wpa_s
->mlme
.scan_ssid_len
);
2754 timeout
= IEEE80211_CHANNEL_TIME
;
2756 timeout
= IEEE80211_PASSIVE_CHANNEL_TIME
;
2758 wpa_s
->mlme
.scan_state
= SCAN_SET_CHANNEL
;
2762 eloop_register_timeout(timeout
/ 1000, 1000 * (timeout
% 1000),
2763 ieee80211_sta_scan_timer
, wpa_s
, NULL
);
2767 int ieee80211_sta_req_scan(struct wpa_supplicant
*wpa_s
, const u8
*ssid
,
2770 if (ssid_len
> MAX_SSID_LEN
)
2773 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
2774 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2777 * ScanType: ACTIVE, PASSIVE
2778 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2779 * a Probe frame during active scanning
2781 * MinChannelTime (>= ProbeDelay), in TU
2782 * MaxChannelTime: (>= MinChannelTime), in TU
2785 /* MLME-SCAN.confirm
2787 * ResultCode: SUCCESS, INVALID_PARAMETERS
2790 /* TODO: if assoc, move to power save mode for the duration of the
2793 if (wpa_s
->mlme
.sta_scanning
)
2796 wpa_printf(MSG_DEBUG
, "MLME: starting scan");
2798 ieee80211_sta_save_oper_chan(wpa_s
);
2800 wpa_s
->mlme
.sta_scanning
= 1;
2801 /* TODO: stop TX queue? */
2804 wpa_s
->mlme
.scan_ssid_len
= ssid_len
;
2805 os_memcpy(wpa_s
->mlme
.scan_ssid
, ssid
, ssid_len
);
2807 wpa_s
->mlme
.scan_ssid_len
= 0;
2808 wpa_s
->mlme
.scan_skip_11b
= 1; /* FIX: clear this is 11g is not
2810 wpa_s
->mlme
.scan_state
= SCAN_SET_CHANNEL
;
2811 wpa_s
->mlme
.scan_hw_mode_idx
= 0;
2812 wpa_s
->mlme
.scan_channel_idx
= 0;
2813 eloop_register_timeout(0, 1, ieee80211_sta_scan_timer
, wpa_s
, NULL
);
2819 struct wpa_scan_results
*
2820 ieee80211_sta_get_scan_results(struct wpa_supplicant
*wpa_s
)
2823 struct wpa_scan_results
*res
;
2824 struct wpa_scan_res
*r
;
2825 struct ieee80211_sta_bss
*bss
;
2827 res
= os_zalloc(sizeof(*res
));
2828 for (bss
= wpa_s
->mlme
.sta_bss_list
; bss
; bss
= bss
->next
)
2830 res
->res
= os_zalloc(ap_num
* sizeof(struct wpa_scan_res
*));
2831 if (res
->res
== NULL
) {
2836 for (bss
= wpa_s
->mlme
.sta_bss_list
; bss
; bss
= bss
->next
) {
2837 r
= os_zalloc(sizeof(*r
) + bss
->ie_len
);
2840 os_memcpy(r
->bssid
, bss
->bssid
, ETH_ALEN
);
2841 r
->freq
= bss
->freq
;
2842 r
->beacon_int
= bss
->beacon_int
;
2843 r
->caps
= bss
->capability
;
2844 r
->level
= bss
->rssi
;
2845 r
->tsf
= bss
->timestamp
;
2847 r
->ie_len
= bss
->ie_len
;
2848 os_memcpy(r
+ 1, bss
->ie
, bss
->ie_len
);
2851 res
->res
[res
->num
++] = r
;
2859 struct sta_info
* ieee80211_ibss_add_sta(struct wpa_supplicant
*wpa_s
,
2860 struct sk_buff
*skb
, u8
*bssid
,
2863 struct ieee80211_local
*local
= dev
->priv
;
2864 struct list_head
*ptr
;
2865 struct sta_info
*sta
;
2866 struct wpa_supplicant
*sta_dev
= NULL
;
2868 /* TODO: Could consider removing the least recently used entry and
2869 * allow new one to be added. */
2870 if (local
->num_sta
>= IEEE80211_IBSS_MAX_STA_ENTRIES
) {
2871 if (net_ratelimit()) {
2872 wpa_printf(MSG_DEBUG
, "MLME: No room for a new IBSS "
2873 "STA entry " MACSTR
, MAC2STR(addr
));
2878 spin_lock_bh(&local
->sub_if_lock
);
2879 list_for_each(ptr
, &local
->sub_if_list
) {
2880 sdata
= list_entry(ptr
, struct ieee80211_sub_if_data
, list
);
2881 if (sdata
->type
== IEEE80211_SUB_IF_TYPE_STA
&&
2882 os_memcmp(bssid
, sdata
->u
.sta
.bssid
, ETH_ALEN
) == 0) {
2883 sta_dev
= sdata
->dev
;
2887 spin_unlock_bh(&local
->sub_if_lock
);
2889 if (sta_dev
== NULL
)
2892 wpa_printf(MSG_DEBUG
, "MLME: Adding new IBSS station " MACSTR
2893 " (dev=%s)", MAC2STR(addr
), sta_dev
->name
);
2895 sta
= sta_info_add(wpa_s
, addr
);
2901 sta
->supp_rates
= wpa_s
->mlme
.supp_rates_bits
;
2903 rate_control_rate_init(local
, sta
);
2905 return sta
; /* caller will call sta_info_release() */
2910 int ieee80211_sta_deauthenticate(struct wpa_supplicant
*wpa_s
, u16 reason
)
2912 wpa_printf(MSG_DEBUG
, "MLME: deauthenticate(reason=%d)", reason
);
2914 ieee80211_send_deauth(wpa_s
, reason
);
2915 ieee80211_set_associated(wpa_s
, 0);
2920 int ieee80211_sta_disassociate(struct wpa_supplicant
*wpa_s
, u16 reason
)
2922 wpa_printf(MSG_DEBUG
, "MLME: disassociate(reason=%d)", reason
);
2924 if (!wpa_s
->mlme
.associated
)
2927 ieee80211_send_disassoc(wpa_s
, reason
);
2928 ieee80211_set_associated(wpa_s
, 0);
2933 void ieee80211_sta_rx(struct wpa_supplicant
*wpa_s
, const u8
*buf
, size_t len
,
2934 struct ieee80211_rx_status
*rx_status
)
2936 struct ieee80211_mgmt
*mgmt
;
2940 /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2942 if (wpa_s
->mlme
.sta_scanning
) {
2943 ieee80211_sta_rx_scan(wpa_s
, buf
, len
, rx_status
);
2950 mgmt
= (struct ieee80211_mgmt
*) buf
;
2951 fc
= le_to_host16(mgmt
->frame_control
);
2953 if (WLAN_FC_GET_TYPE(fc
) == WLAN_FC_TYPE_MGMT
)
2954 ieee80211_sta_rx_mgmt(wpa_s
, buf
, len
, rx_status
);
2955 else if (WLAN_FC_GET_TYPE(fc
) == WLAN_FC_TYPE_DATA
) {
2956 if ((fc
& (WLAN_FC_TODS
| WLAN_FC_FROMDS
)) !=
2959 /* mgmt->sa is actually BSSID for FromDS data frames */
2960 if (os_memcmp(mgmt
->sa
, wpa_s
->bssid
, ETH_ALEN
) != 0)
2962 /* Skip IEEE 802.11 and LLC headers */
2964 if (WPA_GET_BE16(pos
) != ETH_P_EAPOL
)
2967 /* mgmt->bssid is actually BSSID for SA data frames */
2968 wpa_supplicant_rx_eapol(wpa_s
, mgmt
->bssid
,
2969 pos
, buf
+ len
- pos
);
2974 void ieee80211_sta_free_hw_features(struct wpa_hw_modes
*hw_features
,
2975 size_t num_hw_features
)
2979 if (hw_features
== NULL
)
2982 for (i
= 0; i
< num_hw_features
; i
++) {
2983 os_free(hw_features
[i
].channels
);
2984 os_free(hw_features
[i
].rates
);
2987 os_free(hw_features
);
2991 int ieee80211_sta_init(struct wpa_supplicant
*wpa_s
)
2993 u16 num_modes
, flags
;
2995 wpa_s
->mlme
.modes
= wpa_drv_get_hw_feature_data(wpa_s
, &num_modes
,
2997 if (wpa_s
->mlme
.modes
== NULL
) {
2998 wpa_printf(MSG_ERROR
, "MLME: Failed to read supported "
2999 "channels and rates from the driver");
3003 wpa_s
->mlme
.num_modes
= num_modes
;
3005 wpa_s
->mlme
.hw_modes
= 1 << WPA_MODE_IEEE80211A
;
3006 wpa_s
->mlme
.hw_modes
|= 1 << WPA_MODE_IEEE80211B
;
3007 wpa_s
->mlme
.hw_modes
|= 1 << WPA_MODE_IEEE80211G
;
3013 void ieee80211_sta_deinit(struct wpa_supplicant
*wpa_s
)
3015 eloop_cancel_timeout(ieee80211_sta_timer
, wpa_s
, NULL
);
3016 eloop_cancel_timeout(ieee80211_sta_scan_timer
, wpa_s
, NULL
);
3017 os_free(wpa_s
->mlme
.extra_ie
);
3018 wpa_s
->mlme
.extra_ie
= NULL
;
3019 os_free(wpa_s
->mlme
.extra_probe_ie
);
3020 wpa_s
->mlme
.extra_probe_ie
= NULL
;
3021 os_free(wpa_s
->mlme
.assocreq_ies
);
3022 wpa_s
->mlme
.assocreq_ies
= NULL
;
3023 os_free(wpa_s
->mlme
.assocresp_ies
);
3024 wpa_s
->mlme
.assocresp_ies
= NULL
;
3025 ieee80211_bss_list_deinit(wpa_s
);
3026 ieee80211_sta_free_hw_features(wpa_s
->mlme
.modes
,
3027 wpa_s
->mlme
.num_modes
);
3028 #ifdef CONFIG_IEEE80211R
3029 os_free(wpa_s
->mlme
.ft_ies
);
3030 wpa_s
->mlme
.ft_ies
= NULL
;
3031 wpa_s
->mlme
.ft_ies_len
= 0;
3032 #endif /* CONFIG_IEEE80211R */
3036 #ifdef CONFIG_IEEE80211R
3038 int ieee80211_sta_update_ft_ies(struct wpa_supplicant
*wpa_s
, const u8
*md
,
3039 const u8
*ies
, size_t ies_len
)
3042 wpa_printf(MSG_DEBUG
, "MLME: Clear FT mobility domain");
3043 os_memset(wpa_s
->mlme
.current_md
, 0, MOBILITY_DOMAIN_ID_LEN
);
3045 wpa_printf(MSG_DEBUG
, "MLME: Update FT IEs for MD " MACSTR
,
3047 os_memcpy(wpa_s
->mlme
.current_md
, md
, MOBILITY_DOMAIN_ID_LEN
);
3050 wpa_hexdump(MSG_DEBUG
, "MLME: FT IEs", ies
, ies_len
);
3051 os_free(wpa_s
->mlme
.ft_ies
);
3052 wpa_s
->mlme
.ft_ies
= os_malloc(ies_len
);
3053 if (wpa_s
->mlme
.ft_ies
== NULL
)
3055 os_memcpy(wpa_s
->mlme
.ft_ies
, ies
, ies_len
);
3056 wpa_s
->mlme
.ft_ies_len
= ies_len
;
3062 int ieee80211_sta_send_ft_action(struct wpa_supplicant
*wpa_s
, u8 action
,
3063 const u8
*target_ap
,
3064 const u8
*ies
, size_t ies_len
)
3068 struct ieee80211_mgmt
*mgmt
;
3072 * Action frame payload:
3073 * Category[1] = 6 (Fast BSS Transition)
3074 * Action[1] = 1 (Fast BSS Transition Request)
3080 buf
= os_zalloc(sizeof(*mgmt
) + ies_len
);
3082 wpa_printf(MSG_DEBUG
, "MLME: Failed to allocate buffer for "
3087 mgmt
= (struct ieee80211_mgmt
*) buf
;
3089 os_memcpy(mgmt
->da
, wpa_s
->bssid
, ETH_ALEN
);
3090 os_memcpy(mgmt
->sa
, wpa_s
->own_addr
, ETH_ALEN
);
3091 os_memcpy(mgmt
->bssid
, wpa_s
->bssid
, ETH_ALEN
);
3092 mgmt
->frame_control
= IEEE80211_FC(WLAN_FC_TYPE_MGMT
,
3093 WLAN_FC_STYPE_ACTION
);
3094 mgmt
->u
.action
.category
= WLAN_ACTION_FT
;
3095 mgmt
->u
.action
.u
.ft_action_req
.action
= action
;
3096 os_memcpy(mgmt
->u
.action
.u
.ft_action_req
.sta_addr
, wpa_s
->own_addr
,
3098 os_memcpy(mgmt
->u
.action
.u
.ft_action_req
.target_ap_addr
, target_ap
,
3100 os_memcpy(mgmt
->u
.action
.u
.ft_action_req
.variable
, ies
, ies_len
);
3101 len
+= 1 + sizeof(mgmt
->u
.action
.u
.ft_action_req
) + ies_len
;
3103 wpa_printf(MSG_DEBUG
, "MLME: Send FT Action Frame: Action=%d "
3104 "Target AP=" MACSTR
" body_len=%d",
3105 action
, MAC2STR(target_ap
), ies_len
);
3107 res
= ieee80211_sta_tx(wpa_s
, buf
, len
);
3113 #endif /* CONFIG_IEEE80211R */
3116 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant
*wpa_s
, const u8
*ies
,
3119 os_free(wpa_s
->mlme
.extra_probe_ie
);
3120 wpa_s
->mlme
.extra_probe_ie
= NULL
;
3121 wpa_s
->mlme
.extra_probe_ie_len
= 0;
3126 wpa_s
->mlme
.extra_probe_ie
= os_malloc(ies_len
);
3127 if (wpa_s
->mlme
.extra_probe_ie
== NULL
)
3130 os_memcpy(wpa_s
->mlme
.extra_probe_ie
, ies
, ies_len
);
3131 wpa_s
->mlme
.extra_probe_ie_len
= ies_len
;