]> git.ipfire.org Git - thirdparty/hostap.git/blobdiff - src/drivers/driver_nl80211.c
nl80211: Extended Key ID support
[thirdparty/hostap.git] / src / drivers / driver_nl80211.c
index 998b3948b4e3f954f430189b6cde6525a7c377c8..ba8d079b28790217acb865d614524c405dea2d26 100644 (file)
@@ -165,7 +165,8 @@ wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv,
                                   const char *driver_params);
 static int nl80211_send_frame_cmd(struct i802_bss *bss,
                                  unsigned int freq, unsigned int wait,
-                                 const u8 *buf, size_t buf_len, u64 *cookie,
+                                 const u8 *buf, size_t buf_len,
+                                 int save_cookie,
                                  int no_cck, int no_ack, int offchanok,
                                  const u16 *csa_offs, size_t csa_offs_len);
 static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss,
@@ -2107,7 +2108,7 @@ static int nl80211_register_frame(struct i802_bss *bss,
        wpa_printf(MSG_DEBUG, "nl80211: Register frame type=0x%x (%s) nl_handle=%p match=%s",
                   type, fc2str(type), nl_handle, buf);
 
-       if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_ACTION)) ||
+       if (!(msg = nl80211_cmd_msg(bss, 0, NL80211_CMD_REGISTER_FRAME)) ||
            nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE, type) ||
            nla_put(msg, NL80211_ATTR_FRAME_MATCH, match_len, match)) {
                nlmsg_free(msg);
@@ -2181,6 +2182,7 @@ static int nl80211_init_connect_handle(struct i802_bss *bss)
 static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
 {
        struct wpa_driver_nl80211_data *drv = bss->drv;
+       u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
        int ret = 0;
 
        if (nl80211_alloc_mgmt_handle(bss))
@@ -2188,13 +2190,14 @@ static int nl80211_mgmt_subscribe_non_ap(struct i802_bss *bss)
        wpa_printf(MSG_DEBUG, "nl80211: Subscribe to mgmt frames with non-AP "
                   "handle %p", bss->nl_mgmt);
 
-       if (drv->nlmode == NL80211_IFTYPE_ADHOC ||
-           ((drv->capa.flags & WPA_DRIVER_FLAGS_SAE) &&
-            !(drv->capa.flags & WPA_DRIVER_FLAGS_SME))) {
-               u16 type = (WLAN_FC_TYPE_MGMT << 2) | (WLAN_FC_STYPE_AUTH << 4);
-
+       if (drv->nlmode == NL80211_IFTYPE_ADHOC) {
                /* register for any AUTH message */
                nl80211_register_frame(bss, bss->nl_mgmt, type, NULL, 0);
+       } else if ((drv->capa.flags & WPA_DRIVER_FLAGS_SAE) &&
+                  !(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
+               /* register for SAE Authentication frames */
+               nl80211_register_frame(bss, bss->nl_mgmt, type,
+                                      (u8 *) "\x03\x00", 2);
        }
 
 #ifdef CONFIG_INTERWORKING
@@ -2880,7 +2883,6 @@ static u32 wpa_alg_to_cipher_suite(enum wpa_alg alg, size_t key_len)
        case WPA_ALG_KRK:
                return RSN_CIPHER_SUITE_KRK;
        case WPA_ALG_NONE:
-       case WPA_ALG_PMK:
                wpa_printf(MSG_ERROR, "nl80211: Unexpected encryption algorithm %d",
                           alg);
                return 0;
@@ -2941,6 +2943,40 @@ static int wpa_cipher_to_cipher_suites(unsigned int ciphers, u32 suites[],
 }
 
 
+static int wpa_key_mgmt_to_suites(unsigned int key_mgmt_suites, u32 suites[],
+                                 int max_suites)
+{
+       int num_suites = 0;
+
+#define __AKM(a, b) \
+       if (num_suites < max_suites && \
+           (key_mgmt_suites & (WPA_KEY_MGMT_ ## a))) \
+               suites[num_suites++] = (RSN_AUTH_KEY_MGMT_ ## b)
+       __AKM(IEEE8021X, UNSPEC_802_1X);
+       __AKM(PSK, PSK_OVER_802_1X);
+       __AKM(FT_IEEE8021X, FT_802_1X);
+       __AKM(FT_PSK, FT_PSK);
+       __AKM(IEEE8021X_SHA256, 802_1X_SHA256);
+       __AKM(PSK_SHA256, PSK_SHA256);
+       __AKM(SAE, SAE);
+       __AKM(FT_SAE, FT_SAE);
+       __AKM(CCKM, CCKM);
+       __AKM(OSEN, OSEN);
+       __AKM(IEEE8021X_SUITE_B, 802_1X_SUITE_B);
+       __AKM(IEEE8021X_SUITE_B_192, 802_1X_SUITE_B_192);
+       __AKM(FILS_SHA256, FILS_SHA256);
+       __AKM(FILS_SHA384, FILS_SHA384);
+       __AKM(FT_FILS_SHA256, FT_FILS_SHA256);
+       __AKM(FT_FILS_SHA384, FT_FILS_SHA384);
+       __AKM(OWE, OWE);
+       __AKM(DPP, DPP);
+       __AKM(FT_IEEE8021X_SHA384, FT_802_1X_SHA384);
+#undef __AKM
+
+       return num_suites;
+}
+
+
 #ifdef CONFIG_DRIVER_NL80211_QCA
 static int issue_key_mgmt_set_key(struct wpa_driver_nl80211_data *drv,
                                  const u8 *key, size_t key_len)
@@ -3010,18 +3046,26 @@ static int nl80211_set_pmk(struct wpa_driver_nl80211_data *drv,
 }
 
 
-static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
-                                     enum wpa_alg alg, const u8 *addr,
-                                     int key_idx, int set_tx,
-                                     const u8 *seq, size_t seq_len,
-                                     const u8 *key, size_t key_len)
+static int wpa_driver_nl80211_set_key(struct i802_bss *bss,
+                                     struct wpa_driver_set_key_params *params)
 {
        struct wpa_driver_nl80211_data *drv = bss->drv;
        int ifindex;
        struct nl_msg *msg;
        struct nl_msg *key_msg;
        int ret;
-       int tdls = 0;
+       int skip_set_key = 1;
+       const char *ifname = params->ifname;
+       enum wpa_alg alg = params->alg;
+       const u8 *addr = params->addr;
+       int key_idx = params->key_idx;
+       int set_tx = params->set_tx;
+       const u8 *seq = params->seq;
+       size_t seq_len = params->seq_len;
+       const u8 *key = params->key;
+       size_t key_len = params->key_len;
+       int vlan_id = params->vlan_id;
+       enum key_flag key_flag = params->key_flag;
 
        /* Ignore for P2P Device */
        if (drv->nlmode == NL80211_IFTYPE_P2P_DEVICE)
@@ -3029,18 +3073,17 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
 
        ifindex = if_nametoindex(ifname);
        wpa_printf(MSG_DEBUG, "%s: ifindex=%d (%s) alg=%d addr=%p key_idx=%d "
-                  "set_tx=%d seq_len=%lu key_len=%lu",
+                  "set_tx=%d seq_len=%lu key_len=%lu key_flag=0x%x",
                   __func__, ifindex, ifname, alg, addr, key_idx, set_tx,
-                  (unsigned long) seq_len, (unsigned long) key_len);
-#ifdef CONFIG_TDLS
-       if (key_idx == -1) {
-               key_idx = 0;
-               tdls = 1;
+                  (unsigned long) seq_len, (unsigned long) key_len, key_flag);
+
+       if (check_key_flag(key_flag)) {
+               wpa_printf(MSG_DEBUG, "%s: invalid key_flag", __func__);
+               return -EINVAL;
        }
-#endif /* CONFIG_TDLS */
 
 #ifdef CONFIG_DRIVER_NL80211_QCA
-       if (alg == WPA_ALG_PMK &&
+       if ((key_flag & KEY_FLAG_PMK) &&
            (drv->capa.flags & WPA_DRIVER_FLAGS_KEY_MGMT_OFFLOAD)) {
                wpa_printf(MSG_DEBUG, "%s: calling issue_key_mgmt_set_key",
                           __func__);
@@ -3049,15 +3092,30 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
        }
 #endif /* CONFIG_DRIVER_NL80211_QCA */
 
-       if (alg == WPA_ALG_PMK &&
-           (drv->capa.flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X))
-               return nl80211_set_pmk(drv, key, key_len, addr);
+       if (key_flag & KEY_FLAG_PMK) {
+               if (drv->capa.flags & WPA_DRIVER_FLAGS_4WAY_HANDSHAKE_8021X)
+                       return nl80211_set_pmk(drv, key, key_len, addr);
+               /* The driver does not have any offload mechanism for PMK, so
+                * there is no need to configure this key. */
+               return 0;
+       }
 
+       ret = -ENOBUFS;
        key_msg = nlmsg_alloc();
        if (!key_msg)
-               return -ENOBUFS;
+               return ret;
 
-       if (alg == WPA_ALG_NONE) {
+       if ((key_flag & KEY_FLAG_PAIRWISE_MASK) ==
+           KEY_FLAG_PAIRWISE_RX_TX_MODIFY) {
+               msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
+               if (!msg)
+                       goto fail2;
+       } else if (alg == WPA_ALG_NONE && (key_flag & KEY_FLAG_RX_TX)) {
+               wpa_printf(MSG_DEBUG, "%s: invalid key_flag to delete key",
+                          __func__);
+               ret = -EINVAL;
+               goto fail2;
+       } else if (alg == WPA_ALG_NONE) {
                msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_DEL_KEY);
                if (!msg)
                        goto fail2;
@@ -3065,8 +3123,10 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
                u32 suite;
 
                suite = wpa_alg_to_cipher_suite(alg, key_len);
-               if (!suite)
+               if (!suite) {
+                       ret = -EINVAL;
                        goto fail2;
+               }
                msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_NEW_KEY);
                if (!msg)
                        goto fail2;
@@ -3074,12 +3134,13 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
                    nla_put_u32(key_msg, NL80211_KEY_CIPHER, suite))
                        goto fail;
                wpa_hexdump_key(MSG_DEBUG, "nl80211: KEY_DATA", key, key_len);
-       }
 
-       if (seq && seq_len) {
-               if (nla_put(key_msg, NL80211_KEY_SEQ, seq_len, seq))
-                       goto fail;
-               wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ", seq, seq_len);
+               if (seq && seq_len) {
+                       if (nla_put(key_msg, NL80211_KEY_SEQ, seq_len, seq))
+                               goto fail;
+                       wpa_hexdump(MSG_DEBUG, "nl80211: KEY_SEQ",
+                                   seq, seq_len);
+               }
        }
 
        if (addr && !is_broadcast_ether_addr(addr)) {
@@ -3087,22 +3148,42 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
                if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
                        goto fail;
 
-               if (alg != WPA_ALG_WEP && key_idx && !set_tx) {
+               if ((key_flag & KEY_FLAG_PAIRWISE_MASK) ==
+                   KEY_FLAG_PAIRWISE_RX ||
+                   (key_flag & KEY_FLAG_PAIRWISE_MASK) ==
+                   KEY_FLAG_PAIRWISE_RX_TX_MODIFY) {
+                       if (nla_put_u8(key_msg, NL80211_KEY_MODE,
+                                      key_flag == KEY_FLAG_PAIRWISE_RX ?
+                                      NL80211_KEY_NO_TX : NL80211_KEY_SET_TX))
+                               goto fail;
+               } else if ((key_flag & KEY_FLAG_GROUP_MASK) ==
+                          KEY_FLAG_GROUP_RX) {
                        wpa_printf(MSG_DEBUG, "   RSN IBSS RX GTK");
                        if (nla_put_u32(key_msg, NL80211_KEY_TYPE,
                                        NL80211_KEYTYPE_GROUP))
                                goto fail;
+               } else if (!(key_flag & KEY_FLAG_PAIRWISE)) {
+                       wpa_printf(MSG_DEBUG,
+                                  "   key_flag missing PAIRWISE when setting a pairwise key");
+                       ret = -EINVAL;
+                       goto fail;
+               } else if (alg == WPA_ALG_WEP &&
+                          (key_flag & KEY_FLAG_RX_TX) == KEY_FLAG_RX_TX) {
+                       wpa_printf(MSG_DEBUG, "   unicast WEP key");
+                       skip_set_key = 0;
+               } else {
+                       wpa_printf(MSG_DEBUG, "   pairwise key");
                }
-       } else if (addr && is_broadcast_ether_addr(addr)) {
-               struct nlattr *types;
-
+       } else if ((key_flag & KEY_FLAG_PAIRWISE) ||
+                  !(key_flag & KEY_FLAG_GROUP)) {
+               wpa_printf(MSG_DEBUG,
+                          "   invalid key_flag for a broadcast key");
+               ret = -EINVAL;
+               goto fail;
+       } else {
                wpa_printf(MSG_DEBUG, "   broadcast key");
-
-               types = nla_nest_start(key_msg, NL80211_KEY_DEFAULT_TYPES);
-               if (!types ||
-                   nla_put_flag(key_msg, NL80211_KEY_DEFAULT_TYPE_MULTICAST))
-                       goto fail;
-               nla_nest_end(key_msg, types);
+               if (key_flag & KEY_FLAG_DEFAULT)
+                       skip_set_key = 0;
        }
        if (nla_put_u8(key_msg, NL80211_KEY_IDX, key_idx) ||
            nla_put_nested(msg, NL80211_ATTR_KEY, key_msg))
@@ -3111,26 +3192,31 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
        nlmsg_free(key_msg);
        key_msg = NULL;
 
+       if (vlan_id && (drv->capa.flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD)) {
+               wpa_printf(MSG_DEBUG, "nl80211: VLAN ID %d", vlan_id);
+               if (nla_put_u16(msg, NL80211_ATTR_VLAN_ID, vlan_id))
+                       goto fail;
+       }
+
        ret = send_and_recv_msgs(drv, msg, NULL, key ? (void *) -1 : NULL);
        if ((ret == -ENOENT || ret == -ENOLINK) && alg == WPA_ALG_NONE)
                ret = 0;
        if (ret)
-               wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
+               wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s",
                           ret, strerror(-ret));
 
        /*
-        * If we failed or don't need to set the default TX key (below),
+        * If we failed or don't need to set the key as default (below),
         * we're done here.
         */
-       if (ret || !set_tx || alg == WPA_ALG_NONE || tdls)
-               return ret;
-       if (is_ap_interface(drv->nlmode) && addr &&
-           !is_broadcast_ether_addr(addr))
+       if (ret || skip_set_key)
                return ret;
+       wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_SET_KEY - default key");
 
+       ret = -ENOBUFS;
        key_msg = nlmsg_alloc();
        if (!key_msg)
-               return -ENOBUFS;
+               return ret;
 
        msg = nl80211_ifindex_msg(drv, ifindex, 0, NL80211_CMD_SET_KEY);
        if (!msg)
@@ -3141,8 +3227,10 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
                                   alg == WPA_ALG_BIP_GMAC_128 ||
                                   alg == WPA_ALG_BIP_GMAC_256 ||
                                   alg == WPA_ALG_BIP_CMAC_256) ?
-                                  NL80211_KEY_DEFAULT_MGMT :
-                                  NL80211_KEY_DEFAULT))
+                        (key_idx == 6 || key_idx == 7 ?
+                         NL80211_KEY_DEFAULT_BEACON :
+                         NL80211_KEY_DEFAULT_MGMT) :
+                        NL80211_KEY_DEFAULT))
                goto fail;
        if (addr && is_broadcast_ether_addr(addr)) {
                struct nlattr *types;
@@ -3168,12 +3256,18 @@ static int wpa_driver_nl80211_set_key(const char *ifname, struct i802_bss *bss,
        nlmsg_free(key_msg);
        key_msg = NULL;
 
+       if (vlan_id && (drv->capa.flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD)) {
+               wpa_printf(MSG_DEBUG, "nl80211: set_key default - VLAN ID %d",
+                          vlan_id);
+               if (nla_put_u16(msg, NL80211_ATTR_VLAN_ID, vlan_id))
+                       goto fail;
+       }
+
        ret = send_and_recv_msgs(drv, msg, NULL, NULL);
-       if (ret == -ENOENT)
-               ret = 0;
        if (ret)
-               wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
-                          "err=%d %s)", ret, strerror(-ret));
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: set_key default failed; err=%d %s",
+                          ret, strerror(-ret));
        return ret;
 
 fail:
@@ -3182,7 +3276,7 @@ fail:
 fail2:
        nl80211_nlmsg_clear(key_msg);
        nlmsg_free(key_msg);
-       return -ENOBUFS;
+       return ret;
 }
 
 
@@ -3457,6 +3551,7 @@ static int wpa_driver_nl80211_authenticate(
        enum nl80211_iftype nlmode;
        int count = 0;
        int is_retry;
+       struct wpa_driver_set_key_params p;
 
        nl80211_unmask_11b_rates(bss);
 
@@ -3485,14 +3580,20 @@ retry:
        if (!msg)
                goto fail;
 
+       os_memset(&p, 0, sizeof(p));
+       p.ifname = bss->ifname;
+       p.alg = WPA_ALG_WEP;
        for (i = 0; i < 4; i++) {
                if (!params->wep_key[i])
                        continue;
-               wpa_driver_nl80211_set_key(bss->ifname, bss, WPA_ALG_WEP,
-                                          NULL, i,
-                                          i == params->wep_tx_keyidx, NULL, 0,
-                                          params->wep_key[i],
-                                          params->wep_key_len[i]);
+               p.key_idx = i;
+               p.set_tx = i == params->wep_tx_keyidx;
+               p.key = params->wep_key[i];
+               p.key_len = params->wep_key_len[i];
+               p.key_flag = i == params->wep_tx_keyidx ?
+                       KEY_FLAG_GROUP_RX_TX_DEFAULT :
+                       KEY_FLAG_GROUP_RX_TX;
+               wpa_driver_nl80211_set_key(bss, &p);
                if (params->wep_tx_keyidx != i)
                        continue;
                if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0,
@@ -3654,80 +3755,27 @@ int wpa_driver_nl80211_authenticate_retry(struct wpa_driver_nl80211_data *drv)
 }
 
 
-static int wpa_driver_nl80211_send_frame(struct i802_bss *bss,
-                                        const void *data, size_t len,
-                                        int encrypt, int noack,
-                                        unsigned int freq, int no_cck,
-                                        int offchanok, unsigned int wait_time,
-                                        const u16 *csa_offs,
-                                        size_t csa_offs_len)
-{
-       struct wpa_driver_nl80211_data *drv = bss->drv;
-       u64 cookie;
-       int res;
-
-       if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
-               freq = nl80211_get_assoc_freq(drv);
-               wpa_printf(MSG_DEBUG,
-                          "nl80211: send_frame - Use assoc_freq=%u for IBSS",
-                          freq);
-       }
-       if (freq == 0) {
-               wpa_printf(MSG_DEBUG, "nl80211: send_frame - Use bss->freq=%u",
-                          bss->freq);
-               freq = bss->freq;
-       }
-
-       if (drv->use_monitor) {
-               wpa_printf(MSG_DEBUG, "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
-                          freq, bss->freq);
-               return nl80211_send_monitor(drv, data, len, encrypt, noack);
-       }
-
-       wpa_printf(MSG_DEBUG, "nl80211: send_frame -> send_frame_cmd");
-       res = nl80211_send_frame_cmd(bss, freq, wait_time, data, len,
-                                    &cookie, no_cck, noack, offchanok,
-                                    csa_offs, csa_offs_len);
-       if (res == 0 && !noack) {
-               const struct ieee80211_mgmt *mgmt;
-               u16 fc;
-
-               mgmt = (const struct ieee80211_mgmt *) data;
-               fc = le_to_host16(mgmt->frame_control);
-               if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
-                   WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_ACTION) {
-                       wpa_printf(MSG_MSGDUMP,
-                                  "nl80211: Update send_action_cookie from 0x%llx to 0x%llx",
-                                  (long long unsigned int)
-                                  drv->send_action_cookie,
-                                  (long long unsigned int) cookie);
-                       drv->send_action_cookie = cookie;
-               }
-       }
-
-       return res;
-}
-
-
 static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
                                        size_t data_len, int noack,
                                        unsigned int freq, int no_cck,
                                        int offchanok,
                                        unsigned int wait_time,
                                        const u16 *csa_offs,
-                                       size_t csa_offs_len)
+                                       size_t csa_offs_len, int no_encrypt)
 {
        struct wpa_driver_nl80211_data *drv = bss->drv;
        struct ieee80211_mgmt *mgmt;
-       int encrypt = 1;
+       int encrypt = !no_encrypt;
        u16 fc;
+       int use_cookie = 1;
+       int res;
 
        mgmt = (struct ieee80211_mgmt *) data;
        fc = le_to_host16(mgmt->frame_control);
-       wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da= " MACSTR
-                  " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u fc=0x%x (%s) nlmode=%d",
+       wpa_printf(MSG_DEBUG, "nl80211: send_mlme - da=" MACSTR
+                  " noack=%d freq=%u no_cck=%d offchanok=%d wait_time=%u no_encrypt=%d fc=0x%x (%s) nlmode=%d",
                   MAC2STR(mgmt->da), noack, freq, no_cck, offchanok, wait_time,
-                  fc, fc2str(fc), drv->nlmode);
+                  no_encrypt, fc, fc2str(fc), drv->nlmode);
 
        if ((is_sta_interface(drv->nlmode) ||
             drv->nlmode == NL80211_IFTYPE_P2P_DEVICE) &&
@@ -3743,9 +3791,11 @@ static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
                                   drv->last_mgmt_freq);
                        freq = drv->last_mgmt_freq;
                }
-               return nl80211_send_frame_cmd(bss, freq, 0,
-                                             data, data_len, NULL, 1, noack,
-                                             1, csa_offs, csa_offs_len);
+               wait_time = 0;
+               use_cookie = 0;
+               no_cck = 1;
+               offchanok = 1;
+               goto send_frame_cmd;
        }
 
        if (drv->device_ap_sme && is_ap_interface(drv->nlmode)) {
@@ -3754,13 +3804,9 @@ static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
                                   bss->freq);
                        freq = bss->freq;
                }
-               return nl80211_send_frame_cmd(bss, freq,
-                                             (int) freq == bss->freq ? 0 :
-                                             wait_time,
-                                             data, data_len,
-                                             &drv->send_action_cookie,
-                                             no_cck, noack, offchanok,
-                                             csa_offs, csa_offs_len);
+               if ((int) freq == bss->freq)
+                       wait_time = 0;
+               goto send_frame_cmd;
        }
 
        if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
@@ -3777,11 +3823,60 @@ static int wpa_driver_nl80211_send_mlme(struct i802_bss *bss, const u8 *data,
                        encrypt = 0;
        }
 
-       wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame");
-       return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt,
-                                            noack, freq, no_cck, offchanok,
-                                            wait_time, csa_offs,
-                                            csa_offs_len);
+       if (freq == 0 && drv->nlmode == NL80211_IFTYPE_STATION &&
+           (drv->capa.flags & WPA_DRIVER_FLAGS_SAE) &&
+           !(drv->capa.flags & WPA_DRIVER_FLAGS_SME) &&
+           WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
+           WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
+               freq = nl80211_get_assoc_freq(drv);
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: send_mlme - Use assoc_freq=%u for external auth",
+                          freq);
+       }
+
+       if (freq == 0 && drv->nlmode == NL80211_IFTYPE_ADHOC) {
+               freq = nl80211_get_assoc_freq(drv);
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: send_mlme - Use assoc_freq=%u for IBSS",
+                          freq);
+       }
+       if (freq == 0) {
+               wpa_printf(MSG_DEBUG, "nl80211: send_mlme - Use bss->freq=%u",
+                          bss->freq);
+               freq = bss->freq;
+       }
+
+       if (drv->use_monitor) {
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: send_frame(freq=%u bss->freq=%u) -> send_monitor",
+                          freq, bss->freq);
+               return nl80211_send_monitor(drv, data, data_len, encrypt,
+                                           noack);
+       }
+
+       if (noack || WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT ||
+           WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_ACTION)
+               use_cookie = 0;
+send_frame_cmd:
+#ifdef CONFIG_TESTING_OPTIONS
+       if (no_encrypt && !encrypt && !drv->use_monitor) {
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: Request to send an unencrypted frame - use a monitor interface for this");
+               if (nl80211_create_monitor_interface(drv) < 0)
+                       return -1;
+               res = nl80211_send_monitor(drv, data, data_len, encrypt,
+                                          noack);
+               nl80211_remove_monitor_interface(drv);
+               return res;
+       }
+#endif /* CONFIG_TESTING_OPTIONS */
+
+       wpa_printf(MSG_DEBUG, "nl80211: send_mlme -> send_frame_cmd");
+       res = nl80211_send_frame_cmd(bss, freq, wait_time, data, data_len,
+                                    use_cookie, no_cck, noack, offchanok,
+                                    csa_offs, csa_offs_len);
+
+       return res;
 }
 
 
@@ -4083,8 +4178,7 @@ static int wpa_driver_nl80211_set_ap(void *priv,
        int ret = -ENOBUFS;
        int beacon_set;
        int num_suites;
-       int smps_mode;
-       u32 suites[10], suite;
+       u32 suites[20], suite;
        u32 ver;
 #ifdef CONFIG_MESH
        struct wpa_driver_mesh_bss_params mesh_params;
@@ -4178,14 +4272,15 @@ static int wpa_driver_nl80211_set_ap(void *priv,
 
        wpa_printf(MSG_DEBUG, "nl80211: key_mgmt_suites=0x%x",
                   params->key_mgmt_suites);
-       num_suites = 0;
-       if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X)
-               suites[num_suites++] = RSN_AUTH_KEY_MGMT_UNSPEC_802_1X;
-       if (params->key_mgmt_suites & WPA_KEY_MGMT_PSK)
-               suites[num_suites++] = RSN_AUTH_KEY_MGMT_PSK_OVER_802_1X;
-       if (num_suites &&
-           nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
-                   suites))
+       num_suites = wpa_key_mgmt_to_suites(params->key_mgmt_suites,
+                                           suites, ARRAY_SIZE(suites));
+       if (num_suites > NL80211_MAX_NR_AKM_SUITES)
+               wpa_printf(MSG_WARNING,
+                          "nl80211: Not enough room for all AKM suites (num_suites=%d > NL80211_MAX_NR_AKM_SUITES)",
+                          num_suites);
+       else if (num_suites &&
+                nla_put(msg, NL80211_ATTR_AKM_SUITES, num_suites * sizeof(u32),
+                        suites))
                goto fail;
 
        if (params->key_mgmt_suites & WPA_KEY_MGMT_IEEE8021X_NO_WPA &&
@@ -4216,27 +4311,6 @@ static int wpa_driver_nl80211_set_ap(void *priv,
            nla_put_u32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, suite))
                goto fail;
 
-       if (params->ht_opmode != -1) {
-               switch (params->smps_mode) {
-               case HT_CAP_INFO_SMPS_DYNAMIC:
-                       wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - dynamic");
-                       smps_mode = NL80211_SMPS_DYNAMIC;
-                       break;
-               case HT_CAP_INFO_SMPS_STATIC:
-                       wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - static");
-                       smps_mode = NL80211_SMPS_STATIC;
-                       break;
-               default:
-                       /* invalid - fallback to smps off */
-               case HT_CAP_INFO_SMPS_DISABLED:
-                       wpa_printf(MSG_DEBUG, "nl80211: SMPS mode - off");
-                       smps_mode = NL80211_SMPS_OFF;
-                       break;
-               }
-               if (nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, smps_mode))
-                       goto fail;
-       }
-
        if (params->beacon_ies) {
                wpa_hexdump_buf(MSG_DEBUG, "nl80211: beacon_ies",
                                params->beacon_ies);
@@ -4321,7 +4395,8 @@ static int wpa_driver_nl80211_set_ap(void *priv,
                spr = nla_nest_start(msg, NL80211_ATTR_HE_OBSS_PD);
                wpa_printf(MSG_DEBUG, "nl80211: he_spr=%d", params->he_spr);
 
-               if (nla_put_u8(msg, NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET,
+               if (!spr ||
+                   nla_put_u8(msg, NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET,
                               params->he_spr_srg_obss_pd_min_offset) ||
                    nla_put_u8(msg, NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET,
                               params->he_spr_srg_obss_pd_max_offset))
@@ -4329,6 +4404,28 @@ static int wpa_driver_nl80211_set_ap(void *priv,
 
                nla_nest_end(msg, spr);
        }
+
+       if (params->freq && params->freq->he_enabled) {
+               struct nlattr *bss_color;
+
+               bss_color = nla_nest_start(msg, NL80211_ATTR_HE_BSS_COLOR);
+               if (!bss_color ||
+                   (params->he_bss_color_disabled &&
+                    nla_put_flag(msg, NL80211_HE_BSS_COLOR_ATTR_DISABLED)) ||
+                   (params->he_bss_color_partial &&
+                    nla_put_flag(msg, NL80211_HE_BSS_COLOR_ATTR_PARTIAL)) ||
+                   nla_put_u8(msg, NL80211_HE_BSS_COLOR_ATTR_COLOR,
+                              params->he_bss_color))
+                       goto fail;
+               nla_nest_end(msg, bss_color);
+       }
+
+       if (params->twt_responder) {
+               wpa_printf(MSG_DEBUG, "nl80211: twt_responder=%d",
+                          params->twt_responder);
+               if (nla_put_flag(msg, NL80211_ATTR_TWT_RESPONDER))
+                       goto fail;
+       }
 #endif /* CONFIG_IEEE80211AX */
 
        ret = send_and_recv_msgs(drv, msg, NULL, NULL);
@@ -5108,6 +5205,40 @@ static void nl80211_teardown_ap(struct i802_bss *bss)
 }
 
 
+static int nl80211_tx_control_port(void *priv, const u8 *dest,
+                                  u16 proto, const u8 *buf, size_t len,
+                                  int no_encrypt)
+{
+       struct i802_bss *bss = priv;
+       struct nl_msg *msg;
+       int ret;
+
+       wpa_printf(MSG_DEBUG,
+                  "nl80211: Send over control port dest=" MACSTR
+                  " proto=0x%04x len=%u no_encrypt=%d",
+                  MAC2STR(dest), proto, (unsigned int) len, no_encrypt);
+
+       msg = nl80211_bss_msg(bss, 0, NL80211_CMD_CONTROL_PORT_FRAME);
+       if (!msg ||
+           nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
+           nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dest) ||
+           nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
+           (no_encrypt &&
+            nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT))) {
+               nlmsg_free(msg);
+               return -ENOBUFS;
+       }
+
+       ret = send_and_recv_msgs(bss->drv, msg, NULL, NULL);
+       if (ret)
+               wpa_printf(MSG_DEBUG,
+                          "nl80211: tx_control_port failed: ret=%d (%s)",
+                          ret, strerror(-ret));
+
+       return ret;
+}
+
+
 static int nl80211_send_eapol_data(struct i802_bss *bss,
                                   const u8 *addr, const u8 *data,
                                   size_t data_len)
@@ -5150,6 +5281,10 @@ static int wpa_driver_nl80211_hapd_send_eapol(
        int res;
        int qos = flags & WPA_STA_WMM;
 
+       if (drv->capa.flags & WPA_DRIVER_FLAGS_CONTROL_PORT)
+               return nl80211_tx_control_port(bss, addr, ETH_P_EAPOL,
+                                              data, data_len, !encrypt);
+
        if (drv->device_ap_sme || !drv->use_monitor)
                return nl80211_send_eapol_data(bss, addr, data, data_len);
 
@@ -5190,12 +5325,11 @@ static int wpa_driver_nl80211_hapd_send_eapol(
        pos += 2;
        memcpy(pos, data, data_len);
 
-       res = wpa_driver_nl80211_send_frame(bss, (u8 *) hdr, len, encrypt, 0,
-                                           0, 0, 0, 0, NULL, 0);
+       res = nl80211_send_monitor(drv, hdr, len, encrypt, 0);
        if (res < 0) {
-               wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
-                          "failed: %d (%s)",
-                          (unsigned long) len, res, strerror(res));
+               wpa_printf(MSG_ERROR,
+                          "hapd_send_eapol - packet len: %lu - failed",
+                          (unsigned long) len);
        }
        os_free(hdr);
 
@@ -6653,6 +6787,8 @@ static int i802_set_sta_vlan(struct i802_bss *bss, const u8 *addr,
                   MAC2STR(addr), ifname, if_nametoindex(ifname), vlan_id);
        if (!(msg = nl80211_bss_msg(bss, 0, NL80211_CMD_SET_STATION)) ||
            nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
+           ((drv->capa.flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD) &&
+            nla_put_u16(msg, NL80211_ATTR_VLAN_ID, vlan_id)) ||
            nla_put_u32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname))) {
                nlmsg_free(msg);
                return -ENOBUFS;
@@ -6725,7 +6861,7 @@ static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
        return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
                                            IEEE80211_HDRLEN +
                                            sizeof(mgmt.u.deauth), 0, 0, 0, 0,
-                                           0, NULL, 0);
+                                           0, NULL, 0, 0);
 }
 
 
@@ -6752,7 +6888,7 @@ static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
        return wpa_driver_nl80211_send_mlme(bss, (u8 *) &mgmt,
                                            IEEE80211_HDRLEN +
                                            sizeof(mgmt.u.disassoc), 0, 0, 0, 0,
-                                           0, NULL, 0);
+                                           0, NULL, 0, 0);
 }
 
 
@@ -7470,7 +7606,7 @@ static int cookie_handler(struct nl_msg *msg, void *arg)
 static int nl80211_send_frame_cmd(struct i802_bss *bss,
                                  unsigned int freq, unsigned int wait,
                                  const u8 *buf, size_t buf_len,
-                                 u64 *cookie_out, int no_cck, int no_ack,
+                                 int save_cookie, int no_cck, int no_ack,
                                  int offchanok, const u16 *csa_offs,
                                  size_t csa_offs_len)
 {
@@ -7509,22 +7645,22 @@ static int nl80211_send_frame_cmd(struct i802_bss *bss,
                           "cookie 0x%llx", no_ack ? " (no ACK)" : "",
                           (long long unsigned int) cookie);
 
-               if (cookie_out)
-                       *cookie_out = no_ack ? (u64) -1 : cookie;
+               if (save_cookie)
+                       drv->send_frame_cookie = no_ack ? (u64) -1 : cookie;
 
-               if (drv->num_send_action_cookies == MAX_SEND_ACTION_COOKIES) {
+               if (drv->num_send_frame_cookies == MAX_SEND_FRAME_COOKIES) {
                        wpa_printf(MSG_DEBUG,
-                                  "nl80211: Drop oldest pending send action cookie 0x%llx",
+                                  "nl80211: Drop oldest pending send frame cookie 0x%llx",
                                   (long long unsigned int)
-                                  drv->send_action_cookies[0]);
-                       os_memmove(&drv->send_action_cookies[0],
-                                  &drv->send_action_cookies[1],
-                                  (MAX_SEND_ACTION_COOKIES - 1) *
+                                  drv->send_frame_cookies[0]);
+                       os_memmove(&drv->send_frame_cookies[0],
+                                  &drv->send_frame_cookies[1],
+                                  (MAX_SEND_FRAME_COOKIES - 1) *
                                   sizeof(u64));
-                       drv->num_send_action_cookies--;
+                       drv->num_send_frame_cookies--;
                }
-               drv->send_action_cookies[drv->num_send_action_cookies] = cookie;
-               drv->num_send_action_cookies++;
+               drv->send_frame_cookies[drv->num_send_frame_cookies] = cookie;
+               drv->num_send_frame_cookies++;
        }
 
 fail:
@@ -7545,10 +7681,14 @@ static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
        int ret = -1;
        u8 *buf;
        struct ieee80211_hdr *hdr;
+       int offchanok = 1;
+
+       if (is_ap_interface(drv->nlmode) && (int) freq == bss->freq)
+               offchanok = 0;
 
        wpa_printf(MSG_DEBUG, "nl80211: Send Action frame (ifindex=%d, "
-                  "freq=%u MHz wait=%d ms no_cck=%d)",
-                  drv->ifindex, freq, wait_time, no_cck);
+                  "freq=%u MHz wait=%d ms no_cck=%d offchanok=%d)",
+                  drv->ifindex, freq, wait_time, no_cck, offchanok);
 
        buf = os_zalloc(24 + data_len);
        if (buf == NULL)
@@ -7574,13 +7714,12 @@ static int wpa_driver_nl80211_send_action(struct i802_bss *bss,
             (int) freq == bss->freq || drv->device_ap_sme ||
             !drv->use_monitor))
                ret = wpa_driver_nl80211_send_mlme(bss, buf, 24 + data_len,
-                                                  0, freq, no_cck, 1,
-                                                  wait_time, NULL, 0);
+                                                  0, freq, no_cck, offchanok,
+                                                  wait_time, NULL, 0, 0);
        else
                ret = nl80211_send_frame_cmd(bss, freq, wait_time, buf,
                                             24 + data_len,
-                                            &drv->send_action_cookie,
-                                            no_cck, 0, 1, NULL, 0);
+                                            1, no_cck, 0, offchanok, NULL, 0);
 
        os_free(buf);
        return ret;
@@ -7616,19 +7755,19 @@ static void wpa_driver_nl80211_send_action_cancel_wait(void *priv)
        u64 cookie;
 
        /* Cancel the last pending TX cookie */
-       nl80211_frame_wait_cancel(bss, drv->send_action_cookie);
+       nl80211_frame_wait_cancel(bss, drv->send_frame_cookie);
 
        /*
         * Cancel the other pending TX cookies, if any. This is needed since
         * the driver may keep a list of all pending offchannel TX operations
         * and free up the radio only once they have expired or cancelled.
         */
-       for (i = drv->num_send_action_cookies; i > 0; i--) {
-               cookie = drv->send_action_cookies[i - 1];
-               if (cookie != drv->send_action_cookie)
+       for (i = drv->num_send_frame_cookies; i > 0; i--) {
+               cookie = drv->send_frame_cookies[i - 1];
+               if (cookie != drv->send_frame_cookie)
                        nl80211_frame_wait_cancel(bss, cookie);
        }
-       drv->num_send_action_cookies = 0;
+       drv->num_send_frame_cookies = 0;
 }
 
 
@@ -7948,15 +8087,6 @@ static int nl80211_signal_poll(void *priv, struct wpa_signal_info *si)
 }
 
 
-static int nl80211_send_frame(void *priv, const u8 *data, size_t data_len,
-                             int encrypt)
-{
-       struct i802_bss *bss = priv;
-       return wpa_driver_nl80211_send_frame(bss, data, data_len, encrypt, 0,
-                                            0, 0, 0, 0, NULL, 0);
-}
-
-
 static int nl80211_set_param(void *priv, const char *param)
 {
        struct i802_bss *bss = priv;
@@ -7991,6 +8121,9 @@ static int nl80211_set_param(void *priv, const char *param)
                drv->test_use_roc_tx = 1;
        }
 
+       if (os_strstr(param, "control_port=0"))
+               drv->capa.flags &= ~WPA_DRIVER_FLAGS_CONTROL_PORT;
+
        return 0;
 }
 
@@ -8411,7 +8544,7 @@ static void nl80211_send_null_frame(struct i802_bss *bss, const u8 *own_addr,
        os_memcpy(nulldata.hdr.IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
 
        if (wpa_driver_nl80211_send_mlme(bss, (u8 *) &nulldata, size, 0, 0, 0,
-                                        0, 0, NULL, 0) < 0)
+                                        0, 0, NULL, 0, 0) < 0)
                wpa_printf(MSG_DEBUG, "nl80211_send_null_frame: Failed to "
                           "send poll frame");
 }
@@ -8685,15 +8818,12 @@ nl80211_tdls_disable_channel_switch(void *priv, const u8 *addr)
 #endif /* CONFIG TDLS */
 
 
-static int driver_nl80211_set_key(const char *ifname, void *priv,
-                                 enum wpa_alg alg, const u8 *addr,
-                                 int key_idx, int set_tx,
-                                 const u8 *seq, size_t seq_len,
-                                 const u8 *key, size_t key_len)
+static int driver_nl80211_set_key(void *priv,
+                                 struct wpa_driver_set_key_params *params)
 {
        struct i802_bss *bss = priv;
-       return wpa_driver_nl80211_set_key(ifname, bss, alg, addr, key_idx,
-                                         set_tx, seq, seq_len, key, key_len);
+
+       return wpa_driver_nl80211_set_key(bss, params);
 }
 
 
@@ -8752,12 +8882,13 @@ static int driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type,
 static int driver_nl80211_send_mlme(void *priv, const u8 *data,
                                    size_t data_len, int noack,
                                    unsigned int freq,
-                                   const u16 *csa_offs, size_t csa_offs_len)
+                                   const u16 *csa_offs, size_t csa_offs_len,
+                                   int no_encrypt, unsigned int wait)
 {
        struct i802_bss *bss = priv;
        return wpa_driver_nl80211_send_mlme(bss, data, data_len, noack,
-                                           freq, 0, 0, 0, csa_offs,
-                                           csa_offs_len);
+                                           freq, 0, 0, wait, csa_offs,
+                                           csa_offs_len, no_encrypt);
 }
 
 
@@ -11254,6 +11385,7 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .get_hw_feature_data = nl80211_get_hw_feature_data,
        .sta_add = wpa_driver_nl80211_sta_add,
        .sta_remove = driver_nl80211_sta_remove,
+       .tx_control_port = nl80211_tx_control_port,
        .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol,
        .sta_set_flags = wpa_driver_nl80211_sta_set_flags,
        .sta_set_airtime_weight = driver_nl80211_sta_set_airtime_weight,
@@ -11284,7 +11416,6 @@ const struct wpa_driver_ops wpa_driver_nl80211_ops = {
        .signal_monitor = nl80211_signal_monitor,
        .signal_poll = nl80211_signal_poll,
        .channel_info = nl80211_channel_info,
-       .send_frame = nl80211_send_frame,
        .set_param = nl80211_set_param,
        .get_radio_name = nl80211_get_radio_name,
        .add_pmkid = nl80211_add_pmkid,