]> git.ipfire.org Git - thirdparty/hostap.git/blame - src/ap/ieee802_11.c
projects / thirdparty / hostap.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
AP: add station with basic rates configuration
[thirdparty/hostap.git] / src / ap / ieee802_11.c
CommitLineData
6fc6879b
JM		 1/*
2 * hostapd / IEEE 802.11 Management
f3383366 3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
6fc6879b 4 *
0f3d578e
JM		 5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
6fc6879b
JM		 7 */
8
1057d78e 9#include "utils/includes.h"
6fc6879b
JM		 10
11#ifndef CONFIG_NATIVE_WINDOWS
12
1057d78e
JM		 13#include "utils/common.h"
14#include "utils/eloop.h"
03da66bd 15#include "crypto/crypto.h"
d136c376 16#include "crypto/sha256.h"
7a12edd1
JM		 17#include "crypto/sha384.h"
18#include "crypto/sha512.h"
d136c376 19#include "crypto/random.h"
81f4f619
JM		 20#include "common/ieee802_11_defs.h"
21#include "common/ieee802_11_common.h"
03da66bd 22#include "common/wpa_ctrl.h"
98efcc41 23#include "common/sae.h"
10ec6a5f 24#include "common/dpp.h"
99621dc1 25#include "common/ocv.h"
03da66bd
JM		 26#include "radius/radius.h"
27#include "radius/radius_client.h"
e44f8bf2 28#include "p2p/p2p.h"
ed7a09f9 29#include "wps/wps.h"
037378ff 30#include "fst/fst.h"
6fc6879b 31#include "hostapd.h"
6fc6879b 32#include "beacon.h"
6fc6879b
JM		 33#include "ieee802_11_auth.h"
34#include "sta_info.h"
6fc6879b 35#include "ieee802_1x.h"
6226e38d 36#include "wpa_auth.h"
f2991170 37#include "pmksa_cache_auth.h"
1057d78e 38#include "wmm.h"
6fc6879b
JM		 39#include "ap_list.h"
40#include "accounting.h"
6226e38d
JM		 41#include "ap_config.h"
42#include "ap_mlme.h"
dce044cc 43#include "p2p_hostapd.h"
cee7d66b 44#include "ap_drv_ops.h"
c79938a5 45#include "wnm_ap.h"
0e2412d0 46#include "hw_features.h"
6226e38d 47#include "ieee802_11.h"
3d7ad2f6 48#include "dfs.h"
6332aaf3 49#include "mbo_ap.h"
2572df34 50#include "rrm.h"
04059ab8 51#include "taxonomy.h"
54b04d6f 52#include "fils_hlp.h"
9c2b8204
JM		 53#include "dpp_hostapd.h"
54#include "gas_query_ap.h"
6fc6879b
JM		 55
56
5e5f8c81
JM		 57#ifdef CONFIG_FILS
58static struct wpabuf *
59prepare_auth_resp_fils(struct hostapd_data *hapd,
60 struct sta_info *sta, u16 *resp,
61 struct rsn_pmksa_cache_entry *pmksa,
62 struct wpabuf *erp_resp,
63 const u8 *msk, size_t msk_len,
64 int *is_pub);
65#endif /* CONFIG_FILS */
ff9f40ae
JM		 66static void handle_auth(struct hostapd_data *hapd,
67 const struct ieee80211_mgmt *mgmt, size_t len,
68 int rssi, int from_queue);
5e5f8c81 69
9c06f0f6
VN		 70
71u8 * hostapd_eid_multi_ap(struct hostapd_data *hapd, u8 *eid)
72{
73 u8 multi_ap_val = 0;
74
75 if (!hapd->conf->multi_ap)
76 return eid;
77 if (hapd->conf->multi_ap & BACKHAUL_BSS)
78 multi_ap_val |= MULTI_AP_BACKHAUL_BSS;
79 if (hapd->conf->multi_ap & FRONTHAUL_BSS)
80 multi_ap_val |= MULTI_AP_FRONTHAUL_BSS;
81
82 return eid + add_multi_ap_ie(eid, 9, multi_ap_val);
83}
84
85
6fc6879b
JM		 86u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
87{
88 u8 *pos = eid;
89 int i, num, count;
90
91 if (hapd->iface->current_rates == NULL)
92 return eid;
93
94 *pos++ = WLAN_EID_SUPP_RATES;
95 num = hapd->iface->num_rates;
29448243
JM		 96 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
97 num++;
202d97d4
JB		 98 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
99 num++;
6fc6879b
JM		 100 if (num > 8) {
101 /* rest of the rates are encoded in Extended supported
102 * rates element */
103 num = 8;
104 }
105
106 *pos++ = num;
6fc6879b
JM		 107 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
108 i++) {
109 count++;
110 *pos = hapd->iface->current_rates[i].rate / 5;
111 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
112 *pos |= 0x80;
113 pos++;
114 }
115
202d97d4
JB		 116 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht && count < 8) {
117 count++;
29448243 118 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
202d97d4
JB		 119 }
120
121 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht && count < 8) {
122 count++;
123 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
124 }
29448243 125
6fc6879b
JM		 126 return pos;
127}
128
129
130u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
131{
132 u8 *pos = eid;
133 int i, num, count;
134
135 if (hapd->iface->current_rates == NULL)
136 return eid;
137
138 num = hapd->iface->num_rates;
29448243
JM		 139 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht)
140 num++;
202d97d4
JB		 141 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht)
142 num++;
6fc6879b
JM		 143 if (num <= 8)
144 return eid;
145 num -= 8;
146
147 *pos++ = WLAN_EID_EXT_SUPP_RATES;
148 *pos++ = num;
6fc6879b
JM		 149 for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
150 i++) {
151 count++;
152 if (count <= 8)
153 continue; /* already in SuppRates IE */
154 *pos = hapd->iface->current_rates[i].rate / 5;
155 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
156 *pos |= 0x80;
157 pos++;
158 }
159
202d97d4
JB		 160 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht) {
161 count++;
162 if (count > 8)
163 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_HT_PHY;
164 }
165
166 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht) {
167 count++;
168 if (count > 8)
169 *pos++ = 0x80 | BSS_MEMBERSHIP_SELECTOR_VHT_PHY;
170 }
29448243 171
6fc6879b
JM		 172 return pos;
173}
174
175
f41ded6f 176u16 hostapd_own_capab_info(struct hostapd_data *hapd)
6fc6879b
JM		 177{
178 int capab = WLAN_CAPABILITY_ESS;
179 int privacy;
3d7ad2f6 180 int dfs;
01018212 181 int i;
3d7ad2f6
C		 182
183 /* Check if any of configured channels require DFS */
184 dfs = hostapd_is_dfs_required(hapd->iface);
185 if (dfs < 0) {
186 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
187 dfs);
188 dfs = 0;
189 }
6fc6879b
JM		 190
191 if (hapd->iface->num_sta_no_short_preamble == 0 &&
192 hapd->iconf->preamble == SHORT_PREAMBLE)
193 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
194
195 privacy = hapd->conf->ssid.wep.keys_set;
196
197 if (hapd->conf->ieee802_1x &&
198 (hapd->conf->default_wep_key_len ||
199 hapd->conf->individual_wep_key_len))
200 privacy = 1;
201
202 if (hapd->conf->wpa)
203 privacy = 1;
204
a14896e8
JM		 205#ifdef CONFIG_HS20
206 if (hapd->conf->osen)
207 privacy = 1;
208#endif /* CONFIG_HS20 */
209
6fc6879b
JM		 210 if (privacy)
211 capab |= WLAN_CAPABILITY_PRIVACY;
212
213 if (hapd->iface->current_mode &&
214 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
215 hapd->iface->num_sta_no_short_slot_time == 0)
216 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
217
3d7ad2f6
C		 218 /*
219 * Currently, Spectrum Management capability bit is set when directly
220 * requested in configuration by spectrum_mgmt_required or when AP is
221 * running on DFS channel.
222 * TODO: Also consider driver support for TPC to set Spectrum Mgmt bit
223 */
224 if (hapd->iface->current_mode &&
225 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211A &&
226 (hapd->iconf->spectrum_mgmt_required || dfs))
227 capab |= WLAN_CAPABILITY_SPECTRUM_MGMT;
228
01018212
DS		 229 for (i = 0; i < RRM_CAPABILITIES_IE_LEN; i++) {
230 if (hapd->conf->radio_measurements[i]) {
231 capab |= IEEE80211_CAP_RRM;
232 break;
233 }
234 }
0629eeb4 235
6fc6879b
JM		 236 return capab;
237}
238
239
7cb53ded 240#ifndef CONFIG_NO_RC4
6fc6879b 241static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
b57e086c
JM		 242 u16 auth_transaction, const u8 *challenge,
243 int iswep)
6fc6879b
JM		 244{
245 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
246 HOSTAPD_LEVEL_DEBUG,
247 "authentication (shared key, transaction %d)",
248 auth_transaction);
249
250 if (auth_transaction == 1) {
251 if (!sta->challenge) {
252 /* Generate a pseudo-random challenge */
253 u8 key[8];
f441e5af 254
6fc6879b
JM		 255 sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
256 if (sta->challenge == NULL)
257 return WLAN_STATUS_UNSPECIFIED_FAILURE;
258
f441e5af
NL		 259 if (os_get_random(key, sizeof(key)) < 0) {
260 os_free(sta->challenge);
261 sta->challenge = NULL;
262 return WLAN_STATUS_UNSPECIFIED_FAILURE;
263 }
264
8ef16831
JM		 265 rc4_skip(key, sizeof(key), 0,
266 sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
6fc6879b
JM		 267 }
268 return 0;
269 }
270
271 if (auth_transaction != 3)
272 return WLAN_STATUS_UNSPECIFIED_FAILURE;
273
274 /* Transaction 3 */
275 if (!iswep || !sta->challenge || !challenge ||
34ef46ce
JM		 276 os_memcmp_const(sta->challenge, challenge,
277 WLAN_AUTH_CHALLENGE_LEN)) {
6fc6879b
JM		 278 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
279 HOSTAPD_LEVEL_INFO,
280 "shared key authentication - invalid "
281 "challenge-response");
282 return WLAN_STATUS_CHALLENGE_FAIL;
283 }
284
285 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
286 HOSTAPD_LEVEL_DEBUG,
287 "authentication OK (shared key)");
6fc6879b
JM		 288 sta->flags |= WLAN_STA_AUTH;
289 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
6fc6879b
JM		 290 os_free(sta->challenge);
291 sta->challenge = NULL;
292
293 return 0;
294}
7cb53ded 295#endif /* CONFIG_NO_RC4 */
6fc6879b
JM		 296
297
bb598c3b
AB		 298static int send_auth_reply(struct hostapd_data *hapd,
299 const u8 *dst, const u8 *bssid,
300 u16 auth_alg, u16 auth_transaction, u16 resp,
e7525a29 301 const u8 *ies, size_t ies_len, const char *dbg)
6fc6879b
JM		 302{
303 struct ieee80211_mgmt *reply;
304 u8 *buf;
305 size_t rlen;
bb598c3b 306 int reply_res = WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b
JM		 307
308 rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
309 buf = os_zalloc(rlen);
310 if (buf == NULL)
bb598c3b 311 return -1;
6fc6879b
JM		 312
313 reply = (struct ieee80211_mgmt *) buf;
314 reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
315 WLAN_FC_STYPE_AUTH);
6fc6879b
JM		 316 os_memcpy(reply->da, dst, ETH_ALEN);
317 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
318 os_memcpy(reply->bssid, bssid, ETH_ALEN);
319
320 reply->u.auth.auth_alg = host_to_le16(auth_alg);
321 reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
322 reply->u.auth.status_code = host_to_le16(resp);
323
324 if (ies && ies_len)
325 os_memcpy(reply->u.auth.variable, ies, ies_len);
326
327 wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
e7525a29 328 " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu) (dbg=%s)",
6fc6879b 329 MAC2STR(dst), auth_alg, auth_transaction,
e7525a29 330 resp, (unsigned long) ies_len, dbg);
8cfa3527 331 if (hostapd_drv_send_mlme(hapd, reply, rlen, 0) < 0)
bb598c3b
AB		 332 wpa_printf(MSG_INFO, "send_auth_reply: send failed");
333 else
334 reply_res = WLAN_STATUS_SUCCESS;
6fc6879b
JM		 335
336 os_free(buf);
bb598c3b
AB		 337
338 return reply_res;
6fc6879b
JM		 339}
340
341
4ec1fd8e 342#ifdef CONFIG_IEEE80211R_AP
6fc6879b
JM		 343static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
344 u16 auth_transaction, u16 status,
345 const u8 *ies, size_t ies_len)
346{
347 struct hostapd_data *hapd = ctx;
348 struct sta_info *sta;
bb598c3b 349 int reply_res;
6fc6879b 350
bb598c3b 351 reply_res = send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT,
e7525a29
BG		 352 auth_transaction, status, ies, ies_len,
353 "auth-ft-finish");
6fc6879b
JM		 354
355 sta = ap_get_sta(hapd, dst);
356 if (sta == NULL)
357 return;
358
bb598c3b
AB		 359 if (sta->added_unassoc && (reply_res != WLAN_STATUS_SUCCESS ||
360 status != WLAN_STATUS_SUCCESS)) {
361 hostapd_drv_sta_remove(hapd, sta->addr);
362 sta->added_unassoc = 0;
363 return;
364 }
365
366 if (status != WLAN_STATUS_SUCCESS)
367 return;
368
6fc6879b
JM		 369 hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
370 HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
371 sta->flags |= WLAN_STA_AUTH;
372 mlme_authenticate_indication(hapd, sta);
373}
4ec1fd8e 374#endif /* CONFIG_IEEE80211R_AP */
6fc6879b
JM		 375
376
c10347f2 377#ifdef CONFIG_SAE
21af6d15 378
9249afc8
JM		 379static void sae_set_state(struct sta_info *sta, enum sae_state state,
380 const char *reason)
381{
382 wpa_printf(MSG_DEBUG, "SAE: State %s -> %s for peer " MACSTR " (%s)",
383 sae_state_txt(sta->sae->state), sae_state_txt(state),
384 MAC2STR(sta->addr), reason);
385 sta->sae->state = state;
386}
387
388
e96da42b 389static struct wpabuf * auth_build_sae_commit(struct hostapd_data *hapd,
872b7545 390 struct sta_info *sta, int update)
21af6d15
JM		 391{
392 struct wpabuf *buf;
9be19d0b
JM		 393 const char *password = NULL;
394 struct sae_password_entry *pw;
395 const char *rx_id = NULL;
21af6d15 396
9be19d0b
JM		 397 if (sta->sae->tmp)
398 rx_id = sta->sae->tmp->pw_id;
399
400 for (pw = hapd->conf->sae_passwords; pw; pw = pw->next) {
401 if (!is_broadcast_ether_addr(pw->peer_addr) &&
402 os_memcmp(pw->peer_addr, sta->addr, ETH_ALEN) != 0)
403 continue;
404 if ((rx_id && !pw->identifier) || (!rx_id && pw->identifier))
405 continue;
406 if (rx_id && pw->identifier &&
407 os_strcmp(rx_id, pw->identifier) != 0)
408 continue;
409 password = pw->password;
410 break;
411 }
2377c1ca
JM		 412 if (!password)
413 password = hapd->conf->ssid.wpa_passphrase;
414 if (!password) {
146f6c9a
JM		 415 wpa_printf(MSG_DEBUG, "SAE: No password available");
416 return NULL;
417 }
418
872b7545
MH		 419 if (update &&
420 sae_prepare_commit(hapd->own_addr, sta->addr,
9be19d0b 421 (u8 *) password, os_strlen(password), rx_id,
8e31e955
JM		 422 sta->sae) < 0) {
423 wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
21af6d15 424 return NULL;
8e31e955 425 }
21af6d15 426
b0e91e38
JM		 427 if (pw && pw->vlan_id) {
428 if (!sta->sae->tmp) {
429 wpa_printf(MSG_INFO,
430 "SAE: No temporary data allocated - cannot store VLAN ID");
431 return NULL;
432 }
433 sta->sae->tmp->vlan_id = pw->vlan_id;
434 }
435
9be19d0b
JM		 436 buf = wpabuf_alloc(SAE_COMMIT_MAX_LEN +
437 (rx_id ? 3 + os_strlen(rx_id) : 0));
8e31e955
JM		 438 if (buf == NULL)
439 return NULL;
872b7545 440 sae_write_commit(sta->sae, buf, sta->sae->tmp ?
9be19d0b 441 sta->sae->tmp->anti_clogging_token : NULL, rx_id);
21af6d15
JM		 442
443 return buf;
444}
445
446
447static struct wpabuf * auth_build_sae_confirm(struct hostapd_data *hapd,
448 struct sta_info *sta)
449{
450 struct wpabuf *buf;
451
fb8fcc29 452 buf = wpabuf_alloc(SAE_CONFIRM_MAX_LEN);
21af6d15
JM		 453 if (buf == NULL)
454 return NULL;
455
fb8fcc29 456 sae_write_confirm(sta->sae, buf);
21af6d15
JM		 457
458 return buf;
459}
460
461
e96da42b
BC		 462static int auth_sae_send_commit(struct hostapd_data *hapd,
463 struct sta_info *sta,
872b7545 464 const u8 *bssid, int update)
e96da42b
BC		 465{
466 struct wpabuf *data;
bb598c3b 467 int reply_res;
e96da42b 468
872b7545 469 data = auth_build_sae_commit(hapd, sta, update);
9be19d0b
JM		 470 if (!data && sta->sae->tmp && sta->sae->tmp->pw_id)
471 return WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER;
e96da42b
BC		 472 if (data == NULL)
473 return WLAN_STATUS_UNSPECIFIED_FAILURE;
474
bb598c3b
AB		 475 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 1,
476 WLAN_STATUS_SUCCESS, wpabuf_head(data),
e7525a29 477 wpabuf_len(data), "sae-send-commit");
e96da42b
BC		 478
479 wpabuf_free(data);
480
bb598c3b 481 return reply_res;
e96da42b
BC		 482}
483
484
485static int auth_sae_send_confirm(struct hostapd_data *hapd,
486 struct sta_info *sta,
487 const u8 *bssid)
488{
489 struct wpabuf *data;
bb598c3b 490 int reply_res;
e96da42b
BC		 491
492 data = auth_build_sae_confirm(hapd, sta);
493 if (data == NULL)
494 return WLAN_STATUS_UNSPECIFIED_FAILURE;
495
bb598c3b
AB		 496 reply_res = send_auth_reply(hapd, sta->addr, bssid, WLAN_AUTH_SAE, 2,
497 WLAN_STATUS_SUCCESS, wpabuf_head(data),
e7525a29 498 wpabuf_len(data), "sae-send-confirm");
e96da42b
BC		 499
500 wpabuf_free(data);
501
bb598c3b 502 return reply_res;
e96da42b
BC		 503}
504
505
d136c376
JM		 506static int use_sae_anti_clogging(struct hostapd_data *hapd)
507{
508 struct sta_info *sta;
509 unsigned int open = 0;
510
511 if (hapd->conf->sae_anti_clogging_threshold == 0)
512 return 1;
513
514 for (sta = hapd->sta_list; sta; sta = sta->next) {
515 if (!sta->sae)
516 continue;
517 if (sta->sae->state != SAE_COMMITTED &&
518 sta->sae->state != SAE_CONFIRMED)
519 continue;
520 open++;
521 if (open >= hapd->conf->sae_anti_clogging_threshold)
522 return 1;
523 }
524
ff9f40ae
JM		 525 /* In addition to already existing open SAE sessions, check whether
526 * there are enough pending commit messages in the processing queue to
527 * potentially result in too many open sessions. */
528 if (open + dl_list_len(&hapd->sae_commit_queue) >=
529 hapd->conf->sae_anti_clogging_threshold)
530 return 1;
531
d136c376
JM		 532 return 0;
533}
534
535
a9af1da0
JM		 536static u8 sae_token_hash(struct hostapd_data *hapd, const u8 *addr)
537{
538 u8 hash[SHA256_MAC_LEN];
539
540 hmac_sha256(hapd->sae_token_key, sizeof(hapd->sae_token_key),
541 addr, ETH_ALEN, hash);
542 return hash[0];
543}
544
545
d136c376
JM		 546static int check_sae_token(struct hostapd_data *hapd, const u8 *addr,
547 const u8 *token, size_t token_len)
548{
549 u8 mac[SHA256_MAC_LEN];
a9af1da0
JM		 550 const u8 *addrs[2];
551 size_t len[2];
552 u16 token_idx;
553 u8 idx;
d136c376
JM		 554
555 if (token_len != SHA256_MAC_LEN)
556 return -1;
a9af1da0
JM		 557 idx = sae_token_hash(hapd, addr);
558 token_idx = hapd->sae_pending_token_idx[idx];
559 if (token_idx == 0 || token_idx != WPA_GET_BE16(token)) {
560 wpa_printf(MSG_DEBUG, "SAE: Invalid anti-clogging token from "
561 MACSTR " - token_idx 0x%04x, expected 0x%04x",
562 MAC2STR(addr), WPA_GET_BE16(token), token_idx);
563 return -1;
564 }
565
566 addrs[0] = addr;
567 len[0] = ETH_ALEN;
568 addrs[1] = token;
569 len[1] = 2;
570 if (hmac_sha256_vector(hapd->sae_token_key, sizeof(hapd->sae_token_key),
571 2, addrs, len, mac) < 0 ||
572 os_memcmp_const(token + 2, &mac[2], SHA256_MAC_LEN - 2) != 0)
d136c376
JM		 573 return -1;
574
a9af1da0
JM		 575 hapd->sae_pending_token_idx[idx] = 0; /* invalidate used token */
576
d136c376
JM		 577 return 0;
578}
579
580
581static struct wpabuf * auth_build_token_req(struct hostapd_data *hapd,
a959a3b6 582 int group, const u8 *addr)
d136c376
JM		 583{
584 struct wpabuf *buf;
585 u8 *token;
fe52c210 586 struct os_reltime now;
a9af1da0
JM		 587 u8 idx[2];
588 const u8 *addrs[2];
589 size_t len[2];
590 u8 p_idx;
591 u16 token_idx;
d136c376 592
fe52c210
JB		 593 os_get_reltime(&now);
594 if (!os_reltime_initialized(&hapd->last_sae_token_key_update) ||
a9af1da0
JM		 595 os_reltime_expired(&now, &hapd->last_sae_token_key_update, 60) ||
596 hapd->sae_token_idx == 0xffff) {
a50414c3
JM		 597 if (random_get_bytes(hapd->sae_token_key,
598 sizeof(hapd->sae_token_key)) < 0)
599 return NULL;
d136c376
JM		 600 wpa_hexdump(MSG_DEBUG, "SAE: Updated token key",
601 hapd->sae_token_key, sizeof(hapd->sae_token_key));
fe52c210 602 hapd->last_sae_token_key_update = now;
a9af1da0
JM		 603 hapd->sae_token_idx = 0;
604 os_memset(hapd->sae_pending_token_idx, 0,
605 sizeof(hapd->sae_pending_token_idx));
d136c376
JM		 606 }
607
a959a3b6 608 buf = wpabuf_alloc(sizeof(le16) + SHA256_MAC_LEN);
d136c376
JM		 609 if (buf == NULL)
610 return NULL;
611
a959a3b6
MH		 612 wpabuf_put_le16(buf, group); /* Finite Cyclic Group */
613
a9af1da0
JM		 614 p_idx = sae_token_hash(hapd, addr);
615 token_idx = hapd->sae_pending_token_idx[p_idx];
616 if (!token_idx) {
617 hapd->sae_token_idx++;
618 token_idx = hapd->sae_token_idx;
619 hapd->sae_pending_token_idx[p_idx] = token_idx;
620 }
621 WPA_PUT_BE16(idx, token_idx);
d136c376 622 token = wpabuf_put(buf, SHA256_MAC_LEN);
a9af1da0
JM		 623 addrs[0] = addr;
624 len[0] = ETH_ALEN;
625 addrs[1] = idx;
626 len[1] = sizeof(idx);
627 if (hmac_sha256_vector(hapd->sae_token_key, sizeof(hapd->sae_token_key),
628 2, addrs, len, token) < 0) {
629 wpabuf_free(buf);
630 return NULL;
631 }
632 WPA_PUT_BE16(token, token_idx);
d136c376
JM		 633
634 return buf;
635}
636
637
d8b841eb 638static int sae_check_big_sync(struct hostapd_data *hapd, struct sta_info *sta)
f3b8ad4d 639{
d8b841eb 640 if (sta->sae->sync > hapd->conf->sae_sync) {
9249afc8 641 sae_set_state(sta, SAE_NOTHING, "Sync > dot11RSNASAESync");
f3b8ad4d
BC		 642 sta->sae->sync = 0;
643 return -1;
644 }
645 return 0;
646}
647
648
649static void auth_sae_retransmit_timer(void *eloop_ctx, void *eloop_data)
650{
651 struct hostapd_data *hapd = eloop_ctx;
652 struct sta_info *sta = eloop_data;
653 int ret;
654
d8b841eb 655 if (sae_check_big_sync(hapd, sta))
f3b8ad4d
BC		 656 return;
657 sta->sae->sync++;
dad01292 658 wpa_printf(MSG_DEBUG, "SAE: Auth SAE retransmit timer for " MACSTR
9249afc8
JM		 659 " (sync=%d state=%s)",
660 MAC2STR(sta->addr), sta->sae->sync,
661 sae_state_txt(sta->sae->state));
f3b8ad4d
BC		 662
663 switch (sta->sae->state) {
664 case SAE_COMMITTED:
665 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
ecd40fef
MH		 666 eloop_register_timeout(0,
667 hapd->dot11RSNASAERetransPeriod * 1000,
f3b8ad4d
BC		 668 auth_sae_retransmit_timer, hapd, sta);
669 break;
670 case SAE_CONFIRMED:
671 ret = auth_sae_send_confirm(hapd, sta, hapd->own_addr);
ecd40fef
MH		 672 eloop_register_timeout(0,
673 hapd->dot11RSNASAERetransPeriod * 1000,
f3b8ad4d
BC		 674 auth_sae_retransmit_timer, hapd, sta);
675 break;
676 default:
677 ret = -1;
678 break;
679 }
680
681 if (ret != WLAN_STATUS_SUCCESS)
682 wpa_printf(MSG_INFO, "SAE: Failed to retransmit: ret=%d", ret);
683}
684
685
686void sae_clear_retransmit_timer(struct hostapd_data *hapd, struct sta_info *sta)
687{
688 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
689}
690
691
692static void sae_set_retransmit_timer(struct hostapd_data *hapd,
693 struct sta_info *sta)
694{
695 if (!(hapd->conf->mesh & MESH_ENABLED))
696 return;
697
698 eloop_cancel_timeout(auth_sae_retransmit_timer, hapd, sta);
ecd40fef 699 eloop_register_timeout(0, hapd->dot11RSNASAERetransPeriod * 1000,
f3b8ad4d
BC		 700 auth_sae_retransmit_timer, hapd, sta);
701}
702
703
4ffb0fef
SD		 704static void sae_sme_send_external_auth_status(struct hostapd_data *hapd,
705 struct sta_info *sta, u16 status)
706{
707 struct external_auth params;
708
709 os_memset(&params, 0, sizeof(params));
710 params.status = status;
dd1a8cef 711 params.bssid = sta->addr;
4ffb0fef
SD		 712 if (status == WLAN_STATUS_SUCCESS && sta->sae)
713 params.pmkid = sta->sae->pmkid;
714
715 hostapd_drv_send_external_auth_status(hapd, &params);
716}
717
718
9f2cf23e
MH		 719void sae_accept_sta(struct hostapd_data *hapd, struct sta_info *sta)
720{
b0e91e38
JM		 721#ifndef CONFIG_NO_VLAN
722 struct vlan_description vlan_desc;
723
724 if (sta->sae->tmp && sta->sae->tmp->vlan_id > 0) {
725 wpa_printf(MSG_DEBUG, "SAE: Assign STA " MACSTR
726 " to VLAN ID %d",
727 MAC2STR(sta->addr), sta->sae->tmp->vlan_id);
728
729 os_memset(&vlan_desc, 0, sizeof(vlan_desc));
730 vlan_desc.notempty = 1;
731 vlan_desc.untagged = sta->sae->tmp->vlan_id;
732 if (!hostapd_vlan_valid(hapd->conf->vlan, &vlan_desc)) {
733 wpa_printf(MSG_INFO,
734 "Invalid VLAN ID %d in sae_password",
735 sta->sae->tmp->vlan_id);
736 return;
737 }
738
739 if (ap_sta_set_vlan(hapd, sta, &vlan_desc) < 0 ||
740 ap_sta_bind_vlan(hapd, sta) < 0) {
741 wpa_printf(MSG_INFO,
742 "Failed to assign VLAN ID %d from sae_password to "
743 MACSTR, sta->sae->tmp->vlan_id,
744 MAC2STR(sta->addr));
745 return;
746 }
747 }
748#endif /* CONFIG_NO_VLAN */
749
9f2cf23e
MH		 750 sta->flags |= WLAN_STA_AUTH;
751 sta->auth_alg = WLAN_AUTH_SAE;
752 mlme_authenticate_indication(hapd, sta);
753 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
9249afc8 754 sae_set_state(sta, SAE_ACCEPTED, "Accept Confirm");
9f2cf23e
MH		 755 wpa_auth_pmksa_add_sae(hapd->wpa_auth, sta->addr,
756 sta->sae->pmk, sta->sae->pmkid);
4ffb0fef 757 sae_sme_send_external_auth_status(hapd, sta, WLAN_STATUS_SUCCESS);
9f2cf23e
MH		 758}
759
760
e96da42b 761static int sae_sm_step(struct hostapd_data *hapd, struct sta_info *sta,
10cf866b
JM		 762 const u8 *bssid, u8 auth_transaction, int allow_reuse,
763 int *sta_removed)
e96da42b
BC		 764{
765 int ret;
766
10cf866b
JM		 767 *sta_removed = 0;
768
e96da42b
BC		 769 if (auth_transaction != 1 && auth_transaction != 2)
770 return WLAN_STATUS_UNSPECIFIED_FAILURE;
771
9249afc8
JM		 772 wpa_printf(MSG_DEBUG, "SAE: Peer " MACSTR " state=%s auth_trans=%u",
773 MAC2STR(sta->addr), sae_state_txt(sta->sae->state),
774 auth_transaction);
e96da42b
BC		 775 switch (sta->sae->state) {
776 case SAE_NOTHING:
777 if (auth_transaction == 1) {
f2143615
JM		 778 ret = auth_sae_send_commit(hapd, sta, bssid,
779 !allow_reuse);
e96da42b
BC		 780 if (ret)
781 return ret;
9249afc8 782 sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
e96da42b
BC		 783
784 if (sae_process_commit(sta->sae) < 0)
785 return WLAN_STATUS_UNSPECIFIED_FAILURE;
786
787 /*
788 * In mesh case, both Commit and Confirm can be sent
789 * immediately. In infrastructure BSS, only a single
790 * Authentication frame (Commit) is expected from the AP
791 * here and the second one (Confirm) will be sent once
792 * the STA has sent its second Authentication frame
793 * (Confirm).
794 */
795 if (hapd->conf->mesh & MESH_ENABLED) {
796 /*
797 * Send both Commit and Confirm immediately
798 * based on SAE finite state machine
799 * Nothing -> Confirm transition.
800 */
801 ret = auth_sae_send_confirm(hapd, sta, bssid);
802 if (ret)
803 return ret;
9249afc8
JM		 804 sae_set_state(sta, SAE_CONFIRMED,
805 "Sent Confirm (mesh)");
e96da42b
BC		 806 } else {
807 /*
808 * For infrastructure BSS, send only the Commit
809 * message now to get alternating sequence of
810 * Authentication frames between the AP and STA.
811 * Confirm will be sent in
746e5c25 812 * Committed -> Confirmed/Accepted transition
e96da42b
BC		 813 * when receiving Confirm from STA.
814 */
815 }
f3b8ad4d
BC		 816 sta->sae->sync = 0;
817 sae_set_retransmit_timer(hapd, sta);
e96da42b
BC		 818 } else {
819 hostapd_logger(hapd, sta->addr,
820 HOSTAPD_MODULE_IEEE80211,
821 HOSTAPD_LEVEL_DEBUG,
822 "SAE confirm before commit");
823 }
824 break;
825 case SAE_COMMITTED:
f3b8ad4d 826 sae_clear_retransmit_timer(hapd, sta);
e96da42b
BC		 827 if (auth_transaction == 1) {
828 if (sae_process_commit(sta->sae) < 0)
829 return WLAN_STATUS_UNSPECIFIED_FAILURE;
830
831 ret = auth_sae_send_confirm(hapd, sta, bssid);
832 if (ret)
833 return ret;
9249afc8 834 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
f3b8ad4d
BC		 835 sta->sae->sync = 0;
836 sae_set_retransmit_timer(hapd, sta);
e96da42b
BC		 837 } else if (hapd->conf->mesh & MESH_ENABLED) {
838 /*
839 * In mesh case, follow SAE finite state machine and
f3b8ad4d 840 * send Commit now, if sync count allows.
e96da42b 841 */
d8b841eb 842 if (sae_check_big_sync(hapd, sta))
f3b8ad4d
BC		 843 return WLAN_STATUS_SUCCESS;
844 sta->sae->sync++;
845
fabc6dd8 846 ret = auth_sae_send_commit(hapd, sta, bssid, 0);
e96da42b
BC		 847 if (ret)
848 return ret;
f3b8ad4d
BC		 849
850 sae_set_retransmit_timer(hapd, sta);
e96da42b
BC		 851 } else {
852 /*
853 * For instructure BSS, send the postponed Confirm from
854 * Nothing -> Confirmed transition that was reduced to
855 * Nothing -> Committed above.
856 */
857 ret = auth_sae_send_confirm(hapd, sta, bssid);
858 if (ret)
859 return ret;
860
9249afc8 861 sae_set_state(sta, SAE_CONFIRMED, "Sent Confirm");
e96da42b
BC		 862
863 /*
864 * Since this was triggered on Confirm RX, run another
865 * step to get to Accepted without waiting for
866 * additional events.
867 */
f2143615 868 return sae_sm_step(hapd, sta, bssid, auth_transaction,
10cf866b 869 0, sta_removed);
e96da42b
BC		 870 }
871 break;
872 case SAE_CONFIRMED:
f3b8ad4d 873 sae_clear_retransmit_timer(hapd, sta);
e96da42b 874 if (auth_transaction == 1) {
d8b841eb 875 if (sae_check_big_sync(hapd, sta))
f3b8ad4d
BC		 876 return WLAN_STATUS_SUCCESS;
877 sta->sae->sync++;
878
872b7545 879 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
e96da42b
BC		 880 if (ret)
881 return ret;
882
883 if (sae_process_commit(sta->sae) < 0)
884 return WLAN_STATUS_UNSPECIFIED_FAILURE;
885
886 ret = auth_sae_send_confirm(hapd, sta, bssid);
887 if (ret)
888 return ret;
f3b8ad4d
BC		 889
890 sae_set_retransmit_timer(hapd, sta);
e96da42b 891 } else {
c4fc7e31 892 sta->sae->send_confirm = 0xffff;
9f2cf23e 893 sae_accept_sta(hapd, sta);
e96da42b
BC		 894 }
895 break;
896 case SAE_ACCEPTED:
e8d08cf3
JM		 897 if (auth_transaction == 1 &&
898 (hapd->conf->mesh & MESH_ENABLED)) {
e96da42b
BC		 899 wpa_printf(MSG_DEBUG, "SAE: remove the STA (" MACSTR
900 ") doing reauthentication",
901 MAC2STR(sta->addr));
9f2cf23e 902 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
153d4c50 903 ap_free_sta(hapd, sta);
10cf866b 904 *sta_removed = 1;
e8d08cf3
JM		 905 } else if (auth_transaction == 1) {
906 wpa_printf(MSG_DEBUG, "SAE: Start reauthentication");
907 ret = auth_sae_send_commit(hapd, sta, bssid, 1);
908 if (ret)
909 return ret;
910 sae_set_state(sta, SAE_COMMITTED, "Sent Commit");
911
912 if (sae_process_commit(sta->sae) < 0)
913 return WLAN_STATUS_UNSPECIFIED_FAILURE;
914 sta->sae->sync = 0;
915 sae_set_retransmit_timer(hapd, sta);
e96da42b 916 } else {
d8b841eb 917 if (sae_check_big_sync(hapd, sta))
f3b8ad4d
BC		 918 return WLAN_STATUS_SUCCESS;
919 sta->sae->sync++;
920
e96da42b
BC		 921 ret = auth_sae_send_confirm(hapd, sta, bssid);
922 sae_clear_temp_data(sta->sae);
923 if (ret)
924 return ret;
925 }
926 break;
927 default:
928 wpa_printf(MSG_ERROR, "SAE: invalid state %d",
929 sta->sae->state);
930 return WLAN_STATUS_UNSPECIFIED_FAILURE;
931 }
932 return WLAN_STATUS_SUCCESS;
933}
934
935
dad01292
JM		 936static void sae_pick_next_group(struct hostapd_data *hapd, struct sta_info *sta)
937{
938 struct sae_data *sae = sta->sae;
939 int i, *groups = hapd->conf->sae_groups;
941bad5e 940 int default_groups[] = { 19, 0 };
dad01292
JM		 941
942 if (sae->state != SAE_COMMITTED)
943 return;
944
945 wpa_printf(MSG_DEBUG, "SAE: Previously selected group: %d", sae->group);
946
941bad5e
JM		 947 if (!groups)
948 groups = default_groups;
949 for (i = 0; groups[i] > 0; i++) {
dad01292
JM		 950 if (sae->group == groups[i])
951 break;
952 }
953
941bad5e 954 if (groups[i] <= 0) {
dad01292
JM		 955 wpa_printf(MSG_DEBUG,
956 "SAE: Previously selected group not found from the current configuration");
957 return;
958 }
959
960 for (;;) {
961 i++;
962 if (groups[i] <= 0) {
963 wpa_printf(MSG_DEBUG,
964 "SAE: No alternative group enabled");
965 return;
966 }
967
968 if (sae_set_group(sae, groups[i]) < 0)
969 continue;
970
971 break;
972 }
973 wpa_printf(MSG_DEBUG, "SAE: Selected new group: %d", groups[i]);
974}
975
976
c10347f2
JM		 977static void handle_auth_sae(struct hostapd_data *hapd, struct sta_info *sta,
978 const struct ieee80211_mgmt *mgmt, size_t len,
afa2ffb4 979 u16 auth_transaction, u16 status_code)
c10347f2 980{
bb598c3b 981 int resp = WLAN_STATUS_SUCCESS;
750efe6e 982 struct wpabuf *data = NULL;
941bad5e
JM		 983 int *groups = hapd->conf->sae_groups;
984 int default_groups[] = { 19, 0 };
96d6dfa8 985 const u8 *pos, *end;
10cf866b 986 int sta_removed = 0;
941bad5e
JM		 987
988 if (!groups)
989 groups = default_groups;
c10347f2 990
e7533538
JM		 991#ifdef CONFIG_TESTING_OPTIONS
992 if (hapd->conf->sae_reflection_attack && auth_transaction == 1) {
e7533538
JM		 993 wpa_printf(MSG_DEBUG, "SAE: TESTING - reflection attack");
994 pos = mgmt->u.auth.variable;
995 end = ((const u8 *) mgmt) + len;
996 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
e7525a29
BG		 997 auth_transaction, resp, pos, end - pos,
998 "auth-sae-reflection-attack");
e7533538
JM		 999 goto remove_sta;
1000 }
3648d8a1
JM		 1001
1002 if (hapd->conf->sae_commit_override && auth_transaction == 1) {
1003 wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
1004 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
1005 auth_transaction, resp,
1006 wpabuf_head(hapd->conf->sae_commit_override),
e7525a29
BG		 1007 wpabuf_len(hapd->conf->sae_commit_override),
1008 "sae-commit-override");
3648d8a1
JM		 1009 goto remove_sta;
1010 }
e7533538 1011#endif /* CONFIG_TESTING_OPTIONS */
98efcc41 1012 if (!sta->sae) {
bb598c3b
AB		 1013 if (auth_transaction != 1 ||
1014 status_code != WLAN_STATUS_SUCCESS) {
1015 resp = -1;
1016 goto remove_sta;
1017 }
98efcc41 1018 sta->sae = os_zalloc(sizeof(*sta->sae));
bb598c3b
AB		 1019 if (!sta->sae) {
1020 resp = -1;
1021 goto remove_sta;
1022 }
9249afc8 1023 sae_set_state(sta, SAE_NOTHING, "Init");
f3b8ad4d 1024 sta->sae->sync = 0;
98efcc41
JM		 1025 }
1026
9f2cf23e
MH		 1027 if (sta->mesh_sae_pmksa_caching) {
1028 wpa_printf(MSG_DEBUG,
1029 "SAE: Cancel use of mesh PMKSA caching because peer starts SAE authentication");
1030 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
1031 sta->mesh_sae_pmksa_caching = 0;
1032 }
1033
c10347f2 1034 if (auth_transaction == 1) {
96d6dfa8 1035 const u8 *token = NULL;
d136c376 1036 size_t token_len = 0;
f2143615
JM		 1037 int allow_reuse = 0;
1038
c10347f2
JM		 1039 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1040 HOSTAPD_LEVEL_DEBUG,
9c951244
AK		 1041 "start SAE authentication (RX commit, status=%u (%s))",
1042 status_code, status2str(status_code));
872b7545
MH		 1043
1044 if ((hapd->conf->mesh & MESH_ENABLED) &&
afa2ffb4
JM		 1045 status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
1046 sta->sae->tmp) {
a959a3b6
MH		 1047 pos = mgmt->u.auth.variable;
1048 end = ((const u8 *) mgmt) + len;
1049 if (pos + sizeof(le16) > end) {
1050 wpa_printf(MSG_ERROR,
1051 "SAE: Too short anti-clogging token request");
1052 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1053 goto reply;
1054 }
941bad5e 1055 resp = sae_group_allowed(sta->sae, groups,
a959a3b6
MH		 1056 WPA_GET_LE16(pos));
1057 if (resp != WLAN_STATUS_SUCCESS) {
1058 wpa_printf(MSG_ERROR,
1059 "SAE: Invalid group in anti-clogging token request");
1060 goto reply;
1061 }
1062 pos += sizeof(le16);
1063
872b7545
MH		 1064 wpabuf_free(sta->sae->tmp->anti_clogging_token);
1065 sta->sae->tmp->anti_clogging_token =
a959a3b6 1066 wpabuf_alloc_copy(pos, end - pos);
872b7545
MH		 1067 if (sta->sae->tmp->anti_clogging_token == NULL) {
1068 wpa_printf(MSG_ERROR,
1069 "SAE: Failed to alloc for anti-clogging token");
bb598c3b
AB		 1070 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1071 goto remove_sta;
872b7545
MH		 1072 }
1073
1074 /*
1075 * IEEE Std 802.11-2012, 11.3.8.6.4: If the Status code
1076 * is 76, a new Commit Message shall be constructed
1077 * with the Anti-Clogging Token from the received
1078 * Authentication frame, and the commit-scalar and
1079 * COMMIT-ELEMENT previously sent.
1080 */
bb598c3b
AB		 1081 resp = auth_sae_send_commit(hapd, sta, mgmt->bssid, 0);
1082 if (resp != WLAN_STATUS_SUCCESS) {
872b7545
MH		 1083 wpa_printf(MSG_ERROR,
1084 "SAE: Failed to send commit message");
bb598c3b 1085 goto remove_sta;
872b7545 1086 }
9249afc8
JM		 1087 sae_set_state(sta, SAE_COMMITTED,
1088 "Sent Commit (anti-clogging token case in mesh)");
f3b8ad4d
BC		 1089 sta->sae->sync = 0;
1090 sae_set_retransmit_timer(hapd, sta);
872b7545
MH		 1091 return;
1092 }
1093
dad01292
JM		 1094 if ((hapd->conf->mesh & MESH_ENABLED) &&
1095 status_code ==
1096 WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1097 sta->sae->tmp) {
1098 wpa_printf(MSG_DEBUG,
1099 "SAE: Peer did not accept our SAE group");
1100 sae_pick_next_group(hapd, sta);
1101 goto remove_sta;
1102 }
1103
afa2ffb4 1104 if (status_code != WLAN_STATUS_SUCCESS)
bb598c3b 1105 goto remove_sta;
afa2ffb4 1106
3a8dd390
JM		 1107 if (!(hapd->conf->mesh & MESH_ENABLED) &&
1108 sta->sae->state == SAE_COMMITTED) {
1109 /* This is needed in the infrastructure BSS case to
1110 * address a sequence where a STA entry may remain in
1111 * hostapd across two attempts to do SAE authentication
1112 * by the same STA. The second attempt may end up trying
1113 * to use a different group and that would not be
1114 * allowed if we remain in Committed state with the
1115 * previously set parameters. */
f2143615
JM		 1116 pos = mgmt->u.auth.variable;
1117 end = ((const u8 *) mgmt) + len;
1118 if (end - pos >= (int) sizeof(le16) &&
1119 sae_group_allowed(sta->sae, groups,
1120 WPA_GET_LE16(pos)) ==
1121 WLAN_STATUS_SUCCESS) {
1122 /* Do not waste resources deriving the same PWE
1123 * again since the same group is reused. */
1124 sae_set_state(sta, SAE_NOTHING,
1125 "Allow previous PWE to be reused");
1126 allow_reuse = 1;
1127 } else {
1128 sae_set_state(sta, SAE_NOTHING,
1129 "Clear existing state to allow restart");
1130 sae_clear_data(sta->sae);
1131 }
3a8dd390
JM		 1132 }
1133
146f6c9a
JM		 1134 resp = sae_parse_commit(sta->sae, mgmt->u.auth.variable,
1135 ((const u8 *) mgmt) + len -
d136c376 1136 mgmt->u.auth.variable, &token,
941bad5e 1137 &token_len, groups);
6a58444d
JM		 1138 if (resp == SAE_SILENTLY_DISCARD) {
1139 wpa_printf(MSG_DEBUG,
1140 "SAE: Drop commit message from " MACSTR " due to reflection attack",
1141 MAC2STR(sta->addr));
bb598c3b 1142 goto remove_sta;
6a58444d 1143 }
9be19d0b
JM		 1144
1145 if (resp == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
1146 wpa_msg(hapd->msg_ctx, MSG_INFO,
1147 WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER
1148 MACSTR, MAC2STR(sta->addr));
1149 sae_clear_retransmit_timer(hapd, sta);
1150 sae_set_state(sta, SAE_NOTHING,
1151 "Unknown Password Identifier");
1152 goto remove_sta;
1153 }
1154
d136c376
JM		 1155 if (token && check_sae_token(hapd, sta->addr, token, token_len)
1156 < 0) {
1157 wpa_printf(MSG_DEBUG, "SAE: Drop commit message with "
1158 "incorrect token from " MACSTR,
1159 MAC2STR(sta->addr));
bb598c3b
AB		 1160 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1161 goto remove_sta;
d136c376
JM		 1162 }
1163
e96da42b
BC		 1164 if (resp != WLAN_STATUS_SUCCESS)
1165 goto reply;
1166
f2143615 1167 if (!token && use_sae_anti_clogging(hapd) && !allow_reuse) {
e96da42b
BC		 1168 wpa_printf(MSG_DEBUG,
1169 "SAE: Request anti-clogging token from "
1170 MACSTR, MAC2STR(sta->addr));
a959a3b6
MH		 1171 data = auth_build_token_req(hapd, sta->sae->group,
1172 sta->addr);
e96da42b 1173 resp = WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ;
872b7545 1174 if (hapd->conf->mesh & MESH_ENABLED)
9249afc8
JM		 1175 sae_set_state(sta, SAE_NOTHING,
1176 "Request anti-clogging token case in mesh");
e96da42b 1177 goto reply;
750efe6e 1178 }
e96da42b 1179
f2143615 1180 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction,
10cf866b 1181 allow_reuse, &sta_removed);
c10347f2 1182 } else if (auth_transaction == 2) {
c10347f2
JM		 1183 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1184 HOSTAPD_LEVEL_DEBUG,
9c951244
AK		 1185 "SAE authentication (RX confirm, status=%u (%s))",
1186 status_code, status2str(status_code));
afa2ffb4 1187 if (status_code != WLAN_STATUS_SUCCESS)
bb598c3b 1188 goto remove_sta;
e96da42b
BC		 1189 if (sta->sae->state >= SAE_CONFIRMED ||
1190 !(hapd->conf->mesh & MESH_ENABLED)) {
abcbd060
JM		 1191 const u8 *var;
1192 size_t var_len;
1193 u16 peer_send_confirm;
1194
1195 var = mgmt->u.auth.variable;
1196 var_len = ((u8 *) mgmt) + len - mgmt->u.auth.variable;
1197 if (var_len < 2) {
1198 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1199 goto reply;
1200 }
1201
1202 peer_send_confirm = WPA_GET_LE16(var);
1203
1204 if (sta->sae->state == SAE_ACCEPTED &&
1205 (peer_send_confirm <= sta->sae->rc ||
1206 peer_send_confirm == 0xffff)) {
1207 wpa_printf(MSG_DEBUG,
1208 "SAE: Silently ignore unexpected Confirm from peer "
1209 MACSTR
1210 " (peer-send-confirm=%u Rc=%u)",
1211 MAC2STR(sta->addr),
1212 peer_send_confirm, sta->sae->rc);
1213 return;
1214 }
1215
1216 if (sae_check_confirm(sta->sae, var, var_len) < 0) {
750efe6e 1217 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
e96da42b 1218 goto reply;
b4fd3613 1219 }
abcbd060 1220 sta->sae->rc = peer_send_confirm;
21af6d15 1221 }
10cf866b
JM		 1222 resp = sae_sm_step(hapd, sta, mgmt->bssid, auth_transaction, 0,
1223 &sta_removed);
c10347f2
JM		 1224 } else {
1225 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1226 HOSTAPD_LEVEL_DEBUG,
9c951244
AK		 1227 "unexpected SAE authentication transaction %u (status=%u (%s))",
1228 auth_transaction, status_code,
1229 status2str(status_code));
afa2ffb4 1230 if (status_code != WLAN_STATUS_SUCCESS)
bb598c3b 1231 goto remove_sta;
c10347f2
JM		 1232 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
1233 }
1234
e96da42b 1235reply:
10cf866b 1236 if (!sta_removed && resp != WLAN_STATUS_SUCCESS) {
96d6dfa8
JM		 1237 pos = mgmt->u.auth.variable;
1238 end = ((const u8 *) mgmt) + len;
1239
1240 /* Copy the Finite Cyclic Group field from the request if we
1241 * rejected it as unsupported group. */
1242 if (resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
1243 !data && end - pos >= 2)
1244 data = wpabuf_alloc_copy(pos, 2);
1245
4ffb0fef 1246 sae_sme_send_external_auth_status(hapd, sta, resp);
e96da42b
BC		 1247 send_auth_reply(hapd, mgmt->sa, mgmt->bssid, WLAN_AUTH_SAE,
1248 auth_transaction, resp,
1249 data ? wpabuf_head(data) : (u8 *) "",
e7525a29 1250 data ? wpabuf_len(data) : 0, "auth-sae");
e96da42b 1251 }
bb598c3b
AB		 1252
1253remove_sta:
10cf866b
JM		 1254 if (!sta_removed && sta->added_unassoc &&
1255 (resp != WLAN_STATUS_SUCCESS ||
1256 status_code != WLAN_STATUS_SUCCESS)) {
bb598c3b
AB		 1257 hostapd_drv_sta_remove(hapd, sta->addr);
1258 sta->added_unassoc = 0;
1259 }
21af6d15 1260 wpabuf_free(data);
c10347f2 1261}
a206e2a1
BC		 1262
1263
1264/**
1265 * auth_sae_init_committed - Send COMMIT and start SAE in committed state
1266 * @hapd: BSS data for the device initiating the authentication
1267 * @sta: the peer to which commit authentication frame is sent
1268 *
1269 * This function implements Init event handling (IEEE Std 802.11-2012,
1270 * 11.3.8.6.3) in which initial COMMIT message is sent. Prior to calling, the
1271 * sta->sae structure should be initialized appropriately via a call to
1272 * sae_prepare_commit().
1273 */
1274int auth_sae_init_committed(struct hostapd_data *hapd, struct sta_info *sta)
1275{
1276 int ret;
1277
1278 if (!sta->sae || !sta->sae->tmp)
1279 return -1;
1280
1281 if (sta->sae->state != SAE_NOTHING)
1282 return -1;
1283
1284 ret = auth_sae_send_commit(hapd, sta, hapd->own_addr, 0);
1285 if (ret)
1286 return -1;
1287
9249afc8 1288 sae_set_state(sta, SAE_COMMITTED, "Init and sent commit");
f3b8ad4d
BC		 1289 sta->sae->sync = 0;
1290 sae_set_retransmit_timer(hapd, sta);
a206e2a1
BC		 1291
1292 return 0;
1293}
1294
ff9f40ae
JM		 1295
1296void auth_sae_process_commit(void *eloop_ctx, void *user_ctx)
1297{
1298 struct hostapd_data *hapd = eloop_ctx;
1299 struct hostapd_sae_commit_queue *q;
1300 unsigned int queue_len;
1301
1302 q = dl_list_first(&hapd->sae_commit_queue,
1303 struct hostapd_sae_commit_queue, list);
1304 if (!q)
1305 return;
1306 wpa_printf(MSG_DEBUG,
5e3a759c 1307 "SAE: Process next available message from queue");
ff9f40ae
JM		 1308 dl_list_del(&q->list);
1309 handle_auth(hapd, (const struct ieee80211_mgmt *) q->msg, q->len,
1310 q->rssi, 1);
1311 os_free(q);
1312
1313 if (eloop_is_timeout_registered(auth_sae_process_commit, hapd, NULL))
1314 return;
1315 queue_len = dl_list_len(&hapd->sae_commit_queue);
ff5f54e1 1316 eloop_register_timeout(0, queue_len * 10000, auth_sae_process_commit,
ff9f40ae
JM		 1317 hapd, NULL);
1318}
1319
1320
5e3a759c
JM		 1321static void auth_sae_queue(struct hostapd_data *hapd,
1322 const struct ieee80211_mgmt *mgmt, size_t len,
1323 int rssi)
ff9f40ae 1324{
5e3a759c 1325 struct hostapd_sae_commit_queue *q, *q2;
ff9f40ae 1326 unsigned int queue_len;
5e3a759c 1327 const struct ieee80211_mgmt *mgmt2;
ff9f40ae
JM		 1328
1329 queue_len = dl_list_len(&hapd->sae_commit_queue);
1330 if (queue_len >= 15) {
1331 wpa_printf(MSG_DEBUG,
5e3a759c 1332 "SAE: No more room in message queue - drop the new frame from "
ff9f40ae
JM		 1333 MACSTR, MAC2STR(mgmt->sa));
1334 return;
1335 }
1336
5e3a759c
JM		 1337 wpa_printf(MSG_DEBUG, "SAE: Queue Authentication message from "
1338 MACSTR " for processing (queue_len %u)", MAC2STR(mgmt->sa),
1339 queue_len);
ff9f40ae
JM		 1340 q = os_zalloc(sizeof(*q) + len);
1341 if (!q)
1342 return;
1343 q->rssi = rssi;
1344 q->len = len;
1345 os_memcpy(q->msg, mgmt, len);
5e3a759c
JM		 1346
1347 /* Check whether there is already a queued Authentication frame from the
1348 * same station with the same transaction number and if so, replace that
1349 * queue entry with the new one. This avoids issues with a peer that
1350 * sends multiple times (e.g., due to frequent SAE retries). There is no
1351 * point in us trying to process the old attempts after a new one has
1352 * obsoleted them. */
1353 dl_list_for_each(q2, &hapd->sae_commit_queue,
1354 struct hostapd_sae_commit_queue, list) {
1355 mgmt2 = (const struct ieee80211_mgmt *) q2->msg;
1356 if (os_memcmp(mgmt->sa, mgmt2->sa, ETH_ALEN) == 0 &&
1357 mgmt->u.auth.auth_transaction ==
1358 mgmt2->u.auth.auth_transaction) {
1359 wpa_printf(MSG_DEBUG,
1360 "SAE: Replace queued message from same STA with same transaction number");
1361 dl_list_add(&q2->list, &q->list);
1362 dl_list_del(&q2->list);
1363 os_free(q2);
1364 goto queued;
1365 }
1366 }
1367
1368 /* No pending identical entry, so add to the end of the queue */
ff9f40ae 1369 dl_list_add_tail(&hapd->sae_commit_queue, &q->list);
5e3a759c
JM		 1370
1371queued:
ff9f40ae
JM		 1372 if (eloop_is_timeout_registered(auth_sae_process_commit, hapd, NULL))
1373 return;
ff5f54e1 1374 eloop_register_timeout(0, queue_len * 10000, auth_sae_process_commit,
ff9f40ae
JM		 1375 hapd, NULL);
1376}
1377
5e3a759c
JM		 1378
1379static int auth_sae_queued_addr(struct hostapd_data *hapd, const u8 *addr)
1380{
1381 struct hostapd_sae_commit_queue *q;
1382 const struct ieee80211_mgmt *mgmt;
1383
1384 dl_list_for_each(q, &hapd->sae_commit_queue,
1385 struct hostapd_sae_commit_queue, list) {
1386 mgmt = (const struct ieee80211_mgmt *) q->msg;
1387 if (os_memcmp(addr, mgmt->sa, ETH_ALEN) == 0)
1388 return 1;
1389 }
1390
1391 return 0;
1392}
1393
c10347f2
JM		 1394#endif /* CONFIG_SAE */
1395
1396
ffb62f22
JM		 1397static u16 wpa_res_to_status_code(int res)
1398{
1399 if (res == WPA_INVALID_GROUP)
1400 return WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
1401 if (res == WPA_INVALID_PAIRWISE)
1402 return WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1403 if (res == WPA_INVALID_AKMP)
1404 return WLAN_STATUS_AKMP_NOT_VALID;
1405 if (res == WPA_ALLOC_FAIL)
1406 return WLAN_STATUS_UNSPECIFIED_FAILURE;
1407#ifdef CONFIG_IEEE80211W
1408 if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
1409 return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
1410 if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
feba5848 1411 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
ffb62f22
JM		 1412#endif /* CONFIG_IEEE80211W */
1413 if (res == WPA_INVALID_MDIE)
1414 return WLAN_STATUS_INVALID_MDIE;
567da5bb
JM		 1415 if (res == WPA_INVALID_PMKID)
1416 return WLAN_STATUS_INVALID_PMKID;
ffb62f22
JM		 1417 if (res != WPA_IE_OK)
1418 return WLAN_STATUS_INVALID_IE;
1419 return WLAN_STATUS_SUCCESS;
1420}
1421
1422
c4fd6d8a
JM		 1423#ifdef CONFIG_FILS
1424
1425static void handle_auth_fils_finish(struct hostapd_data *hapd,
1426 struct sta_info *sta, u16 resp,
5cee22ca
JM		 1427 struct wpabuf *data, int pub);
1428
1429void handle_auth_fils(struct hostapd_data *hapd, struct sta_info *sta,
1430 const u8 *pos, size_t len, u16 auth_alg,
1431 u16 auth_transaction, u16 status_code,
1432 void (*cb)(struct hostapd_data *hapd,
1433 struct sta_info *sta, u16 resp,
1434 struct wpabuf *data, int pub))
c4fd6d8a
JM		 1435{
1436 u16 resp = WLAN_STATUS_SUCCESS;
b8a3453a 1437 const u8 *end;
c4fd6d8a
JM		 1438 struct ieee802_11_elems elems;
1439 int res;
1440 struct wpa_ie_data rsn;
1441 struct rsn_pmksa_cache_entry *pmksa = NULL;
1442
1443 if (auth_transaction != 1 || status_code != WLAN_STATUS_SUCCESS)
1444 return;
1445
b8a3453a 1446 end = pos + len;
c4fd6d8a
JM		 1447
1448 wpa_hexdump(MSG_DEBUG, "FILS: Authentication frame fields",
1449 pos, end - pos);
1450
1764559e
JM		 1451 /* TODO: FILS PK */
1452#ifdef CONFIG_FILS_SK_PFS
1453 if (auth_alg == WLAN_AUTH_FILS_SK_PFS) {
1454 u16 group;
1455 struct wpabuf *pub;
1456 size_t elem_len;
1457
1458 /* Using FILS PFS */
1459
1460 /* Finite Cyclic Group */
1461 if (end - pos < 2) {
1462 wpa_printf(MSG_DEBUG,
1463 "FILS: No room for Finite Cyclic Group");
1464 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1465 goto fail;
1466 }
1467 group = WPA_GET_LE16(pos);
1468 pos += 2;
1469 if (group != hapd->conf->fils_dh_group) {
1470 wpa_printf(MSG_DEBUG,
1471 "FILS: Unsupported Finite Cyclic Group: %u (expected %u)",
1472 group, hapd->conf->fils_dh_group);
1473 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1474 goto fail;
1475 }
1476
1477 crypto_ecdh_deinit(sta->fils_ecdh);
1478 sta->fils_ecdh = crypto_ecdh_init(group);
1479 if (!sta->fils_ecdh) {
1480 wpa_printf(MSG_INFO,
1481 "FILS: Could not initialize ECDH with group %d",
1482 group);
1483 resp = WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
1484 goto fail;
1485 }
1486
1487 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1488 if (!pub) {
1489 wpa_printf(MSG_DEBUG,
1490 "FILS: Failed to derive ECDH public key");
1491 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1492 goto fail;
1493 }
1494 elem_len = wpabuf_len(pub);
1495 wpabuf_free(pub);
1496
1497 /* Element */
1498 if ((size_t) (end - pos) < elem_len) {
1499 wpa_printf(MSG_DEBUG, "FILS: No room for Element");
1500 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1501 goto fail;
1502 }
1503
80ddf5d9
JM		 1504 wpabuf_free(sta->fils_g_sta);
1505 sta->fils_g_sta = wpabuf_alloc_copy(pos, elem_len);
1764559e
JM		 1506 wpabuf_clear_free(sta->fils_dh_ss);
1507 sta->fils_dh_ss = crypto_ecdh_set_peerkey(sta->fils_ecdh, 1,
1508 pos, elem_len);
1509 if (!sta->fils_dh_ss) {
1510 wpa_printf(MSG_DEBUG, "FILS: ECDH operation failed");
1511 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1512 goto fail;
1513 }
1514 wpa_hexdump_buf_key(MSG_DEBUG, "FILS: DH_SS", sta->fils_dh_ss);
1515 pos += elem_len;
1516 } else {
1517 crypto_ecdh_deinit(sta->fils_ecdh);
1518 sta->fils_ecdh = NULL;
1519 wpabuf_clear_free(sta->fils_dh_ss);
1520 sta->fils_dh_ss = NULL;
1521 }
1522#endif /* CONFIG_FILS_SK_PFS */
c4fd6d8a
JM		 1523
1524 wpa_hexdump(MSG_DEBUG, "FILS: Remaining IEs", pos, end - pos);
1525 if (ieee802_11_parse_elems(pos, end - pos, &elems, 1) == ParseFailed) {
1526 wpa_printf(MSG_DEBUG, "FILS: Could not parse elements");
1527 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1528 goto fail;
1529 }
1530
1531 /* RSNE */
1532 wpa_hexdump(MSG_DEBUG, "FILS: RSN element",
1533 elems.rsn_ie, elems.rsn_ie_len);
1534 if (!elems.rsn_ie ||
1535 wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
1536 &rsn) < 0) {
1537 wpa_printf(MSG_DEBUG, "FILS: No valid RSN element");
1538 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1539 goto fail;
1540 }
1541
1542 if (!sta->wpa_sm)
1543 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth, sta->addr,
1544 NULL);
1545 if (!sta->wpa_sm) {
1546 wpa_printf(MSG_DEBUG,
1547 "FILS: Failed to initialize RSN state machine");
1548 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1549 goto fail;
1550 }
1551
1552 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
2c129a1b 1553 hapd->iface->freq,
c4fd6d8a 1554 elems.rsn_ie - 2, elems.rsn_ie_len + 2,
09368515 1555 elems.mdie, elems.mdie_len, NULL, 0);
c4fd6d8a
JM		 1556 resp = wpa_res_to_status_code(res);
1557 if (resp != WLAN_STATUS_SUCCESS)
1558 goto fail;
1559
c4fd6d8a
JM		 1560 if (!elems.fils_nonce) {
1561 wpa_printf(MSG_DEBUG, "FILS: No FILS Nonce field");
1562 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1563 goto fail;
1564 }
1565 wpa_hexdump(MSG_DEBUG, "FILS: SNonce", elems.fils_nonce,
1566 FILS_NONCE_LEN);
1567 os_memcpy(sta->fils_snonce, elems.fils_nonce, FILS_NONCE_LEN);
1568
1569 /* PMKID List */
1570 if (rsn.pmkid && rsn.num_pmkid > 0) {
1571 u8 num;
1572 const u8 *pmkid;
1573
1574 wpa_hexdump(MSG_DEBUG, "FILS: PMKID List",
1575 rsn.pmkid, rsn.num_pmkid * PMKID_LEN);
1576
1577 pmkid = rsn.pmkid;
1578 num = rsn.num_pmkid;
1579 while (num) {
1580 wpa_hexdump(MSG_DEBUG, "FILS: PMKID", pmkid, PMKID_LEN);
1581 pmksa = wpa_auth_pmksa_get(hapd->wpa_auth, sta->addr,
1582 pmkid);
1583 if (pmksa)
1584 break;
7eace378
JM		 1585 pmksa = wpa_auth_pmksa_get_fils_cache_id(hapd->wpa_auth,
1586 sta->addr,
1587 pmkid);
1588 if (pmksa)
1589 break;
c4fd6d8a
JM		 1590 pmkid += PMKID_LEN;
1591 num--;
1592 }
1593 }
1594 if (pmksa && wpa_auth_sta_key_mgmt(sta->wpa_sm) != pmksa->akmp) {
1595 wpa_printf(MSG_DEBUG,
1596 "FILS: Matching PMKSA cache entry has different AKMP (0x%x != 0x%x) - ignore",
1597 wpa_auth_sta_key_mgmt(sta->wpa_sm), pmksa->akmp);
1598 pmksa = NULL;
1599 }
1600 if (pmksa)
1601 wpa_printf(MSG_DEBUG, "FILS: Found matching PMKSA cache entry");
1602
1603 /* FILS Session */
1604 if (!elems.fils_session) {
1605 wpa_printf(MSG_DEBUG, "FILS: No FILS Session element");
1606 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1607 goto fail;
1608 }
1609 wpa_hexdump(MSG_DEBUG, "FILS: FILS Session", elems.fils_session,
1610 FILS_SESSION_LEN);
1611 os_memcpy(sta->fils_session, elems.fils_session, FILS_SESSION_LEN);
1612
1613 /* FILS Wrapped Data */
1614 if (elems.fils_wrapped_data) {
1615 wpa_hexdump(MSG_DEBUG, "FILS: Wrapped Data",
1616 elems.fils_wrapped_data,
1617 elems.fils_wrapped_data_len);
1618 if (!pmksa) {
1619#ifndef CONFIG_NO_RADIUS
1620 if (!sta->eapol_sm) {
1621 sta->eapol_sm =
1622 ieee802_1x_alloc_eapol_sm(hapd, sta);
1623 }
1624 wpa_printf(MSG_DEBUG,
bfe44833 1625 "FILS: Forward EAP-Initiate/Re-auth to authentication server");
c4fd6d8a
JM		 1626 ieee802_1x_encapsulate_radius(
1627 hapd, sta, elems.fils_wrapped_data,
1628 elems.fils_wrapped_data_len);
5cee22ca 1629 sta->fils_pending_cb = cb;
c4fd6d8a
JM		 1630 wpa_printf(MSG_DEBUG,
1631 "FILS: Will send Authentication frame once the response from authentication server is available");
1632 sta->flags |= WLAN_STA_PENDING_FILS_ERP;
b3e567c8
JM		 1633 /* Calculate pending PMKID here so that we do not need
1634 * to maintain a copy of the EAP-Initiate/Reauth
1635 * message. */
1636 if (fils_pmkid_erp(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1637 elems.fils_wrapped_data,
1638 elems.fils_wrapped_data_len,
1639 sta->fils_erp_pmkid) == 0)
1640 sta->fils_erp_pmkid_set = 1;
c4fd6d8a
JM		 1641 return;
1642#else /* CONFIG_NO_RADIUS */
1643 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1644 goto fail;
1645#endif /* CONFIG_NO_RADIUS */
1646 }
1647 }
1648
1649fail:
5cee22ca
JM		 1650 if (cb) {
1651 struct wpabuf *data;
1652 int pub = 0;
1653
1654 data = prepare_auth_resp_fils(hapd, sta, &resp, pmksa, NULL,
1655 NULL, 0, &pub);
1656 if (!data) {
1657 wpa_printf(MSG_DEBUG,
1658 "%s: prepare_auth_resp_fils() returned failure",
1659 __func__);
1660 }
1661
1662 cb(hapd, sta, resp, data, pub);
1663 }
c4fd6d8a
JM		 1664}
1665
1666
5e5f8c81
JM		 1667static struct wpabuf *
1668prepare_auth_resp_fils(struct hostapd_data *hapd,
1669 struct sta_info *sta, u16 *resp,
1670 struct rsn_pmksa_cache_entry *pmksa,
1671 struct wpabuf *erp_resp,
1672 const u8 *msk, size_t msk_len,
1673 int *is_pub)
c4fd6d8a
JM		 1674{
1675 u8 fils_nonce[FILS_NONCE_LEN];
1676 size_t ielen;
1677 struct wpabuf *data = NULL;
1678 const u8 *ie;
1679 u8 *ie_buf = NULL;
1680 const u8 *pmk = NULL;
1681 size_t pmk_len = 0;
fcd3d6ce 1682 u8 pmk_buf[PMK_LEN_MAX];
1764559e 1683 struct wpabuf *pub = NULL;
c4fd6d8a 1684
5e5f8c81 1685 if (*resp != WLAN_STATUS_SUCCESS)
c4fd6d8a
JM		 1686 goto fail;
1687
1688 ie = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ielen);
1689 if (!ie) {
5e5f8c81 1690 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1691 goto fail;
1692 }
5e5f8c81 1693
c4fd6d8a
JM		 1694 if (pmksa) {
1695 /* Add PMKID of the selected PMKSA into RSNE */
1696 ie_buf = os_malloc(ielen + 2 + 2 + PMKID_LEN);
1697 if (!ie_buf) {
5e5f8c81 1698 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1699 goto fail;
1700 }
5e5f8c81 1701
c4fd6d8a
JM		 1702 os_memcpy(ie_buf, ie, ielen);
1703 if (wpa_insert_pmkid(ie_buf, &ielen, pmksa->pmkid) < 0) {
5e5f8c81 1704 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1705 goto fail;
1706 }
1707 ie = ie_buf;
1708 }
1709
1710 if (random_get_bytes(fils_nonce, FILS_NONCE_LEN) < 0) {
5e5f8c81 1711 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1712 goto fail;
1713 }
1714 wpa_hexdump(MSG_DEBUG, "RSN: Generated FILS Nonce",
1715 fils_nonce, FILS_NONCE_LEN);
1716
1764559e
JM		 1717#ifdef CONFIG_FILS_SK_PFS
1718 if (sta->fils_dh_ss && sta->fils_ecdh) {
1719 pub = crypto_ecdh_get_pubkey(sta->fils_ecdh, 1);
1720 if (!pub) {
5e5f8c81 1721 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
1764559e
JM		 1722 goto fail;
1723 }
1724 }
1725#endif /* CONFIG_FILS_SK_PFS */
1726
1727 data = wpabuf_alloc(1000 + ielen + (pub ? wpabuf_len(pub) : 0));
c4fd6d8a 1728 if (!data) {
5e5f8c81 1729 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1730 goto fail;
1731 }
1732
1764559e
JM		 1733 /* TODO: FILS PK */
1734#ifdef CONFIG_FILS_SK_PFS
1735 if (pub) {
1736 /* Finite Cyclic Group */
1737 wpabuf_put_le16(data, hapd->conf->fils_dh_group);
1738
1739 /* Element */
1740 wpabuf_put_buf(data, pub);
1741 }
1742#endif /* CONFIG_FILS_SK_PFS */
c4fd6d8a
JM		 1743
1744 /* RSNE */
1745 wpabuf_put_data(data, ie, ielen);
1746
5db997e3
JM		 1747 /* MDE when using FILS+FT (already included in ie,ielen with RSNE) */
1748
1749#ifdef CONFIG_IEEE80211R_AP
1750 if (wpa_key_mgmt_ft(wpa_auth_sta_key_mgmt(sta->wpa_sm))) {
1751 /* FTE[R1KH-ID,R0KH-ID] when using FILS+FT */
1752 int res;
a7968ea5
JM		 1753 int use_sha384 = wpa_key_mgmt_sha384(
1754 wpa_auth_sta_key_mgmt(sta->wpa_sm));
5db997e3 1755
a7968ea5
JM		 1756 res = wpa_auth_write_fte(hapd->wpa_auth, use_sha384,
1757 wpabuf_put(data, 0),
5db997e3
JM		 1758 wpabuf_tailroom(data));
1759 if (res < 0) {
5e5f8c81 1760 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
5db997e3
JM		 1761 goto fail;
1762 }
1763 wpabuf_put(data, res);
1764 }
1765#endif /* CONFIG_IEEE80211R_AP */
c4fd6d8a
JM		 1766
1767 /* FILS Nonce */
1768 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1769 wpabuf_put_u8(data, 1 + FILS_NONCE_LEN); /* Length */
1770 /* Element ID Extension */
1771 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_NONCE);
1772 wpabuf_put_data(data, fils_nonce, FILS_NONCE_LEN);
1773
1774 /* FILS Session */
1775 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1776 wpabuf_put_u8(data, 1 + FILS_SESSION_LEN); /* Length */
1777 /* Element ID Extension */
1778 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_SESSION);
1779 wpabuf_put_data(data, sta->fils_session, FILS_SESSION_LEN);
1780
1781 /* FILS Wrapped Data */
1782 if (!pmksa && erp_resp) {
1783 wpabuf_put_u8(data, WLAN_EID_EXTENSION); /* Element ID */
1784 wpabuf_put_u8(data, 1 + wpabuf_len(erp_resp)); /* Length */
1785 /* Element ID Extension */
1786 wpabuf_put_u8(data, WLAN_EID_EXT_FILS_WRAPPED_DATA);
1787 wpabuf_put_buf(data, erp_resp);
1788
fcd3d6ce
JM		 1789 if (fils_rmsk_to_pmk(wpa_auth_sta_key_mgmt(sta->wpa_sm),
1790 msk, msk_len, sta->fils_snonce, fils_nonce,
1764559e
JM		 1791 sta->fils_dh_ss ?
1792 wpabuf_head(sta->fils_dh_ss) : NULL,
1793 sta->fils_dh_ss ?
1794 wpabuf_len(sta->fils_dh_ss) : 0,
1795 pmk_buf, &pmk_len)) {
fcd3d6ce 1796 wpa_printf(MSG_DEBUG, "FILS: Failed to derive PMK");
5e5f8c81 1797 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
fcd3d6ce
JM		 1798 wpabuf_free(data);
1799 data = NULL;
1800 goto fail;
1801 }
1802 pmk = pmk_buf;
b3e567c8 1803
4cada9dc
JM		 1804 /* Don't use DHss in PTK derivation if PMKSA caching is not
1805 * used. */
1806 wpabuf_clear_free(sta->fils_dh_ss);
1807 sta->fils_dh_ss = NULL;
1808
b3e567c8
JM		 1809 if (sta->fils_erp_pmkid_set) {
1810 /* TODO: get PMKLifetime from WPA parameters */
1811 unsigned int dot11RSNAConfigPMKLifetime = 43200;
13f118dc
MB		 1812 int session_timeout;
1813
1814 session_timeout = dot11RSNAConfigPMKLifetime;
1815 if (sta->session_timeout_set) {
1816 struct os_reltime now, diff;
1817
1818 os_get_reltime(&now);
1819 os_reltime_sub(&sta->session_timeout, &now,
1820 &diff);
1821 session_timeout = diff.sec;
1822 }
b3e567c8
JM		 1823
1824 sta->fils_erp_pmkid_set = 0;
a40bd06e
JM		 1825 wpa_auth_add_fils_pmk_pmkid(sta->wpa_sm, pmk, pmk_len,
1826 sta->fils_erp_pmkid);
aabbdb81
JM		 1827 if (!hapd->conf->disable_pmksa_caching &&
1828 wpa_auth_pmksa_add2(
b3e567c8
JM		 1829 hapd->wpa_auth, sta->addr,
1830 pmk, pmk_len,
1831 sta->fils_erp_pmkid,
13f118dc 1832 session_timeout,
b3e567c8
JM		 1833 wpa_auth_sta_key_mgmt(sta->wpa_sm)) < 0) {
1834 wpa_printf(MSG_ERROR,
1835 "FILS: Failed to add PMKSA cache entry based on ERP");
1836 }
1837 }
c4fd6d8a
JM		 1838 } else if (pmksa) {
1839 pmk = pmksa->pmk;
1840 pmk_len = pmksa->pmk_len;
1841 }
1842
1843 if (!pmk) {
1844 wpa_printf(MSG_DEBUG, "FILS: No PMK available");
5e5f8c81 1845 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1846 wpabuf_free(data);
1847 data = NULL;
1848 goto fail;
1849 }
1850
1851 if (fils_auth_pmk_to_ptk(sta->wpa_sm, pmk, pmk_len,
80ddf5d9 1852 sta->fils_snonce, fils_nonce,
4cada9dc
JM		 1853 sta->fils_dh_ss ?
1854 wpabuf_head(sta->fils_dh_ss) : NULL,
1855 sta->fils_dh_ss ?
1856 wpabuf_len(sta->fils_dh_ss) : 0,
80ddf5d9 1857 sta->fils_g_sta, pub) < 0) {
5e5f8c81 1858 *resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
c4fd6d8a
JM		 1859 wpabuf_free(data);
1860 data = NULL;
1861 goto fail;
1862 }
1863
1864fail:
5e5f8c81
JM		 1865 if (is_pub)
1866 *is_pub = pub != NULL;
1867 os_free(ie_buf);
1868 wpabuf_free(pub);
1869 wpabuf_clear_free(sta->fils_dh_ss);
1870 sta->fils_dh_ss = NULL;
1871#ifdef CONFIG_FILS_SK_PFS
1872 crypto_ecdh_deinit(sta->fils_ecdh);
1873 sta->fils_ecdh = NULL;
1874#endif /* CONFIG_FILS_SK_PFS */
1875 return data;
1876}
1877
1878
1879static void handle_auth_fils_finish(struct hostapd_data *hapd,
1880 struct sta_info *sta, u16 resp,
5cee22ca 1881 struct wpabuf *data, int pub)
5e5f8c81 1882{
5e5f8c81 1883 u16 auth_alg;
5e5f8c81 1884
1764559e
JM		 1885 auth_alg = (pub ||
1886 resp == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) ?
1887 WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
1888 send_auth_reply(hapd, sta->addr, hapd->own_addr, auth_alg, 2, resp,
c4fd6d8a 1889 data ? wpabuf_head(data) : (u8 *) "",
e7525a29 1890 data ? wpabuf_len(data) : 0, "auth-fils-finish");
c4fd6d8a
JM		 1891 wpabuf_free(data);
1892
1893 if (resp == WLAN_STATUS_SUCCESS) {
1894 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1895 HOSTAPD_LEVEL_DEBUG,
1896 "authentication OK (FILS)");
1897 sta->flags |= WLAN_STA_AUTH;
1898 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
1764559e 1899 sta->auth_alg = pub ? WLAN_AUTH_FILS_SK_PFS : WLAN_AUTH_FILS_SK;
c4fd6d8a
JM		 1900 mlme_authenticate_indication(hapd, sta);
1901 }
c4fd6d8a
JM		 1902}
1903
1904
1905void ieee802_11_finish_fils_auth(struct hostapd_data *hapd,
1906 struct sta_info *sta, int success,
1907 struct wpabuf *erp_resp,
1908 const u8 *msk, size_t msk_len)
1909{
5cee22ca
JM		 1910 struct wpabuf *data;
1911 int pub = 0;
1912 u16 resp;
1913
c4fd6d8a 1914 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
5cee22ca
JM		 1915
1916 if (!sta->fils_pending_cb)
1917 return;
1918 resp = success ? WLAN_STATUS_SUCCESS : WLAN_STATUS_UNSPECIFIED_FAILURE;
1919 data = prepare_auth_resp_fils(hapd, sta, &resp, NULL, erp_resp,
1920 msk, msk_len, &pub);
1921 if (!data) {
1922 wpa_printf(MSG_DEBUG,
1923 "%s: prepare_auth_resp_fils() returned failure",
1924 __func__);
1925 }
1926 sta->fils_pending_cb(hapd, sta, resp, data, pub);
c4fd6d8a
JM		 1927}
1928
1929#endif /* CONFIG_FILS */
1930
1931
92eb00ae 1932int
53d17144
DL		 1933ieee802_11_allowed_address(struct hostapd_data *hapd, const u8 *addr,
1934 const u8 *msg, size_t len, u32 *session_timeout,
1935 u32 *acct_interim_interval,
1936 struct vlan_description *vlan_id,
1937 struct hostapd_sta_wpa_psk_short **psk,
92eb00ae 1938 char **identity, char **radius_cui, int is_probe_req)
53d17144
DL		 1939{
1940 int res;
1941
1942 os_memset(vlan_id, 0, sizeof(*vlan_id));
1943 res = hostapd_allowed_address(hapd, addr, msg, len,
1944 session_timeout, acct_interim_interval,
92eb00ae
T		 1945 vlan_id, psk, identity, radius_cui,
1946 is_probe_req);
53d17144
DL		 1947
1948 if (res == HOSTAPD_ACL_REJECT) {
6588f712
JM		 1949 if (!is_probe_req)
1950 wpa_printf(MSG_DEBUG,
1951 "Station " MACSTR
1952 " not allowed to authenticate",
1953 MAC2STR(addr));
53d17144
DL		 1954 return HOSTAPD_ACL_REJECT;
1955 }
1956
1957 if (res == HOSTAPD_ACL_PENDING) {
1958 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
1959 " waiting for an external authentication",
1960 MAC2STR(addr));
1961 /* Authentication code will re-send the authentication frame
1962 * after it has received (and cached) information from the
1963 * external source. */
1964 return HOSTAPD_ACL_PENDING;
1965 }
1966
1967 return res;
1968}
1969
1970
1971static int
1972ieee802_11_set_radius_info(struct hostapd_data *hapd, struct sta_info *sta,
1973 int res, u32 session_timeout,
1974 u32 acct_interim_interval,
1975 struct vlan_description *vlan_id,
1976 struct hostapd_sta_wpa_psk_short **psk,
1977 char **identity, char **radius_cui)
1978{
1979 if (vlan_id->notempty &&
1980 !hostapd_vlan_valid(hapd->conf->vlan, vlan_id)) {
1981 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1982 HOSTAPD_LEVEL_INFO,
1983 "Invalid VLAN %d%s received from RADIUS server",
1984 vlan_id->untagged,
1985 vlan_id->tagged[0] ? "+" : "");
1986 return -1;
1987 }
1988 if (ap_sta_set_vlan(hapd, sta, vlan_id) < 0)
1989 return -1;
1990 if (sta->vlan_id)
1991 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
1992 HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
1993
1994 hostapd_free_psk_list(sta->psk);
1995 if (hapd->conf->wpa_psk_radius != PSK_RADIUS_IGNORED) {
1996 sta->psk = *psk;
1997 *psk = NULL;
1998 } else {
1999 sta->psk = NULL;
2000 }
2001
17a8a989 2002 os_free(sta->identity);
53d17144
DL		 2003 sta->identity = *identity;
2004 *identity = NULL;
17a8a989
MB		 2005
2006 os_free(sta->radius_cui);
53d17144
DL		 2007 sta->radius_cui = *radius_cui;
2008 *radius_cui = NULL;
2009
2010 if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
2011 sta->acct_interim_interval = acct_interim_interval;
13f118dc
MB		 2012 if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT) {
2013 sta->session_timeout_set = 1;
2014 os_get_reltime(&sta->session_timeout);
2015 sta->session_timeout.sec += session_timeout;
53d17144 2016 ap_sta_session_timeout(hapd, sta, session_timeout);
13f118dc
MB		 2017 } else {
2018 sta->session_timeout_set = 0;
53d17144 2019 ap_sta_no_session_timeout(hapd, sta);
13f118dc 2020 }
53d17144
DL		 2021
2022 return 0;
2023}
2024
2025
b57e086c 2026static void handle_auth(struct hostapd_data *hapd,
2ea1fce3 2027 const struct ieee80211_mgmt *mgmt, size_t len,
ff9f40ae 2028 int rssi, int from_queue)
6fc6879b
JM		 2029{
2030 u16 auth_alg, auth_transaction, status_code;
2031 u16 resp = WLAN_STATUS_SUCCESS;
2032 struct sta_info *sta = NULL;
bb598c3b 2033 int res, reply_res;
6fc6879b 2034 u16 fc;
b57e086c 2035 const u8 *challenge = NULL;
6fc6879b 2036 u32 session_timeout, acct_interim_interval;
1889af2e 2037 struct vlan_description vlan_id;
2ad3e6c8 2038 struct hostapd_sta_wpa_psk_short *psk = NULL;
6fc6879b
JM		 2039 u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
2040 size_t resp_ies_len = 0;
2092597f
MB		 2041 char *identity = NULL;
2042 char *radius_cui = NULL;
38cb0a2d 2043 u16 seq_ctrl;
6fc6879b
JM		 2044
2045 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
61323e70
JM		 2046 wpa_printf(MSG_INFO, "handle_auth - too short payload (len=%lu)",
2047 (unsigned long) len);
6fc6879b
JM		 2048 return;
2049 }
2050
c2aff6b1 2051#ifdef CONFIG_TESTING_OPTIONS
06df2aa6 2052 if (hapd->iconf->ignore_auth_probability > 0.0 &&
c2aff6b1
JB		 2053 drand48() < hapd->iconf->ignore_auth_probability) {
2054 wpa_printf(MSG_INFO,
2055 "TESTING: ignoring auth frame from " MACSTR,
2056 MAC2STR(mgmt->sa));
2057 return;
2058 }
2059#endif /* CONFIG_TESTING_OPTIONS */
2060
6fc6879b
JM		 2061 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2062 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
2063 status_code = le_to_host16(mgmt->u.auth.status_code);
2064 fc = le_to_host16(mgmt->frame_control);
38cb0a2d 2065 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
6fc6879b
JM		 2066
2067 if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
2068 2 + WLAN_AUTH_CHALLENGE_LEN &&
2069 mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
2070 mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
2071 challenge = &mgmt->u.auth.variable[2];
2072
2073 wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
38cb0a2d 2074 "auth_transaction=%d status_code=%d wep=%d%s "
ff9f40ae 2075 "seq_ctrl=0x%x%s%s",
6fc6879b
JM		 2076 MAC2STR(mgmt->sa), auth_alg, auth_transaction,
2077 status_code, !!(fc & WLAN_FC_ISWEP),
38cb0a2d 2078 challenge ? " challenge" : "",
ff9f40ae
JM		 2079 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "",
2080 from_queue ? " (from queue)" : "");
6fc6879b 2081
7cb53ded
JM		 2082#ifdef CONFIG_NO_RC4
2083 if (auth_alg == WLAN_AUTH_SHARED_KEY) {
2084 wpa_printf(MSG_INFO,
2085 "Unsupported authentication algorithm (%d)",
2086 auth_alg);
2087 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
2088 goto fail;
2089 }
2090#endif /* CONFIG_NO_RC4 */
2091
6fc6879b 2092 if (hapd->tkip_countermeasures) {
e2fc13d0
BG		 2093 wpa_printf(MSG_DEBUG,
2094 "Ongoing TKIP countermeasures (Michael MIC failure) - reject authentication");
fe12ae77 2095 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b
JM		 2096 goto fail;
2097 }
2098
2099 if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
2100 auth_alg == WLAN_AUTH_OPEN) ||
4ec1fd8e 2101#ifdef CONFIG_IEEE80211R_AP
0bf927a0 2102 (hapd->conf->wpa && wpa_key_mgmt_ft(hapd->conf->wpa_key_mgmt) &&
6fc6879b 2103 auth_alg == WLAN_AUTH_FT) ||
4ec1fd8e 2104#endif /* CONFIG_IEEE80211R_AP */
c10347f2
JM		 2105#ifdef CONFIG_SAE
2106 (hapd->conf->wpa && wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
2107 auth_alg == WLAN_AUTH_SAE) ||
2108#endif /* CONFIG_SAE */
c4fd6d8a
JM		 2109#ifdef CONFIG_FILS
2110 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
2111 auth_alg == WLAN_AUTH_FILS_SK) ||
1764559e
JM		 2112 (hapd->conf->wpa && wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt) &&
2113 hapd->conf->fils_dh_group &&
2114 auth_alg == WLAN_AUTH_FILS_SK_PFS) ||
c4fd6d8a 2115#endif /* CONFIG_FILS */
6fc6879b
JM		 2116 ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
2117 auth_alg == WLAN_AUTH_SHARED_KEY))) {
61323e70
JM		 2118 wpa_printf(MSG_INFO, "Unsupported authentication algorithm (%d)",
2119 auth_alg);
6fc6879b
JM		 2120 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
2121 goto fail;
2122 }
2123
c10347f2 2124 if (!(auth_transaction == 1 || auth_alg == WLAN_AUTH_SAE ||
6fc6879b 2125 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
61323e70
JM		 2126 wpa_printf(MSG_INFO, "Unknown authentication transaction number (%d)",
2127 auth_transaction);
6fc6879b
JM		 2128 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
2129 goto fail;
2130 }
2131
2132 if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
61323e70
JM		 2133 wpa_printf(MSG_INFO, "Station " MACSTR " not allowed to authenticate",
2134 MAC2STR(mgmt->sa));
6fc6879b
JM		 2135 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2136 goto fail;
2137 }
2138
0e2412d0
JM		 2139 if (hapd->conf->no_auth_if_seen_on) {
2140 struct hostapd_data *other;
2141
2142 other = sta_track_seen_on(hapd->iface, mgmt->sa,
2143 hapd->conf->no_auth_if_seen_on);
2144 if (other) {
2145 u8 *pos;
2146 u32 info;
2147 u8 op_class, channel, phytype;
2148
2149 wpa_printf(MSG_DEBUG, "%s: Reject authentication from "
2150 MACSTR " since STA has been seen on %s",
2151 hapd->conf->iface, MAC2STR(mgmt->sa),
2152 hapd->conf->no_auth_if_seen_on);
2153
2154 resp = WLAN_STATUS_REJECTED_WITH_SUGGESTED_BSS_TRANSITION;
2155 pos = &resp_ies[0];
2156 *pos++ = WLAN_EID_NEIGHBOR_REPORT;
2157 *pos++ = 13;
2158 os_memcpy(pos, other->own_addr, ETH_ALEN);
2159 pos += ETH_ALEN;
2160 info = 0; /* TODO: BSSID Information */
2161 WPA_PUT_LE32(pos, info);
2162 pos += 4;
2163 if (other->iconf->hw_mode == HOSTAPD_MODE_IEEE80211AD)
2164 phytype = 8; /* dmg */
2165 else if (other->iconf->ieee80211ac)
2166 phytype = 9; /* vht */
2167 else if (other->iconf->ieee80211n)
2168 phytype = 7; /* ht */
2169 else if (other->iconf->hw_mode ==
2170 HOSTAPD_MODE_IEEE80211A)
2171 phytype = 4; /* ofdm */
2172 else if (other->iconf->hw_mode ==
2173 HOSTAPD_MODE_IEEE80211G)
2174 phytype = 6; /* erp */
2175 else
2176 phytype = 5; /* hrdsss */
2177 if (ieee80211_freq_to_channel_ext(
2178 hostapd_hw_get_freq(other,
2179 other->iconf->channel),
2180 other->iconf->secondary_channel,
2181 other->iconf->ieee80211ac,
2182 &op_class, &channel) == NUM_HOSTAPD_MODES) {
2183 op_class = 0;
2184 channel = other->iconf->channel;
2185 }
2186 *pos++ = op_class;
2187 *pos++ = channel;
2188 *pos++ = phytype;
2189 resp_ies_len = pos - &resp_ies[0];
2190 goto fail;
2191 }
2192 }
2193
53d17144
DL		 2194 res = ieee802_11_allowed_address(
2195 hapd, mgmt->sa, (const u8 *) mgmt, len, &session_timeout,
92eb00ae
T		 2196 &acct_interim_interval, &vlan_id, &psk, &identity, &radius_cui,
2197 0);
6fc6879b 2198 if (res == HOSTAPD_ACL_REJECT) {
92eb00ae
T		 2199 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
2200 "Ignore Authentication frame from " MACSTR
2201 " due to ACL reject", MAC2STR(mgmt->sa));
6fc6879b
JM		 2202 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2203 goto fail;
2204 }
53d17144 2205 if (res == HOSTAPD_ACL_PENDING)
6fc6879b 2206 return;
6fc6879b 2207
ff9f40ae 2208#ifdef CONFIG_SAE
5e3a759c
JM		 2209 if (auth_alg == WLAN_AUTH_SAE && !from_queue &&
2210 (auth_transaction == 1 ||
2211 (auth_transaction == 2 && auth_sae_queued_addr(hapd, mgmt->sa)))) {
ff9f40ae
JM		 2212 /* Handle SAE Authentication commit message through a queue to
2213 * provide more control for postponing the needed heavy
5e3a759c
JM		 2214 * processing under a possible DoS attack scenario. In addition,
2215 * queue SAE Authentication confirm message if there happens to
2216 * be a queued commit message from the same peer. This is needed
2217 * to avoid reordering Authentication frames within the same
2218 * SAE exchange. */
2219 auth_sae_queue(hapd, mgmt, len, rssi);
ff9f40ae
JM		 2220 return;
2221 }
2222#endif /* CONFIG_SAE */
2223
38cb0a2d
IP		 2224 sta = ap_get_sta(hapd, mgmt->sa);
2225 if (sta) {
c4fd6d8a 2226 sta->flags &= ~WLAN_STA_PENDING_FILS_ERP;
4cf5efec 2227 sta->ft_over_ds = 0;
38cb0a2d
IP		 2228 if ((fc & WLAN_FC_RETRY) &&
2229 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
2230 sta->last_seq_ctrl == seq_ctrl &&
2231 sta->last_subtype == WLAN_FC_STYPE_AUTH) {
2232 hostapd_logger(hapd, sta->addr,
2233 HOSTAPD_MODULE_IEEE80211,
2234 HOSTAPD_LEVEL_DEBUG,
2235 "Drop repeated authentication frame seq_ctrl=0x%x",
2236 seq_ctrl);
2237 return;
2238 }
09d96de0
MH		 2239#ifdef CONFIG_MESH
2240 if ((hapd->conf->mesh & MESH_ENABLED) &&
2241 sta->plink_state == PLINK_BLOCKED) {
2242 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
2243 " is blocked - drop Authentication frame",
2244 MAC2STR(mgmt->sa));
2245 return;
2246 }
2247#endif /* CONFIG_MESH */
38cb0a2d 2248 } else {
c50d94f1 2249#ifdef CONFIG_MESH
38cb0a2d
IP		 2250 if (hapd->conf->mesh & MESH_ENABLED) {
2251 /* if the mesh peer is not available, we don't do auth.
2252 */
3a322496 2253 wpa_printf(MSG_DEBUG, "Mesh peer " MACSTR
09d96de0 2254 " not yet known - drop Authentication frame",
3a322496
JM		 2255 MAC2STR(mgmt->sa));
2256 /*
2257 * Save a copy of the frame so that it can be processed
2258 * if a new peer entry is added shortly after this.
2259 */
2260 wpabuf_free(hapd->mesh_pending_auth);
2261 hapd->mesh_pending_auth = wpabuf_alloc_copy(mgmt, len);
2262 os_get_reltime(&hapd->mesh_pending_auth_time);
c50d94f1 2263 return;
38cb0a2d 2264 }
c50d94f1 2265#endif /* CONFIG_MESH */
38cb0a2d 2266
c50d94f1
BC		 2267 sta = ap_sta_add(hapd, mgmt->sa);
2268 if (!sta) {
c6b5b9a3 2269 wpa_printf(MSG_DEBUG, "ap_sta_add() failed");
c50d94f1
BC		 2270 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2271 goto fail;
2272 }
6fc6879b 2273 }
38cb0a2d
IP		 2274 sta->last_seq_ctrl = seq_ctrl;
2275 sta->last_subtype = WLAN_FC_STYPE_AUTH;
2ea1fce3
JM		 2276#ifdef CONFIG_MBO
2277 sta->auth_rssi = rssi;
2278#endif /* CONFIG_MBO */
6fc6879b 2279
53d17144
DL		 2280 res = ieee802_11_set_radius_info(
2281 hapd, sta, res, session_timeout, acct_interim_interval,
2282 &vlan_id, &psk, &identity, &radius_cui);
2283 if (res) {
c6b5b9a3 2284 wpa_printf(MSG_DEBUG, "ieee802_11_set_radius_info() failed");
8be640b7
MB		 2285 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2286 goto fail;
6fc6879b 2287 }
2092597f 2288
6fc6879b
JM		 2289 sta->flags &= ~WLAN_STA_PREAUTH;
2290 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
2291
bb598c3b
AB		 2292 /*
2293 * If the driver supports full AP client state, add a station to the
2294 * driver before sending authentication reply to make sure the driver
2295 * has resources, and not to go through the entire authentication and
2296 * association handshake, and fail it at the end.
2297 *
2298 * If this is not the first transaction, in a multi-step authentication
2299 * algorithm, the station already exists in the driver
2300 * (sta->added_unassoc = 1) so skip it.
2301 *
2302 * In mesh mode, the station was already added to the driver when the
2303 * NEW_PEER_CANDIDATE event is received.
2ab09656
JM		 2304 *
2305 * If PMF was negotiated for the existing association, skip this to
2306 * avoid dropping the STA entry and the associated keys. This is needed
2307 * to allow the original connection work until the attempt can complete
2308 * (re)association, so that unprotected Authentication frame cannot be
2309 * used to bypass PMF protection.
bb598c3b
AB		 2310 */
2311 if (FULL_AP_CLIENT_STATE_SUPP(hapd->iface->drv_flags) &&
2ab09656 2312 (!(sta->flags & WLAN_STA_MFP) || !ap_sta_is_authorized(sta)) &&
bb598c3b
AB		 2313 !(hapd->conf->mesh & MESH_ENABLED) &&
2314 !(sta->added_unassoc)) {
2315 /*
2316 * If a station that is already associated to the AP, is trying
2317 * to authenticate again, remove the STA entry, in order to make
2318 * sure the STA PS state gets cleared and configuration gets
2319 * updated. To handle this, station's added_unassoc flag is
2320 * cleared once the station has completed association.
2321 */
b5ebe5dd 2322 ap_sta_set_authorized(hapd, sta, 0);
bb598c3b
AB		 2323 hostapd_drv_sta_remove(hapd, sta->addr);
2324 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH |
2325 WLAN_STA_AUTHORIZED);
2326
d5d156bd
JB		 2327 if (hostapd_sta_add(hapd, sta->addr, 0, 0,
2328 sta->supported_rates,
2329 sta->supported_rates_len,
2330 0, NULL, NULL, NULL, 0,
78d35b16 2331 sta->flags, 0, 0, 0, 0)) {
bb598c3b
AB		 2332 hostapd_logger(hapd, sta->addr,
2333 HOSTAPD_MODULE_IEEE80211,
2334 HOSTAPD_LEVEL_NOTICE,
2335 "Could not add STA to kernel driver");
2336 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
2337 goto fail;
2338 }
2339
2340 sta->added_unassoc = 1;
2341 }
2342
6fc6879b
JM		 2343 switch (auth_alg) {
2344 case WLAN_AUTH_OPEN:
2345 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2346 HOSTAPD_LEVEL_DEBUG,
2347 "authentication OK (open system)");
6fc6879b
JM		 2348 sta->flags |= WLAN_STA_AUTH;
2349 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
2350 sta->auth_alg = WLAN_AUTH_OPEN;
2351 mlme_authenticate_indication(hapd, sta);
6fc6879b 2352 break;
7cb53ded 2353#ifndef CONFIG_NO_RC4
6fc6879b
JM		 2354 case WLAN_AUTH_SHARED_KEY:
2355 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
2356 fc & WLAN_FC_ISWEP);
c6b5b9a3
BG		 2357 if (resp != 0)
2358 wpa_printf(MSG_DEBUG,
2359 "auth_shared_key() failed: status=%d", resp);
6fc6879b
JM		 2360 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
2361 mlme_authenticate_indication(hapd, sta);
2362 if (sta->challenge && auth_transaction == 1) {
2363 resp_ies[0] = WLAN_EID_CHALLENGE;
2364 resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
2365 os_memcpy(resp_ies + 2, sta->challenge,
2366 WLAN_AUTH_CHALLENGE_LEN);
2367 resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
2368 }
2369 break;
7cb53ded 2370#endif /* CONFIG_NO_RC4 */
4ec1fd8e 2371#ifdef CONFIG_IEEE80211R_AP
6fc6879b
JM		 2372 case WLAN_AUTH_FT:
2373 sta->auth_alg = WLAN_AUTH_FT;
2374 if (sta->wpa_sm == NULL)
2375 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
94ddef3e 2376 sta->addr, NULL);
6fc6879b
JM		 2377 if (sta->wpa_sm == NULL) {
2378 wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
2379 "state machine");
2380 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2381 goto fail;
2382 }
2383 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
2384 auth_transaction, mgmt->u.auth.variable,
2385 len - IEEE80211_HDRLEN -
2386 sizeof(mgmt->u.auth),
2387 handle_auth_ft_finish, hapd);
2388 /* handle_auth_ft_finish() callback will complete auth. */
2389 return;
4ec1fd8e 2390#endif /* CONFIG_IEEE80211R_AP */
c10347f2
JM		 2391#ifdef CONFIG_SAE
2392 case WLAN_AUTH_SAE:
c50d94f1 2393#ifdef CONFIG_MESH
afa2ffb4
JM		 2394 if (status_code == WLAN_STATUS_SUCCESS &&
2395 hapd->conf->mesh & MESH_ENABLED) {
c50d94f1
BC		 2396 if (sta->wpa_sm == NULL)
2397 sta->wpa_sm =
2398 wpa_auth_sta_init(hapd->wpa_auth,
2399 sta->addr, NULL);
2400 if (sta->wpa_sm == NULL) {
2401 wpa_printf(MSG_DEBUG,
2402 "SAE: Failed to initialize WPA state machine");
2403 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
2404 goto fail;
2405 }
2406 }
2407#endif /* CONFIG_MESH */
afa2ffb4
JM		 2408 handle_auth_sae(hapd, sta, mgmt, len, auth_transaction,
2409 status_code);
c10347f2
JM		 2410 return;
2411#endif /* CONFIG_SAE */
c4fd6d8a
JM		 2412#ifdef CONFIG_FILS
2413 case WLAN_AUTH_FILS_SK:
1764559e 2414 case WLAN_AUTH_FILS_SK_PFS:
b8a3453a
JM		 2415 handle_auth_fils(hapd, sta, mgmt->u.auth.variable,
2416 len - IEEE80211_HDRLEN - sizeof(mgmt->u.auth),
5cee22ca
JM		 2417 auth_alg, auth_transaction, status_code,
2418 handle_auth_fils_finish);
c4fd6d8a
JM		 2419 return;
2420#endif /* CONFIG_FILS */
6fc6879b
JM		 2421 }
2422
2423 fail:
2092597f
MB		 2424 os_free(identity);
2425 os_free(radius_cui);
f2a14be7 2426 hostapd_free_psk_list(psk);
2092597f 2427
bb598c3b
AB		 2428 reply_res = send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
2429 auth_transaction + 1, resp, resp_ies,
e7525a29 2430 resp_ies_len, "handle-auth");
bb598c3b
AB		 2431
2432 if (sta && sta->added_unassoc && (resp != WLAN_STATUS_SUCCESS ||
2433 reply_res != WLAN_STATUS_SUCCESS)) {
2434 hostapd_drv_sta_remove(hapd, sta->addr);
2435 sta->added_unassoc = 0;
2436 }
6fc6879b
JM		 2437}
2438
2439
681753f2 2440int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
d42a62b3 2441{
2991469c
JM		 2442 int i, j = 32, aid;
2443
d42a62b3
JM		 2444 /* get a unique AID */
2445 if (sta->aid > 0) {
2446 wpa_printf(MSG_DEBUG, " old AID %d", sta->aid);
2447 return 0;
2448 }
2449
d7358113
JM		 2450 if (TEST_FAIL())
2451 return -1;
2452
2991469c
JM		 2453 for (i = 0; i < AID_WORDS; i++) {
2454 if (hapd->sta_aid[i] == (u32) -1)
2455 continue;
2456 for (j = 0; j < 32; j++) {
2457 if (!(hapd->sta_aid[i] & BIT(j)))
2458 break;
2459 }
2460 if (j < 32)
d42a62b3 2461 break;
d42a62b3 2462 }
2991469c
JM		 2463 if (j == 32)
2464 return -1;
2465 aid = i * 32 + j + 1;
2466 if (aid > 2007)
2467 return -1;
d42a62b3 2468
2991469c
JM		 2469 sta->aid = aid;
2470 hapd->sta_aid[i] |= BIT(j);
d42a62b3
JM		 2471 wpa_printf(MSG_DEBUG, " new AID %d", sta->aid);
2472 return 0;
2473}
2474
2475
5586f500
JM		 2476static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
2477 const u8 *ssid_ie, size_t ssid_ie_len)
6fc6879b 2478{
5586f500
JM		 2479 if (ssid_ie == NULL)
2480 return WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b 2481
5586f500
JM		 2482 if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
2483 os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
5586f500
JM		 2484 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2485 HOSTAPD_LEVEL_INFO,
2486 "Station tried to associate with unknown SSID "
b37d582e 2487 "'%s'", wpa_ssid_txt(ssid_ie, ssid_ie_len));
5586f500 2488 return WLAN_STATUS_UNSPECIFIED_FAILURE;
b0194fe0
JM		 2489 }
2490
5586f500
JM		 2491 return WLAN_STATUS_SUCCESS;
2492}
6fc6879b 2493
6fc6879b 2494
5586f500
JM		 2495static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
2496 const u8 *wmm_ie, size_t wmm_ie_len)
2497{
3ae0800c 2498 sta->flags &= ~WLAN_STA_WMM;
5d061637 2499 sta->qosinfo = 0;
5586f500 2500 if (wmm_ie && hapd->conf->wmm_enabled) {
5f32f79c 2501 struct wmm_information_element *wmm;
5f32f79c 2502
c84b868a 2503 if (!hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len)) {
6fc6879b
JM		 2504 hostapd_logger(hapd, sta->addr,
2505 HOSTAPD_MODULE_WPA,
2506 HOSTAPD_LEVEL_DEBUG,
3ae0800c 2507 "invalid WMM element in association "
6fc6879b 2508 "request");
5f32f79c
EP		 2509 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2510 }
2511
2512 sta->flags |= WLAN_STA_WMM;
2513 wmm = (struct wmm_information_element *) wmm_ie;
5d061637 2514 sta->qosinfo = wmm->qos_info;
6fc6879b 2515 }
5586f500
JM		 2516 return WLAN_STATUS_SUCCESS;
2517}
6fc6879b 2518
9c06f0f6
VN		 2519static u16 check_multi_ap(struct hostapd_data *hapd, struct sta_info *sta,
2520 const u8 *multi_ap_ie, size_t multi_ap_len)
2521{
2522 u8 multi_ap_value = 0;
2523
2524 sta->flags &= ~WLAN_STA_MULTI_AP;
2525
2526 if (!hapd->conf->multi_ap)
2527 return WLAN_STATUS_SUCCESS;
2528
2529 if (multi_ap_ie) {
2530 const u8 *multi_ap_subelem;
2531
2532 multi_ap_subelem = get_ie(multi_ap_ie + 4,
2533 multi_ap_len - 4,
2534 MULTI_AP_SUB_ELEM_TYPE);
2535 if (multi_ap_subelem && multi_ap_subelem[1] == 1) {
2536 multi_ap_value = multi_ap_subelem[2];
2537 } else {
2538 hostapd_logger(hapd, sta->addr,
2539 HOSTAPD_MODULE_IEEE80211,
2540 HOSTAPD_LEVEL_INFO,
2541 "Multi-AP IE has missing or invalid Multi-AP subelement");
2542 return WLAN_STATUS_INVALID_IE;
2543 }
2544 }
2545
bfcdac1c
AVEM		 2546 if (multi_ap_value && multi_ap_value != MULTI_AP_BACKHAUL_STA)
2547 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2548 HOSTAPD_LEVEL_INFO,
2549 "Multi-AP IE with unexpected value 0x%02x",
2550 multi_ap_value);
9c06f0f6 2551
bfcdac1c
AVEM		 2552 if (!(multi_ap_value & MULTI_AP_BACKHAUL_STA)) {
2553 if (hapd->conf->multi_ap & FRONTHAUL_BSS)
2554 return WLAN_STATUS_SUCCESS;
9c06f0f6 2555
bfcdac1c
AVEM		 2556 hostapd_logger(hapd, sta->addr,
2557 HOSTAPD_MODULE_IEEE80211,
2558 HOSTAPD_LEVEL_INFO,
2559 "Non-Multi-AP STA tries to associate with backhaul-only BSS");
2560 return WLAN_STATUS_ASSOC_DENIED_UNSPEC;
9c06f0f6
VN		 2561 }
2562
bfcdac1c
AVEM		 2563 if (!(hapd->conf->multi_ap & BACKHAUL_BSS))
2564 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2565 HOSTAPD_LEVEL_DEBUG,
2566 "Backhaul STA tries to associate with fronthaul-only BSS");
2567
2568 sta->flags |= WLAN_STA_MULTI_AP;
2569 return WLAN_STATUS_SUCCESS;
9c06f0f6
VN		 2570}
2571
5586f500
JM		 2572
2573static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
2574 struct ieee802_11_elems *elems)
2575{
0c4b9025
DL		 2576 /* Supported rates not used in IEEE 802.11ad/DMG */
2577 if (hapd->iface->current_mode &&
2578 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD)
2579 return WLAN_STATUS_SUCCESS;
2580
5586f500
JM		 2581 if (!elems->supp_rates) {
2582 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
6fc6879b
JM		 2583 HOSTAPD_LEVEL_DEBUG,
2584 "No supported rates element in AssocReq");
5586f500 2585 return WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b
JM		 2586 }
2587
3489cfb0
JM		 2588 if (elems->supp_rates_len + elems->ext_supp_rates_len >
2589 sizeof(sta->supported_rates)) {
5586f500 2590 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
6fc6879b 2591 HOSTAPD_LEVEL_DEBUG,
3489cfb0
JM		 2592 "Invalid supported rates element length %d+%d",
2593 elems->supp_rates_len,
2594 elems->ext_supp_rates_len);
5586f500 2595 return WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b
JM		 2596 }
2597
3489cfb0
JM		 2598 sta->supported_rates_len = merge_byte_arrays(
2599 sta->supported_rates, sizeof(sta->supported_rates),
2600 elems->supp_rates, elems->supp_rates_len,
2601 elems->ext_supp_rates, elems->ext_supp_rates_len);
6fc6879b 2602
5586f500
JM		 2603 return WLAN_STATUS_SUCCESS;
2604}
2605
2606
c551700f
KP		 2607static u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
2608 const u8 *ext_capab_ie, size_t ext_capab_ie_len)
2609{
2610#ifdef CONFIG_INTERWORKING
2611 /* check for QoS Map support */
2612 if (ext_capab_ie_len >= 5) {
2613 if (ext_capab_ie[4] & 0x01)
2614 sta->qos_map_enabled = 1;
2615 }
2616#endif /* CONFIG_INTERWORKING */
2617
65f9db6b 2618 if (ext_capab_ie_len > 0) {
98b05081 2619 sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
65f9db6b 2620 os_free(sta->ext_capability);
2621 sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
2622 if (sta->ext_capability) {
2623 sta->ext_capability[0] = ext_capab_ie_len;
2624 os_memcpy(sta->ext_capability + 1, ext_capab_ie,
2625 ext_capab_ie_len);
2626 }
2627 }
98b05081 2628
c551700f
KP		 2629 return WLAN_STATUS_SUCCESS;
2630}
2631
2632
09368515 2633#ifdef CONFIG_OWE
91cc34bf
JM		 2634
2635static int owe_group_supported(struct hostapd_data *hapd, u16 group)
2636{
2637 int i;
2638 int *groups = hapd->conf->owe_groups;
2639
2640 if (group != 19 && group != 20 && group != 21)
2641 return 0;
2642
2643 if (!groups)
2644 return 1;
2645
2646 for (i = 0; groups[i] > 0; i++) {
2647 if (groups[i] == group)
2648 return 1;
2649 }
2650
2651 return 0;
2652}
2653
2654
d90f10fa
JM		 2655static u16 owe_process_assoc_req(struct hostapd_data *hapd,
2656 struct sta_info *sta, const u8 *owe_dh,
09368515
JM		 2657 u8 owe_dh_len)
2658{
2659 struct wpabuf *secret, *pub, *hkey;
2660 int res;
7a12edd1 2661 u8 prk[SHA512_MAC_LEN], pmkid[SHA512_MAC_LEN];
09368515
JM		 2662 const char *info = "OWE Key Generation";
2663 const u8 *addr[2];
2664 size_t len[2];
7a12edd1
JM		 2665 u16 group;
2666 size_t hash_len, prime_len;
2667
d90f10fa
JM		 2668 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
2669 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
2670 return WLAN_STATUS_SUCCESS;
2671 }
2672
7a12edd1 2673 group = WPA_GET_LE16(owe_dh);
91cc34bf
JM		 2674 if (!owe_group_supported(hapd, group)) {
2675 wpa_printf(MSG_DEBUG, "OWE: Unsupported DH group %u", group);
2676 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2677 }
7a12edd1
JM		 2678 if (group == 19)
2679 prime_len = 32;
2680 else if (group == 20)
2681 prime_len = 48;
2682 else if (group == 21)
2683 prime_len = 66;
2684 else
09368515
JM		 2685 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
2686
2687 crypto_ecdh_deinit(sta->owe_ecdh);
7a12edd1 2688 sta->owe_ecdh = crypto_ecdh_init(group);
09368515
JM		 2689 if (!sta->owe_ecdh)
2690 return WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED;
7a12edd1 2691 sta->owe_group = group;
09368515
JM		 2692
2693 secret = crypto_ecdh_set_peerkey(sta->owe_ecdh, 0, owe_dh + 2,
2694 owe_dh_len - 2);
7a12edd1 2695 secret = wpabuf_zeropad(secret, prime_len);
09368515
JM		 2696 if (!secret) {
2697 wpa_printf(MSG_DEBUG, "OWE: Invalid peer DH public key");
2698 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2699 }
2700 wpa_hexdump_buf_key(MSG_DEBUG, "OWE: DH shared secret", secret);
2701
2702 /* prk = HKDF-extract(C | A | group, z) */
2703
2704 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
2705 if (!pub) {
2706 wpabuf_clear_free(secret);
2707 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2708 }
2709
2710 /* PMKID = Truncate-128(Hash(C | A)) */
2711 addr[0] = owe_dh + 2;
2712 len[0] = owe_dh_len - 2;
2713 addr[1] = wpabuf_head(pub);
2714 len[1] = wpabuf_len(pub);
7a12edd1
JM		 2715 if (group == 19) {
2716 res = sha256_vector(2, addr, len, pmkid);
2717 hash_len = SHA256_MAC_LEN;
2718 } else if (group == 20) {
2719 res = sha384_vector(2, addr, len, pmkid);
2720 hash_len = SHA384_MAC_LEN;
2721 } else if (group == 21) {
2722 res = sha512_vector(2, addr, len, pmkid);
2723 hash_len = SHA512_MAC_LEN;
2724 } else {
2725 wpabuf_free(pub);
2726 wpabuf_clear_free(secret);
2727 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2728 }
2729 pub = wpabuf_zeropad(pub, prime_len);
2730 if (res < 0 || !pub) {
09368515
JM		 2731 wpabuf_free(pub);
2732 wpabuf_clear_free(secret);
2733 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2734 }
2735
2736 hkey = wpabuf_alloc(owe_dh_len - 2 + wpabuf_len(pub) + 2);
2737 if (!hkey) {
2738 wpabuf_free(pub);
2739 wpabuf_clear_free(secret);
2740 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2741 }
2742
2743 wpabuf_put_data(hkey, owe_dh + 2, owe_dh_len - 2); /* C */
2744 wpabuf_put_buf(hkey, pub); /* A */
2745 wpabuf_free(pub);
7a12edd1
JM		 2746 wpabuf_put_le16(hkey, group); /* group */
2747 if (group == 19)
2748 res = hmac_sha256(wpabuf_head(hkey), wpabuf_len(hkey),
2749 wpabuf_head(secret), wpabuf_len(secret), prk);
2750 else if (group == 20)
2751 res = hmac_sha384(wpabuf_head(hkey), wpabuf_len(hkey),
2752 wpabuf_head(secret), wpabuf_len(secret), prk);
2753 else if (group == 21)
2754 res = hmac_sha512(wpabuf_head(hkey), wpabuf_len(hkey),
2755 wpabuf_head(secret), wpabuf_len(secret), prk);
09368515
JM		 2756 wpabuf_clear_free(hkey);
2757 wpabuf_clear_free(secret);
2758 if (res < 0)
2759 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2760
7a12edd1 2761 wpa_hexdump_key(MSG_DEBUG, "OWE: prk", prk, hash_len);
09368515
JM		 2762
2763 /* PMK = HKDF-expand(prk, "OWE Key Generation", n) */
2764
2765 os_free(sta->owe_pmk);
7a12edd1 2766 sta->owe_pmk = os_malloc(hash_len);
09368515 2767 if (!sta->owe_pmk) {
7a12edd1 2768 os_memset(prk, 0, SHA512_MAC_LEN);
09368515
JM		 2769 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2770 }
2771
7a12edd1
JM		 2772 if (group == 19)
2773 res = hmac_sha256_kdf(prk, hash_len, NULL, (const u8 *) info,
2774 os_strlen(info), sta->owe_pmk, hash_len);
2775 else if (group == 20)
2776 res = hmac_sha384_kdf(prk, hash_len, NULL, (const u8 *) info,
2777 os_strlen(info), sta->owe_pmk, hash_len);
2778 else if (group == 21)
2779 res = hmac_sha512_kdf(prk, hash_len, NULL, (const u8 *) info,
2780 os_strlen(info), sta->owe_pmk, hash_len);
2781 os_memset(prk, 0, SHA512_MAC_LEN);
09368515
JM		 2782 if (res < 0) {
2783 os_free(sta->owe_pmk);
2784 sta->owe_pmk = NULL;
2785 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2786 }
7a12edd1 2787 sta->owe_pmk_len = hash_len;
09368515 2788
7a12edd1 2789 wpa_hexdump_key(MSG_DEBUG, "OWE: PMK", sta->owe_pmk, sta->owe_pmk_len);
09368515 2790 wpa_hexdump(MSG_DEBUG, "OWE: PMKID", pmkid, PMKID_LEN);
d90f10fa
JM		 2791 wpa_auth_pmksa_add2(hapd->wpa_auth, sta->addr, sta->owe_pmk,
2792 sta->owe_pmk_len, pmkid, 0, WPA_KEY_MGMT_OWE);
09368515
JM		 2793
2794 return WLAN_STATUS_SUCCESS;
2795}
91cc34bf 2796
09368515
JM		 2797#endif /* CONFIG_OWE */
2798
2799
5586f500 2800static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
b57e086c 2801 const u8 *ies, size_t ies_len, int reassoc)
5586f500
JM		 2802{
2803 struct ieee802_11_elems elems;
2804 u16 resp;
ba091c06 2805 const u8 *wpa_ie;
5586f500 2806 size_t wpa_ie_len;
94ddef3e 2807 const u8 *p2p_dev_addr = NULL;
5586f500
JM		 2808
2809 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
2810 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2811 HOSTAPD_LEVEL_INFO, "Station sent an invalid "
2812 "association request");
2813 return WLAN_STATUS_UNSPECIFIED_FAILURE;
2814 }
2815
2816 resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
2817 if (resp != WLAN_STATUS_SUCCESS)
2818 return resp;
2819 resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
c551700f
KP		 2820 if (resp != WLAN_STATUS_SUCCESS)
2821 return resp;
2822 resp = check_ext_capab(hapd, sta, elems.ext_capab, elems.ext_capab_len);
5586f500
JM		 2823 if (resp != WLAN_STATUS_SUCCESS)
2824 return resp;
2825 resp = copy_supp_rates(hapd, sta, &elems);
2826 if (resp != WLAN_STATUS_SUCCESS)
2827 return resp;
9c06f0f6
VN		 2828
2829 resp = check_multi_ap(hapd, sta, elems.multi_ap, elems.multi_ap_len);
2830 if (resp != WLAN_STATUS_SUCCESS)
2831 return resp;
2832
d45354be 2833#ifdef CONFIG_IEEE80211N
baae4cb9 2834 resp = copy_sta_ht_capab(hapd, sta, elems.ht_capabilities);
5586f500
JM		 2835 if (resp != WLAN_STATUS_SUCCESS)
2836 return resp;
29448243
JM		 2837 if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
2838 !(sta->flags & WLAN_STA_HT)) {
2839 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2840 HOSTAPD_LEVEL_INFO, "Station does not support "
2841 "mandatory HT PHY - reject association");
2842 return WLAN_STATUS_ASSOC_DENIED_NO_HT;
2843 }
d45354be 2844#endif /* CONFIG_IEEE80211N */
5586f500 2845
de3cdf35 2846#ifdef CONFIG_IEEE80211AC
28ffd21c
ARN		 2847 if (hapd->iconf->ieee80211ac) {
2848 resp = copy_sta_vht_capab(hapd, sta, elems.vht_capabilities);
2849 if (resp != WLAN_STATUS_SUCCESS)
2850 return resp;
8a458116 2851
28ffd21c
ARN		 2852 resp = set_sta_vht_opmode(hapd, sta, elems.vht_opmode_notif);
2853 if (resp != WLAN_STATUS_SUCCESS)
2854 return resp;
2855 }
8a458116 2856
140e850a
MP		 2857 if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
2858 !(sta->flags & WLAN_STA_VHT)) {
2859 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2860 HOSTAPD_LEVEL_INFO, "Station does not support "
2861 "mandatory VHT PHY - reject association");
13b24a76 2862 return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
140e850a 2863 }
e7d0e97b
YL		 2864
2865 if (hapd->conf->vendor_vht && !elems.vht_capabilities) {
2866 resp = copy_sta_vendor_vht(hapd, sta, elems.vendor_vht,
2867 elems.vendor_vht_len);
2868 if (resp != WLAN_STATUS_SUCCESS)
2869 return resp;
2870 }
de3cdf35 2871#endif /* CONFIG_IEEE80211AC */
78d35b16
JC		 2872#ifdef CONFIG_IEEE80211AX
2873 if (hapd->iconf->ieee80211ax) {
2874 resp = copy_sta_he_capab(hapd, sta, elems.he_capabilities,
2875 elems.he_capabilities_len);
2876 if (resp != WLAN_STATUS_SUCCESS)
2877 return resp;
2878 }
2879#endif /* CONFIG_IEEE80211AX */
de3cdf35 2880
94ddef3e
JM		 2881#ifdef CONFIG_P2P
2882 if (elems.p2p) {
2883 wpabuf_free(sta->p2p_ie);
2884 sta->p2p_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2885 P2P_IE_VENDOR_TYPE);
2886 if (sta->p2p_ie)
2887 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
2888 } else {
2889 wpabuf_free(sta->p2p_ie);
2890 sta->p2p_ie = NULL;
2891 }
2892#endif /* CONFIG_P2P */
2893
6fc6879b
JM		 2894 if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
2895 wpa_ie = elems.rsn_ie;
2896 wpa_ie_len = elems.rsn_ie_len;
2897 } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
2898 elems.wpa_ie) {
2899 wpa_ie = elems.wpa_ie;
2900 wpa_ie_len = elems.wpa_ie_len;
2901 } else {
2902 wpa_ie = NULL;
2903 wpa_ie_len = 0;
2904 }
5586f500 2905
ad08c363 2906#ifdef CONFIG_WPS
17f6b900 2907 sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS | WLAN_STA_WPS2);
c47cf42e
JM		 2908 if (hapd->conf->wps_state && elems.wps_ie) {
2909 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
2910 "Request - assume WPS is used");
2911 sta->flags |= WLAN_STA_WPS;
2912 wpabuf_free(sta->wps_ie);
16e46ec0
JM		 2913 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
2914 WPS_IE_VENDOR_TYPE);
17f6b900
JM		 2915 if (sta->wps_ie && wps_is_20(sta->wps_ie)) {
2916 wpa_printf(MSG_DEBUG, "WPS: STA supports WPS 2.0");
2917 sta->flags |= WLAN_STA_WPS2;
2918 }
c47cf42e
JM		 2919 wpa_ie = NULL;
2920 wpa_ie_len = 0;
54f489be
JM		 2921 if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
2922 wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
2923 "(Re)Association Request - reject");
2924 return WLAN_STATUS_INVALID_IE;
2925 }
c47cf42e
JM		 2926 } else if (hapd->conf->wps_state && wpa_ie == NULL) {
2927 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
2928 "(Re)Association Request - possible WPS use");
2929 sta->flags |= WLAN_STA_MAYBE_WPS;
ad08c363
JM		 2930 } else
2931#endif /* CONFIG_WPS */
6fc6879b 2932 if (hapd->conf->wpa && wpa_ie == NULL) {
5586f500
JM		 2933 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
2934 HOSTAPD_LEVEL_INFO,
2935 "No WPA/RSN IE in association request");
2936 return WLAN_STATUS_INVALID_IE;
6fc6879b
JM		 2937 }
2938
2939 if (hapd->conf->wpa && wpa_ie) {
2940 int res;
2941 wpa_ie -= 2;
2942 wpa_ie_len += 2;
2943 if (sta->wpa_sm == NULL)
2944 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
94ddef3e
JM		 2945 sta->addr,
2946 p2p_dev_addr);
6fc6879b 2947 if (sta->wpa_sm == NULL) {
5586f500
JM		 2948 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
2949 "state machine");
2950 return WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b 2951 }
36536639 2952 wpa_auth_set_auth_alg(sta->wpa_sm, sta->auth_alg);
6fc6879b 2953 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
2c129a1b 2954 hapd->iface->freq,
6fc6879b 2955 wpa_ie, wpa_ie_len,
09368515
JM		 2956 elems.mdie, elems.mdie_len,
2957 elems.owe_dh, elems.owe_dh_len);
ffb62f22 2958 resp = wpa_res_to_status_code(res);
6fc6879b 2959 if (resp != WLAN_STATUS_SUCCESS)
5586f500 2960 return resp;
f3f7540e 2961#ifdef CONFIG_IEEE80211W
edb28006
AK		 2962 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_MFP)) ==
2963 (WLAN_STA_ASSOC | WLAN_STA_MFP) &&
2964 !sta->sa_query_timed_out &&
45c94154
JM		 2965 sta->sa_query_count > 0)
2966 ap_check_sa_query_timeout(hapd, sta);
edb28006
AK		 2967 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_MFP)) ==
2968 (WLAN_STA_ASSOC | WLAN_STA_MFP) &&
2969 !sta->sa_query_timed_out &&
8f4617c6 2970 (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
5d22a1d5 2971 /*
93b76319
JM		 2972 * STA has already been associated with MFP and SA
2973 * Query timeout has not been reached. Reject the
2974 * association attempt temporarily and start SA Query,
2975 * if one is not pending.
5d22a1d5
JM		 2976 */
2977
93b76319
JM		 2978 if (sta->sa_query_count == 0)
2979 ap_sta_start_sa_query(hapd, sta);
5d22a1d5 2980
5586f500 2981 return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
5d22a1d5
JM		 2982 }
2983
f3f7540e
JM		 2984 if (wpa_auth_uses_mfp(sta->wpa_sm))
2985 sta->flags |= WLAN_STA_MFP;
2986 else
2987 sta->flags &= ~WLAN_STA_MFP;
2988#endif /* CONFIG_IEEE80211W */
6fc6879b 2989
4ec1fd8e 2990#ifdef CONFIG_IEEE80211R_AP
6fc6879b
JM		 2991 if (sta->auth_alg == WLAN_AUTH_FT) {
2992 if (!reassoc) {
2993 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
2994 "to use association (not "
2995 "re-association) with FT auth_alg",
2996 MAC2STR(sta->addr));
5586f500 2997 return WLAN_STATUS_UNSPECIFIED_FAILURE;
6fc6879b
JM		 2998 }
2999
5586f500
JM		 3000 resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
3001 ies_len);
6fc6879b 3002 if (resp != WLAN_STATUS_SUCCESS)
5586f500 3003 return resp;
6fc6879b 3004 }
4ec1fd8e 3005#endif /* CONFIG_IEEE80211R_AP */
5586f500 3006
c10347f2 3007#ifdef CONFIG_SAE
9d94e4bb
JM		 3008 if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae &&
3009 sta->sae->state == SAE_ACCEPTED)
3010 wpa_auth_add_sae_pmkid(sta->wpa_sm, sta->sae->pmkid);
3011
c10347f2 3012 if (wpa_auth_uses_sae(sta->wpa_sm) &&
f2991170
JM		 3013 sta->auth_alg == WLAN_AUTH_OPEN) {
3014 struct rsn_pmksa_cache_entry *sa;
3015 sa = wpa_auth_sta_get_pmksa(sta->wpa_sm);
3016 if (!sa || sa->akmp != WPA_KEY_MGMT_SAE) {
3017 wpa_printf(MSG_DEBUG,
3018 "SAE: No PMKSA cache entry found for "
3019 MACSTR, MAC2STR(sta->addr));
3020 return WLAN_STATUS_INVALID_PMKID;
3021 }
3022 wpa_printf(MSG_DEBUG, "SAE: " MACSTR
3023 " using PMKSA caching", MAC2STR(sta->addr));
3024 } else if (wpa_auth_uses_sae(sta->wpa_sm) &&
3025 sta->auth_alg != WLAN_AUTH_SAE &&
3026 !(sta->auth_alg == WLAN_AUTH_FT &&
3027 wpa_auth_uses_ft_sae(sta->wpa_sm))) {
c10347f2
JM		 3028 wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
3029 "SAE AKM after non-SAE auth_alg %u",
3030 MAC2STR(sta->addr), sta->auth_alg);
3031 return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
3032 }
3033#endif /* CONFIG_SAE */
3034
09368515
JM		 3035#ifdef CONFIG_OWE
3036 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
3037 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE &&
3038 elems.owe_dh) {
d90f10fa 3039 resp = owe_process_assoc_req(hapd, sta, elems.owe_dh,
09368515
JM		 3040 elems.owe_dh_len);
3041 if (resp != WLAN_STATUS_SUCCESS)
3042 return resp;
3043 }
3044#endif /* CONFIG_OWE */
3045
10ec6a5f
JM		 3046#ifdef CONFIG_DPP2
3047 dpp_pfs_free(sta->dpp_pfs);
3048 sta->dpp_pfs = NULL;
3049
3050 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) &&
3051 hapd->conf->dpp_netaccesskey && sta->wpa_sm &&
3052 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_DPP &&
3053 elems.owe_dh) {
3054 sta->dpp_pfs = dpp_pfs_init(
3055 wpabuf_head(hapd->conf->dpp_netaccesskey),
3056 wpabuf_len(hapd->conf->dpp_netaccesskey));
3057 if (!sta->dpp_pfs) {
3058 wpa_printf(MSG_DEBUG,
3059 "DPP: Could not initialize PFS");
3060 /* Try to continue without PFS */
3061 goto pfs_fail;
3062 }
3063
3064 if (dpp_pfs_process(sta->dpp_pfs, elems.owe_dh,
3065 elems.owe_dh_len) < 0) {
3066 dpp_pfs_free(sta->dpp_pfs);
3067 sta->dpp_pfs = NULL;
3068 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3069 }
3070 }
3071
3072 wpa_auth_set_dpp_z(sta->wpa_sm, sta->dpp_pfs ?
3073 sta->dpp_pfs->secret : NULL);
3074 pfs_fail:
3075#endif /* CONFIG_DPP2 */
3076
ff36ff00 3077#ifdef CONFIG_IEEE80211N
f0c7a986 3078 if ((sta->flags & (WLAN_STA_HT | WLAN_STA_VHT)) &&
ff36ff00 3079 wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
5586f500
JM		 3080 hostapd_logger(hapd, sta->addr,
3081 HOSTAPD_MODULE_IEEE80211,
3082 HOSTAPD_LEVEL_INFO,
3083 "Station tried to use TKIP with HT "
3084 "association");
3085 return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
ff36ff00
JM		 3086 }
3087#endif /* CONFIG_IEEE80211N */
a14896e8
JM		 3088#ifdef CONFIG_HS20
3089 } else if (hapd->conf->osen) {
3090 if (elems.osen == NULL) {
3091 hostapd_logger(
3092 hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3093 HOSTAPD_LEVEL_INFO,
3094 "No HS 2.0 OSEN element in association request");
3095 return WLAN_STATUS_INVALID_IE;
3096 }
3097
3098 wpa_printf(MSG_DEBUG, "HS 2.0: OSEN association");
3099 if (sta->wpa_sm == NULL)
3100 sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
3101 sta->addr, NULL);
3102 if (sta->wpa_sm == NULL) {
3103 wpa_printf(MSG_WARNING, "Failed to initialize WPA "
3104 "state machine");
3105 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3106 }
3107 if (wpa_validate_osen(hapd->wpa_auth, sta->wpa_sm,
3108 elems.osen - 2, elems.osen_len + 2) < 0)
3109 return WLAN_STATUS_INVALID_IE;
3110#endif /* CONFIG_HS20 */
a8d05fca
JM		 3111 } else
3112 wpa_auth_sta_no_wpa(sta->wpa_sm);
6fc6879b 3113
b305c684 3114#ifdef CONFIG_P2P
3f4ce13f 3115 p2p_group_notif_assoc(hapd->p2p_group, sta->addr, ies, ies_len);
b305c684
JM		 3116#endif /* CONFIG_P2P */
3117
f403dcd6
JM		 3118#ifdef CONFIG_HS20
3119 wpabuf_free(sta->hs20_ie);
3120 if (elems.hs20 && elems.hs20_len > 4) {
f3784a6b
JM		 3121 int release;
3122
f403dcd6
JM		 3123 sta->hs20_ie = wpabuf_alloc_copy(elems.hs20 + 4,
3124 elems.hs20_len - 4);
f3784a6b
JM		 3125 release = ((elems.hs20[4] >> 4) & 0x0f) + 1;
3126 if (release >= 2 && !wpa_auth_uses_mfp(sta->wpa_sm)) {
3127 wpa_printf(MSG_DEBUG,
3128 "HS 2.0: PMF not negotiated by release %d station "
3129 MACSTR, release, MAC2STR(sta->addr));
3130 return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
3131 }
3132 } else {
f403dcd6 3133 sta->hs20_ie = NULL;
f3784a6b 3134 }
67cca346
JM		 3135
3136 wpabuf_free(sta->roaming_consortium);
3137 if (elems.roaming_cons_sel)
3138 sta->roaming_consortium = wpabuf_alloc_copy(
3139 elems.roaming_cons_sel + 4,
3140 elems.roaming_cons_sel_len - 4);
3141 else
3142 sta->roaming_consortium = NULL;
f403dcd6
JM		 3143#endif /* CONFIG_HS20 */
3144
ae667c08
AN		 3145#ifdef CONFIG_FST
3146 wpabuf_free(sta->mb_ies);
3147 if (hapd->iface->fst)
3148 sta->mb_ies = mb_ies_by_info(&elems.mb_ies);
3149 else
3150 sta->mb_ies = NULL;
3151#endif /* CONFIG_FST */
3152
4c572281 3153#ifdef CONFIG_MBO
6332aaf3
JM		 3154 mbo_ap_check_sta_assoc(hapd, sta, &elems);
3155
4c572281
JM		 3156 if (hapd->conf->mbo_enabled && (hapd->conf->wpa & 2) &&
3157 elems.mbo && sta->cell_capa && !(sta->flags & WLAN_STA_MFP) &&
3158 hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
3159 wpa_printf(MSG_INFO,
3160 "MBO: Reject WPA2 association without PMF");
3161 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3162 }
3163#endif /* CONFIG_MBO */
3164
99621dc1
MV		 3165#if defined(CONFIG_FILS) && defined(CONFIG_OCV)
3166 if (wpa_auth_uses_ocv(sta->wpa_sm) &&
3167 (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3168 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3169 sta->auth_alg == WLAN_AUTH_FILS_PK)) {
3170 struct wpa_channel_info ci;
3171 int tx_chanwidth;
3172 int tx_seg1_idx;
3173
3174 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
3175 wpa_printf(MSG_WARNING,
3176 "Failed to get channel info to validate received OCI in FILS (Re)Association Request frame");
3177 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3178 }
3179
3180 if (get_sta_tx_parameters(sta->wpa_sm,
3181 channel_width_to_int(ci.chanwidth),
3182 ci.seg1_idx, &tx_chanwidth,
3183 &tx_seg1_idx) < 0)
3184 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3185
3186 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
3187 tx_chanwidth, tx_seg1_idx) != 0) {
3188 wpa_printf(MSG_WARNING, "FILS: %s", ocv_errorstr);
3189 return WLAN_STATUS_UNSPECIFIED_FAILURE;
3190 }
3191 }
3192#endif /* CONFIG_FILS && CONFIG_OCV */
3193
adf0478e
JM		 3194 ap_copy_sta_supp_op_classes(sta, elems.supp_op_classes,
3195 elems.supp_op_classes_len);
3196
629e1804
DS		 3197 if ((sta->capability & WLAN_CAPABILITY_RADIO_MEASUREMENT) &&
3198 elems.rrm_enabled &&
3199 elems.rrm_enabled_len >= sizeof(sta->rrm_enabled_capa))
3200 os_memcpy(sta->rrm_enabled_capa, elems.rrm_enabled,
3201 sizeof(sta->rrm_enabled_capa));
3202
ba72b4b1 3203 if (elems.power_capab) {
3204 sta->min_tx_power = elems.power_capab[0];
3205 sta->max_tx_power = elems.power_capab[1];
3206 sta->power_capab = 1;
3207 } else {
3208 sta->power_capab = 0;
3209 }
3210
5586f500
JM		 3211 return WLAN_STATUS_SUCCESS;
3212}
3213
3214
3215static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
3216 u16 reason_code)
3217{
3218 int send_len;
3219 struct ieee80211_mgmt reply;
3220
3221 os_memset(&reply, 0, sizeof(reply));
3222 reply.frame_control =
3223 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
3224 os_memcpy(reply.da, addr, ETH_ALEN);
3225 os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
3226 os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
3227
3228 send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
3229 reply.u.deauth.reason_code = host_to_le16(reason_code);
3230
8cfa3527 3231 if (hostapd_drv_send_mlme(hapd, &reply, send_len, 0) < 0)
5586f500
JM		 3232 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
3233 strerror(errno));
3234}
3235
3236
3f81ac07 3237static int add_associated_sta(struct hostapd_data *hapd,
4cf5efec 3238 struct sta_info *sta, int reassoc)
3f81ac07
AO		 3239{
3240 struct ieee80211_ht_capabilities ht_cap;
3241 struct ieee80211_vht_capabilities vht_cap;
78d35b16 3242 struct ieee80211_he_capabilities he_cap;
0e3bd7ac 3243 int set = 1;
3f81ac07
AO		 3244
3245 /*
3246 * Remove the STA entry to ensure the STA PS state gets cleared and
3247 * configuration gets updated. This is relevant for cases, such as
3248 * FT-over-the-DS, where a station re-associates back to the same AP but
3249 * skips the authentication flow, or if working with a driver that
3250 * does not support full AP client state.
0e3bd7ac
MV		 3251 *
3252 * Skip this if the STA has already completed FT reassociation and the
3253 * TK has been configured since the TX/RX PN must not be reset to 0 for
3254 * the same key.
4cf5efec
JM		 3255 *
3256 * FT-over-the-DS has a special case where the STA entry (and as such,
3257 * the TK) has not yet been configured to the driver depending on which
3258 * driver interface is used. For that case, allow add-STA operation to
3259 * be used (instead of set-STA). This is needed to allow mac80211-based
3260 * drivers to accept the STA parameter configuration. Since this is
3261 * after a new FT-over-DS exchange, a new TK has been derived, so key
3262 * reinstallation is not a concern for this case.
3f81ac07 3263 */
4cf5efec
JM		 3264 wpa_printf(MSG_DEBUG, "Add associated STA " MACSTR
3265 " (added_unassoc=%d auth_alg=%u ft_over_ds=%u reassoc=%d authorized=%d ft_tk=%d fils_tk=%d)",
3266 MAC2STR(sta->addr), sta->added_unassoc, sta->auth_alg,
3267 sta->ft_over_ds, reassoc,
3268 !!(sta->flags & WLAN_STA_AUTHORIZED),
3269 wpa_auth_sta_ft_tk_already_set(sta->wpa_sm),
3270 wpa_auth_sta_fils_tk_already_set(sta->wpa_sm));
3271
0e3bd7ac
MV		 3272 if (!sta->added_unassoc &&
3273 (!(sta->flags & WLAN_STA_AUTHORIZED) ||
4cf5efec 3274 (reassoc && sta->ft_over_ds && sta->auth_alg == WLAN_AUTH_FT) ||
2f1357fb
JM		 3275 (!wpa_auth_sta_ft_tk_already_set(sta->wpa_sm) &&
3276 !wpa_auth_sta_fils_tk_already_set(sta->wpa_sm)))) {
3f81ac07 3277 hostapd_drv_sta_remove(hapd, sta->addr);
0e3bd7ac
MV		 3278 wpa_auth_sm_event(sta->wpa_sm, WPA_DRV_STA_REMOVED);
3279 set = 0;
4cf5efec
JM		 3280
3281 /* Do not allow the FT-over-DS exception to be used more than
3282 * once per authentication exchange to guarantee a new TK is
3283 * used here */
3284 sta->ft_over_ds = 0;
0e3bd7ac 3285 }
3f81ac07
AO		 3286
3287#ifdef CONFIG_IEEE80211N
3288 if (sta->flags & WLAN_STA_HT)
3289 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
3290#endif /* CONFIG_IEEE80211N */
3291#ifdef CONFIG_IEEE80211AC
3292 if (sta->flags & WLAN_STA_VHT)
3293 hostapd_get_vht_capab(hapd, sta->vht_capabilities, &vht_cap);
3294#endif /* CONFIG_IEEE80211AC */
78d35b16
JC		 3295#ifdef CONFIG_IEEE80211AX
3296 if (sta->flags & WLAN_STA_HE) {
3297 hostapd_get_he_capab(hapd, sta->he_capab, &he_cap,
3298 sta->he_capab_len);
3299 }
3300#endif /* CONFIG_IEEE80211AX */
3f81ac07
AO		 3301
3302 /*
3303 * Add the station with forced WLAN_STA_ASSOC flag. The sta->flags
3304 * will be set when the ACK frame for the (Re)Association Response frame
3305 * is processed (TX status driver event).
3306 */
3307 if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
3308 sta->supported_rates, sta->supported_rates_len,
3309 sta->listen_interval,
3310 sta->flags & WLAN_STA_HT ? &ht_cap : NULL,
3311 sta->flags & WLAN_STA_VHT ? &vht_cap : NULL,
78d35b16
JC		 3312 sta->flags & WLAN_STA_HE ? &he_cap : NULL,
3313 sta->flags & WLAN_STA_HE ? sta->he_capab_len : 0,
3f81ac07 3314 sta->flags | WLAN_STA_ASSOC, sta->qosinfo,
ae33239c 3315 sta->vht_opmode, sta->p2p_ie ? 1 : 0,
0e3bd7ac 3316 set)) {
3f81ac07
AO		 3317 hostapd_logger(hapd, sta->addr,
3318 HOSTAPD_MODULE_IEEE80211, HOSTAPD_LEVEL_NOTICE,
3319 "Could not %s STA to kernel driver",
0e3bd7ac 3320 set ? "set" : "add");
3f81ac07
AO		 3321
3322 if (sta->added_unassoc) {
3323 hostapd_drv_sta_remove(hapd, sta->addr);
3324 sta->added_unassoc = 0;
3325 }
3326
3327 return -1;
3328 }
3329
3330 sta->added_unassoc = 0;
3331
3332 return 0;
3333}
3334
3335
bb598c3b 3336static u16 send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
05e5e615 3337 const u8 *addr, u16 status_code, int reassoc,
076f1ea1 3338 const u8 *ies, size_t ies_len, int rssi)
5586f500
JM		 3339{
3340 int send_len;
91d91abf
JM		 3341 u8 *buf;
3342 size_t buflen;
5586f500
JM		 3343 struct ieee80211_mgmt *reply;
3344 u8 *p;
91d91abf 3345 u16 res = WLAN_STATUS_SUCCESS;
5586f500 3346
91d91abf
JM		 3347 buflen = sizeof(struct ieee80211_mgmt) + 1024;
3348#ifdef CONFIG_FILS
84bb12aa 3349 if (sta && sta->fils_hlp_resp)
91d91abf 3350 buflen += wpabuf_len(sta->fils_hlp_resp);
831d8c9c
JM		 3351 if (sta)
3352 buflen += 150;
91d91abf 3353#endif /* CONFIG_FILS */
09368515
JM		 3354#ifdef CONFIG_OWE
3355 if (sta && (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
d8c8d857 3356 buflen += 150;
09368515 3357#endif /* CONFIG_OWE */
10ec6a5f
JM		 3358#ifdef CONFIG_DPP2
3359 if (sta && sta->dpp_pfs)
3360 buflen += 5 + sta->dpp_pfs->curve->prime_len;
3361#endif /* CONFIG_DPP2 */
91d91abf
JM		 3362 buf = os_zalloc(buflen);
3363 if (!buf) {
3364 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3365 goto done;
3366 }
5586f500
JM		 3367 reply = (struct ieee80211_mgmt *) buf;
3368 reply->frame_control =
3369 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3370 (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
3371 WLAN_FC_STYPE_ASSOC_RESP));
05e5e615 3372 os_memcpy(reply->da, addr, ETH_ALEN);
5586f500
JM		 3373 os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
3374 os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
3375
3376 send_len = IEEE80211_HDRLEN;
3377 send_len += sizeof(reply->u.assoc_resp);
3378 reply->u.assoc_resp.capab_info =
f41ded6f 3379 host_to_le16(hostapd_own_capab_info(hapd));
5586f500 3380 reply->u.assoc_resp.status_code = host_to_le16(status_code);
05e5e615
DL		 3381
3382 reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0) |
3383 BIT(14) | BIT(15));
5586f500
JM		 3384 /* Supported rates */
3385 p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
3386 /* Extended supported rates */
3387 p = hostapd_eid_ext_supp_rates(hapd, p);
5586f500 3388
076f1ea1
BL		 3389#ifdef CONFIG_MBO
3390 if (status_code == WLAN_STATUS_DENIED_POOR_CHANNEL_CONDITIONS &&
3391 rssi != 0) {
3392 int delta = hapd->iconf->rssi_reject_assoc_rssi - rssi;
3393
3394 p = hostapd_eid_mbo_rssi_assoc_rej(hapd, p, buf + buflen - p,
3395 delta);
3396 }
3397#endif /* CONFIG_MBO */
3398
4ec1fd8e 3399#ifdef CONFIG_IEEE80211R_AP
05e5e615 3400 if (sta && status_code == WLAN_STATUS_SUCCESS) {
5586f500
JM		 3401 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
3402 * Transition Information, RSN, [RIC Response] */
3403 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
91d91abf 3404 buf + buflen - p,
5586f500 3405 sta->auth_alg, ies, ies_len);
2cf36d60
JM		 3406 if (!p) {
3407 wpa_printf(MSG_DEBUG,
3408 "FT: Failed to write AssocResp IEs");
3409 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3410 goto done;
3411 }
5586f500 3412 }
4ec1fd8e 3413#endif /* CONFIG_IEEE80211R_AP */
831d8c9c
JM		 3414#ifdef CONFIG_FILS
3415 if (sta && status_code == WLAN_STATUS_SUCCESS &&
3416 (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3417 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3418 sta->auth_alg == WLAN_AUTH_FILS_PK))
3419 p = wpa_auth_write_assoc_resp_fils(sta->wpa_sm, p,
3420 buf + buflen - p,
3421 ies, ies_len);
3422#endif /* CONFIG_FILS */
5586f500 3423
d8c8d857 3424#ifdef CONFIG_OWE
8fc6d884
JM		 3425 if (sta && status_code == WLAN_STATUS_SUCCESS &&
3426 (hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE))
d8c8d857
JM		 3427 p = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, p,
3428 buf + buflen - p,
3429 ies, ies_len);
3430#endif /* CONFIG_OWE */
3431
5586f500 3432#ifdef CONFIG_IEEE80211W
05e5e615 3433 if (sta && status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
5586f500
JM		 3434 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
3435#endif /* CONFIG_IEEE80211W */
3436
1bc774a1
JM		 3437#ifdef CONFIG_IEEE80211N
3438 p = hostapd_eid_ht_capabilities(hapd, p);
3439 p = hostapd_eid_ht_operation(hapd, p);
3440#endif /* CONFIG_IEEE80211N */
3441
14708b50 3442#ifdef CONFIG_IEEE80211AC
e7d0e97b 3443 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac) {
fc72a48a
T		 3444 u32 nsts = 0, sta_nsts;
3445
05e5e615 3446 if (sta && hapd->conf->use_sta_nsts && sta->vht_capabilities) {
fc72a48a
T		 3447 struct ieee80211_vht_capabilities *capa;
3448
3449 nsts = (hapd->iface->conf->vht_capab >>
3450 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
3451 capa = sta->vht_capabilities;
3452 sta_nsts = (le_to_host32(capa->vht_capabilities_info) >>
3453 VHT_CAP_BEAMFORMEE_STS_OFFSET) & 7;
3454
3455 if (nsts < sta_nsts)
3456 nsts = 0;
3457 else
3458 nsts = sta_nsts;
3459 }
3460 p = hostapd_eid_vht_capabilities(hapd, p, nsts);
e7d0e97b
YL		 3461 p = hostapd_eid_vht_operation(hapd, p);
3462 }
14708b50
MP		 3463#endif /* CONFIG_IEEE80211AC */
3464
78d35b16
JC		 3465#ifdef CONFIG_IEEE80211AX
3466 if (hapd->iconf->ieee80211ax) {
3467 p = hostapd_eid_he_capab(hapd, p);
3468 p = hostapd_eid_he_operation(hapd, p);
3469 p = hostapd_eid_spatial_reuse(hapd, p);
3470 p = hostapd_eid_he_mu_edca_parameter_set(hapd, p);
3471 }
3472#endif /* CONFIG_IEEE80211AX */
3473
1161ff1e 3474 p = hostapd_eid_ext_capab(hapd, p);
b6668734 3475 p = hostapd_eid_bss_max_idle_period(hapd, p);
05e5e615 3476 if (sta && sta->qos_map_enabled)
c551700f 3477 p = hostapd_eid_qos_map_set(hapd, p);
1161ff1e 3478
347827ff
AN		 3479#ifdef CONFIG_FST
3480 if (hapd->iface->fst_ies) {
3481 os_memcpy(p, wpabuf_head(hapd->iface->fst_ies),
3482 wpabuf_len(hapd->iface->fst_ies));
3483 p += wpabuf_len(hapd->iface->fst_ies);
3484 }
3485#endif /* CONFIG_FST */
3486
b750dde6
JM		 3487#ifdef CONFIG_OWE
3488 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_OWE) &&
3489 sta && sta->owe_ecdh && status_code == WLAN_STATUS_SUCCESS &&
3490 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_OWE) {
3491 struct wpabuf *pub;
3492
3493 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
3494 if (!pub) {
3495 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3496 goto done;
3497 }
3498 /* OWE Diffie-Hellman Parameter element */
3499 *p++ = WLAN_EID_EXTENSION; /* Element ID */
3500 *p++ = 1 + 2 + wpabuf_len(pub); /* Length */
3501 *p++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension */
3502 WPA_PUT_LE16(p, sta->owe_group);
3503 p += 2;
3504 os_memcpy(p, wpabuf_head(pub), wpabuf_len(pub));
3505 p += wpabuf_len(pub);
3506 wpabuf_free(pub);
3507 }
3508#endif /* CONFIG_OWE */
3509
10ec6a5f
JM		 3510#ifdef CONFIG_DPP2
3511 if ((hapd->conf->wpa_key_mgmt & WPA_KEY_MGMT_DPP) &&
3512 sta && sta->dpp_pfs && status_code == WLAN_STATUS_SUCCESS &&
3513 wpa_auth_sta_key_mgmt(sta->wpa_sm) == WPA_KEY_MGMT_DPP) {
3514 os_memcpy(p, wpabuf_head(sta->dpp_pfs->ie),
3515 wpabuf_len(sta->dpp_pfs->ie));
3516 p += wpabuf_len(sta->dpp_pfs->ie);
3517 }
3518#endif /* CONFIG_DPP2 */
3519
e7d0e97b 3520#ifdef CONFIG_IEEE80211AC
05e5e615 3521 if (sta && hapd->conf->vendor_vht && (sta->flags & WLAN_STA_VENDOR_VHT))
e7d0e97b
YL		 3522 p = hostapd_eid_vendor_vht(hapd, p);
3523#endif /* CONFIG_IEEE80211AC */
3524
05e5e615 3525 if (sta && (sta->flags & WLAN_STA_WMM))
1bc774a1
JM		 3526 p = hostapd_eid_wmm(hapd, p);
3527
ed7a09f9 3528#ifdef CONFIG_WPS
05e5e615
DL		 3529 if (sta &&
3530 ((sta->flags & WLAN_STA_WPS) ||
3531 ((sta->flags & WLAN_STA_MAYBE_WPS) && hapd->conf->wpa))) {
ed7a09f9
JM		 3532 struct wpabuf *wps = wps_build_assoc_resp_ie();
3533 if (wps) {
3534 os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
3535 p += wpabuf_len(wps);
3536 wpabuf_free(wps);
3537 }
3538 }
3539#endif /* CONFIG_WPS */
3540
9c06f0f6
VN		 3541 if (sta && (sta->flags & WLAN_STA_MULTI_AP))
3542 p = hostapd_eid_multi_ap(hapd, p);
3543
8ccbe415 3544#ifdef CONFIG_P2P
05e5e615 3545 if (sta && sta->p2p_ie && hapd->p2p_group) {
8ccbe415
JM		 3546 struct wpabuf *p2p_resp_ie;
3547 enum p2p_status_code status;
3548 switch (status_code) {
3549 case WLAN_STATUS_SUCCESS:
3550 status = P2P_SC_SUCCESS;
3551 break;
3552 case WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA:
3553 status = P2P_SC_FAIL_LIMIT_REACHED;
3554 break;
3555 default:
3556 status = P2P_SC_FAIL_INVALID_PARAMS;
3557 break;
3558 }
3559 p2p_resp_ie = p2p_group_assoc_resp_ie(hapd->p2p_group, status);
3560 if (p2p_resp_ie) {
3561 os_memcpy(p, wpabuf_head(p2p_resp_ie),
3562 wpabuf_len(p2p_resp_ie));
3563 p += wpabuf_len(p2p_resp_ie);
3564 wpabuf_free(p2p_resp_ie);
3565 }
3566 }
3567#endif /* CONFIG_P2P */
3568
962473c1
JM		 3569#ifdef CONFIG_P2P_MANAGER
3570 if (hapd->conf->p2p & P2P_MANAGE)
3571 p = hostapd_eid_p2p_manage(hapd, p);
3572#endif /* CONFIG_P2P_MANAGER */
3573
91d91abf 3574 p = hostapd_eid_mbo(hapd, p, buf + buflen - p);
fb9a1c3e 3575
a9112270 3576 if (hapd->conf->assocresp_elements &&
91d91abf 3577 (size_t) (buf + buflen - p) >=
a9112270
BKB		 3578 wpabuf_len(hapd->conf->assocresp_elements)) {
3579 os_memcpy(p, wpabuf_head(hapd->conf->assocresp_elements),
3580 wpabuf_len(hapd->conf->assocresp_elements));
3581 p += wpabuf_len(hapd->conf->assocresp_elements);
3582 }
3583
5586f500
JM		 3584 send_len += p - reply->u.assoc_resp.variable;
3585
e73ffa09 3586#ifdef CONFIG_FILS
05e5e615
DL		 3587 if (sta &&
3588 (sta->auth_alg == WLAN_AUTH_FILS_SK ||
e73ffa09
JM		 3589 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3590 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
3591 status_code == WLAN_STATUS_SUCCESS) {
3592 struct ieee802_11_elems elems;
3593
3594 if (ieee802_11_parse_elems(ies, ies_len, &elems, 0) ==
91d91abf
JM		 3595 ParseFailed || !elems.fils_session) {
3596 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3597 goto done;
3598 }
e73ffa09
JM		 3599
3600 /* FILS Session */
3601 *p++ = WLAN_EID_EXTENSION; /* Element ID */
3602 *p++ = 1 + FILS_SESSION_LEN; /* Length */
3603 *p++ = WLAN_EID_EXT_FILS_SESSION; /* Element ID Extension */
3604 os_memcpy(p, elems.fils_session, FILS_SESSION_LEN);
3605 send_len += 2 + 1 + FILS_SESSION_LEN;
3606
3607 send_len = fils_encrypt_assoc(sta->wpa_sm, buf, send_len,
91d91abf
JM		 3608 buflen, sta->fils_hlp_resp);
3609 if (send_len < 0) {
3610 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
3611 goto done;
3612 }
e73ffa09
JM		 3613 }
3614#endif /* CONFIG_FILS */
3615
bb598c3b 3616 if (hostapd_drv_send_mlme(hapd, reply, send_len, 0) < 0) {
5586f500
JM		 3617 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
3618 strerror(errno));
91d91abf 3619 res = WLAN_STATUS_UNSPECIFIED_FAILURE;
bb598c3b
AB		 3620 }
3621
91d91abf
JM		 3622done:
3623 os_free(buf);
3624 return res;
5586f500
JM		 3625}
3626
3627
33c8bbd8 3628#ifdef CONFIG_OWE
79ce2d51
AP		 3629u8 * owe_assoc_req_process(struct hostapd_data *hapd, struct sta_info *sta,
3630 const u8 *owe_dh, u8 owe_dh_len,
3631 u8 *owe_buf, size_t owe_buf_len, u16 *reason)
33c8bbd8 3632{
a22e235f
AP		 3633#ifdef CONFIG_TESTING_OPTIONS
3634 if (hapd->conf->own_ie_override) {
3635 wpa_printf(MSG_DEBUG, "OWE: Using IE override");
3636 *reason = WLAN_STATUS_SUCCESS;
3637 return wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3638 owe_buf_len, NULL, 0);
3639 }
3640#endif /* CONFIG_TESTING_OPTIONS */
3641
cd483be2
AP		 3642 if (wpa_auth_sta_get_pmksa(sta->wpa_sm)) {
3643 wpa_printf(MSG_DEBUG, "OWE: Using PMKSA caching");
3644 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3645 owe_buf_len, NULL, 0);
3646 *reason = WLAN_STATUS_SUCCESS;
3647 return owe_buf;
3648 }
3649
33c8bbd8
AKP		 3650 *reason = owe_process_assoc_req(hapd, sta, owe_dh, owe_dh_len);
3651 if (*reason != WLAN_STATUS_SUCCESS)
3652 return NULL;
33c8bbd8 3653
af65ef28
AP		 3654 owe_buf = wpa_auth_write_assoc_resp_owe(sta->wpa_sm, owe_buf,
3655 owe_buf_len, NULL, 0);
3656
f5701cc6 3657 if (sta->owe_ecdh && owe_buf) {
759da93a
AP		 3658 struct wpabuf *pub;
3659
3660 pub = crypto_ecdh_get_pubkey(sta->owe_ecdh, 0);
3661 if (!pub) {
3662 *reason = WLAN_STATUS_UNSPECIFIED_FAILURE;
3663 return owe_buf;
3664 }
3665
3666 /* OWE Diffie-Hellman Parameter element */
3667 *owe_buf++ = WLAN_EID_EXTENSION; /* Element ID */
3668 *owe_buf++ = 1 + 2 + wpabuf_len(pub); /* Length */
3669 *owe_buf++ = WLAN_EID_EXT_OWE_DH_PARAM; /* Element ID Extension
3670 */
3671 WPA_PUT_LE16(owe_buf, sta->owe_group);
3672 owe_buf += 2;
3673 os_memcpy(owe_buf, wpabuf_head(pub), wpabuf_len(pub));
3674 owe_buf += wpabuf_len(pub);
3675 wpabuf_free(pub);
3676 }
3677
33c8bbd8
AKP		 3678 return owe_buf;
3679}
3680#endif /* CONFIG_OWE */
3681
3682
91d91abf
JM		 3683#ifdef CONFIG_FILS
3684
3685void fils_hlp_finish_assoc(struct hostapd_data *hapd, struct sta_info *sta)
3686{
3687 u16 reply_res;
3688
3689 wpa_printf(MSG_DEBUG, "FILS: Finish association with " MACSTR,
3690 MAC2STR(sta->addr));
3691 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
3692 if (!sta->fils_pending_assoc_req)
3693 return;
3694 reply_res = send_assoc_resp(hapd, sta, sta->addr, WLAN_STATUS_SUCCESS,
3695 sta->fils_pending_assoc_is_reassoc,
3696 sta->fils_pending_assoc_req,
076f1ea1 3697 sta->fils_pending_assoc_req_len, 0);
91d91abf
JM		 3698 os_free(sta->fils_pending_assoc_req);
3699 sta->fils_pending_assoc_req = NULL;
3700 sta->fils_pending_assoc_req_len = 0;
3701 wpabuf_free(sta->fils_hlp_resp);
3702 sta->fils_hlp_resp = NULL;
3703 wpabuf_free(sta->hlp_dhcp_discover);
3704 sta->hlp_dhcp_discover = NULL;
3705
3706 /*
fd35ed5b
IP		 3707 * Remove the station in case transmission of a success response fails.
3708 * At this point the station was already added associated to the driver.
91d91abf 3709 */
fd35ed5b 3710 if (reply_res != WLAN_STATUS_SUCCESS)
91d91abf 3711 hostapd_drv_sta_remove(hapd, sta->addr);
91d91abf
JM		 3712}
3713
3714
3715void fils_hlp_timeout(void *eloop_ctx, void *eloop_data)
3716{
3717 struct hostapd_data *hapd = eloop_ctx;
3718 struct sta_info *sta = eloop_data;
3719
3720 wpa_printf(MSG_DEBUG,
3721 "FILS: HLP response timeout - continue with association response for "
3722 MACSTR, MAC2STR(sta->addr));
8b5ddda5
JM		 3723 if (sta->fils_drv_assoc_finish)
3724 hostapd_notify_assoc_fils_finish(hapd, sta);
3725 else
3726 fils_hlp_finish_assoc(hapd, sta);
91d91abf
JM		 3727}
3728
3729#endif /* CONFIG_FILS */
3730
3731
5586f500 3732static void handle_assoc(struct hostapd_data *hapd,
b57e086c 3733 const struct ieee80211_mgmt *mgmt, size_t len,
076f1ea1 3734 int reassoc, int rssi)
5586f500 3735{
38cb0a2d 3736 u16 capab_info, listen_interval, seq_ctrl, fc;
bb598c3b 3737 u16 resp = WLAN_STATUS_SUCCESS, reply_res;
b57e086c 3738 const u8 *pos;
5586f500
JM		 3739 int left, i;
3740 struct sta_info *sta;
78815f3d 3741 u8 *tmp = NULL;
53d17144
DL		 3742 struct hostapd_sta_wpa_psk_short *psk = NULL;
3743 char *identity = NULL;
3744 char *radius_cui = NULL;
91d91abf
JM		 3745#ifdef CONFIG_FILS
3746 int delay_assoc = 0;
3747#endif /* CONFIG_FILS */
5586f500
JM		 3748
3749 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
3750 sizeof(mgmt->u.assoc_req))) {
61323e70
JM		 3751 wpa_printf(MSG_INFO, "handle_assoc(reassoc=%d) - too short payload (len=%lu)",
3752 reassoc, (unsigned long) len);
5586f500
JM		 3753 return;
3754 }
3755
c2aff6b1
JB		 3756#ifdef CONFIG_TESTING_OPTIONS
3757 if (reassoc) {
06df2aa6 3758 if (hapd->iconf->ignore_reassoc_probability > 0.0 &&
c2aff6b1
JB		 3759 drand48() < hapd->iconf->ignore_reassoc_probability) {
3760 wpa_printf(MSG_INFO,
3761 "TESTING: ignoring reassoc request from "
3762 MACSTR, MAC2STR(mgmt->sa));
3763 return;
3764 }
3765 } else {
06df2aa6 3766 if (hapd->iconf->ignore_assoc_probability > 0.0 &&
c2aff6b1
JB		 3767 drand48() < hapd->iconf->ignore_assoc_probability) {
3768 wpa_printf(MSG_INFO,
3769 "TESTING: ignoring assoc request from "
3770 MACSTR, MAC2STR(mgmt->sa));
3771 return;
3772 }
3773 }
3774#endif /* CONFIG_TESTING_OPTIONS */
3775
38cb0a2d
IP		 3776 fc = le_to_host16(mgmt->frame_control);
3777 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
3778
5586f500
JM		 3779 if (reassoc) {
3780 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
3781 listen_interval = le_to_host16(
3782 mgmt->u.reassoc_req.listen_interval);
3783 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
3784 " capab_info=0x%02x listen_interval=%d current_ap="
38cb0a2d 3785 MACSTR " seq_ctrl=0x%x%s",
5586f500 3786 MAC2STR(mgmt->sa), capab_info, listen_interval,
38cb0a2d
IP		 3787 MAC2STR(mgmt->u.reassoc_req.current_ap),
3788 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
5586f500
JM		 3789 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
3790 pos = mgmt->u.reassoc_req.variable;
3791 } else {
3792 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
3793 listen_interval = le_to_host16(
3794 mgmt->u.assoc_req.listen_interval);
3795 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
38cb0a2d
IP		 3796 " capab_info=0x%02x listen_interval=%d "
3797 "seq_ctrl=0x%x%s",
3798 MAC2STR(mgmt->sa), capab_info, listen_interval,
3799 seq_ctrl, (fc & WLAN_FC_RETRY) ? " retry" : "");
5586f500
JM		 3800 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
3801 pos = mgmt->u.assoc_req.variable;
3802 }
3803
3804 sta = ap_get_sta(hapd, mgmt->sa);
4ec1fd8e 3805#ifdef CONFIG_IEEE80211R_AP
5586f500
JM		 3806 if (sta && sta->auth_alg == WLAN_AUTH_FT &&
3807 (sta->flags & WLAN_STA_AUTH) == 0) {
3808 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
3809 "prior to authentication since it is using "
3810 "over-the-DS FT", MAC2STR(mgmt->sa));
bb598c3b
AB		 3811
3812 /*
3813 * Mark station as authenticated, to avoid adding station
3814 * entry in the driver as associated and not authenticated
3815 */
3816 sta->flags |= WLAN_STA_AUTH;
5586f500 3817 } else
4ec1fd8e 3818#endif /* CONFIG_IEEE80211R_AP */
5586f500 3819 if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
05e5e615
DL		 3820 if (hapd->iface->current_mode &&
3821 hapd->iface->current_mode->mode ==
3822 HOSTAPD_MODE_IEEE80211AD) {
53d17144
DL		 3823 int acl_res;
3824 u32 session_timeout, acct_interim_interval;
3825 struct vlan_description vlan_id;
3826
3827 acl_res = ieee802_11_allowed_address(
3828 hapd, mgmt->sa, (const u8 *) mgmt, len,
3829 &session_timeout, &acct_interim_interval,
92eb00ae 3830 &vlan_id, &psk, &identity, &radius_cui, 0);
53d17144 3831 if (acl_res == HOSTAPD_ACL_REJECT) {
92eb00ae
T		 3832 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
3833 "Ignore Association Request frame from "
3834 MACSTR " due to ACL reject",
3835 MAC2STR(mgmt->sa));
53d17144
DL		 3836 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3837 goto fail;
3838 }
3839 if (acl_res == HOSTAPD_ACL_PENDING)
3840 return;
3841
05e5e615
DL		 3842 /* DMG/IEEE 802.11ad does not use authentication.
3843 * Allocate sta entry upon association. */
3844 sta = ap_sta_add(hapd, mgmt->sa);
3845 if (!sta) {
3846 hostapd_logger(hapd, mgmt->sa,
3847 HOSTAPD_MODULE_IEEE80211,
3848 HOSTAPD_LEVEL_INFO,
3849 "Failed to add STA");
3850 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3851 goto fail;
3852 }
3853
53d17144
DL		 3854 acl_res = ieee802_11_set_radius_info(
3855 hapd, sta, acl_res, session_timeout,
3856 acct_interim_interval, &vlan_id, &psk,
3857 &identity, &radius_cui);
3858 if (acl_res) {
3859 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3860 goto fail;
3861 }
3862
05e5e615
DL		 3863 hostapd_logger(hapd, sta->addr,
3864 HOSTAPD_MODULE_IEEE80211,
3865 HOSTAPD_LEVEL_DEBUG,
3866 "Skip authentication for DMG/IEEE 802.11ad");
3867 sta->flags |= WLAN_STA_AUTH;
3868 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
3869 sta->auth_alg = WLAN_AUTH_OPEN;
3870 } else {
3871 hostapd_logger(hapd, mgmt->sa,
3872 HOSTAPD_MODULE_IEEE80211,
3873 HOSTAPD_LEVEL_INFO,
3874 "Station tried to associate before authentication (aid=%d flags=0x%x)",
3875 sta ? sta->aid : -1,
3876 sta ? sta->flags : 0);
3877 send_deauth(hapd, mgmt->sa,
3878 WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
3879 return;
3880 }
5586f500
JM		 3881 }
3882
38cb0a2d
IP		 3883 if ((fc & WLAN_FC_RETRY) &&
3884 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
3885 sta->last_seq_ctrl == seq_ctrl &&
fa67debf
JM		 3886 sta->last_subtype == (reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3887 WLAN_FC_STYPE_ASSOC_REQ)) {
38cb0a2d
IP		 3888 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
3889 HOSTAPD_LEVEL_DEBUG,
3890 "Drop repeated association frame seq_ctrl=0x%x",
3891 seq_ctrl);
3892 return;
3893 }
3894 sta->last_seq_ctrl = seq_ctrl;
3895 sta->last_subtype = reassoc ? WLAN_FC_STYPE_REASSOC_REQ :
3896 WLAN_FC_STYPE_ASSOC_REQ;
3897
5586f500 3898 if (hapd->tkip_countermeasures) {
fe12ae77 3899 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
5586f500
JM		 3900 goto fail;
3901 }
3902
3903 if (listen_interval > hapd->conf->max_listen_interval) {
3904 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3905 HOSTAPD_LEVEL_DEBUG,
3906 "Too large Listen Interval (%d)",
3907 listen_interval);
3908 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
3909 goto fail;
3910 }
3911
fb9a1c3e
AS		 3912#ifdef CONFIG_MBO
3913 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
3914 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3915 goto fail;
3916 }
076f1ea1
BL		 3917
3918 if (hapd->iconf->rssi_reject_assoc_rssi && rssi &&
2ea1fce3
JM		 3919 rssi < hapd->iconf->rssi_reject_assoc_rssi &&
3920 (sta->auth_rssi == 0 ||
3921 sta->auth_rssi < hapd->iconf->rssi_reject_assoc_rssi)) {
076f1ea1
BL		 3922 resp = WLAN_STATUS_DENIED_POOR_CHANNEL_CONDITIONS;
3923 goto fail;
3924 }
fb9a1c3e
AS		 3925#endif /* CONFIG_MBO */
3926
629e1804
DS		 3927 /*
3928 * sta->capability is used in check_assoc_ies() for RRM enabled
3929 * capability element.
3930 */
3931 sta->capability = capab_info;
3932
78815f3d
JM		 3933#ifdef CONFIG_FILS
3934 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
3935 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
3936 sta->auth_alg == WLAN_AUTH_FILS_PK) {
1489fcf8
JM		 3937 int res;
3938
78815f3d
JM		 3939 /* The end of the payload is encrypted. Need to decrypt it
3940 * before parsing. */
3941
a1f11e34 3942 tmp = os_memdup(pos, left);
78815f3d
JM		 3943 if (!tmp) {
3944 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3945 goto fail;
3946 }
78815f3d 3947
1489fcf8
JM		 3948 res = fils_decrypt_assoc(sta->wpa_sm, sta->fils_session, mgmt,
3949 len, tmp, left);
3950 if (res < 0) {
78815f3d
JM		 3951 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
3952 goto fail;
3953 }
3954 pos = tmp;
1489fcf8 3955 left = res;
78815f3d
JM		 3956 }
3957#endif /* CONFIG_FILS */
3958
5586f500
JM		 3959 /* followed by SSID and Supported rates; and HT capabilities if 802.11n
3960 * is used */
3961 resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
3962 if (resp != WLAN_STATUS_SUCCESS)
3963 goto fail;
3964
3965 if (hostapd_get_aid(hapd, sta) < 0) {
3966 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
3967 HOSTAPD_LEVEL_INFO, "No room for more AIDs");
3968 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
3969 goto fail;
3970 }
3971
5586f500
JM		 3972 sta->listen_interval = listen_interval;
3973
28d12641
AKP		 3974 if (hapd->iface->current_mode &&
3975 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
6fc6879b
JM		 3976 sta->flags |= WLAN_STA_NONERP;
3977 for (i = 0; i < sta->supported_rates_len; i++) {
3978 if ((sta->supported_rates[i] & 0x7f) > 22) {
3979 sta->flags &= ~WLAN_STA_NONERP;
3980 break;
3981 }
3982 }
3983 if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
3984 sta->nonerp_set = 1;
3985 hapd->iface->num_sta_non_erp++;
3986 if (hapd->iface->num_sta_non_erp == 1)
3987 ieee802_11_set_beacons(hapd->iface);
3988 }
3989
3990 if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
3991 !sta->no_short_slot_time_set) {
3992 sta->no_short_slot_time_set = 1;
3993 hapd->iface->num_sta_no_short_slot_time++;
28d12641
AKP		 3994 if (hapd->iface->current_mode &&
3995 hapd->iface->current_mode->mode ==
6fc6879b
JM		 3996 HOSTAPD_MODE_IEEE80211G &&
3997 hapd->iface->num_sta_no_short_slot_time == 1)
3998 ieee802_11_set_beacons(hapd->iface);
3999 }
4000
4001 if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
4002 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
4003 else
4004 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
4005
4006 if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
4007 !sta->no_short_preamble_set) {
4008 sta->no_short_preamble_set = 1;
4009 hapd->iface->num_sta_no_short_preamble++;
28d12641
AKP		 4010 if (hapd->iface->current_mode &&
4011 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
6fc6879b
JM		 4012 && hapd->iface->num_sta_no_short_preamble == 1)
4013 ieee802_11_set_beacons(hapd->iface);
4014 }
4015
d45354be 4016#ifdef CONFIG_IEEE80211N
5586f500 4017 update_ht_state(hapd, sta);
d45354be 4018#endif /* CONFIG_IEEE80211N */
de9289c8 4019
6fc6879b
JM		 4020 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4021 HOSTAPD_LEVEL_DEBUG,
4022 "association OK (aid %d)", sta->aid);
4023 /* Station will be marked associated, after it acknowledges AssocResp
4024 */
b8281964 4025 sta->flags |= WLAN_STA_ASSOC_REQ_OK;
6fc6879b 4026
6f5c8dbd
JM		 4027#ifdef CONFIG_IEEE80211W
4028 if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
4029 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
4030 "SA Query procedure", reassoc ? "re" : "");
4031 /* TODO: Send a protected Disassociate frame to the STA using
4032 * the old key and Reason Code "Previous Authentication no
4033 * longer valid". Make sure this is only sent protected since
4034 * unprotected frame would be received by the STA that is now
4035 * trying to associate.
4036 */
4037 }
4038#endif /* CONFIG_IEEE80211W */
4039
6fc6879b
JM		 4040 /* Make sure that the previously registered inactivity timer will not
4041 * remove the STA immediately. */
4042 sta->timeout_next = STA_NULLFUNC;
4043
04059ab8
DG		 4044#ifdef CONFIG_TAXONOMY
4045 taxonomy_sta_info_assoc_req(hapd, sta, pos, left);
4046#endif /* CONFIG_TAXONOMY */
4047
1f0fdaf0
JM		 4048 sta->pending_wds_enable = 0;
4049
5208160b
JM		 4050#ifdef CONFIG_FILS
4051 if (sta->auth_alg == WLAN_AUTH_FILS_SK ||
4052 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
91d91abf
JM		 4053 sta->auth_alg == WLAN_AUTH_FILS_PK) {
4054 if (fils_process_hlp(hapd, sta, pos, left) > 0)
4055 delay_assoc = 1;
4056 }
5208160b
JM		 4057#endif /* CONFIG_FILS */
4058
6fc6879b 4059 fail:
53d17144
DL		 4060 os_free(identity);
4061 os_free(radius_cui);
4062 hostapd_free_psk_list(psk);
4063
3f81ac07
AO		 4064 /*
4065 * In case of a successful response, add the station to the driver.
4066 * Otherwise, the kernel may ignore Data frames before we process the
4067 * ACK frame (TX status). In case of a failure, this station will be
4068 * removed.
4069 *
4070 * Note that this is not compliant with the IEEE 802.11 standard that
4071 * states that a non-AP station should transition into the
4072 * authenticated/associated state only after the station acknowledges
4073 * the (Re)Association Response frame. However, still do this as:
4074 *
4075 * 1. In case the station does not acknowledge the (Re)Association
4076 * Response frame, it will be removed.
4077 * 2. Data frames will be dropped in the kernel until the station is
4078 * set into authorized state, and there are no significant known
4079 * issues with processing other non-Data Class 3 frames during this
4080 * window.
4081 */
4cf5efec
JM		 4082 if (resp == WLAN_STATUS_SUCCESS && sta &&
4083 add_associated_sta(hapd, sta, reassoc))
3f81ac07
AO		 4084 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
4085
91d91abf 4086#ifdef CONFIG_FILS
17adac9e
JM		 4087 if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS &&
4088 eloop_is_timeout_registered(fils_hlp_timeout, hapd, sta) &&
4089 sta->fils_pending_assoc_req) {
4090 /* Do not reschedule fils_hlp_timeout in case the station
4091 * retransmits (Re)Association Request frame while waiting for
4092 * the previously started FILS HLP wait, so that the timeout can
4093 * be determined from the first pending attempt. */
4094 wpa_printf(MSG_DEBUG,
4095 "FILS: Continue waiting for HLP processing before sending (Re)Association Response frame to "
4096 MACSTR, MAC2STR(sta->addr));
4097 os_free(tmp);
4098 return;
4099 }
91d91abf
JM		 4100 if (sta) {
4101 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
4102 os_free(sta->fils_pending_assoc_req);
4103 sta->fils_pending_assoc_req = NULL;
4104 sta->fils_pending_assoc_req_len = 0;
4105 wpabuf_free(sta->fils_hlp_resp);
4106 sta->fils_hlp_resp = NULL;
4107 }
4108 if (sta && delay_assoc && resp == WLAN_STATUS_SUCCESS) {
4109 sta->fils_pending_assoc_req = tmp;
4110 sta->fils_pending_assoc_req_len = left;
4111 sta->fils_pending_assoc_is_reassoc = reassoc;
8b5ddda5 4112 sta->fils_drv_assoc_finish = 0;
91d91abf
JM		 4113 wpa_printf(MSG_DEBUG,
4114 "FILS: Waiting for HLP processing before sending (Re)Association Response frame to "
4115 MACSTR, MAC2STR(sta->addr));
4116 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
4117 eloop_register_timeout(0, hapd->conf->fils_hlp_wait_time * 1024,
4118 fils_hlp_timeout, hapd, sta);
4119 return;
4120 }
4121#endif /* CONFIG_FILS */
4122
05e5e615 4123 reply_res = send_assoc_resp(hapd, sta, mgmt->sa, resp, reassoc, pos,
076f1ea1 4124 left, rssi);
78815f3d 4125 os_free(tmp);
3f81ac07
AO		 4126
4127 /*
4128 * Remove the station in case tranmission of a success response fails
4129 * (the STA was added associated to the driver) or if the station was
4130 * previously added unassociated.
4131 */
05e5e615
DL		 4132 if (sta && ((reply_res != WLAN_STATUS_SUCCESS &&
4133 resp == WLAN_STATUS_SUCCESS) || sta->added_unassoc)) {
bb598c3b
AB		 4134 hostapd_drv_sta_remove(hapd, sta->addr);
4135 sta->added_unassoc = 0;
4136 }
6fc6879b
JM		 4137}
4138
4139
6fc6879b 4140static void handle_disassoc(struct hostapd_data *hapd,
f8b1f695 4141 const struct ieee80211_mgmt *mgmt, size_t len)
6fc6879b
JM		 4142{
4143 struct sta_info *sta;
4144
4145 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
61323e70
JM		 4146 wpa_printf(MSG_INFO, "handle_disassoc - too short payload (len=%lu)",
4147 (unsigned long) len);
6fc6879b
JM		 4148 return;
4149 }
4150
4151 wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
4152 MAC2STR(mgmt->sa),
4153 le_to_host16(mgmt->u.disassoc.reason_code));
4154
6fc6879b
JM		 4155 sta = ap_get_sta(hapd, mgmt->sa);
4156 if (sta == NULL) {
61323e70
JM		 4157 wpa_printf(MSG_INFO, "Station " MACSTR " trying to disassociate, but it is not associated",
4158 MAC2STR(mgmt->sa));
6fc6879b
JM		 4159 return;
4160 }
4161
ae055af4 4162 ap_sta_set_authorized(hapd, sta, 0);
38cb0a2d 4163 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
b8281964 4164 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
6fc6879b
JM		 4165 wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
4166 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4167 HOSTAPD_LEVEL_INFO, "disassociated");
4168 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
4169 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
4170 /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
4171 * authenticated. */
4172 accounting_sta_stop(hapd, sta);
d7c3347f 4173 ieee802_1x_free_station(hapd, sta);
7d597d46 4174 if (sta->ipaddr)
ed4ddb6d 4175 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
bd00c431 4176 ap_sta_ip6addr_del(hapd, sta);
51e2a27a 4177 hostapd_drv_sta_remove(hapd, sta->addr);
bb598c3b 4178 sta->added_unassoc = 0;
6fc6879b
JM		 4179
4180 if (sta->timeout_next == STA_NULLFUNC ||
4181 sta->timeout_next == STA_DISASSOC) {
4182 sta->timeout_next = STA_DEAUTH;
4183 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
4184 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
4185 hapd, sta);
4186 }
4187
4188 mlme_disassociate_indication(
4189 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
05e5e615
DL		 4190
4191 /* DMG/IEEE 802.11ad does not use deauthication. Deallocate sta upon
4192 * disassociation. */
4193 if (hapd->iface->current_mode &&
4194 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
4195 sta->flags &= ~WLAN_STA_AUTH;
4196 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
4197 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4198 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
4199 ap_free_sta(hapd, sta);
4200 }
6fc6879b
JM		 4201}
4202
4203
4204static void handle_deauth(struct hostapd_data *hapd,
f8b1f695 4205 const struct ieee80211_mgmt *mgmt, size_t len)
6fc6879b
JM		 4206{
4207 struct sta_info *sta;
4208
4209 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
3ec1e902
JM		 4210 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "handle_deauth - too short "
4211 "payload (len=%lu)", (unsigned long) len);
6fc6879b
JM		 4212 return;
4213 }
4214
3ec1e902 4215 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "deauthentication: STA=" MACSTR
24d75245
BG		 4216 " reason_code=%d",
4217 MAC2STR(mgmt->sa), le_to_host16(mgmt->u.deauth.reason_code));
6fc6879b 4218
6fc6879b
JM		 4219 sta = ap_get_sta(hapd, mgmt->sa);
4220 if (sta == NULL) {
3ec1e902
JM		 4221 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR " trying "
4222 "to deauthenticate, but it is not authenticated",
24d75245 4223 MAC2STR(mgmt->sa));
6fc6879b
JM		 4224 return;
4225 }
4226
ae055af4 4227 ap_sta_set_authorized(hapd, sta, 0);
38cb0a2d 4228 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
b8281964
JM		 4229 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
4230 WLAN_STA_ASSOC_REQ_OK);
6fc6879b
JM		 4231 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
4232 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4233 HOSTAPD_LEVEL_DEBUG, "deauthenticated");
4234 mlme_deauthenticate_indication(
4235 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
4236 sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
4237 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
4238 ap_free_sta(hapd, sta);
4239}
4240
4241
4242static void handle_beacon(struct hostapd_data *hapd,
b57e086c 4243 const struct ieee80211_mgmt *mgmt, size_t len,
6fc6879b
JM		 4244 struct hostapd_frame_info *fi)
4245{
4246 struct ieee802_11_elems elems;
4247
4248 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
61323e70
JM		 4249 wpa_printf(MSG_INFO, "handle_beacon - too short payload (len=%lu)",
4250 (unsigned long) len);
6fc6879b
JM		 4251 return;
4252 }
4253
3d536eb4 4254 (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
6fc6879b
JM		 4255 len - (IEEE80211_HDRLEN +
4256 sizeof(mgmt->u.beacon)), &elems,
4257 0);
4258
6fc6879b
JM		 4259 ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
4260}
4261
4262
5d22a1d5 4263#ifdef CONFIG_IEEE80211W
c4e281fd
JM		 4264static int robust_action_frame(u8 category)
4265{
4266 return category != WLAN_ACTION_PUBLIC &&
4267 category != WLAN_ACTION_HT;
4268}
9f64b827 4269#endif /* CONFIG_IEEE80211W */
c4e281fd
JM		 4270
4271
912b34f0 4272static int handle_action(struct hostapd_data *hapd,
c5cc7a59
JM		 4273 const struct ieee80211_mgmt *mgmt, size_t len,
4274 unsigned int freq)
6fc6879b 4275{
c4e281fd 4276 struct sta_info *sta;
e0785ebb 4277 u8 *action __maybe_unused;
c4e281fd 4278
e0785ebb 4279 if (len < IEEE80211_HDRLEN + 2 + 1) {
6fc6879b
JM		 4280 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4281 HOSTAPD_LEVEL_DEBUG,
4282 "handle_action - too short payload (len=%lu)",
4283 (unsigned long) len);
912b34f0 4284 return 0;
6fc6879b
JM		 4285 }
4286
e0785ebb
JM		 4287 action = (u8 *) &mgmt->u.action.u;
4288 wpa_printf(MSG_DEBUG, "RX_ACTION category %u action %u sa " MACSTR
4289 " da " MACSTR " len %d freq %u",
4290 mgmt->u.action.category, *action,
4291 MAC2STR(mgmt->sa), MAC2STR(mgmt->da), (int) len, freq);
4292
4293 sta = ap_get_sta(hapd, mgmt->sa);
4294
c79938a5
JM		 4295 if (mgmt->u.action.category != WLAN_ACTION_PUBLIC &&
4296 (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))) {
4297 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored Action "
4298 "frame (category=%u) from unassociated STA " MACSTR,
ae26d302 4299 mgmt->u.action.category, MAC2STR(mgmt->sa));
912b34f0 4300 return 0;
c79938a5
JM		 4301 }
4302
c4e281fd
JM		 4303#ifdef CONFIG_IEEE80211W
4304 if (sta && (sta->flags & WLAN_STA_MFP) &&
7b2c42f8
JM		 4305 !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP)) &&
4306 robust_action_frame(mgmt->u.action.category)) {
c4e281fd
JM		 4307 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4308 HOSTAPD_LEVEL_DEBUG,
4309 "Dropped unprotected Robust Action frame from "
4310 "an MFP STA");
912b34f0 4311 return 0;
c4e281fd
JM		 4312 }
4313#endif /* CONFIG_IEEE80211W */
4314
38cb0a2d
IP		 4315 if (sta) {
4316 u16 fc = le_to_host16(mgmt->frame_control);
4317 u16 seq_ctrl = le_to_host16(mgmt->seq_ctrl);
4318
4319 if ((fc & WLAN_FC_RETRY) &&
4320 sta->last_seq_ctrl != WLAN_INVALID_MGMT_SEQ &&
4321 sta->last_seq_ctrl == seq_ctrl &&
4322 sta->last_subtype == WLAN_FC_STYPE_ACTION) {
4323 hostapd_logger(hapd, sta->addr,
4324 HOSTAPD_MODULE_IEEE80211,
4325 HOSTAPD_LEVEL_DEBUG,
4326 "Drop repeated action frame seq_ctrl=0x%x",
4327 seq_ctrl);
4328 return 1;
4329 }
4330
4331 sta->last_seq_ctrl = seq_ctrl;
4332 sta->last_subtype = WLAN_FC_STYPE_ACTION;
4333 }
4334
6fc6879b 4335 switch (mgmt->u.action.category) {
4ec1fd8e 4336#ifdef CONFIG_IEEE80211R_AP
6fc6879b 4337 case WLAN_ACTION_FT:
d6c6b1fb
JM		 4338 if (!sta ||
4339 wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
6fc6879b
JM		 4340 len - IEEE80211_HDRLEN))
4341 break;
912b34f0 4342 return 1;
4ec1fd8e 4343#endif /* CONFIG_IEEE80211R_AP */
c2a71408 4344 case WLAN_ACTION_WMM:
3ae0800c 4345 hostapd_wmm_action(hapd, mgmt, len);
912b34f0 4346 return 1;
5d22a1d5 4347#ifdef CONFIG_IEEE80211W
93b76319 4348 case WLAN_ACTION_SA_QUERY:
700b3f39
JM		 4349 ieee802_11_sa_query_action(hapd, mgmt, len);
4350 return 1;
5d22a1d5 4351#endif /* CONFIG_IEEE80211W */
b5bf84ba 4352#ifdef CONFIG_WNM_AP
c79938a5 4353 case WLAN_ACTION_WNM:
dbfb8e82
JM		 4354 ieee802_11_rx_wnm_action_ap(hapd, mgmt, len);
4355 return 1;
b5bf84ba 4356#endif /* CONFIG_WNM_AP */
037378ff
AN		 4357#ifdef CONFIG_FST
4358 case WLAN_ACTION_FST:
4359 if (hapd->iface->fst)
4360 fst_rx_action(hapd->iface->fst, mgmt, len);
94edea89
JM		 4361 else
4362 wpa_printf(MSG_DEBUG,
4363 "FST: Ignore FST Action frame - no FST attached");
037378ff
AN		 4364 return 1;
4365#endif /* CONFIG_FST */
c706d5aa 4366 case WLAN_ACTION_PUBLIC:
5ce00d09 4367 case WLAN_ACTION_PROTECTED_DUAL:
587d60d2 4368#ifdef CONFIG_IEEE80211N
fd66aa63
JM		 4369 if (len >= IEEE80211_HDRLEN + 2 &&
4370 mgmt->u.action.u.public_action.action ==
587d60d2 4371 WLAN_PA_20_40_BSS_COEX) {
587d60d2 4372 hostapd_2040_coex_action(hapd, mgmt, len);
115d5e22 4373 return 1;
587d60d2
PX		 4374 }
4375#endif /* CONFIG_IEEE80211N */
9c2b8204
JM		 4376#ifdef CONFIG_DPP
4377 if (len >= IEEE80211_HDRLEN + 6 &&
4378 mgmt->u.action.u.vs_public_action.action ==
4379 WLAN_PA_VENDOR_SPECIFIC &&
4380 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
4381 OUI_WFA &&
4382 mgmt->u.action.u.vs_public_action.variable[0] ==
4383 DPP_OUI_TYPE) {
4384 const u8 *pos, *end;
4385
dc4d271c 4386 pos = mgmt->u.action.u.vs_public_action.oui;
9c2b8204
JM		 4387 end = ((const u8 *) mgmt) + len;
4388 hostapd_dpp_rx_action(hapd, mgmt->sa, pos, end - pos,
c5cc7a59 4389 freq);
9c2b8204
JM		 4390 return 1;
4391 }
4392 if (len >= IEEE80211_HDRLEN + 2 &&
4393 (mgmt->u.action.u.public_action.action ==
4394 WLAN_PA_GAS_INITIAL_RESP ||
4395 mgmt->u.action.u.public_action.action ==
4396 WLAN_PA_GAS_COMEBACK_RESP)) {
4397 const u8 *pos, *end;
4398
4399 pos = &mgmt->u.action.u.public_action.action;
4400 end = ((const u8 *) mgmt) + len;
4401 gas_query_ap_rx(hapd->gas, mgmt->sa,
4402 mgmt->u.action.category,
4403 pos, end - pos, hapd->iface->freq);
4404 return 1;
4405 }
4406#endif /* CONFIG_DPP */
c706d5aa
JM		 4407 if (hapd->public_action_cb) {
4408 hapd->public_action_cb(hapd->public_action_cb_ctx,
4409 (u8 *) mgmt, len,
4410 hapd->iface->freq);
c706d5aa 4411 }
2d9ffe1e 4412 if (hapd->public_action_cb2) {
8dabf4bb 4413 hapd->public_action_cb2(hapd->public_action_cb2_ctx,
2d9ffe1e
JM		 4414 (u8 *) mgmt, len,
4415 hapd->iface->freq);
4416 }
4417 if (hapd->public_action_cb || hapd->public_action_cb2)
912b34f0 4418 return 1;
c706d5aa 4419 break;
e44f8bf2
JM		 4420 case WLAN_ACTION_VENDOR_SPECIFIC:
4421 if (hapd->vendor_action_cb) {
4422 if (hapd->vendor_action_cb(hapd->vendor_action_cb_ctx,
4423 (u8 *) mgmt, len,
4424 hapd->iface->freq) == 0)
912b34f0 4425 return 1;
e44f8bf2
JM		 4426 }
4427 break;
2572df34
DS		 4428 case WLAN_ACTION_RADIO_MEASUREMENT:
4429 hostapd_handle_radio_measurement(hapd, (const u8 *) mgmt, len);
4430 return 1;
6fc6879b
JM		 4431 }
4432
4433 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4434 HOSTAPD_LEVEL_DEBUG,
4435 "handle_action - unknown action category %d or invalid "
4436 "frame",
4437 mgmt->u.action.category);
81372e34
JB		 4438 if (!is_multicast_ether_addr(mgmt->da) &&
4439 !(mgmt->u.action.category & 0x80) &&
4440 !is_multicast_ether_addr(mgmt->sa)) {
b57e086c
JM		 4441 struct ieee80211_mgmt *resp;
4442
6fc6879b
JM		 4443 /*
4444 * IEEE 802.11-REVma/D9.0 - 7.3.1.11
4445 * Return the Action frame to the source without change
4446 * except that MSB of the Category set to 1.
4447 */
4448 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
4449 "frame back to sender");
a1f11e34 4450 resp = os_memdup(mgmt, len);
b57e086c 4451 if (resp == NULL)
912b34f0 4452 return 0;
b57e086c
JM		 4453 os_memcpy(resp->da, resp->sa, ETH_ALEN);
4454 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
4455 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
4456 resp->u.action.category |= 0x80;
4457
41fe8b42
JM		 4458 if (hostapd_drv_send_mlme(hapd, resp, len, 0) < 0) {
4459 wpa_printf(MSG_ERROR, "IEEE 802.11: Failed to send "
4460 "Action frame");
4461 }
b57e086c 4462 os_free(resp);
6fc6879b 4463 }
912b34f0
JM		 4464
4465 return 1;
6fc6879b
JM		 4466}
4467
4468
4469/**
4470 * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
4471 * @hapd: hostapd BSS data structure (the BSS to which the management frame was
4472 * sent to)
4473 * @buf: management frame data (starting from IEEE 802.11 header)
4474 * @len: length of frame data in octets
a17df5fb 4475 * @fi: meta data about received frame (signal level, etc.)
6fc6879b
JM		 4476 *
4477 * Process all incoming IEEE 802.11 management frames. This will be called for
4478 * each frame received from the kernel driver through wlan#ap interface. In
4479 * addition, it can be called to re-inserted pending frames (e.g., when using
4480 * external RADIUS server as an MAC ACL).
4481 */
912b34f0
JM		 4482int ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
4483 struct hostapd_frame_info *fi)
6fc6879b 4484{
f8b1f695 4485 struct ieee80211_mgmt *mgmt;
f8b1f695 4486 u16 fc, stype;
912b34f0 4487 int ret = 0;
c5cc7a59 4488 unsigned int freq;
659ac96d 4489 int ssi_signal = fi ? fi->ssi_signal : 0;
f8b1f695 4490
cbcf92b4 4491 if (len < 24)
912b34f0 4492 return 0;
cbcf92b4 4493
c5cc7a59
JM		 4494 if (fi && fi->freq)
4495 freq = fi->freq;
4496 else
4497 freq = hapd->iface->freq;
4498
f8b1f695
JM		 4499 mgmt = (struct ieee80211_mgmt *) buf;
4500 fc = le_to_host16(mgmt->frame_control);
4501 stype = WLAN_FC_GET_STYPE(fc);
6fc6879b
JM		 4502
4503 if (stype == WLAN_FC_STYPE_BEACON) {
4504 handle_beacon(hapd, mgmt, len, fi);
912b34f0 4505 return 1;
6fc6879b
JM		 4506 }
4507
842c5af5 4508 if (!is_broadcast_ether_addr(mgmt->bssid) &&
3eeee931
AN		 4509#ifdef CONFIG_P2P
4510 /* Invitation responses can be sent with the peer MAC as BSSID */
4511 !((hapd->conf->p2p & P2P_GROUP_OWNER) &&
4512 stype == WLAN_FC_STYPE_ACTION) &&
4513#endif /* CONFIG_P2P */
f3e9899e
BC		 4514#ifdef CONFIG_MESH
4515 !(hapd->conf->mesh & MESH_ENABLED) &&
4516#endif /* CONFIG_MESH */
fe2c5241 4517 os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
61323e70
JM		 4518 wpa_printf(MSG_INFO, "MGMT: BSSID=" MACSTR " not our address",
4519 MAC2STR(mgmt->bssid));
912b34f0 4520 return 0;
6fc6879b
JM		 4521 }
4522
4523
4524 if (stype == WLAN_FC_STYPE_PROBE_REQ) {
659ac96d 4525 handle_probe_req(hapd, mgmt, len, ssi_signal);
912b34f0 4526 return 1;
6fc6879b
JM		 4527 }
4528
efeada91
JM		 4529 if ((!is_broadcast_ether_addr(mgmt->da) ||
4530 stype != WLAN_FC_STYPE_ACTION) &&
4531 os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
6fc6879b
JM		 4532 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4533 HOSTAPD_LEVEL_DEBUG,
4534 "MGMT: DA=" MACSTR " not our address",
4535 MAC2STR(mgmt->da));
912b34f0 4536 return 0;
6fc6879b
JM		 4537 }
4538
b308a304 4539 if (hapd->iconf->track_sta_max_num)
659ac96d 4540 sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
b308a304 4541
6fc6879b
JM		 4542 switch (stype) {
4543 case WLAN_FC_STYPE_AUTH:
4544 wpa_printf(MSG_DEBUG, "mgmt::auth");
ff9f40ae 4545 handle_auth(hapd, mgmt, len, ssi_signal, 0);
912b34f0 4546 ret = 1;
6fc6879b
JM		 4547 break;
4548 case WLAN_FC_STYPE_ASSOC_REQ:
4549 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
076f1ea1 4550 handle_assoc(hapd, mgmt, len, 0, ssi_signal);
912b34f0 4551 ret = 1;
6fc6879b 4552 break;
6fc6879b
JM		 4553 case WLAN_FC_STYPE_REASSOC_REQ:
4554 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
076f1ea1 4555 handle_assoc(hapd, mgmt, len, 1, ssi_signal);
912b34f0 4556 ret = 1;
6fc6879b
JM		 4557 break;
4558 case WLAN_FC_STYPE_DISASSOC:
4559 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
4560 handle_disassoc(hapd, mgmt, len);
912b34f0 4561 ret = 1;
6fc6879b
JM		 4562 break;
4563 case WLAN_FC_STYPE_DEAUTH:
3ec1e902 4564 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "mgmt::deauth");
6fc6879b 4565 handle_deauth(hapd, mgmt, len);
912b34f0 4566 ret = 1;
6fc6879b
JM		 4567 break;
4568 case WLAN_FC_STYPE_ACTION:
4569 wpa_printf(MSG_DEBUG, "mgmt::action");
c5cc7a59 4570 ret = handle_action(hapd, mgmt, len, freq);
6fc6879b
JM		 4571 break;
4572 default:
4573 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
4574 HOSTAPD_LEVEL_DEBUG,
4575 "unknown mgmt frame subtype %d", stype);
4576 break;
4577 }
912b34f0
JM		 4578
4579 return ret;
6fc6879b
JM		 4580}
4581
4582
4583static void handle_auth_cb(struct hostapd_data *hapd,
f8b1f695 4584 const struct ieee80211_mgmt *mgmt,
6fc6879b
JM		 4585 size_t len, int ok)
4586{
4587 u16 auth_alg, auth_transaction, status_code;
4588 struct sta_info *sta;
4589
bb598c3b
AB		 4590 sta = ap_get_sta(hapd, mgmt->da);
4591 if (!sta) {
dc1b1c8d
JM		 4592 wpa_printf(MSG_DEBUG, "handle_auth_cb: STA " MACSTR
4593 " not found",
bb598c3b
AB		 4594 MAC2STR(mgmt->da));
4595 return;
4596 }
4597
4598 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
4599 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
4600 status_code = le_to_host16(mgmt->u.auth.status_code);
4601
6fc6879b
JM		 4602 if (!ok) {
4603 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
4604 HOSTAPD_LEVEL_NOTICE,
4605 "did not acknowledge authentication response");
bb598c3b 4606 goto fail;
6fc6879b
JM		 4607 }
4608
4609 if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
61323e70
JM		 4610 wpa_printf(MSG_INFO, "handle_auth_cb - too short payload (len=%lu)",
4611 (unsigned long) len);
bb598c3b 4612 goto fail;
6fc6879b
JM		 4613 }
4614
4615 if (status_code == WLAN_STATUS_SUCCESS &&
4616 ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
4617 (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
4618 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4619 HOSTAPD_LEVEL_INFO, "authenticated");
4620 sta->flags |= WLAN_STA_AUTH;
bb598c3b
AB		 4621 if (sta->added_unassoc)
4622 hostapd_set_sta_flags(hapd, sta);
4623 return;
4624 }
4625
4626fail:
4627 if (status_code != WLAN_STATUS_SUCCESS && sta->added_unassoc) {
4628 hostapd_drv_sta_remove(hapd, sta->addr);
4629 sta->added_unassoc = 0;
6fc6879b
JM		 4630 }
4631}
4632
4633
69dd2967
SM		 4634static void hostapd_set_wds_encryption(struct hostapd_data *hapd,
4635 struct sta_info *sta,
4636 char *ifname_wds)
4637{
4638 int i;
f41ded6f 4639 struct hostapd_ssid *ssid = &hapd->conf->ssid;
69dd2967
SM		 4640
4641 if (hapd->conf->ieee802_1x || hapd->conf->wpa)
4642 return;
4643
4644 for (i = 0; i < 4; i++) {
4645 if (ssid->wep.key[i] &&
4646 hostapd_drv_set_key(ifname_wds, hapd, WPA_ALG_WEP, NULL, i,
4647 i == ssid->wep.idx, NULL, 0,
4648 ssid->wep.key[i], ssid->wep.len[i])) {
4649 wpa_printf(MSG_WARNING,
4650 "Could not set WEP keys for WDS interface; %s",
4651 ifname_wds);
4652 break;
4653 }
4654 }
4655}
4656
4657
6fc6879b 4658static void handle_assoc_cb(struct hostapd_data *hapd,
f8b1f695 4659 const struct ieee80211_mgmt *mgmt,
6fc6879b
JM		 4660 size_t len, int reassoc, int ok)
4661{
4662 u16 status;
4663 struct sta_info *sta;
4664 int new_assoc = 1;
4665
6fc6879b
JM		 4666 sta = ap_get_sta(hapd, mgmt->da);
4667 if (!sta) {
61323e70
JM		 4668 wpa_printf(MSG_INFO, "handle_assoc_cb: STA " MACSTR " not found",
4669 MAC2STR(mgmt->da));
6fc6879b
JM		 4670 return;
4671 }
4672
bb598c3b
AB		 4673 if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
4674 sizeof(mgmt->u.assoc_resp))) {
4675 wpa_printf(MSG_INFO,
4676 "handle_assoc_cb(reassoc=%d) - too short payload (len=%lu)",
4677 reassoc, (unsigned long) len);
3f81ac07
AO		 4678 hostapd_drv_sta_remove(hapd, sta->addr);
4679 return;
bb598c3b
AB		 4680 }
4681
3f81ac07
AO		 4682 if (reassoc)
4683 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
4684 else
4685 status = le_to_host16(mgmt->u.assoc_resp.status_code);
4686
22b42372
FF		 4687 if (!ok) {
4688 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
4689 HOSTAPD_LEVEL_DEBUG,
4690 "did not acknowledge association response");
4691 sta->flags &= ~WLAN_STA_ASSOC_REQ_OK;
3f81ac07
AO		 4692 /* The STA is added only in case of SUCCESS */
4693 if (status == WLAN_STATUS_SUCCESS)
4694 hostapd_drv_sta_remove(hapd, sta->addr);
22b42372 4695
3f81ac07
AO		 4696 return;
4697 }
22b42372 4698
6fc6879b 4699 if (status != WLAN_STATUS_SUCCESS)
5bdac4ab 4700 return;
6fc6879b
JM		 4701
4702 /* Stop previous accounting session, if one is started, and allocate
4703 * new session id for the new session. */
4704 accounting_sta_stop(hapd, sta);
6fc6879b
JM		 4705
4706 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
4707 HOSTAPD_LEVEL_INFO,
2fc98d02
JM		 4708 "associated (aid %d)",
4709 sta->aid);
6fc6879b
JM		 4710
4711 if (sta->flags & WLAN_STA_ASSOC)
4712 new_assoc = 0;
4713 sta->flags |= WLAN_STA_ASSOC;
3578e665 4714 sta->flags &= ~WLAN_STA_WNM_SLEEP_MODE;
07e0117d
JM		 4715 if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa &&
4716 !hapd->conf->osen) ||
4717 sta->auth_alg == WLAN_AUTH_FILS_SK ||
4718 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4719 sta->auth_alg == WLAN_AUTH_FILS_PK ||
ef580012
JM		 4720 sta->auth_alg == WLAN_AUTH_FT) {
4721 /*
07e0117d
JM		 4722 * Open, static WEP, FT protocol, or FILS; no separate
4723 * authorization step.
ef580012 4724 */
6905dcb1 4725 ap_sta_set_authorized(hapd, sta, 1);
515cf93f 4726 }
6fc6879b
JM		 4727
4728 if (reassoc)
4729 mlme_reassociate_indication(hapd, sta);
4730 else
4731 mlme_associate_indication(hapd, sta);
4732
5d22a1d5 4733#ifdef CONFIG_IEEE80211W
93b76319 4734 sta->sa_query_timed_out = 0;
5d22a1d5
JM		 4735#endif /* CONFIG_IEEE80211W */
4736
6fc6879b
JM		 4737 if (sta->eapol_sm == NULL) {
4738 /*
4739 * This STA does not use RADIUS server for EAP authentication,
4740 * so bind it to the selected VLAN interface now, since the
4741 * interface selection is not going to change anymore.
4742 */
c8e6beab 4743 if (ap_sta_bind_vlan(hapd, sta) < 0)
5bdac4ab 4744 return;
6fc6879b
JM		 4745 } else if (sta->vlan_id) {
4746 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
c8e6beab 4747 if (ap_sta_bind_vlan(hapd, sta) < 0)
5bdac4ab 4748 return;
6fc6879b 4749 }
eddd8010 4750
0e8a96a9 4751 hostapd_set_sta_flags(hapd, sta);
6fc6879b 4752
1f0fdaf0
JM		 4753 if (!(sta->flags & WLAN_STA_WDS) && sta->pending_wds_enable) {
4754 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for STA "
4755 MACSTR " based on pending request",
4756 MAC2STR(sta->addr));
4757 sta->pending_wds_enable = 0;
4758 sta->flags |= WLAN_STA_WDS;
4759 }
4760
9c06f0f6 4761 if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP)) {
cb2b6666
JM		 4762 int ret;
4763 char ifname_wds[IFNAMSIZ + 1];
4764
4765 wpa_printf(MSG_DEBUG, "Reenable 4-address WDS mode for STA "
4766 MACSTR " (aid %u)",
4767 MAC2STR(sta->addr), sta->aid);
4768 ret = hostapd_set_wds_sta(hapd, ifname_wds, sta->addr,
4769 sta->aid, 1);
4770 if (!ret)
4771 hostapd_set_wds_encryption(hapd, sta, ifname_wds);
4772 }
4773
6fc6879b
JM		 4774 if (sta->auth_alg == WLAN_AUTH_FT)
4775 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
4776 else
4777 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
d24df7c3 4778 hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
6fc6879b 4779 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
f2accfe7 4780
da24c5aa
JM		 4781#ifdef CONFIG_FILS
4782 if ((sta->auth_alg == WLAN_AUTH_FILS_SK ||
4783 sta->auth_alg == WLAN_AUTH_FILS_SK_PFS ||
4784 sta->auth_alg == WLAN_AUTH_FILS_PK) &&
4785 fils_set_tk(sta->wpa_sm) < 0) {
4786 wpa_printf(MSG_DEBUG, "FILS: TK configuration failed");
4787 ap_sta_disconnect(hapd, sta, sta->addr,
4788 WLAN_REASON_UNSPECIFIED);
4789 return;
4790 }
4791#endif /* CONFIG_FILS */
4792
f2accfe7
EP		 4793 if (sta->pending_eapol_rx) {
4794 struct os_reltime now, age;
4795
4796 os_get_reltime(&now);
4797 os_reltime_sub(&now, &sta->pending_eapol_rx->rx_time, &age);
4798 if (age.sec == 0 && age.usec < 200000) {
4799 wpa_printf(MSG_DEBUG,
4800 "Process pending EAPOL frame that was received from " MACSTR " just before association notification",
4801 MAC2STR(sta->addr));
4802 ieee802_1x_receive(
4803 hapd, mgmt->da,
4804 wpabuf_head(sta->pending_eapol_rx->buf),
4805 wpabuf_len(sta->pending_eapol_rx->buf));
4806 }
4807 wpabuf_free(sta->pending_eapol_rx->buf);
4808 os_free(sta->pending_eapol_rx);
4809 sta->pending_eapol_rx = NULL;
4810 }
6fc6879b
JM		 4811}
4812
4813
4dc03726
JM		 4814static void handle_deauth_cb(struct hostapd_data *hapd,
4815 const struct ieee80211_mgmt *mgmt,
4816 size_t len, int ok)
4817{
4818 struct sta_info *sta;
81372e34 4819 if (is_multicast_ether_addr(mgmt->da))
4dc03726
JM		 4820 return;
4821 sta = ap_get_sta(hapd, mgmt->da);
4822 if (!sta) {
4823 wpa_printf(MSG_DEBUG, "handle_deauth_cb: STA " MACSTR
4824 " not found", MAC2STR(mgmt->da));
4825 return;
4826 }
4827 if (ok)
4828 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged deauth",
4829 MAC2STR(sta->addr));
4830 else
4831 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4832 "deauth", MAC2STR(sta->addr));
4833
4834 ap_sta_deauth_cb(hapd, sta);
4835}
4836
4837
4838static void handle_disassoc_cb(struct hostapd_data *hapd,
4839 const struct ieee80211_mgmt *mgmt,
4840 size_t len, int ok)
4841{
4842 struct sta_info *sta;
81372e34 4843 if (is_multicast_ether_addr(mgmt->da))
4dc03726
JM		 4844 return;
4845 sta = ap_get_sta(hapd, mgmt->da);
4846 if (!sta) {
4847 wpa_printf(MSG_DEBUG, "handle_disassoc_cb: STA " MACSTR
4848 " not found", MAC2STR(mgmt->da));
4849 return;
4850 }
4851 if (ok)
4852 wpa_printf(MSG_DEBUG, "STA " MACSTR " acknowledged disassoc",
4853 MAC2STR(sta->addr));
4854 else
4855 wpa_printf(MSG_DEBUG, "STA " MACSTR " did not acknowledge "
4856 "disassoc", MAC2STR(sta->addr));
4857
4858 ap_sta_disassoc_cb(hapd, sta);
4859}
4860
4861
f3383366
JM		 4862static void handle_action_cb(struct hostapd_data *hapd,
4863 const struct ieee80211_mgmt *mgmt,
4864 size_t len, int ok)
4865{
4866 struct sta_info *sta;
167f78a5 4867 const struct rrm_measurement_report_element *report;
f3383366
JM		 4868
4869 if (is_multicast_ether_addr(mgmt->da))
4870 return;
9c2b8204
JM		 4871#ifdef CONFIG_DPP
4872 if (len >= IEEE80211_HDRLEN + 6 &&
4873 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4874 mgmt->u.action.u.vs_public_action.action ==
4875 WLAN_PA_VENDOR_SPECIFIC &&
4876 WPA_GET_BE24(mgmt->u.action.u.vs_public_action.oui) ==
4877 OUI_WFA &&
4878 mgmt->u.action.u.vs_public_action.variable[0] ==
4879 DPP_OUI_TYPE) {
4880 const u8 *pos, *end;
4881
4882 pos = &mgmt->u.action.u.vs_public_action.variable[1];
4883 end = ((const u8 *) mgmt) + len;
4884 hostapd_dpp_tx_status(hapd, mgmt->da, pos, end - pos, ok);
4885 return;
4886 }
4887 if (len >= IEEE80211_HDRLEN + 2 &&
4888 mgmt->u.action.category == WLAN_ACTION_PUBLIC &&
4889 (mgmt->u.action.u.public_action.action ==
4890 WLAN_PA_GAS_INITIAL_REQ ||
4891 mgmt->u.action.u.public_action.action ==
4892 WLAN_PA_GAS_COMEBACK_REQ)) {
4893 const u8 *pos, *end;
4894
4895 pos = mgmt->u.action.u.public_action.variable;
4896 end = ((const u8 *) mgmt) + len;
4897 gas_query_ap_tx_status(hapd->gas, mgmt->da, pos, end - pos, ok);
4898 return;
4899 }
4900#endif /* CONFIG_DPP */
f3383366
JM		 4901 sta = ap_get_sta(hapd, mgmt->da);
4902 if (!sta) {
4903 wpa_printf(MSG_DEBUG, "handle_action_cb: STA " MACSTR
4904 " not found", MAC2STR(mgmt->da));
4905 return;
4906 }
4907
167f78a5 4908 if (len < 24 + 5 + sizeof(*report))
f3383366 4909 return;
167f78a5
JM		 4910 report = (const struct rrm_measurement_report_element *)
4911 &mgmt->u.action.u.rrm.variable[2];
f3383366 4912 if (mgmt->u.action.category == WLAN_ACTION_RADIO_MEASUREMENT &&
167f78a5
JM		 4913 mgmt->u.action.u.rrm.action == WLAN_RRM_RADIO_MEASUREMENT_REQUEST &&
4914 report->eid == WLAN_EID_MEASURE_REQUEST &&
4915 report->len >= 3 &&
4916 report->type == MEASURE_TYPE_BEACON)
f3383366
JM		 4917 hostapd_rrm_beacon_req_tx_status(hapd, mgmt, len, ok);
4918}
4919
4920
1c6e69cc
JM		 4921/**
4922 * ieee802_11_mgmt_cb - Process management frame TX status callback
4923 * @hapd: hostapd BSS data structure (the BSS from which the management frame
4924 * was sent from)
4925 * @buf: management frame data (starting from IEEE 802.11 header)
4926 * @len: length of frame data in octets
4927 * @stype: management frame subtype from frame control field
4928 * @ok: Whether the frame was ACK'ed
4929 */
f8b1f695 4930void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
6fc6879b
JM		 4931 u16 stype, int ok)
4932{
f8b1f695
JM		 4933 const struct ieee80211_mgmt *mgmt;
4934 mgmt = (const struct ieee80211_mgmt *) buf;
6fc6879b 4935
93827f45
JM		 4936#ifdef CONFIG_TESTING_OPTIONS
4937 if (hapd->ext_mgmt_frame_handling) {
df949062
JM		 4938 size_t hex_len = 2 * len + 1;
4939 char *hex = os_malloc(hex_len);
4940
4941 if (hex) {
4942 wpa_snprintf_hex(hex, hex_len, buf, len);
4943 wpa_msg(hapd->msg_ctx, MSG_INFO,
4944 "MGMT-TX-STATUS stype=%u ok=%d buf=%s",
4945 stype, ok, hex);
4946 os_free(hex);
4947 }
93827f45
JM		 4948 return;
4949 }
4950#endif /* CONFIG_TESTING_OPTIONS */
4951
6fc6879b
JM		 4952 switch (stype) {
4953 case WLAN_FC_STYPE_AUTH:
4954 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
4955 handle_auth_cb(hapd, mgmt, len, ok);
4956 break;
4957 case WLAN_FC_STYPE_ASSOC_RESP:
4958 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
4959 handle_assoc_cb(hapd, mgmt, len, 0, ok);
4960 break;
4961 case WLAN_FC_STYPE_REASSOC_RESP:
4962 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
4963 handle_assoc_cb(hapd, mgmt, len, 1, ok);
4964 break;
4965 case WLAN_FC_STYPE_PROBE_RESP:
077dcfb8 4966 wpa_printf(MSG_EXCESSIVE, "mgmt::proberesp cb ok=%d", ok);
6fc6879b
JM		 4967 break;
4968 case WLAN_FC_STYPE_DEAUTH:
4dc03726
JM		 4969 wpa_printf(MSG_DEBUG, "mgmt::deauth cb");
4970 handle_deauth_cb(hapd, mgmt, len, ok);
4971 break;
4972 case WLAN_FC_STYPE_DISASSOC:
4973 wpa_printf(MSG_DEBUG, "mgmt::disassoc cb");
4974 handle_disassoc_cb(hapd, mgmt, len, ok);
6fc6879b 4975 break;
5d22a1d5 4976 case WLAN_FC_STYPE_ACTION:
077dcfb8 4977 wpa_printf(MSG_DEBUG, "mgmt::action cb ok=%d", ok);
f3383366 4978 handle_action_cb(hapd, mgmt, len, ok);
5d22a1d5 4979 break;
6fc6879b 4980 default:
61323e70 4981 wpa_printf(MSG_INFO, "unknown mgmt cb frame subtype %d", stype);
6fc6879b
JM		 4982 break;
4983 }
4984}
4985
4986
6fc6879b
JM		 4987int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
4988{
4989 /* TODO */
4990 return 0;
4991}
4992
4993
4994int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
4995 char *buf, size_t buflen)
4996{
4997 /* TODO */
4998 return 0;
4999}
5000
f8b1f695
JM		 5001
5002void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
5003 const u8 *buf, size_t len, int ack)
5004{
5005 struct sta_info *sta;
5006 struct hostapd_iface *iface = hapd->iface;
5007
5008 sta = ap_get_sta(hapd, addr);
5009 if (sta == NULL && iface->num_bss > 1) {
5010 size_t j;
5011 for (j = 0; j < iface->num_bss; j++) {
5012 hapd = iface->bss[j];
5013 sta = ap_get_sta(hapd, addr);
5014 if (sta)
5015 break;
5016 }
5017 }
0c01d65d 5018 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC))
f8b1f695
JM		 5019 return;
5020 if (sta->flags & WLAN_STA_PENDING_POLL) {
5021 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
5022 "activity poll", MAC2STR(sta->addr),
5023 ack ? "ACKed" : "did not ACK");
5024 if (ack)
5025 sta->flags &= ~WLAN_STA_PENDING_POLL;
5026 }
5027
5028 ieee802_1x_tx_status(hapd, sta, buf, len, ack);
5029}
5030
5031
dd840f79
JB		 5032void hostapd_eapol_tx_status(struct hostapd_data *hapd, const u8 *dst,
5033 const u8 *data, size_t len, int ack)
5034{
5035 struct sta_info *sta;
5036 struct hostapd_iface *iface = hapd->iface;
5037
5038 sta = ap_get_sta(hapd, dst);
5039 if (sta == NULL && iface->num_bss > 1) {
5040 size_t j;
5041 for (j = 0; j < iface->num_bss; j++) {
5042 hapd = iface->bss[j];
5043 sta = ap_get_sta(hapd, dst);
5044 if (sta)
5045 break;
5046 }
5047 }
d9a38716
JM		 5048 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
5049 wpa_printf(MSG_DEBUG, "Ignore TX status for Data frame to STA "
5050 MACSTR " that is not currently associated",
5051 MAC2STR(dst));
dd840f79 5052 return;
d9a38716 5053 }
dd840f79
JB		 5054
5055 ieee802_1x_eapol_tx_status(hapd, sta, data, len, ack);
5056}
5057
5058
bcf24348
JB		 5059void hostapd_client_poll_ok(struct hostapd_data *hapd, const u8 *addr)
5060{
5061 struct sta_info *sta;
5062 struct hostapd_iface *iface = hapd->iface;
5063
5064 sta = ap_get_sta(hapd, addr);
5065 if (sta == NULL && iface->num_bss > 1) {
5066 size_t j;
5067 for (j = 0; j < iface->num_bss; j++) {
5068 hapd = iface->bss[j];
5069 sta = ap_get_sta(hapd, addr);
5070 if (sta)
5071 break;
5072 }
5073 }
5074 if (sta == NULL)
5075 return;
1854eeca
JM		 5076 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_POLL_OK MACSTR,
5077 MAC2STR(sta->addr));
bcf24348
JB		 5078 if (!(sta->flags & WLAN_STA_PENDING_POLL))
5079 return;
5080
5081 wpa_printf(MSG_DEBUG, "STA " MACSTR " ACKed pending "
5082 "activity poll", MAC2STR(sta->addr));
5083 sta->flags &= ~WLAN_STA_PENDING_POLL;
5084}
5085
5086
fbbfcbac
FF		 5087void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
5088 int wds)
f8b1f695
JM		 5089{
5090 struct sta_info *sta;
5091
5092 sta = ap_get_sta(hapd, src);
1f0fdaf0
JM		 5093 if (sta &&
5094 ((sta->flags & WLAN_STA_ASSOC) ||
5095 ((sta->flags & WLAN_STA_ASSOC_REQ_OK) && wds))) {
99743811
FF		 5096 if (!hapd->conf->wds_sta)
5097 return;
5098
1f0fdaf0
JM		 5099 if ((sta->flags & (WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK)) ==
5100 WLAN_STA_ASSOC_REQ_OK) {
5101 wpa_printf(MSG_DEBUG,
5102 "Postpone 4-address WDS mode enabling for STA "
5103 MACSTR " since TX status for AssocResp is not yet known",
5104 MAC2STR(sta->addr));
5105 sta->pending_wds_enable = 1;
5106 return;
5107 }
5108
fbbfcbac 5109 if (wds && !(sta->flags & WLAN_STA_WDS)) {
69dd2967
SM		 5110 int ret;
5111 char ifname_wds[IFNAMSIZ + 1];
5112
fbbfcbac
FF		 5113 wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
5114 "STA " MACSTR " (aid %u)",
5115 MAC2STR(sta->addr), sta->aid);
5116 sta->flags |= WLAN_STA_WDS;
69dd2967
SM		 5117 ret = hostapd_set_wds_sta(hapd, ifname_wds,
5118 sta->addr, sta->aid, 1);
5119 if (!ret)
5120 hostapd_set_wds_encryption(hapd, sta,
5121 ifname_wds);
fbbfcbac 5122 }
f8b1f695 5123 return;
fbbfcbac 5124 }
f8b1f695
JM		 5125
5126 wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
5127 MACSTR, MAC2STR(src));
81372e34 5128 if (is_multicast_ether_addr(src)) {
1df492df
JM		 5129 /* Broadcast bit set in SA?! Ignore the frame silently. */
5130 return;
5131 }
5132
b8281964
JM		 5133 if (sta && (sta->flags & WLAN_STA_ASSOC_REQ_OK)) {
5134 wpa_printf(MSG_DEBUG, "Association Response to the STA has "
5135 "already been sent, but no TX status yet known - "
5136 "ignore Class 3 frame issue with " MACSTR,
5137 MAC2STR(src));
5138 return;
5139 }
5140
f8b1f695 5141 if (sta && (sta->flags & WLAN_STA_AUTH))
51e2a27a 5142 hostapd_drv_sta_disassoc(
f8b1f695
JM		 5143 hapd, src,
5144 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
5145 else
51e2a27a 5146 hostapd_drv_sta_deauth(
f8b1f695
JM		 5147 hapd, src,
5148 WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
5149}
5150
5151
6fc6879b 5152#endif /* CONFIG_NATIVE_WINDOWS */
Unnamed repository; edit this file 'description' to name the repository.