contrib/wpa/wpa_supplicant/mlme.c

   1 /*
   2  * WPA Supplicant - Client mode MLME
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18
  19 #include "common.h"
  20 #include "eloop.h"
  21 #include "config_ssid.h"
  22 #include "wpa_supplicant_i.h"
  23 #include "wpa.h"
  24 #include "drivers/driver.h"
  25 #include "ieee802_11_defs.h"
  26 #include "ieee802_11_common.h"
  27 #include "mlme.h"
  28
  29
  30 /* Timeouts and intervals in milliseconds */
  31 #define IEEE80211_AUTH_TIMEOUT (200)
  32 #define IEEE80211_AUTH_MAX_TRIES 3
  33 #define IEEE80211_ASSOC_TIMEOUT (200)
  34 #define IEEE80211_ASSOC_MAX_TRIES 3
  35 #define IEEE80211_MONITORING_INTERVAL (2000)
  36 #define IEEE80211_PROBE_INTERVAL (60000)
  37 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
  38 #define IEEE80211_SCAN_INTERVAL (2000)
  39 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
  40 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
  41
  42 #define IEEE80211_PROBE_DELAY (33)
  43 #define IEEE80211_CHANNEL_TIME (33)
  44 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
  45 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
  46 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
  47 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
  48
  49 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
  50
  51
  52 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
  53
  54
  55 struct ieee80211_sta_bss {
  56         struct ieee80211_sta_bss *next;
  57         struct ieee80211_sta_bss *hnext;
  58
  59         u8 bssid[ETH_ALEN];
  60         u8 ssid[MAX_SSID_LEN];
  61         size_t ssid_len;
  62         u16 capability; /* host byte order */
  63         int hw_mode;
  64         int channel;
  65         int freq;
  66         int rssi;
  67         u8 *ie;
  68         size_t ie_len;
  69         u8 *wpa_ie;
  70         size_t wpa_ie_len;
  71         u8 *rsn_ie;
  72         size_t rsn_ie_len;
  73         u8 *wmm_ie;
  74         size_t wmm_ie_len;
  75         u8 *mdie;
  76         size_t mdie_len;
  77 #define IEEE80211_MAX_SUPP_RATES 32
  78         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
  79         size_t supp_rates_len;
  80         int beacon_int;
  81         u64 timestamp;
  82
  83         int probe_resp;
  84         struct os_time last_update;
  85 };
  86
  87
  88 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
  89                                      const u8 *dst,
  90                                      const u8 *ssid, size_t ssid_len);
  91 static struct ieee80211_sta_bss *
  92 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
  93 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
  94 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
  95 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
  96 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
  97
  98
  99 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
 100                                      wpa_hw_mode phymode, int chan,
 101                                      int freq)
 102 {
 103         size_t i;
 104         struct wpa_hw_modes *mode;
 105
 106         for (i = 0; i < wpa_s->mlme.num_modes; i++) {
 107                 mode = &wpa_s->mlme.modes[i];
 108                 if (mode->mode == phymode) {
 109                         wpa_s->mlme.curr_rates = mode->rates;
 110                         wpa_s->mlme.num_curr_rates = mode->num_rates;
 111                         break;
 112                 }
 113         }
 114
 115         return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
 116 }
 117
 118
 119
 120 #if 0 /* FIX */
 121 static int ecw2cw(int ecw)
 122 {
 123         int cw = 1;
 124         while (ecw > 0) {
 125                 cw <<= 1;
 126                 ecw--;
 127         }
 128         return cw - 1;
 129 }
 130 #endif
 131
 132
 133 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
 134                                      u8 *wmm_param, size_t wmm_param_len)
 135 {
 136         size_t left;
 137         int count;
 138         u8 *pos;
 139
 140         if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
 141                 return;
 142         count = wmm_param[6] & 0x0f;
 143         if (count == wpa_s->mlme.wmm_last_param_set)
 144                 return;
 145         wpa_s->mlme.wmm_last_param_set = count;
 146
 147         pos = wmm_param + 8;
 148         left = wmm_param_len - 8;
 149
 150 #if 0 /* FIX */
 151         wmm_acm = 0;
 152         for (; left >= 4; left -= 4, pos += 4) {
 153                 int aci = (pos[0] >> 5) & 0x03;
 154                 int acm = (pos[0] >> 4) & 0x01;
 155                 int queue;
 156
 157                 switch (aci) {
 158                 case 1:
 159                         queue = IEEE80211_TX_QUEUE_DATA3;
 160                         if (acm)
 161                                 wmm_acm |= BIT(1) | BIT(2);
 162                         break;
 163                 case 2:
 164                         queue = IEEE80211_TX_QUEUE_DATA1;
 165                         if (acm)
 166                                 wmm_acm |= BIT(4) | BIT(5);
 167                         break;
 168                 case 3:
 169                         queue = IEEE80211_TX_QUEUE_DATA0;
 170                         if (acm)
 171                                 wmm_acm |= BIT(6) | BIT(7);
 172                         break;
 173                 case 0:
 174                 default:
 175                         queue = IEEE80211_TX_QUEUE_DATA2;
 176                         if (acm)
 177                                 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
 178                         break;
 179                 }
 180
 181                 params.aifs = pos[0] & 0x0f;
 182                 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
 183                 params.cw_min = ecw2cw(pos[1] & 0x0f);
 184                 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
 185                 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
 186                 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
 187                            "aifs=%d cWmin=%d cWmax=%d burst=%d",
 188                            queue, aci, acm, params.aifs, params.cw_min,
 189                            params.cw_max, params.burst_time);
 190                 /* TODO: handle ACM (block TX, fallback to next lowest allowed
 191                  * AC for now) */
 192                 if (local->hw->conf_tx(local->mdev, queue, &params)) {
 193                         wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
 194                                    "parameters for queue %d", queue);
 195                 }
 196         }
 197 #endif
 198 }
 199
 200
 201 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
 202 {
 203         if (wpa_s->mlme.associated == assoc && !assoc)
 204                 return;
 205
 206         wpa_s->mlme.associated = assoc;
 207
 208         if (assoc) {
 209                 union wpa_event_data data;
 210                 os_memset(&data, 0, sizeof(data));
 211                 wpa_s->mlme.prev_bssid_set = 1;
 212                 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
 213                 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
 214                 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
 215                 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
 216                 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
 217                 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
 218         } else {
 219                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 220         }
 221         os_get_time(&wpa_s->mlme.last_probe);
 222 }
 223
 224
 225 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
 226                             size_t len)
 227 {
 228         return wpa_drv_send_mlme(wpa_s, buf, len);
 229 }
 230
 231
 232 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
 233                                 int transaction, u8 *extra, size_t extra_len,
 234                                 int encrypt)
 235 {
 236         u8 *buf;
 237         size_t len;
 238         struct ieee80211_mgmt *mgmt;
 239
 240         buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
 241         if (buf == NULL) {
 242                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 243                            "auth frame");
 244                 return;
 245         }
 246
 247         mgmt = (struct ieee80211_mgmt *) buf;
 248         len = 24 + 6;
 249         os_memset(mgmt, 0, 24 + 6);
 250         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 251                                            WLAN_FC_STYPE_AUTH);
 252         if (encrypt)
 253                 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 254         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 255         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 256         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 257         mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
 258         mgmt->u.auth.auth_transaction = host_to_le16(transaction);
 259         wpa_s->mlme.auth_transaction = transaction + 1;
 260         mgmt->u.auth.status_code = host_to_le16(0);
 261         if (extra) {
 262                 os_memcpy(buf + len, extra, extra_len);
 263                 len += extra_len;
 264         }
 265
 266         ieee80211_sta_tx(wpa_s, buf, len);
 267         os_free(buf);
 268 }
 269
 270
 271 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
 272 {
 273         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
 274         eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
 275                                ieee80211_sta_timer, wpa_s, NULL);
 276 }
 277
 278
 279 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
 280 {
 281         u8 *extra;
 282         size_t extra_len;
 283
 284         wpa_s->mlme.auth_tries++;
 285         if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
 286                 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
 287                            " timed out", MAC2STR(wpa_s->bssid));
 288                 return;
 289         }
 290
 291         wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 292         wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
 293                    MAC2STR(wpa_s->bssid));
 294
 295         extra = NULL;
 296         extra_len = 0;
 297
 298 #ifdef CONFIG_IEEE80211R
 299         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 300              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 301             wpa_s->mlme.ft_ies) {
 302                 struct ieee80211_sta_bss *bss;
 303                 struct rsn_mdie *mdie = NULL;
 304                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 305                 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
 306                         mdie = (struct rsn_mdie *) (bss->mdie + 2);
 307                 if (mdie &&
 308                     os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
 309                               MOBILITY_DOMAIN_ID_LEN) == 0) {
 310                         wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
 311                                    "over-the-air");
 312                         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
 313                         extra = wpa_s->mlme.ft_ies;
 314                         extra_len = wpa_s->mlme.ft_ies_len;
 315                 }
 316         }
 317 #endif /* CONFIG_IEEE80211R */
 318
 319         ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
 320
 321         ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
 322 }
 323
 324
 325 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
 326 {
 327         struct ieee80211_mgmt *mgmt;
 328         u8 *pos, *ies, *buf;
 329         int i, len;
 330         u16 capab;
 331         struct ieee80211_sta_bss *bss;
 332         int wmm = 0;
 333         size_t blen, buflen;
 334
 335         if (wpa_s->mlme.curr_rates == NULL) {
 336                 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
 337                 return;
 338         }
 339
 340         buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
 341                 wpa_s->mlme.ssid_len;
 342 #ifdef CONFIG_IEEE80211R
 343         if (wpa_s->mlme.ft_ies)
 344                 buflen += wpa_s->mlme.ft_ies_len;
 345 #endif /* CONFIG_IEEE80211R */
 346         buf = os_malloc(buflen);
 347         if (buf == NULL) {
 348                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 349                            "assoc frame");
 350                 return;
 351         }
 352         blen = 0;
 353
 354         capab = wpa_s->mlme.capab;
 355         if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
 356                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
 357                         WLAN_CAPABILITY_SHORT_PREAMBLE;
 358         }
 359         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 360         if (bss) {
 361                 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
 362                         capab |= WLAN_CAPABILITY_PRIVACY;
 363                 if (bss->wmm_ie) {
 364                         wmm = 1;
 365                 }
 366         }
 367
 368         mgmt = (struct ieee80211_mgmt *) buf;
 369         blen += 24;
 370         os_memset(mgmt, 0, 24);
 371         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 372         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 373         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 374
 375         if (wpa_s->mlme.prev_bssid_set) {
 376                 blen += 10;
 377                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 378                                                    WLAN_FC_STYPE_REASSOC_REQ);
 379                 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
 380                 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
 381                 os_memcpy(mgmt->u.reassoc_req.current_ap,
 382                           wpa_s->mlme.prev_bssid,
 383                           ETH_ALEN);
 384         } else {
 385                 blen += 4;
 386                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 387                                                    WLAN_FC_STYPE_ASSOC_REQ);
 388                 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
 389                 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 390         }
 391
 392         /* SSID */
 393         ies = pos = buf + blen;
 394         blen += 2 + wpa_s->mlme.ssid_len;
 395         *pos++ = WLAN_EID_SSID;
 396         *pos++ = wpa_s->mlme.ssid_len;
 397         os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
 398
 399         len = wpa_s->mlme.num_curr_rates;
 400         if (len > 8)
 401                 len = 8;
 402         pos = buf + blen;
 403         blen += len + 2;
 404         *pos++ = WLAN_EID_SUPP_RATES;
 405         *pos++ = len;
 406         for (i = 0; i < len; i++) {
 407                 int rate = wpa_s->mlme.curr_rates[i].rate;
 408                 *pos++ = (u8) (rate / 5);
 409         }
 410
 411         if (wpa_s->mlme.num_curr_rates > len) {
 412                 pos = buf + blen;
 413                 blen += wpa_s->mlme.num_curr_rates - len + 2;
 414                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
 415                 *pos++ = wpa_s->mlme.num_curr_rates - len;
 416                 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
 417                         int rate = wpa_s->mlme.curr_rates[i].rate;
 418                         *pos++ = (u8) (rate / 5);
 419                 }
 420         }
 421
 422         if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
 423                 pos = buf + blen;
 424                 blen += wpa_s->mlme.extra_ie_len;
 425                 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
 426         }
 427
 428 #ifdef CONFIG_IEEE80211R
 429         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 430              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 431             wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
 432             bss && bss->mdie &&
 433             bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
 434             bss->mdie[1] >= sizeof(struct rsn_mdie)) {
 435                 pos = buf + blen;
 436                 blen += 2 + sizeof(struct rsn_mdie);
 437                 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
 438                 *pos++ = sizeof(struct rsn_mdie);
 439                 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
 440                 pos += MOBILITY_DOMAIN_ID_LEN;
 441                 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
 442         }
 443
 444         if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
 445              wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
 446             wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
 447                 pos = buf + blen;
 448                 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
 449                 pos += wpa_s->mlme.ft_ies_len;
 450                 blen += wpa_s->mlme.ft_ies_len;
 451         }
 452 #endif /* CONFIG_IEEE80211R */
 453
 454         if (wmm && wpa_s->mlme.wmm_enabled) {
 455                 pos = buf + blen;
 456                 blen += 9;
 457                 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
 458                 *pos++ = 7; /* len */
 459                 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
 460                 *pos++ = 0x50;
 461                 *pos++ = 0xf2;
 462                 *pos++ = 2; /* WME */
 463                 *pos++ = 0; /* WME info */
 464                 *pos++ = 1; /* WME ver */
 465                 *pos++ = 0;
 466         }
 467
 468         os_free(wpa_s->mlme.assocreq_ies);
 469         wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
 470         wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
 471         if (wpa_s->mlme.assocreq_ies) {
 472                 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
 473                           wpa_s->mlme.assocreq_ies_len);
 474         }
 475
 476         ieee80211_sta_tx(wpa_s, buf, blen);
 477         os_free(buf);
 478 }
 479
 480
 481 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
 482 {
 483         u8 *buf;
 484         size_t len;
 485         struct ieee80211_mgmt *mgmt;
 486
 487         buf = os_zalloc(sizeof(*mgmt));
 488         if (buf == NULL) {
 489                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 490                            "deauth frame");
 491                 return;
 492         }
 493
 494         mgmt = (struct ieee80211_mgmt *) buf;
 495         len = 24;
 496         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 497         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 498         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 499         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 500                                            WLAN_FC_STYPE_DEAUTH);
 501         len += 2;
 502         mgmt->u.deauth.reason_code = host_to_le16(reason);
 503
 504         ieee80211_sta_tx(wpa_s, buf, len);
 505         os_free(buf);
 506 }
 507
 508
 509 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
 510 {
 511         u8 *buf;
 512         size_t len;
 513         struct ieee80211_mgmt *mgmt;
 514
 515         buf = os_zalloc(sizeof(*mgmt));
 516         if (buf == NULL) {
 517                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 518                            "disassoc frame");
 519                 return;
 520         }
 521
 522         mgmt = (struct ieee80211_mgmt *) buf;
 523         len = 24;
 524         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
 525         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 526         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
 527         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 528                                            WLAN_FC_STYPE_DISASSOC);
 529         len += 2;
 530         mgmt->u.disassoc.reason_code = host_to_le16(reason);
 531
 532         ieee80211_sta_tx(wpa_s, buf, len);
 533         os_free(buf);
 534 }
 535
 536
 537 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
 538 {
 539         struct ieee80211_sta_bss *bss;
 540         int res = 0;
 541
 542         if (wpa_s->mlme.mixed_cell ||
 543             wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
 544                 return 0;
 545
 546         bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
 547         if (bss == NULL)
 548                 return 0;
 549
 550         if (ieee80211_sta_wep_configured(wpa_s) !=
 551             !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
 552                 res = 1;
 553
 554         return res;
 555 }
 556
 557
 558 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
 559 {
 560         wpa_s->mlme.assoc_tries++;
 561         if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
 562                 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
 563                            " timed out", MAC2STR(wpa_s->bssid));
 564                 return;
 565         }
 566
 567         wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 568         wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
 569                    MAC2STR(wpa_s->bssid));
 570         if (ieee80211_privacy_mismatch(wpa_s)) {
 571                 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
 572                            "configuration and mixed-cell disabled - abort "
 573                            "association");
 574                 return;
 575         }
 576
 577         ieee80211_send_assoc(wpa_s);
 578
 579         ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
 580 }
 581
 582
 583 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
 584 {
 585         int disassoc;
 586
 587         /* TODO: start monitoring current AP signal quality and number of
 588          * missed beacons. Scan other channels every now and then and search
 589          * for better APs. */
 590         /* TODO: remove expired BSSes */
 591
 592         wpa_s->mlme.state = IEEE80211_ASSOCIATED;
 593
 594 #if 0 /* FIX */
 595         sta = sta_info_get(local, wpa_s->bssid);
 596         if (sta == NULL) {
 597                 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
 598                            MAC2STR(wpa_s->bssid));
 599                 disassoc = 1;
 600         } else {
 601                 disassoc = 0;
 602                 if (time_after(jiffies,
 603                                sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
 604                         if (wpa_s->mlme.probereq_poll) {
 605                                 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
 606                                            "current AP " MACSTR " - assume "
 607                                            "out of range",
 608                                            MAC2STR(wpa_s->bssid));
 609                                 disassoc = 1;
 610                         } else {
 611                                 ieee80211_send_probe_req(
 612                                         wpa_s->bssid,
 613                                         wpa_s->mlme.scan_ssid,
 614                                         wpa_s->mlme.scan_ssid_len);
 615                                 wpa_s->mlme.probereq_poll = 1;
 616                         }
 617                 } else {
 618                         wpa_s->mlme.probereq_poll = 0;
 619                         if (time_after(jiffies, wpa_s->mlme.last_probe +
 620                                        IEEE80211_PROBE_INTERVAL)) {
 621                                 wpa_s->mlme.last_probe = jiffies;
 622                                 ieee80211_send_probe_req(wpa_s->bssid,
 623                                                          wpa_s->mlme.ssid,
 624                                                          wpa_s->mlme.ssid_len);
 625                         }
 626                 }
 627                 sta_info_release(local, sta);
 628         }
 629 #else
 630         disassoc = 0;
 631 #endif
 632         if (disassoc) {
 633                 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
 634                 ieee80211_reschedule_timer(wpa_s,
 635                                            IEEE80211_MONITORING_INTERVAL +
 636                                            30000);
 637         } else {
 638                 ieee80211_reschedule_timer(wpa_s,
 639                                            IEEE80211_MONITORING_INTERVAL);
 640         }
 641 }
 642
 643
 644 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
 645                                      const u8 *dst,
 646                                      const u8 *ssid, size_t ssid_len)
 647 {
 648         u8 *buf;
 649         size_t len;
 650         struct ieee80211_mgmt *mgmt;
 651         u8 *pos, *supp_rates;
 652         u8 *esupp_rates = NULL;
 653         int i;
 654
 655         buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
 656         if (buf == NULL) {
 657                 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
 658                            "probe request");
 659                 return;
 660         }
 661
 662         mgmt = (struct ieee80211_mgmt *) buf;
 663         len = 24;
 664         os_memset(mgmt, 0, 24);
 665         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 666                                            WLAN_FC_STYPE_PROBE_REQ);
 667         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
 668         if (dst) {
 669                 os_memcpy(mgmt->da, dst, ETH_ALEN);
 670                 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
 671         } else {
 672                 os_memset(mgmt->da, 0xff, ETH_ALEN);
 673                 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
 674         }
 675         pos = buf + len;
 676         len += 2 + ssid_len;
 677         *pos++ = WLAN_EID_SSID;
 678         *pos++ = ssid_len;
 679         os_memcpy(pos, ssid, ssid_len);
 680
 681         supp_rates = buf + len;
 682         len += 2;
 683         supp_rates[0] = WLAN_EID_SUPP_RATES;
 684         supp_rates[1] = 0;
 685         for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
 686                 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
 687                 if (esupp_rates) {
 688                         pos = buf + len;
 689                         len++;
 690                         esupp_rates[1]++;
 691                 } else if (supp_rates[1] == 8) {
 692                         esupp_rates = pos;
 693                         esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
 694                         esupp_rates[1] = 1;
 695                         pos = &esupp_rates[2];
 696                         len += 3;
 697                 } else {
 698                         pos = buf + len;
 699                         len++;
 700                         supp_rates[1]++;
 701                 }
 702                 *pos++ = rate->rate / 5;
 703         }
 704
 705         if (wpa_s->mlme.extra_probe_ie) {
 706                 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
 707                           wpa_s->mlme.extra_probe_ie_len);
 708                 len += wpa_s->mlme.extra_probe_ie_len;
 709         }
 710
 711         ieee80211_sta_tx(wpa_s, buf, len);
 712         os_free(buf);
 713 }
 714
 715
 716 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
 717 {
 718 #if 0 /* FIX */
 719         if (sdata == NULL || sdata->default_key == NULL ||
 720             sdata->default_key->alg != ALG_WEP)
 721                 return 0;
 722         return 1;
 723 #else
 724         return 0;
 725 #endif
 726 }
 727
 728
 729 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
 730 {
 731         wpa_printf(MSG_DEBUG, "MLME: authenticated");
 732         wpa_s->mlme.authenticated = 1;
 733         ieee80211_associate(wpa_s);
 734 }
 735
 736
 737 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
 738                                      struct ieee80211_mgmt *mgmt,
 739                                      size_t len,
 740                                      struct ieee80211_rx_status *rx_status)
 741 {
 742         u8 *pos;
 743         struct ieee802_11_elems elems;
 744
 745         wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
 746         pos = mgmt->u.auth.variable;
 747         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
 748             == ParseFailed) {
 749                 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
 750                 return;
 751         }
 752         if (elems.challenge == NULL) {
 753                 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
 754                            "auth frame");
 755                 return;
 756         }
 757         ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
 758                             elems.challenge_len + 2, 1);
 759 }
 760
 761
 762 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
 763                                    struct ieee80211_mgmt *mgmt,
 764                                    size_t len,
 765                                    struct ieee80211_rx_status *rx_status)
 766 {
 767         struct wpa_ssid *ssid = wpa_s->current_ssid;
 768         u16 auth_alg, auth_transaction, status_code;
 769         int adhoc;
 770
 771         adhoc = ssid && ssid->mode == 1;
 772
 773         if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
 774                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 775                            "from " MACSTR ", but not in authenticate state - "
 776                            "ignored", MAC2STR(mgmt->sa));
 777                 return;
 778         }
 779
 780         if (len < 24 + 6) {
 781                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
 782                            "frame received from " MACSTR " - ignored",
 783                            (unsigned long) len, MAC2STR(mgmt->sa));
 784                 return;
 785         }
 786
 787         if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 788                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 789                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 790                            ") - ignored",
 791                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 792                 return;
 793         }
 794
 795         if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
 796                 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
 797                            "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
 798                            ") - ignored",
 799                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 800                 return;
 801         }
 802
 803         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 804         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 805         status_code = le_to_host16(mgmt->u.auth.status_code);
 806
 807         wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
 808                    " (alg=%d transaction=%d status=%d)",
 809                    MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
 810
 811         if (adhoc) {
 812                 /* IEEE 802.11 standard does not require authentication in IBSS
 813                  * networks and most implementations do not seem to use it.
 814                  * However, try to reply to authentication attempts if someone
 815                  * has actually implemented this.
 816                  * TODO: Could implement shared key authentication. */
 817                 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
 818                         wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
 819                                    "authentication frame (alg=%d "
 820                                    "transaction=%d)",
 821                                    auth_alg, auth_transaction);
 822                         return;
 823                 }
 824                 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
 825         }
 826
 827         if (auth_alg != wpa_s->mlme.auth_alg ||
 828             auth_transaction != wpa_s->mlme.auth_transaction) {
 829                 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
 830                            "(alg=%d transaction=%d)",
 831                            auth_alg, auth_transaction);
 832                 return;
 833         }
 834
 835         if (status_code != WLAN_STATUS_SUCCESS) {
 836                 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
 837                            "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
 838                            status_code);
 839                 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
 840                         const int num_algs = 3;
 841                         u8 algs[num_algs];
 842                         int i, pos;
 843                         algs[0] = algs[1] = algs[2] = 0xff;
 844                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
 845                                 algs[0] = WLAN_AUTH_OPEN;
 846                         if (wpa_s->mlme.auth_algs &
 847                             IEEE80211_AUTH_ALG_SHARED_KEY)
 848                                 algs[1] = WLAN_AUTH_SHARED_KEY;
 849                         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
 850                                 algs[2] = WLAN_AUTH_LEAP;
 851                         if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
 852                                 pos = 0;
 853                         else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
 854                                 pos = 1;
 855                         else
 856                                 pos = 2;
 857                         for (i = 0; i < num_algs; i++) {
 858                                 pos++;
 859                                 if (pos >= num_algs)
 860                                         pos = 0;
 861                                 if (algs[pos] == wpa_s->mlme.auth_alg ||
 862                                     algs[pos] == 0xff)
 863                                         continue;
 864                                 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
 865                                     !ieee80211_sta_wep_configured(wpa_s))
 866                                         continue;
 867                                 wpa_s->mlme.auth_alg = algs[pos];
 868                                 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
 869                                            "for next try",
 870                                            wpa_s->mlme.auth_alg);
 871                                 break;
 872                         }
 873                 }
 874                 return;
 875         }
 876
 877         switch (wpa_s->mlme.auth_alg) {
 878         case WLAN_AUTH_OPEN:
 879         case WLAN_AUTH_LEAP:
 880                 ieee80211_auth_completed(wpa_s);
 881                 break;
 882         case WLAN_AUTH_SHARED_KEY:
 883                 if (wpa_s->mlme.auth_transaction == 4)
 884                         ieee80211_auth_completed(wpa_s);
 885                 else
 886                         ieee80211_auth_challenge(wpa_s, mgmt, len,
 887                                                  rx_status);
 888                 break;
 889 #ifdef CONFIG_IEEE80211R
 890         case WLAN_AUTH_FT:
 891         {
 892                 union wpa_event_data data;
 893                 os_memset(&data, 0, sizeof(data));
 894                 data.ft_ies.ies = mgmt->u.auth.variable;
 895                 data.ft_ies.ies_len = len -
 896                         (mgmt->u.auth.variable - (u8 *) mgmt);
 897                 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
 898                 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
 899                 ieee80211_auth_completed(wpa_s);
 900                 break;
 901         }
 902 #endif /* CONFIG_IEEE80211R */
 903         }
 904 }
 905
 906
 907 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
 908                                      struct ieee80211_mgmt *mgmt,
 909                                      size_t len,
 910                                      struct ieee80211_rx_status *rx_status)
 911 {
 912         u16 reason_code;
 913
 914         if (len < 24 + 2) {
 915                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
 916                            "frame received from " MACSTR " - ignored",
 917                            (unsigned long) len, MAC2STR(mgmt->sa));
 918                 return;
 919         }
 920
 921         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 922                 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
 923                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 924                            ") - ignored",
 925                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 926                 return;
 927         }
 928
 929         reason_code = le_to_host16(mgmt->u.deauth.reason_code);
 930
 931         wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
 932                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 933
 934         if (wpa_s->mlme.authenticated)
 935                 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
 936
 937         if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
 938             wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
 939             wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 940                 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
 941                 ieee80211_reschedule_timer(wpa_s,
 942                                            IEEE80211_RETRY_AUTH_INTERVAL);
 943         }
 944
 945         ieee80211_set_associated(wpa_s, 0);
 946         wpa_s->mlme.authenticated = 0;
 947 }
 948
 949
 950 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
 951                                        struct ieee80211_mgmt *mgmt,
 952                                        size_t len,
 953                                        struct ieee80211_rx_status *rx_status)
 954 {
 955         u16 reason_code;
 956
 957         if (len < 24 + 2) {
 958                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
 959                            "frame received from " MACSTR " - ignored",
 960                            (unsigned long) len, MAC2STR(mgmt->sa));
 961                 return;
 962         }
 963
 964         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
 965                 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
 966                            "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
 967                            ") - ignored",
 968                            MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 969                 return;
 970         }
 971
 972         reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
 973
 974         wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
 975                    " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
 976
 977         if (wpa_s->mlme.associated)
 978                 wpa_printf(MSG_DEBUG, "MLME: disassociated");
 979
 980         if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
 981                 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
 982                 ieee80211_reschedule_timer(wpa_s,
 983                                            IEEE80211_RETRY_AUTH_INTERVAL);
 984         }
 985
 986         ieee80211_set_associated(wpa_s, 0);
 987 }
 988
 989
 990 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
 991                                    struct ieee802_11_elems *elems)
 992 {
 993 #ifdef CONFIG_IEEE80211R
 994         const u8 *mobility_domain = NULL;
 995         const u8 *r0kh_id = NULL;
 996         size_t r0kh_id_len = 0;
 997         const u8 *r1kh_id = NULL;
 998         struct rsn_ftie *hdr;
 999         const u8 *pos, *end;
1000
1001         if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1002                 mobility_domain = elems->mdie;
1003         if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1004                 end = elems->ftie + elems->ftie_len;
1005                 hdr = (struct rsn_ftie *) elems->ftie;
1006                 pos = (const u8 *) (hdr + 1);
1007                 while (pos + 1 < end) {
1008                         if (pos + 2 + pos[1] > end)
1009                                 break;
1010                         if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1011                             pos[1] == FT_R1KH_ID_LEN)
1012                                 r1kh_id = pos + 2;
1013                         else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1014                                  pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1015                                 r0kh_id = pos + 2;
1016                                 r0kh_id_len = pos[1];
1017                         }
1018                         pos += 2 + pos[1];
1019                 }
1020         }
1021         return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1022                                     r0kh_id_len, r1kh_id);
1023 #else /* CONFIG_IEEE80211R */
1024         return 0;
1025 #endif /* CONFIG_IEEE80211R */
1026 }
1027
1028
1029 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1030                                          struct ieee80211_mgmt *mgmt,
1031                                          size_t len,
1032                                          struct ieee80211_rx_status *rx_status,
1033                                          int reassoc)
1034 {
1035         u8 rates[32];
1036         size_t rates_len;
1037         u16 capab_info, status_code, aid;
1038         struct ieee802_11_elems elems;
1039         u8 *pos;
1040
1041         /* AssocResp and ReassocResp have identical structure, so process both
1042          * of them in this function. */
1043
1044         if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1045                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1046                            MACSTR ", but not in associate state - ignored",
1047                            MAC2STR(mgmt->sa));
1048                 return;
1049         }
1050
1051         if (len < 24 + 6) {
1052                 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1053                            "frame received from " MACSTR " - ignored",
1054                            (unsigned long) len, MAC2STR(mgmt->sa));
1055                 return;
1056         }
1057
1058         if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1059                 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1060                            "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1061                            "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1062                 return;
1063         }
1064
1065         capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1066         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1067         aid = le_to_host16(mgmt->u.assoc_resp.aid);
1068         if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1069                 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1070                            "not set", aid);
1071         aid &= ~(BIT(15) | BIT(14));
1072
1073         wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1074                    " (capab=0x%x status=%d aid=%d)",
1075                    reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1076                    capab_info, status_code, aid);
1077
1078         pos = mgmt->u.assoc_resp.variable;
1079         if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems, 0)
1080             == ParseFailed) {
1081                 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1082                 return;
1083         }
1084
1085         if (status_code != WLAN_STATUS_SUCCESS) {
1086                 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1087                            status_code);
1088 #ifdef CONFIG_IEEE80211W
1089                 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1090                     elems.timeout_int && elems.timeout_int_len == 5 &&
1091                     elems.timeout_int[0] == WLAN_TIMEOUT_ASSOC_COMEBACK) {
1092                         u32 tu, ms;
1093                         tu = WPA_GET_LE32(elems.timeout_int + 1);
1094                         ms = tu * 1024 / 1000;
1095                         wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1096                                    "temporarily; comeback duration %u TU "
1097                                    "(%u ms)", tu, ms);
1098                         if (ms > IEEE80211_ASSOC_TIMEOUT) {
1099                                 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1100                                            "based on comeback duration");
1101                                 ieee80211_reschedule_timer(wpa_s, ms);
1102                         }
1103                 }
1104 #endif /* CONFIG_IEEE80211W */
1105                 return;
1106         }
1107
1108         if (elems.supp_rates == NULL) {
1109                 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1110                            "AssocResp");
1111                 return;
1112         }
1113
1114         if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1115                 if (!reassoc) {
1116                         wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1117                                    "association, not reassociation, response "
1118                                    "with FT");
1119                         return;
1120                 }
1121                 if (wpa_ft_validate_reassoc_resp(
1122                             wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1123                             mgmt->sa) < 0) {
1124                         wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1125                                    "Resp failed");
1126                         return;
1127                 }
1128         } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1129                 return;
1130
1131         wpa_printf(MSG_DEBUG, "MLME: associated");
1132         wpa_s->mlme.aid = aid;
1133         wpa_s->mlme.ap_capab = capab_info;
1134
1135         os_free(wpa_s->mlme.assocresp_ies);
1136         wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1137         wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1138         if (wpa_s->mlme.assocresp_ies) {
1139                 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1140                           wpa_s->mlme.assocresp_ies_len);
1141         }
1142
1143         ieee80211_set_associated(wpa_s, 1);
1144
1145         rates_len = elems.supp_rates_len;
1146         if (rates_len > sizeof(rates))
1147                 rates_len = sizeof(rates);
1148         os_memcpy(rates, elems.supp_rates, rates_len);
1149         if (elems.ext_supp_rates) {
1150                 size_t _len = elems.ext_supp_rates_len;
1151                 if (_len > sizeof(rates) - rates_len)
1152                         _len = sizeof(rates) - rates_len;
1153                 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1154                 rates_len += _len;
1155         }
1156
1157         if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1158                 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1159                            "netstack");
1160         }
1161         if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1162             0) {
1163                 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1164                            "netstack");
1165         }
1166
1167         /* Remove STA entry before adding a new one just in case to avoid
1168          * problems with existing configuration (e.g., keys). */
1169         wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1170         if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1171                 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1172                            "netstack");
1173         }
1174
1175 #if 0 /* FIX? */
1176         sta->assoc_ap = 1;
1177
1178         if (elems.wme && wpa_s->mlme.wmm_enabled) {
1179                 sta->flags |= WLAN_STA_WME;
1180                 ieee80211_sta_wmm_params(wpa_s, elems.wme, elems.wme_len);
1181         }
1182 #endif
1183
1184         ieee80211_associated(wpa_s);
1185 }
1186
1187
1188 /* Caller must hold local->sta_bss_lock */
1189 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1190                                      struct ieee80211_sta_bss *bss)
1191 {
1192         bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1193         wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1194 }
1195
1196
1197 /* Caller must hold local->sta_bss_lock */
1198 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1199                                      struct ieee80211_sta_bss *bss)
1200 {
1201         struct ieee80211_sta_bss *b, *prev = NULL;
1202         b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1203         while (b) {
1204                 if (b == bss) {
1205                         if (prev == NULL) {
1206                                 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1207                                         = bss->hnext;
1208                         } else {
1209                                 prev->hnext = bss->hnext;
1210                         }
1211                         break;
1212                 }
1213                 prev = b;
1214                 b = b->hnext;
1215         }
1216 }
1217
1218
1219 static struct ieee80211_sta_bss *
1220 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1221 {
1222         struct ieee80211_sta_bss *bss;
1223
1224         bss = os_zalloc(sizeof(*bss));
1225         if (bss == NULL)
1226                 return NULL;
1227         os_memcpy(bss->bssid, bssid, ETH_ALEN);
1228
1229         /* TODO: order by RSSI? */
1230         bss->next = wpa_s->mlme.sta_bss_list;
1231         wpa_s->mlme.sta_bss_list = bss;
1232         __ieee80211_bss_hash_add(wpa_s, bss);
1233         return bss;
1234 }
1235
1236
1237 static struct ieee80211_sta_bss *
1238 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1239 {
1240         struct ieee80211_sta_bss *bss;
1241
1242         bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1243         while (bss) {
1244                 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1245                         break;
1246                 bss = bss->hnext;
1247         }
1248         return bss;
1249 }
1250
1251
1252 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1253                                struct ieee80211_sta_bss *bss)
1254 {
1255         __ieee80211_bss_hash_del(wpa_s, bss);
1256         os_free(bss->ie);
1257         os_free(bss->wpa_ie);
1258         os_free(bss->rsn_ie);
1259         os_free(bss->wmm_ie);
1260         os_free(bss->mdie);
1261         os_free(bss);
1262 }
1263
1264
1265 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1266 {
1267         struct ieee80211_sta_bss *bss, *prev;
1268
1269         bss = wpa_s->mlme.sta_bss_list;
1270         wpa_s->mlme.sta_bss_list = NULL;
1271         while (bss) {
1272                 prev = bss;
1273                 bss = bss->next;
1274                 ieee80211_bss_free(wpa_s, prev);
1275         }
1276 }
1277
1278
1279 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1280                                struct ieee80211_mgmt *mgmt,
1281                                size_t len,
1282                                struct ieee80211_rx_status *rx_status,
1283                                int beacon)
1284 {
1285         struct ieee802_11_elems elems;
1286         size_t baselen;
1287         int channel, invalid = 0, clen;
1288         struct ieee80211_sta_bss *bss;
1289         u64 timestamp;
1290         u8 *pos, *ie_pos;
1291         size_t ie_len;
1292
1293         if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1294                 return; /* ignore ProbeResp to foreign address */
1295
1296 #if 0
1297         wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1298                    beacon ? "Beacon" : "Probe Response",
1299                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1300 #endif
1301
1302         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1303         if (baselen > len)
1304                 return;
1305
1306         pos = mgmt->u.beacon.timestamp;
1307         timestamp = WPA_GET_LE64(pos);
1308
1309 #if 0 /* FIX */
1310         if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1311             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1312 #ifdef IEEE80211_IBSS_DEBUG
1313                 static unsigned long last_tsf_debug = 0;
1314                 u64 tsf;
1315                 if (local->hw->get_tsf)
1316                         tsf = local->hw->get_tsf(local->mdev);
1317                 else
1318                         tsf = -1LLU;
1319                 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1320                         wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1321                                    MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1322                                    "@%ld",
1323                                    MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1324                                    tsf, timestamp, tsf - timestamp, jiffies);
1325                         last_tsf_debug = jiffies;
1326                 }
1327 #endif /* IEEE80211_IBSS_DEBUG */
1328         }
1329 #endif
1330
1331         ie_pos = mgmt->u.beacon.variable;
1332         ie_len = len - baselen;
1333         if (ieee802_11_parse_elems(ie_pos, ie_len, &elems, 0) == ParseFailed)
1334                 invalid = 1;
1335
1336 #if 0 /* FIX */
1337         if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1338             os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1339             (sta = sta_info_get(local, mgmt->sa))) {
1340                 struct ieee80211_rate *rates;
1341                 size_t num_rates;
1342                 u32 supp_rates, prev_rates;
1343                 int i, j, oper_mode;
1344
1345                 rates = local->curr_rates;
1346                 num_rates = local->num_curr_rates;
1347                 oper_mode = wpa_s->mlme.sta_scanning ?
1348                         local->scan_oper_phymode : local->conf.phymode;
1349                 for (i = 0; i < local->hw->num_modes; i++) {
1350                         struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1351                         if (oper_mode == mode->mode) {
1352                                 rates = mode->rates;
1353                                 num_rates = mode->num_rates;
1354                                 break;
1355                         }
1356                 }
1357
1358                 supp_rates = 0;
1359                 for (i = 0; i < elems.supp_rates_len +
1360                              elems.ext_supp_rates_len; i++) {
1361                         u8 rate = 0;
1362                         int own_rate;
1363                         if (i < elems.supp_rates_len)
1364                                 rate = elems.supp_rates[i];
1365                         else if (elems.ext_supp_rates)
1366                                 rate = elems.ext_supp_rates
1367                                         [i - elems.supp_rates_len];
1368                         own_rate = 5 * (rate & 0x7f);
1369                         if (oper_mode == MODE_ATHEROS_TURBO)
1370                                 own_rate *= 2;
1371                         for (j = 0; j < num_rates; j++)
1372                                 if (rates[j].rate == own_rate)
1373                                         supp_rates |= BIT(j);
1374                 }
1375
1376                 prev_rates = sta->supp_rates;
1377                 sta->supp_rates &= supp_rates;
1378                 if (sta->supp_rates == 0) {
1379                         /* No matching rates - this should not really happen.
1380                          * Make sure that at least one rate is marked
1381                          * supported to avoid issues with TX rate ctrl. */
1382                         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1383                 }
1384                 if (sta->supp_rates != prev_rates) {
1385                         wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1386                                    "for " MACSTR " based on beacon info "
1387                                    "(0x%x & 0x%x -> 0x%x)",
1388                                    MAC2STR(sta->addr), prev_rates,
1389                                    supp_rates, sta->supp_rates);
1390                 }
1391                 sta_info_release(local, sta);
1392         }
1393 #endif
1394
1395         if (elems.ssid == NULL)
1396                 return;
1397
1398         if (elems.ds_params && elems.ds_params_len == 1)
1399                 channel = elems.ds_params[0];
1400         else
1401                 channel = rx_status->channel;
1402
1403         bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1404         if (bss == NULL) {
1405                 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1406                 if (bss == NULL)
1407                         return;
1408         } else {
1409 #if 0
1410                 /* TODO: order by RSSI? */
1411                 spin_lock_bh(&local->sta_bss_lock);
1412                 list_move_tail(&bss->list, &local->sta_bss_list);
1413                 spin_unlock_bh(&local->sta_bss_lock);
1414 #endif
1415         }
1416
1417         if (bss->probe_resp && beacon) {
1418                 /* Do not allow beacon to override data from Probe Response. */
1419                 return;
1420         }
1421
1422         bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1423         bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1424
1425         if (bss->ie == NULL || bss->ie_len < ie_len) {
1426                 os_free(bss->ie);
1427                 bss->ie = os_malloc(ie_len);
1428         }
1429         if (bss->ie) {
1430                 os_memcpy(bss->ie, ie_pos, ie_len);
1431                 bss->ie_len = ie_len;
1432         }
1433
1434         if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1435                 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1436                 bss->ssid_len = elems.ssid_len;
1437         }
1438
1439         bss->supp_rates_len = 0;
1440         if (elems.supp_rates) {
1441                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1442                 if (clen > elems.supp_rates_len)
1443                         clen = elems.supp_rates_len;
1444                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1445                           elems.supp_rates, clen);
1446                 bss->supp_rates_len += clen;
1447         }
1448         if (elems.ext_supp_rates) {
1449                 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1450                 if (clen > elems.ext_supp_rates_len)
1451                         clen = elems.ext_supp_rates_len;
1452                 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1453                           elems.ext_supp_rates, clen);
1454                 bss->supp_rates_len += clen;
1455         }
1456
1457         if (elems.wpa_ie &&
1458             (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_ie_len ||
1459              os_memcmp(bss->wpa_ie, elems.wpa_ie, elems.wpa_ie_len))) {
1460                 os_free(bss->wpa_ie);
1461                 bss->wpa_ie = os_malloc(elems.wpa_ie_len + 2);
1462                 if (bss->wpa_ie) {
1463                         os_memcpy(bss->wpa_ie, elems.wpa_ie - 2,
1464                                   elems.wpa_ie_len + 2);
1465                         bss->wpa_ie_len = elems.wpa_ie_len + 2;
1466                 } else
1467                         bss->wpa_ie_len = 0;
1468         } else if (!elems.wpa_ie && bss->wpa_ie) {
1469                 os_free(bss->wpa_ie);
1470                 bss->wpa_ie = NULL;
1471                 bss->wpa_ie_len = 0;
1472         }
1473
1474         if (elems.rsn_ie &&
1475             (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_ie_len ||
1476              os_memcmp(bss->rsn_ie, elems.rsn_ie, elems.rsn_ie_len))) {
1477                 os_free(bss->rsn_ie);
1478                 bss->rsn_ie = os_malloc(elems.rsn_ie_len + 2);
1479                 if (bss->rsn_ie) {
1480                         os_memcpy(bss->rsn_ie, elems.rsn_ie - 2,
1481                                   elems.rsn_ie_len + 2);
1482                         bss->rsn_ie_len = elems.rsn_ie_len + 2;
1483                 } else
1484                         bss->rsn_ie_len = 0;
1485         } else if (!elems.rsn_ie && bss->rsn_ie) {
1486                 os_free(bss->rsn_ie);
1487                 bss->rsn_ie = NULL;
1488                 bss->rsn_ie_len = 0;
1489         }
1490
1491         if (elems.wme &&
1492             (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wme_len ||
1493              os_memcmp(bss->wmm_ie, elems.wme, elems.wme_len))) {
1494                 os_free(bss->wmm_ie);
1495                 bss->wmm_ie = os_malloc(elems.wme_len + 2);
1496                 if (bss->wmm_ie) {
1497                         os_memcpy(bss->wmm_ie, elems.wme - 2,
1498                                   elems.wme_len + 2);
1499                         bss->wmm_ie_len = elems.wme_len + 2;
1500                 } else
1501                         bss->wmm_ie_len = 0;
1502         } else if (!elems.wme && bss->wmm_ie) {
1503                 os_free(bss->wmm_ie);
1504                 bss->wmm_ie = NULL;
1505                 bss->wmm_ie_len = 0;
1506         }
1507
1508 #ifdef CONFIG_IEEE80211R
1509         if (elems.mdie &&
1510             (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1511              os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1512                 os_free(bss->mdie);
1513                 bss->mdie = os_malloc(elems.mdie_len + 2);
1514                 if (bss->mdie) {
1515                         os_memcpy(bss->mdie, elems.mdie - 2,
1516                                   elems.mdie_len + 2);
1517                         bss->mdie_len = elems.mdie_len + 2;
1518                 } else
1519                         bss->mdie_len = 0;
1520         } else if (!elems.mdie && bss->mdie) {
1521                 os_free(bss->mdie);
1522                 bss->mdie = NULL;
1523                 bss->mdie_len = 0;
1524         }
1525 #endif /* CONFIG_IEEE80211R */
1526
1527         bss->hw_mode = wpa_s->mlme.phymode;
1528         bss->channel = channel;
1529         bss->freq = wpa_s->mlme.freq;
1530         if (channel != wpa_s->mlme.channel &&
1531             (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1532              wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1533             channel >= 1 && channel <= 14) {
1534                 static const int freq_list[] = {
1535                         2412, 2417, 2422, 2427, 2432, 2437, 2442,
1536                         2447, 2452, 2457, 2462, 2467, 2472, 2484
1537                 };
1538                 /* IEEE 802.11g/b mode can receive packets from neighboring
1539                  * channels, so map the channel into frequency. */
1540                 bss->freq = freq_list[channel - 1];
1541         }
1542         bss->timestamp = timestamp;
1543         os_get_time(&bss->last_update);
1544         bss->rssi = rx_status->ssi;
1545         if (!beacon)
1546                 bss->probe_resp++;
1547 }
1548
1549
1550 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1551                                          struct ieee80211_mgmt *mgmt,
1552                                          size_t len,
1553                                          struct ieee80211_rx_status *rx_status)
1554 {
1555         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1556 }
1557
1558
1559 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1560                                      struct ieee80211_mgmt *mgmt,
1561                                      size_t len,
1562                                      struct ieee80211_rx_status *rx_status)
1563 {
1564         int use_protection;
1565         size_t baselen;
1566         struct ieee802_11_elems elems;
1567
1568         ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1569
1570         if (!wpa_s->mlme.associated ||
1571             os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1572                 return;
1573
1574         /* Process beacon from the current BSS */
1575         baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1576         if (baselen > len)
1577                 return;
1578
1579         if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1580                                    &elems, 0) == ParseFailed)
1581                 return;
1582
1583         use_protection = 0;
1584         if (elems.erp_info && elems.erp_info_len >= 1) {
1585                 use_protection =
1586                         (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1587         }
1588
1589         if (use_protection != !!wpa_s->mlme.use_protection) {
1590                 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1591                            ")",
1592                            use_protection ? "enabled" : "disabled",
1593                            MAC2STR(wpa_s->bssid));
1594                 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1595                 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1596         }
1597
1598         if (elems.wme && wpa_s->mlme.wmm_enabled) {
1599                 ieee80211_sta_wmm_params(wpa_s, elems.wme,
1600                                          elems.wme_len);
1601         }
1602 }
1603
1604
1605 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1606                                         struct ieee80211_mgmt *mgmt,
1607                                         size_t len,
1608                                         struct ieee80211_rx_status *rx_status)
1609 {
1610         int tx_last_beacon, adhoc;
1611 #if 0 /* FIX */
1612         struct ieee80211_mgmt *resp;
1613 #endif
1614         u8 *pos, *end;
1615         struct wpa_ssid *ssid = wpa_s->current_ssid;
1616
1617         adhoc = ssid && ssid->mode == 1;
1618
1619         if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1620             len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1621                 return;
1622
1623 #if 0 /* FIX */
1624         if (local->hw->tx_last_beacon)
1625                 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1626         else
1627 #endif
1628                 tx_last_beacon = 1;
1629
1630 #ifdef IEEE80211_IBSS_DEBUG
1631         wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1632                    " BSSID=" MACSTR " (tx_last_beacon=%d)",
1633                    MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1634                    MAC2STR(mgmt->bssid), tx_last_beacon);
1635 #endif /* IEEE80211_IBSS_DEBUG */
1636
1637         if (!tx_last_beacon)
1638                 return;
1639
1640         if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1641             os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1642                 return;
1643
1644         end = ((u8 *) mgmt) + len;
1645         pos = mgmt->u.probe_req.variable;
1646         if (pos[0] != WLAN_EID_SSID ||
1647             pos + 2 + pos[1] > end) {
1648                 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1649                            MACSTR, MAC2STR(mgmt->sa));
1650                 return;
1651         }
1652         if (pos[1] != 0 &&
1653             (pos[1] != wpa_s->mlme.ssid_len ||
1654              os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1655         {
1656                 /* Ignore ProbeReq for foreign SSID */
1657                 return;
1658         }
1659
1660 #if 0 /* FIX */
1661         /* Reply with ProbeResp */
1662         skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1663         if (skb == NULL)
1664                 return;
1665
1666         resp = (struct ieee80211_mgmt *) skb->data;
1667         os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1668 #ifdef IEEE80211_IBSS_DEBUG
1669         wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1670                    MAC2STR(resp->da));
1671 #endif /* IEEE80211_IBSS_DEBUG */
1672         ieee80211_sta_tx(wpa_s, skb, 0, 1);
1673 #endif
1674 }
1675
1676
1677 #ifdef CONFIG_IEEE80211R
1678 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1679                                         struct ieee80211_mgmt *mgmt,
1680                                         size_t len,
1681                                         struct ieee80211_rx_status *rx_status)
1682 {
1683         union wpa_event_data data;
1684         u16 status;
1685         u8 *sta_addr, *target_ap_addr;
1686
1687         if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1688                 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1689                 return;
1690         }
1691
1692         /*
1693          * Only FT Action Response is needed for now since reservation
1694          * protocol is not supported.
1695          */
1696         if (mgmt->u.action.u.ft_action_resp.action != 2) {
1697                 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1698                            mgmt->u.action.u.ft_action_resp.action);
1699                 return;
1700         }
1701
1702         status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1703         sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1704         target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1705         wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1706                    " TargetAP " MACSTR " Status Code %d",
1707                    MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1708         if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1709                 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1710                            " in FT Action Response", MAC2STR(sta_addr));
1711                 return;
1712
1713         }
1714
1715         if (status) {
1716                 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1717                            "failure (status code %d)", status);
1718                 /* TODO: report error to FT code(?) */
1719                 return;
1720         }
1721
1722         os_memset(&data, 0, sizeof(data));
1723         data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1724         data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1725                                      (u8 *) mgmt);
1726         data.ft_ies.ft_action = 1;
1727         os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1728         wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1729         /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1730          * successfully */
1731         wpa_s->mlme.prev_bssid_set = 1;
1732         wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1733         os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1734         os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1735         ieee80211_associate(wpa_s);
1736 }
1737 #endif /* CONFIG_IEEE80211R */
1738
1739
1740 #ifdef CONFIG_IEEE80211W
1741
1742 /* MLME-SAQuery.response */
1743 static int ieee80211_sta_send_sa_query_resp(struct wpa_supplicant *wpa_s,
1744                                             const u8 *addr, const u8 *trans_id)
1745 {
1746         struct ieee80211_mgmt *mgmt;
1747         int res;
1748         size_t len;
1749
1750         mgmt = os_zalloc(sizeof(*mgmt));
1751         if (mgmt == NULL) {
1752                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1753                            "SA Query action frame");
1754                 return -1;
1755         }
1756
1757         len = 24;
1758         os_memcpy(mgmt->da, addr, ETH_ALEN);
1759         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1760         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1761         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1762                                            WLAN_FC_STYPE_ACTION);
1763         mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
1764         mgmt->u.action.u.sa_query_resp.action = WLAN_SA_QUERY_RESPONSE;
1765         os_memcpy(mgmt->u.action.u.sa_query_resp.trans_id, trans_id,
1766                   WLAN_SA_QUERY_TR_ID_LEN);
1767         len += 1 + sizeof(mgmt->u.action.u.sa_query_resp);
1768
1769         res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1770         os_free(mgmt);
1771
1772         return res;
1773 }
1774
1775
1776 static void ieee80211_rx_mgmt_sa_query_action(
1777         struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1778         struct ieee80211_rx_status *rx_status)
1779 {
1780         if (len < 24 + 1 + sizeof(mgmt->u.action.u.sa_query_req)) {
1781                 wpa_printf(MSG_DEBUG, "MLME: Too short SA Query Action frame");
1782                 return;
1783         }
1784
1785         if (mgmt->u.action.u.sa_query_req.action != WLAN_SA_QUERY_REQUEST) {
1786                 wpa_printf(MSG_DEBUG, "MLME: Unexpected SA Query Action %d",
1787                            mgmt->u.action.u.sa_query_req.action);
1788                 return;
1789         }
1790
1791         if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1792                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA Query from unknown "
1793                            "source " MACSTR, MAC2STR(mgmt->sa));
1794                 return;
1795         }
1796
1797         if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1798                 wpa_printf(MSG_DEBUG, "MLME: Ignore SA query request during "
1799                            "association process");
1800                 return;
1801         }
1802
1803         wpa_printf(MSG_DEBUG, "MLME: Replying to SA Query request");
1804         ieee80211_sta_send_sa_query_resp(wpa_s, mgmt->sa, mgmt->u.action.u.
1805                                          sa_query_req.trans_id);
1806 }
1807
1808 #endif /* CONFIG_IEEE80211W */
1809
1810
1811 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1812                                      struct ieee80211_mgmt *mgmt,
1813                                      size_t len,
1814                                      struct ieee80211_rx_status *rx_status)
1815 {
1816         wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1817
1818         if (len < 25)
1819                 return;
1820
1821         switch (mgmt->u.action.category) {
1822 #ifdef CONFIG_IEEE80211R
1823         case WLAN_ACTION_FT:
1824                 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1825                 break;
1826 #endif /* CONFIG_IEEE80211R */
1827 #ifdef CONFIG_IEEE80211W
1828         case WLAN_ACTION_SA_QUERY:
1829                 ieee80211_rx_mgmt_sa_query_action(wpa_s, mgmt, len, rx_status);
1830                 break;
1831 #endif /* CONFIG_IEEE80211W */
1832         default:
1833                 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1834                            mgmt->u.action.category);
1835                 break;
1836         }
1837 }
1838
1839
1840 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
1841                                   const u8 *buf, size_t len,
1842                                   struct ieee80211_rx_status *rx_status)
1843 {
1844         struct ieee80211_mgmt *mgmt;
1845         u16 fc;
1846
1847         if (len < 24)
1848                 return;
1849
1850         mgmt = (struct ieee80211_mgmt *) buf;
1851         fc = le_to_host16(mgmt->frame_control);
1852
1853         switch (WLAN_FC_GET_STYPE(fc)) {
1854         case WLAN_FC_STYPE_PROBE_REQ:
1855                 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
1856                 break;
1857         case WLAN_FC_STYPE_PROBE_RESP:
1858                 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
1859                 break;
1860         case WLAN_FC_STYPE_BEACON:
1861                 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1862                 break;
1863         case WLAN_FC_STYPE_AUTH:
1864                 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
1865                 break;
1866         case WLAN_FC_STYPE_ASSOC_RESP:
1867                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
1868                 break;
1869         case WLAN_FC_STYPE_REASSOC_RESP:
1870                 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
1871                 break;
1872         case WLAN_FC_STYPE_DEAUTH:
1873                 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
1874                 break;
1875         case WLAN_FC_STYPE_DISASSOC:
1876                 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
1877                 break;
1878         case WLAN_FC_STYPE_ACTION:
1879                 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
1880                 break;
1881         default:
1882                 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
1883                            "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
1884                 break;
1885         }
1886 }
1887
1888
1889 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
1890                                   const u8 *buf, size_t len,
1891                                   struct ieee80211_rx_status *rx_status)
1892 {
1893         struct ieee80211_mgmt *mgmt;
1894         u16 fc;
1895
1896         if (len < 24)
1897                 return;
1898
1899         mgmt = (struct ieee80211_mgmt *) buf;
1900         fc = le_to_host16(mgmt->frame_control);
1901
1902         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
1903                 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
1904                         ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
1905                                                      len, rx_status);
1906                 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
1907                         ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
1908                 }
1909         }
1910 }
1911
1912
1913 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
1914 {
1915         int active = 0;
1916
1917 #if 0 /* FIX */
1918         list_for_each(ptr, &local->sta_list) {
1919                 sta = list_entry(ptr, struct sta_info, list);
1920                 if (sta->dev == dev &&
1921                     time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
1922                                jiffies)) {
1923                         active++;
1924                         break;
1925                 }
1926         }
1927 #endif
1928
1929         return active;
1930 }
1931
1932
1933 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
1934 {
1935 #if 0 /* FIX */
1936         list_for_each_safe(ptr, n, &local->sta_list) {
1937                 sta = list_entry(ptr, struct sta_info, list);
1938                 if (time_after(jiffies, sta->last_rx +
1939                                IEEE80211_IBSS_INACTIVITY_LIMIT)) {
1940                         wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
1941                                    MACSTR, MAC2STR(sta->addr));
1942                         sta_info_free(local, sta, 1);
1943                 }
1944         }
1945 #endif
1946 }
1947
1948
1949 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
1950 {
1951         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
1952
1953         ieee80211_sta_expire(wpa_s);
1954         if (ieee80211_sta_active_ibss(wpa_s))
1955                 return;
1956
1957         wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
1958                    "other IBSS networks with same SSID (merge)");
1959         ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
1960 }
1961
1962
1963 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
1964 {
1965         struct wpa_supplicant *wpa_s = eloop_ctx;
1966
1967         switch (wpa_s->mlme.state) {
1968         case IEEE80211_DISABLED:
1969                 break;
1970         case IEEE80211_AUTHENTICATE:
1971                 ieee80211_authenticate(wpa_s);
1972                 break;
1973         case IEEE80211_ASSOCIATE:
1974                 ieee80211_associate(wpa_s);
1975                 break;
1976         case IEEE80211_ASSOCIATED:
1977                 ieee80211_associated(wpa_s);
1978                 break;
1979         case IEEE80211_IBSS_SEARCH:
1980                 ieee80211_sta_find_ibss(wpa_s);
1981                 break;
1982         case IEEE80211_IBSS_JOINED:
1983                 ieee80211_sta_merge_ibss(wpa_s);
1984                 break;
1985         default:
1986                 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
1987                            wpa_s->mlme.state);
1988                 break;
1989         }
1990
1991         if (ieee80211_privacy_mismatch(wpa_s)) {
1992                 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
1993                            "and mixed-cell disabled - disassociate");
1994
1995                 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
1996                 ieee80211_set_associated(wpa_s, 0);
1997         }
1998 }
1999
2000
2001 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2002 {
2003         struct wpa_ssid *ssid = wpa_s->current_ssid;
2004         if (ssid && ssid->mode != 0)
2005                 return;
2006
2007 #if 0 /* FIX */
2008         if (local->hw->reset_tsf) {
2009                 /* Reset own TSF to allow time synchronization work. */
2010                 local->hw->reset_tsf(local->mdev);
2011         }
2012 #endif
2013
2014         wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2015
2016
2017         if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2018                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2019         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2020                 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2021         else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2022                 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2023         else
2024                 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2025         wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2026                    wpa_s->mlme.auth_alg);
2027         wpa_s->mlme.auth_transaction = -1;
2028         wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2029         ieee80211_authenticate(wpa_s);
2030 }
2031
2032
2033 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2034 {
2035 #if 0 /* FIX */
2036         int m, c;
2037
2038         for (m = 0; m < local->hw->num_modes; m++) {
2039                 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2040                 if (mode->mode != local->conf.phymode)
2041                         continue;
2042                 for (c = 0; c < mode->num_channels; c++) {
2043                         struct ieee80211_channel *chan = &mode->channels[c];
2044                         if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2045                             chan->chan == local->conf.channel) {
2046                                 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2047                                         return 1;
2048                                 break;
2049                         }
2050                 }
2051         }
2052 #endif
2053
2054         return 0;
2055 }
2056
2057
2058 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2059                                    struct ieee80211_sta_bss *bss)
2060 {
2061         int res = 0, rates, done = 0;
2062         struct ieee80211_mgmt *mgmt;
2063 #if 0 /* FIX */
2064         struct ieee80211_tx_control control;
2065         struct ieee80211_rate *rate;
2066         struct rate_control_extra extra;
2067 #endif
2068         u8 *pos, *buf;
2069         size_t len;
2070
2071         /* Remove possible STA entries from other IBSS networks. */
2072 #if 0 /* FIX */
2073         sta_info_flush(local, NULL);
2074
2075         if (local->hw->reset_tsf) {
2076                 /* Reset own TSF to allow time synchronization work. */
2077                 local->hw->reset_tsf(local->mdev);
2078         }
2079 #endif
2080         os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2081
2082 #if 0 /* FIX */
2083         local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2084
2085         sdata->drop_unencrypted = bss->capability &
2086                 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2087 #endif
2088
2089 #if 0 /* FIX */
2090         os_memset(&rq, 0, sizeof(rq));
2091         rq.m = bss->freq * 100000;
2092         rq.e = 1;
2093         res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2094 #endif
2095
2096         if (!ieee80211_ibss_allowed(wpa_s)) {
2097 #if 0 /* FIX */
2098                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2099                            "(%d MHz)", local->conf.channel,
2100                            local->conf.freq);
2101 #endif
2102                 return -1;
2103         }
2104
2105         /* Set beacon template based on scan results */
2106         buf = os_malloc(400);
2107         len = 0;
2108         do {
2109                 if (buf == NULL)
2110                         break;
2111
2112                 mgmt = (struct ieee80211_mgmt *) buf;
2113                 len += 24 + sizeof(mgmt->u.beacon);
2114                 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2115                 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2116                                                    WLAN_FC_STYPE_BEACON);
2117                 os_memset(mgmt->da, 0xff, ETH_ALEN);
2118                 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2119                 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2120 #if 0 /* FIX */
2121                 mgmt->u.beacon.beacon_int =
2122                         host_to_le16(local->conf.beacon_int);
2123 #endif
2124                 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2125
2126                 pos = buf + len;
2127                 len += 2 + wpa_s->mlme.ssid_len;
2128                 *pos++ = WLAN_EID_SSID;
2129                 *pos++ = wpa_s->mlme.ssid_len;
2130                 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2131
2132                 rates = bss->supp_rates_len;
2133                 if (rates > 8)
2134                         rates = 8;
2135                 pos = buf + len;
2136                 len += 2 + rates;
2137                 *pos++ = WLAN_EID_SUPP_RATES;
2138                 *pos++ = rates;
2139                 os_memcpy(pos, bss->supp_rates, rates);
2140
2141                 pos = buf + len;
2142                 len += 2 + 1;
2143                 *pos++ = WLAN_EID_DS_PARAMS;
2144                 *pos++ = 1;
2145                 *pos++ = bss->channel;
2146
2147                 pos = buf + len;
2148                 len += 2 + 2;
2149                 *pos++ = WLAN_EID_IBSS_PARAMS;
2150                 *pos++ = 2;
2151                 /* FIX: set ATIM window based on scan results */
2152                 *pos++ = 0;
2153                 *pos++ = 0;
2154
2155                 if (bss->supp_rates_len > 8) {
2156                         rates = bss->supp_rates_len - 8;
2157                         pos = buf + len;
2158                         len += 2 + rates;
2159                         *pos++ = WLAN_EID_EXT_SUPP_RATES;
2160                         *pos++ = rates;
2161                         os_memcpy(pos, &bss->supp_rates[8], rates);
2162                 }
2163
2164 #if 0 /* FIX */
2165                 os_memset(&control, 0, sizeof(control));
2166                 control.pkt_type = PKT_PROBE_RESP;
2167                 os_memset(&extra, 0, sizeof(extra));
2168                 extra.endidx = local->num_curr_rates;
2169                 rate = rate_control_get_rate(wpa_s, skb, &extra);
2170                 if (rate == NULL) {
2171                         wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2172                                    "rate for IBSS beacon");
2173                         break;
2174                 }
2175                 control.tx_rate = (wpa_s->mlme.short_preamble &&
2176                                    (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2177                         rate->val2 : rate->val;
2178                 control.antenna_sel = local->conf.antenna_sel;
2179                 control.power_level = local->conf.power_level;
2180                 control.no_ack = 1;
2181                 control.retry_limit = 1;
2182                 control.rts_cts_duration = 0;
2183 #endif
2184
2185 #if 0 /* FIX */
2186                 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2187                 if (wpa_s->mlme.probe_resp) {
2188                         mgmt = (struct ieee80211_mgmt *)
2189                                 wpa_s->mlme.probe_resp->data;
2190                         mgmt->frame_control =
2191                                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2192                                              WLAN_FC_STYPE_PROBE_RESP);
2193                 } else {
2194                         wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2195                                    "ProbeResp template for IBSS");
2196                 }
2197
2198                 if (local->hw->beacon_update &&
2199                     local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2200                         wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2201                                    "template based on scan results");
2202                         skb = NULL;
2203                 }
2204
2205                 rates = 0;
2206                 for (i = 0; i < bss->supp_rates_len; i++) {
2207                         int rate = (bss->supp_rates[i] & 0x7f) * 5;
2208                         if (local->conf.phymode == MODE_ATHEROS_TURBO)
2209                                 rate *= 2;
2210                         for (j = 0; j < local->num_curr_rates; j++)
2211                                 if (local->curr_rates[j].rate == rate)
2212                                         rates |= BIT(j);
2213                 }
2214                 wpa_s->mlme.supp_rates_bits = rates;
2215 #endif
2216                 done = 1;
2217         } while (0);
2218
2219         os_free(buf);
2220         if (!done) {
2221                 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2222                            "template");
2223         }
2224
2225         wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2226         ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2227
2228         return res;
2229 }
2230
2231
2232 #if 0 /* FIX */
2233 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2234 {
2235         struct ieee80211_sta_bss *bss;
2236         u8 bssid[ETH_ALEN], *pos;
2237         int i;
2238
2239 #if 0
2240         /* Easier testing, use fixed BSSID. */
2241         os_memset(bssid, 0xfe, ETH_ALEN);
2242 #else
2243         /* Generate random, not broadcast, locally administered BSSID. Mix in
2244          * own MAC address to make sure that devices that do not have proper
2245          * random number generator get different BSSID. */
2246         os_get_random(bssid, ETH_ALEN);
2247         for (i = 0; i < ETH_ALEN; i++)
2248                 bssid[i] ^= wpa_s->own_addr[i];
2249         bssid[0] &= ~0x01;
2250         bssid[0] |= 0x02;
2251 #endif
2252
2253         wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2254                    MACSTR "", MAC2STR(bssid));
2255
2256         bss = ieee80211_bss_add(wpa_s, bssid);
2257         if (bss == NULL)
2258                 return -ENOMEM;
2259
2260 #if 0 /* FIX */
2261         if (local->conf.beacon_int == 0)
2262                 local->conf.beacon_int = 100;
2263         bss->beacon_int = local->conf.beacon_int;
2264         bss->hw_mode = local->conf.phymode;
2265         bss->channel = local->conf.channel;
2266         bss->freq = local->conf.freq;
2267 #endif
2268         os_get_time(&bss->last_update);
2269         bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2270 #if 0 /* FIX */
2271         if (sdata->default_key) {
2272                 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2273         } else
2274                 sdata->drop_unencrypted = 0;
2275         bss->supp_rates_len = local->num_curr_rates;
2276 #endif
2277         pos = bss->supp_rates;
2278 #if 0 /* FIX */
2279         for (i = 0; i < local->num_curr_rates; i++) {
2280                 int rate = local->curr_rates[i].rate;
2281                 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2282                         rate /= 2;
2283                 *pos++ = (u8) (rate / 5);
2284         }
2285 #endif
2286
2287         return ieee80211_sta_join_ibss(wpa_s, bss);
2288 }
2289 #endif
2290
2291
2292 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2293 {
2294         struct ieee80211_sta_bss *bss;
2295         int found = 0;
2296         u8 bssid[ETH_ALEN];
2297         int active_ibss;
2298         struct os_time now;
2299
2300         if (wpa_s->mlme.ssid_len == 0)
2301                 return -EINVAL;
2302
2303         active_ibss = ieee80211_sta_active_ibss(wpa_s);
2304 #ifdef IEEE80211_IBSS_DEBUG
2305         wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2306                    active_ibss);
2307 #endif /* IEEE80211_IBSS_DEBUG */
2308         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2309                 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2310                     os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2311                     || !(bss->capability & WLAN_CAPABILITY_IBSS))
2312                         continue;
2313 #ifdef IEEE80211_IBSS_DEBUG
2314                 wpa_printf(MSG_DEBUG, "   bssid=" MACSTR " found",
2315                            MAC2STR(bss->bssid));
2316 #endif /* IEEE80211_IBSS_DEBUG */
2317                 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2318                 found = 1;
2319                 if (active_ibss ||
2320                     os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2321                         break;
2322         }
2323
2324 #ifdef IEEE80211_IBSS_DEBUG
2325         wpa_printf(MSG_DEBUG, "   sta_find_ibss: selected " MACSTR " current "
2326                    MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2327 #endif /* IEEE80211_IBSS_DEBUG */
2328         if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2329             (bss = ieee80211_bss_get(wpa_s, bssid))) {
2330                 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2331                            " based on configured SSID",
2332                            MAC2STR(bssid));
2333                 return ieee80211_sta_join_ibss(wpa_s, bss);
2334         }
2335 #ifdef IEEE80211_IBSS_DEBUG
2336         wpa_printf(MSG_DEBUG, "   did not try to join ibss");
2337 #endif /* IEEE80211_IBSS_DEBUG */
2338
2339         /* Selected IBSS not found in current scan results - try to scan */
2340         os_get_time(&now);
2341 #if 0 /* FIX */
2342         if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2343             !ieee80211_sta_active_ibss(wpa_s)) {
2344                 ieee80211_reschedule_timer(wpa_s,
2345                                            IEEE80211_IBSS_MERGE_INTERVAL);
2346         } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2347                               IEEE80211_SCAN_INTERVAL)) {
2348                 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2349                            "to join");
2350                 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2351                                               wpa_s->mlme.ssid_len);
2352         } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2353                 int interval = IEEE80211_SCAN_INTERVAL;
2354
2355                 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2356                                IEEE80211_IBSS_JOIN_TIMEOUT)) {
2357                         if (wpa_s->mlme.create_ibss &&
2358                             ieee80211_ibss_allowed(wpa_s))
2359                                 return ieee80211_sta_create_ibss(wpa_s);
2360                         if (wpa_s->mlme.create_ibss) {
2361                                 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2362                                            "on the configured channel %d "
2363                                            "(%d MHz)",
2364                                            local->conf.channel,
2365                                            local->conf.freq);
2366                         }
2367
2368                         /* No IBSS found - decrease scan interval and continue
2369                          * scanning. */
2370                         interval = IEEE80211_SCAN_INTERVAL_SLOW;
2371                 }
2372
2373                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2374                 ieee80211_reschedule_timer(wpa_s, interval);
2375                 return 0;
2376         }
2377 #endif
2378
2379         return 0;
2380 }
2381
2382
2383 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2384                            size_t *len)
2385 {
2386         os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2387         *len = wpa_s->mlme.ssid_len;
2388         return 0;
2389 }
2390
2391
2392 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2393                             struct wpa_driver_associate_params *params)
2394 {
2395         struct ieee80211_sta_bss *bss;
2396
2397         wpa_s->mlme.bssid_set = 0;
2398         wpa_s->mlme.freq = params->freq;
2399         if (params->bssid) {
2400                 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2401                 if (!is_zero_ether_addr(params->bssid))
2402                         wpa_s->mlme.bssid_set = 1;
2403                 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2404                 if (bss) {
2405                         wpa_s->mlme.phymode = bss->hw_mode;
2406                         wpa_s->mlme.channel = bss->channel;
2407                         wpa_s->mlme.freq = bss->freq;
2408                 }
2409         }
2410
2411 #if 0 /* FIX */
2412         /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2413          * not defined. */
2414         if (local->hw->conf_tx) {
2415                 struct ieee80211_tx_queue_params qparam;
2416                 int i;
2417
2418                 os_memset(&qparam, 0, sizeof(qparam));
2419                 /* TODO: are these ok defaults for all hw_modes? */
2420                 qparam.aifs = 2;
2421                 qparam.cw_min =
2422                         local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2423                 qparam.cw_max = 1023;
2424                 qparam.burst_time = 0;
2425                 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2426                 {
2427                         local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2428                                            &qparam);
2429                 }
2430                 /* IBSS uses different parameters for Beacon sending */
2431                 qparam.cw_min++;
2432                 qparam.cw_min *= 2;
2433                 qparam.cw_min--;
2434                 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2435         }
2436 #endif
2437
2438         if (wpa_s->mlme.ssid_len != params->ssid_len ||
2439             os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2440                 wpa_s->mlme.prev_bssid_set = 0;
2441         os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2442         os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2443                   MAX_SSID_LEN - params->ssid_len);
2444         wpa_s->mlme.ssid_len = params->ssid_len;
2445         wpa_s->mlme.ssid_set = 1;
2446
2447         os_free(wpa_s->mlme.extra_ie);
2448         if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2449                 wpa_s->mlme.extra_ie = NULL;
2450                 wpa_s->mlme.extra_ie_len = 0;
2451         } else {
2452                 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2453                 if (wpa_s->mlme.extra_ie == NULL) {
2454                         wpa_s->mlme.extra_ie_len = 0;
2455                         return -1;
2456                 }
2457                 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2458                           params->wpa_ie_len);
2459                 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2460         }
2461
2462         wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2463
2464         ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2465                                   wpa_s->mlme.channel, wpa_s->mlme.freq);
2466
2467         if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2468                 os_get_time(&wpa_s->mlme.ibss_join_req);
2469                 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2470                 return ieee80211_sta_find_ibss(wpa_s);
2471         }
2472
2473         if (wpa_s->mlme.bssid_set)
2474                 ieee80211_sta_new_auth(wpa_s);
2475
2476         return 0;
2477 }
2478
2479
2480 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2481 {
2482         wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2483         wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2484         wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2485 }
2486
2487
2488 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2489 {
2490         wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2491         wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2492         wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2493         if (wpa_s->mlme.freq == 0)
2494                 return 0;
2495         return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2496                                          wpa_s->mlme.channel,
2497                                          wpa_s->mlme.freq);
2498 }
2499
2500
2501 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2502 {
2503         size_t m;
2504         int c;
2505
2506         for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2507                 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2508                 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2509                         continue;
2510                 for (c = 0; c < mode->num_channels; c++) {
2511                         struct wpa_channel_data *chan = &mode->channels[c];
2512                         if (chan->flag & WPA_CHAN_W_SCAN &&
2513                             chan->chan == wpa_s->mlme.channel) {
2514                                 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2515                                         return 1;
2516                                 break;
2517                         }
2518                 }
2519         }
2520
2521         return 0;
2522 }
2523
2524
2525 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2526 {
2527         struct wpa_supplicant *wpa_s = eloop_ctx;
2528         struct wpa_hw_modes *mode;
2529         struct wpa_channel_data *chan;
2530         int skip = 0;
2531         int timeout = 0;
2532         struct wpa_ssid *ssid = wpa_s->current_ssid;
2533         int adhoc;
2534
2535         if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2536                 return;
2537
2538         adhoc = ssid && ssid->mode == 1;
2539
2540         switch (wpa_s->mlme.scan_state) {
2541         case SCAN_SET_CHANNEL:
2542                 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2543                 if (wpa_s->mlme.scan_hw_mode_idx >=
2544                     (int) wpa_s->mlme.num_modes ||
2545                     (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2546                      (int) wpa_s->mlme.num_modes
2547                      && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2548                         if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2549                                 wpa_printf(MSG_DEBUG, "MLME: failed to "
2550                                            "restore operational channel after "
2551                                            "scan");
2552                         }
2553                         wpa_printf(MSG_DEBUG, "MLME: scan completed");
2554                         wpa_s->mlme.sta_scanning = 0;
2555                         os_get_time(&wpa_s->mlme.last_scan_completed);
2556                         wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2557                         if (adhoc) {
2558                                 if (!wpa_s->mlme.bssid_set ||
2559                                     (wpa_s->mlme.state ==
2560                                      IEEE80211_IBSS_JOINED &&
2561                                      !ieee80211_sta_active_ibss(wpa_s)))
2562                                         ieee80211_sta_find_ibss(wpa_s);
2563                         }
2564                         return;
2565                 }
2566                 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2567                 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2568                 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2569                     (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2570                     (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2571                      mode->mode == WPA_MODE_IEEE80211B &&
2572                      wpa_s->mlme.scan_skip_11b))
2573                         skip = 1;
2574
2575                 if (!skip) {
2576                         wpa_printf(MSG_MSGDUMP,
2577                                    "MLME: scan channel %d (%d MHz)",
2578                                    chan->chan, chan->freq);
2579
2580                         wpa_s->mlme.channel = chan->chan;
2581                         wpa_s->mlme.freq = chan->freq;
2582                         wpa_s->mlme.phymode = mode->mode;
2583                         if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2584                                                       chan->chan, chan->freq))
2585                         {
2586                                 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2587                                            "channel %d (%d MHz) for scan",
2588                                            chan->chan, chan->freq);
2589                                 skip = 1;
2590                         }
2591                 }
2592
2593                 wpa_s->mlme.scan_channel_idx++;
2594                 if (wpa_s->mlme.scan_channel_idx >=
2595                     wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2596                     num_channels) {
2597                         wpa_s->mlme.scan_hw_mode_idx++;
2598                         wpa_s->mlme.scan_channel_idx = 0;
2599                 }
2600
2601                 if (skip) {
2602                         timeout = 0;
2603                         break;
2604                 }
2605
2606                 timeout = IEEE80211_PROBE_DELAY;
2607                 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2608                 break;
2609         case SCAN_SEND_PROBE:
2610                 if (ieee80211_active_scan(wpa_s)) {
2611                         ieee80211_send_probe_req(wpa_s, NULL,
2612                                                  wpa_s->mlme.scan_ssid,
2613                                                  wpa_s->mlme.scan_ssid_len);
2614                         timeout = IEEE80211_CHANNEL_TIME;
2615                 } else {
2616                         timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2617                 }
2618                 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2619                 break;
2620         }
2621
2622         eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2623                                ieee80211_sta_scan_timer, wpa_s, NULL);
2624 }
2625
2626
2627 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2628                            size_t ssid_len)
2629 {
2630         if (ssid_len > MAX_SSID_LEN)
2631                 return -1;
2632
2633         /* MLME-SCAN.request (page 118)  page 144 (11.1.3.1)
2634          * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2635          * BSSID: MACAddress
2636          * SSID
2637          * ScanType: ACTIVE, PASSIVE
2638          * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2639          *    a Probe frame during active scanning
2640          * ChannelList
2641          * MinChannelTime (>= ProbeDelay), in TU
2642          * MaxChannelTime: (>= MinChannelTime), in TU
2643          */
2644
2645          /* MLME-SCAN.confirm
2646           * BSSDescriptionSet
2647           * ResultCode: SUCCESS, INVALID_PARAMETERS
2648          */
2649
2650         /* TODO: if assoc, move to power save mode for the duration of the
2651          * scan */
2652
2653         if (wpa_s->mlme.sta_scanning)
2654                 return -1;
2655
2656         wpa_printf(MSG_DEBUG, "MLME: starting scan");
2657
2658         ieee80211_sta_save_oper_chan(wpa_s);
2659
2660         wpa_s->mlme.sta_scanning = 1;
2661         /* TODO: stop TX queue? */
2662
2663         if (ssid) {
2664                 wpa_s->mlme.scan_ssid_len = ssid_len;
2665                 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2666         } else
2667                 wpa_s->mlme.scan_ssid_len = 0;
2668         wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2669                                         * supported */
2670         wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2671         wpa_s->mlme.scan_hw_mode_idx = 0;
2672         wpa_s->mlme.scan_channel_idx = 0;
2673         eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2674
2675         return 0;
2676 }
2677
2678
2679 struct wpa_scan_results *
2680 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2681 {
2682         size_t ap_num = 0;
2683         struct wpa_scan_results *res;
2684         struct wpa_scan_res *r;
2685         struct ieee80211_sta_bss *bss;
2686
2687         res = os_zalloc(sizeof(*res));
2688         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2689                 ap_num++;
2690         res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2691         if (res->res == NULL) {
2692                 os_free(res);
2693                 return NULL;
2694         }
2695
2696         for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2697                 r = os_zalloc(sizeof(*r) + bss->ie_len);
2698                 if (r == NULL)
2699                         break;
2700                 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2701                 r->freq = bss->freq;
2702                 r->beacon_int = bss->beacon_int;
2703                 r->caps = bss->capability;
2704                 r->level = bss->rssi;
2705                 r->tsf = bss->timestamp;
2706                 if (bss->ie) {
2707                         r->ie_len = bss->ie_len;
2708                         os_memcpy(r + 1, bss->ie, bss->ie_len);
2709                 }
2710
2711                 res->res[res->num++] = r;
2712         }
2713
2714         return res;
2715 }
2716
2717
2718 #if 0 /* FIX */
2719 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2720                                          struct sk_buff *skb, u8 *bssid,
2721                                          u8 *addr)
2722 {
2723         struct ieee80211_local *local = dev->priv;
2724         struct list_head *ptr;
2725         struct sta_info *sta;
2726         struct wpa_supplicant *sta_dev = NULL;
2727
2728         /* TODO: Could consider removing the least recently used entry and
2729          * allow new one to be added. */
2730         if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2731                 if (net_ratelimit()) {
2732                         wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2733                                    "STA entry " MACSTR, MAC2STR(addr));
2734                 }
2735                 return NULL;
2736         }
2737
2738         spin_lock_bh(&local->sub_if_lock);
2739         list_for_each(ptr, &local->sub_if_list) {
2740                 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2741                 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2742                     os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2743                         sta_dev = sdata->dev;
2744                         break;
2745                 }
2746         }
2747         spin_unlock_bh(&local->sub_if_lock);
2748
2749         if (sta_dev == NULL)
2750                 return NULL;
2751
2752         wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2753                    " (dev=%s)", MAC2STR(addr), sta_dev->name);
2754
2755         sta = sta_info_add(wpa_s, addr);
2756         if (sta == NULL) {
2757                 return NULL;
2758         }
2759
2760         sta->dev = sta_dev;
2761         sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2762
2763         rate_control_rate_init(local, sta);
2764
2765         return sta; /* caller will call sta_info_release() */
2766 }
2767 #endif
2768
2769
2770 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2771 {
2772         wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2773
2774         ieee80211_send_deauth(wpa_s, reason);
2775         ieee80211_set_associated(wpa_s, 0);
2776         return 0;
2777 }
2778
2779
2780 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2781 {
2782         wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2783
2784         if (!wpa_s->mlme.associated)
2785                 return -1;
2786
2787         ieee80211_send_disassoc(wpa_s, reason);
2788         ieee80211_set_associated(wpa_s, 0);
2789         return 0;
2790 }
2791
2792
2793 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2794                       struct ieee80211_rx_status *rx_status)
2795 {
2796         struct ieee80211_mgmt *mgmt;
2797         u16 fc;
2798         const u8 *pos;
2799
2800         /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2801
2802         if (wpa_s->mlme.sta_scanning) {
2803                 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2804                 return;
2805         }
2806
2807         if (len < 24)
2808                 return;
2809
2810         mgmt = (struct ieee80211_mgmt *) buf;
2811         fc = le_to_host16(mgmt->frame_control);
2812
2813         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2814                 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2815         else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2816                 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2817                     WLAN_FC_FROMDS)
2818                         return;
2819                 /* mgmt->sa is actually BSSID for FromDS data frames */
2820                 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2821                         return;
2822                 /* Skip IEEE 802.11 and LLC headers */
2823                 pos = buf + 24 + 6;
2824                 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2825                         return;
2826                 pos += 2;
2827                 /* mgmt->bssid is actually BSSID for SA data frames */
2828                 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2829                                         pos, buf + len - pos);
2830         }
2831 }
2832
2833
2834 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2835                                     size_t num_hw_features)
2836 {
2837         size_t i;
2838
2839         if (hw_features == NULL)
2840                 return;
2841
2842         for (i = 0; i < num_hw_features; i++) {
2843                 os_free(hw_features[i].channels);
2844                 os_free(hw_features[i].rates);
2845         }
2846
2847         os_free(hw_features);
2848 }
2849
2850
2851 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
2852 {
2853         u16 num_modes, flags;
2854
2855         wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
2856                                                         &flags);
2857         if (wpa_s->mlme.modes == NULL) {
2858                 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
2859                            "channels and rates from the driver");
2860                 return -1;
2861         }
2862
2863         wpa_s->mlme.num_modes = num_modes;
2864
2865         wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
2866         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
2867         wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
2868
2869         return 0;
2870 }
2871
2872
2873 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
2874 {
2875         eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
2876         eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
2877         os_free(wpa_s->mlme.extra_ie);
2878         wpa_s->mlme.extra_ie = NULL;
2879         os_free(wpa_s->mlme.extra_probe_ie);
2880         wpa_s->mlme.extra_probe_ie = NULL;
2881         os_free(wpa_s->mlme.assocreq_ies);
2882         wpa_s->mlme.assocreq_ies = NULL;
2883         os_free(wpa_s->mlme.assocresp_ies);
2884         wpa_s->mlme.assocresp_ies = NULL;
2885         ieee80211_bss_list_deinit(wpa_s);
2886         ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
2887                                        wpa_s->mlme.num_modes);
2888 #ifdef CONFIG_IEEE80211R
2889         os_free(wpa_s->mlme.ft_ies);
2890         wpa_s->mlme.ft_ies = NULL;
2891         wpa_s->mlme.ft_ies_len = 0;
2892 #endif /* CONFIG_IEEE80211R */
2893 }
2894
2895
2896 #ifdef CONFIG_IEEE80211R
2897
2898 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
2899                                 const u8 *ies, size_t ies_len)
2900 {
2901         if (md == NULL) {
2902                 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
2903                 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
2904         } else {
2905                 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
2906                            MAC2STR(md));
2907                 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
2908         }
2909
2910         wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
2911         os_free(wpa_s->mlme.ft_ies);
2912         wpa_s->mlme.ft_ies = os_malloc(ies_len);
2913         if (wpa_s->mlme.ft_ies == NULL)
2914                 return -1;
2915         os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
2916         wpa_s->mlme.ft_ies_len = ies_len;
2917
2918         return 0;
2919 }
2920
2921
2922 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
2923                                  const u8 *target_ap,
2924                                  const u8 *ies, size_t ies_len)
2925 {
2926         u8 *buf;
2927         size_t len;
2928         struct ieee80211_mgmt *mgmt;
2929         int res;
2930
2931         /*
2932          * Action frame payload:
2933          * Category[1] = 6 (Fast BSS Transition)
2934          * Action[1] = 1 (Fast BSS Transition Request)
2935          * STA Address
2936          * Target AP Address
2937          * FT IEs
2938          */
2939
2940         buf = os_zalloc(sizeof(*mgmt) + ies_len);
2941         if (buf == NULL) {
2942                 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
2943                            "FT action frame");
2944                 return -1;
2945         }
2946
2947         mgmt = (struct ieee80211_mgmt *) buf;
2948         len = 24;
2949         os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
2950         os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2951         os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2952         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2953                                            WLAN_FC_STYPE_ACTION);
2954         mgmt->u.action.category = WLAN_ACTION_FT;
2955         mgmt->u.action.u.ft_action_req.action = action;
2956         os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
2957                   ETH_ALEN);
2958         os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
2959                   ETH_ALEN);
2960         os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
2961         len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
2962
2963         wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
2964                    "Target AP=" MACSTR " body_len=%lu",
2965                    action, MAC2STR(target_ap), (unsigned long) ies_len);
2966
2967         res = ieee80211_sta_tx(wpa_s, buf, len);
2968         os_free(buf);
2969
2970         return res;
2971 }
2972
2973 #endif /* CONFIG_IEEE80211R */
2974
2975
2976 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
2977                                    size_t ies_len)
2978 {
2979         os_free(wpa_s->mlme.extra_probe_ie);
2980         wpa_s->mlme.extra_probe_ie = NULL;
2981         wpa_s->mlme.extra_probe_ie_len = 0;
2982
2983         if (ies == NULL)
2984                 return 0;
2985
2986         wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
2987         if (wpa_s->mlme.extra_probe_ie == NULL)
2988                 return -1;
2989
2990         os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
2991         wpa_s->mlme.extra_probe_ie_len = ies_len;
2992
2993         return 0;
2994 }