contrib/wpa/src/ap/ieee802_11.c

   1 /*
   2  * hostapd / IEEE 802.11 Management
   3  * Copyright (c) 2002-2010, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "utils/includes.h"
  16
  17 #ifndef CONFIG_NATIVE_WINDOWS
  18
  19 #include "utils/common.h"
  20 #include "utils/eloop.h"
  21 #include "crypto/crypto.h"
  22 #include "drivers/driver.h"
  23 #include "common/ieee802_11_defs.h"
  24 #include "common/ieee802_11_common.h"
  25 #include "common/wpa_ctrl.h"
  26 #include "radius/radius.h"
  27 #include "radius/radius_client.h"
  28 #include "wps/wps.h"
  29 #include "hostapd.h"
  30 #include "beacon.h"
  31 #include "ieee802_11_auth.h"
  32 #include "sta_info.h"
  33 #include "ieee802_1x.h"
  34 #include "wpa_auth.h"
  35 #include "wmm.h"
  36 #include "ap_list.h"
  37 #include "accounting.h"
  38 #include "ap_config.h"
  39 #include "ap_mlme.h"
  40 #include "ieee802_11.h"
  41
  42
  43 u8 * hostapd_eid_supp_rates(struct hostapd_data *hapd, u8 *eid)
  44 {
  45         u8 *pos = eid;
  46         int i, num, count;
  47
  48         if (hapd->iface->current_rates == NULL)
  49                 return eid;
  50
  51         *pos++ = WLAN_EID_SUPP_RATES;
  52         num = hapd->iface->num_rates;
  53         if (num > 8) {
  54                 /* rest of the rates are encoded in Extended supported
  55                  * rates element */
  56                 num = 8;
  57         }
  58
  59         *pos++ = num;
  60         count = 0;
  61         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num;
  62              i++) {
  63                 count++;
  64                 *pos = hapd->iface->current_rates[i].rate / 5;
  65                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  66                         *pos |= 0x80;
  67                 pos++;
  68         }
  69
  70         return pos;
  71 }
  72
  73
  74 u8 * hostapd_eid_ext_supp_rates(struct hostapd_data *hapd, u8 *eid)
  75 {
  76         u8 *pos = eid;
  77         int i, num, count;
  78
  79         if (hapd->iface->current_rates == NULL)
  80                 return eid;
  81
  82         num = hapd->iface->num_rates;
  83         if (num <= 8)
  84                 return eid;
  85         num -= 8;
  86
  87         *pos++ = WLAN_EID_EXT_SUPP_RATES;
  88         *pos++ = num;
  89         count = 0;
  90         for (i = 0, count = 0; i < hapd->iface->num_rates && count < num + 8;
  91              i++) {
  92                 count++;
  93                 if (count <= 8)
  94                         continue; /* already in SuppRates IE */
  95                 *pos = hapd->iface->current_rates[i].rate / 5;
  96                 if (hapd->iface->current_rates[i].flags & HOSTAPD_RATE_BASIC)
  97                         *pos |= 0x80;
  98                 pos++;
  99         }
 100
 101         return pos;
 102 }
 103
 104
 105 u16 hostapd_own_capab_info(struct hostapd_data *hapd, struct sta_info *sta,
 106                            int probe)
 107 {
 108         int capab = WLAN_CAPABILITY_ESS;
 109         int privacy;
 110
 111         if (hapd->iface->num_sta_no_short_preamble == 0 &&
 112             hapd->iconf->preamble == SHORT_PREAMBLE)
 113                 capab |= WLAN_CAPABILITY_SHORT_PREAMBLE;
 114
 115         privacy = hapd->conf->ssid.wep.keys_set;
 116
 117         if (hapd->conf->ieee802_1x &&
 118             (hapd->conf->default_wep_key_len ||
 119              hapd->conf->individual_wep_key_len))
 120                 privacy = 1;
 121
 122         if (hapd->conf->wpa)
 123                 privacy = 1;
 124
 125         if (sta) {
 126                 int policy, def_klen;
 127                 if (probe && sta->ssid_probe) {
 128                         policy = sta->ssid_probe->security_policy;
 129                         def_klen = sta->ssid_probe->wep.default_len;
 130                 } else {
 131                         policy = sta->ssid->security_policy;
 132                         def_klen = sta->ssid->wep.default_len;
 133                 }
 134                 privacy = policy != SECURITY_PLAINTEXT;
 135                 if (policy == SECURITY_IEEE_802_1X && def_klen == 0)
 136                         privacy = 0;
 137         }
 138
 139         if (privacy)
 140                 capab |= WLAN_CAPABILITY_PRIVACY;
 141
 142         if (hapd->iface->current_mode &&
 143             hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G &&
 144             hapd->iface->num_sta_no_short_slot_time == 0)
 145                 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME;
 146
 147         return capab;
 148 }
 149
 150
 151 #ifdef CONFIG_IEEE80211W
 152 static u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
 153                                             struct sta_info *sta, u8 *eid)
 154 {
 155         u8 *pos = eid;
 156         u32 timeout, tu;
 157         struct os_time now, passed;
 158
 159         *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
 160         *pos++ = 5;
 161         *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
 162         os_get_time(&now);
 163         os_time_sub(&now, &sta->sa_query_start, &passed);
 164         tu = (passed.sec * 1000000 + passed.usec) / 1024;
 165         if (hapd->conf->assoc_sa_query_max_timeout > tu)
 166                 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
 167         else
 168                 timeout = 0;
 169         if (timeout < hapd->conf->assoc_sa_query_max_timeout)
 170                 timeout++; /* add some extra time for local timers */
 171         WPA_PUT_LE32(pos, timeout);
 172         pos += 4;
 173
 174         return pos;
 175 }
 176 #endif /* CONFIG_IEEE80211W */
 177
 178
 179 void ieee802_11_print_ssid(char *buf, const u8 *ssid, u8 len)
 180 {
 181         int i;
 182         if (len > HOSTAPD_MAX_SSID_LEN)
 183                 len = HOSTAPD_MAX_SSID_LEN;
 184         for (i = 0; i < len; i++) {
 185                 if (ssid[i] >= 32 && ssid[i] < 127)
 186                         buf[i] = ssid[i];
 187                 else
 188                         buf[i] = '.';
 189         }
 190         buf[len] = '\0';
 191 }
 192
 193
 194 static u16 auth_shared_key(struct hostapd_data *hapd, struct sta_info *sta,
 195                            u16 auth_transaction, const u8 *challenge,
 196                            int iswep)
 197 {
 198         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 199                        HOSTAPD_LEVEL_DEBUG,
 200                        "authentication (shared key, transaction %d)",
 201                        auth_transaction);
 202
 203         if (auth_transaction == 1) {
 204                 if (!sta->challenge) {
 205                         /* Generate a pseudo-random challenge */
 206                         u8 key[8];
 207                         time_t now;
 208                         int r;
 209                         sta->challenge = os_zalloc(WLAN_AUTH_CHALLENGE_LEN);
 210                         if (sta->challenge == NULL)
 211                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 212
 213                         now = time(NULL);
 214                         r = random();
 215                         os_memcpy(key, &now, 4);
 216                         os_memcpy(key + 4, &r, 4);
 217                         rc4_skip(key, sizeof(key), 0,
 218                                  sta->challenge, WLAN_AUTH_CHALLENGE_LEN);
 219                 }
 220                 return 0;
 221         }
 222
 223         if (auth_transaction != 3)
 224                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 225
 226         /* Transaction 3 */
 227         if (!iswep || !sta->challenge || !challenge ||
 228             os_memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) {
 229                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 230                                HOSTAPD_LEVEL_INFO,
 231                                "shared key authentication - invalid "
 232                                "challenge-response");
 233                 return WLAN_STATUS_CHALLENGE_FAIL;
 234         }
 235
 236         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 237                        HOSTAPD_LEVEL_DEBUG,
 238                        "authentication OK (shared key)");
 239 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 240         /* Station will be marked authenticated if it ACKs the
 241          * authentication reply. */
 242 #else
 243         sta->flags |= WLAN_STA_AUTH;
 244         wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 245 #endif
 246         os_free(sta->challenge);
 247         sta->challenge = NULL;
 248
 249         return 0;
 250 }
 251
 252
 253 static void send_auth_reply(struct hostapd_data *hapd,
 254                             const u8 *dst, const u8 *bssid,
 255                             u16 auth_alg, u16 auth_transaction, u16 resp,
 256                             const u8 *ies, size_t ies_len)
 257 {
 258         struct ieee80211_mgmt *reply;
 259         u8 *buf;
 260         size_t rlen;
 261
 262         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth) + ies_len;
 263         buf = os_zalloc(rlen);
 264         if (buf == NULL)
 265                 return;
 266
 267         reply = (struct ieee80211_mgmt *) buf;
 268         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 269                                             WLAN_FC_STYPE_AUTH);
 270         os_memcpy(reply->da, dst, ETH_ALEN);
 271         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 272         os_memcpy(reply->bssid, bssid, ETH_ALEN);
 273
 274         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 275         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 276         reply->u.auth.status_code = host_to_le16(resp);
 277
 278         if (ies && ies_len)
 279                 os_memcpy(reply->u.auth.variable, ies, ies_len);
 280
 281         wpa_printf(MSG_DEBUG, "authentication reply: STA=" MACSTR
 282                    " auth_alg=%d auth_transaction=%d resp=%d (IE len=%lu)",
 283                    MAC2STR(dst), auth_alg, auth_transaction,
 284                    resp, (unsigned long) ies_len);
 285         if (hapd->drv.send_mgmt_frame(hapd, reply, rlen) < 0)
 286                 perror("send_auth_reply: send");
 287
 288         os_free(buf);
 289 }
 290
 291
 292 #ifdef CONFIG_IEEE80211R
 293 static void handle_auth_ft_finish(void *ctx, const u8 *dst, const u8 *bssid,
 294                                   u16 auth_transaction, u16 status,
 295                                   const u8 *ies, size_t ies_len)
 296 {
 297         struct hostapd_data *hapd = ctx;
 298         struct sta_info *sta;
 299
 300         send_auth_reply(hapd, dst, bssid, WLAN_AUTH_FT, auth_transaction,
 301                         status, ies, ies_len);
 302
 303         if (status != WLAN_STATUS_SUCCESS)
 304                 return;
 305
 306         sta = ap_get_sta(hapd, dst);
 307         if (sta == NULL)
 308                 return;
 309
 310         hostapd_logger(hapd, dst, HOSTAPD_MODULE_IEEE80211,
 311                        HOSTAPD_LEVEL_DEBUG, "authentication OK (FT)");
 312         sta->flags |= WLAN_STA_AUTH;
 313         mlme_authenticate_indication(hapd, sta);
 314 }
 315 #endif /* CONFIG_IEEE80211R */
 316
 317
 318 static void handle_auth(struct hostapd_data *hapd,
 319                         const struct ieee80211_mgmt *mgmt, size_t len)
 320 {
 321         u16 auth_alg, auth_transaction, status_code;
 322         u16 resp = WLAN_STATUS_SUCCESS;
 323         struct sta_info *sta = NULL;
 324         int res;
 325         u16 fc;
 326         const u8 *challenge = NULL;
 327         u32 session_timeout, acct_interim_interval;
 328         int vlan_id = 0;
 329         u8 resp_ies[2 + WLAN_AUTH_CHALLENGE_LEN];
 330         size_t resp_ies_len = 0;
 331
 332         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 333                 printf("handle_auth - too short payload (len=%lu)\n",
 334                        (unsigned long) len);
 335                 return;
 336         }
 337
 338         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 339         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 340         status_code = le_to_host16(mgmt->u.auth.status_code);
 341         fc = le_to_host16(mgmt->frame_control);
 342
 343         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 344             2 + WLAN_AUTH_CHALLENGE_LEN &&
 345             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 346             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 347                 challenge = &mgmt->u.auth.variable[2];
 348
 349         wpa_printf(MSG_DEBUG, "authentication: STA=" MACSTR " auth_alg=%d "
 350                    "auth_transaction=%d status_code=%d wep=%d%s",
 351                    MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 352                    status_code, !!(fc & WLAN_FC_ISWEP),
 353                    challenge ? " challenge" : "");
 354
 355         if (hapd->tkip_countermeasures) {
 356                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 357                 goto fail;
 358         }
 359
 360         if (!(((hapd->conf->auth_algs & WPA_AUTH_ALG_OPEN) &&
 361                auth_alg == WLAN_AUTH_OPEN) ||
 362 #ifdef CONFIG_IEEE80211R
 363               (hapd->conf->wpa &&
 364                (hapd->conf->wpa_key_mgmt &
 365                 (WPA_KEY_MGMT_FT_IEEE8021X | WPA_KEY_MGMT_FT_PSK)) &&
 366                auth_alg == WLAN_AUTH_FT) ||
 367 #endif /* CONFIG_IEEE80211R */
 368               ((hapd->conf->auth_algs & WPA_AUTH_ALG_SHARED) &&
 369                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 370                 printf("Unsupported authentication algorithm (%d)\n",
 371                        auth_alg);
 372                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 373                 goto fail;
 374         }
 375
 376         if (!(auth_transaction == 1 ||
 377               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 378                 printf("Unknown authentication transaction number (%d)\n",
 379                        auth_transaction);
 380                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 381                 goto fail;
 382         }
 383
 384         if (os_memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 385                 printf("Station " MACSTR " not allowed to authenticate.\n",
 386                        MAC2STR(mgmt->sa));
 387                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 388                 goto fail;
 389         }
 390
 391         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 392                                       &session_timeout,
 393                                       &acct_interim_interval, &vlan_id);
 394         if (res == HOSTAPD_ACL_REJECT) {
 395                 printf("Station " MACSTR " not allowed to authenticate.\n",
 396                        MAC2STR(mgmt->sa));
 397                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 398                 goto fail;
 399         }
 400         if (res == HOSTAPD_ACL_PENDING) {
 401                 wpa_printf(MSG_DEBUG, "Authentication frame from " MACSTR
 402                            " waiting for an external authentication",
 403                            MAC2STR(mgmt->sa));
 404                 /* Authentication code will re-send the authentication frame
 405                  * after it has received (and cached) information from the
 406                  * external source. */
 407                 return;
 408         }
 409
 410         sta = ap_sta_add(hapd, mgmt->sa);
 411         if (!sta) {
 412                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 413                 goto fail;
 414         }
 415
 416         if (vlan_id > 0) {
 417                 if (hostapd_get_vlan_id_ifname(hapd->conf->vlan,
 418                                                vlan_id) == NULL) {
 419                         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 420                                        HOSTAPD_LEVEL_INFO, "Invalid VLAN ID "
 421                                        "%d received from RADIUS server",
 422                                        vlan_id);
 423                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 424                         goto fail;
 425                 }
 426                 sta->vlan_id = vlan_id;
 427                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_RADIUS,
 428                                HOSTAPD_LEVEL_INFO, "VLAN ID %d", sta->vlan_id);
 429         }
 430
 431         sta->flags &= ~WLAN_STA_PREAUTH;
 432         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 433
 434         if (hapd->conf->acct_interim_interval == 0 && acct_interim_interval)
 435                 sta->acct_interim_interval = acct_interim_interval;
 436         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 437                 ap_sta_session_timeout(hapd, sta, session_timeout);
 438         else
 439                 ap_sta_no_session_timeout(hapd, sta);
 440
 441         switch (auth_alg) {
 442         case WLAN_AUTH_OPEN:
 443                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 444                                HOSTAPD_LEVEL_DEBUG,
 445                                "authentication OK (open system)");
 446 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 447                 /* Station will be marked authenticated if it ACKs the
 448                  * authentication reply. */
 449 #else
 450                 sta->flags |= WLAN_STA_AUTH;
 451                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 452                 sta->auth_alg = WLAN_AUTH_OPEN;
 453                 mlme_authenticate_indication(hapd, sta);
 454 #endif
 455                 break;
 456         case WLAN_AUTH_SHARED_KEY:
 457                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
 458                                        fc & WLAN_FC_ISWEP);
 459                 sta->auth_alg = WLAN_AUTH_SHARED_KEY;
 460                 mlme_authenticate_indication(hapd, sta);
 461                 if (sta->challenge && auth_transaction == 1) {
 462                         resp_ies[0] = WLAN_EID_CHALLENGE;
 463                         resp_ies[1] = WLAN_AUTH_CHALLENGE_LEN;
 464                         os_memcpy(resp_ies + 2, sta->challenge,
 465                                   WLAN_AUTH_CHALLENGE_LEN);
 466                         resp_ies_len = 2 + WLAN_AUTH_CHALLENGE_LEN;
 467                 }
 468                 break;
 469 #ifdef CONFIG_IEEE80211R
 470         case WLAN_AUTH_FT:
 471                 sta->auth_alg = WLAN_AUTH_FT;
 472                 if (sta->wpa_sm == NULL)
 473                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 474                                                         sta->addr);
 475                 if (sta->wpa_sm == NULL) {
 476                         wpa_printf(MSG_DEBUG, "FT: Failed to initialize WPA "
 477                                    "state machine");
 478                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 479                         goto fail;
 480                 }
 481                 wpa_ft_process_auth(sta->wpa_sm, mgmt->bssid,
 482                                     auth_transaction, mgmt->u.auth.variable,
 483                                     len - IEEE80211_HDRLEN -
 484                                     sizeof(mgmt->u.auth),
 485                                     handle_auth_ft_finish, hapd);
 486                 /* handle_auth_ft_finish() callback will complete auth. */
 487                 return;
 488 #endif /* CONFIG_IEEE80211R */
 489         }
 490
 491  fail:
 492         send_auth_reply(hapd, mgmt->sa, mgmt->bssid, auth_alg,
 493                         auth_transaction + 1, resp, resp_ies, resp_ies_len);
 494 }
 495
 496
 497 static int hostapd_get_aid(struct hostapd_data *hapd, struct sta_info *sta)
 498 {
 499         int i, j = 32, aid;
 500
 501         /* get a unique AID */
 502         if (sta->aid > 0) {
 503                 wpa_printf(MSG_DEBUG, "  old AID %d", sta->aid);
 504                 return 0;
 505         }
 506
 507         for (i = 0; i < AID_WORDS; i++) {
 508                 if (hapd->sta_aid[i] == (u32) -1)
 509                         continue;
 510                 for (j = 0; j < 32; j++) {
 511                         if (!(hapd->sta_aid[i] & BIT(j)))
 512                                 break;
 513                 }
 514                 if (j < 32)
 515                         break;
 516         }
 517         if (j == 32)
 518                 return -1;
 519         aid = i * 32 + j + 1;
 520         if (aid > 2007)
 521                 return -1;
 522
 523         sta->aid = aid;
 524         hapd->sta_aid[i] |= BIT(j);
 525         wpa_printf(MSG_DEBUG, "  new AID %d", sta->aid);
 526         return 0;
 527 }
 528
 529
 530 static u16 check_ssid(struct hostapd_data *hapd, struct sta_info *sta,
 531                       const u8 *ssid_ie, size_t ssid_ie_len)
 532 {
 533         if (ssid_ie == NULL)
 534                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 535
 536         if (ssid_ie_len != hapd->conf->ssid.ssid_len ||
 537             os_memcmp(ssid_ie, hapd->conf->ssid.ssid, ssid_ie_len) != 0) {
 538                 char ssid_txt[33];
 539                 ieee802_11_print_ssid(ssid_txt, ssid_ie, ssid_ie_len);
 540                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 541                                HOSTAPD_LEVEL_INFO,
 542                                "Station tried to associate with unknown SSID "
 543                                "'%s'", ssid_txt);
 544                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 545         }
 546
 547         return WLAN_STATUS_SUCCESS;
 548 }
 549
 550
 551 static u16 check_wmm(struct hostapd_data *hapd, struct sta_info *sta,
 552                      const u8 *wmm_ie, size_t wmm_ie_len)
 553 {
 554         sta->flags &= ~WLAN_STA_WMM;
 555         if (wmm_ie && hapd->conf->wmm_enabled) {
 556                 if (hostapd_eid_wmm_valid(hapd, wmm_ie, wmm_ie_len))
 557                         hostapd_logger(hapd, sta->addr,
 558                                        HOSTAPD_MODULE_WPA,
 559                                        HOSTAPD_LEVEL_DEBUG,
 560                                        "invalid WMM element in association "
 561                                        "request");
 562                 else
 563                         sta->flags |= WLAN_STA_WMM;
 564         }
 565         return WLAN_STATUS_SUCCESS;
 566 }
 567
 568
 569 static u16 copy_supp_rates(struct hostapd_data *hapd, struct sta_info *sta,
 570                            struct ieee802_11_elems *elems)
 571 {
 572         if (!elems->supp_rates) {
 573                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 574                                HOSTAPD_LEVEL_DEBUG,
 575                                "No supported rates element in AssocReq");
 576                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 577         }
 578
 579         if (elems->supp_rates_len > sizeof(sta->supported_rates)) {
 580                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 581                                HOSTAPD_LEVEL_DEBUG,
 582                                "Invalid supported rates element length %d",
 583                                elems->supp_rates_len);
 584                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 585         }
 586
 587         os_memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
 588         os_memcpy(sta->supported_rates, elems->supp_rates,
 589                   elems->supp_rates_len);
 590         sta->supported_rates_len = elems->supp_rates_len;
 591
 592         if (elems->ext_supp_rates) {
 593                 if (elems->supp_rates_len + elems->ext_supp_rates_len >
 594                     sizeof(sta->supported_rates)) {
 595                         hostapd_logger(hapd, sta->addr,
 596                                        HOSTAPD_MODULE_IEEE80211,
 597                                        HOSTAPD_LEVEL_DEBUG,
 598                                        "Invalid supported rates element length"
 599                                        " %d+%d", elems->supp_rates_len,
 600                                        elems->ext_supp_rates_len);
 601                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 602                 }
 603
 604                 os_memcpy(sta->supported_rates + elems->supp_rates_len,
 605                           elems->ext_supp_rates, elems->ext_supp_rates_len);
 606                 sta->supported_rates_len += elems->ext_supp_rates_len;
 607         }
 608
 609         return WLAN_STATUS_SUCCESS;
 610 }
 611
 612
 613 static u16 check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
 614                            const u8 *ies, size_t ies_len, int reassoc)
 615 {
 616         struct ieee802_11_elems elems;
 617         u16 resp;
 618         const u8 *wpa_ie;
 619         size_t wpa_ie_len;
 620
 621         if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) == ParseFailed) {
 622                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 623                                HOSTAPD_LEVEL_INFO, "Station sent an invalid "
 624                                "association request");
 625                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 626         }
 627
 628         resp = check_ssid(hapd, sta, elems.ssid, elems.ssid_len);
 629         if (resp != WLAN_STATUS_SUCCESS)
 630                 return resp;
 631         resp = check_wmm(hapd, sta, elems.wmm, elems.wmm_len);
 632         if (resp != WLAN_STATUS_SUCCESS)
 633                 return resp;
 634         resp = copy_supp_rates(hapd, sta, &elems);
 635         if (resp != WLAN_STATUS_SUCCESS)
 636                 return resp;
 637 #ifdef CONFIG_IEEE80211N
 638         resp = copy_sta_ht_capab(sta, elems.ht_capabilities,
 639                                  elems.ht_capabilities_len);
 640         if (resp != WLAN_STATUS_SUCCESS)
 641                 return resp;
 642 #endif /* CONFIG_IEEE80211N */
 643
 644         if ((hapd->conf->wpa & WPA_PROTO_RSN) && elems.rsn_ie) {
 645                 wpa_ie = elems.rsn_ie;
 646                 wpa_ie_len = elems.rsn_ie_len;
 647         } else if ((hapd->conf->wpa & WPA_PROTO_WPA) &&
 648                    elems.wpa_ie) {
 649                 wpa_ie = elems.wpa_ie;
 650                 wpa_ie_len = elems.wpa_ie_len;
 651         } else {
 652                 wpa_ie = NULL;
 653                 wpa_ie_len = 0;
 654         }
 655
 656 #ifdef CONFIG_WPS
 657         sta->flags &= ~(WLAN_STA_WPS | WLAN_STA_MAYBE_WPS);
 658         if (hapd->conf->wps_state && elems.wps_ie) {
 659                 wpa_printf(MSG_DEBUG, "STA included WPS IE in (Re)Association "
 660                            "Request - assume WPS is used");
 661                 sta->flags |= WLAN_STA_WPS;
 662                 wpabuf_free(sta->wps_ie);
 663                 sta->wps_ie = ieee802_11_vendor_ie_concat(ies, ies_len,
 664                                                           WPS_IE_VENDOR_TYPE);
 665                 wpa_ie = NULL;
 666                 wpa_ie_len = 0;
 667         } else if (hapd->conf->wps_state && wpa_ie == NULL) {
 668                 wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
 669                            "(Re)Association Request - possible WPS use");
 670                 sta->flags |= WLAN_STA_MAYBE_WPS;
 671         } else
 672 #endif /* CONFIG_WPS */
 673         if (hapd->conf->wpa && wpa_ie == NULL) {
 674                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 675                                HOSTAPD_LEVEL_INFO,
 676                                "No WPA/RSN IE in association request");
 677                 return WLAN_STATUS_INVALID_IE;
 678         }
 679
 680         if (hapd->conf->wpa && wpa_ie) {
 681                 int res;
 682                 wpa_ie -= 2;
 683                 wpa_ie_len += 2;
 684                 if (sta->wpa_sm == NULL)
 685                         sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
 686                                                         sta->addr);
 687                 if (sta->wpa_sm == NULL) {
 688                         wpa_printf(MSG_WARNING, "Failed to initialize WPA "
 689                                    "state machine");
 690                         return WLAN_STATUS_UNSPECIFIED_FAILURE;
 691                 }
 692                 res = wpa_validate_wpa_ie(hapd->wpa_auth, sta->wpa_sm,
 693                                           wpa_ie, wpa_ie_len,
 694                                           elems.mdie, elems.mdie_len);
 695                 if (res == WPA_INVALID_GROUP)
 696                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 697                 else if (res == WPA_INVALID_PAIRWISE)
 698                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 699                 else if (res == WPA_INVALID_AKMP)
 700                         resp = WLAN_STATUS_AKMP_NOT_VALID;
 701                 else if (res == WPA_ALLOC_FAIL)
 702                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 703 #ifdef CONFIG_IEEE80211W
 704                 else if (res == WPA_MGMT_FRAME_PROTECTION_VIOLATION)
 705                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 706                 else if (res == WPA_INVALID_MGMT_GROUP_CIPHER)
 707                         resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
 708 #endif /* CONFIG_IEEE80211W */
 709                 else if (res == WPA_INVALID_MDIE)
 710                         resp = WLAN_STATUS_INVALID_MDIE;
 711                 else if (res != WPA_IE_OK)
 712                         resp = WLAN_STATUS_INVALID_IE;
 713                 if (resp != WLAN_STATUS_SUCCESS)
 714                         return resp;
 715 #ifdef CONFIG_IEEE80211W
 716                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 717                     sta->sa_query_count > 0)
 718                         ap_check_sa_query_timeout(hapd, sta);
 719                 if ((sta->flags & WLAN_STA_MFP) && !sta->sa_query_timed_out &&
 720                     (!reassoc || sta->auth_alg != WLAN_AUTH_FT)) {
 721                         /*
 722                          * STA has already been associated with MFP and SA
 723                          * Query timeout has not been reached. Reject the
 724                          * association attempt temporarily and start SA Query,
 725                          * if one is not pending.
 726                          */
 727
 728                         if (sta->sa_query_count == 0)
 729                                 ap_sta_start_sa_query(hapd, sta);
 730
 731                         return WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY;
 732                 }
 733
 734                 if (wpa_auth_uses_mfp(sta->wpa_sm))
 735                         sta->flags |= WLAN_STA_MFP;
 736                 else
 737                         sta->flags &= ~WLAN_STA_MFP;
 738 #endif /* CONFIG_IEEE80211W */
 739
 740 #ifdef CONFIG_IEEE80211R
 741                 if (sta->auth_alg == WLAN_AUTH_FT) {
 742                         if (!reassoc) {
 743                                 wpa_printf(MSG_DEBUG, "FT: " MACSTR " tried "
 744                                            "to use association (not "
 745                                            "re-association) with FT auth_alg",
 746                                            MAC2STR(sta->addr));
 747                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 748                         }
 749
 750                         resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
 751                                                        ies_len);
 752                         if (resp != WLAN_STATUS_SUCCESS)
 753                                 return resp;
 754                 }
 755 #endif /* CONFIG_IEEE80211R */
 756
 757 #ifdef CONFIG_IEEE80211N
 758                 if ((sta->flags & WLAN_STA_HT) &&
 759                     wpa_auth_get_pairwise(sta->wpa_sm) == WPA_CIPHER_TKIP) {
 760                         hostapd_logger(hapd, sta->addr,
 761                                        HOSTAPD_MODULE_IEEE80211,
 762                                        HOSTAPD_LEVEL_INFO,
 763                                        "Station tried to use TKIP with HT "
 764                                        "association");
 765                         return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
 766                 }
 767 #endif /* CONFIG_IEEE80211N */
 768         } else
 769                 wpa_auth_sta_no_wpa(sta->wpa_sm);
 770
 771         return WLAN_STATUS_SUCCESS;
 772 }
 773
 774
 775 static void send_deauth(struct hostapd_data *hapd, const u8 *addr,
 776                         u16 reason_code)
 777 {
 778         int send_len;
 779         struct ieee80211_mgmt reply;
 780
 781         os_memset(&reply, 0, sizeof(reply));
 782         reply.frame_control =
 783                 IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH);
 784         os_memcpy(reply.da, addr, ETH_ALEN);
 785         os_memcpy(reply.sa, hapd->own_addr, ETH_ALEN);
 786         os_memcpy(reply.bssid, hapd->own_addr, ETH_ALEN);
 787
 788         send_len = IEEE80211_HDRLEN + sizeof(reply.u.deauth);
 789         reply.u.deauth.reason_code = host_to_le16(reason_code);
 790
 791         if (hapd->drv.send_mgmt_frame(hapd, &reply, send_len) < 0)
 792                 wpa_printf(MSG_INFO, "Failed to send deauth: %s",
 793                            strerror(errno));
 794 }
 795
 796
 797 static void send_assoc_resp(struct hostapd_data *hapd, struct sta_info *sta,
 798                             u16 status_code, int reassoc, const u8 *ies,
 799                             size_t ies_len)
 800 {
 801         int send_len;
 802         u8 buf[sizeof(struct ieee80211_mgmt) + 1024];
 803         struct ieee80211_mgmt *reply;
 804         u8 *p;
 805
 806         os_memset(buf, 0, sizeof(buf));
 807         reply = (struct ieee80211_mgmt *) buf;
 808         reply->frame_control =
 809                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 810                              (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
 811                               WLAN_FC_STYPE_ASSOC_RESP));
 812         os_memcpy(reply->da, sta->addr, ETH_ALEN);
 813         os_memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 814         os_memcpy(reply->bssid, hapd->own_addr, ETH_ALEN);
 815
 816         send_len = IEEE80211_HDRLEN;
 817         send_len += sizeof(reply->u.assoc_resp);
 818         reply->u.assoc_resp.capab_info =
 819                 host_to_le16(hostapd_own_capab_info(hapd, sta, 0));
 820         reply->u.assoc_resp.status_code = host_to_le16(status_code);
 821         reply->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0)
 822                                                | BIT(14) | BIT(15));
 823         /* Supported rates */
 824         p = hostapd_eid_supp_rates(hapd, reply->u.assoc_resp.variable);
 825         /* Extended supported rates */
 826         p = hostapd_eid_ext_supp_rates(hapd, p);
 827
 828 #ifdef CONFIG_IEEE80211R
 829         if (status_code == WLAN_STATUS_SUCCESS) {
 830                 /* IEEE 802.11r: Mobility Domain Information, Fast BSS
 831                  * Transition Information, RSN, [RIC Response] */
 832                 p = wpa_sm_write_assoc_resp_ies(sta->wpa_sm, p,
 833                                                 buf + sizeof(buf) - p,
 834                                                 sta->auth_alg, ies, ies_len);
 835         }
 836 #endif /* CONFIG_IEEE80211R */
 837
 838 #ifdef CONFIG_IEEE80211W
 839         if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY)
 840                 p = hostapd_eid_assoc_comeback_time(hapd, sta, p);
 841 #endif /* CONFIG_IEEE80211W */
 842
 843 #ifdef CONFIG_IEEE80211N
 844         p = hostapd_eid_ht_capabilities(hapd, p);
 845         p = hostapd_eid_ht_operation(hapd, p);
 846 #endif /* CONFIG_IEEE80211N */
 847
 848         if (sta->flags & WLAN_STA_WMM)
 849                 p = hostapd_eid_wmm(hapd, p);
 850
 851 #ifdef CONFIG_WPS
 852         if (sta->flags & WLAN_STA_WPS) {
 853                 struct wpabuf *wps = wps_build_assoc_resp_ie();
 854                 if (wps) {
 855                         os_memcpy(p, wpabuf_head(wps), wpabuf_len(wps));
 856                         p += wpabuf_len(wps);
 857                         wpabuf_free(wps);
 858                 }
 859         }
 860 #endif /* CONFIG_WPS */
 861
 862         send_len += p - reply->u.assoc_resp.variable;
 863
 864         if (hapd->drv.send_mgmt_frame(hapd, reply, send_len) < 0)
 865                 wpa_printf(MSG_INFO, "Failed to send assoc resp: %s",
 866                            strerror(errno));
 867 }
 868
 869
 870 static void handle_assoc(struct hostapd_data *hapd,
 871                          const struct ieee80211_mgmt *mgmt, size_t len,
 872                          int reassoc)
 873 {
 874         u16 capab_info, listen_interval;
 875         u16 resp = WLAN_STATUS_SUCCESS;
 876         const u8 *pos;
 877         int left, i;
 878         struct sta_info *sta;
 879
 880         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
 881                                       sizeof(mgmt->u.assoc_req))) {
 882                 printf("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
 883                        "\n", reassoc, (unsigned long) len);
 884                 return;
 885         }
 886
 887         if (reassoc) {
 888                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
 889                 listen_interval = le_to_host16(
 890                         mgmt->u.reassoc_req.listen_interval);
 891                 wpa_printf(MSG_DEBUG, "reassociation request: STA=" MACSTR
 892                            " capab_info=0x%02x listen_interval=%d current_ap="
 893                            MACSTR,
 894                            MAC2STR(mgmt->sa), capab_info, listen_interval,
 895                            MAC2STR(mgmt->u.reassoc_req.current_ap));
 896                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
 897                 pos = mgmt->u.reassoc_req.variable;
 898         } else {
 899                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
 900                 listen_interval = le_to_host16(
 901                         mgmt->u.assoc_req.listen_interval);
 902                 wpa_printf(MSG_DEBUG, "association request: STA=" MACSTR
 903                            " capab_info=0x%02x listen_interval=%d",
 904                            MAC2STR(mgmt->sa), capab_info, listen_interval);
 905                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
 906                 pos = mgmt->u.assoc_req.variable;
 907         }
 908
 909         sta = ap_get_sta(hapd, mgmt->sa);
 910 #ifdef CONFIG_IEEE80211R
 911         if (sta && sta->auth_alg == WLAN_AUTH_FT &&
 912             (sta->flags & WLAN_STA_AUTH) == 0) {
 913                 wpa_printf(MSG_DEBUG, "FT: Allow STA " MACSTR " to associate "
 914                            "prior to authentication since it is using "
 915                            "over-the-DS FT", MAC2STR(mgmt->sa));
 916         } else
 917 #endif /* CONFIG_IEEE80211R */
 918         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
 919                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
 920                                HOSTAPD_LEVEL_INFO, "Station tried to "
 921                                "associate before authentication "
 922                                "(aid=%d flags=0x%x)",
 923                                sta ? sta->aid : -1,
 924                                sta ? sta->flags : 0);
 925                 send_deauth(hapd, mgmt->sa,
 926                             WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA);
 927                 return;
 928         }
 929
 930         if (hapd->tkip_countermeasures) {
 931                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 932                 goto fail;
 933         }
 934
 935         if (listen_interval > hapd->conf->max_listen_interval) {
 936                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
 937                                HOSTAPD_LEVEL_DEBUG,
 938                                "Too large Listen Interval (%d)",
 939                                listen_interval);
 940                 resp = WLAN_STATUS_ASSOC_DENIED_LISTEN_INT_TOO_LARGE;
 941                 goto fail;
 942         }
 943
 944         /* followed by SSID and Supported rates; and HT capabilities if 802.11n
 945          * is used */
 946         resp = check_assoc_ies(hapd, sta, pos, left, reassoc);
 947         if (resp != WLAN_STATUS_SUCCESS)
 948                 goto fail;
 949
 950         if (hostapd_get_aid(hapd, sta) < 0) {
 951                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
 952                                HOSTAPD_LEVEL_INFO, "No room for more AIDs");
 953                 resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 954                 goto fail;
 955         }
 956
 957         sta->capability = capab_info;
 958         sta->listen_interval = listen_interval;
 959
 960         if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
 961                 sta->flags |= WLAN_STA_NONERP;
 962         for (i = 0; i < sta->supported_rates_len; i++) {
 963                 if ((sta->supported_rates[i] & 0x7f) > 22) {
 964                         sta->flags &= ~WLAN_STA_NONERP;
 965                         break;
 966                 }
 967         }
 968         if (sta->flags & WLAN_STA_NONERP && !sta->nonerp_set) {
 969                 sta->nonerp_set = 1;
 970                 hapd->iface->num_sta_non_erp++;
 971                 if (hapd->iface->num_sta_non_erp == 1)
 972                         ieee802_11_set_beacons(hapd->iface);
 973         }
 974
 975         if (!(sta->capability & WLAN_CAPABILITY_SHORT_SLOT_TIME) &&
 976             !sta->no_short_slot_time_set) {
 977                 sta->no_short_slot_time_set = 1;
 978                 hapd->iface->num_sta_no_short_slot_time++;
 979                 if (hapd->iface->current_mode->mode ==
 980                     HOSTAPD_MODE_IEEE80211G &&
 981                     hapd->iface->num_sta_no_short_slot_time == 1)
 982                         ieee802_11_set_beacons(hapd->iface);
 983         }
 984
 985         if (sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE)
 986                 sta->flags |= WLAN_STA_SHORT_PREAMBLE;
 987         else
 988                 sta->flags &= ~WLAN_STA_SHORT_PREAMBLE;
 989
 990         if (!(sta->capability & WLAN_CAPABILITY_SHORT_PREAMBLE) &&
 991             !sta->no_short_preamble_set) {
 992                 sta->no_short_preamble_set = 1;
 993                 hapd->iface->num_sta_no_short_preamble++;
 994                 if (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
 995                     && hapd->iface->num_sta_no_short_preamble == 1)
 996                         ieee802_11_set_beacons(hapd->iface);
 997         }
 998
 999 #ifdef CONFIG_IEEE80211N
1000         update_ht_state(hapd, sta);
1001 #endif /* CONFIG_IEEE80211N */
1002
1003         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1004                        HOSTAPD_LEVEL_DEBUG,
1005                        "association OK (aid %d)", sta->aid);
1006         /* Station will be marked associated, after it acknowledges AssocResp
1007          */
1008
1009 #ifdef CONFIG_IEEE80211W
1010         if ((sta->flags & WLAN_STA_MFP) && sta->sa_query_timed_out) {
1011                 wpa_printf(MSG_DEBUG, "Allowing %sassociation after timed out "
1012                            "SA Query procedure", reassoc ? "re" : "");
1013                 /* TODO: Send a protected Disassociate frame to the STA using
1014                  * the old key and Reason Code "Previous Authentication no
1015                  * longer valid". Make sure this is only sent protected since
1016                  * unprotected frame would be received by the STA that is now
1017                  * trying to associate.
1018                  */
1019         }
1020 #endif /* CONFIG_IEEE80211W */
1021
1022         if (reassoc) {
1023                 os_memcpy(sta->previous_ap, mgmt->u.reassoc_req.current_ap,
1024                           ETH_ALEN);
1025         }
1026
1027         if (sta->last_assoc_req)
1028                 os_free(sta->last_assoc_req);
1029         sta->last_assoc_req = os_malloc(len);
1030         if (sta->last_assoc_req)
1031                 os_memcpy(sta->last_assoc_req, mgmt, len);
1032
1033         /* Make sure that the previously registered inactivity timer will not
1034          * remove the STA immediately. */
1035         sta->timeout_next = STA_NULLFUNC;
1036
1037  fail:
1038         send_assoc_resp(hapd, sta, resp, reassoc, pos, left);
1039 }
1040
1041
1042 static void handle_disassoc(struct hostapd_data *hapd,
1043                             const struct ieee80211_mgmt *mgmt, size_t len)
1044 {
1045         struct sta_info *sta;
1046
1047         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
1048                 printf("handle_disassoc - too short payload (len=%lu)\n",
1049                        (unsigned long) len);
1050                 return;
1051         }
1052
1053         wpa_printf(MSG_DEBUG, "disassocation: STA=" MACSTR " reason_code=%d",
1054                    MAC2STR(mgmt->sa),
1055                    le_to_host16(mgmt->u.disassoc.reason_code));
1056
1057         sta = ap_get_sta(hapd, mgmt->sa);
1058         if (sta == NULL) {
1059                 printf("Station " MACSTR " trying to disassociate, but it "
1060                        "is not associated.\n", MAC2STR(mgmt->sa));
1061                 return;
1062         }
1063
1064         sta->flags &= ~WLAN_STA_ASSOC;
1065         wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
1066                 MAC2STR(sta->addr));
1067         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
1068         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1069                        HOSTAPD_LEVEL_INFO, "disassociated");
1070         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1071         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1072         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
1073          * authenticated. */
1074         accounting_sta_stop(hapd, sta);
1075         ieee802_1x_free_station(sta);
1076         hapd->drv.sta_remove(hapd, sta->addr);
1077
1078         if (sta->timeout_next == STA_NULLFUNC ||
1079             sta->timeout_next == STA_DISASSOC) {
1080                 sta->timeout_next = STA_DEAUTH;
1081                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1082                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
1083                                        hapd, sta);
1084         }
1085
1086         mlme_disassociate_indication(
1087                 hapd, sta, le_to_host16(mgmt->u.disassoc.reason_code));
1088 }
1089
1090
1091 static void handle_deauth(struct hostapd_data *hapd,
1092                           const struct ieee80211_mgmt *mgmt, size_t len)
1093 {
1094         struct sta_info *sta;
1095
1096         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
1097                 printf("handle_deauth - too short payload (len=%lu)\n",
1098                        (unsigned long) len);
1099                 return;
1100         }
1101
1102         wpa_printf(MSG_DEBUG, "deauthentication: STA=" MACSTR
1103                    " reason_code=%d",
1104                    MAC2STR(mgmt->sa),
1105                    le_to_host16(mgmt->u.deauth.reason_code));
1106
1107         sta = ap_get_sta(hapd, mgmt->sa);
1108         if (sta == NULL) {
1109                 printf("Station " MACSTR " trying to deauthenticate, but it "
1110                        "is not authenticated.\n", MAC2STR(mgmt->sa));
1111                 return;
1112         }
1113
1114         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1115         wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED MACSTR,
1116                 MAC2STR(sta->addr));
1117         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1118         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1119                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
1120         mlme_deauthenticate_indication(
1121                 hapd, sta, le_to_host16(mgmt->u.deauth.reason_code));
1122         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
1123         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1124         ap_free_sta(hapd, sta);
1125 }
1126
1127
1128 static void handle_beacon(struct hostapd_data *hapd,
1129                           const struct ieee80211_mgmt *mgmt, size_t len,
1130                           struct hostapd_frame_info *fi)
1131 {
1132         struct ieee802_11_elems elems;
1133
1134         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
1135                 printf("handle_beacon - too short payload (len=%lu)\n",
1136                        (unsigned long) len);
1137                 return;
1138         }
1139
1140         (void) ieee802_11_parse_elems(mgmt->u.beacon.variable,
1141                                       len - (IEEE80211_HDRLEN +
1142                                              sizeof(mgmt->u.beacon)), &elems,
1143                                       0);
1144
1145         ap_list_process_beacon(hapd->iface, mgmt, &elems, fi);
1146 }
1147
1148
1149 #ifdef CONFIG_IEEE80211W
1150
1151 /* MLME-SAQuery.request */
1152 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
1153                                   const u8 *addr, const u8 *trans_id)
1154 {
1155         struct ieee80211_mgmt mgmt;
1156         u8 *end;
1157
1158         wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
1159                    MACSTR, MAC2STR(addr));
1160         wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
1161                     trans_id, WLAN_SA_QUERY_TR_ID_LEN);
1162
1163         os_memset(&mgmt, 0, sizeof(mgmt));
1164         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1165                                           WLAN_FC_STYPE_ACTION);
1166         os_memcpy(mgmt.da, addr, ETH_ALEN);
1167         os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
1168         os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
1169         mgmt.u.action.category = WLAN_ACTION_SA_QUERY;
1170         mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
1171         os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
1172                   WLAN_SA_QUERY_TR_ID_LEN);
1173         end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
1174         if (hapd->drv.send_mgmt_frame(hapd, &mgmt, end - (u8 *) &mgmt) < 0)
1175                 perror("ieee802_11_send_sa_query_req: send");
1176 }
1177
1178
1179 static void hostapd_sa_query_request(struct hostapd_data *hapd,
1180                                      const struct ieee80211_mgmt *mgmt)
1181 {
1182         struct sta_info *sta;
1183         struct ieee80211_mgmt resp;
1184         u8 *end;
1185
1186         wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
1187                    MACSTR, MAC2STR(mgmt->sa));
1188         wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
1189                     mgmt->u.action.u.sa_query_resp.trans_id,
1190                     WLAN_SA_QUERY_TR_ID_LEN);
1191
1192         sta = ap_get_sta(hapd, mgmt->sa);
1193         if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
1194                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
1195                            "from unassociated STA " MACSTR, MAC2STR(mgmt->sa));
1196                 return;
1197         }
1198
1199         wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
1200                    MACSTR, MAC2STR(mgmt->sa));
1201
1202         os_memset(&resp, 0, sizeof(resp));
1203         resp.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1204                                           WLAN_FC_STYPE_ACTION);
1205         os_memcpy(resp.da, mgmt->sa, ETH_ALEN);
1206         os_memcpy(resp.sa, hapd->own_addr, ETH_ALEN);
1207         os_memcpy(resp.bssid, hapd->own_addr, ETH_ALEN);
1208         resp.u.action.category = WLAN_ACTION_SA_QUERY;
1209         resp.u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
1210         os_memcpy(resp.u.action.u.sa_query_req.trans_id,
1211                   mgmt->u.action.u.sa_query_req.trans_id,
1212                   WLAN_SA_QUERY_TR_ID_LEN);
1213         end = resp.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
1214         if (hapd->drv.send_mgmt_frame(hapd, &resp, end - (u8 *) &resp) < 0)
1215                 perror("hostapd_sa_query_request: send");
1216 }
1217
1218
1219 static void hostapd_sa_query_action(struct hostapd_data *hapd,
1220                                     const struct ieee80211_mgmt *mgmt,
1221                                     size_t len)
1222 {
1223         struct sta_info *sta;
1224         const u8 *end;
1225         int i;
1226
1227         end = mgmt->u.action.u.sa_query_resp.trans_id +
1228                 WLAN_SA_QUERY_TR_ID_LEN;
1229         if (((u8 *) mgmt) + len < end) {
1230                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Too short SA Query Action "
1231                            "frame (len=%lu)", (unsigned long) len);
1232                 return;
1233         }
1234
1235         if (mgmt->u.action.u.sa_query_resp.action == WLAN_SA_QUERY_REQUEST) {
1236                 hostapd_sa_query_request(hapd, mgmt);
1237                 return;
1238         }
1239
1240         if (mgmt->u.action.u.sa_query_resp.action != WLAN_SA_QUERY_RESPONSE) {
1241                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
1242                            "Action %d", mgmt->u.action.u.sa_query_resp.action);
1243                 return;
1244         }
1245
1246         wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
1247                    MACSTR, MAC2STR(mgmt->sa));
1248         wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
1249                     mgmt->u.action.u.sa_query_resp.trans_id,
1250                     WLAN_SA_QUERY_TR_ID_LEN);
1251
1252         /* MLME-SAQuery.confirm */
1253
1254         sta = ap_get_sta(hapd, mgmt->sa);
1255         if (sta == NULL || sta->sa_query_trans_id == NULL) {
1256                 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
1257                            "pending SA Query request found");
1258                 return;
1259         }
1260
1261         for (i = 0; i < sta->sa_query_count; i++) {
1262                 if (os_memcmp(sta->sa_query_trans_id +
1263                               i * WLAN_SA_QUERY_TR_ID_LEN,
1264                               mgmt->u.action.u.sa_query_resp.trans_id,
1265                               WLAN_SA_QUERY_TR_ID_LEN) == 0)
1266                         break;
1267         }
1268
1269         if (i >= sta->sa_query_count) {
1270                 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
1271                            "transaction identifier found");
1272                 return;
1273         }
1274
1275         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1276                        HOSTAPD_LEVEL_DEBUG,
1277                        "Reply to pending SA Query received");
1278         ap_sta_stop_sa_query(hapd, sta);
1279 }
1280
1281
1282 static int robust_action_frame(u8 category)
1283 {
1284         return category != WLAN_ACTION_PUBLIC &&
1285                 category != WLAN_ACTION_HT;
1286 }
1287 #endif /* CONFIG_IEEE80211W */
1288
1289
1290 static void handle_action(struct hostapd_data *hapd,
1291                           const struct ieee80211_mgmt *mgmt, size_t len)
1292 {
1293         struct sta_info *sta;
1294
1295         if (len < IEEE80211_HDRLEN + 1) {
1296                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1297                                HOSTAPD_LEVEL_DEBUG,
1298                                "handle_action - too short payload (len=%lu)",
1299                                (unsigned long) len);
1300                 return;
1301         }
1302
1303         sta = ap_get_sta(hapd, mgmt->sa);
1304 #ifdef CONFIG_IEEE80211W
1305         if (sta && (sta->flags & WLAN_STA_MFP) &&
1306             !(mgmt->frame_control & host_to_le16(WLAN_FC_ISWEP) &&
1307               robust_action_frame(mgmt->u.action.category))) {
1308                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1309                                HOSTAPD_LEVEL_DEBUG,
1310                                "Dropped unprotected Robust Action frame from "
1311                                "an MFP STA");
1312                 return;
1313         }
1314 #endif /* CONFIG_IEEE80211W */
1315
1316         switch (mgmt->u.action.category) {
1317 #ifdef CONFIG_IEEE80211R
1318         case WLAN_ACTION_FT:
1319         {
1320                 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
1321                         wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignored FT Action "
1322                                    "frame from unassociated STA " MACSTR,
1323                                    MAC2STR(mgmt->sa));
1324                         return;
1325                 }
1326
1327                 if (wpa_ft_action_rx(sta->wpa_sm, (u8 *) &mgmt->u.action,
1328                                      len - IEEE80211_HDRLEN))
1329                         break;
1330
1331                 return;
1332         }
1333 #endif /* CONFIG_IEEE80211R */
1334         case WLAN_ACTION_WMM:
1335                 hostapd_wmm_action(hapd, mgmt, len);
1336                 return;
1337 #ifdef CONFIG_IEEE80211W
1338         case WLAN_ACTION_SA_QUERY:
1339                 hostapd_sa_query_action(hapd, mgmt, len);
1340                 return;
1341 #endif /* CONFIG_IEEE80211W */
1342         case WLAN_ACTION_PUBLIC:
1343                 if (hapd->public_action_cb) {
1344                         hapd->public_action_cb(hapd->public_action_cb_ctx,
1345                                                (u8 *) mgmt, len,
1346                                                hapd->iface->freq);
1347                         return;
1348                 }
1349                 break;
1350         }
1351
1352         hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1353                        HOSTAPD_LEVEL_DEBUG,
1354                        "handle_action - unknown action category %d or invalid "
1355                        "frame",
1356                        mgmt->u.action.category);
1357         if (!(mgmt->da[0] & 0x01) && !(mgmt->u.action.category & 0x80) &&
1358             !(mgmt->sa[0] & 0x01)) {
1359                 struct ieee80211_mgmt *resp;
1360
1361                 /*
1362                  * IEEE 802.11-REVma/D9.0 - 7.3.1.11
1363                  * Return the Action frame to the source without change
1364                  * except that MSB of the Category set to 1.
1365                  */
1366                 wpa_printf(MSG_DEBUG, "IEEE 802.11: Return unknown Action "
1367                            "frame back to sender");
1368                 resp = os_malloc(len);
1369                 if (resp == NULL)
1370                         return;
1371                 os_memcpy(resp, mgmt, len);
1372                 os_memcpy(resp->da, resp->sa, ETH_ALEN);
1373                 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
1374                 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
1375                 resp->u.action.category |= 0x80;
1376
1377                 hapd->drv.send_mgmt_frame(hapd, resp, len);
1378                 os_free(resp);
1379         }
1380 }
1381
1382
1383 /**
1384  * ieee802_11_mgmt - process incoming IEEE 802.11 management frames
1385  * @hapd: hostapd BSS data structure (the BSS to which the management frame was
1386  * sent to)
1387  * @buf: management frame data (starting from IEEE 802.11 header)
1388  * @len: length of frame data in octets
1389  * @fi: meta data about received frame (signal level, etc.)
1390  *
1391  * Process all incoming IEEE 802.11 management frames. This will be called for
1392  * each frame received from the kernel driver through wlan#ap interface. In
1393  * addition, it can be called to re-inserted pending frames (e.g., when using
1394  * external RADIUS server as an MAC ACL).
1395  */
1396 void ieee802_11_mgmt(struct hostapd_data *hapd, const u8 *buf, size_t len,
1397                      struct hostapd_frame_info *fi)
1398 {
1399         struct ieee80211_mgmt *mgmt;
1400         int broadcast;
1401         u16 fc, stype;
1402
1403         mgmt = (struct ieee80211_mgmt *) buf;
1404         fc = le_to_host16(mgmt->frame_control);
1405         stype = WLAN_FC_GET_STYPE(fc);
1406
1407         if (stype == WLAN_FC_STYPE_BEACON) {
1408                 handle_beacon(hapd, mgmt, len, fi);
1409                 return;
1410         }
1411
1412         broadcast = mgmt->bssid[0] == 0xff && mgmt->bssid[1] == 0xff &&
1413                 mgmt->bssid[2] == 0xff && mgmt->bssid[3] == 0xff &&
1414                 mgmt->bssid[4] == 0xff && mgmt->bssid[5] == 0xff;
1415
1416         if (!broadcast &&
1417             os_memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0) {
1418                 printf("MGMT: BSSID=" MACSTR " not our address\n",
1419                        MAC2STR(mgmt->bssid));
1420                 return;
1421         }
1422
1423
1424         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
1425                 handle_probe_req(hapd, mgmt, len);
1426                 return;
1427         }
1428
1429         if (os_memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
1430                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1431                                HOSTAPD_LEVEL_DEBUG,
1432                                "MGMT: DA=" MACSTR " not our address",
1433                                MAC2STR(mgmt->da));
1434                 return;
1435         }
1436
1437         switch (stype) {
1438         case WLAN_FC_STYPE_AUTH:
1439                 wpa_printf(MSG_DEBUG, "mgmt::auth");
1440                 handle_auth(hapd, mgmt, len);
1441                 break;
1442         case WLAN_FC_STYPE_ASSOC_REQ:
1443                 wpa_printf(MSG_DEBUG, "mgmt::assoc_req");
1444                 handle_assoc(hapd, mgmt, len, 0);
1445                 break;
1446         case WLAN_FC_STYPE_REASSOC_REQ:
1447                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_req");
1448                 handle_assoc(hapd, mgmt, len, 1);
1449                 break;
1450         case WLAN_FC_STYPE_DISASSOC:
1451                 wpa_printf(MSG_DEBUG, "mgmt::disassoc");
1452                 handle_disassoc(hapd, mgmt, len);
1453                 break;
1454         case WLAN_FC_STYPE_DEAUTH:
1455                 wpa_printf(MSG_DEBUG, "mgmt::deauth");
1456                 handle_deauth(hapd, mgmt, len);
1457                 break;
1458         case WLAN_FC_STYPE_ACTION:
1459                 wpa_printf(MSG_DEBUG, "mgmt::action");
1460                 handle_action(hapd, mgmt, len);
1461                 break;
1462         default:
1463                 hostapd_logger(hapd, mgmt->sa, HOSTAPD_MODULE_IEEE80211,
1464                                HOSTAPD_LEVEL_DEBUG,
1465                                "unknown mgmt frame subtype %d", stype);
1466                 break;
1467         }
1468 }
1469
1470
1471 static void handle_auth_cb(struct hostapd_data *hapd,
1472                            const struct ieee80211_mgmt *mgmt,
1473                            size_t len, int ok)
1474 {
1475         u16 auth_alg, auth_transaction, status_code;
1476         struct sta_info *sta;
1477
1478         if (!ok) {
1479                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1480                                HOSTAPD_LEVEL_NOTICE,
1481                                "did not acknowledge authentication response");
1482                 return;
1483         }
1484
1485         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1486                 printf("handle_auth_cb - too short payload (len=%lu)\n",
1487                        (unsigned long) len);
1488                 return;
1489         }
1490
1491         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1492         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1493         status_code = le_to_host16(mgmt->u.auth.status_code);
1494
1495         sta = ap_get_sta(hapd, mgmt->da);
1496         if (!sta) {
1497                 printf("handle_auth_cb: STA " MACSTR " not found\n",
1498                        MAC2STR(mgmt->da));
1499                 return;
1500         }
1501
1502         if (status_code == WLAN_STATUS_SUCCESS &&
1503             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
1504              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
1505                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1506                                HOSTAPD_LEVEL_INFO, "authenticated");
1507                 sta->flags |= WLAN_STA_AUTH;
1508         }
1509 }
1510
1511
1512 static void handle_assoc_cb(struct hostapd_data *hapd,
1513                             const struct ieee80211_mgmt *mgmt,
1514                             size_t len, int reassoc, int ok)
1515 {
1516         u16 status;
1517         struct sta_info *sta;
1518         int new_assoc = 1;
1519         struct ieee80211_ht_capabilities ht_cap;
1520
1521         if (!ok) {
1522                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1523                                HOSTAPD_LEVEL_DEBUG,
1524                                "did not acknowledge association response");
1525                 return;
1526         }
1527
1528         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_resp) :
1529                                       sizeof(mgmt->u.assoc_resp))) {
1530                 printf("handle_assoc_cb(reassoc=%d) - too short payload "
1531                        "(len=%lu)\n", reassoc, (unsigned long) len);
1532                 return;
1533         }
1534
1535         if (reassoc)
1536                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
1537         else
1538                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1539
1540         sta = ap_get_sta(hapd, mgmt->da);
1541         if (!sta) {
1542                 printf("handle_assoc_cb: STA " MACSTR " not found\n",
1543                        MAC2STR(mgmt->da));
1544                 return;
1545         }
1546
1547         if (status != WLAN_STATUS_SUCCESS)
1548                 goto fail;
1549
1550         /* Stop previous accounting session, if one is started, and allocate
1551          * new session id for the new session. */
1552         accounting_sta_stop(hapd, sta);
1553
1554         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1555                        HOSTAPD_LEVEL_INFO,
1556                        "associated (aid %d)",
1557                        sta->aid);
1558
1559         if (sta->flags & WLAN_STA_ASSOC)
1560                 new_assoc = 0;
1561         sta->flags |= WLAN_STA_ASSOC;
1562         if ((!hapd->conf->ieee802_1x && !hapd->conf->wpa) ||
1563             sta->auth_alg == WLAN_AUTH_FT) {
1564                 /*
1565                  * Open, static WEP, or FT protocol; no separate authorization
1566                  * step.
1567                  */
1568                 sta->flags |= WLAN_STA_AUTHORIZED;
1569                 wpa_msg(hapd->msg_ctx, MSG_INFO,
1570                         AP_STA_CONNECTED MACSTR, MAC2STR(sta->addr));
1571         }
1572
1573         if (reassoc)
1574                 mlme_reassociate_indication(hapd, sta);
1575         else
1576                 mlme_associate_indication(hapd, sta);
1577
1578 #ifdef CONFIG_IEEE80211W
1579         sta->sa_query_timed_out = 0;
1580 #endif /* CONFIG_IEEE80211W */
1581
1582         /*
1583          * Remove the STA entry in order to make sure the STA PS state gets
1584          * cleared and configuration gets updated in case of reassociation back
1585          * to the same AP.
1586          */
1587         hapd->drv.sta_remove(hapd, sta->addr);
1588
1589 #ifdef CONFIG_IEEE80211N
1590         if (sta->flags & WLAN_STA_HT)
1591                 hostapd_get_ht_capab(hapd, sta->ht_capabilities, &ht_cap);
1592 #endif /* CONFIG_IEEE80211N */
1593
1594         if (hapd->drv.sta_add(hapd, sta->addr, sta->aid, sta->capability,
1595                               sta->supported_rates, sta->supported_rates_len,
1596                               sta->listen_interval,
1597                               sta->flags & WLAN_STA_HT ? &ht_cap : NULL)) {
1598                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1599                                HOSTAPD_LEVEL_NOTICE,
1600                                "Could not add STA to kernel driver");
1601         }
1602
1603         if (sta->eapol_sm == NULL) {
1604                 /*
1605                  * This STA does not use RADIUS server for EAP authentication,
1606                  * so bind it to the selected VLAN interface now, since the
1607                  * interface selection is not going to change anymore.
1608                  */
1609                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
1610                         goto fail;
1611         } else if (sta->vlan_id) {
1612                 /* VLAN ID already set (e.g., by PMKSA caching), so bind STA */
1613                 if (ap_sta_bind_vlan(hapd, sta, 0) < 0)
1614                         goto fail;
1615         }
1616
1617         hapd->drv.set_sta_flags(hapd, sta);
1618
1619         if (sta->auth_alg == WLAN_AUTH_FT)
1620                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC_FT);
1621         else
1622                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
1623         hapd->new_assoc_sta_cb(hapd, sta, !new_assoc);
1624
1625         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
1626
1627  fail:
1628         /* Copy of the association request is not needed anymore */
1629         if (sta->last_assoc_req) {
1630                 os_free(sta->last_assoc_req);
1631                 sta->last_assoc_req = NULL;
1632         }
1633 }
1634
1635
1636 /**
1637  * ieee802_11_mgmt_cb - Process management frame TX status callback
1638  * @hapd: hostapd BSS data structure (the BSS from which the management frame
1639  * was sent from)
1640  * @buf: management frame data (starting from IEEE 802.11 header)
1641  * @len: length of frame data in octets
1642  * @stype: management frame subtype from frame control field
1643  * @ok: Whether the frame was ACK'ed
1644  */
1645 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, const u8 *buf, size_t len,
1646                         u16 stype, int ok)
1647 {
1648         const struct ieee80211_mgmt *mgmt;
1649         mgmt = (const struct ieee80211_mgmt *) buf;
1650
1651         switch (stype) {
1652         case WLAN_FC_STYPE_AUTH:
1653                 wpa_printf(MSG_DEBUG, "mgmt::auth cb");
1654                 handle_auth_cb(hapd, mgmt, len, ok);
1655                 break;
1656         case WLAN_FC_STYPE_ASSOC_RESP:
1657                 wpa_printf(MSG_DEBUG, "mgmt::assoc_resp cb");
1658                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
1659                 break;
1660         case WLAN_FC_STYPE_REASSOC_RESP:
1661                 wpa_printf(MSG_DEBUG, "mgmt::reassoc_resp cb");
1662                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
1663                 break;
1664         case WLAN_FC_STYPE_PROBE_RESP:
1665                 wpa_printf(MSG_DEBUG, "mgmt::proberesp cb");
1666                 break;
1667         case WLAN_FC_STYPE_DEAUTH:
1668                 /* ignore */
1669                 break;
1670         case WLAN_FC_STYPE_ACTION:
1671                 wpa_printf(MSG_DEBUG, "mgmt::action cb");
1672                 break;
1673         default:
1674                 printf("unknown mgmt cb frame subtype %d\n", stype);
1675                 break;
1676         }
1677 }
1678
1679
1680 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1681 {
1682         /* TODO */
1683         return 0;
1684 }
1685
1686
1687 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1688                            char *buf, size_t buflen)
1689 {
1690         /* TODO */
1691         return 0;
1692 }
1693
1694
1695 void hostapd_tx_status(struct hostapd_data *hapd, const u8 *addr,
1696                        const u8 *buf, size_t len, int ack)
1697 {
1698         struct sta_info *sta;
1699         struct hostapd_iface *iface = hapd->iface;
1700
1701         sta = ap_get_sta(hapd, addr);
1702         if (sta == NULL && iface->num_bss > 1) {
1703                 size_t j;
1704                 for (j = 0; j < iface->num_bss; j++) {
1705                         hapd = iface->bss[j];
1706                         sta = ap_get_sta(hapd, addr);
1707                         if (sta)
1708                                 break;
1709                 }
1710         }
1711         if (sta == NULL)
1712                 return;
1713         if (sta->flags & WLAN_STA_PENDING_POLL) {
1714                 wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
1715                            "activity poll", MAC2STR(sta->addr),
1716                            ack ? "ACKed" : "did not ACK");
1717                 if (ack)
1718                         sta->flags &= ~WLAN_STA_PENDING_POLL;
1719         }
1720
1721         ieee802_1x_tx_status(hapd, sta, buf, len, ack);
1722 }
1723
1724
1725 void ieee802_11_rx_from_unknown(struct hostapd_data *hapd, const u8 *src,
1726                                 int wds)
1727 {
1728         struct sta_info *sta;
1729
1730         sta = ap_get_sta(hapd, src);
1731         if (sta && (sta->flags & WLAN_STA_ASSOC)) {
1732                 if (wds && !(sta->flags & WLAN_STA_WDS)) {
1733                         wpa_printf(MSG_DEBUG, "Enable 4-address WDS mode for "
1734                                    "STA " MACSTR " (aid %u)",
1735                                    MAC2STR(sta->addr), sta->aid);
1736                         sta->flags |= WLAN_STA_WDS;
1737                         hapd->drv.set_wds_sta(hapd, sta->addr, sta->aid, 1);
1738                 }
1739                 return;
1740         }
1741
1742         wpa_printf(MSG_DEBUG, "Data/PS-poll frame from not associated STA "
1743                    MACSTR, MAC2STR(src));
1744         if (sta && (sta->flags & WLAN_STA_AUTH))
1745                 hapd->drv.sta_disassoc(
1746                         hapd, src,
1747                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
1748         else
1749                 hapd->drv.sta_deauth(
1750                         hapd, src,
1751                         WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
1752 }
1753
1754
1755 #endif /* CONFIG_NATIVE_WINDOWS */