2 * Host AP (software wireless LAN access point) user space daemon for
3 * Host AP kernel driver / IEEE 802.11F-2003 Inter-Access Point Protocol (IAPP)
4 * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License version 2 as
8 * published by the Free Software Foundation.
10 * Alternatively, this software may be distributed under the terms of BSD
13 * See README and COPYING for more details.
17 * Level 1: no administrative or security support
18 * (e.g., static BSSID to IP address mapping in each AP)
19 * Level 2: support for dynamic mapping of BSSID to IP address
20 * Level 3: support for encryption and authentication of IAPP messages
21 * - add support for MOVE-notify and MOVE-response (this requires support for
22 * finding out IP address for previous AP using RADIUS)
23 * - add support for Send- and ACK-Security-Block to speedup IEEE 802.1X during
24 * reassociation to another AP
25 * - implement counters etc. for IAPP MIB
26 * - verify endianness of fields in IAPP messages; are they big-endian as
28 * - RADIUS connection for AP registration and BSSID to IP address mapping
29 * - TCP connection for IAPP MOVE, CACHE
30 * - broadcast ESP for IAPP ADD-notify
31 * - ESP for IAPP MOVE messages
32 * - security block sending/processing
33 * - IEEE 802.11 context transfer
40 #include <netinet/in.h>
42 #include <sys/ioctl.h>
43 #include <sys/socket.h>
44 #include <arpa/inet.h>
45 #ifdef USE_KERNEL_HEADERS
46 #include <linux/if_packet.h>
47 #else /* USE_KERNEL_HEADERS */
48 #include <netpacket/packet.h>
49 #endif /* USE_KERNEL_HEADERS */
52 #include "ieee802_11.h"
56 #include "hostap_common.h"
59 #define IAPP_MULTICAST "224.0.1.178"
60 #define IAPP_UDP_PORT 3517
61 #define IAPP_TCP_PORT 3517
68 /* followed by length-6 octets of data */
69 } __attribute__ ((packed));
71 #define IAPP_VERSION 0
74 IAPP_CMD_ADD_notify = 0,
75 IAPP_CMD_MOVE_notify = 1,
76 IAPP_CMD_MOVE_response = 2,
77 IAPP_CMD_Send_Security_Block = 3,
78 IAPP_CMD_ACK_Security_Block = 4,
79 IAPP_CMD_CACHE_notify = 5,
80 IAPP_CMD_CACHE_response = 6,
84 /* ADD-notify - multicast UDP on the local LAN */
85 struct iapp_add_notify {
86 u8 addr_len; /* ETH_ALEN */
88 u8 mac_addr[ETH_ALEN];
90 } __attribute__ ((packed));
93 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
94 struct iapp_layer2_update {
95 u8 da[ETH_ALEN]; /* broadcast */
96 u8 sa[ETH_ALEN]; /* STA addr */
98 u8 dsap; /* null DSAP address */
99 u8 ssap; /* null SSAP address, CR=Response */
102 } __attribute__ ((packed));
105 /* MOVE-notify - unicast TCP */
106 struct iapp_move_notify {
107 u8 addr_len; /* ETH_ALEN */
109 u8 mac_addr[ETH_ALEN];
112 /* followed by ctx_block_len bytes */
113 } __attribute__ ((packed));
116 /* MOVE-response - unicast TCP */
117 struct iapp_move_response {
118 u8 addr_len; /* ETH_ALEN */
120 u8 mac_addr[ETH_ALEN];
123 /* followed by ctx_block_len bytes */
124 } __attribute__ ((packed));
127 IAPP_MOVE_SUCCESSFUL = 0,
128 IAPP_MOVE_DENIED = 1,
129 IAPP_MOVE_STALE_MOVE = 2,
134 struct iapp_cache_notify {
135 u8 addr_len; /* ETH_ALEN */
137 u8 mac_addr[ETH_ALEN];
139 u8 current_ap[ETH_ALEN];
141 /* ctx_block_len bytes of context block followed by 16-bit context
143 } __attribute__ ((packed));
146 /* CACHE-response - unicast TCP */
147 struct iapp_cache_response {
148 u8 addr_len; /* ETH_ALEN */
150 u8 mac_addr[ETH_ALEN];
152 } __attribute__ ((packed));
155 IAPP_CACHE_SUCCESSFUL = 0,
156 IAPP_CACHE_STALE_CACHE = 1,
160 /* Send-Security-Block - unicast TCP */
161 struct iapp_send_security_block {
164 /* followed by sec_block_len bytes of security block */
165 } __attribute__ ((packed));
168 /* ACK-Security-Block - unicast TCP */
169 struct iapp_ack_security_block {
171 u8 new_ap_ack_authenticator[48];
172 } __attribute__ ((packed));
176 struct hostapd_data *hapd;
177 u16 identifier; /* next IAPP identifier */
178 struct in_addr own, multicast;
184 static void iapp_send_add(struct iapp_data *iapp, u8 *macaddr, u16 seq_num)
187 struct iapp_hdr *hdr;
188 struct iapp_add_notify *add;
189 struct sockaddr_in addr;
191 /* Send IAPP ADD-notify to remove possible association from other APs
194 hdr = (struct iapp_hdr *) buf;
195 hdr->version = IAPP_VERSION;
196 hdr->command = IAPP_CMD_ADD_notify;
197 hdr->identifier = host_to_be16(iapp->identifier++);
198 hdr->length = host_to_be16(sizeof(*hdr) + sizeof(*add));
200 add = (struct iapp_add_notify *) (hdr + 1);
201 add->addr_len = ETH_ALEN;
203 memcpy(add->mac_addr, macaddr, ETH_ALEN);
205 add->seq_num = host_to_be16(seq_num);
207 memset(&addr, 0, sizeof(addr));
208 addr.sin_family = AF_INET;
209 addr.sin_addr.s_addr = iapp->multicast.s_addr;
210 addr.sin_port = htons(IAPP_UDP_PORT);
211 if (sendto(iapp->udp_sock, buf, (char *) (add + 1) - buf, 0,
212 (struct sockaddr *) &addr, sizeof(addr)) < 0)
213 perror("sendto[IAPP-ADD]");
217 static void iapp_send_layer2_update(struct iapp_data *iapp, u8 *addr)
219 struct iapp_layer2_update msg;
221 /* Send Level 2 Update Frame to update forwarding tables in layer 2
224 /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
225 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
227 memset(msg.da, 0xff, ETH_ALEN);
228 memcpy(msg.sa, addr, ETH_ALEN);
229 msg.len = host_to_be16(6);
230 msg.dsap = 0; /* NULL DSAP address */
231 msg.ssap = 0x01; /* NULL SSAP address, CR Bit: Response */
232 msg.control = 0xaf; /* XID response lsb.1111F101.
233 * F=0 (no poll command; unsolicited frame) */
234 msg.xid_info[0] = 0x81; /* XID format identifier */
235 msg.xid_info[1] = 1; /* LLC types/classes: Type 1 LLC */
236 msg.xid_info[2] = 1 << 1; /* XID sender's receive window size (RW)
237 * FIX: what is correct RW with 802.11? */
239 if (send(iapp->packet_sock, &msg, sizeof(msg), 0) < 0)
240 perror("send[L2 Update]");
244 void iapp_new_station(struct iapp_data *iapp, struct sta_info *sta)
246 struct ieee80211_mgmt *assoc;
252 assoc = sta->last_assoc_req;
253 seq = assoc ? WLAN_GET_SEQ_SEQ(le_to_host16(assoc->seq_ctrl)) : 0;
255 /* IAPP-ADD.request(MAC Address, Sequence Number, Timeout) */
256 hostapd_logger(iapp->hapd, sta->addr, HOSTAPD_MODULE_IAPP,
257 HOSTAPD_LEVEL_DEBUG, "IAPP-ADD.request(seq=%d)", seq);
258 iapp_send_layer2_update(iapp, sta->addr);
259 iapp_send_add(iapp, sta->addr, seq);
261 if (assoc && WLAN_FC_GET_STYPE(le_to_host16(assoc->frame_control)) ==
262 WLAN_FC_STYPE_REASSOC_REQ) {
263 /* IAPP-MOVE.request(MAC Address, Sequence Number, Old AP,
264 * Context Block, Timeout)
266 /* TODO: Send IAPP-MOVE to the old AP; Map Old AP BSSID to
272 static void iapp_process_add_notify(struct iapp_data *iapp,
273 struct sockaddr_in *from,
274 struct iapp_hdr *hdr, int len)
276 struct iapp_add_notify *add = (struct iapp_add_notify *) (hdr + 1);
277 struct sta_info *sta;
279 if (len != sizeof(*add)) {
280 printf("Invalid IAPP-ADD packet length %d (expected %lu)\n",
281 len, (unsigned long) sizeof(*add));
285 sta = ap_get_sta(iapp->hapd, add->mac_addr);
287 /* IAPP-ADD.indication(MAC Address, Sequence Number) */
288 hostapd_logger(iapp->hapd, add->mac_addr, HOSTAPD_MODULE_IAPP,
290 "Received IAPP ADD-notify (seq# %d) from %s:%d%s",
291 be_to_host16(add->seq_num),
292 inet_ntoa(from->sin_addr), ntohs(from->sin_port),
293 sta ? "" : " (STA not found)");
298 /* TODO: could use seq_num to try to determine whether last association
299 * to this AP is newer than the one advertised in IAPP-ADD. Although,
300 * this is not really a reliable verification. */
302 hostapd_logger(iapp->hapd, add->mac_addr, HOSTAPD_MODULE_IAPP,
304 "Removing STA due to IAPP ADD-notify");
305 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_AUTHORIZED);
306 eloop_cancel_timeout(ap_handle_timer, iapp->hapd, sta);
307 eloop_register_timeout(0, 0, ap_handle_timer, iapp->hapd, sta);
308 sta->timeout_next = STA_REMOVE;
312 static void iapp_receive_udp(int sock, void *eloop_ctx, void *sock_ctx)
314 struct iapp_data *iapp = eloop_ctx;
316 unsigned char buf[128];
317 struct sockaddr_in from;
319 struct iapp_hdr *hdr;
321 /* Handle incoming IAPP frames (over UDP/IP) */
323 fromlen = sizeof(from);
324 len = recvfrom(iapp->udp_sock, buf, sizeof(buf), 0,
325 (struct sockaddr *) &from, &fromlen);
329 if (from.sin_addr.s_addr == iapp->own.s_addr)
330 return; /* ignore own IAPP messages */
332 hostapd_logger(iapp->hapd, NULL, HOSTAPD_MODULE_IAPP,
334 "Received %d byte IAPP frame from %s%s\n",
335 len, inet_ntoa(from.sin_addr),
336 len < sizeof(*hdr) ? " (too short)" : "");
338 if (len < sizeof(*hdr))
341 hdr = (struct iapp_hdr *) buf;
342 hlen = be_to_host16(hdr->length);
343 hostapd_logger(iapp->hapd, NULL, HOSTAPD_MODULE_IAPP,
345 "RX: version=%d command=%d id=%d len=%d\n",
346 hdr->version, hdr->command,
347 be_to_host16(hdr->identifier), hlen);
348 if (hdr->version != IAPP_VERSION) {
349 printf("Dropping IAPP frame with unknown version %d\n",
354 printf("Underflow IAPP frame (hlen=%d len=%d)\n", hlen, len);
358 printf("Ignoring %d extra bytes from IAPP frame\n",
363 switch (hdr->command) {
364 case IAPP_CMD_ADD_notify:
365 iapp_process_add_notify(iapp, &from, hdr, hlen - sizeof(*hdr));
367 case IAPP_CMD_MOVE_notify:
368 /* TODO: MOVE is using TCP; so move this to TCP handler once it
369 * is implemented.. */
370 /* IAPP-MOVE.indication(MAC Address, New BSSID,
371 * Sequence Number, AP Address, Context Block) */
375 printf("Unknown IAPP command %d\n", hdr->command);
381 struct iapp_data * iapp_init(struct hostapd_data *hapd, const char *iface)
384 struct sockaddr_ll addr;
386 struct sockaddr_in *paddr, uaddr;
387 struct iapp_data *iapp;
388 struct ip_mreqn mreq;
390 iapp = malloc(sizeof(*iapp));
393 memset(iapp, 0, sizeof(*iapp));
395 iapp->udp_sock = iapp->packet_sock = -1;
398 * open socket for sending and receiving IAPP frames over TCP
401 iapp->udp_sock = socket(PF_INET, SOCK_DGRAM, 0);
402 if (iapp->udp_sock < 0) {
403 perror("socket[PF_INET,SOCK_DGRAM]");
408 memset(&ifr, 0, sizeof(ifr));
409 strncpy(ifr.ifr_name, iface, sizeof(ifr.ifr_name));
410 if (ioctl(iapp->udp_sock, SIOCGIFINDEX, &ifr) != 0) {
411 perror("ioctl(SIOCGIFINDEX)");
415 ifindex = ifr.ifr_ifindex;
417 if (ioctl(iapp->udp_sock, SIOCGIFADDR, &ifr) != 0) {
418 perror("ioctl(SIOCGIFADDR)");
422 paddr = (struct sockaddr_in *) &ifr.ifr_addr;
423 if (paddr->sin_family != AF_INET) {
424 printf("Invalid address family %i (SIOCGIFADDR)\n",
429 iapp->own.s_addr = paddr->sin_addr.s_addr;
431 if (ioctl(iapp->udp_sock, SIOCGIFBRDADDR, &ifr) != 0) {
432 perror("ioctl(SIOCGIFBRDADDR)");
436 paddr = (struct sockaddr_in *) &ifr.ifr_addr;
437 if (paddr->sin_family != AF_INET) {
438 printf("Invalid address family %i (SIOCGIFBRDADDR)\n",
443 inet_aton(IAPP_MULTICAST, &iapp->multicast);
445 memset(&uaddr, 0, sizeof(uaddr));
446 uaddr.sin_family = AF_INET;
447 uaddr.sin_port = htons(IAPP_UDP_PORT);
448 if (bind(iapp->udp_sock, (struct sockaddr *) &uaddr,
449 sizeof(uaddr)) < 0) {
455 memset(&mreq, 0, sizeof(mreq));
456 mreq.imr_multiaddr = iapp->multicast;
457 mreq.imr_address.s_addr = INADDR_ANY;
458 mreq.imr_ifindex = 0;
459 if (setsockopt(iapp->udp_sock, SOL_IP, IP_ADD_MEMBERSHIP, &mreq,
461 perror("setsockopt[UDP,IP_ADD_MEMBERSHIP]");
465 iapp->packet_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
466 if (iapp->packet_sock < 0) {
467 perror("socket[PF_PACKET,SOCK_RAW]");
471 memset(&addr, 0, sizeof(addr));
472 addr.sll_family = AF_PACKET;
473 addr.sll_ifindex = ifindex;
474 if (bind(iapp->packet_sock, (struct sockaddr *) &addr,
476 perror("bind[PACKET]");
480 if (eloop_register_read_sock(iapp->udp_sock, iapp_receive_udp,
482 printf("Could not register read socket for IAPP.\n");
486 printf("IEEE 802.11F (IAPP) using interface %s\n", iface);
488 /* TODO: For levels 2 and 3: send RADIUS Initiate-Request, receive
489 * RADIUS Initiate-Accept or Initiate-Reject. IAPP port should actually
490 * be openned only after receiving Initiate-Accept. If Initiate-Reject
491 * is received, IAPP is not started. */
497 void iapp_deinit(struct iapp_data *iapp)
499 struct ip_mreqn mreq;
504 if (iapp->udp_sock >= 0) {
505 memset(&mreq, 0, sizeof(mreq));
506 mreq.imr_multiaddr = iapp->multicast;
507 mreq.imr_address.s_addr = INADDR_ANY;
508 mreq.imr_ifindex = 0;
509 if (setsockopt(iapp->udp_sock, SOL_IP, IP_DROP_MEMBERSHIP,
510 &mreq, sizeof(mreq)) < 0) {
511 perror("setsockopt[UDP,IP_DEL_MEMBERSHIP]");
514 eloop_unregister_read_sock(iapp->udp_sock);
515 close(iapp->udp_sock);
517 if (iapp->packet_sock >= 0) {
518 eloop_unregister_read_sock(iapp->packet_sock);
519 close(iapp->packet_sock);