contrib/hostapd/src/drivers/driver_madwifi.c

   1 /*
   2  * hostapd - driver interaction with MADWIFI 802.11 driver
   3  * Copyright (c) 2004, Sam Leffler <sam@errno.com>
   4  * Copyright (c) 2004, Video54 Technologies
   5  * Copyright (c) 2004-2007, Jouni Malinen <j@w1.fi>
   6  *
   7  * This software may be distributed under the terms of the BSD license.
   8  * See README for more details.
   9  *
  10  * This driver wrapper is only for hostapd AP mode functionality. Station
  11  * (wpa_supplicant) operations with madwifi are supported by the driver_wext.c
  12  * wrapper.
  13  */
  14
  15 #include "includes.h"
  16 #include <sys/ioctl.h>
  17
  18 #include "common.h"
  19 #include "driver.h"
  20 #include "driver_wext.h"
  21 #include "eloop.h"
  22 #include "common/ieee802_11_defs.h"
  23 #include "linux_wext.h"
  24
  25 /*
  26  * Avoid conflicts with wpa_supplicant definitions by undefining a definition.
  27  */
  28 #undef WME_OUI_TYPE
  29
  30 #include <include/compat.h>
  31 #include <net80211/ieee80211.h>
  32 #ifdef WME_NUM_AC
  33 /* Assume this is built against BSD branch of madwifi driver. */
  34 #define MADWIFI_BSD
  35 #include <net80211/_ieee80211.h>
  36 #endif /* WME_NUM_AC */
  37 #include <net80211/ieee80211_crypto.h>
  38 #include <net80211/ieee80211_ioctl.h>
  39
  40 #ifdef CONFIG_WPS
  41 #ifdef IEEE80211_IOCTL_FILTERFRAME
  42 #include <netpacket/packet.h>
  43
  44 #ifndef ETH_P_80211_RAW
  45 #define ETH_P_80211_RAW 0x0019
  46 #endif
  47 #endif /* IEEE80211_IOCTL_FILTERFRAME */
  48 #endif /* CONFIG_WPS */
  49
  50 /*
  51  * Avoid conflicts with hostapd definitions by undefining couple of defines
  52  * from madwifi header files.
  53  */
  54 #undef RSN_VERSION
  55 #undef WPA_VERSION
  56 #undef WPA_OUI_TYPE
  57 #undef WME_OUI_TYPE
  58
  59
  60 #ifdef IEEE80211_IOCTL_SETWMMPARAMS
  61 /* Assume this is built against madwifi-ng */
  62 #define MADWIFI_NG
  63 #endif /* IEEE80211_IOCTL_SETWMMPARAMS */
  64
  65 #define WPA_KEY_RSC_LEN 8
  66
  67 #include "priv_netlink.h"
  68 #include "netlink.h"
  69 #include "linux_ioctl.h"
  70 #include "l2_packet/l2_packet.h"
  71
  72
  73 struct madwifi_driver_data {
  74         struct hostapd_data *hapd;              /* back pointer */
  75
  76         char    iface[IFNAMSIZ + 1];
  77         int     ifindex;
  78         struct l2_packet_data *sock_xmit;       /* raw packet xmit socket */
  79         struct l2_packet_data *sock_recv;       /* raw packet recv socket */
  80         int     ioctl_sock;                     /* socket for ioctl() use */
  81         struct netlink_data *netlink;
  82         int     we_version;
  83         u8      acct_mac[ETH_ALEN];
  84         struct hostap_sta_driver_data acct_data;
  85
  86         struct l2_packet_data *sock_raw; /* raw 802.11 management frames */
  87 };
  88
  89 static int madwifi_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
  90                               int reason_code);
  91
  92 static int
  93 set80211priv(struct madwifi_driver_data *drv, int op, void *data, int len)
  94 {
  95         struct iwreq iwr;
  96         int do_inline = len < IFNAMSIZ;
  97
  98         memset(&iwr, 0, sizeof(iwr));
  99         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 100 #ifdef IEEE80211_IOCTL_FILTERFRAME
 101         /* FILTERFRAME must be NOT inline, regardless of size. */
 102         if (op == IEEE80211_IOCTL_FILTERFRAME)
 103                 do_inline = 0;
 104 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 105         if (op == IEEE80211_IOCTL_SET_APPIEBUF)
 106                 do_inline = 0;
 107         if (do_inline) {
 108                 /*
 109                  * Argument data fits inline; put it there.
 110                  */
 111                 memcpy(iwr.u.name, data, len);
 112         } else {
 113                 /*
 114                  * Argument data too big for inline transfer; setup a
 115                  * parameter block instead; the kernel will transfer
 116                  * the data for the driver.
 117                  */
 118                 iwr.u.data.pointer = data;
 119                 iwr.u.data.length = len;
 120         }
 121
 122         if (ioctl(drv->ioctl_sock, op, &iwr) < 0) {
 123 #ifdef MADWIFI_NG
 124                 int first = IEEE80211_IOCTL_SETPARAM;
 125                 static const char *opnames[] = {
 126                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 127                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 128                         "ioctl[IEEE80211_IOCTL_SETMODE]",
 129                         "ioctl[IEEE80211_IOCTL_GETMODE]",
 130                         "ioctl[IEEE80211_IOCTL_SETWMMPARAMS]",
 131                         "ioctl[IEEE80211_IOCTL_GETWMMPARAMS]",
 132                         "ioctl[IEEE80211_IOCTL_SETCHANLIST]",
 133                         "ioctl[IEEE80211_IOCTL_GETCHANLIST]",
 134                         "ioctl[IEEE80211_IOCTL_CHANSWITCH]",
 135                         "ioctl[IEEE80211_IOCTL_GET_APPIEBUF]",
 136                         "ioctl[IEEE80211_IOCTL_SET_APPIEBUF]",
 137                         "ioctl[IEEE80211_IOCTL_GETSCANRESULTS]",
 138                         "ioctl[IEEE80211_IOCTL_FILTERFRAME]",
 139                         "ioctl[IEEE80211_IOCTL_GETCHANINFO]",
 140                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 141                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 142                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 143                         NULL,
 144                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 145                         NULL,
 146                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 147                         NULL,
 148                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 149                         NULL,
 150                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 151                         NULL,
 152                         "ioctl[IEEE80211_IOCTL_WDSMAC]",
 153                         NULL,
 154                         "ioctl[IEEE80211_IOCTL_WDSDELMAC]",
 155                         NULL,
 156                         "ioctl[IEEE80211_IOCTL_KICKMAC]",
 157                 };
 158 #else /* MADWIFI_NG */
 159                 int first = IEEE80211_IOCTL_SETPARAM;
 160                 static const char *opnames[] = {
 161                         "ioctl[IEEE80211_IOCTL_SETPARAM]",
 162                         "ioctl[IEEE80211_IOCTL_GETPARAM]",
 163                         "ioctl[IEEE80211_IOCTL_SETKEY]",
 164                         "ioctl[SIOCIWFIRSTPRIV+3]",
 165                         "ioctl[IEEE80211_IOCTL_DELKEY]",
 166                         "ioctl[SIOCIWFIRSTPRIV+5]",
 167                         "ioctl[IEEE80211_IOCTL_SETMLME]",
 168                         "ioctl[SIOCIWFIRSTPRIV+7]",
 169                         "ioctl[IEEE80211_IOCTL_SETOPTIE]",
 170                         "ioctl[IEEE80211_IOCTL_GETOPTIE]",
 171                         "ioctl[IEEE80211_IOCTL_ADDMAC]",
 172                         "ioctl[SIOCIWFIRSTPRIV+11]",
 173                         "ioctl[IEEE80211_IOCTL_DELMAC]",
 174                         "ioctl[SIOCIWFIRSTPRIV+13]",
 175                         "ioctl[IEEE80211_IOCTL_CHANLIST]",
 176                         "ioctl[SIOCIWFIRSTPRIV+15]",
 177                         "ioctl[IEEE80211_IOCTL_GETRSN]",
 178                         "ioctl[SIOCIWFIRSTPRIV+17]",
 179                         "ioctl[IEEE80211_IOCTL_GETKEY]",
 180                 };
 181 #endif /* MADWIFI_NG */
 182                 int idx = op - first;
 183                 if (first <= op &&
 184                     idx < (int) ARRAY_SIZE(opnames) &&
 185                     opnames[idx])
 186                         perror(opnames[idx]);
 187                 else
 188                         perror("ioctl[unknown???]");
 189                 return -1;
 190         }
 191         return 0;
 192 }
 193
 194 static int
 195 set80211param(struct madwifi_driver_data *drv, int op, int arg)
 196 {
 197         struct iwreq iwr;
 198
 199         memset(&iwr, 0, sizeof(iwr));
 200         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 201         iwr.u.mode = op;
 202         memcpy(iwr.u.name+sizeof(__u32), &arg, sizeof(arg));
 203
 204         if (ioctl(drv->ioctl_sock, IEEE80211_IOCTL_SETPARAM, &iwr) < 0) {
 205                 perror("ioctl[IEEE80211_IOCTL_SETPARAM]");
 206                 wpa_printf(MSG_DEBUG, "%s: Failed to set parameter (op %d "
 207                            "arg %d)", __func__, op, arg);
 208                 return -1;
 209         }
 210         return 0;
 211 }
 212
 213 #ifndef CONFIG_NO_STDOUT_DEBUG
 214 static const char *
 215 ether_sprintf(const u8 *addr)
 216 {
 217         static char buf[sizeof(MACSTR)];
 218
 219         if (addr != NULL)
 220                 snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
 221         else
 222                 snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
 223         return buf;
 224 }
 225 #endif /* CONFIG_NO_STDOUT_DEBUG */
 226
 227 /*
 228  * Configure WPA parameters.
 229  */
 230 static int
 231 madwifi_configure_wpa(struct madwifi_driver_data *drv,
 232                       struct wpa_bss_params *params)
 233 {
 234         int v;
 235
 236         switch (params->wpa_group) {
 237         case WPA_CIPHER_CCMP:
 238                 v = IEEE80211_CIPHER_AES_CCM;
 239                 break;
 240         case WPA_CIPHER_TKIP:
 241                 v = IEEE80211_CIPHER_TKIP;
 242                 break;
 243         case WPA_CIPHER_WEP104:
 244                 v = IEEE80211_CIPHER_WEP;
 245                 break;
 246         case WPA_CIPHER_WEP40:
 247                 v = IEEE80211_CIPHER_WEP;
 248                 break;
 249         case WPA_CIPHER_NONE:
 250                 v = IEEE80211_CIPHER_NONE;
 251                 break;
 252         default:
 253                 wpa_printf(MSG_ERROR, "Unknown group key cipher %u",
 254                            params->wpa_group);
 255                 return -1;
 256         }
 257         wpa_printf(MSG_DEBUG, "%s: group key cipher=%d", __func__, v);
 258         if (set80211param(drv, IEEE80211_PARAM_MCASTCIPHER, v)) {
 259                 printf("Unable to set group key cipher to %u\n", v);
 260                 return -1;
 261         }
 262         if (v == IEEE80211_CIPHER_WEP) {
 263                 /* key length is done only for specific ciphers */
 264                 v = (params->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
 265                 if (set80211param(drv, IEEE80211_PARAM_MCASTKEYLEN, v)) {
 266                         printf("Unable to set group key length to %u\n", v);
 267                         return -1;
 268                 }
 269         }
 270
 271         v = 0;
 272         if (params->wpa_pairwise & WPA_CIPHER_CCMP)
 273                 v |= 1<<IEEE80211_CIPHER_AES_CCM;
 274         if (params->wpa_pairwise & WPA_CIPHER_TKIP)
 275                 v |= 1<<IEEE80211_CIPHER_TKIP;
 276         if (params->wpa_pairwise & WPA_CIPHER_NONE)
 277                 v |= 1<<IEEE80211_CIPHER_NONE;
 278         wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
 279         if (set80211param(drv, IEEE80211_PARAM_UCASTCIPHERS, v)) {
 280                 printf("Unable to set pairwise key ciphers to 0x%x\n", v);
 281                 return -1;
 282         }
 283
 284         wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
 285                    __func__, params->wpa_key_mgmt);
 286         if (set80211param(drv, IEEE80211_PARAM_KEYMGTALGS,
 287                           params->wpa_key_mgmt)) {
 288                 printf("Unable to set key management algorithms to 0x%x\n",
 289                         params->wpa_key_mgmt);
 290                 return -1;
 291         }
 292
 293         v = 0;
 294         if (params->rsn_preauth)
 295                 v |= BIT(0);
 296         wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
 297                    __func__, params->rsn_preauth);
 298         if (set80211param(drv, IEEE80211_PARAM_RSNCAPS, v)) {
 299                 printf("Unable to set RSN capabilities to 0x%x\n", v);
 300                 return -1;
 301         }
 302
 303         wpa_printf(MSG_DEBUG, "%s: enable WPA=0x%x", __func__, params->wpa);
 304         if (set80211param(drv, IEEE80211_PARAM_WPA, params->wpa)) {
 305                 printf("Unable to set WPA to %u\n", params->wpa);
 306                 return -1;
 307         }
 308         return 0;
 309 }
 310
 311 static int
 312 madwifi_set_ieee8021x(void *priv, struct wpa_bss_params *params)
 313 {
 314         struct madwifi_driver_data *drv = priv;
 315
 316         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, params->enabled);
 317
 318         if (!params->enabled) {
 319                 /* XXX restore state */
 320                 return set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 321                         IEEE80211_AUTH_AUTO);
 322         }
 323         if (!params->wpa && !params->ieee802_1x) {
 324                 wpa_printf(MSG_WARNING, "No 802.1X or WPA enabled!");
 325                 return -1;
 326         }
 327         if (params->wpa && madwifi_configure_wpa(drv, params) != 0) {
 328                 wpa_printf(MSG_WARNING, "Error configuring WPA state!");
 329                 return -1;
 330         }
 331         if (set80211param(priv, IEEE80211_PARAM_AUTHMODE,
 332                 (params->wpa ? IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
 333                 wpa_printf(MSG_WARNING, "Error enabling WPA/802.1X!");
 334                 return -1;
 335         }
 336
 337         return 0;
 338 }
 339
 340 static int
 341 madwifi_set_privacy(void *priv, int enabled)
 342 {
 343         struct madwifi_driver_data *drv = priv;
 344
 345         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
 346
 347         return set80211param(drv, IEEE80211_PARAM_PRIVACY, enabled);
 348 }
 349
 350 static int
 351 madwifi_set_sta_authorized(void *priv, const u8 *addr, int authorized)
 352 {
 353         struct madwifi_driver_data *drv = priv;
 354         struct ieee80211req_mlme mlme;
 355         int ret;
 356
 357         wpa_printf(MSG_DEBUG, "%s: addr=%s authorized=%d",
 358                    __func__, ether_sprintf(addr), authorized);
 359
 360         if (authorized)
 361                 mlme.im_op = IEEE80211_MLME_AUTHORIZE;
 362         else
 363                 mlme.im_op = IEEE80211_MLME_UNAUTHORIZE;
 364         mlme.im_reason = 0;
 365         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 366         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 367         if (ret < 0) {
 368                 wpa_printf(MSG_DEBUG, "%s: Failed to %sauthorize STA " MACSTR,
 369                            __func__, authorized ? "" : "un", MAC2STR(addr));
 370         }
 371
 372         return ret;
 373 }
 374
 375 static int
 376 madwifi_sta_set_flags(void *priv, const u8 *addr,
 377                       int total_flags, int flags_or, int flags_and)
 378 {
 379         /* For now, only support setting Authorized flag */
 380         if (flags_or & WPA_STA_AUTHORIZED)
 381                 return madwifi_set_sta_authorized(priv, addr, 1);
 382         if (!(flags_and & WPA_STA_AUTHORIZED))
 383                 return madwifi_set_sta_authorized(priv, addr, 0);
 384         return 0;
 385 }
 386
 387 static int
 388 madwifi_del_key(void *priv, const u8 *addr, int key_idx)
 389 {
 390         struct madwifi_driver_data *drv = priv;
 391         struct ieee80211req_del_key wk;
 392         int ret;
 393
 394         wpa_printf(MSG_DEBUG, "%s: addr=%s key_idx=%d",
 395                    __func__, ether_sprintf(addr), key_idx);
 396
 397         memset(&wk, 0, sizeof(wk));
 398         if (addr != NULL) {
 399                 memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
 400                 wk.idk_keyix = (u8) IEEE80211_KEYIX_NONE;
 401         } else {
 402                 wk.idk_keyix = key_idx;
 403         }
 404
 405         ret = set80211priv(drv, IEEE80211_IOCTL_DELKEY, &wk, sizeof(wk));
 406         if (ret < 0) {
 407                 wpa_printf(MSG_DEBUG, "%s: Failed to delete key (addr %s"
 408                            " key_idx %d)", __func__, ether_sprintf(addr),
 409                            key_idx);
 410         }
 411
 412         return ret;
 413 }
 414
 415 static int
 416 wpa_driver_madwifi_set_key(const char *ifname, void *priv, enum wpa_alg alg,
 417                            const u8 *addr, int key_idx, int set_tx,
 418                            const u8 *seq, size_t seq_len,
 419                            const u8 *key, size_t key_len)
 420 {
 421         struct madwifi_driver_data *drv = priv;
 422         struct ieee80211req_key wk;
 423         u_int8_t cipher;
 424         int ret;
 425
 426         if (alg == WPA_ALG_NONE)
 427                 return madwifi_del_key(drv, addr, key_idx);
 428
 429         wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%s key_idx=%d",
 430                    __func__, alg, ether_sprintf(addr), key_idx);
 431
 432         if (alg == WPA_ALG_WEP)
 433                 cipher = IEEE80211_CIPHER_WEP;
 434         else if (alg == WPA_ALG_TKIP)
 435                 cipher = IEEE80211_CIPHER_TKIP;
 436         else if (alg == WPA_ALG_CCMP)
 437                 cipher = IEEE80211_CIPHER_AES_CCM;
 438         else {
 439                 printf("%s: unknown/unsupported algorithm %d\n",
 440                         __func__, alg);
 441                 return -1;
 442         }
 443
 444         if (key_len > sizeof(wk.ik_keydata)) {
 445                 printf("%s: key length %lu too big\n", __func__,
 446                        (unsigned long) key_len);
 447                 return -3;
 448         }
 449
 450         memset(&wk, 0, sizeof(wk));
 451         wk.ik_type = cipher;
 452         wk.ik_flags = IEEE80211_KEY_RECV | IEEE80211_KEY_XMIT;
 453         if (addr == NULL || is_broadcast_ether_addr(addr)) {
 454                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 455                 wk.ik_keyix = key_idx;
 456                 wk.ik_flags |= IEEE80211_KEY_DEFAULT;
 457         } else {
 458                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 459                 wk.ik_keyix = IEEE80211_KEYIX_NONE;
 460         }
 461         wk.ik_keylen = key_len;
 462         memcpy(wk.ik_keydata, key, key_len);
 463
 464         ret = set80211priv(drv, IEEE80211_IOCTL_SETKEY, &wk, sizeof(wk));
 465         if (ret < 0) {
 466                 wpa_printf(MSG_DEBUG, "%s: Failed to set key (addr %s"
 467                            " key_idx %d alg %d key_len %lu set_tx %d)",
 468                            __func__, ether_sprintf(wk.ik_macaddr), key_idx,
 469                            alg, (unsigned long) key_len, set_tx);
 470         }
 471
 472         return ret;
 473 }
 474
 475
 476 static int
 477 madwifi_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
 478                    u8 *seq)
 479 {
 480         struct madwifi_driver_data *drv = priv;
 481         struct ieee80211req_key wk;
 482
 483         wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
 484                    __func__, ether_sprintf(addr), idx);
 485
 486         memset(&wk, 0, sizeof(wk));
 487         if (addr == NULL)
 488                 memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
 489         else
 490                 memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
 491         wk.ik_keyix = idx;
 492
 493         if (set80211priv(drv, IEEE80211_IOCTL_GETKEY, &wk, sizeof(wk))) {
 494                 wpa_printf(MSG_DEBUG, "%s: Failed to get encryption data "
 495                            "(addr " MACSTR " key_idx %d)",
 496                            __func__, MAC2STR(wk.ik_macaddr), idx);
 497                 return -1;
 498         }
 499
 500 #ifdef WORDS_BIGENDIAN
 501         {
 502                 /*
 503                  * wk.ik_keytsc is in host byte order (big endian), need to
 504                  * swap it to match with the byte order used in WPA.
 505                  */
 506                 int i;
 507                 u8 tmp[WPA_KEY_RSC_LEN];
 508                 memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 509                 for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
 510                         seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
 511                 }
 512         }
 513 #else /* WORDS_BIGENDIAN */
 514         memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
 515 #endif /* WORDS_BIGENDIAN */
 516         return 0;
 517 }
 518
 519
 520 static int
 521 madwifi_flush(void *priv)
 522 {
 523 #ifdef MADWIFI_BSD
 524         u8 allsta[IEEE80211_ADDR_LEN];
 525         memset(allsta, 0xff, IEEE80211_ADDR_LEN);
 526         return madwifi_sta_deauth(priv, NULL, allsta,
 527                                   IEEE80211_REASON_AUTH_LEAVE);
 528 #else /* MADWIFI_BSD */
 529         return 0;               /* XXX */
 530 #endif /* MADWIFI_BSD */
 531 }
 532
 533
 534 static int
 535 madwifi_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
 536                              const u8 *addr)
 537 {
 538         struct madwifi_driver_data *drv = priv;
 539
 540 #ifdef MADWIFI_BSD
 541         struct ieee80211req_sta_stats stats;
 542
 543         memset(data, 0, sizeof(*data));
 544
 545         /*
 546          * Fetch statistics for station from the system.
 547          */
 548         memset(&stats, 0, sizeof(stats));
 549         memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
 550         if (set80211priv(drv,
 551 #ifdef MADWIFI_NG
 552                          IEEE80211_IOCTL_STA_STATS,
 553 #else /* MADWIFI_NG */
 554                          IEEE80211_IOCTL_GETSTASTATS,
 555 #endif /* MADWIFI_NG */
 556                          &stats, sizeof(stats))) {
 557                 wpa_printf(MSG_DEBUG, "%s: Failed to fetch STA stats (addr "
 558                            MACSTR ")", __func__, MAC2STR(addr));
 559                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 560                         memcpy(data, &drv->acct_data, sizeof(*data));
 561                         return 0;
 562                 }
 563
 564                 printf("Failed to get station stats information element.\n");
 565                 return -1;
 566         }
 567
 568         data->rx_packets = stats.is_stats.ns_rx_data;
 569         data->rx_bytes = stats.is_stats.ns_rx_bytes;
 570         data->tx_packets = stats.is_stats.ns_tx_data;
 571         data->tx_bytes = stats.is_stats.ns_tx_bytes;
 572         return 0;
 573
 574 #else /* MADWIFI_BSD */
 575
 576         char buf[1024], line[128], *pos;
 577         FILE *f;
 578         unsigned long val;
 579
 580         memset(data, 0, sizeof(*data));
 581         snprintf(buf, sizeof(buf), "/proc/net/madwifi/%s/" MACSTR,
 582                  drv->iface, MAC2STR(addr));
 583
 584         f = fopen(buf, "r");
 585         if (!f) {
 586                 if (memcmp(addr, drv->acct_mac, ETH_ALEN) != 0)
 587                         return -1;
 588                 memcpy(data, &drv->acct_data, sizeof(*data));
 589                 return 0;
 590         }
 591         /* Need to read proc file with in one piece, so use large enough
 592          * buffer. */
 593         setbuffer(f, buf, sizeof(buf));
 594
 595         while (fgets(line, sizeof(line), f)) {
 596                 pos = strchr(line, '=');
 597                 if (!pos)
 598                         continue;
 599                 *pos++ = '\0';
 600                 val = strtoul(pos, NULL, 10);
 601                 if (strcmp(line, "rx_packets") == 0)
 602                         data->rx_packets = val;
 603                 else if (strcmp(line, "tx_packets") == 0)
 604                         data->tx_packets = val;
 605                 else if (strcmp(line, "rx_bytes") == 0)
 606                         data->rx_bytes = val;
 607                 else if (strcmp(line, "tx_bytes") == 0)
 608                         data->tx_bytes = val;
 609         }
 610
 611         fclose(f);
 612
 613         return 0;
 614 #endif /* MADWIFI_BSD */
 615 }
 616
 617
 618 static int
 619 madwifi_sta_clear_stats(void *priv, const u8 *addr)
 620 {
 621 #if defined(MADWIFI_BSD) && defined(IEEE80211_MLME_CLEAR_STATS)
 622         struct madwifi_driver_data *drv = priv;
 623         struct ieee80211req_mlme mlme;
 624         int ret;
 625
 626         wpa_printf(MSG_DEBUG, "%s: addr=%s", __func__, ether_sprintf(addr));
 627
 628         mlme.im_op = IEEE80211_MLME_CLEAR_STATS;
 629         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 630         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme,
 631                            sizeof(mlme));
 632         if (ret < 0) {
 633                 wpa_printf(MSG_DEBUG, "%s: Failed to clear STA stats (addr "
 634                            MACSTR ")", __func__, MAC2STR(addr));
 635         }
 636
 637         return ret;
 638 #else /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 639         return 0; /* FIX */
 640 #endif /* MADWIFI_BSD && IEEE80211_MLME_CLEAR_STATS */
 641 }
 642
 643
 644 static int
 645 madwifi_set_opt_ie(void *priv, const u8 *ie, size_t ie_len)
 646 {
 647         /*
 648          * Do nothing; we setup parameters at startup that define the
 649          * contents of the beacon information element.
 650          */
 651         return 0;
 652 }
 653
 654 static int
 655 madwifi_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
 656                    int reason_code)
 657 {
 658         struct madwifi_driver_data *drv = priv;
 659         struct ieee80211req_mlme mlme;
 660         int ret;
 661
 662         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 663                    __func__, ether_sprintf(addr), reason_code);
 664
 665         mlme.im_op = IEEE80211_MLME_DEAUTH;
 666         mlme.im_reason = reason_code;
 667         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 668         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 669         if (ret < 0) {
 670                 wpa_printf(MSG_DEBUG, "%s: Failed to deauth STA (addr " MACSTR
 671                            " reason %d)",
 672                            __func__, MAC2STR(addr), reason_code);
 673         }
 674
 675         return ret;
 676 }
 677
 678 static int
 679 madwifi_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
 680                      int reason_code)
 681 {
 682         struct madwifi_driver_data *drv = priv;
 683         struct ieee80211req_mlme mlme;
 684         int ret;
 685
 686         wpa_printf(MSG_DEBUG, "%s: addr=%s reason_code=%d",
 687                    __func__, ether_sprintf(addr), reason_code);
 688
 689         mlme.im_op = IEEE80211_MLME_DISASSOC;
 690         mlme.im_reason = reason_code;
 691         memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
 692         ret = set80211priv(drv, IEEE80211_IOCTL_SETMLME, &mlme, sizeof(mlme));
 693         if (ret < 0) {
 694                 wpa_printf(MSG_DEBUG, "%s: Failed to disassoc STA (addr "
 695                            MACSTR " reason %d)",
 696                            __func__, MAC2STR(addr), reason_code);
 697         }
 698
 699         return ret;
 700 }
 701
 702 #ifdef CONFIG_WPS
 703 #ifdef IEEE80211_IOCTL_FILTERFRAME
 704 static void madwifi_raw_receive(void *ctx, const u8 *src_addr, const u8 *buf,
 705                                 size_t len)
 706 {
 707         struct madwifi_driver_data *drv = ctx;
 708         const struct ieee80211_mgmt *mgmt;
 709         u16 fc;
 710         union wpa_event_data event;
 711
 712         /* Send Probe Request information to WPS processing */
 713
 714         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req))
 715                 return;
 716         mgmt = (const struct ieee80211_mgmt *) buf;
 717
 718         fc = le_to_host16(mgmt->frame_control);
 719         if (WLAN_FC_GET_TYPE(fc) != WLAN_FC_TYPE_MGMT ||
 720             WLAN_FC_GET_STYPE(fc) != WLAN_FC_STYPE_PROBE_REQ)
 721                 return;
 722
 723         os_memset(&event, 0, sizeof(event));
 724         event.rx_probe_req.sa = mgmt->sa;
 725         event.rx_probe_req.da = mgmt->da;
 726         event.rx_probe_req.bssid = mgmt->bssid;
 727         event.rx_probe_req.ie = mgmt->u.probe_req.variable;
 728         event.rx_probe_req.ie_len =
 729                 len - (IEEE80211_HDRLEN + sizeof(mgmt->u.probe_req));
 730         wpa_supplicant_event(drv->hapd, EVENT_RX_PROBE_REQ, &event);
 731 }
 732 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 733 #endif /* CONFIG_WPS */
 734
 735 static int madwifi_receive_probe_req(struct madwifi_driver_data *drv)
 736 {
 737         int ret = 0;
 738 #ifdef CONFIG_WPS
 739 #ifdef IEEE80211_IOCTL_FILTERFRAME
 740         struct ieee80211req_set_filter filt;
 741
 742         wpa_printf(MSG_DEBUG, "%s Enter", __func__);
 743         filt.app_filterype = IEEE80211_FILTER_TYPE_PROBE_REQ;
 744
 745         ret = set80211priv(drv, IEEE80211_IOCTL_FILTERFRAME, &filt,
 746                            sizeof(struct ieee80211req_set_filter));
 747         if (ret)
 748                 return ret;
 749
 750         drv->sock_raw = l2_packet_init(drv->iface, NULL, ETH_P_80211_RAW,
 751                                        madwifi_raw_receive, drv, 1);
 752         if (drv->sock_raw == NULL)
 753                 return -1;
 754 #endif /* IEEE80211_IOCTL_FILTERFRAME */
 755 #endif /* CONFIG_WPS */
 756         return ret;
 757 }
 758
 759 #ifdef CONFIG_WPS
 760 static int
 761 madwifi_set_wps_ie(void *priv, const u8 *ie, size_t len, u32 frametype)
 762 {
 763         struct madwifi_driver_data *drv = priv;
 764         u8 buf[256];
 765         struct ieee80211req_getset_appiebuf *beac_ie;
 766
 767         wpa_printf(MSG_DEBUG, "%s buflen = %lu", __func__,
 768                    (unsigned long) len);
 769
 770         beac_ie = (struct ieee80211req_getset_appiebuf *) buf;
 771         beac_ie->app_frmtype = frametype;
 772         beac_ie->app_buflen = len;
 773         memcpy(&(beac_ie->app_buf[0]), ie, len);
 774
 775         return set80211priv(drv, IEEE80211_IOCTL_SET_APPIEBUF, beac_ie,
 776                             sizeof(struct ieee80211req_getset_appiebuf) + len);
 777 }
 778
 779 static int
 780 madwifi_set_ap_wps_ie(void *priv, const struct wpabuf *beacon,
 781                       const struct wpabuf *proberesp,
 782                       const struct wpabuf *assocresp)
 783 {
 784         if (madwifi_set_wps_ie(priv, beacon ? wpabuf_head(beacon) : NULL,
 785                                beacon ? wpabuf_len(beacon) : 0,
 786                                IEEE80211_APPIE_FRAME_BEACON) < 0)
 787                 return -1;
 788         return madwifi_set_wps_ie(priv,
 789                                   proberesp ? wpabuf_head(proberesp) : NULL,
 790                                   proberesp ? wpabuf_len(proberesp) : 0,
 791                                   IEEE80211_APPIE_FRAME_PROBE_RESP);
 792 }
 793 #else /* CONFIG_WPS */
 794 #define madwifi_set_ap_wps_ie NULL
 795 #endif /* CONFIG_WPS */
 796
 797 static int madwifi_set_freq(void *priv, struct hostapd_freq_params *freq)
 798 {
 799         struct madwifi_driver_data *drv = priv;
 800         struct iwreq iwr;
 801
 802         os_memset(&iwr, 0, sizeof(iwr));
 803         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 804         iwr.u.freq.m = freq->channel;
 805         iwr.u.freq.e = 0;
 806
 807         if (ioctl(drv->ioctl_sock, SIOCSIWFREQ, &iwr) < 0) {
 808                 perror("ioctl[SIOCSIWFREQ]");
 809                 return -1;
 810         }
 811
 812         return 0;
 813 }
 814
 815 static void
 816 madwifi_new_sta(struct madwifi_driver_data *drv, u8 addr[IEEE80211_ADDR_LEN])
 817 {
 818         struct hostapd_data *hapd = drv->hapd;
 819         struct ieee80211req_wpaie ie;
 820         int ielen = 0;
 821         u8 *iebuf = NULL;
 822
 823         /*
 824          * Fetch negotiated WPA/RSN parameters from the system.
 825          */
 826         memset(&ie, 0, sizeof(ie));
 827         memcpy(ie.wpa_macaddr, addr, IEEE80211_ADDR_LEN);
 828         if (set80211priv(drv, IEEE80211_IOCTL_GETWPAIE, &ie, sizeof(ie))) {
 829                 wpa_printf(MSG_DEBUG, "%s: Failed to get WPA/RSN IE",
 830                            __func__);
 831                 goto no_ie;
 832         }
 833         wpa_hexdump(MSG_MSGDUMP, "madwifi req WPA IE",
 834                     ie.wpa_ie, IEEE80211_MAX_OPT_IE);
 835         iebuf = ie.wpa_ie;
 836         /* madwifi seems to return some random data if WPA/RSN IE is not set.
 837          * Assume the IE was not included if the IE type is unknown. */
 838         if (iebuf[0] != WLAN_EID_VENDOR_SPECIFIC)
 839                 iebuf[1] = 0;
 840 #ifdef MADWIFI_NG
 841         wpa_hexdump(MSG_MSGDUMP, "madwifi req RSN IE",
 842                     ie.rsn_ie, IEEE80211_MAX_OPT_IE);
 843         if (iebuf[1] == 0 && ie.rsn_ie[1] > 0) {
 844                 /* madwifi-ng svn #1453 added rsn_ie. Use it, if wpa_ie was not
 845                  * set. This is needed for WPA2. */
 846                 iebuf = ie.rsn_ie;
 847                 if (iebuf[0] != WLAN_EID_RSN)
 848                         iebuf[1] = 0;
 849         }
 850 #endif /* MADWIFI_NG */
 851
 852         ielen = iebuf[1];
 853         if (ielen == 0)
 854                 iebuf = NULL;
 855         else
 856                 ielen += 2;
 857
 858 no_ie:
 859         drv_event_assoc(hapd, addr, iebuf, ielen, 0);
 860
 861         if (memcmp(addr, drv->acct_mac, ETH_ALEN) == 0) {
 862                 /* Cached accounting data is not valid anymore. */
 863                 memset(drv->acct_mac, 0, ETH_ALEN);
 864                 memset(&drv->acct_data, 0, sizeof(drv->acct_data));
 865         }
 866 }
 867
 868 static void
 869 madwifi_wireless_event_wireless_custom(struct madwifi_driver_data *drv,
 870                                        char *custom)
 871 {
 872         wpa_printf(MSG_DEBUG, "Custom wireless event: '%s'", custom);
 873
 874         if (strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
 875                 char *pos;
 876                 u8 addr[ETH_ALEN];
 877                 pos = strstr(custom, "addr=");
 878                 if (pos == NULL) {
 879                         wpa_printf(MSG_DEBUG,
 880                                    "MLME-MICHAELMICFAILURE.indication "
 881                                    "without sender address ignored");
 882                         return;
 883                 }
 884                 pos += 5;
 885                 if (hwaddr_aton(pos, addr) == 0) {
 886                         union wpa_event_data data;
 887                         os_memset(&data, 0, sizeof(data));
 888                         data.michael_mic_failure.unicast = 1;
 889                         data.michael_mic_failure.src = addr;
 890                         wpa_supplicant_event(drv->hapd,
 891                                              EVENT_MICHAEL_MIC_FAILURE, &data);
 892                 } else {
 893                         wpa_printf(MSG_DEBUG,
 894                                    "MLME-MICHAELMICFAILURE.indication "
 895                                    "with invalid MAC address");
 896                 }
 897         } else if (strncmp(custom, "STA-TRAFFIC-STAT", 16) == 0) {
 898                 char *key, *value;
 899                 u32 val;
 900                 key = custom;
 901                 while ((key = strchr(key, '\n')) != NULL) {
 902                         key++;
 903                         value = strchr(key, '=');
 904                         if (value == NULL)
 905                                 continue;
 906                         *value++ = '\0';
 907                         val = strtoul(value, NULL, 10);
 908                         if (strcmp(key, "mac") == 0)
 909                                 hwaddr_aton(value, drv->acct_mac);
 910                         else if (strcmp(key, "rx_packets") == 0)
 911                                 drv->acct_data.rx_packets = val;
 912                         else if (strcmp(key, "tx_packets") == 0)
 913                                 drv->acct_data.tx_packets = val;
 914                         else if (strcmp(key, "rx_bytes") == 0)
 915                                 drv->acct_data.rx_bytes = val;
 916                         else if (strcmp(key, "tx_bytes") == 0)
 917                                 drv->acct_data.tx_bytes = val;
 918                         key = value;
 919                 }
 920         }
 921 }
 922
 923 static void
 924 madwifi_wireless_event_wireless(struct madwifi_driver_data *drv,
 925                                             char *data, int len)
 926 {
 927         struct iw_event iwe_buf, *iwe = &iwe_buf;
 928         char *pos, *end, *custom, *buf;
 929
 930         pos = data;
 931         end = data + len;
 932
 933         while (pos + IW_EV_LCP_LEN <= end) {
 934                 /* Event data may be unaligned, so make a local, aligned copy
 935                  * before processing. */
 936                 memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
 937                 wpa_printf(MSG_MSGDUMP, "Wireless event: cmd=0x%x len=%d",
 938                            iwe->cmd, iwe->len);
 939                 if (iwe->len <= IW_EV_LCP_LEN)
 940                         return;
 941
 942                 custom = pos + IW_EV_POINT_LEN;
 943                 if (drv->we_version > 18 &&
 944                     (iwe->cmd == IWEVMICHAELMICFAILURE ||
 945                      iwe->cmd == IWEVCUSTOM)) {
 946                         /* WE-19 removed the pointer from struct iw_point */
 947                         char *dpos = (char *) &iwe_buf.u.data.length;
 948                         int dlen = dpos - (char *) &iwe_buf;
 949                         memcpy(dpos, pos + IW_EV_LCP_LEN,
 950                                sizeof(struct iw_event) - dlen);
 951                 } else {
 952                         memcpy(&iwe_buf, pos, sizeof(struct iw_event));
 953                         custom += IW_EV_POINT_OFF;
 954                 }
 955
 956                 switch (iwe->cmd) {
 957                 case IWEVEXPIRED:
 958                         drv_event_disassoc(drv->hapd,
 959                                            (u8 *) iwe->u.addr.sa_data);
 960                         break;
 961                 case IWEVREGISTERED:
 962                         madwifi_new_sta(drv, (u8 *) iwe->u.addr.sa_data);
 963                         break;
 964                 case IWEVCUSTOM:
 965                         if (custom + iwe->u.data.length > end)
 966                                 return;
 967                         buf = malloc(iwe->u.data.length + 1);
 968                         if (buf == NULL)
 969                                 return;         /* XXX */
 970                         memcpy(buf, custom, iwe->u.data.length);
 971                         buf[iwe->u.data.length] = '\0';
 972                         madwifi_wireless_event_wireless_custom(drv, buf);
 973                         free(buf);
 974                         break;
 975                 }
 976
 977                 pos += iwe->len;
 978         }
 979 }
 980
 981
 982 static void
 983 madwifi_wireless_event_rtm_newlink(void *ctx, struct ifinfomsg *ifi,
 984                                    u8 *buf, size_t len)
 985 {
 986         struct madwifi_driver_data *drv = ctx;
 987         int attrlen, rta_len;
 988         struct rtattr *attr;
 989
 990         if (ifi->ifi_index != drv->ifindex)
 991                 return;
 992
 993         attrlen = len;
 994         attr = (struct rtattr *) buf;
 995
 996         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 997         while (RTA_OK(attr, attrlen)) {
 998                 if (attr->rta_type == IFLA_WIRELESS) {
 999                         madwifi_wireless_event_wireless(
1000                                 drv, ((char *) attr) + rta_len,
1001                                 attr->rta_len - rta_len);
1002                 }
1003                 attr = RTA_NEXT(attr, attrlen);
1004         }
1005 }
1006
1007
1008 static int
1009 madwifi_get_we_version(struct madwifi_driver_data *drv)
1010 {
1011         struct iw_range *range;
1012         struct iwreq iwr;
1013         int minlen;
1014         size_t buflen;
1015
1016         drv->we_version = 0;
1017
1018         /*
1019          * Use larger buffer than struct iw_range in order to allow the
1020          * structure to grow in the future.
1021          */
1022         buflen = sizeof(struct iw_range) + 500;
1023         range = os_zalloc(buflen);
1024         if (range == NULL)
1025                 return -1;
1026
1027         memset(&iwr, 0, sizeof(iwr));
1028         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1029         iwr.u.data.pointer = (caddr_t) range;
1030         iwr.u.data.length = buflen;
1031
1032         minlen = ((char *) &range->enc_capa) - (char *) range +
1033                 sizeof(range->enc_capa);
1034
1035         if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
1036                 perror("ioctl[SIOCGIWRANGE]");
1037                 free(range);
1038                 return -1;
1039         } else if (iwr.u.data.length >= minlen &&
1040                    range->we_version_compiled >= 18) {
1041                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
1042                            "WE(source)=%d enc_capa=0x%x",
1043                            range->we_version_compiled,
1044                            range->we_version_source,
1045                            range->enc_capa);
1046                 drv->we_version = range->we_version_compiled;
1047         }
1048
1049         free(range);
1050         return 0;
1051 }
1052
1053
1054 static int
1055 madwifi_wireless_event_init(struct madwifi_driver_data *drv)
1056 {
1057         struct netlink_config *cfg;
1058
1059         madwifi_get_we_version(drv);
1060
1061         cfg = os_zalloc(sizeof(*cfg));
1062         if (cfg == NULL)
1063                 return -1;
1064         cfg->ctx = drv;
1065         cfg->newlink_cb = madwifi_wireless_event_rtm_newlink;
1066         drv->netlink = netlink_init(cfg);
1067         if (drv->netlink == NULL) {
1068                 os_free(cfg);
1069                 return -1;
1070         }
1071
1072         return 0;
1073 }
1074
1075
1076 static int
1077 madwifi_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
1078                    int encrypt, const u8 *own_addr, u32 flags)
1079 {
1080         struct madwifi_driver_data *drv = priv;
1081         unsigned char buf[3000];
1082         unsigned char *bp = buf;
1083         struct l2_ethhdr *eth;
1084         size_t len;
1085         int status;
1086
1087         /*
1088          * Prepend the Ethernet header.  If the caller left us
1089          * space at the front we could just insert it but since
1090          * we don't know we copy to a local buffer.  Given the frequency
1091          * and size of frames this probably doesn't matter.
1092          */
1093         len = data_len + sizeof(struct l2_ethhdr);
1094         if (len > sizeof(buf)) {
1095                 bp = malloc(len);
1096                 if (bp == NULL) {
1097                         printf("EAPOL frame discarded, cannot malloc temp "
1098                                "buffer of size %lu!\n", (unsigned long) len);
1099                         return -1;
1100                 }
1101         }
1102         eth = (struct l2_ethhdr *) bp;
1103         memcpy(eth->h_dest, addr, ETH_ALEN);
1104         memcpy(eth->h_source, own_addr, ETH_ALEN);
1105         eth->h_proto = host_to_be16(ETH_P_EAPOL);
1106         memcpy(eth+1, data, data_len);
1107
1108         wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", bp, len);
1109
1110         status = l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, bp, len);
1111
1112         if (bp != buf)
1113                 free(bp);
1114         return status;
1115 }
1116
1117 static void
1118 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
1119 {
1120         struct madwifi_driver_data *drv = ctx;
1121         drv_event_eapol_rx(drv->hapd, src_addr, buf + sizeof(struct l2_ethhdr),
1122                            len - sizeof(struct l2_ethhdr));
1123 }
1124
1125 static void *
1126 madwifi_init(struct hostapd_data *hapd, struct wpa_init_params *params)
1127 {
1128         struct madwifi_driver_data *drv;
1129         struct ifreq ifr;
1130         struct iwreq iwr;
1131         char brname[IFNAMSIZ];
1132
1133         drv = os_zalloc(sizeof(struct madwifi_driver_data));
1134         if (drv == NULL) {
1135                 printf("Could not allocate memory for madwifi driver data\n");
1136                 return NULL;
1137         }
1138
1139         drv->hapd = hapd;
1140         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1141         if (drv->ioctl_sock < 0) {
1142                 perror("socket[PF_INET,SOCK_DGRAM]");
1143                 goto bad;
1144         }
1145         memcpy(drv->iface, params->ifname, sizeof(drv->iface));
1146
1147         memset(&ifr, 0, sizeof(ifr));
1148         os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
1149         if (ioctl(drv->ioctl_sock, SIOCGIFINDEX, &ifr) != 0) {
1150                 perror("ioctl(SIOCGIFINDEX)");
1151                 goto bad;
1152         }
1153         drv->ifindex = ifr.ifr_ifindex;
1154
1155         drv->sock_xmit = l2_packet_init(drv->iface, NULL, ETH_P_EAPOL,
1156                                         handle_read, drv, 1);
1157         if (drv->sock_xmit == NULL)
1158                 goto bad;
1159         if (l2_packet_get_own_addr(drv->sock_xmit, params->own_addr))
1160                 goto bad;
1161         if (params->bridge[0]) {
1162                 wpa_printf(MSG_DEBUG, "Configure bridge %s for EAPOL traffic.",
1163                            params->bridge[0]);
1164                 drv->sock_recv = l2_packet_init(params->bridge[0], NULL,
1165                                                 ETH_P_EAPOL, handle_read, drv,
1166                                                 1);
1167                 if (drv->sock_recv == NULL)
1168                         goto bad;
1169         } else if (linux_br_get(brname, drv->iface) == 0) {
1170                 wpa_printf(MSG_DEBUG, "Interface in bridge %s; configure for "
1171                            "EAPOL receive", brname);
1172                 drv->sock_recv = l2_packet_init(brname, NULL, ETH_P_EAPOL,
1173                                                 handle_read, drv, 1);
1174                 if (drv->sock_recv == NULL)
1175                         goto bad;
1176         } else
1177                 drv->sock_recv = drv->sock_xmit;
1178
1179         memset(&iwr, 0, sizeof(iwr));
1180         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1181
1182         iwr.u.mode = IW_MODE_MASTER;
1183
1184         if (ioctl(drv->ioctl_sock, SIOCSIWMODE, &iwr) < 0) {
1185                 perror("ioctl[SIOCSIWMODE]");
1186                 printf("Could not set interface to master mode!\n");
1187                 goto bad;
1188         }
1189
1190         /* mark down during setup */
1191         linux_set_iface_flags(drv->ioctl_sock, drv->iface, 0);
1192         madwifi_set_privacy(drv, 0); /* default to no privacy */
1193
1194         madwifi_receive_probe_req(drv);
1195
1196         if (madwifi_wireless_event_init(drv))
1197                 goto bad;
1198
1199         return drv;
1200 bad:
1201         if (drv->sock_xmit != NULL)
1202                 l2_packet_deinit(drv->sock_xmit);
1203         if (drv->ioctl_sock >= 0)
1204                 close(drv->ioctl_sock);
1205         if (drv != NULL)
1206                 free(drv);
1207         return NULL;
1208 }
1209
1210
1211 static void
1212 madwifi_deinit(void *priv)
1213 {
1214         struct madwifi_driver_data *drv = priv;
1215
1216         netlink_deinit(drv->netlink);
1217         (void) linux_set_iface_flags(drv->ioctl_sock, drv->iface, 0);
1218         if (drv->ioctl_sock >= 0)
1219                 close(drv->ioctl_sock);
1220         if (drv->sock_recv != NULL && drv->sock_recv != drv->sock_xmit)
1221                 l2_packet_deinit(drv->sock_recv);
1222         if (drv->sock_xmit != NULL)
1223                 l2_packet_deinit(drv->sock_xmit);
1224         if (drv->sock_raw)
1225                 l2_packet_deinit(drv->sock_raw);
1226         free(drv);
1227 }
1228
1229 static int
1230 madwifi_set_ssid(void *priv, const u8 *buf, int len)
1231 {
1232         struct madwifi_driver_data *drv = priv;
1233         struct iwreq iwr;
1234
1235         memset(&iwr, 0, sizeof(iwr));
1236         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1237         iwr.u.essid.flags = 1; /* SSID active */
1238         iwr.u.essid.pointer = (caddr_t) buf;
1239         iwr.u.essid.length = len + 1;
1240
1241         if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
1242                 perror("ioctl[SIOCSIWESSID]");
1243                 printf("len=%d\n", len);
1244                 return -1;
1245         }
1246         return 0;
1247 }
1248
1249 static int
1250 madwifi_get_ssid(void *priv, u8 *buf, int len)
1251 {
1252         struct madwifi_driver_data *drv = priv;
1253         struct iwreq iwr;
1254         int ret = 0;
1255
1256         memset(&iwr, 0, sizeof(iwr));
1257         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
1258         iwr.u.essid.pointer = (caddr_t) buf;
1259         iwr.u.essid.length = len;
1260
1261         if (ioctl(drv->ioctl_sock, SIOCGIWESSID, &iwr) < 0) {
1262                 perror("ioctl[SIOCGIWESSID]");
1263                 ret = -1;
1264         } else
1265                 ret = iwr.u.essid.length;
1266
1267         return ret;
1268 }
1269
1270 static int
1271 madwifi_set_countermeasures(void *priv, int enabled)
1272 {
1273         struct madwifi_driver_data *drv = priv;
1274         wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
1275         return set80211param(drv, IEEE80211_PARAM_COUNTERMEASURES, enabled);
1276 }
1277
1278 static int
1279 madwifi_commit(void *priv)
1280 {
1281         struct madwifi_driver_data *drv = priv;
1282         return linux_set_iface_flags(drv->ioctl_sock, drv->iface, 1);
1283 }
1284
1285
1286 const struct wpa_driver_ops wpa_driver_madwifi_ops = {
1287         .name                   = "madwifi",
1288         .desc                   = "MADWIFI 802.11 support (Atheros, etc.)",
1289         .set_key                = wpa_driver_madwifi_set_key,
1290         .hapd_init              = madwifi_init,
1291         .hapd_deinit            = madwifi_deinit,
1292         .set_ieee8021x          = madwifi_set_ieee8021x,
1293         .set_privacy            = madwifi_set_privacy,
1294         .get_seqnum             = madwifi_get_seqnum,
1295         .flush                  = madwifi_flush,
1296         .set_generic_elem       = madwifi_set_opt_ie,
1297         .sta_set_flags          = madwifi_sta_set_flags,
1298         .read_sta_data          = madwifi_read_sta_driver_data,
1299         .hapd_send_eapol        = madwifi_send_eapol,
1300         .sta_disassoc           = madwifi_sta_disassoc,
1301         .sta_deauth             = madwifi_sta_deauth,
1302         .hapd_set_ssid          = madwifi_set_ssid,
1303         .hapd_get_ssid          = madwifi_get_ssid,
1304         .hapd_set_countermeasures       = madwifi_set_countermeasures,
1305         .sta_clear_stats        = madwifi_sta_clear_stats,
1306         .commit                 = madwifi_commit,
1307         .set_ap_wps_ie          = madwifi_set_ap_wps_ie,
1308         .set_freq               = madwifi_set_freq,
1309 };