contrib/hostapd-0.4.9/ieee802_11.c

   1 /*
   2  * Host AP (software wireless LAN access point) user space daemon for
   3  * Host AP kernel driver / IEEE 802.11 Management
   4  * Copyright (c) 2002-2005, Jouni Malinen <jkmaline@cc.hut.fi>
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License version 2 as
   8  * published by the Free Software Foundation.
   9  *
  10  * Alternatively, this software may be distributed under the terms of BSD
  11  * license.
  12  *
  13  * See README and COPYING for more details.
  14  */
  15
  16 #include <stdlib.h>
  17 #include <stdio.h>
  18 #include <string.h>
  19 #include <sys/socket.h>
  20 #include <net/if.h>
  21 #include <netinet/in.h>
  22 #include <arpa/inet.h>
  23 #include <time.h>
  24
  25 #include "eloop.h"
  26 #include "hostapd.h"
  27 #include "ieee802_11.h"
  28 #include "radius.h"
  29 #include "radius_client.h"
  30 #include "ieee802_11_auth.h"
  31 #include "sta_info.h"
  32 #include "eapol_sm.h"
  33 #include "rc4.h"
  34 #include "ieee802_1x.h"
  35 #include "wpa.h"
  36 #include "accounting.h"
  37 #include "driver.h"
  38 #include "hostap_common.h"
  39
  40
  41 static u8 * hostapd_eid_supp_rates(hostapd *hapd, u8 *eid)
  42 {
  43         u8 *pos = eid;
  44
  45         *pos++ = WLAN_EID_SUPP_RATES;
  46         *pos++ = 4; /* len */
  47         *pos++ = 0x82; /* 1 Mbps, base set */
  48         *pos++ = 0x84; /* 2 Mbps, base set */
  49         *pos++ = 0x0b; /* 5.5 Mbps */
  50         *pos++ = 0x16; /* 11 Mbps */
  51
  52         return pos;
  53 }
  54
  55
  56 static u16 hostapd_own_capab_info(hostapd *hapd)
  57 {
  58         int capab = WLAN_CAPABILITY_ESS;
  59         if (hapd->conf->wpa ||
  60             (hapd->conf->ieee802_1x &&
  61              (hapd->conf->default_wep_key_len ||
  62               hapd->conf->individual_wep_key_len)))
  63                 capab |= WLAN_CAPABILITY_PRIVACY;
  64         return capab;
  65 }
  66
  67
  68 static const u8 WPA_OUI_TYPE[] = { 0x00, 0x50, 0xf2, 1 };
  69
  70 ParseRes ieee802_11_parse_elems(struct hostapd_data *hapd, u8 *start,
  71                                 size_t len,
  72                                 struct ieee802_11_elems *elems,
  73                                 int show_errors)
  74 {
  75         size_t left = len;
  76         u8 *pos = start;
  77         int unknown = 0;
  78
  79         memset(elems, 0, sizeof(*elems));
  80
  81         while (left >= 2) {
  82                 u8 id, elen;
  83
  84                 id = *pos++;
  85                 elen = *pos++;
  86                 left -= 2;
  87
  88                 if (elen > left) {
  89                         if (show_errors) {
  90                                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
  91                                               "IEEE 802.11 element parse "
  92                                               "failed (id=%d elen=%d "
  93                                               "left=%lu)\n",
  94                                               id, elen, (unsigned long) left);
  95                                 if (HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_MINIMAL))
  96                                         hostapd_hexdump("IEs", start, len);
  97                         }
  98                         return ParseFailed;
  99                 }
 100
 101                 switch (id) {
 102                 case WLAN_EID_SSID:
 103                         elems->ssid = pos;
 104                         elems->ssid_len = elen;
 105                         break;
 106                 case WLAN_EID_SUPP_RATES:
 107                         elems->supp_rates = pos;
 108                         elems->supp_rates_len = elen;
 109                         break;
 110                 case WLAN_EID_FH_PARAMS:
 111                         elems->fh_params = pos;
 112                         elems->fh_params_len = elen;
 113                         break;
 114                 case WLAN_EID_DS_PARAMS:
 115                         elems->ds_params = pos;
 116                         elems->ds_params_len = elen;
 117                         break;
 118                 case WLAN_EID_CF_PARAMS:
 119                         elems->cf_params = pos;
 120                         elems->cf_params_len = elen;
 121                         break;
 122                 case WLAN_EID_TIM:
 123                         elems->tim = pos;
 124                         elems->tim_len = elen;
 125                         break;
 126                 case WLAN_EID_IBSS_PARAMS:
 127                         elems->ibss_params = pos;
 128                         elems->ibss_params_len = elen;
 129                         break;
 130                 case WLAN_EID_CHALLENGE:
 131                         elems->challenge = pos;
 132                         elems->challenge_len = elen;
 133                         break;
 134                 case WLAN_EID_GENERIC:
 135                         if (elen > 4 && memcmp(pos, WPA_OUI_TYPE, 4) == 0) {
 136                                 elems->wpa_ie = pos;
 137                                 elems->wpa_ie_len = elen;
 138                         } else if (show_errors) {
 139                                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_EXCESSIVE,
 140                                               "IEEE 802.11 element parse "
 141                                               "ignored unknown generic element"
 142                                               " (id=%d elen=%d OUI:type="
 143                                               "%02x-%02x-%02x:%d)\n",
 144                                               id, elen,
 145                                               elen >= 1 ? pos[0] : 0,
 146                                               elen >= 2 ? pos[1] : 0,
 147                                               elen >= 3 ? pos[2] : 0,
 148                                               elen >= 4 ? pos[3] : 0);
 149                                 unknown++;
 150                         } else {
 151                                 unknown++;
 152                         }
 153                         break;
 154                 case WLAN_EID_RSN:
 155                         elems->rsn_ie = pos;
 156                         elems->rsn_ie_len = elen;
 157                         break;
 158                 default:
 159                         unknown++;
 160                         if (!show_errors)
 161                                 break;
 162                         HOSTAPD_DEBUG(HOSTAPD_DEBUG_EXCESSIVE,
 163                                       "IEEE 802.11 element parse ignored "
 164                                       "unknown element (id=%d elen=%d)\n",
 165                                       id, elen);
 166                         break;
 167                 }
 168
 169                 left -= elen;
 170                 pos += elen;
 171         }
 172
 173         if (left)
 174                 return ParseFailed;
 175
 176         return unknown ? ParseUnknown : ParseOK;
 177 }
 178
 179
 180 static void ieee802_11_print_ssid(const u8 *ssid, u8 len)
 181 {
 182         int i;
 183         for (i = 0; i < len; i++) {
 184                 if (ssid[i] >= 32 && ssid[i] < 127)
 185                         printf("%c", ssid[i]);
 186                 else
 187                         printf("<%02x>", ssid[i]);
 188         }
 189 }
 190
 191
 192 static void ieee802_11_sta_authenticate(void *eloop_ctx, void *timeout_ctx)
 193 {
 194         hostapd *hapd = eloop_ctx;
 195         struct ieee80211_mgmt mgmt;
 196
 197         if (hapd->assoc_ap_state == WAIT_BEACON)
 198                 hapd->assoc_ap_state = AUTHENTICATE;
 199         if (hapd->assoc_ap_state != AUTHENTICATE)
 200                 return;
 201
 202         printf("Authenticate with AP " MACSTR " SSID=",
 203                MAC2STR(hapd->conf->assoc_ap_addr));
 204         ieee802_11_print_ssid((u8 *) hapd->assoc_ap_ssid,
 205                               hapd->assoc_ap_ssid_len);
 206         printf(" (as station)\n");
 207
 208         memset(&mgmt, 0, sizeof(mgmt));
 209         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 210                                           WLAN_FC_STYPE_AUTH);
 211         /* Request TX callback */
 212         mgmt.frame_control |= host_to_le16(BIT(1));
 213         memcpy(mgmt.da, hapd->conf->assoc_ap_addr, ETH_ALEN);
 214         memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
 215         memcpy(mgmt.bssid, hapd->conf->assoc_ap_addr, ETH_ALEN);
 216         mgmt.u.auth.auth_alg = host_to_le16(WLAN_AUTH_OPEN);
 217         mgmt.u.auth.auth_transaction = host_to_le16(1);
 218         mgmt.u.auth.status_code = host_to_le16(0);
 219         if (hostapd_send_mgmt_frame(hapd, &mgmt, IEEE80211_HDRLEN +
 220                                     sizeof(mgmt.u.auth), 0) < 0)
 221                 perror("ieee802_11_sta_authenticate: send");
 222
 223         /* Try to authenticate again, if this attempt fails or times out. */
 224         eloop_register_timeout(5, 0, ieee802_11_sta_authenticate, hapd, NULL);
 225 }
 226
 227
 228 static void ieee802_11_sta_associate(void *eloop_ctx, void *timeout_ctx)
 229 {
 230         hostapd *hapd = eloop_ctx;
 231         u8 buf[256];
 232         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) buf;
 233         u8 *p;
 234
 235         if (hapd->assoc_ap_state == AUTHENTICATE)
 236                 hapd->assoc_ap_state = ASSOCIATE;
 237         if (hapd->assoc_ap_state != ASSOCIATE)
 238                 return;
 239
 240         printf("Associate with AP " MACSTR " SSID=",
 241                MAC2STR(hapd->conf->assoc_ap_addr));
 242         ieee802_11_print_ssid((u8 *) hapd->assoc_ap_ssid,
 243                               hapd->assoc_ap_ssid_len);
 244         printf(" (as station)\n");
 245
 246         memset(mgmt, 0, sizeof(*mgmt));
 247         mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 248                                           WLAN_FC_STYPE_ASSOC_REQ);
 249         /* Request TX callback */
 250         mgmt->frame_control |= host_to_le16(BIT(1));
 251         memcpy(mgmt->da, hapd->conf->assoc_ap_addr, ETH_ALEN);
 252         memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
 253         memcpy(mgmt->bssid, hapd->conf->assoc_ap_addr, ETH_ALEN);
 254         mgmt->u.assoc_req.capab_info = host_to_le16(0);
 255         mgmt->u.assoc_req.listen_interval = host_to_le16(1);
 256         p = &mgmt->u.assoc_req.variable[0];
 257
 258         *p++ = WLAN_EID_SSID;
 259         *p++ = hapd->assoc_ap_ssid_len;
 260         memcpy(p, hapd->assoc_ap_ssid, hapd->assoc_ap_ssid_len);
 261         p += hapd->assoc_ap_ssid_len;
 262
 263         p = hostapd_eid_supp_rates(hapd, p);
 264
 265         if (hostapd_send_mgmt_frame(hapd, mgmt, p - (u8 *) mgmt, 0) < 0)
 266                 perror("ieee802_11_sta_associate: send");
 267
 268         /* Try to authenticate again, if this attempt fails or times out. */
 269         eloop_register_timeout(5, 0, ieee802_11_sta_associate, hapd, NULL);
 270 }
 271
 272
 273 static u16 auth_shared_key(hostapd *hapd, struct sta_info *sta,
 274                            u16 auth_transaction, u8 *challenge, int iswep)
 275 {
 276         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 277                        HOSTAPD_LEVEL_DEBUG,
 278                        "authentication (shared key, transaction %d)",
 279                        auth_transaction);
 280
 281         if (auth_transaction == 1) {
 282                 if (!sta->challenge) {
 283                         /* Generate a pseudo-random challenge */
 284                         u8 key[8];
 285                         time_t now;
 286                         int r;
 287                         sta->challenge = malloc(WLAN_AUTH_CHALLENGE_LEN);
 288                         if (!sta->challenge)
 289                                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 290                         memset(sta->challenge, 0, WLAN_AUTH_CHALLENGE_LEN);
 291
 292                         now = time(NULL);
 293                         r = random();
 294                         memcpy(key, &now, 4);
 295                         memcpy(key + 4, &r, 4);
 296                         rc4(sta->challenge, WLAN_AUTH_CHALLENGE_LEN,
 297                             key, sizeof(key));
 298                 }
 299                 return 0;
 300         }
 301
 302         if (auth_transaction != 3)
 303                 return WLAN_STATUS_UNSPECIFIED_FAILURE;
 304
 305         /* Transaction 3 */
 306         if (!iswep || !sta->challenge || !challenge ||
 307             memcmp(sta->challenge, challenge, WLAN_AUTH_CHALLENGE_LEN)) {
 308                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 309                                HOSTAPD_LEVEL_INFO,
 310                                "shared key authentication - invalid "
 311                                "challenge-response");
 312                 return WLAN_STATUS_CHALLENGE_FAIL;
 313         }
 314
 315         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 316                        HOSTAPD_LEVEL_DEBUG,
 317                        "authentication OK (shared key)");
 318 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 319         /* Station will be marked authenticated if it ACKs the
 320          * authentication reply. */
 321 #else
 322         sta->flags |= WLAN_STA_AUTH;
 323         wpa_sm_event(hapd, sta, WPA_AUTH);
 324 #endif
 325         free(sta->challenge);
 326         sta->challenge = NULL;
 327
 328         return 0;
 329 }
 330
 331
 332 static void send_auth_reply(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 333                             u16 auth_alg, u16 auth_transaction, u16 resp,
 334                             u8 *challenge)
 335 {
 336         u8 buf[IEEE80211_HDRLEN + sizeof(mgmt->u.auth) + 2 +
 337                WLAN_AUTH_CHALLENGE_LEN];
 338         struct ieee80211_mgmt *reply;
 339         size_t rlen;
 340
 341         memset(buf, 0, sizeof(buf));
 342         reply = (struct ieee80211_mgmt *) buf;
 343         reply->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 344                                            WLAN_FC_STYPE_AUTH);
 345         /* Request TX callback */
 346         reply->frame_control |= host_to_le16(BIT(1));
 347         memcpy(reply->da, mgmt->sa, ETH_ALEN);
 348         memcpy(reply->sa, hapd->own_addr, ETH_ALEN);
 349         memcpy(reply->bssid, mgmt->bssid, ETH_ALEN);
 350
 351         reply->u.auth.auth_alg = host_to_le16(auth_alg);
 352         reply->u.auth.auth_transaction = host_to_le16(auth_transaction);
 353         reply->u.auth.status_code = host_to_le16(resp);
 354         rlen = IEEE80211_HDRLEN + sizeof(reply->u.auth);
 355         if (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 2 &&
 356             challenge) {
 357                 u8 *p = reply->u.auth.variable;
 358                 *p++ = WLAN_EID_CHALLENGE;
 359                 *p++ = WLAN_AUTH_CHALLENGE_LEN;
 360                 memcpy(p, challenge, WLAN_AUTH_CHALLENGE_LEN);
 361                 rlen += 2 + WLAN_AUTH_CHALLENGE_LEN;
 362         } else
 363                 challenge = NULL;
 364
 365         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 366                       "authentication reply: STA=" MACSTR " auth_alg=%d "
 367                       "auth_transaction=%d resp=%d%s\n",
 368                       MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 369                       resp, challenge ? " challenge" : "");
 370         if (hostapd_send_mgmt_frame(hapd, reply, rlen, 0) < 0)
 371                 perror("send_auth_reply: send");
 372 }
 373
 374
 375 static void handle_auth(hostapd *hapd, struct ieee80211_mgmt *mgmt, size_t len)
 376 {
 377         u16 auth_alg, auth_transaction, status_code;
 378         u16 resp = WLAN_STATUS_SUCCESS;
 379         struct sta_info *sta = NULL;
 380         int res;
 381         u16 fc;
 382         u8 *challenge = NULL;
 383         u32 session_timeout, acct_interim_interval;
 384
 385         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
 386                 printf("handle_auth - too short payload (len=%lu)\n",
 387                        (unsigned long) len);
 388                 return;
 389         }
 390
 391         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 392         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
 393         status_code = le_to_host16(mgmt->u.auth.status_code);
 394         fc = le_to_host16(mgmt->frame_control);
 395
 396         if (len >= IEEE80211_HDRLEN + sizeof(mgmt->u.auth) +
 397             2 + WLAN_AUTH_CHALLENGE_LEN &&
 398             mgmt->u.auth.variable[0] == WLAN_EID_CHALLENGE &&
 399             mgmt->u.auth.variable[1] == WLAN_AUTH_CHALLENGE_LEN)
 400                 challenge = &mgmt->u.auth.variable[2];
 401
 402         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 403                       "authentication: STA=" MACSTR " auth_alg=%d "
 404                       "auth_transaction=%d status_code=%d wep=%d%s\n",
 405                       MAC2STR(mgmt->sa), auth_alg, auth_transaction,
 406                       status_code, !!(fc & WLAN_FC_ISWEP),
 407                       challenge ? " challenge" : "");
 408
 409         if (hapd->assoc_ap_state == AUTHENTICATE && auth_transaction == 2 &&
 410             memcmp(mgmt->sa, hapd->conf->assoc_ap_addr, ETH_ALEN) == 0 &&
 411             memcmp(mgmt->bssid, hapd->conf->assoc_ap_addr, ETH_ALEN) == 0) {
 412                 if (status_code != 0) {
 413                         printf("Authentication (as station) with AP "
 414                                MACSTR " failed (status_code=%d)\n",
 415                                MAC2STR(hapd->conf->assoc_ap_addr),
 416                                status_code);
 417                         return;
 418                 }
 419                 printf("Authenticated (as station) with AP " MACSTR "\n",
 420                        MAC2STR(hapd->conf->assoc_ap_addr));
 421                 ieee802_11_sta_associate(hapd, NULL);
 422                 return;
 423         }
 424
 425         if (hapd->tkip_countermeasures) {
 426                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 427                 goto fail;
 428         }
 429
 430         if (!(((hapd->conf->auth_algs & HOSTAPD_AUTH_OPEN) &&
 431                auth_alg == WLAN_AUTH_OPEN) ||
 432               ((hapd->conf->auth_algs & HOSTAPD_AUTH_SHARED_KEY) &&
 433                auth_alg == WLAN_AUTH_SHARED_KEY))) {
 434                 printf("Unsupported authentication algorithm (%d)\n",
 435                        auth_alg);
 436                 resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
 437                 goto fail;
 438         }
 439
 440         if (!(auth_transaction == 1 ||
 441               (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 3))) {
 442                 printf("Unknown authentication transaction number (%d)\n",
 443                        auth_transaction);
 444                 resp = WLAN_STATUS_UNKNOWN_AUTH_TRANSACTION;
 445                 goto fail;
 446         }
 447
 448         if (memcmp(mgmt->sa, hapd->own_addr, ETH_ALEN) == 0) {
 449                 printf("Station " MACSTR " not allowed to authenticate.\n",
 450                        MAC2STR(mgmt->sa));
 451                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 452                 goto fail;
 453         }
 454
 455         res = hostapd_allowed_address(hapd, mgmt->sa, (u8 *) mgmt, len,
 456                                       &session_timeout,
 457                                       &acct_interim_interval);
 458         if (res == HOSTAPD_ACL_REJECT) {
 459                 printf("Station " MACSTR " not allowed to authenticate.\n",
 460                        MAC2STR(mgmt->sa));
 461                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 462                 goto fail;
 463         }
 464         if (res == HOSTAPD_ACL_PENDING) {
 465                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "Authentication frame "
 466                               "from " MACSTR " waiting for an external "
 467                               "authentication\n", MAC2STR(mgmt->sa));
 468                 /* Authentication code will re-send the authentication frame
 469                  * after it has received (and cached) information from the
 470                  * external source. */
 471                 return;
 472         }
 473
 474         sta = ap_sta_add(hapd, mgmt->sa);
 475         if (!sta) {
 476                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 477                 goto fail;
 478         }
 479         sta->flags &= ~WLAN_STA_PREAUTH;
 480         ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 481
 482         if (hapd->conf->radius->acct_interim_interval == 0 &&
 483             acct_interim_interval)
 484                 sta->acct_interim_interval = acct_interim_interval;
 485         if (res == HOSTAPD_ACL_ACCEPT_TIMEOUT)
 486                 ap_sta_session_timeout(hapd, sta, session_timeout);
 487         else
 488                 ap_sta_no_session_timeout(hapd, sta);
 489
 490         switch (auth_alg) {
 491         case WLAN_AUTH_OPEN:
 492                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 493                                HOSTAPD_LEVEL_DEBUG,
 494                                "authentication OK (open system)");
 495 #ifdef IEEE80211_REQUIRE_AUTH_ACK
 496                 /* Station will be marked authenticated if it ACKs the
 497                  * authentication reply. */
 498 #else
 499                 sta->flags |= WLAN_STA_AUTH;
 500                 wpa_sm_event(hapd, sta, WPA_AUTH);
 501 #endif
 502                 break;
 503         case WLAN_AUTH_SHARED_KEY:
 504                 resp = auth_shared_key(hapd, sta, auth_transaction, challenge,
 505                                        fc & WLAN_FC_ISWEP);
 506                 break;
 507         }
 508
 509  fail:
 510         send_auth_reply(hapd, mgmt, auth_alg, auth_transaction + 1, resp,
 511                         sta ? sta->challenge : NULL);
 512 }
 513
 514
 515 static void handle_assoc(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 516                          size_t len, int reassoc)
 517 {
 518         u16 capab_info, listen_interval;
 519         u16 resp = WLAN_STATUS_SUCCESS;
 520         u8 *pos, *wpa_ie;
 521         size_t wpa_ie_len;
 522         int send_deauth = 0, send_len, left, i;
 523         struct sta_info *sta;
 524         struct ieee802_11_elems elems;
 525
 526         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
 527                                       sizeof(mgmt->u.assoc_req))) {
 528                 printf("handle_assoc(reassoc=%d) - too short payload (len=%lu)"
 529                        "\n", reassoc, (unsigned long) len);
 530                 return;
 531         }
 532
 533         if (reassoc) {
 534                 capab_info = le_to_host16(mgmt->u.reassoc_req.capab_info);
 535                 listen_interval = le_to_host16(
 536                         mgmt->u.reassoc_req.listen_interval);
 537                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 538                               "reassociation request: STA=" MACSTR
 539                               " capab_info=0x%02x "
 540                               "listen_interval=%d current_ap=" MACSTR "\n",
 541                               MAC2STR(mgmt->sa), capab_info, listen_interval,
 542                               MAC2STR(mgmt->u.reassoc_req.current_ap));
 543                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.reassoc_req));
 544                 pos = mgmt->u.reassoc_req.variable;
 545         } else {
 546                 capab_info = le_to_host16(mgmt->u.assoc_req.capab_info);
 547                 listen_interval = le_to_host16(
 548                         mgmt->u.assoc_req.listen_interval);
 549                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 550                               "association request: STA=" MACSTR
 551                               " capab_info=0x%02x listen_interval=%d\n",
 552                               MAC2STR(mgmt->sa), capab_info, listen_interval);
 553                 left = len - (IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_req));
 554                 pos = mgmt->u.assoc_req.variable;
 555         }
 556
 557         sta = ap_get_sta(hapd, mgmt->sa);
 558         if (sta == NULL || (sta->flags & WLAN_STA_AUTH) == 0) {
 559                 printf("STA " MACSTR " trying to associate before "
 560                        "authentication\n", MAC2STR(mgmt->sa));
 561                 if (sta) {
 562                         printf("  sta: addr=" MACSTR " aid=%d flags=0x%04x\n",
 563                                MAC2STR(sta->addr), sta->aid, sta->flags);
 564                 }
 565                 send_deauth = 1;
 566                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 567                 goto fail;
 568         }
 569
 570         if (hapd->tkip_countermeasures) {
 571                 resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 572                 goto fail;
 573         }
 574
 575         sta->capability = capab_info;
 576
 577         /* followed by SSID and Supported rates */
 578         if (ieee802_11_parse_elems(hapd, pos, left, &elems, 1) == ParseFailed
 579             || !elems.ssid) {
 580                 printf("STA " MACSTR " sent invalid association request\n",
 581                        MAC2STR(sta->addr));
 582                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 583                 goto fail;
 584         }
 585
 586         if (elems.ssid_len != hapd->conf->ssid_len ||
 587             memcmp(elems.ssid, hapd->conf->ssid, elems.ssid_len) != 0) {
 588                 printf("Station " MACSTR " tried to associate with "
 589                        "unknown SSID '", MAC2STR(sta->addr));
 590                 ieee802_11_print_ssid(elems.ssid, elems.ssid_len);
 591                 printf("'\n");
 592                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 593                 goto fail;
 594         }
 595
 596         if (elems.supp_rates) {
 597                 if (elems.supp_rates_len > sizeof(sta->supported_rates)) {
 598                         printf("STA " MACSTR ": Invalid supported rates "
 599                                "element length %d\n", MAC2STR(sta->addr),
 600                                elems.supp_rates_len);
 601                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 602                         goto fail;
 603                 }
 604
 605                 memset(sta->supported_rates, 0, sizeof(sta->supported_rates));
 606                 memcpy(sta->supported_rates, elems.supp_rates,
 607                        elems.supp_rates_len);
 608
 609                 sta->tx_supp_rates = 0;
 610                 for (i = 0; i < elems.supp_rates_len; i++) {
 611                         if ((sta->supported_rates[i] & 0x7f) == 2)
 612                                 sta->tx_supp_rates |= WLAN_RATE_1M;
 613                         if ((sta->supported_rates[i] & 0x7f) == 4)
 614                                 sta->tx_supp_rates |= WLAN_RATE_2M;
 615                         if ((sta->supported_rates[i] & 0x7f) == 11)
 616                                 sta->tx_supp_rates |= WLAN_RATE_5M5;
 617                         if ((sta->supported_rates[i] & 0x7f) == 22)
 618                                 sta->tx_supp_rates |= WLAN_RATE_11M;
 619                 }
 620         } else
 621                 sta->tx_supp_rates = 0xff;
 622
 623         if ((hapd->conf->wpa & HOSTAPD_WPA_VERSION_WPA2) && elems.rsn_ie) {
 624                 wpa_ie = elems.rsn_ie;
 625                 wpa_ie_len = elems.rsn_ie_len;
 626         } else if ((hapd->conf->wpa & HOSTAPD_WPA_VERSION_WPA) &&
 627                    elems.wpa_ie) {
 628                 wpa_ie = elems.wpa_ie;
 629                 wpa_ie_len = elems.wpa_ie_len;
 630         } else {
 631                 wpa_ie = NULL;
 632                 wpa_ie_len = 0;
 633         }
 634         if (hapd->conf->wpa && wpa_ie == NULL) {
 635                 printf("STA " MACSTR ": No WPA/RSN IE in association "
 636                        "request\n", MAC2STR(sta->addr));
 637                 resp = WLAN_STATUS_INVALID_IE;
 638                 goto fail;
 639         }
 640
 641         if (hapd->conf->wpa) {
 642                 int res;
 643                 wpa_ie -= 2;
 644                 wpa_ie_len += 2;
 645                 res = wpa_validate_wpa_ie(hapd, sta, wpa_ie, wpa_ie_len,
 646                                           elems.rsn_ie ?
 647                                           HOSTAPD_WPA_VERSION_WPA2 :
 648                                           HOSTAPD_WPA_VERSION_WPA);
 649                 if (res == WPA_INVALID_GROUP)
 650                         resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 651                 else if (res == WPA_INVALID_PAIRWISE)
 652                         resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 653                 else if (res == WPA_INVALID_AKMP)
 654                         resp = WLAN_STATUS_AKMP_NOT_VALID;
 655                 else if (res != WPA_IE_OK)
 656                         resp = WLAN_STATUS_INVALID_IE;
 657                 if (resp != WLAN_STATUS_SUCCESS)
 658                         goto fail;
 659                 free(sta->wpa_ie);
 660                 sta->wpa_ie = malloc(wpa_ie_len);
 661                 if (sta->wpa_ie == NULL) {
 662                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 663                         goto fail;
 664                 }
 665                 sta->wpa_ie_len = wpa_ie_len;
 666                 memcpy(sta->wpa_ie, wpa_ie, wpa_ie_len);
 667         }
 668
 669         /* get a unique AID */
 670         if (sta->aid > 0) {
 671                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 672                               "  old AID %d\n", sta->aid);
 673         } else {
 674                 for (sta->aid = 1; sta->aid <= MAX_AID_TABLE_SIZE; sta->aid++)
 675                         if (hapd->sta_aid[sta->aid - 1] == NULL)
 676                                 break;
 677                 if (sta->aid > MAX_AID_TABLE_SIZE) {
 678                         sta->aid = 0;
 679                         resp = WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA;
 680                         printf("  no room for more AIDs\n");
 681                         goto fail;
 682                 } else {
 683                         hapd->sta_aid[sta->aid - 1] = sta;
 684                         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 685                                       "  new AID %d\n", sta->aid);
 686                 }
 687         }
 688
 689         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 690                        HOSTAPD_LEVEL_DEBUG,
 691                        "association OK (aid %d)", sta->aid);
 692         /* Station will be marked associated, after it acknowledges AssocResp
 693          */
 694
 695         if (sta->last_assoc_req)
 696                 free(sta->last_assoc_req);
 697         sta->last_assoc_req = (struct ieee80211_mgmt *) malloc(len);
 698         if (sta->last_assoc_req)
 699                 memcpy(sta->last_assoc_req, mgmt, len);
 700
 701         /* Make sure that the previously registered inactivity timer will not
 702          * remove the STA immediately. */
 703         sta->timeout_next = STA_NULLFUNC;
 704
 705  fail:
 706
 707         /* use the queued buffer for transmission because it is large enough
 708          * and not needed anymore */
 709         mgmt->frame_control =
 710                 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
 711                              (send_deauth ? WLAN_FC_STYPE_DEAUTH :
 712                               (reassoc ? WLAN_FC_STYPE_REASSOC_RESP :
 713                                WLAN_FC_STYPE_ASSOC_RESP)));
 714         memcpy(mgmt->da, mgmt->sa, ETH_ALEN);
 715         memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
 716         /* Addr3 = BSSID - already set */
 717
 718         send_len = IEEE80211_HDRLEN;
 719         if (send_deauth) {
 720                 send_len += sizeof(mgmt->u.deauth);
 721                 mgmt->u.deauth.reason_code = host_to_le16(resp);
 722         } else {
 723                 u8 *p;
 724                 send_len += sizeof(mgmt->u.assoc_resp);
 725                 mgmt->u.assoc_resp.capab_info =
 726                         host_to_le16(hostapd_own_capab_info(hapd));
 727                 mgmt->u.assoc_resp.status_code = host_to_le16(resp);
 728                 mgmt->u.assoc_resp.aid = host_to_le16((sta ? sta->aid : 0)
 729                                                       | BIT(14) | BIT(15));
 730                 /* Supported rates */
 731                 p = hostapd_eid_supp_rates(hapd, mgmt->u.assoc_resp.variable);
 732                 send_len += p - mgmt->u.assoc_resp.variable;
 733
 734                 /* Request TX callback */
 735                 mgmt->frame_control |= host_to_le16(BIT(1));
 736         }
 737
 738         if (hostapd_send_mgmt_frame(hapd, mgmt, send_len, 0) < 0)
 739                 perror("handle_assoc: send");
 740 }
 741
 742
 743 static void handle_assoc_resp(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 744                               size_t len)
 745 {
 746         u16 status_code, aid;
 747
 748         if (hapd->assoc_ap_state != ASSOCIATE) {
 749                 printf("Unexpected association response received from " MACSTR
 750                        "\n", MAC2STR(mgmt->sa));
 751                 return;
 752         }
 753
 754         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.assoc_resp)) {
 755                 printf("handle_assoc_resp - too short payload (len=%lu)\n",
 756                        (unsigned long) len);
 757                 return;
 758         }
 759
 760         if (memcmp(mgmt->sa, hapd->conf->assoc_ap_addr, ETH_ALEN) != 0 ||
 761             memcmp(mgmt->bssid, hapd->conf->assoc_ap_addr, ETH_ALEN) != 0) {
 762                 printf("Received association response from unexpected address "
 763                        "(SA=" MACSTR " BSSID=" MACSTR "\n",
 764                        MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
 765                 return;
 766         }
 767
 768         status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
 769         aid = le_to_host16(mgmt->u.assoc_resp.aid);
 770         aid &= ~(BIT(14) | BIT(15));
 771
 772         if (status_code != 0) {
 773                 printf("Association (as station) with AP " MACSTR " failed "
 774                        "(status_code=%d)\n",
 775                        MAC2STR(hapd->conf->assoc_ap_addr), status_code);
 776                 /* Try to authenticate again */
 777                 hapd->assoc_ap_state = AUTHENTICATE;
 778                 eloop_register_timeout(5, 0, ieee802_11_sta_authenticate,
 779                                        hapd, NULL);
 780         }
 781
 782         printf("Associated (as station) with AP " MACSTR " (aid=%d)\n",
 783                MAC2STR(hapd->conf->assoc_ap_addr), aid);
 784         hapd->assoc_ap_aid = aid;
 785         hapd->assoc_ap_state = ASSOCIATED;
 786
 787         if (hostapd_set_assoc_ap(hapd, hapd->conf->assoc_ap_addr)) {
 788                 printf("Could not set associated AP address to kernel "
 789                        "driver.\n");
 790         }
 791 }
 792
 793
 794 static void handle_disassoc(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 795                             size_t len)
 796 {
 797         struct sta_info *sta;
 798
 799         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.disassoc)) {
 800                 printf("handle_disassoc - too short payload (len=%lu)\n",
 801                        (unsigned long) len);
 802                 return;
 803         }
 804
 805         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 806                       "disassocation: STA=" MACSTR " reason_code=%d\n",
 807                       MAC2STR(mgmt->sa),
 808                       le_to_host16(mgmt->u.disassoc.reason_code));
 809
 810         if (hapd->assoc_ap_state != DO_NOT_ASSOC &&
 811             memcmp(mgmt->sa, hapd->conf->assoc_ap_addr, ETH_ALEN) == 0) {
 812                 printf("Assoc AP " MACSTR " sent disassociation "
 813                        "(reason_code=%d) - try to authenticate\n",
 814                        MAC2STR(hapd->conf->assoc_ap_addr),
 815                        le_to_host16(mgmt->u.disassoc.reason_code));
 816                 hapd->assoc_ap_state = AUTHENTICATE;
 817                 ieee802_11_sta_authenticate(hapd, NULL);
 818                 eloop_register_timeout(0, 500000, ieee802_11_sta_authenticate,
 819                                        hapd, NULL);
 820                 return;
 821         }
 822
 823         sta = ap_get_sta(hapd, mgmt->sa);
 824         if (sta == NULL) {
 825                 printf("Station " MACSTR " trying to disassociate, but it "
 826                        "is not associated.\n", MAC2STR(mgmt->sa));
 827                 return;
 828         }
 829
 830         sta->flags &= ~WLAN_STA_ASSOC;
 831         wpa_sm_event(hapd, sta, WPA_DISASSOC);
 832         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 833                        HOSTAPD_LEVEL_INFO, "disassociated");
 834         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 835         ieee802_1x_set_port_enabled(hapd, sta, 0);
 836         /* Stop Accounting and IEEE 802.1X sessions, but leave the STA
 837          * authenticated. */
 838         accounting_sta_stop(hapd, sta);
 839         ieee802_1x_free_station(sta);
 840         hostapd_sta_remove(hapd, sta->addr);
 841
 842         if (sta->timeout_next == STA_NULLFUNC ||
 843             sta->timeout_next == STA_DISASSOC) {
 844                 sta->timeout_next = STA_DEAUTH;
 845                 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
 846                 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
 847                                        hapd, sta);
 848         }
 849 }
 850
 851
 852 static void handle_deauth(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 853                           size_t len)
 854 {
 855         struct sta_info *sta;
 856
 857         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.deauth)) {
 858                 printf("handle_deauth - too short payload (len=%lu)\n",
 859                        (unsigned long) len);
 860                 return;
 861         }
 862
 863         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
 864                       "deauthentication: STA=" MACSTR " reason_code=%d\n",
 865                       MAC2STR(mgmt->sa),
 866                       le_to_host16(mgmt->u.deauth.reason_code));
 867
 868         if (hapd->assoc_ap_state != DO_NOT_ASSOC &&
 869             memcmp(mgmt->sa, hapd->conf->assoc_ap_addr, ETH_ALEN) == 0) {
 870                 printf("Assoc AP " MACSTR " sent deauthentication "
 871                        "(reason_code=%d) - try to authenticate\n",
 872                        MAC2STR(hapd->conf->assoc_ap_addr),
 873                        le_to_host16(mgmt->u.deauth.reason_code));
 874                 hapd->assoc_ap_state = AUTHENTICATE;
 875                 eloop_register_timeout(0, 500000, ieee802_11_sta_authenticate,
 876                                        hapd, NULL);
 877                 return;
 878         }
 879
 880         sta = ap_get_sta(hapd, mgmt->sa);
 881         if (sta == NULL) {
 882                 printf("Station " MACSTR " trying to deauthenticate, but it "
 883                        "is not authenticated.\n", MAC2STR(mgmt->sa));
 884                 return;
 885         }
 886
 887         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 888         wpa_sm_event(hapd, sta, WPA_DEAUTH);
 889         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
 890                        HOSTAPD_LEVEL_DEBUG, "deauthenticated");
 891         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 892         ieee802_1x_set_port_enabled(hapd, sta, 0);
 893         ap_free_sta(hapd, sta);
 894 }
 895
 896
 897 static void handle_beacon(hostapd *hapd, struct ieee80211_mgmt *mgmt,
 898                           size_t len)
 899 {
 900         struct ieee802_11_elems elems;
 901
 902         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.beacon)) {
 903                 printf("handle_beacon - too short payload (len=%lu)\n",
 904                        (unsigned long) len);
 905                 return;
 906         }
 907
 908         (void) ieee802_11_parse_elems(hapd, mgmt->u.beacon.variable,
 909                                       len - (IEEE80211_HDRLEN +
 910                                              sizeof(mgmt->u.beacon)), &elems,
 911                                       0);
 912
 913         if (hapd->assoc_ap_state == WAIT_BEACON &&
 914             memcmp(mgmt->sa, hapd->conf->assoc_ap_addr, ETH_ALEN) == 0) {
 915                 if (elems.ssid && elems.ssid_len <= 32) {
 916                         memcpy(hapd->assoc_ap_ssid, elems.ssid,
 917                                elems.ssid_len);
 918                         hapd->assoc_ap_ssid[elems.ssid_len] = '\0';
 919                         hapd->assoc_ap_ssid_len = elems.ssid_len;
 920                 }
 921                 ieee802_11_sta_authenticate(hapd, NULL);
 922         }
 923
 924         if (!HOSTAPD_DEBUG_COND(HOSTAPD_DEBUG_EXCESSIVE))
 925                 return;
 926
 927         printf("Beacon from " MACSTR, MAC2STR(mgmt->sa));
 928         if (elems.ssid) {
 929                 printf(" SSID='");
 930                 ieee802_11_print_ssid(elems.ssid, elems.ssid_len);
 931                 printf("'");
 932         }
 933         if (elems.ds_params && elems.ds_params_len == 1)
 934                 printf(" CHAN=%d", elems.ds_params[0]);
 935         printf("\n");
 936 }
 937
 938
 939 void ieee802_11_mgmt(struct hostapd_data *hapd, u8 *buf, size_t len, u16 stype)
 940 {
 941         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) buf;
 942
 943         if (stype == WLAN_FC_STYPE_BEACON) {
 944                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_EXCESSIVE, "mgmt::beacon\n");
 945                 handle_beacon(hapd, mgmt, len);
 946                 return;
 947         }
 948
 949         if (memcmp(mgmt->bssid, hapd->own_addr, ETH_ALEN) != 0 &&
 950             (hapd->assoc_ap_state == DO_NOT_ASSOC ||
 951              memcmp(mgmt->bssid, hapd->conf->assoc_ap_addr, ETH_ALEN) != 0)) {
 952                 printf("MGMT: BSSID=" MACSTR " not our address\n",
 953                        MAC2STR(mgmt->bssid));
 954                 return;
 955         }
 956
 957
 958         if (stype == WLAN_FC_STYPE_PROBE_REQ) {
 959                 printf("mgmt::probe_req\n");
 960                 return;
 961         }
 962
 963         if (memcmp(mgmt->da, hapd->own_addr, ETH_ALEN) != 0) {
 964                 printf("MGMT: DA=" MACSTR " not our address\n",
 965                        MAC2STR(mgmt->da));
 966                 return;
 967         }
 968
 969         switch (stype) {
 970         case WLAN_FC_STYPE_AUTH:
 971                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::auth\n");
 972                 handle_auth(hapd, mgmt, len);
 973                 break;
 974         case WLAN_FC_STYPE_ASSOC_REQ:
 975                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::assoc_req\n");
 976                 handle_assoc(hapd, mgmt, len, 0);
 977                 break;
 978         case WLAN_FC_STYPE_ASSOC_RESP:
 979                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::assoc_resp\n");
 980                 handle_assoc_resp(hapd, mgmt, len);
 981                 break;
 982         case WLAN_FC_STYPE_REASSOC_REQ:
 983                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::reassoc_req\n");
 984                 handle_assoc(hapd, mgmt, len, 1);
 985                 break;
 986         case WLAN_FC_STYPE_DISASSOC:
 987                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::disassoc\n");
 988                 handle_disassoc(hapd, mgmt, len);
 989                 break;
 990         case WLAN_FC_STYPE_DEAUTH:
 991                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::deauth\n");
 992                 handle_deauth(hapd, mgmt, len);
 993                 break;
 994         default:
 995                 printf("unknown mgmt frame subtype %d\n", stype);
 996                 break;
 997         }
 998 }
 999
1000
1001 static void handle_auth_cb(hostapd *hapd, struct ieee80211_mgmt *mgmt,
1002                            size_t len, int ok)
1003 {
1004         u16 auth_alg, auth_transaction, status_code;
1005         struct sta_info *sta;
1006
1007         if (!ok) {
1008                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1009                                HOSTAPD_LEVEL_NOTICE,
1010                                "did not acknowledge authentication response");
1011                 return;
1012         }
1013
1014         if (len < IEEE80211_HDRLEN + sizeof(mgmt->u.auth)) {
1015                 printf("handle_auth_cb - too short payload (len=%lu)\n",
1016                        (unsigned long) len);
1017                 return;
1018         }
1019
1020         auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
1021         auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
1022         status_code = le_to_host16(mgmt->u.auth.status_code);
1023
1024         sta = ap_get_sta(hapd, mgmt->da);
1025         if (!sta) {
1026                 printf("handle_auth_cb: STA " MACSTR " not found\n",
1027                        MAC2STR(mgmt->da));
1028                 return;
1029         }
1030
1031         if (status_code == WLAN_STATUS_SUCCESS &&
1032             ((auth_alg == WLAN_AUTH_OPEN && auth_transaction == 2) ||
1033              (auth_alg == WLAN_AUTH_SHARED_KEY && auth_transaction == 4))) {
1034                 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1035                                HOSTAPD_LEVEL_INFO, "authenticated");
1036                 sta->flags |= WLAN_STA_AUTH;
1037         }
1038 }
1039
1040
1041 static void handle_assoc_cb(hostapd *hapd, struct ieee80211_mgmt *mgmt,
1042                             size_t len, int reassoc, int ok)
1043 {
1044         u16 status;
1045         struct sta_info *sta;
1046         int new_assoc = 1;
1047
1048         if (!ok) {
1049                 hostapd_logger(hapd, mgmt->da, HOSTAPD_MODULE_IEEE80211,
1050                                HOSTAPD_LEVEL_DEBUG,
1051                                "did not acknowledge association response");
1052                 return;
1053         }
1054
1055         if (len < IEEE80211_HDRLEN + (reassoc ? sizeof(mgmt->u.reassoc_req) :
1056                                       sizeof(mgmt->u.assoc_req))) {
1057                 printf("handle_assoc_cb(reassoc=%d) - too short payload "
1058                        "(len=%lu)\n", reassoc, (unsigned long) len);
1059                 return;
1060         }
1061
1062         if (reassoc)
1063                 status = le_to_host16(mgmt->u.reassoc_resp.status_code);
1064         else
1065                 status = le_to_host16(mgmt->u.assoc_resp.status_code);
1066
1067         sta = ap_get_sta(hapd, mgmt->da);
1068         if (!sta) {
1069                 printf("handle_assoc_cb: STA " MACSTR " not found\n",
1070                        MAC2STR(mgmt->da));
1071                 return;
1072         }
1073
1074         if (status != WLAN_STATUS_SUCCESS)
1075                 goto fail;
1076
1077         /* Stop previous accounting session, if one is started, and allocate
1078          * new session id for the new session. */
1079         accounting_sta_stop(hapd, sta);
1080         accounting_sta_get_id(hapd, sta);
1081
1082         hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1083                        HOSTAPD_LEVEL_INFO,
1084                        "associated (aid %d, accounting session %08X-%08X)",
1085                        sta->aid, sta->acct_session_id_hi,
1086                        sta->acct_session_id_lo);
1087
1088         if (sta->flags & WLAN_STA_ASSOC)
1089                 new_assoc = 0;
1090         sta->flags |= WLAN_STA_ASSOC;
1091
1092         if (hostapd_sta_add(hapd, sta->addr, sta->aid, sta->capability,
1093                             sta->tx_supp_rates)) {
1094                 printf("Could not add station to kernel driver.\n");
1095         }
1096
1097         wpa_sm_event(hapd, sta, WPA_ASSOC);
1098         hostapd_new_assoc_sta(hapd, sta, !new_assoc);
1099
1100         ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
1101
1102  fail:
1103         /* Copy of the association request is not needed anymore */
1104         if (sta->last_assoc_req) {
1105                 free(sta->last_assoc_req);
1106                 sta->last_assoc_req = NULL;
1107         }
1108 }
1109
1110
1111 void ieee802_11_mgmt_cb(struct hostapd_data *hapd, u8 *buf, size_t len,
1112                         u16 stype, int ok)
1113 {
1114         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *) buf;
1115
1116         switch (stype) {
1117         case WLAN_FC_STYPE_AUTH:
1118                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL, "mgmt::auth cb\n");
1119                 handle_auth_cb(hapd, mgmt, len, ok);
1120                 break;
1121         case WLAN_FC_STYPE_ASSOC_RESP:
1122                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1123                               "mgmt::assoc_resp cb\n");
1124                 handle_assoc_cb(hapd, mgmt, len, 0, ok);
1125                 break;
1126         case WLAN_FC_STYPE_REASSOC_RESP:
1127                 HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1128                               "mgmt::reassoc_resp cb\n");
1129                 handle_assoc_cb(hapd, mgmt, len, 1, ok);
1130                 break;
1131         default:
1132                 printf("unknown mgmt cb frame subtype %d\n", stype);
1133                 break;
1134         }
1135 }
1136
1137
1138 static void ieee80211_tkip_countermeasures_stop(void *eloop_ctx,
1139                                                 void *timeout_ctx)
1140 {
1141         struct hostapd_data *hapd = eloop_ctx;
1142         hapd->tkip_countermeasures = 0;
1143         hostapd_set_countermeasures(hapd, 0);
1144         hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
1145                        HOSTAPD_LEVEL_INFO, "TKIP countermeasures ended");
1146 }
1147
1148
1149 static void ieee80211_tkip_countermeasures_start(struct hostapd_data *hapd)
1150 {
1151         struct sta_info *sta;
1152
1153         hostapd_logger(hapd, NULL, HOSTAPD_MODULE_IEEE80211,
1154                        HOSTAPD_LEVEL_INFO, "TKIP countermeasures initiated");
1155
1156         if (hapd->wpa_auth)
1157                 hapd->wpa_auth->dot11RSNATKIPCounterMeasuresInvoked++;
1158         hapd->tkip_countermeasures = 1;
1159         hostapd_set_countermeasures(hapd, 1);
1160         wpa_gtk_rekey(hapd);
1161         eloop_cancel_timeout(ieee80211_tkip_countermeasures_stop, hapd, NULL);
1162         eloop_register_timeout(60, 0, ieee80211_tkip_countermeasures_stop,
1163                                hapd, NULL);
1164         for (sta = hapd->sta_list; sta != NULL; sta = sta->next) {
1165                 hostapd_sta_deauth(hapd, sta->addr,
1166                                    WLAN_REASON_MICHAEL_MIC_FAILURE);
1167                 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
1168                                 WLAN_STA_AUTHORIZED);
1169                 hostapd_sta_remove(hapd, sta->addr);
1170         }
1171 }
1172
1173
1174 void ieee80211_michael_mic_failure(struct hostapd_data *hapd, u8 *addr,
1175                                    int local)
1176 {
1177         time_t now;
1178
1179         if (addr && local) {
1180                 struct sta_info *sta = ap_get_sta(hapd, addr);
1181                 if (sta != NULL) {
1182                         sta->dot11RSNAStatsTKIPLocalMICFailures++;
1183                         hostapd_logger(hapd, addr, HOSTAPD_MODULE_IEEE80211,
1184                                        HOSTAPD_LEVEL_INFO,
1185                                        "Michael MIC failure detected in "
1186                                        "received frame");
1187                 } else {
1188                         HOSTAPD_DEBUG(HOSTAPD_DEBUG_MINIMAL,
1189                                       "MLME-MICHAELMICFAILURE.indication "
1190                                       "for not associated STA (" MACSTR
1191                                       ") ignored\n", MAC2STR(addr));
1192                         return;
1193                 }
1194         }
1195
1196         time(&now);
1197         if (now > hapd->michael_mic_failure + 60) {
1198                 hapd->michael_mic_failures = 1;
1199         } else {
1200                 hapd->michael_mic_failures++;
1201                 if (hapd->michael_mic_failures > 1)
1202                         ieee80211_tkip_countermeasures_start(hapd);
1203         }
1204         hapd->michael_mic_failure = now;
1205 }
1206
1207
1208 int ieee802_11_get_mib(struct hostapd_data *hapd, char *buf, size_t buflen)
1209 {
1210         /* TODO */
1211         return 0;
1212 }
1213
1214
1215 int ieee802_11_get_mib_sta(struct hostapd_data *hapd, struct sta_info *sta,
1216                            char *buf, size_t buflen)
1217 {
1218         /* TODO */
1219         return 0;
1220 }