contrib/hostapd/hostapd/driver_prism54.c

   1 /*
   2  * hostapd / Driver interaction with Prism54 PIMFOR interface
   3  * Copyright (c) 2004, Bell Kin <bell_kin@pek.com.tw>
   4  * based on hostap driver.c, ieee802_11.c
   5  * Copyright (c) 2002-2007, Jouni Malinen <j@w1.fi>
   6  *
   7  * This program is free software; you can redistribute it and/or modify
   8  * it under the terms of the GNU General Public License version 2 as
   9  * published by the Free Software Foundation.
  10  *
  11  * Alternatively, this software may be distributed under the terms of BSD
  12  * license.
  13  *
  14  * See README and COPYING for more details.
  15  */
  16
  17 #include "includes.h"
  18 #include <sys/ioctl.h>
  19 #include <sys/select.h>
  20
  21 #ifdef USE_KERNEL_HEADERS
  22 /* compat-wireless does not include linux/compiler.h to define __user, so
  23  * define it here */
  24 #ifndef __user
  25 #define __user
  26 #endif /* __user */
  27 #include <asm/types.h>
  28 #include <linux/if_packet.h>
  29 #include <linux/if_ether.h>   /* The L2 protocols */
  30 #include <linux/if_arp.h>
  31 #include <linux/wireless.h>
  32 #else /* USE_KERNEL_HEADERS */
  33 #include <net/if_arp.h>
  34 #include <netpacket/packet.h>
  35 #include "wireless_copy.h"
  36 #endif /* USE_KERNEL_HEADERS */
  37
  38 #include "hostapd.h"
  39 #include "driver.h"
  40 #include "ieee802_1x.h"
  41 #include "eloop.h"
  42 #include "ieee802_11.h"
  43 #include "prism54.h"
  44 #include "wpa.h"
  45 #include "radius/radius.h"
  46 #include "sta_info.h"
  47 #include "accounting.h"
  48
  49 const int PIM_BUF_SIZE = 4096;
  50
  51 struct prism54_driver_data {
  52         struct hostapd_data *hapd;
  53         char iface[IFNAMSIZ + 1];
  54         int sock; /* raw packet socket for 802.3 access */
  55         int pim_sock; /* socket for pimfor packet */
  56         char macs[2007][6];
  57 };
  58
  59
  60 static int mac_id_refresh(struct prism54_driver_data *data, int id, char *mac)
  61 {
  62         if (id < 0 || id > 2006) {
  63                 return -1;
  64         }
  65         memcpy(&data->macs[id][0], mac, ETH_ALEN);
  66         return 0;
  67 }
  68
  69
  70 static char * mac_id_get(struct prism54_driver_data *data, int id)
  71 {
  72         if (id < 0 || id > 2006) {
  73                 return NULL;
  74         }
  75         return &data->macs[id][0];
  76 }
  77
  78
  79 /* wait for a specific pimfor, timeout in 10ms resolution */
  80 /* pim_sock must be non-block to prevent dead lock from no response */
  81 /* or same response type in series */
  82 static int prism54_waitpim(void *priv, unsigned long oid, void *buf, int len,
  83                            int timeout)
  84 {
  85         struct prism54_driver_data *drv = priv;
  86         struct timeval tv, stv, ctv;
  87         fd_set pfd;
  88         int rlen;
  89         pimdev_hdr *pkt;
  90
  91         pkt = malloc(8192);
  92         if (pkt == NULL)
  93                 return -1;
  94
  95         FD_ZERO(&pfd);
  96         gettimeofday(&stv, NULL);
  97         do {
  98                 FD_SET(drv->pim_sock, &pfd);
  99                 tv.tv_sec = 0;
 100                 tv.tv_usec = 10000;
 101                 if (select(drv->pim_sock + 1, &pfd, NULL, NULL, &tv)) {
 102                         rlen = recv(drv->pim_sock, pkt, 8192, 0);
 103                         if (rlen > 0) {
 104                                 if (pkt->oid == htonl(oid)) {
 105                                         if (rlen <= len) {
 106                                                 if (buf != NULL) {
 107                                                         memcpy(buf, pkt, rlen);
 108                                                 }
 109                                                 free(pkt);
 110                                                 return rlen;
 111                                         } else {
 112                                                 printf("buffer too small\n");
 113                                                 free(pkt);
 114                                                 return -1;
 115                                         }
 116                                 } else {
 117                                         gettimeofday(&ctv, NULL);
 118                                         continue;
 119                                 }
 120                         }
 121                 }
 122                 gettimeofday(&ctv, NULL);
 123         } while (((ctv.tv_sec - stv.tv_sec) * 100 +
 124                   (ctv.tv_usec - stv.tv_usec) / 10000) > timeout);
 125         free(pkt);
 126         return 0;
 127 }
 128
 129
 130 /* send an eapol packet */
 131 static int prism54_send_eapol(void *priv, const u8 *addr,
 132                               const u8 *data, size_t data_len, int encrypt,
 133                               const u8 *own_addr)
 134 {
 135         struct prism54_driver_data *drv = priv;
 136         ieee802_3_hdr *hdr;
 137         size_t len;
 138         u8 *pos;
 139         int res;
 140
 141         len = sizeof(*hdr) + data_len;
 142         hdr = os_zalloc(len);
 143         if (hdr == NULL) {
 144                 printf("malloc() failed for prism54_send_data(len=%lu)\n",
 145                        (unsigned long) len);
 146                 return -1;
 147         }
 148
 149         memcpy(&hdr->da[0], addr, ETH_ALEN);
 150         memcpy(&hdr->sa[0], own_addr, ETH_ALEN);
 151         hdr->type = htons(ETH_P_PAE);
 152         pos = (u8 *) (hdr + 1);
 153         memcpy(pos, data, data_len);
 154
 155         res = send(drv->sock, hdr, len, 0);
 156         free(hdr);
 157
 158         if (res < 0) {
 159                 perror("hostapd_send_eapol: send");
 160                 printf("hostapd_send_eapol - packet len: %lu - failed\n",
 161                        (unsigned long) len);
 162         }
 163
 164         return res;
 165 }
 166
 167
 168 /* open data channel(auth-1) or eapol only(unauth-0) */
 169 static int prism54_set_sta_authorized(void *priv, const u8 *addr,
 170                                       int authorized)
 171 {
 172         struct prism54_driver_data *drv = priv;
 173         pimdev_hdr *hdr;
 174         char *pos;
 175
 176         hdr = malloc(sizeof(*hdr) + ETH_ALEN);
 177         if (hdr == NULL)
 178                 return -1;
 179         hdr->op = htonl(PIMOP_SET);
 180         if (authorized) {
 181                 hdr->oid = htonl(DOT11_OID_EAPAUTHSTA);
 182         } else {
 183                 hdr->oid = htonl(DOT11_OID_EAPUNAUTHSTA);
 184         }
 185         pos = (char *) (hdr + 1);
 186         memcpy(pos, addr, ETH_ALEN);
 187         send(drv->pim_sock, hdr, sizeof(*hdr) + ETH_ALEN, 0);
 188         prism54_waitpim(priv, hdr->oid, hdr, sizeof(*hdr) + ETH_ALEN, 10);
 189         free(hdr);
 190         return 0;
 191 }
 192
 193
 194 static int
 195 prism54_sta_set_flags(void *priv, const u8 *addr, int total_flags,
 196                       int flags_or, int flags_and)
 197 {
 198         /* For now, only support setting Authorized flag */
 199         if (flags_or & WLAN_STA_AUTHORIZED)
 200                 return prism54_set_sta_authorized(priv, addr, 1);
 201         if (flags_and & WLAN_STA_AUTHORIZED)
 202                 return prism54_set_sta_authorized(priv, addr, 0);
 203         return 0;
 204 }
 205
 206
 207 /* set per station key */
 208 static int prism54_set_encryption(const char *ifname, void *priv,
 209                                   const char *alg, const u8 *addr,
 210                                   int idx, const u8 *key, size_t key_len,
 211                                   int txkey)
 212 {
 213         struct prism54_driver_data *drv = priv;
 214         pimdev_hdr *hdr;
 215         struct obj_stakey *keys;
 216         u8 *buf;
 217         size_t blen;
 218         int ret = 0;
 219
 220         blen = sizeof(struct obj_stakey) + sizeof(pimdev_hdr);
 221         hdr = malloc(blen);
 222         if (hdr == NULL) {
 223                 printf("memory low\n");
 224                 return -1;
 225         }
 226         keys = (struct obj_stakey *) &hdr[1];
 227         if (!addr) {
 228                 memset(&keys->address[0], 0xff, ETH_ALEN);
 229         } else {
 230                 memcpy(&keys->address[0], addr, ETH_ALEN);
 231         }
 232         if (!strcmp(alg, "WEP")) {
 233                 keys->type = DOT11_PRIV_WEP;
 234         } else if (!strcmp(alg, "TKIP")) {
 235                 keys->type = DOT11_PRIV_TKIP;
 236         } else if (!strcmp(alg, "none")) {
 237                 /* the only way to clear the key is to deauth it */
 238                 /* and prism54 is capable to receive unencrypted packet */
 239                 /* so we do nothing here */
 240                 free(hdr);
 241                 return 0;
 242         } else {
 243                 printf("bad auth type: %s\n", alg);
 244         }
 245         buf = (u8 *) &keys->key[0];
 246         keys->length = key_len;
 247         keys->keyid = idx;
 248         keys->options = htons(DOT11_STAKEY_OPTION_DEFAULTKEY);
 249         keys->reserved = 0;
 250
 251         hdr->op = htonl(PIMOP_SET);
 252         hdr->oid = htonl(DOT11_OID_STAKEY);
 253
 254         memcpy(buf, key, key_len);
 255
 256         ret = send(drv->pim_sock, hdr, blen, 0);
 257         if (ret < 0) {
 258                 free(hdr);
 259                 return ret;
 260         }
 261         prism54_waitpim(priv, hdr->oid, hdr, blen, 10);
 262
 263         free(hdr);
 264
 265         return 0;
 266 }
 267
 268
 269 /* get TKIP station sequence counter, prism54 is only 6 bytes */
 270 static int prism54_get_seqnum(const char *ifname, void *priv, const u8 *addr,
 271                               int idx, u8 *seq)
 272 {
 273         struct prism54_driver_data *drv = priv;
 274         struct obj_stasc *stasc;
 275         pimdev_hdr *hdr;
 276         size_t blen;
 277         int ret = 0;
 278
 279         blen = sizeof(*stasc) + sizeof(*hdr);
 280         hdr = malloc(blen);
 281         if (hdr == NULL)
 282                 return -1;
 283
 284         stasc = (struct obj_stasc *) &hdr[1];
 285
 286         if (addr == NULL)
 287                 memset(&stasc->address[0], 0xff, ETH_ALEN);
 288         else
 289                 memcpy(&stasc->address[0], addr, ETH_ALEN);
 290
 291         hdr->oid = htonl(DOT11_OID_STASC);
 292         hdr->op = htonl(PIMOP_GET);
 293         stasc->keyid = idx;
 294         if (send(drv->pim_sock,hdr,blen,0) <= 0) {
 295                 free(hdr);
 296                 return -1;
 297         }
 298         if (prism54_waitpim(priv, DOT11_OID_STASC, hdr, blen, 10) <= 0) {
 299                 ret = -1;
 300         } else {
 301                 if (hdr->op == (int) htonl(PIMOP_RESPONSE)) {
 302                         memcpy(seq + 2, &stasc->sc_high, ETH_ALEN);
 303                         memset(seq, 0, 2);
 304                 } else {
 305                         ret = -1;
 306                 }
 307         }
 308         free(hdr);
 309
 310         return ret;
 311 }
 312
 313
 314 /* include unencrypted, set mlme autolevel to extended */
 315 static int prism54_init_1x(void *priv)
 316 {
 317         struct prism54_driver_data *drv = priv;
 318         pimdev_hdr *hdr;
 319         unsigned long *ul;
 320         int blen = sizeof(*hdr) + sizeof(*ul);
 321
 322         hdr = malloc(blen);
 323         if (hdr == NULL)
 324                 return -1;
 325
 326         ul = (unsigned long *) &hdr[1];
 327         hdr->op = htonl(PIMOP_SET);
 328         hdr->oid = htonl(DOT11_OID_EXUNENCRYPTED);
 329         *ul = htonl(DOT11_BOOL_TRUE); /* not accept */
 330         send(drv->pim_sock, hdr, blen, 0);
 331         prism54_waitpim(priv, DOT11_OID_EXUNENCRYPTED, hdr, blen, 10);
 332         hdr->op = htonl(PIMOP_SET);
 333         hdr->oid = htonl(DOT11_OID_MLMEAUTOLEVEL);
 334         *ul = htonl(DOT11_MLME_EXTENDED);
 335         send(drv->pim_sock, hdr, blen, 0);
 336         prism54_waitpim(priv, DOT11_OID_MLMEAUTOLEVEL, hdr, blen, 10);
 337         hdr->op = htonl(PIMOP_SET);
 338         hdr->oid = htonl(DOT11_OID_DOT1XENABLE);
 339         *ul = htonl(DOT11_BOOL_TRUE);
 340         send(drv->pim_sock, hdr, blen, 0);
 341         prism54_waitpim(priv, DOT11_OID_DOT1XENABLE, hdr, blen, 10);
 342         hdr->op = htonl(PIMOP_SET);
 343         hdr->oid = htonl(DOT11_OID_AUTHENABLE);
 344         *ul = htonl(DOT11_AUTH_OS); /* OS */
 345         send(drv->pim_sock, hdr, blen, 0);
 346         prism54_waitpim(priv, DOT11_OID_AUTHENABLE, hdr, blen, 10);
 347         free(hdr);
 348         return 0;
 349 }
 350
 351
 352 static int prism54_set_privacy_invoked(const char *ifname, void *priv,
 353                                        int flag)
 354 {
 355         struct prism54_driver_data *drv = priv;
 356         pimdev_hdr *hdr;
 357         unsigned long *ul;
 358         int ret;
 359         int blen = sizeof(*hdr) + sizeof(*ul);
 360         hdr = malloc(blen);
 361         if (hdr == NULL)
 362                 return -1;
 363         ul = (unsigned long *) &hdr[1];
 364         hdr->op = htonl(PIMOP_SET);
 365         hdr->oid = htonl(DOT11_OID_PRIVACYINVOKED);
 366         if (flag) {
 367                 *ul = htonl(DOT11_BOOL_TRUE); /* has privacy */
 368         } else {
 369                 *ul = 0;
 370         }
 371         ret = send(drv->pim_sock, hdr, blen, 0);
 372         if (ret >= 0) {
 373                 ret = prism54_waitpim(priv, DOT11_OID_PRIVACYINVOKED, hdr,
 374                                       blen, 10);
 375         }
 376         free(hdr);
 377         return ret;
 378 }
 379
 380
 381 static int prism54_ioctl_setiwessid(const char *ifname, void *priv,
 382                                     const u8 *buf, int len)
 383 {
 384 #if 0
 385         struct prism54_driver_data *drv = priv;
 386         struct iwreq iwr;
 387
 388         memset(&iwr, 0, sizeof(iwr));
 389         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 390         iwr.u.essid.flags = 1; /* SSID active */
 391         iwr.u.essid.pointer = (caddr_t) buf;
 392         iwr.u.essid.length = len + 1;
 393
 394         if (ioctl(drv->pim_sock, SIOCSIWESSID, &iwr) < 0) {
 395                 perror("ioctl[SIOCSIWESSID]");
 396                 printf("len=%d\n", len);
 397                 return -1;
 398         }
 399 #endif
 400         return 0;
 401 }
 402
 403
 404 /* kick all stations */
 405 /* does not work during init, but at least it won't crash firmware */
 406 static int prism54_flush(void *priv)
 407 {
 408         struct prism54_driver_data *drv = priv;
 409         struct obj_mlmeex *mlme;
 410         pimdev_hdr *hdr;
 411         int ret;
 412         unsigned int i;
 413         long *nsta;
 414         int blen = sizeof(*hdr) + sizeof(*mlme);
 415         char *mac_id;
 416
 417         hdr = os_zalloc(blen);
 418         if (hdr == NULL)
 419                 return -1;
 420
 421         mlme = (struct obj_mlmeex *) &hdr[1];
 422         nsta = (long *) &hdr[1];
 423         hdr->op = htonl(PIMOP_GET);
 424         hdr->oid = htonl(DOT11_OID_CLIENTS);
 425         ret = send(drv->pim_sock, hdr, sizeof(*hdr) + sizeof(long), 0);
 426         ret = prism54_waitpim(priv, DOT11_OID_CLIENTS, hdr, blen, 10);
 427         if ((ret < 0) || (hdr->op != (int) htonl(PIMOP_RESPONSE)) ||
 428             (le_to_host32(*nsta) > 2007)) {
 429                 free(hdr);
 430                 return 0;
 431         }
 432         for (i = 0; i < le_to_host32(*nsta); i++) {
 433                 mlme->id = -1;
 434                 mac_id = mac_id_get(drv, i);
 435                 if (mac_id)
 436                         memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 437                 mlme->code = host_to_le16(WLAN_REASON_UNSPECIFIED);
 438                 mlme->state = htons(DOT11_STATE_NONE);
 439                 mlme->size = 0;
 440                 hdr->op = htonl(PIMOP_SET);
 441                 hdr->oid = htonl(DOT11_OID_DISASSOCIATEEX);
 442                 ret = send(drv->pim_sock, hdr, blen, 0);
 443                 prism54_waitpim(priv, DOT11_OID_DISASSOCIATEEX, hdr, blen,
 444                                 100);
 445         }
 446         for (i = 0; i < le_to_host32(*nsta); i++) {
 447                 mlme->id = -1;
 448                 mac_id = mac_id_get(drv, i);
 449                 if (mac_id)
 450                         memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 451                 mlme->code = host_to_le16(WLAN_REASON_UNSPECIFIED);
 452                 mlme->state = htons(DOT11_STATE_NONE);
 453                 mlme->size = 0;
 454                 hdr->op = htonl(PIMOP_SET);
 455                 hdr->oid = htonl(DOT11_OID_DEAUTHENTICATEEX);
 456                 ret = send(drv->pim_sock, hdr, blen, 0);
 457                 prism54_waitpim(priv, DOT11_OID_DEAUTHENTICATEEX, hdr, blen,
 458                                 100);
 459         }
 460         free(hdr);
 461         return 0;
 462 }
 463
 464
 465 static int prism54_sta_deauth(void *priv, const u8 *addr, int reason)
 466 {
 467         struct prism54_driver_data *drv = priv;
 468         pimdev_hdr *hdr;
 469         struct obj_mlmeex *mlme;
 470         int ret;
 471         int blen = sizeof(*hdr) + sizeof(*mlme);
 472         hdr = malloc(blen);
 473         if (hdr == NULL)
 474                 return -1;
 475         mlme = (struct obj_mlmeex *) &hdr[1];
 476         hdr->op = htonl(PIMOP_SET);
 477         hdr->oid = htonl(DOT11_OID_DEAUTHENTICATEEX);
 478         memcpy(&mlme->address[0], addr, ETH_ALEN);
 479         mlme->id = -1;
 480         mlme->state = htons(DOT11_STATE_NONE);
 481         mlme->code = host_to_le16(reason);
 482         mlme->size = 0;
 483         ret = send(drv->pim_sock, hdr, blen, 0);
 484         prism54_waitpim(priv, DOT11_OID_DEAUTHENTICATEEX, hdr, blen, 10);
 485         free(hdr);
 486         return ret;
 487 }
 488
 489
 490 static int prism54_sta_disassoc(void *priv, const u8 *addr, int reason)
 491 {
 492         struct prism54_driver_data *drv = priv;
 493         pimdev_hdr *hdr;
 494         struct obj_mlmeex *mlme;
 495         int ret;
 496         int blen = sizeof(*hdr) + sizeof(*mlme);
 497         hdr = malloc(blen);
 498         if (hdr == NULL)
 499                 return -1;
 500         mlme = (struct obj_mlmeex *) &hdr[1];
 501         hdr->op = htonl(PIMOP_SET);
 502         hdr->oid = htonl(DOT11_OID_DISASSOCIATEEX);
 503         memcpy(&mlme->address[0], addr, ETH_ALEN);
 504         mlme->id = -1;
 505         mlme->state = htons(DOT11_STATE_NONE);
 506         mlme->code = host_to_le16(reason);
 507         mlme->size = 0;
 508         ret = send(drv->pim_sock, hdr, blen, 0);
 509         prism54_waitpim(priv, DOT11_OID_DISASSOCIATEEX, hdr, blen, 10);
 510         free(hdr);
 511         return ret;
 512 }
 513
 514
 515 static int prism54_get_inact_sec(void *priv, const u8 *addr)
 516 {
 517         struct prism54_driver_data *drv = priv;
 518         pimdev_hdr *hdr;
 519         struct obj_sta *sta;
 520         int blen = sizeof(*hdr) + sizeof(*sta);
 521         int ret;
 522
 523         hdr = malloc(blen);
 524         if (hdr == NULL)
 525                 return -1;
 526         hdr->op = htonl(PIMOP_GET);
 527         hdr->oid = htonl(DOT11_OID_CLIENTFIND);
 528         sta = (struct obj_sta *) &hdr[1];
 529         memcpy(&sta->address[0], addr, ETH_ALEN);
 530         ret = send(drv->pim_sock, hdr, blen, 0);
 531         ret = prism54_waitpim(priv, DOT11_OID_CLIENTFIND, hdr, blen, 10);
 532         if (ret != blen) {
 533                 printf("get_inact_sec: bad return %d\n", ret);
 534                 free(hdr);
 535                 return -1;
 536         }
 537         if (hdr->op != (int) htonl(PIMOP_RESPONSE)) {
 538                 printf("get_inact_sec: bad resp\n");
 539                 free(hdr);
 540                 return -1;
 541         }
 542         free(hdr);
 543         return le_to_host16(sta->age);
 544 }
 545
 546
 547 /* set attachments */
 548 static int prism54_set_generic_elem(const char *ifname, void *priv,
 549                                     const u8 *elem, size_t elem_len)
 550 {
 551         struct prism54_driver_data *drv = priv;
 552         pimdev_hdr *hdr;
 553         char *pos;
 554         struct obj_attachment_hdr *attach;
 555         size_t blen = sizeof(*hdr) + sizeof(*attach) + elem_len;
 556         hdr = os_zalloc(blen);
 557         if (hdr == NULL) {
 558                 printf("%s: memory low\n", __func__);
 559                 return -1;
 560         }
 561         hdr->op = htonl(PIMOP_SET);
 562         hdr->oid = htonl(DOT11_OID_ATTACHMENT);
 563         attach = (struct obj_attachment_hdr *)&hdr[1];
 564         attach->type = DOT11_PKT_BEACON;
 565         attach->id = -1;
 566         attach->size = host_to_le16((short)elem_len);
 567         pos = ((char*) attach) + sizeof(*attach);
 568         if (elem)
 569                 memcpy(pos, elem, elem_len);
 570         send(drv->pim_sock, hdr, blen, 0);
 571         attach->type = DOT11_PKT_PROBE_RESP;
 572         send(drv->pim_sock, hdr, blen, 0);
 573         free(hdr);
 574         return 0;
 575 }
 576
 577
 578 /* tell the card to auth the sta */
 579 static void prism54_handle_probe(struct prism54_driver_data *drv,
 580                                  void *buf, size_t len)
 581 {
 582         struct obj_mlmeex *mlme;
 583         pimdev_hdr *hdr;
 584         struct sta_info *sta;
 585         hdr = (pimdev_hdr *)buf;
 586         mlme = (struct obj_mlmeex *) &hdr[1];
 587         sta = ap_get_sta(drv->hapd, (u8 *) &mlme->address[0]);
 588         if (sta != NULL) {
 589                 if (sta->flags & (WLAN_STA_AUTH | WLAN_STA_ASSOC))
 590                         return;
 591         }
 592         if (len < sizeof(*mlme)) {
 593                 printf("bad probe packet\n");
 594                 return;
 595         }
 596         mlme->state = htons(DOT11_STATE_AUTHING);
 597         mlme->code = 0;
 598         hdr->op = htonl(PIMOP_SET);
 599         hdr->oid = htonl(DOT11_OID_AUTHENTICATEEX);
 600         mlme->size = 0;
 601         send(drv->pim_sock, hdr, sizeof(*hdr)+sizeof(*mlme), 0);
 602 }
 603
 604
 605 static void prism54_handle_deauth(struct prism54_driver_data *drv,
 606                                   void *buf, size_t len)
 607 {
 608         struct obj_mlme *mlme;
 609         pimdev_hdr *hdr;
 610         struct sta_info *sta;
 611         char *mac_id;
 612
 613         hdr = (pimdev_hdr *) buf;
 614         mlme = (struct obj_mlme *) &hdr[1];
 615         sta = ap_get_sta(drv->hapd, (u8 *) &mlme->address[0]);
 616         mac_id = mac_id_get(drv, mlme->id);
 617         if (sta == NULL || mac_id == NULL)
 618                 return;
 619         memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 620         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 621         wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
 622         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 623         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
 624         ap_free_sta(drv->hapd, sta);
 625 }
 626
 627
 628 static void prism54_handle_disassoc(struct prism54_driver_data *drv,
 629                                     void *buf, size_t len)
 630 {
 631         struct obj_mlme *mlme;
 632         pimdev_hdr *hdr;
 633         struct sta_info *sta;
 634         char *mac_id;
 635
 636         hdr = (pimdev_hdr *) buf;
 637         mlme = (struct obj_mlme *) &hdr[1];
 638         mac_id = mac_id_get(drv, mlme->id);
 639         if (mac_id == NULL)
 640                 return;
 641         memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 642         sta = ap_get_sta(drv->hapd, (u8 *) &mlme->address[0]);
 643         if (sta == NULL) {
 644                 return;
 645         }
 646         sta->flags &= ~WLAN_STA_ASSOC;
 647         wpa_auth_sm_event(sta->wpa_sm, WPA_DISASSOC);
 648         sta->acct_terminate_cause = RADIUS_ACCT_TERMINATE_CAUSE_USER_REQUEST;
 649         ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
 650         accounting_sta_stop(drv->hapd, sta);
 651         ieee802_1x_free_station(sta);
 652 }
 653
 654
 655 /* to auth it, just allow it now, later for os/sk */
 656 static void prism54_handle_auth(struct prism54_driver_data *drv,
 657                                 void *buf, size_t len)
 658 {
 659         struct obj_mlmeex *mlme;
 660         pimdev_hdr *hdr;
 661         struct sta_info *sta;
 662         int resp;
 663
 664         hdr = (pimdev_hdr *) buf;
 665         mlme = (struct obj_mlmeex *) &hdr[1];
 666         if (len < sizeof(*mlme)) {
 667                 printf("bad auth packet\n");
 668                 return;
 669         }
 670
 671         if (mlme->state == htons(DOT11_STATE_AUTHING)) {
 672                 sta = ap_sta_add(drv->hapd, (u8 *) &mlme->address[0]);
 673                 if (drv->hapd->tkip_countermeasures) {
 674                         resp = WLAN_REASON_MICHAEL_MIC_FAILURE;
 675                         goto fail;
 676                 }
 677                 mac_id_refresh(drv, mlme->id, &mlme->address[0]);
 678                 if (!sta) {
 679                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 680                         goto fail;
 681                 }
 682                 sta->flags &= ~WLAN_STA_PREAUTH;
 683
 684                 ieee802_1x_notify_pre_auth(sta->eapol_sm, 0);
 685                 sta->flags |= WLAN_STA_AUTH;
 686                 wpa_auth_sm_event(sta->wpa_sm, WPA_AUTH);
 687                 mlme->code = 0;
 688                 mlme->state=htons(DOT11_STATE_AUTH);
 689                 hdr->op = htonl(PIMOP_SET);
 690                 hdr->oid = htonl(DOT11_OID_AUTHENTICATEEX);
 691                 mlme->size = 0;
 692                 sta->timeout_next = STA_NULLFUNC;
 693                 send(drv->pim_sock, hdr, sizeof(*hdr) + sizeof(*mlme), 0);
 694         }
 695         return;
 696
 697 fail:
 698         printf("auth fail: %x\n", resp);
 699         mlme->code = host_to_le16(resp);
 700         mlme->size = 0;
 701         if (sta)
 702                 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 703         hdr->oid = htonl(DOT11_OID_DEAUTHENTICATEEX);
 704         hdr->op = htonl(PIMOP_SET);
 705         send(drv->pim_sock, hdr, sizeof(*hdr)+sizeof(*mlme), 0);
 706 }
 707
 708
 709 /* do the wpa thing */
 710 static void prism54_handle_assoc(struct prism54_driver_data *drv,
 711                                  void *buf, size_t len)
 712 {
 713         pimdev_hdr *hdr;
 714         struct obj_mlmeex *mlme;
 715         struct ieee802_11_elems elems;
 716         struct sta_info *sta;
 717         u8 *wpa_ie;
 718         u8 *cb;
 719         int ieofs = 0;
 720         size_t wpa_ie_len;
 721         int resp, new_assoc;
 722         char *mac_id;
 723
 724         resp = 0;
 725         hdr = (pimdev_hdr *) buf;
 726         mlme = (struct obj_mlmeex *) &hdr[1];
 727         switch (ntohl(hdr->oid)) {
 728                 case DOT11_OID_ASSOCIATE:
 729                 case DOT11_OID_REASSOCIATE:
 730                         mlme->size = 0;
 731                 default:
 732                         break;
 733         }
 734         if ((mlme->state == (int) htonl(DOT11_STATE_ASSOCING)) ||
 735             (mlme->state == (int) htonl(DOT11_STATE_REASSOCING))) {
 736                 if (len < sizeof(pimdev_hdr) + sizeof(struct obj_mlme)) {
 737                         printf("bad assoc packet\n");
 738                         return;
 739                 }
 740                 mac_id = mac_id_get(drv, mlme->id);
 741                 if (mac_id == NULL)
 742                         return;
 743                 memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 744                 sta = ap_get_sta(drv->hapd, (u8 *) &mlme->address[0]);
 745                 if (sta == NULL) {
 746                         printf("cannot get sta\n");
 747                         return;
 748                 }
 749                 cb = (u8 *) &mlme->data[0];
 750                 if (hdr->oid == htonl(DOT11_OID_ASSOCIATEEX)) {
 751                         ieofs = 4;
 752                 } else if (hdr->oid == htonl(DOT11_OID_REASSOCIATEEX)) {
 753                         ieofs = 10;
 754                 }
 755                 if (le_to_host16(mlme->size) <= ieofs) {
 756                         printf("attach too small\n");
 757                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 758                         goto fail;
 759                 }
 760                 if (ieee802_11_parse_elems(cb + ieofs,
 761                                            le_to_host16(mlme->size) - ieofs,
 762                                            &elems, 1) == ParseFailed) {
 763                         printf("STA " MACSTR " sent invalid association "
 764                                "request\n", MAC2STR(sta->addr));
 765                         resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 766                         goto fail;
 767                 }
 768                 if ((drv->hapd->conf->wpa & WPA_PROTO_RSN) &&
 769                     elems.rsn_ie) {
 770                         wpa_ie = elems.rsn_ie;
 771                         wpa_ie_len = elems.rsn_ie_len;
 772                 } else if ((drv->hapd->conf->wpa & WPA_PROTO_WPA) &&
 773                            elems.wpa_ie) {
 774                         wpa_ie = elems.wpa_ie;
 775                         wpa_ie_len = elems.wpa_ie_len;
 776                 } else {
 777                         wpa_ie = NULL;
 778                         wpa_ie_len = 0;
 779                 }
 780                 if (drv->hapd->conf->wpa && wpa_ie == NULL) {
 781                         printf("STA " MACSTR ": No WPA/RSN IE in association "
 782                                "request\n", MAC2STR(sta->addr));
 783                         resp = WLAN_STATUS_INVALID_IE;
 784                         goto fail;
 785                 }
 786                 if (drv->hapd->conf->wpa) {
 787                         int res;
 788                         wpa_ie -= 2;
 789                         wpa_ie_len += 2;
 790                         if (sta->wpa_sm == NULL)
 791                                 sta->wpa_sm = wpa_auth_sta_init(
 792                                         drv->hapd->wpa_auth, sta->addr);
 793                         if (sta->wpa_sm == NULL) {
 794                                 printf("Failed to initialize WPA state "
 795                                        "machine\n");
 796                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 797                                 goto fail;
 798                         }
 799                         res = wpa_validate_wpa_ie(drv->hapd->wpa_auth,
 800                                                   sta->wpa_sm,
 801                                                   wpa_ie, wpa_ie_len,
 802                                                   NULL, 0);
 803                         if (res == WPA_INVALID_GROUP)
 804                                 resp = WLAN_STATUS_GROUP_CIPHER_NOT_VALID;
 805                         else if (res == WPA_INVALID_PAIRWISE)
 806                                 resp = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
 807                         else if (res == WPA_INVALID_AKMP)
 808                                 resp = WLAN_STATUS_AKMP_NOT_VALID;
 809                         else if (res == WPA_ALLOC_FAIL)
 810                                 resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
 811                         else if (res != WPA_IE_OK)
 812                                 resp = WLAN_STATUS_INVALID_IE;
 813                         if (resp != WLAN_STATUS_SUCCESS)
 814                                 goto fail;
 815                 }
 816                 hdr->oid = (hdr->oid == htonl(DOT11_OID_ASSOCIATEEX)) ?
 817                         htonl(DOT11_OID_ASSOCIATEEX) :
 818                         htonl(DOT11_OID_REASSOCIATEEX);
 819                 hdr->op = htonl(PIMOP_SET);
 820                 mlme->code = 0;
 821                 mlme->state = htons(DOT11_STATE_ASSOC);
 822                 mlme->size = 0;
 823                 send(drv->pim_sock, hdr, sizeof(*hdr) + sizeof(*mlme), 0);
 824                 return;
 825         } else if (mlme->state==htons(DOT11_STATE_ASSOC)) {
 826                 if (len < sizeof(pimdev_hdr) + sizeof(struct obj_mlme)) {
 827                         printf("bad assoc packet\n");
 828                         return;
 829                 }
 830                 mac_id = mac_id_get(drv, mlme->id);
 831                 if (mac_id == NULL)
 832                         return;
 833                 memcpy(&mlme->address[0], mac_id, ETH_ALEN);
 834                 sta = ap_get_sta(drv->hapd, (u8 *) &mlme->address[0]);
 835                 if (sta == NULL) {
 836                         printf("cannot get sta\n");
 837                         return;
 838                 }
 839                 new_assoc = (sta->flags & WLAN_STA_ASSOC) == 0;
 840                 sta->flags |= WLAN_STA_AUTH | WLAN_STA_ASSOC;
 841                 wpa_auth_sm_event(sta->wpa_sm, WPA_ASSOC);
 842                 hostapd_new_assoc_sta(drv->hapd, sta, !new_assoc);
 843                 ieee802_1x_notify_port_enabled(sta->eapol_sm, 1);
 844                 sta->timeout_next = STA_NULLFUNC;
 845                 return;
 846         }
 847         return;
 848
 849 fail:
 850         printf("Prism54: assoc fail: %x\n", resp);
 851         mlme->code = host_to_le16(resp);
 852         mlme->size = 0;
 853         mlme->state = htons(DOT11_STATE_ASSOCING);
 854         hdr->oid = htonl(DOT11_OID_DISASSOCIATEEX);
 855         hdr->op = htonl(PIMOP_SET);
 856         sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
 857         send(drv->pim_sock, hdr, sizeof(*hdr) + sizeof(*mlme), 0);
 858 }
 859
 860
 861 static void handle_pim(int sock, void *eloop_ctx, void *sock_ctx)
 862 {
 863         struct prism54_driver_data *drv = eloop_ctx;
 864         int len;
 865         pimdev_hdr *hdr;
 866
 867         hdr = malloc(PIM_BUF_SIZE);
 868         if (hdr == NULL)
 869                 return;
 870         len = recv(sock, hdr, PIM_BUF_SIZE, 0);
 871         if (len < 0) {
 872                 perror("recv");
 873                 free(hdr);
 874                 return;
 875         }
 876         if (len < 8) {
 877                 printf("handle_pim: too short (%d)\n", len);
 878                 free(hdr);
 879                 return;
 880         }
 881
 882         if (hdr->op != (int) htonl(PIMOP_TRAP)) {
 883                 free(hdr);
 884                 return;
 885         }
 886         switch (ntohl(hdr->oid)) {
 887                 case DOT11_OID_PROBE:
 888                         prism54_handle_probe(drv, hdr, len);
 889                         break;
 890                 case DOT11_OID_DEAUTHENTICATEEX:
 891                 case DOT11_OID_DEAUTHENTICATE:
 892                         prism54_handle_deauth(drv, hdr, len);
 893                         break;
 894                 case DOT11_OID_DISASSOCIATEEX:
 895                 case DOT11_OID_DISASSOCIATE:
 896                         prism54_handle_disassoc(drv, hdr, len);
 897                         break;
 898                 case DOT11_OID_AUTHENTICATEEX:
 899                 case DOT11_OID_AUTHENTICATE:
 900                         prism54_handle_auth(drv, hdr, len);
 901                         break;
 902                 case DOT11_OID_ASSOCIATEEX:
 903                 case DOT11_OID_REASSOCIATEEX:
 904                 case DOT11_OID_ASSOCIATE:
 905                 case DOT11_OID_REASSOCIATE:
 906                         prism54_handle_assoc(drv, hdr, len);
 907                 default:
 908                         break;
 909         }
 910
 911         free(hdr);
 912 }
 913
 914
 915 static void handle_802_3(int sock, void *eloop_ctx, void *sock_ctx)
 916 {
 917         struct hostapd_data *hapd = (struct hostapd_data *) eloop_ctx;
 918         int len;
 919         ieee802_3_hdr *hdr;
 920
 921         hdr = malloc(PIM_BUF_SIZE);
 922         if (hdr == NULL)
 923                 return;
 924         len = recv(sock, hdr, PIM_BUF_SIZE, 0);
 925         if (len < 0) {
 926                 perror("recv");
 927                 free(hdr);
 928                 return;
 929         }
 930         if (len < 14) {
 931                 wpa_printf(MSG_MSGDUMP, "handle_802_3: too short (%d)", len);
 932                 free(hdr);
 933                 return;
 934         }
 935         if (hdr->type == htons(ETH_P_PAE)) {
 936                 ieee802_1x_receive(hapd, (u8 *) &hdr->sa[0], (u8 *) &hdr[1],
 937                                    len - sizeof(*hdr));
 938         }
 939         free(hdr);
 940 }
 941
 942
 943 static int prism54_init_sockets(struct prism54_driver_data *drv)
 944 {
 945         struct hostapd_data *hapd = drv->hapd;
 946         struct ifreq ifr;
 947         struct sockaddr_ll addr;
 948
 949         drv->sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_PAE));
 950         if (drv->sock < 0) {
 951                 perror("socket[PF_PACKET,SOCK_RAW]");
 952                 return -1;
 953         }
 954
 955         if (eloop_register_read_sock(drv->sock, handle_802_3, drv->hapd, NULL))
 956         {
 957                 printf("Could not register read socket\n");
 958                 return -1;
 959         }
 960
 961         memset(&ifr, 0, sizeof(ifr));
 962         if (hapd->conf->bridge[0] != '\0') {
 963                 printf("opening bridge: %s\n", hapd->conf->bridge);
 964                 os_strlcpy(ifr.ifr_name, hapd->conf->bridge,
 965                            sizeof(ifr.ifr_name));
 966         } else {
 967                 os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
 968         }
 969         if (ioctl(drv->sock, SIOCGIFINDEX, &ifr) != 0) {
 970                 perror("ioctl(SIOCGIFINDEX)");
 971                 return -1;
 972         }
 973
 974         memset(&addr, 0, sizeof(addr));
 975         addr.sll_family = AF_PACKET;
 976         addr.sll_ifindex = ifr.ifr_ifindex;
 977         addr.sll_protocol = htons(ETH_P_PAE);
 978         wpa_printf(MSG_DEBUG, "Opening raw packet socket for ifindex %d",
 979                    addr.sll_ifindex);
 980
 981         if (bind(drv->sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
 982                 perror("bind");
 983                 return -1;
 984         }
 985
 986         memset(&ifr, 0, sizeof(ifr));
 987         os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
 988         if (ioctl(drv->sock, SIOCGIFHWADDR, &ifr) != 0) {
 989                 perror("ioctl(SIOCGIFHWADDR)");
 990                 return -1;
 991         }
 992
 993         if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
 994                 printf("Invalid HW-addr family 0x%04x\n",
 995                        ifr.ifr_hwaddr.sa_family);
 996                 return -1;
 997         }
 998         memcpy(drv->hapd->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
 999
1000         drv->pim_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1001         if (drv->pim_sock < 0) {
1002                 perror("socket[PF_PACKET,SOCK_RAW]");
1003                 return -1;
1004         }
1005
1006         if (eloop_register_read_sock(drv->pim_sock, handle_pim, drv, NULL)) {
1007                 printf("Could not register read socket\n");
1008                 return -1;
1009         }
1010
1011         memset(&ifr, 0, sizeof(ifr));
1012         snprintf(ifr.ifr_name, sizeof(ifr.ifr_name), "%sap", drv->iface);
1013         if (ioctl(drv->pim_sock, SIOCGIFINDEX, &ifr) != 0) {
1014                 perror("ioctl(SIOCGIFINDEX)");
1015                 return -1;
1016         }
1017
1018         memset(&addr, 0, sizeof(addr));
1019         addr.sll_family = AF_PACKET;
1020         addr.sll_ifindex = ifr.ifr_ifindex;
1021         addr.sll_protocol = htons(ETH_P_ALL);
1022         wpa_printf(MSG_DEBUG, "Opening raw packet socket for ifindex %d",
1023                    addr.sll_ifindex);
1024
1025         if (bind(drv->pim_sock, (struct sockaddr *) &addr, sizeof(addr)) < 0) {
1026                 perror("bind");
1027                 return -1;
1028         }
1029
1030         return 0;
1031 }
1032
1033
1034 static void * prism54_driver_init(struct hostapd_data *hapd)
1035 {
1036         struct prism54_driver_data *drv;
1037
1038         drv = os_zalloc(sizeof(struct prism54_driver_data));
1039         if (drv == NULL) {
1040                 printf("Could not allocate memory for hostapd Prism54 driver "
1041                        "data\n");
1042                 return NULL;
1043         }
1044
1045         drv->hapd = hapd;
1046         drv->pim_sock = drv->sock = -1;
1047         memcpy(drv->iface, hapd->conf->iface, sizeof(drv->iface));
1048
1049         if (prism54_init_sockets(drv)) {
1050                 free(drv);
1051                 return NULL;
1052         }
1053         prism54_init_1x(drv);
1054         /* must clean previous elems */
1055         prism54_set_generic_elem(drv->iface, drv, NULL, 0);
1056
1057         return drv;
1058 }
1059
1060
1061 static void prism54_driver_deinit(void *priv)
1062 {
1063         struct prism54_driver_data *drv = priv;
1064
1065         if (drv->pim_sock >= 0)
1066                 close(drv->pim_sock);
1067
1068         if (drv->sock >= 0)
1069                 close(drv->sock);
1070
1071         free(drv);
1072 }
1073
1074
1075 const struct wpa_driver_ops wpa_driver_prism54_ops = {
1076         .name = "prism54",
1077         .init = prism54_driver_init,
1078         .deinit = prism54_driver_deinit,
1079         /* .set_ieee8021x = prism54_init_1x, */
1080         .set_privacy = prism54_set_privacy_invoked,
1081         .set_encryption = prism54_set_encryption,
1082         .get_seqnum = prism54_get_seqnum,
1083         .flush = prism54_flush,
1084         .set_generic_elem = prism54_set_generic_elem,
1085         .send_eapol = prism54_send_eapol,
1086         .sta_set_flags = prism54_sta_set_flags,
1087         .sta_deauth = prism54_sta_deauth,
1088         .sta_disassoc = prism54_sta_disassoc,
1089         .set_ssid = prism54_ioctl_setiwessid,
1090         .get_inact_sec = prism54_get_inact_sec,
1091 };