/* * Driver interaction with Linux nl80211/cfg80211 * Copyright (c) 2002-2008, Jouni Malinen * Copyright (c) 2003-2004, Instant802 Networks, Inc. * Copyright (c) 2005-2006, Devicescape Software, Inc. * Copyright (c) 2007, Johannes Berg * Copyright (c) 2009, Atheros Communications * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 as * published by the Free Software Foundation. * * Alternatively, this software may be distributed under the terms of BSD * license. * * See README and COPYING for more details. */ #include "includes.h" #include #include #include #include #include #include #include #include #include "nl80211_copy.h" #include "common.h" #include "eloop.h" #include "common/ieee802_11_defs.h" #include "netlink.h" #include "radiotap.h" #include "radiotap_iter.h" #include "driver.h" #ifdef CONFIG_LIBNL20 /* libnl 2.0 compatibility code */ #define nl_handle nl_sock #define nl_handle_alloc_cb nl_socket_alloc_cb #define nl_handle_destroy nl_socket_free #endif /* CONFIG_LIBNL20 */ #ifndef IFF_LOWER_UP #define IFF_LOWER_UP 0x10000 /* driver signals L1 up */ #endif #ifndef IFF_DORMANT #define IFF_DORMANT 0x20000 /* driver signals dormant */ #endif #ifndef IF_OPER_DORMANT #define IF_OPER_DORMANT 5 #endif #ifndef IF_OPER_UP #define IF_OPER_UP 6 #endif struct i802_bss { struct i802_bss *next; int ifindex; unsigned int beacon_set:1; }; struct wpa_driver_nl80211_data { void *ctx; int link_event_sock; int ioctl_sock; /* socket for ioctl() use */ char ifname[IFNAMSIZ + 1]; int ifindex; int if_removed; struct wpa_driver_capa capa; int has_capability; int operstate; int scan_complete_events; struct nl_handle *nl_handle; struct nl_handle *nl_handle_event; struct nl_cache *nl_cache; struct nl_cache *nl_cache_event; struct nl_cb *nl_cb; struct genl_family *nl80211; u8 auth_bssid[ETH_ALEN]; u8 bssid[ETH_ALEN]; int associated; u8 ssid[32]; size_t ssid_len; int nlmode; int ap_scan_as_station; int monitor_sock; int monitor_ifidx; unsigned int beacon_set:1; #ifdef HOSTAPD int eapol_sock; /* socket for EAPOL frames */ int default_if_indices[16]; int *if_indices; int num_if_indices; struct i802_bss bss; int last_freq; int last_freq_ht; #endif /* HOSTAPD */ }; static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx); static int wpa_driver_nl80211_set_mode(void *priv, int mode); static int wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv); static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv, const u8 *addr, int cmd, u16 reason_code); static void nl80211_remove_monitor_interface( struct wpa_driver_nl80211_data *drv); #ifdef HOSTAPD static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx); static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx); static struct i802_bss * get_bss(struct wpa_driver_nl80211_data *drv, int ifindex); static int i802_set_freq(void *priv, struct hostapd_freq_params *freq); #endif /* HOSTAPD */ /* nl80211 code */ static int ack_handler(struct nl_msg *msg, void *arg) { int *err = arg; *err = 0; return NL_STOP; } static int finish_handler(struct nl_msg *msg, void *arg) { int *ret = arg; *ret = 0; return NL_SKIP; } static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err, void *arg) { int *ret = arg; *ret = err->error; return NL_SKIP; } static int no_seq_check(struct nl_msg *msg, void *arg) { return NL_OK; } static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv, struct nl_msg *msg, int (*valid_handler)(struct nl_msg *, void *), void *valid_data) { struct nl_cb *cb; int err = -ENOMEM; cb = nl_cb_clone(drv->nl_cb); if (!cb) goto out; err = nl_send_auto_complete(drv->nl_handle, msg); if (err < 0) goto out; err = 1; nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err); nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err); nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err); if (valid_handler) nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, valid_handler, valid_data); while (err > 0) nl_recvmsgs(drv->nl_handle, cb); out: nl_cb_put(cb); nlmsg_free(msg); return err; } struct family_data { const char *group; int id; }; static int family_handler(struct nl_msg *msg, void *arg) { struct family_data *res = arg; struct nlattr *tb[CTRL_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct nlattr *mcgrp; int i; nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); if (!tb[CTRL_ATTR_MCAST_GROUPS]) return NL_SKIP; nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) { struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1]; nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp), nla_len(mcgrp), NULL); if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] || !tb2[CTRL_ATTR_MCAST_GRP_ID] || os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]), res->group, nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0) continue; res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]); break; }; return NL_SKIP; } static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv, const char *family, const char *group) { struct nl_msg *msg; int ret = -1; struct family_data res = { group, -ENOENT }; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"), 0, 0, CTRL_CMD_GETFAMILY, 0); NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family); ret = send_and_recv_msgs(drv, msg, family_handler, &res); msg = NULL; if (ret == 0) ret = res.id; nla_put_failure: nlmsg_free(msg); return ret; } #ifdef HOSTAPD static int get_ifhwaddr(struct wpa_driver_nl80211_data *drv, const char *ifname, u8 *addr) { struct ifreq ifr; os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ); if (ioctl(drv->ioctl_sock, SIOCGIFHWADDR, &ifr)) { wpa_printf(MSG_ERROR, "%s: ioctl(SIOCGIFHWADDR): %d (%s)", ifname, errno, strerror(errno)); return -1; } if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) { wpa_printf(MSG_ERROR, "%s: Invalid HW-addr family 0x%04x", ifname, ifr.ifr_hwaddr.sa_family); return -1; } os_memcpy(addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN); return 0; } static int set_ifhwaddr(struct wpa_driver_nl80211_data *drv, const char *ifname, const u8 *addr) { struct ifreq ifr; os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ); os_memcpy(ifr.ifr_hwaddr.sa_data, addr, ETH_ALEN); ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER; if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifr)) { wpa_printf(MSG_DEBUG, "%s: ioctl(SIOCSIFHWADDR): %d (%s)", ifname, errno, strerror(errno)); return -1; } return 0; } #endif /* HOSTAPD */ static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid) { struct wpa_driver_nl80211_data *drv = priv; if (!drv->associated) return -1; os_memcpy(bssid, drv->bssid, ETH_ALEN); return 0; } static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid) { struct wpa_driver_nl80211_data *drv = priv; if (!drv->associated) return -1; os_memcpy(ssid, drv->ssid, drv->ssid_len); return drv->ssid_len; } static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv, void *ctx, char *buf, size_t len, int del) { union wpa_event_data event; os_memset(&event, 0, sizeof(event)); if (len > sizeof(event.interface_status.ifname)) len = sizeof(event.interface_status.ifname) - 1; os_memcpy(event.interface_status.ifname, buf, len); event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED : EVENT_INTERFACE_ADDED; wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s", del ? "DEL" : "NEW", event.interface_status.ifname, del ? "removed" : "added"); if (os_strcmp(drv->ifname, event.interface_status.ifname) == 0) { if (del) drv->if_removed = 1; else drv->if_removed = 0; } wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event); } static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv, struct nlmsghdr *h) { struct ifinfomsg *ifi; int attrlen, _nlmsg_len, rta_len; struct rtattr *attr; ifi = NLMSG_DATA(h); _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg)); attrlen = NLMSG_PAYLOAD(h, sizeof(struct ifinfomsg)); if (attrlen < 0) return 0; attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len); rta_len = RTA_ALIGN(sizeof(struct rtattr)); while (RTA_OK(attr, attrlen)) { if (attr->rta_type == IFLA_IFNAME) { if (os_strcmp(((char *) attr) + rta_len, drv->ifname) == 0) return 1; else break; } attr = RTA_NEXT(attr, attrlen); } return 0; } static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv, int ifindex, struct nlmsghdr *h) { if (drv->ifindex == ifindex) return 1; if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, h)) { drv->ifindex = if_nametoindex(drv->ifname); wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed " "interface"); wpa_driver_nl80211_finish_drv_init(drv); return 1; } return 0; } static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data *drv, void *ctx, struct nlmsghdr *h, size_t len) { struct ifinfomsg *ifi; int attrlen, _nlmsg_len, rta_len; struct rtattr * attr; if (len < sizeof(*ifi)) return; ifi = NLMSG_DATA(h); if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, h)) { wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d", ifi->ifi_index); return; } wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x " "(%s%s%s%s)", drv->operstate, ifi->ifi_flags, (ifi->ifi_flags & IFF_UP) ? "[UP]" : "", (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "", (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "", (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : ""); /* * Some drivers send the association event before the operup event--in * this case, lifting operstate in wpa_driver_nl80211_set_operstate() * fails. This will hit us when wpa_supplicant does not need to do * IEEE 802.1X authentication */ if (drv->operstate == 1 && (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP && !(ifi->ifi_flags & IFF_RUNNING)) netlink_send_oper_ifla(drv->link_event_sock, drv->ifindex, -1, IF_OPER_UP); _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg)); attrlen = NLMSG_PAYLOAD(h, sizeof(struct ifinfomsg)); if (attrlen < 0) return; attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len); rta_len = RTA_ALIGN(sizeof(struct rtattr)); while (RTA_OK(attr, attrlen)) { if (attr->rta_type == IFLA_IFNAME) { wpa_driver_nl80211_event_link( drv, ctx, ((char *) attr) + rta_len, attr->rta_len - rta_len, 0); } attr = RTA_NEXT(attr, attrlen); } } static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data *drv, void *ctx, struct nlmsghdr *h, size_t len) { struct ifinfomsg *ifi; int attrlen, _nlmsg_len, rta_len; struct rtattr * attr; if (len < sizeof(*ifi)) return; ifi = NLMSG_DATA(h); _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg)); attrlen = NLMSG_PAYLOAD(h, sizeof(struct ifinfomsg)); if (attrlen < 0) return; attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len); rta_len = RTA_ALIGN(sizeof(struct rtattr)); while (RTA_OK(attr, attrlen)) { if (attr->rta_type == IFLA_IFNAME) { wpa_driver_nl80211_event_link( drv, ctx, ((char *) attr) + rta_len, attr->rta_len - rta_len, 1); } attr = RTA_NEXT(attr, attrlen); } } static void wpa_driver_nl80211_event_receive_link(int sock, void *eloop_ctx, void *sock_ctx) { char buf[8192]; int left; struct sockaddr_nl from; socklen_t fromlen; struct nlmsghdr *h; int max_events = 10; try_again: fromlen = sizeof(from); left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT, (struct sockaddr *) &from, &fromlen); if (left < 0) { if (errno != EINTR && errno != EAGAIN) perror("recvfrom(netlink)"); return; } h = (struct nlmsghdr *) buf; while (left >= (int) sizeof(*h)) { int len, plen; len = h->nlmsg_len; plen = len - sizeof(*h); if (len > left || plen < 0) { wpa_printf(MSG_DEBUG, "Malformed netlink message: " "len=%d left=%d plen=%d", len, left, plen); break; } switch (h->nlmsg_type) { case RTM_NEWLINK: wpa_driver_nl80211_event_rtm_newlink(eloop_ctx, sock_ctx, h, plen); break; case RTM_DELLINK: wpa_driver_nl80211_event_rtm_dellink(eloop_ctx, sock_ctx, h, plen); break; } len = NLMSG_ALIGN(len); left -= len; h = (struct nlmsghdr *) ((char *) h + len); } if (left > 0) { wpa_printf(MSG_DEBUG, "%d extra bytes in the end of netlink " "message", left); } if (--max_events > 0) { /* * Try to receive all events in one eloop call in order to * limit race condition on cases where AssocInfo event, Assoc * event, and EAPOL frames are received more or less at the * same time. We want to process the event messages first * before starting EAPOL processing. */ goto try_again; } } static void mlme_event_auth(struct wpa_driver_nl80211_data *drv, const u8 *frame, size_t len) { const struct ieee80211_mgmt *mgmt; union wpa_event_data event; mgmt = (const struct ieee80211_mgmt *) frame; if (len < 24 + sizeof(mgmt->u.auth)) { wpa_printf(MSG_DEBUG, "nl80211: Too short association event " "frame"); return; } os_memcpy(drv->auth_bssid, mgmt->sa, ETH_ALEN); os_memset(&event, 0, sizeof(event)); os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN); event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg); event.auth.status_code = le_to_host16(mgmt->u.auth.status_code); if (len > 24 + sizeof(mgmt->u.auth)) { event.auth.ies = mgmt->u.auth.variable; event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth); } wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event); } static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv, const u8 *frame, size_t len) { const struct ieee80211_mgmt *mgmt; union wpa_event_data event; u16 status; mgmt = (const struct ieee80211_mgmt *) frame; if (len < 24 + sizeof(mgmt->u.assoc_resp)) { wpa_printf(MSG_DEBUG, "nl80211: Too short association event " "frame"); return; } status = le_to_host16(mgmt->u.assoc_resp.status_code); if (status != WLAN_STATUS_SUCCESS) { os_memset(&event, 0, sizeof(event)); if (len > 24 + sizeof(mgmt->u.assoc_resp)) { event.assoc_reject.resp_ies = (u8 *) mgmt->u.assoc_resp.variable; event.assoc_reject.resp_ies_len = len - 24 - sizeof(mgmt->u.assoc_resp); } event.assoc_reject.status_code = status; wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event); return; } drv->associated = 1; os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN); os_memset(&event, 0, sizeof(event)); if (len > 24 + sizeof(mgmt->u.assoc_resp)) { event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable; event.assoc_info.resp_ies_len = len - 24 - sizeof(mgmt->u.assoc_resp); } wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event); } static void mlme_event_connect(struct wpa_driver_nl80211_data *drv, enum nl80211_commands cmd, struct nlattr *status, struct nlattr *addr, struct nlattr *req_ie, struct nlattr *resp_ie) { union wpa_event_data event; if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { /* * Avoid reporting two association events that would confuse * the core code. */ wpa_printf(MSG_DEBUG, "nl80211: Ignore connect event (cmd=%d) " "when using userspace SME", cmd); return; } os_memset(&event, 0, sizeof(event)); if (cmd == NL80211_CMD_CONNECT && nla_get_u16(status) != WLAN_STATUS_SUCCESS) { if (resp_ie) { event.assoc_reject.resp_ies = nla_data(resp_ie); event.assoc_reject.resp_ies_len = nla_len(resp_ie); } event.assoc_reject.status_code = nla_get_u16(status); wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event); return; } drv->associated = 1; if (addr) os_memcpy(drv->bssid, nla_data(addr), ETH_ALEN); if (req_ie) { event.assoc_info.req_ies = nla_data(req_ie); event.assoc_info.req_ies_len = nla_len(req_ie); } if (resp_ie) { event.assoc_info.resp_ies = nla_data(resp_ie); event.assoc_info.resp_ies_len = nla_len(resp_ie); } wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event); } static void mlme_timeout_event(struct wpa_driver_nl80211_data *drv, enum nl80211_commands cmd, struct nlattr *addr) { union wpa_event_data event; enum wpa_event_type ev; if (nla_len(addr) != ETH_ALEN) return; wpa_printf(MSG_DEBUG, "nl80211: MLME event %d; timeout with " MACSTR, cmd, MAC2STR((u8 *) nla_data(addr))); if (cmd == NL80211_CMD_AUTHENTICATE) ev = EVENT_AUTH_TIMED_OUT; else if (cmd == NL80211_CMD_ASSOCIATE) ev = EVENT_ASSOC_TIMED_OUT; else return; os_memset(&event, 0, sizeof(event)); os_memcpy(event.timeout_event.addr, nla_data(addr), ETH_ALEN); wpa_supplicant_event(drv->ctx, ev, &event); } static void mlme_event(struct wpa_driver_nl80211_data *drv, enum nl80211_commands cmd, struct nlattr *frame, struct nlattr *addr, struct nlattr *timed_out) { if (timed_out && addr) { mlme_timeout_event(drv, cmd, addr); return; } if (frame == NULL) { wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame " "data", cmd); return; } wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd); wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame", nla_data(frame), nla_len(frame)); switch (cmd) { case NL80211_CMD_AUTHENTICATE: mlme_event_auth(drv, nla_data(frame), nla_len(frame)); break; case NL80211_CMD_ASSOCIATE: mlme_event_assoc(drv, nla_data(frame), nla_len(frame)); break; case NL80211_CMD_DEAUTHENTICATE: drv->associated = 0; wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL); break; case NL80211_CMD_DISASSOCIATE: drv->associated = 0; wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL); break; default: break; } } static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv, struct nlattr *tb[]) { union wpa_event_data data; wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure"); os_memset(&data, 0, sizeof(data)); if (tb[NL80211_ATTR_MAC]) { wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address", nla_data(tb[NL80211_ATTR_MAC]), nla_len(tb[NL80211_ATTR_MAC])); data.michael_mic_failure.src = nla_data(tb[NL80211_ATTR_MAC]); } if (tb[NL80211_ATTR_KEY_SEQ]) { wpa_hexdump(MSG_DEBUG, "nl80211: TSC", nla_data(tb[NL80211_ATTR_KEY_SEQ]), nla_len(tb[NL80211_ATTR_KEY_SEQ])); } if (tb[NL80211_ATTR_KEY_TYPE]) { enum nl80211_key_type key_type = nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]); wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type); if (key_type == NL80211_KEYTYPE_PAIRWISE) data.michael_mic_failure.unicast = 1; } else data.michael_mic_failure.unicast = 1; if (tb[NL80211_ATTR_KEY_IDX]) { u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]); wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id); } wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data); } static void mlme_event_join_ibss(struct wpa_driver_nl80211_data *drv, struct nlattr *tb[]) { if (tb[NL80211_ATTR_MAC] == NULL) { wpa_printf(MSG_DEBUG, "nl80211: No address in IBSS joined " "event"); return; } os_memcpy(drv->bssid, nla_data(tb[NL80211_ATTR_MAC]), ETH_ALEN); drv->associated = 1; wpa_printf(MSG_DEBUG, "nl80211: IBSS " MACSTR " joined", MAC2STR(drv->bssid)); wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL); } static int process_event(struct nl_msg *msg, void *arg) { struct wpa_driver_nl80211_data *drv = arg; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct nlattr *tb[NL80211_ATTR_MAX + 1]; nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); if (tb[NL80211_ATTR_IFINDEX]) { int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]); if (ifindex != drv->ifindex) { wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)" " for foreign interface (ifindex %d)", gnlh->cmd, ifindex); return NL_SKIP; } } if (drv->ap_scan_as_station && (gnlh->cmd == NL80211_CMD_NEW_SCAN_RESULTS || gnlh->cmd == NL80211_CMD_SCAN_ABORTED)) { wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_AP); drv->ap_scan_as_station = 0; } switch (gnlh->cmd) { case NL80211_CMD_TRIGGER_SCAN: wpa_printf(MSG_DEBUG, "nl80211: Scan trigger"); break; case NL80211_CMD_NEW_SCAN_RESULTS: wpa_printf(MSG_DEBUG, "nl80211: New scan results available"); drv->scan_complete_events = 1; eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL); break; case NL80211_CMD_SCAN_ABORTED: wpa_printf(MSG_DEBUG, "nl80211: Scan aborted"); /* * Need to indicate that scan results are available in order * not to make wpa_supplicant stop its scanning. */ eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL); break; case NL80211_CMD_AUTHENTICATE: case NL80211_CMD_ASSOCIATE: case NL80211_CMD_DEAUTHENTICATE: case NL80211_CMD_DISASSOCIATE: mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME], tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_TIMED_OUT]); break; case NL80211_CMD_CONNECT: case NL80211_CMD_ROAM: mlme_event_connect(drv, gnlh->cmd, tb[NL80211_ATTR_STATUS_CODE], tb[NL80211_ATTR_MAC], tb[NL80211_ATTR_REQ_IE], tb[NL80211_ATTR_RESP_IE]); break; case NL80211_CMD_DISCONNECT: if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { /* * Avoid reporting two disassociation events that could * confuse the core code. */ wpa_printf(MSG_DEBUG, "nl80211: Ignore disconnect " "event when using userspace SME"); break; } drv->associated = 0; wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL); break; case NL80211_CMD_MICHAEL_MIC_FAILURE: mlme_event_michael_mic_failure(drv, tb); break; case NL80211_CMD_JOIN_IBSS: mlme_event_join_ibss(drv, tb); break; default: wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event " "(cmd=%d)", gnlh->cmd); break; } return NL_SKIP; } static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx, void *sock_ctx) { struct nl_cb *cb; struct wpa_driver_nl80211_data *drv = eloop_ctx; wpa_printf(MSG_DEBUG, "nl80211: Event message available"); cb = nl_cb_clone(drv->nl_cb); if (!cb) return; nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL); nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv); nl_recvmsgs(drv->nl_handle_event, cb); nl_cb_put(cb); } static int hostapd_set_iface_flags(struct wpa_driver_nl80211_data *drv, const char *ifname, int dev_up) { struct ifreq ifr; if (drv->ioctl_sock < 0) return -1; os_memset(&ifr, 0, sizeof(ifr)); os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ); if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) { perror("ioctl[SIOCGIFFLAGS]"); wpa_printf(MSG_DEBUG, "Could not read interface flags (%s)", ifname); return -1; } if (dev_up) { if (ifr.ifr_flags & IFF_UP) return 0; ifr.ifr_flags |= IFF_UP; } else { if (!(ifr.ifr_flags & IFF_UP)) return 0; ifr.ifr_flags &= ~IFF_UP; } if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) { perror("ioctl[SIOCSIFFLAGS]"); return -1; } return 0; } /** * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain * @priv: driver_nl80211 private data * @alpha2_arg: country to which to switch to * Returns: 0 on success, -1 on failure * * This asks nl80211 to set the regulatory domain for given * country ISO / IEC alpha2. */ static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg) { struct wpa_driver_nl80211_data *drv = priv; char alpha2[3]; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; alpha2[0] = alpha2_arg[0]; alpha2[1] = alpha2_arg[1]; alpha2[2] = '\0'; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_REQ_SET_REG, 0); NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2); if (send_and_recv_msgs(drv, msg, NULL, NULL)) return -EINVAL; return 0; nla_put_failure: return -EINVAL; } #ifndef HOSTAPD struct wiphy_info_data { int max_scan_ssids; int ap_supported; int auth_supported; int connect_supported; }; static int wiphy_info_handler(struct nl_msg *msg, void *arg) { struct nlattr *tb[NL80211_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct wiphy_info_data *info = arg; nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]) info->max_scan_ssids = nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]); if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) { struct nlattr *nl_mode; int i; nla_for_each_nested(nl_mode, tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) { if (nl_mode->nla_type == NL80211_IFTYPE_AP) { info->ap_supported = 1; break; } } } if (tb[NL80211_ATTR_SUPPORTED_COMMANDS]) { struct nlattr *nl_cmd; int i; nla_for_each_nested(nl_cmd, tb[NL80211_ATTR_SUPPORTED_COMMANDS], i) { u32 cmd = nla_get_u32(nl_cmd); if (cmd == NL80211_CMD_AUTHENTICATE) info->auth_supported = 1; else if (cmd == NL80211_CMD_CONNECT) info->connect_supported = 1; } } return NL_SKIP; } static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv, struct wiphy_info_data *info) { struct nl_msg *msg; os_memset(info, 0, sizeof(*info)); msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_GET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0) return 0; msg = NULL; nla_put_failure: nlmsg_free(msg); return -1; } static int wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv) { struct wiphy_info_data info; if (wpa_driver_nl80211_get_info(drv, &info)) return -1; drv->has_capability = 1; /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */ drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA | WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK | WPA_DRIVER_CAPA_KEY_MGMT_WPA2 | WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK; drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 | WPA_DRIVER_CAPA_ENC_WEP104 | WPA_DRIVER_CAPA_ENC_TKIP | WPA_DRIVER_CAPA_ENC_CCMP; drv->capa.max_scan_ssids = info.max_scan_ssids; if (info.ap_supported) drv->capa.flags |= WPA_DRIVER_FLAGS_AP; if (info.auth_supported) drv->capa.flags |= WPA_DRIVER_FLAGS_SME; else if (!info.connect_supported) { wpa_printf(MSG_INFO, "nl80211: Driver does not support " "authentication/association or connect commands"); return -1; } drv->capa.flags |= WPA_DRIVER_FLAGS_SET_KEYS_AFTER_ASSOC_DONE; return 0; } #endif /* HOSTAPD */ static int wpa_driver_nl80211_init_nl(struct wpa_driver_nl80211_data *drv, void *ctx) { int ret; /* Initialize generic netlink and nl80211 */ drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT); if (drv->nl_cb == NULL) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " "callbacks"); goto err1; } drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb); if (drv->nl_handle == NULL) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " "callbacks"); goto err2; } drv->nl_handle_event = nl_handle_alloc_cb(drv->nl_cb); if (drv->nl_handle_event == NULL) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink " "callbacks (event)"); goto err2b; } if (genl_connect(drv->nl_handle)) { wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic " "netlink"); goto err3; } if (genl_connect(drv->nl_handle_event)) { wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic " "netlink (event)"); goto err3; } #ifdef CONFIG_LIBNL20 if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " "netlink cache"); goto err3; } if (genl_ctrl_alloc_cache(drv->nl_handle_event, &drv->nl_cache_event) < 0) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " "netlink cache (event)"); goto err3b; } #else /* CONFIG_LIBNL20 */ drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle); if (drv->nl_cache == NULL) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " "netlink cache"); goto err3; } drv->nl_cache_event = genl_ctrl_alloc_cache(drv->nl_handle_event); if (drv->nl_cache_event == NULL) { wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic " "netlink cache (event)"); goto err3b; } #endif /* CONFIG_LIBNL20 */ drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211"); if (drv->nl80211 == NULL) { wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not " "found"); goto err4; } ret = nl_get_multicast_id(drv, "nl80211", "scan"); if (ret >= 0) ret = nl_socket_add_membership(drv->nl_handle_event, ret); if (ret < 0) { wpa_printf(MSG_ERROR, "nl80211: Could not add multicast " "membership for scan events: %d (%s)", ret, strerror(-ret)); goto err4; } ret = nl_get_multicast_id(drv, "nl80211", "mlme"); if (ret >= 0) ret = nl_socket_add_membership(drv->nl_handle_event, ret); if (ret < 0) { wpa_printf(MSG_ERROR, "nl80211: Could not add multicast " "membership for mlme events: %d (%s)", ret, strerror(-ret)); goto err4; } eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle_event), wpa_driver_nl80211_event_receive, drv, ctx); return 0; err4: nl_cache_free(drv->nl_cache_event); err3b: nl_cache_free(drv->nl_cache); err3: nl_handle_destroy(drv->nl_handle_event); err2b: nl_handle_destroy(drv->nl_handle); err2: nl_cb_put(drv->nl_cb); err1: return -1; } static int wpa_driver_nl80211_init_link_events( struct wpa_driver_nl80211_data *drv) { int s; struct sockaddr_nl local; s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE); if (s < 0) { perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)"); return -1; } os_memset(&local, 0, sizeof(local)); local.nl_family = AF_NETLINK; local.nl_groups = RTMGRP_LINK; if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) { perror("bind(netlink)"); close(s); return -1; } eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_link, drv, drv->ctx); drv->link_event_sock = s; return 0; } /** * wpa_driver_nl80211_init - Initialize nl80211 driver interface * @ctx: context to be used when calling wpa_supplicant functions, * e.g., wpa_supplicant_event() * @ifname: interface name, e.g., wlan0 * Returns: Pointer to private data, %NULL on failure */ static void * wpa_driver_nl80211_init(void *ctx, const char *ifname) { struct wpa_driver_nl80211_data *drv; drv = os_zalloc(sizeof(*drv)); if (drv == NULL) return NULL; drv->ctx = ctx; os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname)); drv->monitor_ifidx = -1; drv->monitor_sock = -1; drv->link_event_sock = -1; drv->ioctl_sock = -1; if (wpa_driver_nl80211_init_nl(drv, ctx)) { os_free(drv); return NULL; } drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0); if (drv->ioctl_sock < 0) { perror("socket(PF_INET,SOCK_DGRAM)"); goto failed; } if (wpa_driver_nl80211_init_link_events(drv) || wpa_driver_nl80211_finish_drv_init(drv)) goto failed; return drv; failed: if (drv->link_event_sock >= 0) { eloop_unregister_read_sock(drv->link_event_sock); close(drv->link_event_sock); } if (drv->ioctl_sock >= 0) close(drv->ioctl_sock); genl_family_put(drv->nl80211); nl_cache_free(drv->nl_cache); nl_handle_destroy(drv->nl_handle); nl_cb_put(drv->nl_cb); os_free(drv); return NULL; } static int wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv) { drv->ifindex = if_nametoindex(drv->ifname); #ifndef HOSTAPD if (wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_INFRA) < 0) { wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to " "use managed mode"); } if (hostapd_set_iface_flags(drv, drv->ifname, 1)) { wpa_printf(MSG_ERROR, "Could not set interface '%s' " "UP", drv->ifname); return -1; } if (wpa_driver_nl80211_capa(drv)) return -1; netlink_send_oper_ifla(drv->link_event_sock, drv->ifindex, 1, IF_OPER_DORMANT); #endif /* HOSTAPD */ return 0; } #ifdef HOSTAPD static void wpa_driver_nl80211_free_bss(struct wpa_driver_nl80211_data *drv) { struct i802_bss *bss, *prev; bss = drv->bss.next; while (bss) { prev = bss; bss = bss->next; os_free(bss); } } #endif /* HOSTAPD */ static int wpa_driver_nl80211_del_beacon(struct wpa_driver_nl80211_data *drv) { struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_DEL_BEACON, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } /** * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init() * * Shut down driver interface and processing of driver events. Free * private data buffer if one was allocated in wpa_driver_nl80211_init(). */ static void wpa_driver_nl80211_deinit(void *priv) { struct wpa_driver_nl80211_data *drv = priv; nl80211_remove_monitor_interface(drv); if (drv->monitor_sock >= 0) { eloop_unregister_read_sock(drv->monitor_sock); close(drv->monitor_sock); } if (drv->nlmode == NL80211_IFTYPE_AP) wpa_driver_nl80211_del_beacon(drv); #ifdef HOSTAPD if (drv->last_freq_ht) { /* Clear HT flags from the driver */ struct hostapd_freq_params freq; os_memset(&freq, 0, sizeof(freq)); freq.freq = drv->last_freq; i802_set_freq(priv, &freq); } if (drv->eapol_sock >= 0) { eloop_unregister_read_sock(drv->eapol_sock); close(drv->eapol_sock); } if (drv->if_indices != drv->default_if_indices) os_free(drv->if_indices); wpa_driver_nl80211_free_bss(drv); #endif /* HOSTAPD */ netlink_send_oper_ifla(drv->link_event_sock, drv->ifindex, 0, IF_OPER_UP); if (drv->link_event_sock >= 0) { eloop_unregister_read_sock(drv->link_event_sock); close(drv->link_event_sock); } eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); (void) hostapd_set_iface_flags(drv, drv->ifname, 0); wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_INFRA); if (drv->ioctl_sock >= 0) close(drv->ioctl_sock); eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle_event)); genl_family_put(drv->nl80211); nl_cache_free(drv->nl_cache); nl_cache_free(drv->nl_cache_event); nl_handle_destroy(drv->nl_handle); nl_handle_destroy(drv->nl_handle_event); nl_cb_put(drv->nl_cb); os_free(drv); } /** * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion * @eloop_ctx: Driver private data * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init() * * This function can be used as registered timeout when starting a scan to * generate a scan completed event if the driver does not report this. */ static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx) { struct wpa_driver_nl80211_data *drv = eloop_ctx; if (drv->ap_scan_as_station) { wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_AP); drv->ap_scan_as_station = 0; } wpa_printf(MSG_DEBUG, "Scan timeout - try to get results"); wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL); } /** * wpa_driver_nl80211_scan - Request the driver to initiate scan * @priv: Pointer to private driver data from wpa_driver_nl80211_init() * @params: Scan parameters * Returns: 0 on success, -1 on failure */ static int wpa_driver_nl80211_scan(void *priv, struct wpa_driver_scan_params *params) { struct wpa_driver_nl80211_data *drv = priv; int ret = 0, timeout; struct nl_msg *msg, *ssids, *freqs; size_t i; msg = nlmsg_alloc(); ssids = nlmsg_alloc(); freqs = nlmsg_alloc(); if (!msg || !ssids || !freqs) { nlmsg_free(msg); nlmsg_free(ssids); nlmsg_free(freqs); return -1; } genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_TRIGGER_SCAN, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); for (i = 0; i < params->num_ssids; i++) { NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len, params->ssids[i].ssid); } if (params->num_ssids) nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids); if (params->extra_ies) { NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len, params->extra_ies); } if (params->freqs) { for (i = 0; params->freqs[i]; i++) NLA_PUT_U32(freqs, i + 1, params->freqs[i]); nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs); } ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d " "(%s)", ret, strerror(-ret)); #ifdef HOSTAPD if (drv->nlmode == NL80211_IFTYPE_AP) { /* * mac80211 does not allow scan requests in AP mode, so * try to do this in station mode. */ if (wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_INFRA)) goto nla_put_failure; if (wpa_driver_nl80211_scan(drv, params)) { wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_AP); goto nla_put_failure; } /* Restore AP mode when processing scan results */ drv->ap_scan_as_station = 1; ret = 0; } else goto nla_put_failure; #else /* HOSTAPD */ goto nla_put_failure; #endif /* HOSTAPD */ } /* Not all drivers generate "scan completed" wireless event, so try to * read results after a timeout. */ timeout = 10; if (drv->scan_complete_events) { /* * The driver seems to deliver events to notify when scan is * complete, so use longer timeout to avoid race conditions * with scanning and following association request. */ timeout = 30; } wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d " "seconds", ret, timeout); eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx); eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout, drv, drv->ctx); nla_put_failure: nlmsg_free(ssids); nlmsg_free(msg); nlmsg_free(freqs); return ret; } static int bss_info_handler(struct nl_msg *msg, void *arg) { struct nlattr *tb[NL80211_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct nlattr *bss[NL80211_BSS_MAX + 1]; static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = { [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC }, [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 }, [NL80211_BSS_TSF] = { .type = NLA_U64 }, [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 }, [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 }, [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC }, [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 }, [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 }, [NL80211_BSS_STATUS] = { .type = NLA_U32 }, [NL80211_BSS_SEEN_MS_AGO] = { .type = NLA_U32 }, }; struct wpa_scan_results *res = arg; struct wpa_scan_res **tmp; struct wpa_scan_res *r; const u8 *ie; size_t ie_len; nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); if (!tb[NL80211_ATTR_BSS]) return NL_SKIP; if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS], bss_policy)) return NL_SKIP; if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) { ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]); ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]); } else { ie = NULL; ie_len = 0; } r = os_zalloc(sizeof(*r) + ie_len); if (r == NULL) return NL_SKIP; if (bss[NL80211_BSS_BSSID]) os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]), ETH_ALEN); if (bss[NL80211_BSS_FREQUENCY]) r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]); if (bss[NL80211_BSS_BEACON_INTERVAL]) r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]); if (bss[NL80211_BSS_CAPABILITY]) r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]); r->flags |= WPA_SCAN_NOISE_INVALID; if (bss[NL80211_BSS_SIGNAL_MBM]) { r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]); r->level /= 100; /* mBm to dBm */ r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID; } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) { r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]); r->flags |= WPA_SCAN_LEVEL_INVALID; } else r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID; if (bss[NL80211_BSS_TSF]) r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]); if (bss[NL80211_BSS_SEEN_MS_AGO]) r->age = nla_get_u32(bss[NL80211_BSS_SEEN_MS_AGO]); r->ie_len = ie_len; if (ie) os_memcpy(r + 1, ie, ie_len); if (bss[NL80211_BSS_STATUS]) { enum nl80211_bss_status status; status = nla_get_u32(bss[NL80211_BSS_STATUS]); switch (status) { case NL80211_BSS_STATUS_AUTHENTICATED: r->flags |= WPA_SCAN_AUTHENTICATED; break; case NL80211_BSS_STATUS_ASSOCIATED: r->flags |= WPA_SCAN_ASSOCIATED; break; default: break; } } tmp = os_realloc(res->res, (res->num + 1) * sizeof(struct wpa_scan_res *)); if (tmp == NULL) { os_free(r); return NL_SKIP; } tmp[res->num++] = r; res->res = tmp; return NL_SKIP; } static void clear_state_mismatch(struct wpa_driver_nl80211_data *drv, const u8 *addr) { if (drv->capa.flags & WPA_DRIVER_FLAGS_SME) { wpa_printf(MSG_DEBUG, "nl80211: Clear possible state " "mismatch"); wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE, WLAN_REASON_PREV_AUTH_NOT_VALID); } } static void wpa_driver_nl80211_check_bss_status( struct wpa_driver_nl80211_data *drv, struct wpa_scan_results *res) { size_t i; for (i = 0; i < res->num; i++) { struct wpa_scan_res *r = res->res[i]; if (r->flags & WPA_SCAN_AUTHENTICATED) { wpa_printf(MSG_DEBUG, "nl80211: Scan results " "indicates BSS status with " MACSTR " as authenticated", MAC2STR(r->bssid)); if (drv->nlmode == NL80211_IFTYPE_STATION && os_memcmp(r->bssid, drv->bssid, ETH_ALEN) != 0 && os_memcmp(r->bssid, drv->auth_bssid, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "nl80211: Unknown BSSID" " in local state (auth=" MACSTR " assoc=" MACSTR ")", MAC2STR(drv->auth_bssid), MAC2STR(drv->bssid)); } } if (r->flags & WPA_SCAN_ASSOCIATED) { wpa_printf(MSG_DEBUG, "nl80211: Scan results " "indicate BSS status with " MACSTR " as associated", MAC2STR(r->bssid)); if (drv->nlmode == NL80211_IFTYPE_STATION && !drv->associated) { wpa_printf(MSG_DEBUG, "nl80211: Local state " "(not associated) does not match " "with BSS state"); clear_state_mismatch(drv, r->bssid); } else if (drv->nlmode == NL80211_IFTYPE_STATION && os_memcmp(drv->bssid, r->bssid, ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, "nl80211: Local state " "(associated with " MACSTR ") does " "not match with BSS state", MAC2STR(drv->bssid)); clear_state_mismatch(drv, r->bssid); clear_state_mismatch(drv, drv->bssid); } } } } /** * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results * @priv: Pointer to private wext data from wpa_driver_nl80211_init() * Returns: Scan results on success, -1 on failure */ static struct wpa_scan_results * wpa_driver_nl80211_get_scan_results(void *priv) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; struct wpa_scan_results *res; int ret; res = os_zalloc(sizeof(*res)); if (res == NULL) return NULL; msg = nlmsg_alloc(); if (!msg) goto nla_put_failure; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP, NL80211_CMD_GET_SCAN, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); ret = send_and_recv_msgs(drv, msg, bss_info_handler, res); msg = NULL; if (ret == 0) { wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)", (unsigned long) res->num); wpa_driver_nl80211_check_bss_status(drv, res); return res; } wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d " "(%s)", ret, strerror(-ret)); nla_put_failure: nlmsg_free(msg); wpa_scan_results_free(res); return NULL; } static int wpa_driver_nl80211_set_key(const char *ifname, void *priv, wpa_alg alg, const u8 *addr, int key_idx, int set_tx, const u8 *seq, size_t seq_len, const u8 *key, size_t key_len) { struct wpa_driver_nl80211_data *drv = priv; int ifindex = if_nametoindex(ifname); struct nl_msg *msg; int ret; wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d " "set_tx=%d seq_len=%lu key_len=%lu", __func__, ifindex, alg, addr, key_idx, set_tx, (unsigned long) seq_len, (unsigned long) key_len); msg = nlmsg_alloc(); if (!msg) return -ENOMEM; if (alg == WPA_ALG_NONE) { genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_DEL_KEY, 0); } else { genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_NEW_KEY, 0); NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key); switch (alg) { case WPA_ALG_WEP: if (key_len == 5) NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP40); else NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP104); break; case WPA_ALG_TKIP: NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP); break; case WPA_ALG_CCMP: NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP); break; case WPA_ALG_IGTK: NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, WLAN_CIPHER_SUITE_AES_CMAC); break; default: wpa_printf(MSG_ERROR, "%s: Unsupported encryption " "algorithm %d", __func__, alg); nlmsg_free(msg); return -1; } } if (seq && seq_len) NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq); if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0) { wpa_printf(MSG_DEBUG, " addr=" MACSTR, MAC2STR(addr)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); } NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret == -ENOENT && alg == WPA_ALG_NONE) ret = 0; if (ret) wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)", ret, strerror(-ret)); /* * If we failed or don't need to set the default TX key (below), * we're done here. */ if (ret || !set_tx || alg == WPA_ALG_NONE) return ret; #ifdef HOSTAPD /* FIX: is this needed? */ if (addr) return ret; #endif /* HOSTAPD */ msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_KEY, 0); NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); if (alg == WPA_ALG_IGTK) NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT); else NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret == -ENOENT) ret = 0; if (ret) wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; " "err=%d %s)", ret, strerror(-ret)); return ret; nla_put_failure: return -ENOBUFS; } static int nl_add_key(struct nl_msg *msg, wpa_alg alg, int key_idx, int defkey, const u8 *seq, size_t seq_len, const u8 *key, size_t key_len) { struct nlattr *key_attr = nla_nest_start(msg, NL80211_ATTR_KEY); if (!key_attr) return -1; if (defkey && alg == WPA_ALG_IGTK) NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT_MGMT); else if (defkey) NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT); NLA_PUT_U8(msg, NL80211_KEY_IDX, key_idx); switch (alg) { case WPA_ALG_WEP: if (key_len == 5) NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP40); else NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP104); break; case WPA_ALG_TKIP: NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_TKIP); break; case WPA_ALG_CCMP: NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_CCMP); break; case WPA_ALG_IGTK: NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_AES_CMAC); break; default: wpa_printf(MSG_ERROR, "%s: Unsupported encryption " "algorithm %d", __func__, alg); return -1; } if (seq && seq_len) NLA_PUT(msg, NL80211_KEY_SEQ, seq_len, seq); NLA_PUT(msg, NL80211_KEY_DATA, key_len, key); nla_nest_end(msg, key_attr); return 0; nla_put_failure: return -1; } static int nl80211_set_conn_keys(struct wpa_driver_associate_params *params, struct nl_msg *msg) { int i, privacy = 0; struct nlattr *nl_keys, *nl_key; for (i = 0; i < 4; i++) { if (!params->wep_key[i]) continue; privacy = 1; break; } if (!privacy) return 0; NLA_PUT_FLAG(msg, NL80211_ATTR_PRIVACY); nl_keys = nla_nest_start(msg, NL80211_ATTR_KEYS); if (!nl_keys) goto nla_put_failure; for (i = 0; i < 4; i++) { if (!params->wep_key[i]) continue; nl_key = nla_nest_start(msg, i); if (!nl_key) goto nla_put_failure; NLA_PUT(msg, NL80211_KEY_DATA, params->wep_key_len[i], params->wep_key[i]); if (params->wep_key_len[i] == 5) NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP40); else NLA_PUT_U32(msg, NL80211_KEY_CIPHER, WLAN_CIPHER_SUITE_WEP104); NLA_PUT_U8(msg, NL80211_KEY_IDX, i); if (i == params->wep_tx_keyidx) NLA_PUT_FLAG(msg, NL80211_KEY_DEFAULT); nla_nest_end(msg, nl_key); } nla_nest_end(msg, nl_keys); return 0; nla_put_failure: return -ENOBUFS; } static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv, const u8 *addr, int cmd, u16 reason_code) { int ret = -1; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " "(%s)", ret, strerror(-ret)); goto nla_put_failure; } ret = 0; nla_put_failure: nlmsg_free(msg); return ret; } static int wpa_driver_nl80211_disconnect(struct wpa_driver_nl80211_data *drv, const u8 *addr, int reason_code) { wpa_printf(MSG_DEBUG, "%s", __func__); drv->associated = 0; return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISCONNECT, reason_code); } static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr, int reason_code) { struct wpa_driver_nl80211_data *drv = priv; if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) return wpa_driver_nl80211_disconnect(drv, addr, reason_code); wpa_printf(MSG_DEBUG, "%s", __func__); drv->associated = 0; return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE, reason_code); } static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr, int reason_code) { struct wpa_driver_nl80211_data *drv = priv; if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) return wpa_driver_nl80211_disconnect(drv, addr, reason_code); wpa_printf(MSG_DEBUG, "%s", __func__); drv->associated = 0; return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE, reason_code); } static int wpa_driver_nl80211_authenticate( void *priv, struct wpa_driver_auth_params *params) { struct wpa_driver_nl80211_data *drv = priv; int ret = -1, i; struct nl_msg *msg; enum nl80211_auth_type type; int count = 0; drv->associated = 0; os_memset(drv->auth_bssid, 0, ETH_ALEN); if (wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_INFRA) < 0) return -1; retry: msg = nlmsg_alloc(); if (!msg) return -1; wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)", drv->ifindex); genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_AUTHENTICATE, 0); for (i = 0; i < 4; i++) { if (!params->wep_key[i]) continue; wpa_driver_nl80211_set_key(drv->ifname, drv, WPA_ALG_WEP, NULL, i, i == params->wep_tx_keyidx, NULL, 0, params->wep_key[i], params->wep_key_len[i]); if (params->wep_tx_keyidx != i) continue; if (nl_add_key(msg, WPA_ALG_WEP, i, 1, NULL, 0, params->wep_key[i], params->wep_key_len[i])) { nlmsg_free(msg); return -1; } } NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (params->bssid) { wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, MAC2STR(params->bssid)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); } if (params->freq) { wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); } if (params->ssid) { wpa_hexdump_ascii(MSG_DEBUG, " * SSID", params->ssid, params->ssid_len); NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid); } wpa_hexdump(MSG_DEBUG, " * IEs", params->ie, params->ie_len); if (params->ie) NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie); /* * TODO: if multiple auth_alg options enabled, try them one by one if * the AP rejects authentication due to unknown auth alg */ if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM) type = NL80211_AUTHTYPE_OPEN_SYSTEM; else if (params->auth_alg & AUTH_ALG_SHARED_KEY) type = NL80211_AUTHTYPE_SHARED_KEY; else if (params->auth_alg & AUTH_ALG_LEAP) type = NL80211_AUTHTYPE_NETWORK_EAP; else if (params->auth_alg & AUTH_ALG_FT) type = NL80211_AUTHTYPE_FT; else goto nla_put_failure; wpa_printf(MSG_DEBUG, " * Auth Type %d", type); NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type); ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " "(%s)", ret, strerror(-ret)); count++; if (ret == -EALREADY && count == 1 && params->bssid) { /* * mac80211 does not currently accept new * authentication if we are already authenticated. As a * workaround, force deauthentication and try again. */ wpa_printf(MSG_DEBUG, "nl80211: Retry authentication " "after forced deauthentication"); wpa_driver_nl80211_deauthenticate( drv, params->bssid, WLAN_REASON_PREV_AUTH_NOT_VALID); nlmsg_free(msg); goto retry; } goto nla_put_failure; } ret = 0; wpa_printf(MSG_DEBUG, "nl80211: Authentication request send " "successfully"); nla_put_failure: nlmsg_free(msg); return ret; } struct phy_info_arg { u16 *num_modes; struct hostapd_hw_modes *modes; }; static int phy_info_handler(struct nl_msg *msg, void *arg) { struct nlattr *tb_msg[NL80211_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct phy_info_arg *phy_info = arg; struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1]; struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1]; static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = { [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 }, [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG }, [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG }, [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG }, [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG }, [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 }, }; struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1]; static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = { [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 }, [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG }, }; struct nlattr *nl_band; struct nlattr *nl_freq; struct nlattr *nl_rate; int rem_band, rem_freq, rem_rate; struct hostapd_hw_modes *mode; int idx, mode_is_set; nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); if (!tb_msg[NL80211_ATTR_WIPHY_BANDS]) return NL_SKIP; nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) { mode = realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode)); if (!mode) return NL_SKIP; phy_info->modes = mode; mode_is_set = 0; mode = &phy_info->modes[*(phy_info->num_modes)]; memset(mode, 0, sizeof(*mode)); *(phy_info->num_modes) += 1; nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band), nla_len(nl_band), NULL); if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) { mode->ht_capab = nla_get_u16( tb_band[NL80211_BAND_ATTR_HT_CAPA]); } if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) { mode->a_mpdu_params |= nla_get_u8( tb_band[NL80211_BAND_ATTR_HT_AMPDU_FACTOR]) & 0x03; } if (tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) { mode->a_mpdu_params |= nla_get_u8( tb_band[NL80211_BAND_ATTR_HT_AMPDU_DENSITY]) << 2; } if (tb_band[NL80211_BAND_ATTR_HT_MCS_SET] && nla_len(tb_band[NL80211_BAND_ATTR_HT_MCS_SET])) { u8 *mcs; mcs = nla_data(tb_band[NL80211_BAND_ATTR_HT_MCS_SET]); os_memcpy(mode->mcs_set, mcs, 16); } nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) { nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq), nla_len(nl_freq), freq_policy); if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ]) continue; mode->num_channels++; } mode->channels = calloc(mode->num_channels, sizeof(struct hostapd_channel_data)); if (!mode->channels) return NL_SKIP; idx = 0; nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) { nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq), nla_len(nl_freq), freq_policy); if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ]) continue; mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]); mode->channels[idx].flag = 0; if (!mode_is_set) { /* crude heuristic */ if (mode->channels[idx].freq < 4000) mode->mode = HOSTAPD_MODE_IEEE80211B; else mode->mode = HOSTAPD_MODE_IEEE80211A; mode_is_set = 1; } /* crude heuristic */ if (mode->channels[idx].freq < 4000) if (mode->channels[idx].freq == 2484) mode->channels[idx].chan = 14; else mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5; else mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000; if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED]) mode->channels[idx].flag |= HOSTAPD_CHAN_DISABLED; if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN]) mode->channels[idx].flag |= HOSTAPD_CHAN_PASSIVE_SCAN; if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS]) mode->channels[idx].flag |= HOSTAPD_CHAN_NO_IBSS; if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR]) mode->channels[idx].flag |= HOSTAPD_CHAN_RADAR; if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] && !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED]) mode->channels[idx].max_tx_power = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100; idx++; } nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) { nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate), nla_len(nl_rate), rate_policy); if (!tb_rate[NL80211_BITRATE_ATTR_RATE]) continue; mode->num_rates++; } mode->rates = calloc(mode->num_rates, sizeof(int)); if (!mode->rates) return NL_SKIP; idx = 0; nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) { nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate), nla_len(nl_rate), rate_policy); if (!tb_rate[NL80211_BITRATE_ATTR_RATE]) continue; mode->rates[idx] = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]); /* crude heuristic */ if (mode->mode == HOSTAPD_MODE_IEEE80211B && mode->rates[idx] > 200) mode->mode = HOSTAPD_MODE_IEEE80211G; idx++; } } return NL_SKIP; } static struct hostapd_hw_modes * wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes) { u16 m; struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode; int i, mode11g_idx = -1; /* If only 802.11g mode is included, use it to construct matching * 802.11b mode data. */ for (m = 0; m < *num_modes; m++) { if (modes[m].mode == HOSTAPD_MODE_IEEE80211B) return modes; /* 802.11b already included */ if (modes[m].mode == HOSTAPD_MODE_IEEE80211G) mode11g_idx = m; } if (mode11g_idx < 0) return modes; /* 2.4 GHz band not supported at all */ nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes)); if (nmodes == NULL) return modes; /* Could not add 802.11b mode */ mode = &nmodes[*num_modes]; os_memset(mode, 0, sizeof(*mode)); (*num_modes)++; modes = nmodes; mode->mode = HOSTAPD_MODE_IEEE80211B; mode11g = &modes[mode11g_idx]; mode->num_channels = mode11g->num_channels; mode->channels = os_malloc(mode11g->num_channels * sizeof(struct hostapd_channel_data)); if (mode->channels == NULL) { (*num_modes)--; return modes; /* Could not add 802.11b mode */ } os_memcpy(mode->channels, mode11g->channels, mode11g->num_channels * sizeof(struct hostapd_channel_data)); mode->num_rates = 0; mode->rates = os_malloc(4 * sizeof(int)); if (mode->rates == NULL) { os_free(mode->channels); (*num_modes)--; return modes; /* Could not add 802.11b mode */ } for (i = 0; i < mode11g->num_rates; i++) { if (mode11g->rates[i] != 10 && mode11g->rates[i] != 20 && mode11g->rates[i] != 55 && mode11g->rates[i] != 110) continue; mode->rates[mode->num_rates] = mode11g->rates[i]; mode->num_rates++; if (mode->num_rates == 4) break; } if (mode->num_rates == 0) { os_free(mode->channels); os_free(mode->rates); (*num_modes)--; return modes; /* No 802.11b rates */ } wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g " "information"); return modes; } static struct hostapd_hw_modes * wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; struct phy_info_arg result = { .num_modes = num_modes, .modes = NULL, }; *num_modes = 0; *flags = 0; msg = nlmsg_alloc(); if (!msg) return NULL; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_GET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0) return wpa_driver_nl80211_add_11b(result.modes, num_modes); nla_put_failure: return NULL; } static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv, const void *data, size_t len, int encrypt) { __u8 rtap_hdr[] = { 0x00, 0x00, /* radiotap version */ 0x0e, 0x00, /* radiotap length */ 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */ IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */ 0x00, /* padding */ 0x00, 0x00, /* RX and TX flags to indicate that */ 0x00, 0x00, /* this is the injected frame directly */ }; struct iovec iov[2] = { { .iov_base = &rtap_hdr, .iov_len = sizeof(rtap_hdr), }, { .iov_base = (void *) data, .iov_len = len, } }; struct msghdr msg = { .msg_name = NULL, .msg_namelen = 0, .msg_iov = iov, .msg_iovlen = 2, .msg_control = NULL, .msg_controllen = 0, .msg_flags = 0, }; if (encrypt) rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP; return sendmsg(drv->monitor_sock, &msg, 0); } static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data, size_t data_len) { struct wpa_driver_nl80211_data *drv = priv; struct ieee80211_mgmt *mgmt; int encrypt = 1; u16 fc; mgmt = (struct ieee80211_mgmt *) data; fc = le_to_host16(mgmt->frame_control); if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT && WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) { /* * Only one of the authentication frame types is encrypted. * In order for static WEP encryption to work properly (i.e., * to not encrypt the frame), we need to tell mac80211 about * the frames that must not be encrypted. */ u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg); u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction); if (auth_alg != WLAN_AUTH_SHARED_KEY || auth_trans != 3) encrypt = 0; } return wpa_driver_nl80211_send_frame(drv, data, data_len, encrypt); } static int wpa_driver_nl80211_set_beacon(const char *ifname, void *priv, const u8 *head, size_t head_len, const u8 *tail, size_t tail_len, int dtim_period, int beacon_int) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; u8 cmd = NL80211_CMD_NEW_BEACON; int ret; int beacon_set; int ifindex = if_nametoindex(ifname); #ifdef HOSTAPD struct i802_bss *bss; bss = get_bss(drv, ifindex); if (bss == NULL) return -ENOENT; beacon_set = bss->beacon_set; #else /* HOSTAPD */ beacon_set = drv->beacon_set; #endif /* HOSTAPD */ msg = nlmsg_alloc(); if (!msg) return -ENOMEM; wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)", beacon_set); if (beacon_set) cmd = NL80211_CMD_SET_BEACON; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0); NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head); NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, beacon_int); NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret) { wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)", ret, strerror(-ret)); } else { #ifdef HOSTAPD bss->beacon_set = 1; #else /* HOSTAPD */ drv->beacon_set = 1; #endif /* HOSTAPD */ } return ret; nla_put_failure: return -ENOBUFS; } static int wpa_driver_nl80211_set_freq(struct wpa_driver_nl80211_data *drv, int freq, int ht_enabled, int sec_channel_offset) { struct nl_msg *msg; int ret; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq); if (ht_enabled) { switch (sec_channel_offset) { case -1: NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, NL80211_CHAN_HT40MINUS); break; case 1: NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, NL80211_CHAN_HT40PLUS); break; default: NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE, NL80211_CHAN_HT20); break; } } ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret == 0) return 0; wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): " "%d (%s)", freq, ret, strerror(-ret)); nla_put_failure: return -1; } static int wpa_driver_nl80211_sta_add(const char *ifname, void *priv, struct hostapd_sta_add_params *params) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; int ret = -ENOBUFS; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_NEW_STATION, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(ifname)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr); NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid); NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len, params->supp_rates); NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL, params->listen_interval); if (params->ht_capabilities) { NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY, sizeof(*params->ht_capabilities), params->ht_capabilities); } ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret) wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION " "result: %d (%s)", ret, strerror(-ret)); if (ret == -EEXIST) ret = 0; nla_put_failure: return ret; } static int wpa_driver_nl80211_sta_remove(void *priv, const u8 *addr) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; int ret; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_DEL_STATION, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret == -ENOENT) return 0; return ret; nla_put_failure: return -ENOBUFS; } static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv, int ifidx) { struct nl_msg *msg; #ifdef HOSTAPD /* stop listening for EAPOL on this interface */ del_ifidx(drv, ifidx); #endif /* HOSTAPD */ msg = nlmsg_alloc(); if (!msg) goto nla_put_failure; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_DEL_INTERFACE, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx); if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0) return; nla_put_failure: wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d).\n", ifidx); } static int nl80211_create_iface_once(struct wpa_driver_nl80211_data *drv, const char *ifname, enum nl80211_iftype iftype, const u8 *addr) { struct nl_msg *msg, *flags = NULL; int ifidx; int ret = -ENOBUFS; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_NEW_INTERFACE, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname); NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype); if (iftype == NL80211_IFTYPE_MONITOR) { int err; flags = nlmsg_alloc(); if (!flags) goto nla_put_failure; NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES); err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags); nlmsg_free(flags); if (err) goto nla_put_failure; } ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (ret) { nla_put_failure: wpa_printf(MSG_ERROR, "Failed to create interface %s: %d (%s)", ifname, ret, strerror(-ret)); return ret; } ifidx = if_nametoindex(ifname); if (ifidx <= 0) return -1; #ifdef HOSTAPD /* start listening for EAPOL on this interface */ add_ifidx(drv, ifidx); if (addr && iftype == NL80211_IFTYPE_AP && set_ifhwaddr(drv, ifname, addr)) { nl80211_remove_iface(drv, ifidx); return -1; } #endif /* HOSTAPD */ return ifidx; } static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv, const char *ifname, enum nl80211_iftype iftype, const u8 *addr) { int ret; ret = nl80211_create_iface_once(drv, ifname, iftype, addr); /* if error occured and interface exists already */ if (ret == -ENFILE && if_nametoindex(ifname)) { wpa_printf(MSG_INFO, "Try to remove and re-create %s", ifname); /* Try to remove the interface that was already there. */ nl80211_remove_iface(drv, if_nametoindex(ifname)); /* Try to create the interface again */ ret = nl80211_create_iface_once(drv, ifname, iftype, addr); } return ret; } static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok) { struct ieee80211_hdr *hdr; u16 fc; union wpa_event_data event; hdr = (struct ieee80211_hdr *) buf; fc = le_to_host16(hdr->frame_control); os_memset(&event, 0, sizeof(event)); event.tx_status.type = WLAN_FC_GET_TYPE(fc); event.tx_status.stype = WLAN_FC_GET_STYPE(fc); event.tx_status.dst = hdr->addr1; event.tx_status.data = buf; event.tx_status.data_len = len; event.tx_status.ack = ok; wpa_supplicant_event(ctx, EVENT_TX_STATUS, &event); } static void from_unknown_sta(struct wpa_driver_nl80211_data *drv, struct ieee80211_hdr *hdr, size_t len) { union wpa_event_data event; os_memset(&event, 0, sizeof(event)); event.rx_from_unknown.hdr = hdr; event.rx_from_unknown.len = len; wpa_supplicant_event(drv->ctx, EVENT_RX_FROM_UNKNOWN, &event); } static void handle_frame(struct wpa_driver_nl80211_data *drv, u8 *buf, size_t len, struct hostapd_frame_info *hfi) { struct ieee80211_hdr *hdr; u16 fc; union wpa_event_data event; hdr = (struct ieee80211_hdr *) buf; fc = le_to_host16(hdr->frame_control); switch (WLAN_FC_GET_TYPE(fc)) { case WLAN_FC_TYPE_MGMT: os_memset(&event, 0, sizeof(event)); event.rx_mgmt.frame = buf; event.rx_mgmt.frame_len = len; event.rx_mgmt.fi = hfi; wpa_supplicant_event(drv->ctx, EVENT_RX_MGMT, &event); break; case WLAN_FC_TYPE_CTRL: /* can only get here with PS-Poll frames */ wpa_printf(MSG_DEBUG, "CTRL"); from_unknown_sta(drv, hdr, len); break; case WLAN_FC_TYPE_DATA: from_unknown_sta(drv, hdr, len); break; } } static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx) { struct wpa_driver_nl80211_data *drv = eloop_ctx; int len; unsigned char buf[3000]; struct ieee80211_radiotap_iterator iter; int ret; struct hostapd_frame_info hfi; int injected = 0, failed = 0, rxflags = 0; len = recv(sock, buf, sizeof(buf), 0); if (len < 0) { perror("recv"); return; } if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) { printf("received invalid radiotap frame\n"); return; } memset(&hfi, 0, sizeof(hfi)); while (1) { ret = ieee80211_radiotap_iterator_next(&iter); if (ret == -ENOENT) break; if (ret) { printf("received invalid radiotap frame (%d)\n", ret); return; } switch (iter.this_arg_index) { case IEEE80211_RADIOTAP_FLAGS: if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS) len -= 4; break; case IEEE80211_RADIOTAP_RX_FLAGS: rxflags = 1; break; case IEEE80211_RADIOTAP_TX_FLAGS: injected = 1; failed = le_to_host16((*(uint16_t *) iter.this_arg)) & IEEE80211_RADIOTAP_F_TX_FAIL; break; case IEEE80211_RADIOTAP_DATA_RETRIES: break; case IEEE80211_RADIOTAP_CHANNEL: /* TODO convert from freq/flags to channel number hfi.channel = XXX; */ break; case IEEE80211_RADIOTAP_RATE: hfi.datarate = *iter.this_arg * 5; break; case IEEE80211_RADIOTAP_DB_ANTSIGNAL: hfi.ssi_signal = *iter.this_arg; break; } } if (rxflags && injected) return; if (!injected) handle_frame(drv, buf + iter.max_length, len - iter.max_length, &hfi); else handle_tx_callback(drv->ctx, buf + iter.max_length, len - iter.max_length, !failed); } /* * we post-process the filter code later and rewrite * this to the offset to the last instruction */ #define PASS 0xFF #define FAIL 0xFE static struct sock_filter msock_filter_insns[] = { /* * do a little-endian load of the radiotap length field */ /* load lower byte into A */ BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 2), /* put it into X (== index register) */ BPF_STMT(BPF_MISC| BPF_TAX, 0), /* load upper byte into A */ BPF_STMT(BPF_LD | BPF_B | BPF_ABS, 3), /* left-shift it by 8 */ BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8), /* or with X */ BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0), /* put result into X */ BPF_STMT(BPF_MISC| BPF_TAX, 0), /* * Allow management frames through, this also gives us those * management frames that we sent ourselves with status */ /* load the lower byte of the IEEE 802.11 frame control field */ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), /* mask off frame type and version */ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF), /* accept frame if it's both 0, fall through otherwise */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0), /* * TODO: add a bit to radiotap RX flags that indicates * that the sending station is not associated, then * add a filter here that filters on our DA and that flag * to allow us to deauth frames to that bad station. * * Not a regression -- we didn't do it before either. */ #if 0 /* * drop non-data frames, WDS frames */ /* load the lower byte of the frame control field */ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), /* mask off QoS bit */ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x0c), /* drop non-data frames */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 8, 0, FAIL), /* load the upper byte of the frame control field */ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), /* mask off toDS/fromDS */ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x03), /* drop WDS frames */ BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 3, FAIL, 0), #endif /* * add header length to index */ /* load the lower byte of the frame control field */ BPF_STMT(BPF_LD | BPF_B | BPF_IND, 0), /* mask off QoS bit */ BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0x80), /* right shift it by 6 to give 0 or 2 */ BPF_STMT(BPF_ALU | BPF_RSH | BPF_K, 6), /* add data frame header length */ BPF_STMT(BPF_ALU | BPF_ADD | BPF_K, 24), /* add index, was start of 802.11 header */ BPF_STMT(BPF_ALU | BPF_ADD | BPF_X, 0), /* move to index, now start of LL header */ BPF_STMT(BPF_MISC | BPF_TAX, 0), /* * Accept empty data frames, we use those for * polling activity. */ BPF_STMT(BPF_LD | BPF_W | BPF_LEN, 0), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0), /* * Accept EAPOL frames */ BPF_STMT(BPF_LD | BPF_W | BPF_IND, 0), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL), BPF_STMT(BPF_LD | BPF_W | BPF_IND, 4), BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL), /* keep these last two statements or change the code below */ /* return 0 == "DROP" */ BPF_STMT(BPF_RET | BPF_K, 0), /* return ~0 == "keep all" */ BPF_STMT(BPF_RET | BPF_K, ~0), }; static struct sock_fprog msock_filter = { .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]), .filter = msock_filter_insns, }; static int add_monitor_filter(int s) { int idx; /* rewrite all PASS/FAIL jump offsets */ for (idx = 0; idx < msock_filter.len; idx++) { struct sock_filter *insn = &msock_filter_insns[idx]; if (BPF_CLASS(insn->code) == BPF_JMP) { if (insn->code == (BPF_JMP|BPF_JA)) { if (insn->k == PASS) insn->k = msock_filter.len - idx - 2; else if (insn->k == FAIL) insn->k = msock_filter.len - idx - 3; } if (insn->jt == PASS) insn->jt = msock_filter.len - idx - 2; else if (insn->jt == FAIL) insn->jt = msock_filter.len - idx - 3; if (insn->jf == PASS) insn->jf = msock_filter.len - idx - 2; else if (insn->jf == FAIL) insn->jf = msock_filter.len - idx - 3; } } if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER, &msock_filter, sizeof(msock_filter))) { perror("SO_ATTACH_FILTER"); return -1; } return 0; } static void nl80211_remove_monitor_interface( struct wpa_driver_nl80211_data *drv) { if (drv->monitor_ifidx >= 0) { nl80211_remove_iface(drv, drv->monitor_ifidx); drv->monitor_ifidx = -1; } } static int nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv) { char buf[IFNAMSIZ]; struct sockaddr_ll ll; int optval; socklen_t optlen; snprintf(buf, IFNAMSIZ, "mon.%s", drv->ifname); buf[IFNAMSIZ - 1] = '\0'; drv->monitor_ifidx = nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL); if (drv->monitor_ifidx < 0) return -1; if (hostapd_set_iface_flags(drv, buf, 1)) goto error; memset(&ll, 0, sizeof(ll)); ll.sll_family = AF_PACKET; ll.sll_ifindex = drv->monitor_ifidx; drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL)); if (drv->monitor_sock < 0) { perror("socket[PF_PACKET,SOCK_RAW]"); goto error; } if (add_monitor_filter(drv->monitor_sock)) { wpa_printf(MSG_INFO, "Failed to set socket filter for monitor " "interface; do filtering in user space"); /* This works, but will cost in performance. */ } if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) { perror("monitor socket bind"); goto error; } optlen = sizeof(optval); optval = 20; if (setsockopt (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) { perror("Failed to set socket priority"); goto error; } if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read, drv, NULL)) { printf("Could not register monitor read socket\n"); goto error; } return 0; error: nl80211_remove_monitor_interface(drv); return -1; } static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 }; static int wpa_driver_nl80211_hapd_send_eapol( void *priv, const u8 *addr, const u8 *data, size_t data_len, int encrypt, const u8 *own_addr) { struct wpa_driver_nl80211_data *drv = priv; struct ieee80211_hdr *hdr; size_t len; u8 *pos; int res; #if 0 /* FIX */ int qos = sta->flags & WPA_STA_WMM; #else int qos = 0; #endif len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 + data_len; hdr = os_zalloc(len); if (hdr == NULL) { printf("malloc() failed for i802_send_data(len=%lu)\n", (unsigned long) len); return -1; } hdr->frame_control = IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA); hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS); if (encrypt) hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP); #if 0 /* To be enabled if qos determination is added above */ if (qos) { hdr->frame_control |= host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4); } #endif memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN); memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN); memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN); pos = (u8 *) (hdr + 1); #if 0 /* To be enabled if qos determination is added above */ if (qos) { /* add an empty QoS header if needed */ pos[0] = 0; pos[1] = 0; pos += 2; } #endif memcpy(pos, rfc1042_header, sizeof(rfc1042_header)); pos += sizeof(rfc1042_header); WPA_PUT_BE16(pos, ETH_P_PAE); pos += 2; memcpy(pos, data, data_len); res = wpa_driver_nl80211_send_frame(drv, (u8 *) hdr, len, encrypt); if (res < 0) { wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - " "failed: %d (%s)", (unsigned long) len, errno, strerror(errno)); } free(hdr); return res; } static u32 sta_flags_nl80211(int flags) { u32 f = 0; if (flags & WPA_STA_AUTHORIZED) f |= BIT(NL80211_STA_FLAG_AUTHORIZED); if (flags & WPA_STA_WMM) f |= BIT(NL80211_STA_FLAG_WME); if (flags & WPA_STA_SHORT_PREAMBLE) f |= BIT(NL80211_STA_FLAG_SHORT_PREAMBLE); if (flags & WPA_STA_MFP) f |= BIT(NL80211_STA_FLAG_MFP); return f; } static int wpa_driver_nl80211_sta_set_flags(void *priv, const u8 *addr, int total_flags, int flags_or, int flags_and) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg, *flags = NULL; struct nl80211_sta_flag_update upd; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; flags = nlmsg_alloc(); if (!flags) { nlmsg_free(msg); return -ENOMEM; } genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_STATION, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); /* * Backwards compatibility version using NL80211_ATTR_STA_FLAGS. This * can be removed eventually. */ if (total_flags & WPA_STA_AUTHORIZED) NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED); if (total_flags & WPA_STA_WMM) NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME); if (total_flags & WPA_STA_SHORT_PREAMBLE) NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE); if (total_flags & WPA_STA_MFP) NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP); if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags)) goto nla_put_failure; os_memset(&upd, 0, sizeof(upd)); upd.mask = sta_flags_nl80211(flags_or | ~flags_and); upd.set = sta_flags_nl80211(flags_or); NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd); nlmsg_free(flags); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: nlmsg_free(flags); return -ENOBUFS; } static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv, struct wpa_driver_associate_params *params) { if (wpa_driver_nl80211_set_mode(drv, params->mode) || wpa_driver_nl80211_set_freq(drv, params->freq, 0, 0)) { nl80211_remove_monitor_interface(drv); return -1; } /* TODO: setup monitor interface (and add code somewhere to remove this * when AP mode is stopped; associate with mode != 2 or drv_deinit) */ return 0; } static int nl80211_leave_ibss(struct wpa_driver_nl80211_data *drv) { struct nl_msg *msg; int ret = -1; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_LEAVE_IBSS, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS failed: ret=%d " "(%s)", ret, strerror(-ret)); goto nla_put_failure; } ret = 0; wpa_printf(MSG_DEBUG, "nl80211: Leave IBSS request sent successfully"); nla_put_failure: nlmsg_free(msg); return ret; } static int wpa_driver_nl80211_ibss(struct wpa_driver_nl80211_data *drv, struct wpa_driver_associate_params *params) { struct nl_msg *msg; int ret = -1; int count = 0; wpa_printf(MSG_DEBUG, "nl80211: Join IBSS (ifindex=%d)", drv->ifindex); if (wpa_driver_nl80211_set_mode(drv, params->mode)) { wpa_printf(MSG_INFO, "nl80211: Failed to set interface into " "IBSS mode"); return -1; } retry: msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_JOIN_IBSS, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (params->ssid == NULL || params->ssid_len > sizeof(drv->ssid)) goto nla_put_failure; wpa_hexdump_ascii(MSG_DEBUG, " * SSID", params->ssid, params->ssid_len); NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid); os_memcpy(drv->ssid, params->ssid, params->ssid_len); drv->ssid_len = params->ssid_len; wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); ret = nl80211_set_conn_keys(params, msg); if (ret) goto nla_put_failure; if (params->wpa_ie) { wpa_hexdump(MSG_DEBUG, " * Extra IEs for Beacon/Probe Response frames", params->wpa_ie, params->wpa_ie_len); NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie); } ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: Join IBSS failed: ret=%d (%s)", ret, strerror(-ret)); count++; if (ret == -EALREADY && count == 1) { wpa_printf(MSG_DEBUG, "nl80211: Retry IBSS join after " "forced leave"); nl80211_leave_ibss(drv); nlmsg_free(msg); goto retry; } goto nla_put_failure; } ret = 0; wpa_printf(MSG_DEBUG, "nl80211: Join IBSS request sent successfully"); nla_put_failure: nlmsg_free(msg); return ret; } static int wpa_driver_nl80211_connect( struct wpa_driver_nl80211_data *drv, struct wpa_driver_associate_params *params) { struct nl_msg *msg; enum nl80211_auth_type type; int ret = 0; msg = nlmsg_alloc(); if (!msg) return -1; wpa_printf(MSG_DEBUG, "nl80211: Connect (ifindex=%d)", drv->ifindex); genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_CONNECT, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (params->bssid) { wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, MAC2STR(params->bssid)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); } if (params->freq) { wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); } if (params->ssid) { wpa_hexdump_ascii(MSG_DEBUG, " * SSID", params->ssid, params->ssid_len); NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid); if (params->ssid_len > sizeof(drv->ssid)) goto nla_put_failure; os_memcpy(drv->ssid, params->ssid, params->ssid_len); drv->ssid_len = params->ssid_len; } wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len); if (params->wpa_ie) NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie); if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM) type = NL80211_AUTHTYPE_OPEN_SYSTEM; else if (params->auth_alg & AUTH_ALG_SHARED_KEY) type = NL80211_AUTHTYPE_SHARED_KEY; else if (params->auth_alg & AUTH_ALG_LEAP) type = NL80211_AUTHTYPE_NETWORK_EAP; else if (params->auth_alg & AUTH_ALG_FT) type = NL80211_AUTHTYPE_FT; else goto nla_put_failure; wpa_printf(MSG_DEBUG, " * Auth Type %d", type); NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type); if (params->wpa_ie && params->wpa_ie_len) { enum nl80211_wpa_versions ver; if (params->wpa_ie[0] == WLAN_EID_RSN) ver = NL80211_WPA_VERSION_2; else ver = NL80211_WPA_VERSION_1; wpa_printf(MSG_DEBUG, " * WPA Version %d", ver); NLA_PUT_U32(msg, NL80211_ATTR_WPA_VERSIONS, ver); } if (params->pairwise_suite != CIPHER_NONE) { int cipher; switch (params->pairwise_suite) { case CIPHER_WEP40: cipher = WLAN_CIPHER_SUITE_WEP40; break; case CIPHER_WEP104: cipher = WLAN_CIPHER_SUITE_WEP104; break; case CIPHER_CCMP: cipher = WLAN_CIPHER_SUITE_CCMP; break; case CIPHER_TKIP: default: cipher = WLAN_CIPHER_SUITE_TKIP; break; } NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITES_PAIRWISE, cipher); } if (params->group_suite != CIPHER_NONE) { int cipher; switch (params->group_suite) { case CIPHER_WEP40: cipher = WLAN_CIPHER_SUITE_WEP40; break; case CIPHER_WEP104: cipher = WLAN_CIPHER_SUITE_WEP104; break; case CIPHER_CCMP: cipher = WLAN_CIPHER_SUITE_CCMP; break; case CIPHER_TKIP: default: cipher = WLAN_CIPHER_SUITE_TKIP; break; } NLA_PUT_U32(msg, NL80211_ATTR_CIPHER_SUITE_GROUP, cipher); } if (params->key_mgmt_suite == KEY_MGMT_802_1X || params->key_mgmt_suite == KEY_MGMT_PSK) { int mgmt = WLAN_AKM_SUITE_PSK; switch (params->key_mgmt_suite) { case KEY_MGMT_802_1X: mgmt = WLAN_AKM_SUITE_8021X; break; case KEY_MGMT_PSK: default: mgmt = WLAN_AKM_SUITE_PSK; break; } NLA_PUT_U32(msg, NL80211_ATTR_AKM_SUITES, mgmt); } ret = nl80211_set_conn_keys(params, msg); if (ret) goto nla_put_failure; ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: MLME connect failed: ret=%d " "(%s)", ret, strerror(-ret)); goto nla_put_failure; } ret = 0; wpa_printf(MSG_DEBUG, "nl80211: Connect request send successfully"); nla_put_failure: nlmsg_free(msg); return ret; } static int wpa_driver_nl80211_associate( void *priv, struct wpa_driver_associate_params *params) { struct wpa_driver_nl80211_data *drv = priv; int ret = -1; struct nl_msg *msg; if (params->mode == IEEE80211_MODE_AP) return wpa_driver_nl80211_ap(drv, params); if (params->mode == IEEE80211_MODE_IBSS) return wpa_driver_nl80211_ibss(drv, params); if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) { if (wpa_driver_nl80211_set_mode(drv, params->mode) < 0) return -1; return wpa_driver_nl80211_connect(drv, params); } drv->associated = 0; msg = nlmsg_alloc(); if (!msg) return -1; wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)", drv->ifindex); genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_ASSOCIATE, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); if (params->bssid) { wpa_printf(MSG_DEBUG, " * bssid=" MACSTR, MAC2STR(params->bssid)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid); } if (params->freq) { wpa_printf(MSG_DEBUG, " * freq=%d", params->freq); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq); } if (params->ssid) { wpa_hexdump_ascii(MSG_DEBUG, " * SSID", params->ssid, params->ssid_len); NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len, params->ssid); if (params->ssid_len > sizeof(drv->ssid)) goto nla_put_failure; os_memcpy(drv->ssid, params->ssid, params->ssid_len); drv->ssid_len = params->ssid_len; } wpa_hexdump(MSG_DEBUG, " * IEs", params->wpa_ie, params->wpa_ie_len); if (params->wpa_ie) NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len, params->wpa_ie); #ifdef CONFIG_IEEE80211W if (params->mgmt_frame_protection == MGMT_FRAME_PROTECTION_REQUIRED) NLA_PUT_U32(msg, NL80211_ATTR_USE_MFP, NL80211_MFP_REQUIRED); #endif /* CONFIG_IEEE80211W */ NLA_PUT_FLAG(msg, NL80211_ATTR_CONTROL_PORT); if (params->prev_bssid) { wpa_printf(MSG_DEBUG, " * prev_bssid=" MACSTR, MAC2STR(params->prev_bssid)); NLA_PUT(msg, NL80211_ATTR_PREV_BSSID, ETH_ALEN, params->prev_bssid); } ret = send_and_recv_msgs(drv, msg, NULL, NULL); msg = NULL; if (ret) { wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d " "(%s)", ret, strerror(-ret)); goto nla_put_failure; } ret = 0; wpa_printf(MSG_DEBUG, "nl80211: Association request send " "successfully"); nla_put_failure: nlmsg_free(msg); return ret; } static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv, int ifindex, int mode) { struct nl_msg *msg; int ret = -ENOBUFS; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_INTERFACE, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex); NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (!ret) return 0; nla_put_failure: wpa_printf(MSG_DEBUG, "nl80211: Failed to set interface %d to mode %d:" " %d (%s)", ifindex, mode, ret, strerror(-ret)); return ret; } static int wpa_driver_nl80211_set_mode(void *priv, int mode) { struct wpa_driver_nl80211_data *drv = priv; int ret = -1; int nlmode; switch (mode) { case 0: nlmode = NL80211_IFTYPE_STATION; break; case 1: nlmode = NL80211_IFTYPE_ADHOC; break; case 2: nlmode = NL80211_IFTYPE_AP; break; default: return -1; } if (nl80211_set_mode(drv, drv->ifindex, nlmode) == 0) { drv->nlmode = nlmode; ret = 0; goto done; } if (nlmode == drv->nlmode) { ret = 0; goto done; /* Already in the requested mode */ } /* mac80211 doesn't allow mode changes while the device is up, so * take the device down, try to set the mode again, and bring the * device back up. */ if (hostapd_set_iface_flags(drv, drv->ifname, 0) == 0) { /* Try to set the mode again while the interface is down */ ret = nl80211_set_mode(drv, drv->ifindex, nlmode); if (hostapd_set_iface_flags(drv, drv->ifname, 1)) ret = -1; } if (!ret) drv->nlmode = nlmode; done: if (!ret && nlmode == NL80211_IFTYPE_AP) { /* Setup additional AP mode functionality if needed */ if (drv->monitor_ifidx < 0 && nl80211_create_monitor_interface(drv)) return -1; } else if (!ret && nlmode != NL80211_IFTYPE_AP) { /* Remove additional AP mode functionality */ nl80211_remove_monitor_interface(drv); } return ret; } static int wpa_driver_nl80211_get_capa(void *priv, struct wpa_driver_capa *capa) { struct wpa_driver_nl80211_data *drv = priv; if (!drv->has_capability) return -1; os_memcpy(capa, &drv->capa, sizeof(*capa)); return 0; } static int wpa_driver_nl80211_set_operstate(void *priv, int state) { struct wpa_driver_nl80211_data *drv = priv; wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)", __func__, drv->operstate, state, state ? "UP" : "DORMANT"); drv->operstate = state; return netlink_send_oper_ifla(drv->link_event_sock, drv->ifindex, -1, state ? IF_OPER_UP : IF_OPER_DORMANT); } static int wpa_driver_nl80211_set_supp_port(void *priv, int authorized) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; struct nl80211_sta_flag_update upd; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_STATION, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, drv->bssid); os_memset(&upd, 0, sizeof(upd)); upd.mask = BIT(NL80211_STA_FLAG_AUTHORIZED); if (authorized) upd.set = BIT(NL80211_STA_FLAG_AUTHORIZED); NLA_PUT(msg, NL80211_ATTR_STA_FLAGS2, sizeof(upd), &upd); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } #ifdef HOSTAPD static struct i802_bss * get_bss(struct wpa_driver_nl80211_data *drv, int ifindex) { struct i802_bss *bss = &drv->bss; while (bss) { if (ifindex == bss->ifindex) return bss; bss = bss->next; } wpa_printf(MSG_DEBUG, "nl80211: get_bss(%d) failed", ifindex); return NULL; } static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) { int i; int *old; wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d", ifidx); for (i = 0; i < drv->num_if_indices; i++) { if (drv->if_indices[i] == 0) { drv->if_indices[i] = ifidx; return; } } if (drv->if_indices != drv->default_if_indices) old = drv->if_indices; else old = NULL; drv->if_indices = realloc(old, sizeof(int) * (drv->num_if_indices + 1)); if (!drv->if_indices) { if (!old) drv->if_indices = drv->default_if_indices; else drv->if_indices = old; wpa_printf(MSG_ERROR, "Failed to reallocate memory for " "interfaces"); wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx); return; } drv->if_indices[drv->num_if_indices] = ifidx; drv->num_if_indices++; } static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) { int i; for (i = 0; i < drv->num_if_indices; i++) { if (drv->if_indices[i] == ifidx) { drv->if_indices[i] = 0; break; } } } static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx) { int i; for (i = 0; i < drv->num_if_indices; i++) if (drv->if_indices[i] == ifidx) return 1; return 0; } static inline int min_int(int a, int b) { if (a < b) return a; return b; } static int get_key_handler(struct nl_msg *msg, void *arg) { struct nlattr *tb[NL80211_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); /* * TODO: validate the key index and mac address! * Otherwise, there's a race condition as soon as * the kernel starts sending key notifications. */ if (tb[NL80211_ATTR_KEY_SEQ]) memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]), min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6)); return NL_SKIP; } static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr, int idx, u8 *seq) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_GET_KEY, 0); if (addr) NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface)); memset(seq, 0, 6); return send_and_recv_msgs(drv, msg, get_key_handler, seq); nla_put_failure: return -ENOBUFS; } static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates, int mode) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; u8 rates[NL80211_MAX_SUPP_RATES]; u8 rates_len = 0; int i; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_BSS, 0); for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++) rates[rates_len++] = basic_rates[i] / 5; NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates); /* TODO: multi-BSS support */ NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } /* Set kernel driver on given frequency (MHz) */ static int i802_set_freq(void *priv, struct hostapd_freq_params *freq) { struct wpa_driver_nl80211_data *drv = priv; return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled, freq->sec_channel_offset); } static int i802_set_rts(void *priv, int rts) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; int ret = -ENOBUFS; u32 val; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; if (rts >= 2347) val = (u32) -1; else val = rts; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD, val); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (!ret) return 0; nla_put_failure: wpa_printf(MSG_DEBUG, "nl80211: Failed to set RTS threshold %d: " "%d (%s)", rts, ret, strerror(-ret)); return ret; } static int i802_set_frag(void *priv, int frag) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; int ret = -ENOBUFS; u32 val; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; if (frag >= 2346) val = (u32) -1; else val = frag; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex); NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD, val); ret = send_and_recv_msgs(drv, msg, NULL, NULL); if (!ret) return 0; nla_put_failure: wpa_printf(MSG_DEBUG, "nl80211: Failed to set fragmentation threshold " "%d: %d (%s)", frag, ret, strerror(-ret)); return ret; } static int i802_flush(void *priv) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_DEL_STATION, 0); /* * XXX: FIX! this needs to flush all VLANs too */ NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } static int get_sta_handler(struct nl_msg *msg, void *arg) { struct nlattr *tb[NL80211_ATTR_MAX + 1]; struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg)); struct hostap_sta_driver_data *data = arg; struct nlattr *stats[NL80211_STA_INFO_MAX + 1]; static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = { [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 }, [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 }, [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 }, [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 }, [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 }, }; nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0), genlmsg_attrlen(gnlh, 0), NULL); /* * TODO: validate the interface and mac address! * Otherwise, there's a race condition as soon as * the kernel starts sending station notifications. */ if (!tb[NL80211_ATTR_STA_INFO]) { wpa_printf(MSG_DEBUG, "sta stats missing!"); return NL_SKIP; } if (nla_parse_nested(stats, NL80211_STA_INFO_MAX, tb[NL80211_ATTR_STA_INFO], stats_policy)) { wpa_printf(MSG_DEBUG, "failed to parse nested attributes!"); return NL_SKIP; } if (stats[NL80211_STA_INFO_INACTIVE_TIME]) data->inactive_msec = nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]); if (stats[NL80211_STA_INFO_RX_BYTES]) data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]); if (stats[NL80211_STA_INFO_TX_BYTES]) data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]); if (stats[NL80211_STA_INFO_RX_PACKETS]) data->rx_packets = nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]); if (stats[NL80211_STA_INFO_TX_PACKETS]) data->tx_packets = nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]); return NL_SKIP; } static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data, const u8 *addr) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; os_memset(data, 0, sizeof(*data)); msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_GET_STATION, 0); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); return send_and_recv_msgs(drv, msg, get_sta_handler, data); nla_put_failure: return -ENOBUFS; } static int i802_set_tx_queue_params(void *priv, int queue, int aifs, int cw_min, int cw_max, int burst_time) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; struct nlattr *txq, *params; msg = nlmsg_alloc(); if (!msg) return -1; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_WIPHY, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS); if (!txq) goto nla_put_failure; /* We are only sending parameters for a single TXQ at a time */ params = nla_nest_start(msg, 1); if (!params) goto nla_put_failure; NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue); /* Burst time is configured in units of 0.1 msec and TXOP parameter in * 32 usec, so need to convert the value here. */ NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32); NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min); NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max); NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs); nla_nest_end(msg, params); nla_nest_end(msg, txq); if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0) return 0; nla_put_failure: return -1; } static int i802_set_bss(void *priv, int cts, int preamble, int slot) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_BSS, 0); if (cts >= 0) NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts); if (preamble >= 0) NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble); if (slot >= 0) NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot); /* TODO: multi-BSS support */ NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } static int i802_set_cts_protect(void *priv, int value) { return i802_set_bss(priv, value, -1, -1); } static int i802_set_preamble(void *priv, int value) { return i802_set_bss(priv, -1, value, -1); } static int i802_set_short_slot_time(void *priv, int value) { return i802_set_bss(priv, -1, -1, value); } static int i802_set_sta_vlan(void *priv, const u8 *addr, const char *ifname, int vlan_id) { struct wpa_driver_nl80211_data *drv = priv; struct nl_msg *msg; msg = nlmsg_alloc(); if (!msg) return -ENOMEM; genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, NL80211_CMD_SET_STATION, 0); NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname)); NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr); NLA_PUT_U32(msg, NL80211_ATTR_STA_VLAN, if_nametoindex(ifname)); return send_and_recv_msgs(drv, msg, NULL, NULL); nla_put_failure: return -ENOBUFS; } static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx) { struct wpa_driver_nl80211_data *drv = eloop_ctx; struct sockaddr_ll lladdr; unsigned char buf[3000]; int len; socklen_t fromlen = sizeof(lladdr); len = recvfrom(sock, buf, sizeof(buf), 0, (struct sockaddr *)&lladdr, &fromlen); if (len < 0) { perror("recv"); return; } if (have_ifidx(drv, lladdr.sll_ifindex)) { void *ctx; ctx = hostapd_sta_get_bss(drv->ctx, lladdr.sll_addr); if (!ctx) return; hostapd_eapol_receive(ctx, lladdr.sll_addr, buf, len); } } static int i802_get_inact_sec(void *priv, const u8 *addr) { struct hostap_sta_driver_data data; int ret; data.inactive_msec = (unsigned long) -1; ret = i802_read_sta_data(priv, &data, addr); if (ret || data.inactive_msec == (unsigned long) -1) return -1; return data.inactive_msec / 1000; } static int i802_sta_clear_stats(void *priv, const u8 *addr) { #if 0 /* TODO */ #endif return 0; } static int i802_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr, int reason) { struct wpa_driver_nl80211_data *drv = priv; struct ieee80211_mgmt mgmt; memset(&mgmt, 0, sizeof(mgmt)); mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DEAUTH); memcpy(mgmt.da, addr, ETH_ALEN); memcpy(mgmt.sa, own_addr, ETH_ALEN); memcpy(mgmt.bssid, own_addr, ETH_ALEN); mgmt.u.deauth.reason_code = host_to_le16(reason); return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt, IEEE80211_HDRLEN + sizeof(mgmt.u.deauth)); } static int i802_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr, int reason) { struct wpa_driver_nl80211_data *drv = priv; struct ieee80211_mgmt mgmt; memset(&mgmt, 0, sizeof(mgmt)); mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT, WLAN_FC_STYPE_DISASSOC); memcpy(mgmt.da, addr, ETH_ALEN); memcpy(mgmt.sa, own_addr, ETH_ALEN); memcpy(mgmt.bssid, own_addr, ETH_ALEN); mgmt.u.disassoc.reason_code = host_to_le16(reason); return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt, IEEE80211_HDRLEN + sizeof(mgmt.u.disassoc)); } static void *i802_init(struct hostapd_data *hapd, struct wpa_init_params *params) { struct wpa_driver_nl80211_data *drv; size_t i; drv = wpa_driver_nl80211_init(hapd, params->ifname); if (drv == NULL) return NULL; drv->bss.ifindex = drv->ifindex; drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int); drv->if_indices = drv->default_if_indices; for (i = 0; i < params->num_bridge; i++) { if (params->bridge[i]) add_ifidx(drv, if_nametoindex(params->bridge[i])); } /* start listening for EAPOL on the default AP interface */ add_ifidx(drv, drv->ifindex); if (hostapd_set_iface_flags(drv, drv->ifname, 0)) goto failed; if (params->bssid) { if (set_ifhwaddr(drv, drv->ifname, params->bssid)) goto failed; } if (wpa_driver_nl80211_set_mode(drv, IEEE80211_MODE_AP)) { wpa_printf(MSG_ERROR, "nl80211: Failed to set interface %s " "into AP mode", drv->ifname); goto failed; } if (hostapd_set_iface_flags(drv, drv->ifname, 1)) goto failed; drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE)); if (drv->eapol_sock < 0) { perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)"); goto failed; } if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL)) { printf("Could not register read socket for eapol\n"); goto failed; } if (get_ifhwaddr(drv, drv->ifname, params->own_addr)) goto failed; return drv; failed: nl80211_remove_monitor_interface(drv); if (drv->ioctl_sock >= 0) close(drv->ioctl_sock); genl_family_put(drv->nl80211); nl_cache_free(drv->nl_cache); nl_handle_destroy(drv->nl_handle); nl_cb_put(drv->nl_cb); os_free(drv); return NULL; } static void i802_deinit(void *priv) { wpa_driver_nl80211_deinit(priv); } #endif /* HOSTAPD */ static enum nl80211_iftype wpa_driver_nl80211_if_type( enum wpa_driver_if_type type) { switch (type) { case WPA_IF_STATION: return NL80211_IFTYPE_STATION; case WPA_IF_AP_VLAN: return NL80211_IFTYPE_AP_VLAN; case WPA_IF_AP_BSS: return NL80211_IFTYPE_AP; } return -1; } static int wpa_driver_nl80211_if_add(const char *iface, void *priv, enum wpa_driver_if_type type, const char *ifname, const u8 *addr, void *bss_ctx) { struct wpa_driver_nl80211_data *drv = priv; int ifidx; #ifdef HOSTAPD struct i802_bss *bss = NULL; if (type == WPA_IF_AP_BSS) { bss = os_zalloc(sizeof(*bss)); if (bss == NULL) return -1; } #endif /* HOSTAPD */ ifidx = nl80211_create_iface(drv, ifname, wpa_driver_nl80211_if_type(type), addr); if (ifidx < 0) { #ifdef HOSTAPD os_free(bss); #endif /* HOSTAPD */ return -1; } #ifdef HOSTAPD if (type == WPA_IF_AP_BSS) { if (hostapd_set_iface_flags(priv, ifname, 1)) { nl80211_remove_iface(priv, ifidx); os_free(bss); return -1; } bss->ifindex = ifidx; bss->next = drv->bss.next; drv->bss.next = bss; } #endif /* HOSTAPD */ return 0; } static int wpa_driver_nl80211_if_remove(void *priv, enum wpa_driver_if_type type, const char *ifname) { struct wpa_driver_nl80211_data *drv = priv; int ifindex = if_nametoindex(ifname); nl80211_remove_iface(drv, ifindex); #ifdef HOSTAPD if (type == WPA_IF_AP_BSS) { struct i802_bss *bss, *prev; prev = &drv->bss; bss = drv->bss.next; while (bss) { if (ifindex == bss->ifindex) { prev->next = bss->next; os_free(bss); break; } prev = bss; bss = bss->next; } } #endif /* HOSTAPD */ return 0; } const struct wpa_driver_ops wpa_driver_nl80211_ops = { .name = "nl80211", .desc = "Linux nl80211/cfg80211", .get_bssid = wpa_driver_nl80211_get_bssid, .get_ssid = wpa_driver_nl80211_get_ssid, .set_key = wpa_driver_nl80211_set_key, .scan2 = wpa_driver_nl80211_scan, .get_scan_results2 = wpa_driver_nl80211_get_scan_results, .deauthenticate = wpa_driver_nl80211_deauthenticate, .disassociate = wpa_driver_nl80211_disassociate, .authenticate = wpa_driver_nl80211_authenticate, .associate = wpa_driver_nl80211_associate, .init = wpa_driver_nl80211_init, .deinit = wpa_driver_nl80211_deinit, .get_capa = wpa_driver_nl80211_get_capa, .set_operstate = wpa_driver_nl80211_set_operstate, .set_supp_port = wpa_driver_nl80211_set_supp_port, .set_country = wpa_driver_nl80211_set_country, .set_beacon = wpa_driver_nl80211_set_beacon, .if_add = wpa_driver_nl80211_if_add, .if_remove = wpa_driver_nl80211_if_remove, .send_mlme = wpa_driver_nl80211_send_mlme, .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data, .sta_add = wpa_driver_nl80211_sta_add, .sta_remove = wpa_driver_nl80211_sta_remove, .hapd_send_eapol = wpa_driver_nl80211_hapd_send_eapol, .sta_set_flags = wpa_driver_nl80211_sta_set_flags, #ifdef HOSTAPD .hapd_init = i802_init, .hapd_deinit = i802_deinit, .get_seqnum = i802_get_seqnum, .flush = i802_flush, .read_sta_data = i802_read_sta_data, .sta_deauth = i802_sta_deauth, .sta_disassoc = i802_sta_disassoc, .get_inact_sec = i802_get_inact_sec, .sta_clear_stats = i802_sta_clear_stats, .set_freq = i802_set_freq, .set_rts = i802_set_rts, .set_frag = i802_set_frag, .set_rate_sets = i802_set_rate_sets, .set_cts_protect = i802_set_cts_protect, .set_preamble = i802_set_preamble, .set_short_slot_time = i802_set_short_slot_time, .set_tx_queue_params = i802_set_tx_queue_params, .set_sta_vlan = i802_set_sta_vlan, #endif /* HOSTAPD */ };