git.maemo.org Git - wpasupplicant/blob - src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009, Atheros Communications
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  *
  13  * Alternatively, this software may be distributed under the terms of BSD
  14  * license.
  15  *
  16  * See README and COPYING for more details.
  17  */
  18
  19 #include "includes.h"
  20 #include <sys/ioctl.h>
  21 #include <net/if_arp.h>
  22 #include <netlink/genl/genl.h>
  23 #include <netlink/genl/family.h>
  24 #include <netlink/genl/ctrl.h>
  25 #include "nl80211_copy.h"
  26 #include "wireless_copy.h"
  27
  28 #include "common.h"
  29 #include "driver.h"
  30 #include "eloop.h"
  31 #include "ieee802_11_defs.h"
  32
  33 #if defined(CONFIG_AP) || defined(HOSTAPD)
  34 #include <netpacket/packet.h>
  35 #include <linux/filter.h>
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #endif /* CONFIG_AP || HOSTAPD */
  39
  40 #ifdef CONFIG_AP
  41
  42 #include "../hostapd/hostapd_defs.h"
  43
  44 #ifndef ETH_P_ALL
  45 #define ETH_P_ALL 0x0003
  46 #endif
  47
  48 #endif /* CONFIG_AP */
  49
  50 #ifdef HOSTAPD
  51 #include <netlink/msg.h>
  52 #include <netlink/attr.h>
  53 #include <net/if.h>
  54 #include <net/if_arp.h>
  55
  56 #include "../../hostapd/hostapd.h"
  57 #include "../../hostapd/sta_flags.h"
  58 #include "ieee802_11_common.h"
  59
  60 #ifdef CONFIG_LIBNL20
  61 /* libnl 2.0 compatibility code */
  62 #define nl_handle_alloc_cb nl_socket_alloc_cb
  63 #define nl_handle_destroy nl_socket_free
  64 #endif /* CONFIG_LIBNL20 */
  65
  66 #endif /* HOSTAPD */
  67
  68
  69 #ifndef IFF_LOWER_UP
  70 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
  71 #endif
  72 #ifndef IFF_DORMANT
  73 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
  74 #endif
  75
  76 #ifndef IF_OPER_DORMANT
  77 #define IF_OPER_DORMANT 5
  78 #endif
  79 #ifndef IF_OPER_UP
  80 #define IF_OPER_UP 6
  81 #endif
  82
  83 enum ieee80211_msg_type {
  84         ieee80211_msg_normal = 0,
  85         ieee80211_msg_tx_callback_ack = 1,
  86         ieee80211_msg_tx_callback_fail = 2,
  87 };
  88
  89 struct i802_bss {
  90         struct i802_bss *next;
  91         char ifname[IFNAMSIZ + 1];
  92         unsigned int beacon_set:1;
  93 };
  94
  95 struct wpa_driver_nl80211_data {
  96         void *ctx;
  97         int link_event_sock;
  98         int ioctl_sock; /* socket for ioctl() use */
  99         char ifname[IFNAMSIZ + 1];
 100         int ifindex;
 101         int if_removed;
 102         struct wpa_driver_capa capa;
 103         int has_capability;
 104
 105         int operstate;
 106
 107         int scan_complete_events;
 108
 109         struct nl_handle *nl_handle;
 110         struct nl_cache *nl_cache;
 111         struct nl_cb *nl_cb;
 112         struct genl_family *nl80211;
 113
 114         u8 bssid[ETH_ALEN];
 115         int associated;
 116         u8 ssid[32];
 117         size_t ssid_len;
 118
 119 #ifdef CONFIG_AP
 120         int beacon_int;
 121         unsigned int beacon_set:1;
 122         int monitor_sock;
 123         int monitor_ifidx;
 124 #endif /* CONFIG_AP */
 125
 126 #ifdef HOSTAPD
 127         struct hostapd_data *hapd;
 128
 129         int eapol_sock; /* socket for EAPOL frames */
 130         int monitor_sock; /* socket for monitor */
 131         int monitor_ifidx;
 132
 133         int default_if_indices[16];
 134         int *if_indices;
 135         int num_if_indices;
 136
 137         int beacon_int;
 138         struct i802_bss bss;
 139         unsigned int ht_40mhz_scan:1;
 140
 141         int last_freq;
 142         int last_freq_ht;
 143         struct hostapd_neighbor_bss *neighbors;
 144         size_t num_neighbors;
 145 #endif /* HOSTAPD */
 146 };
 147
 148
 149 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 150                                             void *timeout_ctx);
 151 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
 152                                        int mode);
 153 static int
 154 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 155
 156 #ifdef CONFIG_AP
 157 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
 158                                  int ifidx);
 159 #endif /* CONFIG_AP */
 160
 161 #ifdef HOSTAPD
 162 static void handle_frame(struct wpa_driver_nl80211_data *drv,
 163                          u8 *buf, size_t len,
 164                          struct hostapd_frame_info *hfi,
 165                          enum ieee80211_msg_type msg_type);
 166 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 167 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 168 #endif /* HOSTAPD */
 169
 170
 171 /* nl80211 code */
 172 static int ack_handler(struct nl_msg *msg, void *arg)
 173 {
 174         int *err = arg;
 175         *err = 0;
 176         return NL_STOP;
 177 }
 178
 179 static int finish_handler(struct nl_msg *msg, void *arg)
 180 {
 181         int *ret = arg;
 182         *ret = 0;
 183         return NL_SKIP;
 184 }
 185
 186 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 187                          void *arg)
 188 {
 189         int *ret = arg;
 190         *ret = err->error;
 191         return NL_SKIP;
 192 }
 193
 194
 195 static int no_seq_check(struct nl_msg *msg, void *arg)
 196 {
 197         return NL_OK;
 198 }
 199
 200
 201 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 202                               struct nl_msg *msg,
 203                               int (*valid_handler)(struct nl_msg *, void *),
 204                               void *valid_data)
 205 {
 206         struct nl_cb *cb;
 207         int err = -ENOMEM;
 208
 209         cb = nl_cb_clone(drv->nl_cb);
 210         if (!cb)
 211                 goto out;
 212
 213         err = nl_send_auto_complete(drv->nl_handle, msg);
 214         if (err < 0)
 215                 goto out;
 216
 217         err = 1;
 218
 219         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 220         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 221         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 222
 223         if (valid_handler)
 224                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 225                           valid_handler, valid_data);
 226
 227         while (err > 0)
 228                 nl_recvmsgs(drv->nl_handle, cb);
 229  out:
 230         nl_cb_put(cb);
 231         nlmsg_free(msg);
 232         return err;
 233 }
 234
 235
 236 struct family_data {
 237         const char *group;
 238         int id;
 239 };
 240
 241
 242 static int family_handler(struct nl_msg *msg, void *arg)
 243 {
 244         struct family_data *res = arg;
 245         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 246         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 247         struct nlattr *mcgrp;
 248         int i;
 249
 250         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 251                   genlmsg_attrlen(gnlh, 0), NULL);
 252         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 253                 return NL_SKIP;
 254
 255         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 256                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 257                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 258                           nla_len(mcgrp), NULL);
 259                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 260                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 261                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 262                                res->group,
 263                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 264                         continue;
 265                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 266                 break;
 267         };
 268
 269         return NL_SKIP;
 270 }
 271
 272
 273 static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
 274                                const char *family, const char *group)
 275 {
 276         struct nl_msg *msg;
 277         int ret = -1;
 278         struct family_data res = { group, -ENOENT };
 279
 280         msg = nlmsg_alloc();
 281         if (!msg)
 282                 return -ENOMEM;
 283         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
 284                     0, 0, CTRL_CMD_GETFAMILY, 0);
 285         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 286
 287         ret = send_and_recv_msgs(drv, msg, family_handler, &res);
 288         msg = NULL;
 289         if (ret == 0)
 290                 ret = res.id;
 291
 292 nla_put_failure:
 293         nlmsg_free(msg);
 294         return ret;
 295 }
 296
 297
 298 static int wpa_driver_nl80211_send_oper_ifla(
 299         struct wpa_driver_nl80211_data *drv,
 300         int linkmode, int operstate)
 301 {
 302         struct {
 303                 struct nlmsghdr hdr;
 304                 struct ifinfomsg ifinfo;
 305                 char opts[16];
 306         } req;
 307         struct rtattr *rta;
 308         static int nl_seq;
 309         ssize_t ret;
 310
 311         os_memset(&req, 0, sizeof(req));
 312
 313         req.hdr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
 314         req.hdr.nlmsg_type = RTM_SETLINK;
 315         req.hdr.nlmsg_flags = NLM_F_REQUEST;
 316         req.hdr.nlmsg_seq = ++nl_seq;
 317         req.hdr.nlmsg_pid = 0;
 318
 319         req.ifinfo.ifi_family = AF_UNSPEC;
 320         req.ifinfo.ifi_type = 0;
 321         req.ifinfo.ifi_index = drv->ifindex;
 322         req.ifinfo.ifi_flags = 0;
 323         req.ifinfo.ifi_change = 0;
 324
 325         if (linkmode != -1) {
 326                 rta = (struct rtattr *)
 327                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 328                 rta->rta_type = IFLA_LINKMODE;
 329                 rta->rta_len = RTA_LENGTH(sizeof(char));
 330                 *((char *) RTA_DATA(rta)) = linkmode;
 331                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 332                         RTA_LENGTH(sizeof(char));
 333         }
 334         if (operstate != -1) {
 335                 rta = (struct rtattr *)
 336                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 337                 rta->rta_type = IFLA_OPERSTATE;
 338                 rta->rta_len = RTA_LENGTH(sizeof(char));
 339                 *((char *) RTA_DATA(rta)) = operstate;
 340                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 341                         RTA_LENGTH(sizeof(char));
 342         }
 343
 344         wpa_printf(MSG_DEBUG, "WEXT: Operstate: linkmode=%d, operstate=%d",
 345                    linkmode, operstate);
 346
 347         ret = send(drv->link_event_sock, &req, req.hdr.nlmsg_len, 0);
 348         if (ret < 0) {
 349                 wpa_printf(MSG_DEBUG, "WEXT: Sending operstate IFLA failed: "
 350                            "%s (assume operstate is not supported)",
 351                            strerror(errno));
 352         }
 353
 354         return ret < 0 ? -1 : 0;
 355 }
 356
 357
 358 static int wpa_driver_nl80211_set_auth_param(
 359         struct wpa_driver_nl80211_data *drv, int idx, u32 value)
 360 {
 361         struct iwreq iwr;
 362         int ret = 0;
 363
 364         os_memset(&iwr, 0, sizeof(iwr));
 365         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 366         iwr.u.param.flags = idx & IW_AUTH_INDEX;
 367         iwr.u.param.value = value;
 368
 369         if (ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr) < 0) {
 370                 if (errno != EOPNOTSUPP) {
 371                         wpa_printf(MSG_DEBUG, "WEXT: SIOCSIWAUTH(param %d "
 372                                    "value 0x%x) failed: %s)",
 373                                    idx, value, strerror(errno));
 374                 }
 375                 ret = errno == EOPNOTSUPP ? -2 : -1;
 376         }
 377
 378         return ret;
 379 }
 380
 381
 382 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 383 {
 384         struct wpa_driver_nl80211_data *drv = priv;
 385         if (!drv->associated)
 386                 return -1;
 387         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 388         return 0;
 389 }
 390
 391
 392 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 393 {
 394         struct wpa_driver_nl80211_data *drv = priv;
 395         if (!drv->associated)
 396                 return -1;
 397         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 398         return drv->ssid_len;
 399 }
 400
 401
 402 #ifndef HOSTAPD
 403 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 404                                           void *ctx, char *buf, size_t len,
 405                                           int del)
 406 {
 407         union wpa_event_data event;
 408
 409         os_memset(&event, 0, sizeof(event));
 410         if (len > sizeof(event.interface_status.ifname))
 411                 len = sizeof(event.interface_status.ifname) - 1;
 412         os_memcpy(event.interface_status.ifname, buf, len);
 413         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 414                 EVENT_INTERFACE_ADDED;
 415
 416         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 417                    del ? "DEL" : "NEW",
 418                    event.interface_status.ifname,
 419                    del ? "removed" : "added");
 420
 421         if (os_strcmp(drv->ifname, event.interface_status.ifname) == 0) {
 422                 if (del)
 423                         drv->if_removed = 1;
 424                 else
 425                         drv->if_removed = 0;
 426         }
 427
 428         wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
 429 }
 430
 431
 432 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 433                                          struct nlmsghdr *h)
 434 {
 435         struct ifinfomsg *ifi;
 436         int attrlen, _nlmsg_len, rta_len;
 437         struct rtattr *attr;
 438
 439         ifi = NLMSG_DATA(h);
 440
 441         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 442
 443         attrlen = h->nlmsg_len - _nlmsg_len;
 444         if (attrlen < 0)
 445                 return 0;
 446
 447         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 448
 449         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 450         while (RTA_OK(attr, attrlen)) {
 451                 if (attr->rta_type == IFLA_IFNAME) {
 452                         if (os_strcmp(((char *) attr) + rta_len, drv->ifname)
 453                             == 0)
 454                                 return 1;
 455                         else
 456                                 break;
 457                 }
 458                 attr = RTA_NEXT(attr, attrlen);
 459         }
 460
 461         return 0;
 462 }
 463
 464
 465 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 466                                           int ifindex, struct nlmsghdr *h)
 467 {
 468         if (drv->ifindex == ifindex)
 469                 return 1;
 470
 471         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, h)) {
 472                 drv->ifindex = if_nametoindex(drv->ifname);
 473                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 474                            "interface");
 475                 wpa_driver_nl80211_finish_drv_init(drv);
 476                 return 1;
 477         }
 478
 479         return 0;
 480 }
 481
 482
 483 static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data *drv,
 484                                               void *ctx, struct nlmsghdr *h,
 485                                               size_t len)
 486 {
 487         struct ifinfomsg *ifi;
 488         int attrlen, _nlmsg_len, rta_len;
 489         struct rtattr * attr;
 490
 491         if (len < sizeof(*ifi))
 492                 return;
 493
 494         ifi = NLMSG_DATA(h);
 495
 496         if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, h)) {
 497                 wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d",
 498                            ifi->ifi_index);
 499                 return;
 500         }
 501
 502         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 503                    "(%s%s%s%s)",
 504                    drv->operstate, ifi->ifi_flags,
 505                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 506                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 507                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 508                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 509         /*
 510          * Some drivers send the association event before the operup event--in
 511          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 512          * fails. This will hit us when wpa_supplicant does not need to do
 513          * IEEE 802.1X authentication
 514          */
 515         if (drv->operstate == 1 &&
 516             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 517             !(ifi->ifi_flags & IFF_RUNNING))
 518                 wpa_driver_nl80211_send_oper_ifla(drv, -1, IF_OPER_UP);
 519
 520         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 521
 522         attrlen = h->nlmsg_len - _nlmsg_len;
 523         if (attrlen < 0)
 524                 return;
 525
 526         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 527
 528         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 529         while (RTA_OK(attr, attrlen)) {
 530                 if (attr->rta_type == IFLA_IFNAME) {
 531                         wpa_driver_nl80211_event_link(
 532                                 drv, ctx,
 533                                 ((char *) attr) + rta_len,
 534                                 attr->rta_len - rta_len, 0);
 535                 }
 536                 attr = RTA_NEXT(attr, attrlen);
 537         }
 538 }
 539
 540
 541 static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data *drv,
 542                                               void *ctx, struct nlmsghdr *h,
 543                                               size_t len)
 544 {
 545         struct ifinfomsg *ifi;
 546         int attrlen, _nlmsg_len, rta_len;
 547         struct rtattr * attr;
 548
 549         if (len < sizeof(*ifi))
 550                 return;
 551
 552         ifi = NLMSG_DATA(h);
 553
 554         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 555
 556         attrlen = h->nlmsg_len - _nlmsg_len;
 557         if (attrlen < 0)
 558                 return;
 559
 560         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 561
 562         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 563         while (RTA_OK(attr, attrlen)) {
 564                 if (attr->rta_type == IFLA_IFNAME) {
 565                         wpa_driver_nl80211_event_link(
 566                                 drv, ctx,
 567                                 ((char *) attr) + rta_len,
 568                                 attr->rta_len - rta_len, 1);
 569                 }
 570                 attr = RTA_NEXT(attr, attrlen);
 571         }
 572 }
 573
 574
 575 static void wpa_driver_nl80211_event_receive_link(int sock, void *eloop_ctx,
 576                                                   void *sock_ctx)
 577 {
 578         char buf[8192];
 579         int left;
 580         struct sockaddr_nl from;
 581         socklen_t fromlen;
 582         struct nlmsghdr *h;
 583         int max_events = 10;
 584
 585 try_again:
 586         fromlen = sizeof(from);
 587         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
 588                         (struct sockaddr *) &from, &fromlen);
 589         if (left < 0) {
 590                 if (errno != EINTR && errno != EAGAIN)
 591                         perror("recvfrom(netlink)");
 592                 return;
 593         }
 594
 595         h = (struct nlmsghdr *) buf;
 596         while (left >= (int) sizeof(*h)) {
 597                 int len, plen;
 598
 599                 len = h->nlmsg_len;
 600                 plen = len - sizeof(*h);
 601                 if (len > left || plen < 0) {
 602                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
 603                                    "len=%d left=%d plen=%d",
 604                                    len, left, plen);
 605                         break;
 606                 }
 607
 608                 switch (h->nlmsg_type) {
 609                 case RTM_NEWLINK:
 610                         wpa_driver_nl80211_event_rtm_newlink(eloop_ctx, sock_ctx,
 611                                                           h, plen);
 612                         break;
 613                 case RTM_DELLINK:
 614                         wpa_driver_nl80211_event_rtm_dellink(eloop_ctx, sock_ctx,
 615                                                           h, plen);
 616                         break;
 617                 }
 618
 619                 len = NLMSG_ALIGN(len);
 620                 left -= len;
 621                 h = (struct nlmsghdr *) ((char *) h + len);
 622         }
 623
 624         if (left > 0) {
 625                 wpa_printf(MSG_DEBUG, "%d extra bytes in the end of netlink "
 626                            "message", left);
 627         }
 628
 629         if (--max_events > 0) {
 630                 /*
 631                  * Try to receive all events in one eloop call in order to
 632                  * limit race condition on cases where AssocInfo event, Assoc
 633                  * event, and EAPOL frames are received more or less at the
 634                  * same time. We want to process the event messages first
 635                  * before starting EAPOL processing.
 636                  */
 637                 goto try_again;
 638         }
 639 }
 640
 641
 642 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
 643                             const u8 *frame, size_t len)
 644 {
 645         const struct ieee80211_mgmt *mgmt;
 646         union wpa_event_data event;
 647
 648         mgmt = (const struct ieee80211_mgmt *) frame;
 649         if (len < 24 + sizeof(mgmt->u.auth)) {
 650                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 651                            "frame");
 652                 return;
 653         }
 654
 655         os_memset(&event, 0, sizeof(event));
 656         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
 657         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
 658         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
 659         if (len > 24 + sizeof(mgmt->u.auth)) {
 660                 event.auth.ies = mgmt->u.auth.variable;
 661                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
 662         }
 663
 664         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
 665 }
 666
 667
 668 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
 669                             const u8 *frame, size_t len)
 670 {
 671         const struct ieee80211_mgmt *mgmt;
 672         union wpa_event_data event;
 673         u16 status;
 674
 675         mgmt = (const struct ieee80211_mgmt *) frame;
 676         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
 677                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 678                            "frame");
 679                 return;
 680         }
 681
 682         status = le_to_host16(mgmt->u.assoc_resp.status_code);
 683         if (status != WLAN_STATUS_SUCCESS) {
 684                 os_memset(&event, 0, sizeof(event));
 685                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 686                         event.assoc_reject.resp_ies =
 687                                 (u8 *) mgmt->u.assoc_resp.variable;
 688                         event.assoc_reject.resp_ies_len =
 689                                 len - 24 - sizeof(mgmt->u.assoc_resp);
 690                 }
 691                 event.assoc_reject.status_code = status;
 692
 693                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
 694                 return;
 695         }
 696
 697         drv->associated = 1;
 698         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
 699
 700         os_memset(&event, 0, sizeof(event));
 701         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 702                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
 703                 event.assoc_info.resp_ies_len =
 704                         len - 24 - sizeof(mgmt->u.assoc_resp);
 705         }
 706
 707         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 708 }
 709
 710
 711 static void mlme_event(struct wpa_driver_nl80211_data *drv,
 712                        enum nl80211_commands cmd, struct nlattr *frame)
 713 {
 714         if (frame == NULL) {
 715                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
 716                            "data", cmd);
 717                 return;
 718         }
 719
 720         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
 721         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
 722                     nla_data(frame), nla_len(frame));
 723
 724         switch (cmd) {
 725         case NL80211_CMD_AUTHENTICATE:
 726                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
 727                 break;
 728         case NL80211_CMD_ASSOCIATE:
 729                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
 730                 break;
 731         case NL80211_CMD_DEAUTHENTICATE:
 732                 drv->associated = 0;
 733                 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
 734                 break;
 735         case NL80211_CMD_DISASSOCIATE:
 736                 drv->associated = 0;
 737                 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
 738                 break;
 739         default:
 740                 break;
 741         }
 742 }
 743
 744 #endif /* HOSTAPD */
 745
 746
 747 static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv,
 748                                            struct nlattr *tb[])
 749 {
 750 #ifdef HOSTAPD
 751         if (tb[NL80211_ATTR_MAC])
 752                 hostapd_michael_mic_failure(drv->hapd,
 753                                             nla_data(tb[NL80211_ATTR_MAC]));
 754 #else /* HOSTAPD */
 755         union wpa_event_data data;
 756
 757         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
 758         os_memset(&data, 0, sizeof(data));
 759         if (tb[NL80211_ATTR_MAC]) {
 760                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
 761                             nla_data(tb[NL80211_ATTR_MAC]),
 762                             nla_len(tb[NL80211_ATTR_MAC]));
 763         }
 764         if (tb[NL80211_ATTR_KEY_SEQ]) {
 765                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
 766                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
 767                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
 768         }
 769         if (tb[NL80211_ATTR_KEY_TYPE]) {
 770                 enum nl80211_key_type key_type =
 771                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
 772                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
 773                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
 774                         data.michael_mic_failure.unicast = 1;
 775         } else
 776                 data.michael_mic_failure.unicast = 1;
 777
 778         if (tb[NL80211_ATTR_KEY_IDX]) {
 779                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
 780                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
 781         }
 782
 783         wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
 784 #endif /* HOSTAPD */
 785 }
 786
 787
 788 static int process_event(struct nl_msg *msg, void *arg)
 789 {
 790         struct wpa_driver_nl80211_data *drv = arg;
 791         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 792         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 793
 794         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 795                   genlmsg_attrlen(gnlh, 0), NULL);
 796
 797         if (tb[NL80211_ATTR_IFINDEX]) {
 798                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 799                 if (ifindex != drv->ifindex) {
 800                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
 801                                    " for foreign interface (ifindex %d)",
 802                                    gnlh->cmd, ifindex);
 803                         return NL_SKIP;
 804                 }
 805         }
 806
 807         switch (gnlh->cmd) {
 808 #ifndef HOSTAPD
 809         case NL80211_CMD_NEW_SCAN_RESULTS:
 810                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
 811                 drv->scan_complete_events = 1;
 812                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 813                                      drv->ctx);
 814                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 815                 break;
 816         case NL80211_CMD_SCAN_ABORTED:
 817                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
 818                 /*
 819                  * Need to indicate that scan results are available in order
 820                  * not to make wpa_supplicant stop its scanning.
 821                  */
 822                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 823                                      drv->ctx);
 824                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 825                 break;
 826         case NL80211_CMD_AUTHENTICATE:
 827         case NL80211_CMD_ASSOCIATE:
 828         case NL80211_CMD_DEAUTHENTICATE:
 829         case NL80211_CMD_DISASSOCIATE:
 830                 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME]);
 831                 break;
 832 #endif /* HOSTAPD */
 833         case NL80211_CMD_MICHAEL_MIC_FAILURE:
 834                 mlme_event_michael_mic_failure(drv, tb);
 835                 break;
 836         default:
 837                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
 838                            "(cmd=%d)", gnlh->cmd);
 839                 break;
 840         }
 841
 842         return NL_SKIP;
 843 }
 844
 845
 846 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
 847                                              void *sock_ctx)
 848 {
 849         struct nl_cb *cb;
 850         struct wpa_driver_nl80211_data *drv = eloop_ctx;
 851
 852         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
 853
 854         cb = nl_cb_clone(drv->nl_cb);
 855         if (!cb)
 856                 return;
 857         nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 858         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
 859         nl_recvmsgs(drv->nl_handle, cb);
 860         nl_cb_put(cb);
 861 }
 862
 863
 864 static int hostapd_set_iface_flags(struct wpa_driver_nl80211_data *drv,
 865                                    const char *ifname, int dev_up)
 866 {
 867         struct ifreq ifr;
 868
 869         if (drv->ioctl_sock < 0)
 870                 return -1;
 871
 872         os_memset(&ifr, 0, sizeof(ifr));
 873         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
 874
 875         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
 876                 perror("ioctl[SIOCGIFFLAGS]");
 877                 wpa_printf(MSG_DEBUG, "Could not read interface flags (%s)",
 878                            ifname);
 879                 return -1;
 880         }
 881
 882         if (dev_up) {
 883                 if (ifr.ifr_flags & IFF_UP)
 884                         return 0;
 885                 ifr.ifr_flags |= IFF_UP;
 886         } else {
 887                 if (!(ifr.ifr_flags & IFF_UP))
 888                         return 0;
 889                 ifr.ifr_flags &= ~IFF_UP;
 890         }
 891
 892         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
 893                 perror("ioctl[SIOCSIFFLAGS]");
 894                 return -1;
 895         }
 896
 897         return 0;
 898 }
 899
 900
 901 /**
 902  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
 903  * @priv: driver_nl80211 private data
 904  * @alpha2_arg: country to which to switch to
 905  * Returns: 0 on success, -1 on failure
 906  *
 907  * This asks nl80211 to set the regulatory domain for given
 908  * country ISO / IEC alpha2.
 909  */
 910 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
 911 {
 912         struct wpa_driver_nl80211_data *drv = priv;
 913         char alpha2[3];
 914         struct nl_msg *msg;
 915
 916         msg = nlmsg_alloc();
 917         if (!msg)
 918                 return -ENOMEM;
 919
 920         alpha2[0] = alpha2_arg[0];
 921         alpha2[1] = alpha2_arg[1];
 922         alpha2[2] = '\0';
 923
 924         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 925                     0, NL80211_CMD_REQ_SET_REG, 0);
 926
 927         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
 928         if (send_and_recv_msgs(drv, msg, NULL, NULL))
 929                 return -EINVAL;
 930         return 0;
 931 nla_put_failure:
 932         return -EINVAL;
 933 }
 934
 935
 936 struct wiphy_info_data {
 937         int max_scan_ssids;
 938         int ap_supported;
 939 };
 940
 941
 942 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
 943 {
 944         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 945         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 946         struct wiphy_info_data *info = arg;
 947
 948         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 949                   genlmsg_attrlen(gnlh, 0), NULL);
 950
 951         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
 952                 info->max_scan_ssids =
 953                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
 954
 955         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
 956                 struct nlattr *nl_mode;
 957                 int i;
 958                 nla_for_each_nested(nl_mode,
 959                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
 960                         if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
 961                                 info->ap_supported = 1;
 962                                 break;
 963                         }
 964                 }
 965         }
 966
 967         return NL_SKIP;
 968 }
 969
 970
 971 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
 972                                        struct wiphy_info_data *info)
 973 {
 974         struct nl_msg *msg;
 975
 976         os_memset(info, 0, sizeof(*info));
 977         msg = nlmsg_alloc();
 978         if (!msg)
 979                 return -1;
 980
 981         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 982                     0, NL80211_CMD_GET_WIPHY, 0);
 983
 984         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 985
 986         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
 987                 return 0;
 988         msg = NULL;
 989 nla_put_failure:
 990         nlmsg_free(msg);
 991         return -1;
 992 }
 993
 994
 995 static void wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
 996 {
 997         struct wiphy_info_data info;
 998         if (wpa_driver_nl80211_get_info(drv, &info))
 999                 return;
1000         drv->has_capability = 1;
1001         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
1002         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1003                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
1004                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1005                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1006         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
1007                 WPA_DRIVER_CAPA_ENC_WEP104 |
1008                 WPA_DRIVER_CAPA_ENC_TKIP |
1009                 WPA_DRIVER_CAPA_ENC_CCMP;
1010
1011         drv->capa.max_scan_ssids = info.max_scan_ssids;
1012         if (info.ap_supported)
1013                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1014 }
1015
1016
1017 /**
1018  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1019  * @ctx: context to be used when calling wpa_supplicant functions,
1020  * e.g., wpa_supplicant_event()
1021  * @ifname: interface name, e.g., wlan0
1022  * Returns: Pointer to private data, %NULL on failure
1023  */
1024 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
1025 {
1026         int s, ret;
1027         struct sockaddr_nl local;
1028         struct wpa_driver_nl80211_data *drv;
1029
1030         drv = os_zalloc(sizeof(*drv));
1031         if (drv == NULL)
1032                 return NULL;
1033         drv->ctx = ctx;
1034         os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1035 #ifdef CONFIG_AP
1036         drv->monitor_ifidx = -1;
1037         drv->monitor_sock = -1;
1038 #endif /* CONFIG_AP */
1039
1040         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1041         if (drv->nl_cb == NULL) {
1042                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1043                            "callbacks");
1044                 goto err1;
1045         }
1046
1047         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
1048         if (drv->nl_handle == NULL) {
1049                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1050                            "callbacks");
1051                 goto err2;
1052         }
1053
1054         if (genl_connect(drv->nl_handle)) {
1055                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
1056                            "netlink");
1057                 goto err3;
1058         }
1059
1060         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
1061         if (drv->nl_cache == NULL) {
1062                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1063                            "netlink cache");
1064                 goto err3;
1065         }
1066
1067         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
1068         if (drv->nl80211 == NULL) {
1069                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1070                            "found");
1071                 goto err4;
1072         }
1073
1074         ret = nl_get_multicast_id(drv, "nl80211", "scan");
1075         if (ret >= 0)
1076                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1077         if (ret < 0) {
1078                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1079                            "membership for scan events: %d (%s)",
1080                            ret, strerror(-ret));
1081                 goto err4;
1082         }
1083
1084         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
1085         if (ret >= 0)
1086                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1087         if (ret < 0) {
1088                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1089                            "membership for mlme events: %d (%s)",
1090                            ret, strerror(-ret));
1091                 goto err4;
1092         }
1093         drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1094
1095         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
1096                                  wpa_driver_nl80211_event_receive, drv, ctx);
1097
1098         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1099         if (drv->ioctl_sock < 0) {
1100                 perror("socket(PF_INET,SOCK_DGRAM)");
1101                 goto err5;
1102         }
1103
1104         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
1105         if (s < 0) {
1106                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
1107                 goto err6;
1108         }
1109
1110         os_memset(&local, 0, sizeof(local));
1111         local.nl_family = AF_NETLINK;
1112         local.nl_groups = RTMGRP_LINK;
1113         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
1114                 perror("bind(netlink)");
1115                 close(s);
1116                 goto err6;
1117         }
1118
1119 #ifndef HOSTAPD
1120         eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_link, drv,
1121                                  ctx);
1122 #endif /* HOSTAPD */
1123         drv->link_event_sock = s;
1124
1125         if (wpa_driver_nl80211_finish_drv_init(drv))
1126                 goto err7;
1127
1128         return drv;
1129
1130 err7:
1131         eloop_unregister_read_sock(drv->link_event_sock);
1132         close(drv->link_event_sock);
1133 err6:
1134         close(drv->ioctl_sock);
1135 err5:
1136         genl_family_put(drv->nl80211);
1137 err4:
1138         nl_cache_free(drv->nl_cache);
1139 err3:
1140         nl_handle_destroy(drv->nl_handle);
1141 err2:
1142         nl_cb_put(drv->nl_cb);
1143 err1:
1144         os_free(drv);
1145         return NULL;
1146 }
1147
1148
1149 static int
1150 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
1151 {
1152         drv->ifindex = if_nametoindex(drv->ifname);
1153
1154         if (wpa_driver_nl80211_set_mode(drv, 0) < 0) {
1155                 wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
1156                            "use managed mode");
1157         }
1158
1159         if (hostapd_set_iface_flags(drv, drv->ifname, 1)) {
1160                 wpa_printf(MSG_ERROR, "Could not set interface '%s' "
1161                            "UP", drv->ifname);
1162                 return -1;
1163         }
1164
1165         wpa_driver_nl80211_capa(drv);
1166
1167         wpa_driver_nl80211_send_oper_ifla(drv, 1, IF_OPER_DORMANT);
1168
1169         return 0;
1170 }
1171
1172
1173 /**
1174  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
1175  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1176  *
1177  * Shut down driver interface and processing of driver events. Free
1178  * private data buffer if one was allocated in wpa_driver_nl80211_init().
1179  */
1180 static void wpa_driver_nl80211_deinit(void *priv)
1181 {
1182         struct wpa_driver_nl80211_data *drv = priv;
1183
1184 #ifdef CONFIG_AP
1185         if (drv->monitor_ifidx >= 0)
1186                 nl80211_remove_iface(drv, drv->monitor_ifidx);
1187         if (drv->monitor_sock >= 0) {
1188                 eloop_unregister_read_sock(drv->monitor_sock);
1189                 close(drv->monitor_sock);
1190         }
1191 #endif /* CONFIG_AP */
1192
1193         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1194
1195         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED, 0);
1196
1197         wpa_driver_nl80211_send_oper_ifla(priv, 0, IF_OPER_UP);
1198
1199         eloop_unregister_read_sock(drv->link_event_sock);
1200
1201         hostapd_set_iface_flags(drv, drv->ifname, 0);
1202         wpa_driver_nl80211_set_mode(drv, 0);
1203
1204         close(drv->link_event_sock);
1205         close(drv->ioctl_sock);
1206
1207         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
1208         genl_family_put(drv->nl80211);
1209         nl_cache_free(drv->nl_cache);
1210         nl_handle_destroy(drv->nl_handle);
1211         nl_cb_put(drv->nl_cb);
1212
1213         os_free(drv);
1214 }
1215
1216
1217 /**
1218  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
1219  * @eloop_ctx: Unused
1220  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
1221  *
1222  * This function can be used as registered timeout when starting a scan to
1223  * generate a scan completed event if the driver does not report this.
1224  */
1225 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1226 {
1227         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
1228 #ifndef HOSTAPD
1229         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
1230 #endif /* HOSTAPD */
1231 }
1232
1233
1234 /**
1235  * wpa_driver_nl80211_scan - Request the driver to initiate scan
1236  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1237  * @params: Scan parameters
1238  * Returns: 0 on success, -1 on failure
1239  */
1240 static int wpa_driver_nl80211_scan(void *priv,
1241                                    struct wpa_driver_scan_params *params)
1242 {
1243         struct wpa_driver_nl80211_data *drv = priv;
1244         int ret = 0, timeout;
1245         struct nl_msg *msg, *ssids, *freqs;
1246         size_t i;
1247
1248         msg = nlmsg_alloc();
1249         ssids = nlmsg_alloc();
1250         freqs = nlmsg_alloc();
1251         if (!msg || !ssids || !freqs) {
1252                 nlmsg_free(msg);
1253                 nlmsg_free(ssids);
1254                 nlmsg_free(freqs);
1255                 return -1;
1256         }
1257
1258         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1259                     NL80211_CMD_TRIGGER_SCAN, 0);
1260
1261         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1262
1263         for (i = 0; i < params->num_ssids; i++) {
1264                 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
1265                         params->ssids[i].ssid);
1266         }
1267         if (params->num_ssids)
1268                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
1269
1270         if (params->extra_ies) {
1271                 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
1272                         params->extra_ies);
1273         }
1274
1275         if (params->freqs) {
1276                 for (i = 0; params->freqs[i]; i++)
1277                         NLA_PUT_U32(freqs, i + 1, params->freqs[i]);
1278                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
1279         }
1280
1281         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1282         msg = NULL;
1283         if (ret) {
1284                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
1285                            "(%s)", ret, strerror(-ret));
1286                 goto nla_put_failure;
1287         }
1288
1289         /* Not all drivers generate "scan completed" wireless event, so try to
1290          * read results after a timeout. */
1291         timeout = 10;
1292         if (drv->scan_complete_events) {
1293                 /*
1294                  * The driver seems to deliver events to notify when scan is
1295                  * complete, so use longer timeout to avoid race conditions
1296                  * with scanning and following association request.
1297                  */
1298                 timeout = 30;
1299         }
1300         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
1301                    "seconds", ret, timeout);
1302         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1303         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
1304                                drv, drv->ctx);
1305
1306 nla_put_failure:
1307         nlmsg_free(ssids);
1308         nlmsg_free(msg);
1309         nlmsg_free(freqs);
1310         return ret;
1311 }
1312
1313
1314 static int bss_info_handler(struct nl_msg *msg, void *arg)
1315 {
1316         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1317         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1318         struct nlattr *bss[NL80211_BSS_MAX + 1];
1319         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1320                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
1321                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1322                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1323                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1324                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1325                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
1326                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1327                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1328         };
1329         struct wpa_scan_results *res = arg;
1330         struct wpa_scan_res **tmp;
1331         struct wpa_scan_res *r;
1332         const u8 *ie;
1333         size_t ie_len;
1334
1335         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1336                   genlmsg_attrlen(gnlh, 0), NULL);
1337         if (!tb[NL80211_ATTR_BSS])
1338                 return NL_SKIP;
1339         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
1340                              bss_policy))
1341                 return NL_SKIP;
1342         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
1343                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1344                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1345         } else {
1346                 ie = NULL;
1347                 ie_len = 0;
1348         }
1349
1350         r = os_zalloc(sizeof(*r) + ie_len);
1351         if (r == NULL)
1352                 return NL_SKIP;
1353         if (bss[NL80211_BSS_BSSID])
1354                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
1355                           ETH_ALEN);
1356         if (bss[NL80211_BSS_FREQUENCY])
1357                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1358         if (bss[NL80211_BSS_BEACON_INTERVAL])
1359                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
1360         if (bss[NL80211_BSS_CAPABILITY])
1361                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1362         r->flags |= WPA_SCAN_NOISE_INVALID;
1363         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1364                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1365                 r->level /= 100; /* mBm to dBm */
1366                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
1367         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1368                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1369                 r->flags |= WPA_SCAN_LEVEL_INVALID;
1370         } else
1371                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
1372         if (bss[NL80211_BSS_TSF])
1373                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
1374         r->ie_len = ie_len;
1375         if (ie)
1376                 os_memcpy(r + 1, ie, ie_len);
1377
1378         tmp = os_realloc(res->res,
1379                          (res->num + 1) * sizeof(struct wpa_scan_res *));
1380         if (tmp == NULL) {
1381                 os_free(r);
1382                 return NL_SKIP;
1383         }
1384         tmp[res->num++] = r;
1385         res->res = tmp;
1386
1387         return NL_SKIP;
1388 }
1389
1390
1391 /**
1392  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1393  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1394  * Returns: Scan results on success, -1 on failure
1395  */
1396 static struct wpa_scan_results *
1397 wpa_driver_nl80211_get_scan_results(void *priv)
1398 {
1399         struct wpa_driver_nl80211_data *drv = priv;
1400         struct nl_msg *msg;
1401         struct wpa_scan_results *res;
1402         int ret;
1403
1404         res = os_zalloc(sizeof(*res));
1405         if (res == NULL)
1406                 return 0;
1407         msg = nlmsg_alloc();
1408         if (!msg)
1409                 goto nla_put_failure;
1410
1411         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
1412                     NL80211_CMD_GET_SCAN, 0);
1413         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1414
1415         ret = send_and_recv_msgs(drv, msg, bss_info_handler, res);
1416         msg = NULL;
1417         if (ret == 0) {
1418                 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
1419                            (unsigned long) res->num);
1420                 return res;
1421         }
1422         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1423                    "(%s)", ret, strerror(-ret));
1424 nla_put_failure:
1425         nlmsg_free(msg);
1426         wpa_scan_results_free(res);
1427         return NULL;
1428 }
1429
1430
1431 static int nl_set_encr(int ifindex, struct wpa_driver_nl80211_data *drv,
1432                        wpa_alg alg, const u8 *addr, int key_idx, int set_tx,
1433                        const u8 *seq, size_t seq_len,
1434                        const u8 *key, size_t key_len)
1435 {
1436         struct nl_msg *msg;
1437         int ret;
1438
1439         wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
1440                    "set_tx=%d seq_len=%lu key_len=%lu",
1441                    __func__, ifindex, alg, addr, key_idx, set_tx,
1442                    (unsigned long) seq_len, (unsigned long) key_len);
1443
1444         msg = nlmsg_alloc();
1445         if (!msg)
1446                 return -ENOMEM;
1447
1448         if (alg == WPA_ALG_NONE) {
1449                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1450                             0, NL80211_CMD_DEL_KEY, 0);
1451         } else {
1452                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1453                             0, NL80211_CMD_NEW_KEY, 0);
1454                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
1455                 switch (alg) {
1456                 case WPA_ALG_WEP:
1457                         if (key_len == 5)
1458                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1459                                             0x000FAC01);
1460                         else
1461                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1462                                             0x000FAC05);
1463                         break;
1464                 case WPA_ALG_TKIP:
1465                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
1466                         break;
1467                 case WPA_ALG_CCMP:
1468                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
1469                         break;
1470                 case WPA_ALG_IGTK:
1471                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC06);
1472                         break;
1473                 default:
1474                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
1475                                    "algorithm %d", __func__, alg);
1476                         nlmsg_free(msg);
1477                         return -1;
1478                 }
1479         }
1480
1481         if (seq)
1482                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
1483
1484         if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1485         {
1486                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
1487                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1488         }
1489         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1490         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
1491
1492         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1493         if (ret == -ENOENT && alg == WPA_ALG_NONE)
1494                 ret = 0;
1495         if (ret)
1496                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
1497                            ret, strerror(-ret));
1498
1499         /*
1500          * If we failed or don't need to set the default TX key (below),
1501          * we're done here.
1502          */
1503         if (ret || !set_tx || alg == WPA_ALG_NONE)
1504                 return ret;
1505 #ifdef HOSTAPD /* FIX: is this needed? */
1506         if (addr)
1507                 return ret;
1508 #endif /* HOSTAPD */
1509
1510         msg = nlmsg_alloc();
1511         if (!msg)
1512                 return -ENOMEM;
1513
1514         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1515                     0, NL80211_CMD_SET_KEY, 0);
1516         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1517         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
1518         if (alg == WPA_ALG_IGTK)
1519                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
1520         else
1521                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
1522
1523         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1524         if (ret == -ENOENT)
1525                 ret = 0;
1526         if (ret)
1527                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
1528                            "err=%d %s)", ret, strerror(-ret));
1529         return ret;
1530
1531 nla_put_failure:
1532         return -ENOBUFS;
1533 }
1534
1535
1536 static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
1537                                       const u8 *addr, int key_idx,
1538                                       int set_tx, const u8 *seq,
1539                                       size_t seq_len,
1540                                       const u8 *key, size_t key_len)
1541 {
1542         struct wpa_driver_nl80211_data *drv = priv;
1543         return nl_set_encr(drv->ifindex, drv, alg, addr, key_idx, set_tx, seq,
1544                            seq_len, key, key_len);
1545 }
1546
1547
1548 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
1549                                    const u8 *addr, int cmd, u16 reason_code)
1550 {
1551         int ret = -1;
1552         struct nl_msg *msg;
1553
1554         msg = nlmsg_alloc();
1555         if (!msg)
1556                 return -1;
1557
1558         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
1559
1560         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1561         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
1562         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1563
1564         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1565         msg = NULL;
1566         if (ret) {
1567                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1568                            "(%s)", ret, strerror(-ret));
1569                 goto nla_put_failure;
1570         }
1571         ret = 0;
1572
1573 nla_put_failure:
1574         nlmsg_free(msg);
1575         return ret;
1576 }
1577
1578
1579 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
1580                                              int reason_code)
1581 {
1582         struct wpa_driver_nl80211_data *drv = priv;
1583         wpa_printf(MSG_DEBUG, "%s", __func__);
1584         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
1585                                        reason_code);
1586 }
1587
1588
1589 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
1590                                            int reason_code)
1591 {
1592         struct wpa_driver_nl80211_data *drv = priv;
1593         wpa_printf(MSG_DEBUG, "%s", __func__);
1594         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
1595                                        reason_code);
1596 }
1597
1598
1599 static int wpa_driver_nl80211_authenticate(
1600         void *priv, struct wpa_driver_auth_params *params)
1601 {
1602         struct wpa_driver_nl80211_data *drv = priv;
1603         int ret = -1, i;
1604         struct nl_msg *msg;
1605         enum nl80211_auth_type type;
1606
1607         drv->associated = 0;
1608
1609         msg = nlmsg_alloc();
1610         if (!msg)
1611                 return -1;
1612
1613         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
1614                    drv->ifindex);
1615
1616         for (i = 0; i < 4; i++) {
1617                 if (!params->wep_key[i])
1618                         continue;
1619                 wpa_driver_nl80211_set_key(drv, WPA_ALG_WEP, NULL, i,
1620                                            i == params->wep_tx_keyidx, NULL, 0,
1621                                            params->wep_key[i],
1622                                            params->wep_key_len[i]);
1623         }
1624
1625         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1626                     NL80211_CMD_AUTHENTICATE, 0);
1627
1628         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1629         if (params->bssid) {
1630                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
1631                            MAC2STR(params->bssid));
1632                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
1633         }
1634         if (params->freq) {
1635                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
1636                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
1637         }
1638         if (params->ssid) {
1639                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
1640                                   params->ssid, params->ssid_len);
1641                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
1642                         params->ssid);
1643         }
1644         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
1645         if (params->ie)
1646                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
1647         /*
1648          * TODO: if multiple auth_alg options enabled, try them one by one if
1649          * the AP rejects authentication due to unknown auth alg
1650          */
1651         if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
1652                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1653         else if (params->auth_alg & AUTH_ALG_SHARED_KEY)
1654                 type = NL80211_AUTHTYPE_SHARED_KEY;
1655         else if (params->auth_alg & AUTH_ALG_LEAP)
1656                 type = NL80211_AUTHTYPE_NETWORK_EAP;
1657         else if (params->auth_alg & AUTH_ALG_FT)
1658                 type = NL80211_AUTHTYPE_FT;
1659         else
1660                 goto nla_put_failure;
1661         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
1662         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
1663
1664         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1665         msg = NULL;
1666         if (ret) {
1667                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1668                            "(%s)", ret, strerror(-ret));
1669                 goto nla_put_failure;
1670         }
1671         ret = 0;
1672         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
1673                    "successfully");
1674
1675 nla_put_failure:
1676         nlmsg_free(msg);
1677         return ret;
1678 }
1679
1680
1681 #if defined(CONFIG_AP) || defined(HOSTAPD)
1682
1683 struct phy_info_arg {
1684         u16 *num_modes;
1685         struct hostapd_hw_modes *modes;
1686 };
1687
1688 static int phy_info_handler(struct nl_msg *msg, void *arg)
1689 {
1690         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1691         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1692         struct phy_info_arg *phy_info = arg;
1693
1694         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
1695
1696         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
1697         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
1698                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
1699                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
1700                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
1701                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
1702                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
1703                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
1704         };
1705
1706         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
1707         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
1708                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
1709                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
1710         };
1711
1712         struct nlattr *nl_band;
1713         struct nlattr *nl_freq;
1714         struct nlattr *nl_rate;
1715         int rem_band, rem_freq, rem_rate;
1716         struct hostapd_hw_modes *mode;
1717         int idx, mode_is_set;
1718
1719         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1720                   genlmsg_attrlen(gnlh, 0), NULL);
1721
1722         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
1723                 return NL_SKIP;
1724
1725         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
1726                 mode = realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode));
1727                 if (!mode)
1728                         return NL_SKIP;
1729                 phy_info->modes = mode;
1730
1731                 mode_is_set = 0;
1732
1733                 mode = &phy_info->modes[*(phy_info->num_modes)];
1734                 memset(mode, 0, sizeof(*mode));
1735                 *(phy_info->num_modes) += 1;
1736
1737                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
1738                           nla_len(nl_band), NULL);
1739
1740                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
1741                         mode->ht_capab = nla_get_u16(
1742                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
1743                 }
1744
1745                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1746                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1747                                   nla_len(nl_freq), freq_policy);
1748                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1749                                 continue;
1750                         mode->num_channels++;
1751                 }
1752
1753                 mode->channels = calloc(mode->num_channels, sizeof(struct hostapd_channel_data));
1754                 if (!mode->channels)
1755                         return NL_SKIP;
1756
1757                 idx = 0;
1758
1759                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1760                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1761                                   nla_len(nl_freq), freq_policy);
1762                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1763                                 continue;
1764
1765                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
1766                         mode->channels[idx].flag = 0;
1767
1768                         if (!mode_is_set) {
1769                                 /* crude heuristic */
1770                                 if (mode->channels[idx].freq < 4000)
1771                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
1772                                 else
1773                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
1774                                 mode_is_set = 1;
1775                         }
1776
1777                         /* crude heuristic */
1778                         if (mode->channels[idx].freq < 4000)
1779                                 if (mode->channels[idx].freq == 2484)
1780                                         mode->channels[idx].chan = 14;
1781                                 else
1782                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
1783                         else
1784                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
1785
1786                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1787                                 mode->channels[idx].flag |=
1788                                         HOSTAPD_CHAN_DISABLED;
1789                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
1790                                 mode->channels[idx].flag |=
1791                                         HOSTAPD_CHAN_PASSIVE_SCAN;
1792                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
1793                                 mode->channels[idx].flag |=
1794                                         HOSTAPD_CHAN_NO_IBSS;
1795                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
1796                                 mode->channels[idx].flag |=
1797                                         HOSTAPD_CHAN_RADAR;
1798
1799                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
1800                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1801                                 mode->channels[idx].max_tx_power =
1802                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
1803
1804                         idx++;
1805                 }
1806
1807                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1808                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1809                                   nla_len(nl_rate), rate_policy);
1810                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1811                                 continue;
1812                         mode->num_rates++;
1813                 }
1814
1815                 mode->rates = calloc(mode->num_rates, sizeof(struct hostapd_rate_data));
1816                 if (!mode->rates)
1817                         return NL_SKIP;
1818
1819                 idx = 0;
1820
1821                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1822                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1823                                   nla_len(nl_rate), rate_policy);
1824                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1825                                 continue;
1826                         mode->rates[idx].rate = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
1827
1828                         /* crude heuristic */
1829                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
1830                             mode->rates[idx].rate > 200)
1831                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
1832
1833                         if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
1834                                 mode->rates[idx].flags |= HOSTAPD_RATE_PREAMBLE2;
1835
1836                         idx++;
1837                 }
1838         }
1839
1840         return NL_SKIP;
1841 }
1842
1843 static struct hostapd_hw_modes *
1844 wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
1845 {
1846         u16 m;
1847         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
1848         int i, mode11g_idx = -1;
1849
1850         /* If only 802.11g mode is included, use it to construct matching
1851          * 802.11b mode data. */
1852
1853         for (m = 0; m < *num_modes; m++) {
1854                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
1855                         return modes; /* 802.11b already included */
1856                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
1857                         mode11g_idx = m;
1858         }
1859
1860         if (mode11g_idx < 0)
1861                 return modes; /* 2.4 GHz band not supported at all */
1862
1863         nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes));
1864         if (nmodes == NULL)
1865                 return modes; /* Could not add 802.11b mode */
1866
1867         mode = &nmodes[*num_modes];
1868         os_memset(mode, 0, sizeof(*mode));
1869         (*num_modes)++;
1870         modes = nmodes;
1871
1872         mode->mode = HOSTAPD_MODE_IEEE80211B;
1873
1874         mode11g = &modes[mode11g_idx];
1875         mode->num_channels = mode11g->num_channels;
1876         mode->channels = os_malloc(mode11g->num_channels *
1877                                    sizeof(struct hostapd_channel_data));
1878         if (mode->channels == NULL) {
1879                 (*num_modes)--;
1880                 return modes; /* Could not add 802.11b mode */
1881         }
1882         os_memcpy(mode->channels, mode11g->channels,
1883                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
1884
1885         mode->num_rates = 0;
1886         mode->rates = os_malloc(4 * sizeof(struct hostapd_rate_data));
1887         if (mode->rates == NULL) {
1888                 os_free(mode->channels);
1889                 (*num_modes)--;
1890                 return modes; /* Could not add 802.11b mode */
1891         }
1892
1893         for (i = 0; i < mode11g->num_rates; i++) {
1894                 if (mode11g->rates[i].rate > 110 ||
1895                     mode11g->rates[i].flags &
1896                     (HOSTAPD_RATE_ERP | HOSTAPD_RATE_OFDM))
1897                         continue;
1898                 mode->rates[mode->num_rates] = mode11g->rates[i];
1899                 mode->num_rates++;
1900                 if (mode->num_rates == 4)
1901                         break;
1902         }
1903
1904         if (mode->num_rates == 0) {
1905                 os_free(mode->channels);
1906                 os_free(mode->rates);
1907                 (*num_modes)--;
1908                 return modes; /* No 802.11b rates */
1909         }
1910
1911         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
1912                    "information");
1913
1914         return modes;
1915 }
1916
1917
1918 static struct hostapd_hw_modes *
1919 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
1920 {
1921         struct wpa_driver_nl80211_data *drv = priv;
1922         struct nl_msg *msg;
1923         struct phy_info_arg result = {
1924                 .num_modes = num_modes,
1925                 .modes = NULL,
1926         };
1927
1928         *num_modes = 0;
1929         *flags = 0;
1930
1931         msg = nlmsg_alloc();
1932         if (!msg)
1933                 return NULL;
1934
1935         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1936                     0, NL80211_CMD_GET_WIPHY, 0);
1937
1938         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1939
1940         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
1941                 return wpa_driver_nl80211_add_11b(result.modes, num_modes);
1942  nla_put_failure:
1943         return NULL;
1944 }
1945
1946
1947 static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv,
1948                                          const void *data, size_t len,
1949                                          int encrypt)
1950 {
1951         __u8 rtap_hdr[] = {
1952                 0x00, 0x00, /* radiotap version */
1953                 0x0e, 0x00, /* radiotap length */
1954                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
1955                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
1956                 0x00,       /* padding */
1957                 0x00, 0x00, /* RX and TX flags to indicate that */
1958                 0x00, 0x00, /* this is the injected frame directly */
1959         };
1960         struct iovec iov[2] = {
1961                 {
1962                         .iov_base = &rtap_hdr,
1963                         .iov_len = sizeof(rtap_hdr),
1964                 },
1965                 {
1966                         .iov_base = (void *) data,
1967                         .iov_len = len,
1968                 }
1969         };
1970         struct msghdr msg = {
1971                 .msg_name = NULL,
1972                 .msg_namelen = 0,
1973                 .msg_iov = iov,
1974                 .msg_iovlen = 2,
1975                 .msg_control = NULL,
1976                 .msg_controllen = 0,
1977                 .msg_flags = 0,
1978         };
1979
1980         if (encrypt)
1981                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
1982
1983         return sendmsg(drv->monitor_sock, &msg, 0);
1984 }
1985
1986
1987 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
1988                                         size_t data_len)
1989 {
1990         struct wpa_driver_nl80211_data *drv = priv;
1991         struct ieee80211_mgmt *mgmt;
1992         int do_not_encrypt = 0;
1993         u16 fc;
1994
1995         mgmt = (struct ieee80211_mgmt *) data;
1996         fc = le_to_host16(mgmt->frame_control);
1997
1998         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
1999             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
2000                 /*
2001                  * Only one of the authentication frame types is encrypted.
2002                  * In order for static WEP encryption to work properly (i.e.,
2003                  * to not encrypt the frame), we need to tell mac80211 about
2004                  * the frames that must not be encrypted.
2005                  */
2006                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2007                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
2008                 if (auth_alg == WLAN_AUTH_OPEN ||
2009                     (auth_alg == WLAN_AUTH_SHARED_KEY && auth_trans != 3))
2010                         do_not_encrypt = 1;
2011         }
2012
2013         return wpa_driver_nl80211_send_frame(drv, data, data_len,
2014                                              !do_not_encrypt);
2015 }
2016
2017 #endif /* CONFIG_AP || HOSTAPD */
2018
2019
2020 #ifdef CONFIG_AP
2021
2022 static int wpa_driver_nl80211_set_beacon(void *priv,
2023                                          const u8 *head, size_t head_len,
2024                                          const u8 *tail, size_t tail_len,
2025                                          int dtim_period)
2026 {
2027         struct wpa_driver_nl80211_data *drv = priv;
2028         struct nl_msg *msg;
2029         u8 cmd = NL80211_CMD_NEW_BEACON;
2030         int ret;
2031
2032         msg = nlmsg_alloc();
2033         if (!msg)
2034                 return -ENOMEM;
2035
2036         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
2037                    drv->beacon_set);
2038         if (drv->beacon_set)
2039                 cmd = NL80211_CMD_SET_BEACON;
2040
2041         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2042                     0, cmd, 0);
2043         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
2044         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
2045         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2046         if (!drv->beacon_int)
2047                 drv->beacon_int = 100;
2048         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, drv->beacon_int);
2049         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
2050
2051         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2052         if (ret) {
2053                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
2054                            ret, strerror(-ret));
2055         } else
2056                 drv->beacon_set = 1;
2057         return ret;
2058  nla_put_failure:
2059         return -ENOBUFS;
2060 }
2061
2062
2063 static int wpa_driver_nl80211_set_beacon_int(void *priv, int value)
2064 {
2065         struct wpa_driver_nl80211_data *drv = priv;
2066         struct nl_msg *msg;
2067
2068         drv->beacon_int = value;
2069
2070         if (!drv->beacon_set)
2071                 return 0;
2072
2073         msg = nlmsg_alloc();
2074         if (!msg)
2075                 return -ENOMEM;
2076
2077         wpa_printf(MSG_DEBUG, "nl80211: Set beacon interval %d "
2078                    "(beacon_set=%d)", value, drv->beacon_set);
2079         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2080                     0, NL80211_CMD_SET_BEACON, 0);
2081         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2082
2083         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
2084
2085         return send_and_recv_msgs(drv, msg, NULL, NULL);
2086  nla_put_failure:
2087         return -ENOBUFS;
2088 }
2089
2090
2091 static int wpa_driver_nl80211_set_freq2(
2092         struct wpa_driver_nl80211_data *drv,
2093         struct wpa_driver_associate_params *params)
2094 {
2095         struct nl_msg *msg;
2096         int ret;
2097
2098         msg = nlmsg_alloc();
2099         if (!msg)
2100                 return -1;
2101
2102         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2103                     NL80211_CMD_SET_WIPHY, 0);
2104
2105         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2106
2107         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2108
2109         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2110         if (ret == 0)
2111                 return 0;
2112         wpa_printf(MSG_DEBUG, "nl80211: MLME Failed to set channel (freq=%d): "
2113                    "%d (%s)", params->freq, ret, strerror(-ret));
2114 nla_put_failure:
2115         return -1;
2116 }
2117
2118 #endif /* CONFIG_AP */
2119
2120 #if defined(CONFIG_AP) || defined(HOSTAPD)
2121
2122 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
2123                                  int ifidx)
2124 {
2125         struct nl_msg *msg;
2126
2127 #ifdef HOSTAPD
2128         /* stop listening for EAPOL on this interface */
2129         del_ifidx(drv, ifidx);
2130 #endif /* HOSTAPD */
2131
2132         msg = nlmsg_alloc();
2133         if (!msg)
2134                 goto nla_put_failure;
2135
2136         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2137                     0, NL80211_CMD_DEL_INTERFACE, 0);
2138         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
2139
2140         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
2141                 return;
2142  nla_put_failure:
2143         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d).\n",
2144                    ifidx);
2145 }
2146
2147
2148 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
2149                                 const char *ifname, enum nl80211_iftype iftype,
2150                                 const u8 *addr)
2151 {
2152         struct nl_msg *msg, *flags = NULL;
2153         int ifidx;
2154         int ret = -ENOBUFS;
2155 #ifdef HOSTAPD
2156         struct ifreq ifreq;
2157         struct iwreq iwr;
2158 #endif /* HOSTAPD */
2159
2160         msg = nlmsg_alloc();
2161         if (!msg)
2162                 return -1;
2163
2164         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2165                     0, NL80211_CMD_NEW_INTERFACE, 0);
2166         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2167         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
2168         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
2169
2170         if (iftype == NL80211_IFTYPE_MONITOR) {
2171                 int err;
2172
2173                 flags = nlmsg_alloc();
2174                 if (!flags)
2175                         goto nla_put_failure;
2176
2177                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
2178
2179                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
2180
2181                 nlmsg_free(flags);
2182
2183                 if (err)
2184                         goto nla_put_failure;
2185         }
2186
2187         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2188         if (ret) {
2189  nla_put_failure:
2190                 wpa_printf(MSG_ERROR, "Failed to create interface %s.",
2191                            ifname);
2192                 return ret;
2193         }
2194
2195         ifidx = if_nametoindex(ifname);
2196
2197         if (ifidx <= 0)
2198                 return -1;
2199
2200 #ifdef HOSTAPD
2201         /* start listening for EAPOL on this interface */
2202         add_ifidx(drv, ifidx);
2203
2204         if (addr) {
2205                 switch (iftype) {
2206                 case NL80211_IFTYPE_AP:
2207                         os_strlcpy(ifreq.ifr_name, ifname, IFNAMSIZ);
2208                         memcpy(ifreq.ifr_hwaddr.sa_data, addr, ETH_ALEN);
2209                         ifreq.ifr_hwaddr.sa_family = ARPHRD_ETHER;
2210
2211                         if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifreq)) {
2212                                 nl80211_remove_iface(drv, ifidx);
2213                                 return -1;
2214                         }
2215                         break;
2216                 case NL80211_IFTYPE_WDS:
2217                         memset(&iwr, 0, sizeof(iwr));
2218                         os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
2219                         iwr.u.addr.sa_family = ARPHRD_ETHER;
2220                         memcpy(iwr.u.addr.sa_data, addr, ETH_ALEN);
2221                         if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr))
2222                                 return -1;
2223                         break;
2224                 default:
2225                         /* nothing */
2226                         break;
2227                 }
2228         }
2229 #endif /* HOSTAPD */
2230
2231         return ifidx;
2232 }
2233
2234 #endif /* CONFIG_AP || HOSTAPD */
2235
2236 #ifdef CONFIG_AP
2237
2238 void ap_tx_status(void *ctx, const u8 *addr,
2239                   const u8 *buf, size_t len, int ack);
2240 void ap_rx_from_unknown_sta(void *ctx, const u8 *addr);
2241 void ap_mgmt_rx(void *ctx, u8 *buf, size_t len, u16 stype,
2242                 struct hostapd_frame_info *fi);
2243 void ap_mgmt_tx_cb(void *ctx, u8 *buf, size_t len, u16 stype, int ok);
2244
2245 #endif /* CONFIG_AP */
2246
2247 #if defined(CONFIG_AP) || defined(HOSTAPD)
2248
2249 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
2250 {
2251         struct ieee80211_hdr *hdr;
2252         u16 fc, type, stype;
2253
2254         hdr = (struct ieee80211_hdr *) buf;
2255         fc = le_to_host16(hdr->frame_control);
2256
2257         type = WLAN_FC_GET_TYPE(fc);
2258         stype = WLAN_FC_GET_STYPE(fc);
2259
2260         switch (type) {
2261         case WLAN_FC_TYPE_MGMT:
2262                 wpa_printf(MSG_DEBUG, "MGMT (TX callback) %s",
2263                            ok ? "ACK" : "fail");
2264 #ifdef HOSTAPD
2265                 hostapd_mgmt_tx_cb(ctx, buf, len, stype, ok);
2266 #else /* HOSTAPD */
2267                 ap_mgmt_tx_cb(ctx, buf, len, stype, ok);
2268 #endif /* HOSTAPD */
2269                 break;
2270         case WLAN_FC_TYPE_CTRL:
2271                 wpa_printf(MSG_DEBUG, "CTRL (TX callback) %s",
2272                            ok ? "ACK" : "fail");
2273                 break;
2274         case WLAN_FC_TYPE_DATA:
2275 #ifdef HOSTAPD
2276                 hostapd_tx_status(ctx, hdr->addr1, buf, len, ok);
2277 #else /* HOSTAPD */
2278                 ap_tx_status(ctx, hdr->addr1, buf, len, ok);
2279 #endif /* HOSTAPD */
2280                 break;
2281         default:
2282                 wpa_printf(MSG_DEBUG, "unknown TX callback frame type %d",
2283                            type);
2284                 break;
2285         }
2286 }
2287
2288 #endif /* CONFIG_AP || HOSTAPD */
2289
2290 #ifdef CONFIG_AP
2291
2292 static void handle_frame(struct wpa_driver_nl80211_data *drv,
2293                          u8 *buf, size_t len,
2294                          struct hostapd_frame_info *hfi,
2295                          enum ieee80211_msg_type msg_type)
2296 {
2297         struct ieee80211_hdr *hdr;
2298         u16 fc, type, stype;
2299         size_t data_len = len;
2300
2301         /*
2302          * PS-Poll frames are 16 bytes. All other frames are
2303          * 24 bytes or longer.
2304          */
2305         if (len < 16)
2306                 return;
2307
2308         hdr = (struct ieee80211_hdr *) buf;
2309         fc = le_to_host16(hdr->frame_control);
2310
2311         type = WLAN_FC_GET_TYPE(fc);
2312         stype = WLAN_FC_GET_STYPE(fc);
2313
2314         switch (type) {
2315         case WLAN_FC_TYPE_DATA:
2316                 if (len < 24)
2317                         return;
2318                 switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
2319                 case WLAN_FC_TODS:
2320                         break;
2321                 case WLAN_FC_FROMDS:
2322                         break;
2323                 default:
2324                         /* discard */
2325                         return;
2326                 }
2327                 break;
2328         case WLAN_FC_TYPE_CTRL:
2329                 /* discard non-ps-poll frames */
2330                 if (stype != WLAN_FC_STYPE_PSPOLL)
2331                         return;
2332                 break;
2333         case WLAN_FC_TYPE_MGMT:
2334                 break;
2335         default:
2336                 /* discard */
2337                 return;
2338         }
2339
2340         switch (msg_type) {
2341         case ieee80211_msg_normal:
2342                 /* continue processing */
2343                 break;
2344         case ieee80211_msg_tx_callback_ack:
2345                 handle_tx_callback(drv->ctx, buf, data_len, 1);
2346                 return;
2347         case ieee80211_msg_tx_callback_fail:
2348                 handle_tx_callback(drv->ctx, buf, data_len, 0);
2349                 return;
2350         }
2351
2352         switch (type) {
2353         case WLAN_FC_TYPE_MGMT:
2354                 if (stype != WLAN_FC_STYPE_BEACON &&
2355                     stype != WLAN_FC_STYPE_PROBE_REQ)
2356                         wpa_printf(MSG_MSGDUMP, "MGMT");
2357                 ap_mgmt_rx(drv->ctx, buf, data_len, stype, hfi);
2358                 break;
2359         case WLAN_FC_TYPE_CTRL:
2360                 /* can only get here with PS-Poll frames */
2361                 wpa_printf(MSG_DEBUG, "CTRL");
2362                 ap_rx_from_unknown_sta(drv->ctx, hdr->addr2);
2363                 break;
2364         case WLAN_FC_TYPE_DATA:
2365                 ap_rx_from_unknown_sta(drv->ctx, hdr->addr2);
2366                 break;
2367         }
2368 }
2369
2370 #endif /* CONFIG_AP */
2371
2372 #if defined(CONFIG_AP) || defined(HOSTAPD)
2373
2374 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
2375 {
2376         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2377         int len;
2378         unsigned char buf[3000];
2379         struct ieee80211_radiotap_iterator iter;
2380         int ret;
2381         struct hostapd_frame_info hfi;
2382         int injected = 0, failed = 0, msg_type, rxflags = 0;
2383
2384         len = recv(sock, buf, sizeof(buf), 0);
2385         if (len < 0) {
2386                 perror("recv");
2387                 return;
2388         }
2389
2390         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
2391                 printf("received invalid radiotap frame\n");
2392                 return;
2393         }
2394
2395         memset(&hfi, 0, sizeof(hfi));
2396
2397         while (1) {
2398                 ret = ieee80211_radiotap_iterator_next(&iter);
2399                 if (ret == -ENOENT)
2400                         break;
2401                 if (ret) {
2402                         printf("received invalid radiotap frame (%d)\n", ret);
2403                         return;
2404                 }
2405                 switch (iter.this_arg_index) {
2406                 case IEEE80211_RADIOTAP_FLAGS:
2407                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
2408                                 len -= 4;
2409                         break;
2410                 case IEEE80211_RADIOTAP_RX_FLAGS:
2411                         rxflags = 1;
2412                         break;
2413                 case IEEE80211_RADIOTAP_TX_FLAGS:
2414                         injected = 1;
2415                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
2416                                         IEEE80211_RADIOTAP_F_TX_FAIL;
2417                         break;
2418                 case IEEE80211_RADIOTAP_DATA_RETRIES:
2419                         break;
2420                 case IEEE80211_RADIOTAP_CHANNEL:
2421                         /* TODO convert from freq/flags to channel number
2422                         hfi.channel = XXX;
2423                         hfi.phytype = XXX;
2424                          */
2425                         break;
2426                 case IEEE80211_RADIOTAP_RATE:
2427                         hfi.datarate = *iter.this_arg * 5;
2428                         break;
2429                 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2430                         hfi.ssi_signal = *iter.this_arg;
2431                         break;
2432                 }
2433         }
2434
2435         if (rxflags && injected)
2436                 return;
2437
2438         if (!injected)
2439                 msg_type = ieee80211_msg_normal;
2440         else if (failed)
2441                 msg_type = ieee80211_msg_tx_callback_fail;
2442         else
2443                 msg_type = ieee80211_msg_tx_callback_ack;
2444
2445         handle_frame(drv, buf + iter.max_length,
2446                      len - iter.max_length, &hfi, msg_type);
2447 }
2448
2449
2450 /*
2451  * we post-process the filter code later and rewrite
2452  * this to the offset to the last instruction
2453  */
2454 #define PASS    0xFF
2455 #define FAIL    0xFE
2456
2457 static struct sock_filter msock_filter_insns[] = {
2458         /*
2459          * do a little-endian load of the radiotap length field
2460          */
2461         /* load lower byte into A */
2462         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
2463         /* put it into X (== index register) */
2464         BPF_STMT(BPF_MISC| BPF_TAX, 0),
2465         /* load upper byte into A */
2466         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
2467         /* left-shift it by 8 */
2468         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
2469         /* or with X */
2470         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
2471         /* put result into X */
2472         BPF_STMT(BPF_MISC| BPF_TAX, 0),
2473
2474         /*
2475          * Allow management frames through, this also gives us those
2476          * management frames that we sent ourselves with status
2477          */
2478         /* load the lower byte of the IEEE 802.11 frame control field */
2479         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
2480         /* mask off frame type and version */
2481         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
2482         /* accept frame if it's both 0, fall through otherwise */
2483         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
2484
2485         /*
2486          * TODO: add a bit to radiotap RX flags that indicates
2487          * that the sending station is not associated, then
2488          * add a filter here that filters on our DA and that flag
2489          * to allow us to deauth frames to that bad station.
2490          *
2491          * Not a regression -- we didn't do it before either.
2492          */
2493
2494 #if 0
2495         /*
2496          * drop non-data frames, WDS frames
2497          */
2498         /* load the lower byte of the frame control field */
2499         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2500         /* mask off QoS bit */
2501         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
2502         /* drop non-data frames */
2503         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
2504         /* load the upper byte of the frame control field */
2505         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2506         /* mask off toDS/fromDS */
2507         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
2508         /* drop WDS frames */
2509         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, FAIL, 0),
2510 #endif
2511
2512         /*
2513          * add header length to index
2514          */
2515         /* load the lower byte of the frame control field */
2516         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2517         /* mask off QoS bit */
2518         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
2519         /* right shift it by 6 to give 0 or 2 */
2520         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
2521         /* add data frame header length */
2522         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
2523         /* add index, was start of 802.11 header */
2524         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
2525         /* move to index, now start of LL header */
2526         BPF_STMT(BPF_MISC | BPF_TAX, 0),
2527
2528         /*
2529          * Accept empty data frames, we use those for
2530          * polling activity.
2531          */
2532         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
2533         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
2534
2535         /*
2536          * Accept EAPOL frames
2537          */
2538         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
2539         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
2540         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
2541         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
2542
2543         /* keep these last two statements or change the code below */
2544         /* return 0 == "DROP" */
2545         BPF_STMT(BPF_RET | BPF_K, 0),
2546         /* return ~0 == "keep all" */
2547         BPF_STMT(BPF_RET | BPF_K, ~0),
2548 };
2549
2550 static struct sock_fprog msock_filter = {
2551         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
2552         .filter = msock_filter_insns,
2553 };
2554
2555
2556 static int add_monitor_filter(int s)
2557 {
2558         int idx;
2559
2560         /* rewrite all PASS/FAIL jump offsets */
2561         for (idx = 0; idx < msock_filter.len; idx++) {
2562                 struct sock_filter *insn = &msock_filter_insns[idx];
2563
2564                 if (BPF_CLASS(insn->code) == BPF_JMP) {
2565                         if (insn->code == (BPF_JMP|BPF_JA)) {
2566                                 if (insn->k == PASS)
2567                                         insn->k = msock_filter.len - idx - 2;
2568                                 else if (insn->k == FAIL)
2569                                         insn->k = msock_filter.len - idx - 3;
2570                         }
2571
2572                         if (insn->jt == PASS)
2573                                 insn->jt = msock_filter.len - idx - 2;
2574                         else if (insn->jt == FAIL)
2575                                 insn->jt = msock_filter.len - idx - 3;
2576
2577                         if (insn->jf == PASS)
2578                                 insn->jf = msock_filter.len - idx - 2;
2579                         else if (insn->jf == FAIL)
2580                                 insn->jf = msock_filter.len - idx - 3;
2581                 }
2582         }
2583
2584         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
2585                        &msock_filter, sizeof(msock_filter))) {
2586                 perror("SO_ATTACH_FILTER");
2587                 return -1;
2588         }
2589
2590         return 0;
2591 }
2592
2593
2594 static int
2595 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
2596 {
2597         char buf[IFNAMSIZ];
2598         struct sockaddr_ll ll;
2599         int optval;
2600         socklen_t optlen;
2601
2602         snprintf(buf, IFNAMSIZ, "mon.%s", drv->ifname);
2603         buf[IFNAMSIZ - 1] = '\0';
2604
2605         drv->monitor_ifidx =
2606                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL);
2607
2608         if (drv->monitor_ifidx < 0)
2609                 return -1;
2610
2611         if (hostapd_set_iface_flags(drv, buf, 1))
2612                 goto error;
2613
2614         memset(&ll, 0, sizeof(ll));
2615         ll.sll_family = AF_PACKET;
2616         ll.sll_ifindex = drv->monitor_ifidx;
2617         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
2618         if (drv->monitor_sock < 0) {
2619                 perror("socket[PF_PACKET,SOCK_RAW]");
2620                 goto error;
2621         }
2622
2623         if (add_monitor_filter(drv->monitor_sock)) {
2624                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
2625                            "interface; do filtering in user space");
2626                 /* This works, but will cost in performance. */
2627         }
2628
2629         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
2630                 perror("monitor socket bind");
2631                 goto error;
2632         }
2633
2634         optlen = sizeof(optval);
2635         optval = 20;
2636         if (setsockopt
2637             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
2638                 perror("Failed to set socket priority");
2639                 goto error;
2640         }
2641
2642         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
2643                                      drv, NULL)) {
2644                 printf("Could not register monitor read socket\n");
2645                 goto error;
2646         }
2647
2648         return 0;
2649  error:
2650         nl80211_remove_iface(drv, drv->monitor_ifidx);
2651         return -1;
2652 }
2653
2654 #endif /* CONFIG_AP || HOSTAPD */
2655
2656 #ifdef CONFIG_AP
2657
2658 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
2659                                  struct wpa_driver_associate_params *params)
2660 {
2661         if (drv->monitor_ifidx < 0 &&
2662             nl80211_create_monitor_interface(drv))
2663                 return -1;
2664
2665         if (wpa_driver_nl80211_set_mode(drv, params->mode) ||
2666             wpa_driver_nl80211_set_freq2(drv, params)) {
2667                 nl80211_remove_iface(drv, drv->monitor_ifidx);
2668                 drv->monitor_ifidx = -1;
2669                 return -1;
2670         }
2671
2672         /* TODO: setup monitor interface (and add code somewhere to remove this
2673          * when AP mode is stopped; associate with mode != 2 or drv_deinit) */
2674
2675         return 0;
2676 }
2677 #endif /* CONFIG_AP */
2678
2679
2680 static int wpa_driver_nl80211_associate(
2681         void *priv, struct wpa_driver_associate_params *params)
2682 {
2683         struct wpa_driver_nl80211_data *drv = priv;
2684         int ret = -1;
2685         struct nl_msg *msg;
2686
2687 #ifdef CONFIG_AP
2688         if (params->mode == 2)
2689                 return wpa_driver_nl80211_ap(drv, params);
2690 #endif /* CONFIG_AP */
2691
2692         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
2693                                           params->drop_unencrypted);
2694
2695         drv->associated = 0;
2696
2697         msg = nlmsg_alloc();
2698         if (!msg)
2699                 return -1;
2700
2701         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
2702                    drv->ifindex);
2703         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2704                     NL80211_CMD_ASSOCIATE, 0);
2705
2706         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2707         if (params->bssid) {
2708                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2709                            MAC2STR(params->bssid));
2710                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
2711         }
2712         if (params->freq) {
2713                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2714                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2715         }
2716         if (params->ssid) {
2717                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2718                                   params->ssid, params->ssid_len);
2719                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
2720                         params->ssid);
2721                 if (params->ssid_len > sizeof(drv->ssid))
2722                         goto nla_put_failure;
2723                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
2724                 drv->ssid_len = params->ssid_len;
2725         }
2726         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
2727         if (params->wpa_ie)
2728                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
2729                         params->wpa_ie);
2730
2731         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2732         msg = NULL;
2733         if (ret) {
2734                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2735                            "(%s)", ret, strerror(-ret));
2736                 goto nla_put_failure;
2737         }
2738         ret = 0;
2739         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
2740                    "successfully");
2741
2742 nla_put_failure:
2743         nlmsg_free(msg);
2744         return ret;
2745 }
2746
2747
2748 /**
2749  * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc)
2750  * @drv: Pointer to private driver data from wpa_driver_nl80211_init()
2751  * @mode: 0 = infra/BSS (associate with an AP), 1 = adhoc/IBSS
2752  * Returns: 0 on success, -1 on failure
2753  */
2754 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
2755                                        int mode)
2756 {
2757         int ret = -1;
2758         struct nl_msg *msg;
2759         int nlmode;
2760
2761         switch (mode) {
2762         case 0:
2763                 nlmode = NL80211_IFTYPE_STATION;
2764                 break;
2765         case 1:
2766                 nlmode = NL80211_IFTYPE_ADHOC;
2767                 break;
2768         case 2:
2769                 nlmode = NL80211_IFTYPE_AP;
2770                 break;
2771         default:
2772                 return -1;
2773         }
2774
2775         msg = nlmsg_alloc();
2776         if (!msg)
2777                 return -1;
2778
2779         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2780                     0, NL80211_CMD_SET_INTERFACE, 0);
2781         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2782         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
2783
2784         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2785         if (!ret)
2786                 return 0;
2787         else
2788                 goto try_again;
2789
2790 nla_put_failure:
2791         wpa_printf(MSG_ERROR, "nl80211: Failed to set interface mode: %d (%s)",
2792                    ret, strerror(-ret));
2793         return -1;
2794
2795 try_again:
2796         /* mac80211 doesn't allow mode changes while the device is up, so
2797          * take the device down, try to set the mode again, and bring the
2798          * device back up.
2799          */
2800         if (hostapd_set_iface_flags(drv, drv->ifname, 0) == 0) {
2801                 /* Try to set the mode again while the interface is down */
2802                 msg = nlmsg_alloc();
2803                 if (!msg)
2804                         return -1;
2805
2806                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2807                             0, NL80211_CMD_SET_INTERFACE, 0);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2809                 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
2810                 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2811                 if (ret) {
2812                         wpa_printf(MSG_ERROR, "Failed to set interface %s "
2813                                    "mode(try_again): %d (%s)",
2814                                    drv->ifname, ret, strerror(-ret));
2815                 }
2816
2817                 if (hostapd_set_iface_flags(drv, drv->ifname, 1))
2818                         ret = -1;
2819         }
2820
2821         return ret;
2822 }
2823
2824
2825 static int wpa_driver_nl80211_get_capa(void *priv,
2826                                        struct wpa_driver_capa *capa)
2827 {
2828         struct wpa_driver_nl80211_data *drv = priv;
2829         if (!drv->has_capability)
2830                 return -1;
2831         os_memcpy(capa, &drv->capa, sizeof(*capa));
2832         return 0;
2833 }
2834
2835
2836 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
2837 {
2838         struct wpa_driver_nl80211_data *drv = priv;
2839
2840         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
2841                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
2842         drv->operstate = state;
2843         return wpa_driver_nl80211_send_oper_ifla(
2844                 drv, -1, state ? IF_OPER_UP : IF_OPER_DORMANT);
2845 }
2846
2847
2848 #ifdef HOSTAPD
2849
2850 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2851
2852 static int i802_sta_deauth(void *priv, const u8 *addr, int reason);
2853 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason);
2854
2855
2856 static struct i802_bss * get_bss(struct wpa_driver_nl80211_data *drv,
2857                                  const char *iface)
2858 {
2859         struct i802_bss *bss = &drv->bss;
2860         while (bss) {
2861                 if (os_strncmp(iface, bss->ifname, IFNAMSIZ) == 0)
2862                         return bss;
2863                 bss = bss->next;
2864         }
2865         wpa_printf(MSG_DEBUG, "nl80211: get_bss(%s) failed", iface);
2866         return NULL;
2867 }
2868
2869
2870 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
2871 {
2872         int i;
2873         int *old;
2874
2875         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
2876                    ifidx);
2877         for (i = 0; i < drv->num_if_indices; i++) {
2878                 if (drv->if_indices[i] == 0) {
2879                         drv->if_indices[i] = ifidx;
2880                         return;
2881                 }
2882         }
2883
2884         if (drv->if_indices != drv->default_if_indices)
2885                 old = drv->if_indices;
2886         else
2887                 old = NULL;
2888
2889         drv->if_indices = realloc(old,
2890                                   sizeof(int) * (drv->num_if_indices + 1));
2891         if (!drv->if_indices) {
2892                 if (!old)
2893                         drv->if_indices = drv->default_if_indices;
2894                 else
2895                         drv->if_indices = old;
2896                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
2897                            "interfaces");
2898                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
2899                 return;
2900         }
2901         drv->if_indices[drv->num_if_indices] = ifidx;
2902         drv->num_if_indices++;
2903 }
2904
2905
2906 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
2907 {
2908         int i;
2909
2910         for (i = 0; i < drv->num_if_indices; i++) {
2911                 if (drv->if_indices[i] == ifidx) {
2912                         drv->if_indices[i] = 0;
2913                         break;
2914                 }
2915         }
2916 }
2917
2918
2919 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
2920 {
2921         int i;
2922
2923         for (i = 0; i < drv->num_if_indices; i++)
2924                 if (drv->if_indices[i] == ifidx)
2925                         return 1;
2926
2927         return 0;
2928 }
2929
2930
2931 static int i802_set_key(const char *iface, void *priv, wpa_alg alg,
2932                         const u8 *addr, int key_idx, int set_tx, const u8 *seq,
2933                         size_t seq_len, const u8 *key, size_t key_len)
2934 {
2935         struct wpa_driver_nl80211_data *drv = priv;
2936         return nl_set_encr(if_nametoindex(iface), drv, alg, addr, key_idx,
2937                            set_tx, seq, seq_len, key, key_len);
2938 }
2939
2940
2941 static inline int min_int(int a, int b)
2942 {
2943         if (a < b)
2944                 return a;
2945         return b;
2946 }
2947
2948
2949 static int get_key_handler(struct nl_msg *msg, void *arg)
2950 {
2951         struct nlattr *tb[NL80211_ATTR_MAX + 1];
2952         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2953
2954         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2955                   genlmsg_attrlen(gnlh, 0), NULL);
2956
2957         /*
2958          * TODO: validate the key index and mac address!
2959          * Otherwise, there's a race condition as soon as
2960          * the kernel starts sending key notifications.
2961          */
2962
2963         if (tb[NL80211_ATTR_KEY_SEQ])
2964                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
2965                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
2966         return NL_SKIP;
2967 }
2968
2969
2970 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
2971                            int idx, u8 *seq)
2972 {
2973         struct wpa_driver_nl80211_data *drv = priv;
2974         struct nl_msg *msg;
2975
2976         msg = nlmsg_alloc();
2977         if (!msg)
2978                 return -ENOMEM;
2979
2980         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2981                     0, NL80211_CMD_GET_KEY, 0);
2982
2983         if (addr)
2984                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
2985         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
2986         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
2987
2988         memset(seq, 0, 6);
2989
2990         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
2991  nla_put_failure:
2992         return -ENOBUFS;
2993 }
2994
2995
2996 static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
2997                               int mode)
2998 {
2999         struct wpa_driver_nl80211_data *drv = priv;
3000         struct nl_msg *msg;
3001         u8 rates[NL80211_MAX_SUPP_RATES];
3002         u8 rates_len = 0;
3003         int i;
3004
3005         msg = nlmsg_alloc();
3006         if (!msg)
3007                 return -ENOMEM;
3008
3009         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3010                     NL80211_CMD_SET_BSS, 0);
3011
3012         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3013                 rates[rates_len++] = basic_rates[i] / 5;
3014
3015         NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3016
3017         /* TODO: multi-BSS support */
3018         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3019
3020         return send_and_recv_msgs(drv, msg, NULL, NULL);
3021  nla_put_failure:
3022         return -ENOBUFS;
3023 }
3024
3025
3026 /* Set kernel driver on given frequency (MHz) */
3027 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
3028 {
3029         struct wpa_driver_nl80211_data *drv = priv;
3030         struct nl_msg *msg;
3031
3032         msg = nlmsg_alloc();
3033         if (!msg)
3034                 return -1;
3035
3036         drv->last_freq = freq->freq;
3037         drv->last_freq_ht = freq->ht_enabled;
3038
3039         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3040                     NL80211_CMD_SET_WIPHY, 0);
3041
3042         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3043         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
3044         if (freq->ht_enabled) {
3045                 switch (freq->sec_channel_offset) {
3046                 case -1:
3047                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3048                                     NL80211_CHAN_HT40MINUS);
3049                         break;
3050                 case 1:
3051                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3052                                     NL80211_CHAN_HT40PLUS);
3053                         break;
3054                 default:
3055                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3056                                     NL80211_CHAN_HT20);
3057                         break;
3058                 }
3059         }
3060
3061         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3062                 return 0;
3063  nla_put_failure:
3064         return -1;
3065 }
3066
3067
3068 static int i802_set_rts(void *priv, int rts)
3069 {
3070         struct wpa_driver_nl80211_data *drv = priv;
3071         struct iwreq iwr;
3072
3073         memset(&iwr, 0, sizeof(iwr));
3074         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3075         iwr.u.rts.value = rts;
3076         iwr.u.rts.fixed = 1;
3077
3078         if (ioctl(drv->ioctl_sock, SIOCSIWRTS, &iwr) < 0) {
3079                 perror("ioctl[SIOCSIWRTS]");
3080                 return -1;
3081         }
3082
3083         return 0;
3084 }
3085
3086
3087 static int i802_set_frag(void *priv, int frag)
3088 {
3089         struct wpa_driver_nl80211_data *drv = priv;
3090         struct iwreq iwr;
3091
3092         memset(&iwr, 0, sizeof(iwr));
3093         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3094         iwr.u.frag.value = frag;
3095         iwr.u.frag.fixed = 1;
3096
3097         if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
3098                 perror("ioctl[SIOCSIWFRAG]");
3099                 return -1;
3100         }
3101
3102         return 0;
3103 }
3104
3105
3106 static int i802_set_retry(void *priv, int short_retry, int long_retry)
3107 {
3108         struct wpa_driver_nl80211_data *drv = priv;
3109         struct iwreq iwr;
3110
3111         memset(&iwr, 0, sizeof(iwr));
3112         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3113
3114         iwr.u.retry.value = short_retry;
3115         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
3116         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
3117                 perror("ioctl[SIOCSIWRETRY(short)]");
3118                 return -1;
3119         }
3120
3121         iwr.u.retry.value = long_retry;
3122         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
3123         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
3124                 perror("ioctl[SIOCSIWRETRY(long)]");
3125                 return -1;
3126         }
3127
3128         return 0;
3129 }
3130
3131
3132 static int i802_flush(void *priv)
3133 {
3134         struct wpa_driver_nl80211_data *drv = priv;
3135         struct nl_msg *msg;
3136
3137         msg = nlmsg_alloc();
3138         if (!msg)
3139                 return -1;
3140
3141         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3142                     0, NL80211_CMD_DEL_STATION, 0);
3143
3144         /*
3145          * XXX: FIX! this needs to flush all VLANs too
3146          */
3147         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3148                     if_nametoindex(drv->ifname));
3149
3150         return send_and_recv_msgs(drv, msg, NULL, NULL);
3151  nla_put_failure:
3152         return -ENOBUFS;
3153 }
3154
3155
3156 static int get_sta_handler(struct nl_msg *msg, void *arg)
3157 {
3158         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3159         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3160         struct hostap_sta_driver_data *data = arg;
3161         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
3162         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
3163                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
3164                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
3165                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
3166                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
3167                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
3168         };
3169
3170         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3171                   genlmsg_attrlen(gnlh, 0), NULL);
3172
3173         /*
3174          * TODO: validate the interface and mac address!
3175          * Otherwise, there's a race condition as soon as
3176          * the kernel starts sending station notifications.
3177          */
3178
3179         if (!tb[NL80211_ATTR_STA_INFO]) {
3180                 wpa_printf(MSG_DEBUG, "sta stats missing!");
3181                 return NL_SKIP;
3182         }
3183         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
3184                              tb[NL80211_ATTR_STA_INFO],
3185                              stats_policy)) {
3186                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
3187                 return NL_SKIP;
3188         }
3189
3190         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
3191                 data->inactive_msec =
3192                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
3193         if (stats[NL80211_STA_INFO_RX_BYTES])
3194                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
3195         if (stats[NL80211_STA_INFO_TX_BYTES])
3196                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
3197         if (stats[NL80211_STA_INFO_RX_PACKETS])
3198                 data->rx_packets =
3199                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
3200         if (stats[NL80211_STA_INFO_TX_PACKETS])
3201                 data->tx_packets =
3202                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
3203
3204         return NL_SKIP;
3205 }
3206
3207 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
3208                               const u8 *addr)
3209 {
3210         struct wpa_driver_nl80211_data *drv = priv;
3211         struct nl_msg *msg;
3212
3213         os_memset(data, 0, sizeof(*data));
3214         msg = nlmsg_alloc();
3215         if (!msg)
3216                 return -ENOMEM;
3217
3218         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3219                     0, NL80211_CMD_GET_STATION, 0);
3220
3221         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3222         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3223
3224         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
3225  nla_put_failure:
3226         return -ENOBUFS;
3227 }
3228
3229
3230 static int i802_send_eapol(void *priv, const u8 *addr, const u8 *data,
3231                            size_t data_len, int encrypt, const u8 *own_addr)
3232 {
3233         struct wpa_driver_nl80211_data *drv = priv;
3234         struct ieee80211_hdr *hdr;
3235         size_t len;
3236         u8 *pos;
3237         int res;
3238 #if 0 /* FIX */
3239         int qos = sta->flags & WLAN_STA_WME;
3240 #else
3241         int qos = 0;
3242 #endif
3243
3244         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
3245                 data_len;
3246         hdr = os_zalloc(len);
3247         if (hdr == NULL) {
3248                 printf("malloc() failed for i802_send_data(len=%lu)\n",
3249                        (unsigned long) len);
3250                 return -1;
3251         }
3252
3253         hdr->frame_control =
3254                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
3255         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
3256         if (encrypt)
3257                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
3258 #if 0 /* To be enabled if qos determination is added above */
3259         if (qos) {
3260                 hdr->frame_control |=
3261                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
3262         }
3263 #endif
3264
3265         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
3266         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
3267         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
3268         pos = (u8 *) (hdr + 1);
3269
3270 #if 0 /* To be enabled if qos determination is added above */
3271         if (qos) {
3272                 /* add an empty QoS header if needed */
3273                 pos[0] = 0;
3274                 pos[1] = 0;
3275                 pos += 2;
3276         }
3277 #endif
3278
3279         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
3280         pos += sizeof(rfc1042_header);
3281         WPA_PUT_BE16(pos, ETH_P_PAE);
3282         pos += 2;
3283         memcpy(pos, data, data_len);
3284
3285         res = wpa_driver_nl80211_send_frame(drv, (u8 *) hdr, len, encrypt);
3286         if (res < 0) {
3287                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
3288                            "failed: %d (%s)",
3289                            (unsigned long) len, errno, strerror(errno));
3290         }
3291         free(hdr);
3292
3293         return res;
3294 }
3295
3296
3297 static int i802_sta_add(const char *ifname, void *priv,
3298                         struct hostapd_sta_add_params *params)
3299 {
3300         struct wpa_driver_nl80211_data *drv = priv;
3301         struct nl_msg *msg;
3302         int ret = -ENOBUFS;
3303
3304         msg = nlmsg_alloc();
3305         if (!msg)
3306                 return -ENOMEM;
3307
3308         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3309                     0, NL80211_CMD_NEW_STATION, 0);
3310
3311         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3312                     if_nametoindex(drv->ifname));
3313         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
3314         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
3315         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
3316                 params->supp_rates);
3317         NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3318                     params->listen_interval);
3319
3320 #ifdef CONFIG_IEEE80211N
3321         if (params->ht_capabilities) {
3322                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
3323                         params->ht_capabilities->length,
3324                         &params->ht_capabilities->data);
3325         }
3326 #endif /* CONFIG_IEEE80211N */
3327
3328         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3329         if (ret)
3330                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION "
3331                            "result: %d (%s)", ret, strerror(-ret));
3332         if (ret == -EEXIST)
3333                 ret = 0;
3334  nla_put_failure:
3335         return ret;
3336 }
3337
3338
3339 static int i802_sta_remove(void *priv, const u8 *addr)
3340 {
3341         struct wpa_driver_nl80211_data *drv = priv;
3342         struct nl_msg *msg;
3343         int ret;
3344
3345         msg = nlmsg_alloc();
3346         if (!msg)
3347                 return -ENOMEM;
3348
3349         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3350                     0, NL80211_CMD_DEL_STATION, 0);
3351
3352         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3353                     if_nametoindex(drv->ifname));
3354         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3355
3356         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3357         if (ret == -ENOENT)
3358                 return 0;
3359         return ret;
3360  nla_put_failure:
3361         return -ENOBUFS;
3362 }
3363
3364
3365 static int i802_sta_set_flags(void *priv, const u8 *addr,
3366                               int total_flags, int flags_or, int flags_and)
3367 {
3368         struct wpa_driver_nl80211_data *drv = priv;
3369         struct nl_msg *msg, *flags = NULL;
3370
3371         msg = nlmsg_alloc();
3372         if (!msg)
3373                 return -ENOMEM;
3374
3375         flags = nlmsg_alloc();
3376         if (!flags) {
3377                 nlmsg_free(msg);
3378                 return -ENOMEM;
3379         }
3380
3381         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3382                     0, NL80211_CMD_SET_STATION, 0);
3383
3384         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3385                     if_nametoindex(drv->ifname));
3386         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3387
3388         if (total_flags & WLAN_STA_AUTHORIZED)
3389                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
3390
3391         if (total_flags & WLAN_STA_WMM)
3392                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
3393
3394         if (total_flags & WLAN_STA_SHORT_PREAMBLE)
3395                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
3396
3397         if (total_flags & WLAN_STA_MFP)
3398                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
3399
3400         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
3401                 goto nla_put_failure;
3402
3403         nlmsg_free(flags);
3404
3405         return send_and_recv_msgs(drv, msg, NULL, NULL);
3406  nla_put_failure:
3407         nlmsg_free(flags);
3408         return -ENOBUFS;
3409 }
3410
3411
3412 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
3413                                     int cw_min, int cw_max, int burst_time)
3414 {
3415         struct wpa_driver_nl80211_data *drv = priv;
3416         struct nl_msg *msg;
3417         struct nlattr *txq, *params;
3418
3419         msg = nlmsg_alloc();
3420         if (!msg)
3421                 return -1;
3422
3423         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3424                     0, NL80211_CMD_SET_WIPHY, 0);
3425
3426         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3427
3428         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
3429         if (!txq)
3430                 goto nla_put_failure;
3431
3432         /* We are only sending parameters for a single TXQ at a time */
3433         params = nla_nest_start(msg, 1);
3434         if (!params)
3435                 goto nla_put_failure;
3436
3437         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue);
3438         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
3439          * 32 usec, so need to convert the value here. */
3440         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
3441         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
3442         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
3443         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
3444
3445         nla_nest_end(msg, params);
3446
3447         nla_nest_end(msg, txq);
3448
3449         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3450                 return 0;
3451  nla_put_failure:
3452         return -1;
3453 }
3454
3455
3456 static int i802_bss_add(void *priv, const char *ifname, const u8 *bssid)
3457 {
3458         struct wpa_driver_nl80211_data *drv = priv;
3459         int ifidx;
3460         struct i802_bss *bss;
3461
3462         bss = os_zalloc(sizeof(*bss));
3463         if (bss == NULL)
3464                 return -1;
3465         os_strlcpy(bss->ifname, ifname, IFNAMSIZ);
3466
3467         ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid);
3468         if (ifidx < 0) {
3469                 os_free(bss);
3470                 return -1;
3471         }
3472         if (hostapd_set_iface_flags(priv, ifname, 1)) {
3473                 nl80211_remove_iface(priv, ifidx);
3474                 os_free(bss);
3475                 return -1;
3476         }
3477         bss->next = drv->bss.next;
3478         drv->bss.next = bss;
3479         return 0;
3480 }
3481
3482
3483 static int i802_bss_remove(void *priv, const char *ifname)
3484 {
3485         struct wpa_driver_nl80211_data *drv = priv;
3486         struct i802_bss *bss, *prev;
3487         nl80211_remove_iface(priv, if_nametoindex(ifname));
3488         prev = &drv->bss;
3489         bss = drv->bss.next;
3490         while (bss) {
3491                 if (os_strncmp(ifname, bss->ifname, IFNAMSIZ) == 0) {
3492                         prev->next = bss->next;
3493                         os_free(bss);
3494                         break;
3495                 }
3496                 prev = bss;
3497                 bss = bss->next;
3498         }
3499         return 0;
3500 }
3501
3502
3503 static int i802_set_beacon(const char *iface, void *priv,
3504                            const u8 *head, size_t head_len,
3505                            const u8 *tail, size_t tail_len, int dtim_period)
3506 {
3507         struct wpa_driver_nl80211_data *drv = priv;
3508         struct nl_msg *msg;
3509         u8 cmd = NL80211_CMD_NEW_BEACON;
3510         int ret;
3511         struct i802_bss *bss;
3512
3513         bss = get_bss(drv, iface);
3514         if (bss == NULL)
3515                 return -ENOENT;
3516
3517         msg = nlmsg_alloc();
3518         if (!msg)
3519                 return -ENOMEM;
3520
3521         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (iface=%s beacon_set=%d)",
3522                    iface, bss->beacon_set);
3523         if (bss->beacon_set)
3524                 cmd = NL80211_CMD_SET_BEACON;
3525
3526         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3527                     0, cmd, 0);
3528         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
3529         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
3530         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
3531         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, drv->beacon_int);
3532         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
3533
3534         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3535         if (!ret)
3536                 bss->beacon_set = 1;
3537         return ret;
3538  nla_put_failure:
3539         return -ENOBUFS;
3540 }
3541
3542
3543 static int i802_del_beacon(struct wpa_driver_nl80211_data *drv)
3544 {
3545         struct nl_msg *msg;
3546
3547         msg = nlmsg_alloc();
3548         if (!msg)
3549                 return -ENOMEM;
3550
3551         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3552                     0, NL80211_CMD_DEL_BEACON, 0);
3553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3554
3555         return send_and_recv_msgs(drv, msg, NULL, NULL);
3556  nla_put_failure:
3557         return -ENOBUFS;
3558 }
3559
3560
3561 static int i802_set_beacon_int(void *priv, int value)
3562 {
3563         struct wpa_driver_nl80211_data *drv = priv;
3564         struct nl_msg *msg;
3565
3566         drv->beacon_int = value;
3567
3568         if (!drv->bss.beacon_set)
3569                 return 0;
3570
3571         msg = nlmsg_alloc();
3572         if (!msg)
3573                 return -ENOMEM;
3574
3575         wpa_printf(MSG_DEBUG, "nl80211: Set beacon interval %d "
3576                    "(beacon_set=%d)", value, drv->bss.beacon_set);
3577         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3578                     0, NL80211_CMD_SET_BEACON, 0);
3579         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3580
3581         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
3582
3583         return send_and_recv_msgs(drv, msg, NULL, NULL);
3584  nla_put_failure:
3585         return -ENOBUFS;
3586 }
3587
3588
3589 static int i802_set_bss(void *priv, int cts, int preamble, int slot)
3590 {
3591         struct wpa_driver_nl80211_data *drv = priv;
3592         struct nl_msg *msg;
3593
3594         msg = nlmsg_alloc();
3595         if (!msg)
3596                 return -ENOMEM;
3597
3598         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3599                     NL80211_CMD_SET_BSS, 0);
3600
3601         if (cts >= 0)
3602                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
3603         if (preamble >= 0)
3604                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
3605         if (slot >= 0)
3606                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
3607
3608         /* TODO: multi-BSS support */
3609         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3610
3611         return send_and_recv_msgs(drv, msg, NULL, NULL);
3612  nla_put_failure:
3613         return -ENOBUFS;
3614 }
3615
3616
3617 static int i802_set_cts_protect(void *priv, int value)
3618 {
3619         return i802_set_bss(priv, value, -1, -1);
3620 }
3621
3622
3623 static int i802_set_preamble(void *priv, int value)
3624 {
3625         return i802_set_bss(priv, -1, value, -1);
3626 }
3627
3628
3629 static int i802_set_short_slot_time(void *priv, int value)
3630 {
3631         return i802_set_bss(priv, -1, -1, value);
3632 }
3633
3634
3635 static enum nl80211_iftype i802_if_type(enum hostapd_driver_if_type type)
3636 {
3637         switch (type) {
3638         case HOSTAPD_IF_VLAN:
3639                 return NL80211_IFTYPE_AP_VLAN;
3640         case HOSTAPD_IF_WDS:
3641                 return NL80211_IFTYPE_WDS;
3642         }
3643         return -1;
3644 }
3645
3646
3647 static int i802_if_add(const char *iface, void *priv,
3648                        enum hostapd_driver_if_type type, char *ifname,
3649                        const u8 *addr)
3650 {
3651         if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr) < 0)
3652                 return -1;
3653         return 0;
3654 }
3655
3656
3657 static int i802_if_update(void *priv, enum hostapd_driver_if_type type,
3658                           char *ifname, const u8 *addr)
3659 {
3660         /* unused at the moment */
3661         return -1;
3662 }
3663
3664
3665 static int i802_if_remove(void *priv, enum hostapd_driver_if_type type,
3666                           const char *ifname, const u8 *addr)
3667 {
3668         nl80211_remove_iface(priv, if_nametoindex(ifname));
3669         return 0;
3670 }
3671
3672
3673 static int i802_set_sta_vlan(void *priv, const u8 *addr,
3674                              const char *ifname, int vlan_id)
3675 {
3676         struct wpa_driver_nl80211_data *drv = priv;
3677         struct nl_msg *msg;
3678
3679         msg = nlmsg_alloc();
3680         if (!msg)
3681                 return -ENOMEM;
3682
3683         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3684                     0, NL80211_CMD_SET_STATION, 0);
3685
3686         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3687                     if_nametoindex(drv->ifname));
3688         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3689         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3690                     if_nametoindex(ifname));
3691
3692         return send_and_recv_msgs(drv, msg, NULL, NULL);
3693  nla_put_failure:
3694         return -ENOBUFS;
3695 }
3696
3697
3698 static void handle_frame(struct wpa_driver_nl80211_data *drv,
3699                          u8 *buf, size_t len,
3700                          struct hostapd_frame_info *hfi,
3701                          enum ieee80211_msg_type msg_type)
3702 {
3703         struct hostapd_iface *iface = drv->hapd->iface;
3704         struct ieee80211_hdr *hdr;
3705         u16 fc, type, stype;
3706         size_t data_len = len;
3707         struct hostapd_data *hapd = NULL;
3708         int broadcast_bssid = 0;
3709         size_t i;
3710         u8 *bssid;
3711
3712         /*
3713          * PS-Poll frames are 16 bytes. All other frames are
3714          * 24 bytes or longer.
3715          */
3716         if (len < 16)
3717                 return;
3718
3719         hdr = (struct ieee80211_hdr *) buf;
3720         fc = le_to_host16(hdr->frame_control);
3721
3722         type = WLAN_FC_GET_TYPE(fc);
3723         stype = WLAN_FC_GET_STYPE(fc);
3724
3725         switch (type) {
3726         case WLAN_FC_TYPE_DATA:
3727                 if (len < 24)
3728                         return;
3729                 switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
3730                 case WLAN_FC_TODS:
3731                         bssid = hdr->addr1;
3732                         break;
3733                 case WLAN_FC_FROMDS:
3734                         bssid = hdr->addr2;
3735                         break;
3736                 default:
3737                         /* discard */
3738                         return;
3739                 }
3740                 break;
3741         case WLAN_FC_TYPE_CTRL:
3742                 /* discard non-ps-poll frames */
3743                 if (stype != WLAN_FC_STYPE_PSPOLL)
3744                         return;
3745                 bssid = hdr->addr1;
3746                 break;
3747         case WLAN_FC_TYPE_MGMT:
3748                 bssid = hdr->addr3;
3749                 break;
3750         default:
3751                 /* discard */
3752                 return;
3753         }
3754
3755         /* find interface frame belongs to */
3756         for (i = 0; i < iface->num_bss; i++) {
3757                 if (memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) {
3758                         hapd = iface->bss[i];
3759                         break;
3760                 }
3761         }
3762
3763         if (hapd == NULL) {
3764                 hapd = iface->bss[0];
3765
3766                 if (bssid[0] != 0xff || bssid[1] != 0xff ||
3767                     bssid[2] != 0xff || bssid[3] != 0xff ||
3768                     bssid[4] != 0xff || bssid[5] != 0xff) {
3769                         /*
3770                          * Unknown BSSID - drop frame if this is not from
3771                          * passive scanning or a beacon (at least ProbeReq
3772                          * frames to other APs may be allowed through RX
3773                          * filtering in the wlan hw/driver)
3774                          */
3775                         if ((type != WLAN_FC_TYPE_MGMT ||
3776                              stype != WLAN_FC_STYPE_BEACON))
3777                                 return;
3778                 } else
3779                         broadcast_bssid = 1;
3780         }
3781
3782         switch (msg_type) {
3783         case ieee80211_msg_normal:
3784                 /* continue processing */
3785                 break;
3786         case ieee80211_msg_tx_callback_ack:
3787                 handle_tx_callback(hapd, buf, data_len, 1);
3788                 return;
3789         case ieee80211_msg_tx_callback_fail:
3790                 handle_tx_callback(hapd, buf, data_len, 0);
3791                 return;
3792         }
3793
3794         switch (type) {
3795         case WLAN_FC_TYPE_MGMT:
3796                 if (stype != WLAN_FC_STYPE_BEACON &&
3797                     stype != WLAN_FC_STYPE_PROBE_REQ)
3798                         wpa_printf(MSG_MSGDUMP, "MGMT");
3799                 if (broadcast_bssid) {
3800                         for (i = 0; i < iface->num_bss; i++)
3801                                 hostapd_mgmt_rx(iface->bss[i], buf, data_len,
3802                                                 stype, hfi);
3803                 } else
3804                         hostapd_mgmt_rx(hapd, buf, data_len, stype, hfi);
3805                 break;
3806         case WLAN_FC_TYPE_CTRL:
3807                 /* can only get here with PS-Poll frames */
3808                 wpa_printf(MSG_DEBUG, "CTRL");
3809                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
3810                 break;
3811         case WLAN_FC_TYPE_DATA:
3812                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
3813                 break;
3814         }
3815 }
3816
3817
3818 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
3819 {
3820         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3821         struct sockaddr_ll lladdr;
3822         unsigned char buf[3000];
3823         int len;
3824         socklen_t fromlen = sizeof(lladdr);
3825
3826         len = recvfrom(sock, buf, sizeof(buf), 0,
3827                        (struct sockaddr *)&lladdr, &fromlen);
3828         if (len < 0) {
3829                 perror("recv");
3830                 return;
3831         }
3832
3833         if (have_ifidx(drv, lladdr.sll_ifindex)) {
3834                 struct hostapd_data *hapd;
3835                 hapd = hostapd_sta_get_bss(drv->hapd, lladdr.sll_addr);
3836                 if (!hapd)
3837                         return;
3838                 hostapd_eapol_receive(hapd, lladdr.sll_addr, buf, len);
3839         }
3840 }
3841
3842
3843 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv, const char *ifname,
3844                             int mode)
3845 {
3846         struct nl_msg *msg;
3847         int ret = -ENOBUFS;
3848
3849         msg = nlmsg_alloc();
3850         if (!msg)
3851                 return -ENOMEM;
3852
3853         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3854                     0, NL80211_CMD_SET_INTERFACE, 0);
3855         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3856                     if_nametoindex(ifname));
3857         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
3858
3859         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3860         if (!ret)
3861                 return 0;
3862  nla_put_failure:
3863         wpa_printf(MSG_ERROR, "Failed to set interface %s to master "
3864                    "mode.", ifname);
3865         return ret;
3866 }
3867
3868
3869 #ifdef CONFIG_IEEE80211N
3870 static void i802_add_neighbor(struct wpa_driver_nl80211_data *drv, u8 *bssid,
3871                               int freq, u8 *ie, size_t ie_len)
3872 {
3873         struct ieee802_11_elems elems;
3874         int ht, pri_chan = 0, sec_chan = 0;
3875         struct ieee80211_ht_operation *oper;
3876         struct hostapd_neighbor_bss *nnei;
3877
3878         ieee802_11_parse_elems(ie, ie_len, &elems, 0);
3879         ht = elems.ht_capabilities || elems.ht_operation;
3880         if (elems.ht_operation && elems.ht_operation_len >= sizeof(*oper)) {
3881                 oper = (struct ieee80211_ht_operation *) elems.ht_operation;
3882                 pri_chan = oper->control_chan;
3883                 if (oper->ht_param & HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH) {
3884                         if (oper->ht_param &
3885                             HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3886                                 sec_chan = pri_chan + 4;
3887                         else if (oper->ht_param &
3888                             HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3889                                 sec_chan = pri_chan - 4;
3890                 }
3891         }
3892
3893         wpa_printf(MSG_DEBUG, "nl80211: Neighboring BSS - bssid=" MACSTR
3894                    " freq=%d MHz HT=%d pri_chan=%d sec_chan=%d",
3895                    MAC2STR(bssid), freq, ht, pri_chan, sec_chan);
3896
3897         nnei = os_realloc(drv->neighbors, (drv->num_neighbors + 1) *
3898                           sizeof(struct hostapd_neighbor_bss));
3899         if (nnei == NULL)
3900                 return;
3901         drv->neighbors = nnei;
3902         nnei = &nnei[drv->num_neighbors];
3903         os_memcpy(nnei->bssid, bssid, ETH_ALEN);
3904         nnei->freq = freq;
3905         nnei->ht = !!ht;
3906         nnei->pri_chan = pri_chan;
3907         nnei->sec_chan = sec_chan;
3908         drv->num_neighbors++;
3909 }
3910
3911
3912 static int i802_get_scan_freq(struct iw_event *iwe, int *freq)
3913 {
3914         int divi = 1000000, i;
3915
3916         if (iwe->u.freq.e == 0) {
3917                 /*
3918                  * Some drivers do not report frequency, but a channel.
3919                  * Try to map this to frequency by assuming they are using
3920                  * IEEE 802.11b/g.  But don't overwrite a previously parsed
3921                  * frequency if the driver sends both frequency and channel,
3922                  * since the driver may be sending an A-band channel that we
3923                  * don't handle here.
3924                  */
3925
3926                 if (*freq)
3927                         return 0;
3928
3929                 if (iwe->u.freq.m >= 1 && iwe->u.freq.m <= 13) {
3930                         *freq = 2407 + 5 * iwe->u.freq.m;
3931                         return 0;
3932                 } else if (iwe->u.freq.m == 14) {
3933                         *freq = 2484;
3934                         return 0;
3935                 }
3936         }
3937
3938         if (iwe->u.freq.e > 6) {
3939                 wpa_printf(MSG_DEBUG, "Invalid freq in scan results: "
3940                            "m=%d e=%d", iwe->u.freq.m, iwe->u.freq.e);
3941                 return -1;
3942         }
3943
3944         for (i = 0; i < iwe->u.freq.e; i++)
3945                 divi /= 10;
3946         *freq = iwe->u.freq.m / divi;
3947         return 0;
3948 }
3949
3950
3951 static int i802_parse_scan(struct wpa_driver_nl80211_data *drv, u8 *res_buf,
3952                            size_t len)
3953 {
3954         size_t ap_num = 0;
3955         int first;
3956         struct iw_event iwe_buf, *iwe = &iwe_buf;
3957         char *pos, *end, *custom;
3958         u8 bssid[ETH_ALEN];
3959         int freq = 0;
3960         u8 *ie = NULL;
3961         size_t ie_len = 0;
3962
3963         ap_num = 0;
3964         first = 1;
3965
3966         pos = (char *) res_buf;
3967         end = (char *) res_buf + len;
3968
3969         while (pos + IW_EV_LCP_LEN <= end) {
3970                 /* Event data may be unaligned, so make a local, aligned copy
3971                  * before processing. */
3972                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
3973                 if (iwe->len <= IW_EV_LCP_LEN)
3974                         break;
3975
3976                 custom = pos + IW_EV_POINT_LEN;
3977                 if (iwe->cmd == IWEVGENIE) {
3978                         /* WE-19 removed the pointer from struct iw_point */
3979                         char *dpos = (char *) &iwe_buf.u.data.length;
3980                         int dlen = dpos - (char *) &iwe_buf;
3981                         os_memcpy(dpos, pos + IW_EV_LCP_LEN,
3982                                   sizeof(struct iw_event) - dlen);
3983                 } else {
3984                         os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
3985                         custom += IW_EV_POINT_OFF;
3986                 }
3987
3988                 switch (iwe->cmd) {
3989                 case SIOCGIWAP:
3990                         if (!first)
3991                                 i802_add_neighbor(drv, bssid, freq, ie,
3992                                                   ie_len);
3993                         first = 0;
3994                         os_memcpy(bssid, iwe->u.ap_addr.sa_data, ETH_ALEN);
3995                         freq = 0;
3996                         ie = NULL;
3997                         ie_len = 0;
3998                         break;
3999                 case SIOCGIWFREQ:
4000                         i802_get_scan_freq(iwe, &freq);
4001                         break;
4002                 case IWEVGENIE:
4003                         if (custom + iwe->u.data.length > end) {
4004                                 wpa_printf(MSG_ERROR, "IWEVGENIE overflow");
4005                                 return -1;
4006                         }
4007                         ie = (u8 *) custom;
4008                         ie_len = iwe->u.data.length;
4009                         break;
4010                 }
4011
4012                 pos += iwe->len;
4013         }
4014
4015         if (!first)
4016                 i802_add_neighbor(drv, bssid, freq, ie, ie_len);
4017
4018         return 0;
4019 }
4020
4021
4022 static int i802_get_ht_scan_res(struct wpa_driver_nl80211_data *drv)
4023 {
4024         struct iwreq iwr;
4025         u8 *res_buf;
4026         size_t res_buf_len;
4027         int res;
4028
4029         res_buf_len = IW_SCAN_MAX_DATA;
4030         for (;;) {
4031                 res_buf = os_malloc(res_buf_len);
4032                 if (res_buf == NULL)
4033                         return -1;
4034                 os_memset(&iwr, 0, sizeof(iwr));
4035                 os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
4036                 iwr.u.data.pointer = res_buf;
4037                 iwr.u.data.length = res_buf_len;
4038
4039                 if (ioctl(drv->ioctl_sock, SIOCGIWSCAN, &iwr) == 0)
4040                         break;
4041
4042                 if (errno == E2BIG && res_buf_len < 65535) {
4043                         os_free(res_buf);
4044                         res_buf = NULL;
4045                         res_buf_len *= 2;
4046                         if (res_buf_len > 65535)
4047                                 res_buf_len = 65535; /* 16-bit length field */
4048                         wpa_printf(MSG_DEBUG, "Scan results did not fit - "
4049                                    "trying larger buffer (%lu bytes)",
4050                                    (unsigned long) res_buf_len);
4051                 } else {
4052                         perror("ioctl[SIOCGIWSCAN]");
4053                         os_free(res_buf);
4054                         return -1;
4055                 }
4056         }
4057
4058         if (iwr.u.data.length > res_buf_len) {
4059                 os_free(res_buf);
4060                 return -1;
4061         }
4062
4063         res = i802_parse_scan(drv, res_buf, iwr.u.data.length);
4064         os_free(res_buf);
4065
4066         return res;
4067 }
4068
4069
4070 static int i802_is_event_wireless_scan_complete(char *data, int len)
4071 {
4072         struct iw_event iwe_buf, *iwe = &iwe_buf;
4073         char *pos, *end;
4074
4075         pos = data;
4076         end = data + len;
4077
4078         while (pos + IW_EV_LCP_LEN <= end) {
4079                 /* Event data may be unaligned, so make a local, aligned copy
4080                  * before processing. */
4081                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
4082                 if (iwe->cmd == SIOCGIWSCAN)
4083                         return 1;
4084
4085                 pos += iwe->len;
4086         }
4087
4088         return 0;
4089 }
4090
4091
4092 static int i802_is_rtm_scan_complete(int ifindex, struct nlmsghdr *h, int len)
4093 {
4094         struct ifinfomsg *ifi;
4095         int attrlen, _nlmsg_len, rta_len;
4096         struct rtattr *attr;
4097
4098         if (len < (int) sizeof(*ifi))
4099                 return 0;
4100
4101         ifi = NLMSG_DATA(h);
4102
4103         if (ifindex != ifi->ifi_index)
4104                 return 0; /* event for foreign ifindex */
4105
4106         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
4107
4108         attrlen = h->nlmsg_len - _nlmsg_len;
4109         if (attrlen < 0)
4110                 return 0;
4111
4112         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
4113
4114         rta_len = RTA_ALIGN(sizeof(struct rtattr));
4115         while (RTA_OK(attr, attrlen)) {
4116                 if (attr->rta_type == IFLA_WIRELESS &&
4117                     i802_is_event_wireless_scan_complete(
4118                             ((char *) attr) + rta_len,
4119                             attr->rta_len - rta_len))
4120                         return 1;
4121                 attr = RTA_NEXT(attr, attrlen);
4122         }
4123
4124         return 0;
4125 }
4126
4127
4128 static int i802_is_scan_complete(int s, int ifindex)
4129 {
4130         char buf[1024];
4131         int left;
4132         struct nlmsghdr *h;
4133
4134         left = recv(s, buf, sizeof(buf), MSG_DONTWAIT);
4135         if (left < 0) {
4136                 perror("recv(netlink)");
4137                 return 0;
4138         }
4139
4140         h = (struct nlmsghdr *) buf;
4141         while (left >= (int) sizeof(*h)) {
4142                 int len, plen;
4143
4144                 len = h->nlmsg_len;
4145                 plen = len - sizeof(*h);
4146                 if (len > left || plen < 0) {
4147                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
4148                                    "len=%d left=%d plen=%d",
4149                                    len, left, plen);
4150                         break;
4151                 }
4152
4153                 switch (h->nlmsg_type) {
4154                 case RTM_NEWLINK:
4155                         if (i802_is_rtm_scan_complete(ifindex, h, plen))
4156                                 return 1;
4157                         break;
4158                 }
4159
4160                 len = NLMSG_ALIGN(len);
4161                 left -= len;
4162                 h = (struct nlmsghdr *) ((char *) h + len);
4163         }
4164
4165         return 0;
4166 }
4167
4168
4169 static int i802_ht_scan(struct wpa_driver_nl80211_data *drv)
4170 {
4171         struct iwreq iwr;
4172         int s, res, ifindex;
4173         struct sockaddr_nl local;
4174         time_t now, end;
4175         fd_set rfds;
4176         struct timeval tv;
4177
4178         wpa_printf(MSG_DEBUG, "nl80211: Scanning overlapping BSSes before "
4179                    "starting HT 20/40 MHz BSS");
4180
4181         /* Request a new scan */
4182         /* TODO: would be enough to scan the selected band */
4183         os_memset(&iwr, 0, sizeof(iwr));
4184         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
4185         if (ioctl(drv->ioctl_sock, SIOCSIWSCAN, &iwr) < 0) {
4186                 perror("ioctl[SIOCSIWSCAN]");
4187                 return -1;
4188         }
4189
4190         ifindex = if_nametoindex(drv->ifname);
4191
4192         /* Wait for scan completion event or timeout */
4193         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
4194         if (s < 0) {
4195                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
4196                 return -1;
4197         }
4198
4199         os_memset(&local, 0, sizeof(local));
4200         local.nl_family = AF_NETLINK;
4201         local.nl_groups = RTMGRP_LINK;
4202         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
4203                 perror("bind(netlink)");
4204                 close(s);
4205                 return -1;
4206         }
4207
4208         time(&end);
4209         end += 30; /* Wait at most 30 seconds for scan results */
4210         for (;;) {
4211                 time(&now);
4212                 tv.tv_sec = end > now ? end - now : 0;
4213                 tv.tv_usec = 0;
4214                 FD_ZERO(&rfds);
4215                 FD_SET(s, &rfds);
4216                 res = select(s + 1, &rfds, NULL, NULL, &tv);
4217                 if (res < 0) {
4218                         perror("select");
4219                         /* Assume results are ready after 10 seconds wait */
4220                         os_sleep(10, 0);
4221                         break;
4222                 } else if (res) {
4223                         if (i802_is_scan_complete(s, ifindex)) {
4224                                 wpa_printf(MSG_DEBUG, "nl80211: Scan "
4225                                            "completed");
4226                                 break;
4227                         }
4228                 } else {
4229                         wpa_printf(MSG_DEBUG, "nl80211: Scan timeout");
4230                         /* Assume results are ready to be read now */
4231                         break;
4232                 }
4233         }
4234
4235         close(s);
4236
4237         return i802_get_ht_scan_res(drv);
4238 }
4239 #endif /* CONFIG_IEEE80211N */
4240
4241
4242 static int i802_init_sockets(struct wpa_driver_nl80211_data *drv, const u8 *bssid)
4243 {
4244         struct ifreq ifr;
4245         int ret;
4246
4247         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
4248         if (drv->ioctl_sock < 0) {
4249                 perror("socket[PF_INET,SOCK_DGRAM]");
4250                 return -1;
4251         }
4252
4253         /* start listening for EAPOL on the default AP interface */
4254         add_ifidx(drv, if_nametoindex(drv->ifname));
4255
4256         if (hostapd_set_iface_flags(drv, drv->ifname, 0))
4257                 return -1;
4258
4259         if (bssid) {
4260                 os_strlcpy(ifr.ifr_name, drv->ifname, IFNAMSIZ);
4261                 memcpy(ifr.ifr_hwaddr.sa_data, bssid, ETH_ALEN);
4262                 ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
4263
4264                 if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifr)) {
4265                         perror("ioctl(SIOCSIFHWADDR)");
4266                         return -1;
4267                 }
4268         }
4269
4270         /*
4271          * initialise generic netlink and nl80211
4272          */
4273         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4274         if (!drv->nl_cb) {
4275                 printf("Failed to allocate netlink callbacks.\n");
4276                 return -1;
4277         }
4278
4279         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
4280         if (!drv->nl_handle) {
4281                 printf("Failed to allocate netlink handle.\n");
4282                 return -1;
4283         }
4284
4285         if (genl_connect(drv->nl_handle)) {
4286                 printf("Failed to connect to generic netlink.\n");
4287                 return -1;
4288         }
4289
4290 #ifdef CONFIG_LIBNL20
4291         if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) {
4292                 printf("Failed to allocate generic netlink cache.\n");
4293                 return -1;
4294         }
4295 #else /* CONFIG_LIBNL20 */
4296         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
4297         if (!drv->nl_cache) {
4298                 printf("Failed to allocate generic netlink cache.\n");
4299                 return -1;
4300         }
4301 #endif /* CONFIG_LIBNL20 */
4302
4303         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
4304         if (!drv->nl80211) {
4305                 printf("nl80211 not found.\n");
4306                 return -1;
4307         }
4308
4309         ret = nl_get_multicast_id(drv, "nl80211", "scan");
4310         if (ret >= 0)
4311                 ret = nl_socket_add_membership(drv->nl_handle, ret);
4312         if (ret < 0) {
4313                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4314                            "membership for scan events: %d (%s)",
4315                            ret, strerror(-ret));
4316         }
4317
4318         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
4319         if (ret >= 0)
4320                 ret = nl_socket_add_membership(drv->nl_handle, ret);
4321         if (ret < 0) {
4322                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4323                            "membership for mlme events: %d (%s)",
4324                            ret, strerror(-ret));
4325         }
4326
4327         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
4328                                  wpa_driver_nl80211_event_receive, drv,
4329                                  drv->hapd);
4330
4331 #ifdef CONFIG_IEEE80211N
4332         if (drv->ht_40mhz_scan) {
4333                 if (nl80211_set_mode(drv, drv->ifname, NL80211_IFTYPE_STATION)
4334                     || hostapd_set_iface_flags(drv, drv->ifname, 1) ||
4335                     i802_ht_scan(drv) ||
4336                     hostapd_set_iface_flags(drv, drv->ifname, 0)) {
4337                         wpa_printf(MSG_ERROR, "Failed to scan channels for "
4338                                    "HT 40 MHz operations");
4339                         return -1;
4340                 }
4341         }
4342 #endif /* CONFIG_IEEE80211N */
4343
4344         /* Initialise a monitor interface */
4345         if (nl80211_create_monitor_interface(drv))
4346                 return -1;
4347
4348         if (nl80211_set_mode(drv, drv->ifname, NL80211_IFTYPE_AP))
4349                 goto fail1;
4350
4351         if (hostapd_set_iface_flags(drv, drv->ifname, 1))
4352                 goto fail1;
4353
4354         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
4355         if (drv->eapol_sock < 0) {
4356                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
4357                 goto fail1;
4358         }
4359
4360         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
4361         {
4362                 printf("Could not register read socket for eapol\n");
4363                 return -1;
4364         }
4365
4366         memset(&ifr, 0, sizeof(ifr));
4367         os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
4368         if (ioctl(drv->ioctl_sock, SIOCGIFHWADDR, &ifr) != 0) {
4369                 perror("ioctl(SIOCGIFHWADDR)");
4370                 goto fail1;
4371         }
4372
4373         if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
4374                 printf("Invalid HW-addr family 0x%04x\n",
4375                        ifr.ifr_hwaddr.sa_family);
4376                 goto fail1;
4377         }
4378         memcpy(drv->hapd->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
4379
4380         return 0;
4381
4382 fail1:
4383         nl80211_remove_iface(drv, drv->monitor_ifidx);
4384         return -1;
4385 }
4386
4387
4388 static int i802_get_inact_sec(void *priv, const u8 *addr)
4389 {
4390         struct hostap_sta_driver_data data;
4391         int ret;
4392
4393         data.inactive_msec = (unsigned long) -1;
4394         ret = i802_read_sta_data(priv, &data, addr);
4395         if (ret || data.inactive_msec == (unsigned long) -1)
4396                 return -1;
4397         return data.inactive_msec / 1000;
4398 }
4399
4400
4401 static int i802_sta_clear_stats(void *priv, const u8 *addr)
4402 {
4403 #if 0
4404         /* TODO */
4405 #endif
4406         return 0;
4407 }
4408
4409
4410 static int i802_sta_deauth(void *priv, const u8 *addr, int reason)
4411 {
4412         struct wpa_driver_nl80211_data *drv = priv;
4413         struct ieee80211_mgmt mgmt;
4414
4415         memset(&mgmt, 0, sizeof(mgmt));
4416         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4417                                           WLAN_FC_STYPE_DEAUTH);
4418         memcpy(mgmt.da, addr, ETH_ALEN);
4419         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
4420         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
4421         mgmt.u.deauth.reason_code = host_to_le16(reason);
4422         return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt,
4423                                             IEEE80211_HDRLEN +
4424                                             sizeof(mgmt.u.deauth));
4425 }
4426
4427
4428 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason)
4429 {
4430         struct wpa_driver_nl80211_data *drv = priv;
4431         struct ieee80211_mgmt mgmt;
4432
4433         memset(&mgmt, 0, sizeof(mgmt));
4434         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4435                                           WLAN_FC_STYPE_DISASSOC);
4436         memcpy(mgmt.da, addr, ETH_ALEN);
4437         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
4438         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
4439         mgmt.u.disassoc.reason_code = host_to_le16(reason);
4440         return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt,
4441                                             IEEE80211_HDRLEN +
4442                                             sizeof(mgmt.u.disassoc));
4443 }
4444
4445
4446 static const struct hostapd_neighbor_bss *
4447 i802_get_neighbor_bss(void *priv, size_t *num)
4448 {
4449         struct wpa_driver_nl80211_data *drv = priv;
4450         *num = drv->num_neighbors;
4451         return drv->neighbors;
4452 }
4453
4454
4455 static void *i802_init(struct hostapd_data *hapd,
4456                        struct wpa_init_params *params)
4457 {
4458         struct wpa_driver_nl80211_data *drv;
4459         size_t i;
4460
4461         drv = os_zalloc(sizeof(struct wpa_driver_nl80211_data));
4462         if (drv == NULL) {
4463                 printf("Could not allocate memory for i802 driver data\n");
4464                 return NULL;
4465         }
4466
4467         drv->hapd = hapd;
4468         memcpy(drv->ifname, params->ifname, sizeof(drv->ifname));
4469         memcpy(drv->bss.ifname, params->ifname, sizeof(drv->bss.ifname));
4470         drv->ifindex = if_nametoindex(drv->ifname);
4471
4472         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
4473         drv->if_indices = drv->default_if_indices;
4474         for (i = 0; i < params->num_bridge; i++) {
4475                 if (params->bridge[i])
4476                         add_ifidx(drv, if_nametoindex(params->bridge[i]));
4477         }
4478         drv->ht_40mhz_scan = params->ht_40mhz_scan;
4479
4480         if (i802_init_sockets(drv, params->bssid))
4481                 goto failed;
4482
4483         return drv;
4484
4485 failed:
4486         free(drv);
4487         return NULL;
4488 }
4489
4490
4491 static void i802_deinit(void *priv)
4492 {
4493         struct wpa_driver_nl80211_data *drv = priv;
4494         struct i802_bss *bss, *prev;
4495
4496         if (drv->last_freq_ht) {
4497                 /* Clear HT flags from the driver */
4498                 struct hostapd_freq_params freq;
4499                 os_memset(&freq, 0, sizeof(freq));
4500                 freq.freq = drv->last_freq;
4501                 i802_set_freq(priv, &freq);
4502         }
4503
4504         i802_del_beacon(drv);
4505
4506         /* remove monitor interface */
4507         nl80211_remove_iface(drv, drv->monitor_ifidx);
4508
4509         (void) hostapd_set_iface_flags(drv, drv->ifname, 0);
4510
4511         if (drv->monitor_sock >= 0) {
4512                 eloop_unregister_read_sock(drv->monitor_sock);
4513                 close(drv->monitor_sock);
4514         }
4515         if (drv->ioctl_sock >= 0)
4516                 close(drv->ioctl_sock);
4517         if (drv->eapol_sock >= 0) {
4518                 eloop_unregister_read_sock(drv->eapol_sock);
4519                 close(drv->eapol_sock);
4520         }
4521
4522         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
4523         genl_family_put(drv->nl80211);
4524         nl_cache_free(drv->nl_cache);
4525         nl_handle_destroy(drv->nl_handle);
4526         nl_cb_put(drv->nl_cb);
4527
4528         if (drv->if_indices != drv->default_if_indices)
4529                 free(drv->if_indices);
4530
4531         os_free(drv->neighbors);
4532
4533         bss = drv->bss.next;
4534         while (bss) {
4535                 prev = bss;
4536                 bss = bss->next;
4537                 os_free(bss);
4538         }
4539
4540         free(drv);
4541 }
4542
4543 #endif /* HOSTAPD */
4544
4545
4546 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
4547         .name = "nl80211",
4548         .desc = "Linux nl80211/cfg80211",
4549         .get_bssid = wpa_driver_nl80211_get_bssid,
4550         .get_ssid = wpa_driver_nl80211_get_ssid,
4551         .set_key = wpa_driver_nl80211_set_key,
4552         .scan2 = wpa_driver_nl80211_scan,
4553         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
4554         .deauthenticate = wpa_driver_nl80211_deauthenticate,
4555         .disassociate = wpa_driver_nl80211_disassociate,
4556         .authenticate = wpa_driver_nl80211_authenticate,
4557         .associate = wpa_driver_nl80211_associate,
4558         .init = wpa_driver_nl80211_init,
4559         .deinit = wpa_driver_nl80211_deinit,
4560         .get_capa = wpa_driver_nl80211_get_capa,
4561         .set_operstate = wpa_driver_nl80211_set_operstate,
4562         .set_country = wpa_driver_nl80211_set_country,
4563 #ifdef CONFIG_AP
4564         .set_beacon = wpa_driver_nl80211_set_beacon,
4565         .set_beacon_int = wpa_driver_nl80211_set_beacon_int,
4566         .send_mlme = wpa_driver_nl80211_send_mlme,
4567 #endif /* CONFIG_AP */
4568 #if defined(CONFIG_AP) || defined(HOSTAPD)
4569         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
4570 #endif /* CONFIG_AP || HOSTAPD */
4571 #ifdef HOSTAPD
4572         .hapd_init = i802_init,
4573         .hapd_deinit = i802_deinit,
4574         .hapd_set_key = i802_set_key,
4575         .get_seqnum = i802_get_seqnum,
4576         .flush = i802_flush,
4577         .read_sta_data = i802_read_sta_data,
4578         .hapd_send_eapol = i802_send_eapol,
4579         .sta_set_flags = i802_sta_set_flags,
4580         .sta_deauth = i802_sta_deauth,
4581         .sta_disassoc = i802_sta_disassoc,
4582         .sta_remove = i802_sta_remove,
4583         .sta_add = i802_sta_add,
4584         .get_inact_sec = i802_get_inact_sec,
4585         .sta_clear_stats = i802_sta_clear_stats,
4586         .set_freq = i802_set_freq,
4587         .set_rts = i802_set_rts,
4588         .set_frag = i802_set_frag,
4589         .set_retry = i802_set_retry,
4590         .set_rate_sets = i802_set_rate_sets,
4591         .hapd_set_beacon = i802_set_beacon,
4592         .hapd_set_beacon_int = i802_set_beacon_int,
4593         .set_cts_protect = i802_set_cts_protect,
4594         .set_preamble = i802_set_preamble,
4595         .set_short_slot_time = i802_set_short_slot_time,
4596         .set_tx_queue_params = i802_set_tx_queue_params,
4597         .bss_add = i802_bss_add,
4598         .bss_remove = i802_bss_remove,
4599         .if_add = i802_if_add,
4600         .if_update = i802_if_update,
4601         .if_remove = i802_if_remove,
4602         .set_sta_vlan = i802_set_sta_vlan,
4603         .get_neighbor_bss = i802_get_neighbor_bss,
4604 #endif /* HOSTAPD */
4605 };