2 * WPA Supplicant - Client mode MLME
3 * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
4 * Copyright (c) 2004, Instant802 Networks, Inc.
5 * Copyright (c) 2005-2006, Devicescape Software, Inc.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License version 2 as
9 * published by the Free Software Foundation.
11 * Alternatively, this software may be distributed under the terms of BSD
14 * See README and COPYING for more details.
21 #include "config_ssid.h"
22 #include "wpa_supplicant_i.h"
24 #include "drivers/driver.h"
25 #include "ieee802_11_defs.h"
29 /* Timeouts and intervals in milliseconds */
30 #define IEEE80211_AUTH_TIMEOUT (200)
31 #define IEEE80211_AUTH_MAX_TRIES 3
32 #define IEEE80211_ASSOC_TIMEOUT (200)
33 #define IEEE80211_ASSOC_MAX_TRIES 3
34 #define IEEE80211_MONITORING_INTERVAL (2000)
35 #define IEEE80211_PROBE_INTERVAL (60000)
36 #define IEEE80211_RETRY_AUTH_INTERVAL (1000)
37 #define IEEE80211_SCAN_INTERVAL (2000)
38 #define IEEE80211_SCAN_INTERVAL_SLOW (15000)
39 #define IEEE80211_IBSS_JOIN_TIMEOUT (20000)
41 #define IEEE80211_PROBE_DELAY (33)
42 #define IEEE80211_CHANNEL_TIME (33)
43 #define IEEE80211_PASSIVE_CHANNEL_TIME (200)
44 #define IEEE80211_SCAN_RESULT_EXPIRE (10000)
45 #define IEEE80211_IBSS_MERGE_INTERVAL (30000)
46 #define IEEE80211_IBSS_INACTIVITY_LIMIT (60000)
48 #define IEEE80211_IBSS_MAX_STA_ENTRIES 128
51 #define IEEE80211_FC(type, stype) host_to_le16((type << 2) | (stype << 4))
54 struct ieee80211_sta_bss {
55 struct ieee80211_sta_bss *next;
56 struct ieee80211_sta_bss *hnext;
59 u8 ssid[MAX_SSID_LEN];
61 u16 capability; /* host byte order */
76 #define IEEE80211_MAX_SUPP_RATES 32
77 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
78 size_t supp_rates_len;
83 struct os_time last_update;
87 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
89 const u8 *ssid, size_t ssid_len);
90 static struct ieee80211_sta_bss *
91 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid);
92 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s);
93 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s);
94 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx);
95 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx);
98 /* Parsed Information Elements */
99 struct ieee802_11_elems {
123 u8 ext_supp_rates_len;
133 u8 assoc_comeback_len;
136 typedef enum { ParseOK = 0, ParseUnknown = 1, ParseFailed = -1 } ParseRes;
139 static ParseRes ieee802_11_parse_elems(u8 *start, size_t len,
140 struct ieee802_11_elems *elems)
146 os_memset(elems, 0, sizeof(*elems));
157 wpa_printf(MSG_MSGDUMP, "MLME: IEEE 802.11 element "
158 "parse failed (id=%d elen=%d left=%d)",
167 elems->ssid_len = elen;
169 case WLAN_EID_SUPP_RATES:
170 elems->supp_rates = pos;
171 elems->supp_rates_len = elen;
173 case WLAN_EID_FH_PARAMS:
174 elems->fh_params = pos;
175 elems->fh_params_len = elen;
177 case WLAN_EID_DS_PARAMS:
178 elems->ds_params = pos;
179 elems->ds_params_len = elen;
181 case WLAN_EID_CF_PARAMS:
182 elems->cf_params = pos;
183 elems->cf_params_len = elen;
187 elems->tim_len = elen;
189 case WLAN_EID_IBSS_PARAMS:
190 elems->ibss_params = pos;
191 elems->ibss_params_len = elen;
193 case WLAN_EID_CHALLENGE:
194 elems->challenge = pos;
195 elems->challenge_len = elen;
197 case WLAN_EID_VENDOR_SPECIFIC:
198 if (elen >= 4 && pos[0] == 0x00 && pos[1] == 0x50 &&
200 /* Microsoft OUI (00:50:F2) */
202 /* OUI Type 1 - WPA IE */
204 elems->wpa_len = elen;
205 } else if (elen >= 5 && pos[3] == 2) {
207 elems->wmm_info = pos;
208 elems->wmm_info_len = elen;
209 } else if (pos[4] == 1) {
210 elems->wmm_param = pos;
211 elems->wmm_param_len = elen;
218 elems->rsn_len = elen;
220 case WLAN_EID_ERP_INFO:
221 elems->erp_info = pos;
222 elems->erp_info_len = elen;
224 case WLAN_EID_EXT_SUPP_RATES:
225 elems->ext_supp_rates = pos;
226 elems->ext_supp_rates_len = elen;
228 case WLAN_EID_MOBILITY_DOMAIN:
230 elems->mdie_len = elen;
232 case WLAN_EID_FAST_BSS_TRANSITION:
234 elems->ftie_len = elen;
236 case WLAN_EID_ASSOC_COMEBACK_TIME:
237 elems->assoc_comeback = pos;
238 elems->assoc_comeback_len = elen;
242 wpa_printf(MSG_MSGDUMP "MLME: IEEE 802.11 element "
243 "parse ignored unknown element (id=%d "
244 "elen=%d)", id, elen);
257 return unknown ? ParseUnknown : ParseOK;
261 static int ieee80211_sta_set_channel(struct wpa_supplicant *wpa_s,
262 wpa_hw_mode phymode, int chan,
266 struct wpa_hw_modes *mode;
268 for (i = 0; i < wpa_s->mlme.num_modes; i++) {
269 mode = &wpa_s->mlme.modes[i];
270 if (mode->mode == phymode) {
271 wpa_s->mlme.curr_rates = mode->rates;
272 wpa_s->mlme.num_curr_rates = mode->num_rates;
277 return wpa_drv_set_channel(wpa_s, phymode, chan, freq);
283 static int ecw2cw(int ecw)
295 static void ieee80211_sta_wmm_params(struct wpa_supplicant *wpa_s,
296 u8 *wmm_param, size_t wmm_param_len)
302 if (wmm_param_len < 8 || wmm_param[5] /* version */ != 1)
304 count = wmm_param[6] & 0x0f;
305 if (count == wpa_s->mlme.wmm_last_param_set)
307 wpa_s->mlme.wmm_last_param_set = count;
310 left = wmm_param_len - 8;
314 for (; left >= 4; left -= 4, pos += 4) {
315 int aci = (pos[0] >> 5) & 0x03;
316 int acm = (pos[0] >> 4) & 0x01;
321 queue = IEEE80211_TX_QUEUE_DATA3;
323 wmm_acm |= BIT(1) | BIT(2);
326 queue = IEEE80211_TX_QUEUE_DATA1;
328 wmm_acm |= BIT(4) | BIT(5);
331 queue = IEEE80211_TX_QUEUE_DATA0;
333 wmm_acm |= BIT(6) | BIT(7);
337 queue = IEEE80211_TX_QUEUE_DATA2;
339 wpa_s->mlme.wmm_acm |= BIT(0) | BIT(3);
343 params.aifs = pos[0] & 0x0f;
344 params.cw_max = ecw2cw((pos[1] & 0xf0) >> 4);
345 params.cw_min = ecw2cw(pos[1] & 0x0f);
346 /* TXOP is in units of 32 usec; burst_time in 0.1 ms */
347 params.burst_time = (pos[2] | (pos[3] << 8)) * 32 / 100;
348 wpa_printf(MSG_DEBUG, "MLME: WMM queue=%d aci=%d acm=%d "
349 "aifs=%d cWmin=%d cWmax=%d burst=%d",
350 queue, aci, acm, params.aifs, params.cw_min,
351 params.cw_max, params.burst_time);
352 /* TODO: handle ACM (block TX, fallback to next lowest allowed
354 if (local->hw->conf_tx(local->mdev, queue, ¶ms)) {
355 wpa_printf(MSG_DEBUG, "MLME: failed to set TX queue "
356 "parameters for queue %d", queue);
363 static void ieee80211_set_associated(struct wpa_supplicant *wpa_s, int assoc)
365 if (wpa_s->mlme.associated == assoc && !assoc)
368 wpa_s->mlme.associated = assoc;
371 union wpa_event_data data;
372 os_memset(&data, 0, sizeof(data));
373 wpa_s->mlme.prev_bssid_set = 1;
374 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
375 data.assoc_info.req_ies = wpa_s->mlme.assocreq_ies;
376 data.assoc_info.req_ies_len = wpa_s->mlme.assocreq_ies_len;
377 data.assoc_info.resp_ies = wpa_s->mlme.assocresp_ies;
378 data.assoc_info.resp_ies_len = wpa_s->mlme.assocresp_ies_len;
379 wpa_supplicant_event(wpa_s, EVENT_ASSOC, &data);
381 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
383 os_get_time(&wpa_s->mlme.last_probe);
387 static int ieee80211_sta_tx(struct wpa_supplicant *wpa_s, const u8 *buf,
390 return wpa_drv_send_mlme(wpa_s, buf, len);
394 static void ieee80211_send_auth(struct wpa_supplicant *wpa_s,
395 int transaction, u8 *extra, size_t extra_len,
400 struct ieee80211_mgmt *mgmt;
402 buf = os_malloc(sizeof(*mgmt) + 6 + extra_len);
404 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
409 mgmt = (struct ieee80211_mgmt *) buf;
411 os_memset(mgmt, 0, 24 + 6);
412 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
415 mgmt->frame_control |= host_to_le16(WLAN_FC_ISWEP);
416 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
417 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
418 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
419 mgmt->u.auth.auth_alg = host_to_le16(wpa_s->mlme.auth_alg);
420 mgmt->u.auth.auth_transaction = host_to_le16(transaction);
421 wpa_s->mlme.auth_transaction = transaction + 1;
422 mgmt->u.auth.status_code = host_to_le16(0);
424 os_memcpy(buf + len, extra, extra_len);
428 ieee80211_sta_tx(wpa_s, buf, len);
433 static void ieee80211_reschedule_timer(struct wpa_supplicant *wpa_s, int ms)
435 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
436 eloop_register_timeout(ms / 1000, 1000 * (ms % 1000),
437 ieee80211_sta_timer, wpa_s, NULL);
441 static void ieee80211_authenticate(struct wpa_supplicant *wpa_s)
446 wpa_s->mlme.auth_tries++;
447 if (wpa_s->mlme.auth_tries > IEEE80211_AUTH_MAX_TRIES) {
448 wpa_printf(MSG_DEBUG, "MLME: authentication with AP " MACSTR
449 " timed out", MAC2STR(wpa_s->bssid));
453 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
454 wpa_printf(MSG_DEBUG, "MLME: authenticate with AP " MACSTR,
455 MAC2STR(wpa_s->bssid));
460 #ifdef CONFIG_IEEE80211R
461 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
462 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
463 wpa_s->mlme.ft_ies) {
464 struct ieee80211_sta_bss *bss;
465 struct rsn_mdie *mdie = NULL;
466 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
467 if (bss && bss->mdie_len >= 2 + sizeof(*mdie))
468 mdie = (struct rsn_mdie *) (bss->mdie + 2);
470 os_memcmp(mdie->mobility_domain, wpa_s->mlme.current_md,
471 MOBILITY_DOMAIN_ID_LEN) == 0) {
472 wpa_printf(MSG_DEBUG, "MLME: Trying to use FT "
474 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
475 extra = wpa_s->mlme.ft_ies;
476 extra_len = wpa_s->mlme.ft_ies_len;
479 #endif /* CONFIG_IEEE80211R */
481 ieee80211_send_auth(wpa_s, 1, extra, extra_len, 0);
483 ieee80211_reschedule_timer(wpa_s, IEEE80211_AUTH_TIMEOUT);
487 static void ieee80211_send_assoc(struct wpa_supplicant *wpa_s)
489 struct ieee80211_mgmt *mgmt;
493 struct ieee80211_sta_bss *bss;
497 if (wpa_s->mlme.curr_rates == NULL) {
498 wpa_printf(MSG_DEBUG, "MLME: curr_rates not set for assoc");
502 buflen = sizeof(*mgmt) + 200 + wpa_s->mlme.extra_ie_len +
503 wpa_s->mlme.ssid_len;
504 #ifdef CONFIG_IEEE80211R
505 if (wpa_s->mlme.ft_ies)
506 buflen += wpa_s->mlme.ft_ies_len;
507 #endif /* CONFIG_IEEE80211R */
508 buf = os_malloc(buflen);
510 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
516 capab = wpa_s->mlme.capab;
517 if (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G) {
518 capab |= WLAN_CAPABILITY_SHORT_SLOT_TIME |
519 WLAN_CAPABILITY_SHORT_PREAMBLE;
521 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
523 if (bss->capability & WLAN_CAPABILITY_PRIVACY)
524 capab |= WLAN_CAPABILITY_PRIVACY;
530 mgmt = (struct ieee80211_mgmt *) buf;
532 os_memset(mgmt, 0, 24);
533 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
534 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
535 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
537 if (wpa_s->mlme.prev_bssid_set) {
539 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
540 WLAN_FC_STYPE_REASSOC_REQ);
541 mgmt->u.reassoc_req.capab_info = host_to_le16(capab);
542 mgmt->u.reassoc_req.listen_interval = host_to_le16(1);
543 os_memcpy(mgmt->u.reassoc_req.current_ap,
544 wpa_s->mlme.prev_bssid,
548 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
549 WLAN_FC_STYPE_ASSOC_REQ);
550 mgmt->u.assoc_req.capab_info = host_to_le16(capab);
551 mgmt->u.assoc_req.listen_interval = host_to_le16(1);
555 ies = pos = buf + blen;
556 blen += 2 + wpa_s->mlme.ssid_len;
557 *pos++ = WLAN_EID_SSID;
558 *pos++ = wpa_s->mlme.ssid_len;
559 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
561 len = wpa_s->mlme.num_curr_rates;
566 *pos++ = WLAN_EID_SUPP_RATES;
568 for (i = 0; i < len; i++) {
569 int rate = wpa_s->mlme.curr_rates[i].rate;
570 *pos++ = (u8) (rate / 5);
573 if (wpa_s->mlme.num_curr_rates > len) {
575 blen += wpa_s->mlme.num_curr_rates - len + 2;
576 *pos++ = WLAN_EID_EXT_SUPP_RATES;
577 *pos++ = wpa_s->mlme.num_curr_rates - len;
578 for (i = len; i < wpa_s->mlme.num_curr_rates; i++) {
579 int rate = wpa_s->mlme.curr_rates[i].rate;
580 *pos++ = (u8) (rate / 5);
584 if (wpa_s->mlme.extra_ie && wpa_s->mlme.auth_alg != WLAN_AUTH_FT) {
586 blen += wpa_s->mlme.extra_ie_len;
587 os_memcpy(pos, wpa_s->mlme.extra_ie, wpa_s->mlme.extra_ie_len);
590 #ifdef CONFIG_IEEE80211R
591 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
592 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
593 wpa_s->mlme.auth_alg != WLAN_AUTH_FT &&
595 bss->mdie_len >= 2 + sizeof(struct rsn_mdie) &&
596 bss->mdie[1] >= sizeof(struct rsn_mdie)) {
598 blen += 2 + sizeof(struct rsn_mdie);
599 *pos++ = WLAN_EID_MOBILITY_DOMAIN;
600 *pos++ = sizeof(struct rsn_mdie);
601 os_memcpy(pos, bss->mdie + 2, MOBILITY_DOMAIN_ID_LEN);
602 pos += MOBILITY_DOMAIN_ID_LEN;
603 *pos++ = 0; /* FIX: copy from the target AP's MDIE */
606 if ((wpa_s->mlme.key_mgmt == KEY_MGMT_FT_802_1X ||
607 wpa_s->mlme.key_mgmt == KEY_MGMT_FT_PSK) &&
608 wpa_s->mlme.auth_alg == WLAN_AUTH_FT && wpa_s->mlme.ft_ies) {
610 os_memcpy(pos, wpa_s->mlme.ft_ies, wpa_s->mlme.ft_ies_len);
611 pos += wpa_s->mlme.ft_ies_len;
612 blen += wpa_s->mlme.ft_ies_len;
614 #endif /* CONFIG_IEEE80211R */
616 if (wmm && wpa_s->mlme.wmm_enabled) {
619 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
620 *pos++ = 7; /* len */
621 *pos++ = 0x00; /* Microsoft OUI 00:50:F2 */
624 *pos++ = 2; /* WME */
625 *pos++ = 0; /* WME info */
626 *pos++ = 1; /* WME ver */
630 os_free(wpa_s->mlme.assocreq_ies);
631 wpa_s->mlme.assocreq_ies_len = (buf + blen) - ies;
632 wpa_s->mlme.assocreq_ies = os_malloc(wpa_s->mlme.assocreq_ies_len);
633 if (wpa_s->mlme.assocreq_ies) {
634 os_memcpy(wpa_s->mlme.assocreq_ies, ies,
635 wpa_s->mlme.assocreq_ies_len);
638 ieee80211_sta_tx(wpa_s, buf, blen);
643 static void ieee80211_send_deauth(struct wpa_supplicant *wpa_s, u16 reason)
647 struct ieee80211_mgmt *mgmt;
649 buf = os_zalloc(sizeof(*mgmt));
651 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
656 mgmt = (struct ieee80211_mgmt *) buf;
658 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
659 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
660 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
661 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
662 WLAN_FC_STYPE_DEAUTH);
664 mgmt->u.deauth.reason_code = host_to_le16(reason);
666 ieee80211_sta_tx(wpa_s, buf, len);
671 static void ieee80211_send_disassoc(struct wpa_supplicant *wpa_s, u16 reason)
675 struct ieee80211_mgmt *mgmt;
677 buf = os_zalloc(sizeof(*mgmt));
679 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
684 mgmt = (struct ieee80211_mgmt *) buf;
686 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
687 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
688 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
689 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
690 WLAN_FC_STYPE_DISASSOC);
692 mgmt->u.disassoc.reason_code = host_to_le16(reason);
694 ieee80211_sta_tx(wpa_s, buf, len);
699 static int ieee80211_privacy_mismatch(struct wpa_supplicant *wpa_s)
701 struct ieee80211_sta_bss *bss;
704 if (wpa_s->mlme.mixed_cell ||
705 wpa_s->mlme.key_mgmt != KEY_MGMT_NONE)
708 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
712 if (ieee80211_sta_wep_configured(wpa_s) !=
713 !!(bss->capability & WLAN_CAPABILITY_PRIVACY))
720 static void ieee80211_associate(struct wpa_supplicant *wpa_s)
722 wpa_s->mlme.assoc_tries++;
723 if (wpa_s->mlme.assoc_tries > IEEE80211_ASSOC_MAX_TRIES) {
724 wpa_printf(MSG_DEBUG, "MLME: association with AP " MACSTR
725 " timed out", MAC2STR(wpa_s->bssid));
729 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
730 wpa_printf(MSG_DEBUG, "MLME: associate with AP " MACSTR,
731 MAC2STR(wpa_s->bssid));
732 if (ieee80211_privacy_mismatch(wpa_s)) {
733 wpa_printf(MSG_DEBUG, "MLME: mismatch in privacy "
734 "configuration and mixed-cell disabled - abort "
739 ieee80211_send_assoc(wpa_s);
741 ieee80211_reschedule_timer(wpa_s, IEEE80211_ASSOC_TIMEOUT);
745 static void ieee80211_associated(struct wpa_supplicant *wpa_s)
749 /* TODO: start monitoring current AP signal quality and number of
750 * missed beacons. Scan other channels every now and then and search
752 /* TODO: remove expired BSSes */
754 wpa_s->mlme.state = IEEE80211_ASSOCIATED;
757 sta = sta_info_get(local, wpa_s->bssid);
759 wpa_printf(MSG_DEBUG "MLME: No STA entry for own AP " MACSTR,
760 MAC2STR(wpa_s->bssid));
764 if (time_after(jiffies,
765 sta->last_rx + IEEE80211_MONITORING_INTERVAL)) {
766 if (wpa_s->mlme.probereq_poll) {
767 wpa_printf(MSG_DEBUG "MLME: No ProbeResp from "
768 "current AP " MACSTR " - assume "
770 MAC2STR(wpa_s->bssid));
773 ieee80211_send_probe_req(
775 wpa_s->mlme.scan_ssid,
776 wpa_s->mlme.scan_ssid_len);
777 wpa_s->mlme.probereq_poll = 1;
780 wpa_s->mlme.probereq_poll = 0;
781 if (time_after(jiffies, wpa_s->mlme.last_probe +
782 IEEE80211_PROBE_INTERVAL)) {
783 wpa_s->mlme.last_probe = jiffies;
784 ieee80211_send_probe_req(wpa_s->bssid,
786 wpa_s->mlme.ssid_len);
789 sta_info_release(local, sta);
795 wpa_supplicant_event(wpa_s, EVENT_DISASSOC, NULL);
796 ieee80211_reschedule_timer(wpa_s,
797 IEEE80211_MONITORING_INTERVAL +
800 ieee80211_reschedule_timer(wpa_s,
801 IEEE80211_MONITORING_INTERVAL);
806 static void ieee80211_send_probe_req(struct wpa_supplicant *wpa_s,
808 const u8 *ssid, size_t ssid_len)
812 struct ieee80211_mgmt *mgmt;
813 u8 *pos, *supp_rates;
814 u8 *esupp_rates = NULL;
817 buf = os_malloc(sizeof(*mgmt) + 200 + wpa_s->mlme.extra_probe_ie_len);
819 wpa_printf(MSG_DEBUG, "MLME: failed to allocate buffer for "
824 mgmt = (struct ieee80211_mgmt *) buf;
826 os_memset(mgmt, 0, 24);
827 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
828 WLAN_FC_STYPE_PROBE_REQ);
829 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
831 os_memcpy(mgmt->da, dst, ETH_ALEN);
832 os_memcpy(mgmt->bssid, dst, ETH_ALEN);
834 os_memset(mgmt->da, 0xff, ETH_ALEN);
835 os_memset(mgmt->bssid, 0xff, ETH_ALEN);
839 *pos++ = WLAN_EID_SSID;
841 os_memcpy(pos, ssid, ssid_len);
843 supp_rates = buf + len;
845 supp_rates[0] = WLAN_EID_SUPP_RATES;
847 for (i = 0; i < wpa_s->mlme.num_curr_rates; i++) {
848 struct wpa_rate_data *rate = &wpa_s->mlme.curr_rates[i];
853 } else if (supp_rates[1] == 8) {
855 esupp_rates[0] = WLAN_EID_EXT_SUPP_RATES;
857 pos = &esupp_rates[2];
864 *pos++ = rate->rate / 5;
867 if (wpa_s->mlme.extra_probe_ie) {
868 os_memcpy(pos, wpa_s->mlme.extra_probe_ie,
869 wpa_s->mlme.extra_probe_ie_len);
870 len += wpa_s->mlme.extra_probe_ie_len;
873 ieee80211_sta_tx(wpa_s, buf, len);
878 static int ieee80211_sta_wep_configured(struct wpa_supplicant *wpa_s)
881 if (sdata == NULL || sdata->default_key == NULL ||
882 sdata->default_key->alg != ALG_WEP)
891 static void ieee80211_auth_completed(struct wpa_supplicant *wpa_s)
893 wpa_printf(MSG_DEBUG, "MLME: authenticated");
894 wpa_s->mlme.authenticated = 1;
895 ieee80211_associate(wpa_s);
899 static void ieee80211_auth_challenge(struct wpa_supplicant *wpa_s,
900 struct ieee80211_mgmt *mgmt,
902 struct ieee80211_rx_status *rx_status)
905 struct ieee802_11_elems elems;
907 wpa_printf(MSG_DEBUG, "MLME: replying to auth challenge");
908 pos = mgmt->u.auth.variable;
909 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
911 wpa_printf(MSG_DEBUG, "MLME: failed to parse Auth(challenge)");
914 if (elems.challenge == NULL) {
915 wpa_printf(MSG_DEBUG, "MLME: no challenge IE in shared key "
919 ieee80211_send_auth(wpa_s, 3, elems.challenge - 2,
920 elems.challenge_len + 2, 1);
924 static void ieee80211_rx_mgmt_auth(struct wpa_supplicant *wpa_s,
925 struct ieee80211_mgmt *mgmt,
927 struct ieee80211_rx_status *rx_status)
929 struct wpa_ssid *ssid = wpa_s->current_ssid;
930 u16 auth_alg, auth_transaction, status_code;
933 adhoc = ssid && ssid->mode == 1;
935 if (wpa_s->mlme.state != IEEE80211_AUTHENTICATE && !adhoc) {
936 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
937 "from " MACSTR ", but not in authenticate state - "
938 "ignored", MAC2STR(mgmt->sa));
943 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) authentication "
944 "frame received from " MACSTR " - ignored",
945 (unsigned long) len, MAC2STR(mgmt->sa));
949 if (!adhoc && os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
950 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
951 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
953 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
957 if (adhoc && os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0) {
958 wpa_printf(MSG_DEBUG, "MLME: authentication frame received "
959 "from unknown BSSID (SA=" MACSTR " BSSID=" MACSTR
961 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
965 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
966 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
967 status_code = le_to_host16(mgmt->u.auth.status_code);
969 wpa_printf(MSG_DEBUG, "MLME: RX authentication from " MACSTR
970 " (alg=%d transaction=%d status=%d)",
971 MAC2STR(mgmt->sa), auth_alg, auth_transaction, status_code);
974 /* IEEE 802.11 standard does not require authentication in IBSS
975 * networks and most implementations do not seem to use it.
976 * However, try to reply to authentication attempts if someone
977 * has actually implemented this.
978 * TODO: Could implement shared key authentication. */
979 if (auth_alg != WLAN_AUTH_OPEN || auth_transaction != 1) {
980 wpa_printf(MSG_DEBUG, "MLME: unexpected IBSS "
981 "authentication frame (alg=%d "
983 auth_alg, auth_transaction);
986 ieee80211_send_auth(wpa_s, 2, NULL, 0, 0);
989 if (auth_alg != wpa_s->mlme.auth_alg ||
990 auth_transaction != wpa_s->mlme.auth_transaction) {
991 wpa_printf(MSG_DEBUG, "MLME: unexpected authentication frame "
992 "(alg=%d transaction=%d)",
993 auth_alg, auth_transaction);
997 if (status_code != WLAN_STATUS_SUCCESS) {
998 wpa_printf(MSG_DEBUG, "MLME: AP denied authentication "
999 "(auth_alg=%d code=%d)", wpa_s->mlme.auth_alg,
1001 if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG) {
1002 const int num_algs = 3;
1005 algs[0] = algs[1] = algs[2] = 0xff;
1006 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
1007 algs[0] = WLAN_AUTH_OPEN;
1008 if (wpa_s->mlme.auth_algs &
1009 IEEE80211_AUTH_ALG_SHARED_KEY)
1010 algs[1] = WLAN_AUTH_SHARED_KEY;
1011 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
1012 algs[2] = WLAN_AUTH_LEAP;
1013 if (wpa_s->mlme.auth_alg == WLAN_AUTH_OPEN)
1015 else if (wpa_s->mlme.auth_alg == WLAN_AUTH_SHARED_KEY)
1019 for (i = 0; i < num_algs; i++) {
1021 if (pos >= num_algs)
1023 if (algs[pos] == wpa_s->mlme.auth_alg ||
1026 if (algs[pos] == WLAN_AUTH_SHARED_KEY &&
1027 !ieee80211_sta_wep_configured(wpa_s))
1029 wpa_s->mlme.auth_alg = algs[pos];
1030 wpa_printf(MSG_DEBUG, "MLME: set auth_alg=%d "
1032 wpa_s->mlme.auth_alg);
1039 switch (wpa_s->mlme.auth_alg) {
1040 case WLAN_AUTH_OPEN:
1041 case WLAN_AUTH_LEAP:
1042 ieee80211_auth_completed(wpa_s);
1044 case WLAN_AUTH_SHARED_KEY:
1045 if (wpa_s->mlme.auth_transaction == 4)
1046 ieee80211_auth_completed(wpa_s);
1048 ieee80211_auth_challenge(wpa_s, mgmt, len,
1051 #ifdef CONFIG_IEEE80211R
1054 union wpa_event_data data;
1055 os_memset(&data, 0, sizeof(data));
1056 data.ft_ies.ies = mgmt->u.auth.variable;
1057 data.ft_ies.ies_len = len -
1058 (mgmt->u.auth.variable - (u8 *) mgmt);
1059 os_memcpy(data.ft_ies.target_ap, wpa_s->bssid, ETH_ALEN);
1060 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1061 ieee80211_auth_completed(wpa_s);
1064 #endif /* CONFIG_IEEE80211R */
1069 static void ieee80211_rx_mgmt_deauth(struct wpa_supplicant *wpa_s,
1070 struct ieee80211_mgmt *mgmt,
1072 struct ieee80211_rx_status *rx_status)
1077 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) deauthentication "
1078 "frame received from " MACSTR " - ignored",
1079 (unsigned long) len, MAC2STR(mgmt->sa));
1083 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1084 wpa_printf(MSG_DEBUG, "MLME: deauthentication frame received "
1085 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1087 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1091 reason_code = le_to_host16(mgmt->u.deauth.reason_code);
1093 wpa_printf(MSG_DEBUG, "MLME: RX deauthentication from " MACSTR
1094 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1096 if (wpa_s->mlme.authenticated)
1097 wpa_printf(MSG_DEBUG, "MLME: deauthenticated");
1099 if (wpa_s->mlme.state == IEEE80211_AUTHENTICATE ||
1100 wpa_s->mlme.state == IEEE80211_ASSOCIATE ||
1101 wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1102 wpa_s->mlme.state = IEEE80211_AUTHENTICATE;
1103 ieee80211_reschedule_timer(wpa_s,
1104 IEEE80211_RETRY_AUTH_INTERVAL);
1107 ieee80211_set_associated(wpa_s, 0);
1108 wpa_s->mlme.authenticated = 0;
1112 static void ieee80211_rx_mgmt_disassoc(struct wpa_supplicant *wpa_s,
1113 struct ieee80211_mgmt *mgmt,
1115 struct ieee80211_rx_status *rx_status)
1120 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) disassociation "
1121 "frame received from " MACSTR " - ignored",
1122 (unsigned long) len, MAC2STR(mgmt->sa));
1126 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1127 wpa_printf(MSG_DEBUG, "MLME: disassociation frame received "
1128 "from unknown AP (SA=" MACSTR " BSSID=" MACSTR
1130 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1134 reason_code = le_to_host16(mgmt->u.disassoc.reason_code);
1136 wpa_printf(MSG_DEBUG, "MLME: RX disassociation from " MACSTR
1137 " (reason=%d)", MAC2STR(mgmt->sa), reason_code);
1139 if (wpa_s->mlme.associated)
1140 wpa_printf(MSG_DEBUG, "MLME: disassociated");
1142 if (wpa_s->mlme.state == IEEE80211_ASSOCIATED) {
1143 wpa_s->mlme.state = IEEE80211_ASSOCIATE;
1144 ieee80211_reschedule_timer(wpa_s,
1145 IEEE80211_RETRY_AUTH_INTERVAL);
1148 ieee80211_set_associated(wpa_s, 0);
1152 static int ieee80211_ft_assoc_resp(struct wpa_supplicant *wpa_s,
1153 struct ieee802_11_elems *elems)
1155 #ifdef CONFIG_IEEE80211R
1156 const u8 *mobility_domain = NULL;
1157 const u8 *r0kh_id = NULL;
1158 size_t r0kh_id_len = 0;
1159 const u8 *r1kh_id = NULL;
1160 struct rsn_ftie *hdr;
1161 const u8 *pos, *end;
1163 if (elems->mdie && elems->mdie_len >= MOBILITY_DOMAIN_ID_LEN)
1164 mobility_domain = elems->mdie;
1165 if (elems->ftie && elems->ftie_len >= sizeof(struct rsn_ftie)) {
1166 end = elems->ftie + elems->ftie_len;
1167 hdr = (struct rsn_ftie *) elems->ftie;
1168 pos = (const u8 *) (hdr + 1);
1169 while (pos + 1 < end) {
1170 if (pos + 2 + pos[1] > end)
1172 if (pos[0] == FTIE_SUBELEM_R1KH_ID &&
1173 pos[1] == FT_R1KH_ID_LEN)
1175 else if (pos[0] == FTIE_SUBELEM_R0KH_ID &&
1176 pos[1] >= 1 && pos[1] <= FT_R0KH_ID_MAX_LEN) {
1178 r0kh_id_len = pos[1];
1183 return wpa_sm_set_ft_params(wpa_s->wpa, mobility_domain, r0kh_id,
1184 r0kh_id_len, r1kh_id);
1185 #else /* CONFIG_IEEE80211R */
1187 #endif /* CONFIG_IEEE80211R */
1191 static void ieee80211_rx_mgmt_assoc_resp(struct wpa_supplicant *wpa_s,
1192 struct ieee80211_mgmt *mgmt,
1194 struct ieee80211_rx_status *rx_status,
1199 u16 capab_info, status_code, aid;
1200 struct ieee802_11_elems elems;
1203 /* AssocResp and ReassocResp have identical structure, so process both
1204 * of them in this function. */
1206 if (wpa_s->mlme.state != IEEE80211_ASSOCIATE) {
1207 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1208 MACSTR ", but not in associate state - ignored",
1214 wpa_printf(MSG_DEBUG, "MLME: too short (%lu) association "
1215 "frame received from " MACSTR " - ignored",
1216 (unsigned long) len, MAC2STR(mgmt->sa));
1220 if (os_memcmp(wpa_s->bssid, mgmt->sa, ETH_ALEN) != 0) {
1221 wpa_printf(MSG_DEBUG, "MLME: association frame received from "
1222 "unknown AP (SA=" MACSTR " BSSID=" MACSTR ") - "
1223 "ignored", MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid));
1227 capab_info = le_to_host16(mgmt->u.assoc_resp.capab_info);
1228 status_code = le_to_host16(mgmt->u.assoc_resp.status_code);
1229 aid = le_to_host16(mgmt->u.assoc_resp.aid);
1230 if ((aid & (BIT(15) | BIT(14))) != (BIT(15) | BIT(14)))
1231 wpa_printf(MSG_DEBUG, "MLME: invalid aid value %d; bits 15:14 "
1233 aid &= ~(BIT(15) | BIT(14));
1235 wpa_printf(MSG_DEBUG, "MLME: RX %sssocResp from " MACSTR
1236 " (capab=0x%x status=%d aid=%d)",
1237 reassoc ? "Rea" : "A", MAC2STR(mgmt->sa),
1238 capab_info, status_code, aid);
1240 pos = mgmt->u.assoc_resp.variable;
1241 if (ieee802_11_parse_elems(pos, len - (pos - (u8 *) mgmt), &elems)
1243 wpa_printf(MSG_DEBUG, "MLME: failed to parse AssocResp");
1247 if (status_code != WLAN_STATUS_SUCCESS) {
1248 wpa_printf(MSG_DEBUG, "MLME: AP denied association (code=%d)",
1250 #ifdef CONFIG_IEEE80211W
1251 if (status_code == WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY &&
1252 elems.assoc_comeback && elems.assoc_comeback_len == 4) {
1254 tu = WPA_GET_LE32(elems.assoc_comeback);
1255 ms = tu * 1024 / 1000;
1256 wpa_printf(MSG_DEBUG, "MLME: AP rejected association "
1257 "temporarily; comeback duration %u TU "
1259 if (ms > IEEE80211_ASSOC_TIMEOUT) {
1260 wpa_printf(MSG_DEBUG, "MLME: Update timer "
1261 "based on comeback duration");
1262 ieee80211_reschedule_timer(wpa_s, ms);
1265 #endif /* CONFIG_IEEE80211W */
1269 if (elems.supp_rates == NULL) {
1270 wpa_printf(MSG_DEBUG, "MLME: no SuppRates element in "
1275 if (wpa_s->mlme.auth_alg == WLAN_AUTH_FT) {
1277 wpa_printf(MSG_DEBUG, "MLME: AP tried to use "
1278 "association, not reassociation, response "
1282 if (wpa_ft_validate_reassoc_resp(
1283 wpa_s->wpa, pos, len - (pos - (u8 *) mgmt),
1285 wpa_printf(MSG_DEBUG, "MLME: FT validation of Reassoc"
1289 } else if (ieee80211_ft_assoc_resp(wpa_s, &elems) < 0)
1292 wpa_printf(MSG_DEBUG, "MLME: associated");
1293 wpa_s->mlme.aid = aid;
1294 wpa_s->mlme.ap_capab = capab_info;
1296 os_free(wpa_s->mlme.assocresp_ies);
1297 wpa_s->mlme.assocresp_ies_len = len - (pos - (u8 *) mgmt);
1298 wpa_s->mlme.assocresp_ies = os_malloc(wpa_s->mlme.assocresp_ies_len);
1299 if (wpa_s->mlme.assocresp_ies) {
1300 os_memcpy(wpa_s->mlme.assocresp_ies, pos,
1301 wpa_s->mlme.assocresp_ies_len);
1304 ieee80211_set_associated(wpa_s, 1);
1306 rates_len = elems.supp_rates_len;
1307 if (rates_len > sizeof(rates))
1308 rates_len = sizeof(rates);
1309 os_memcpy(rates, elems.supp_rates, rates_len);
1310 if (elems.ext_supp_rates) {
1311 size_t _len = elems.ext_supp_rates_len;
1312 if (_len > sizeof(rates) - rates_len)
1313 _len = sizeof(rates) - rates_len;
1314 os_memcpy(rates + rates_len, elems.ext_supp_rates, _len);
1318 if (wpa_drv_set_bssid(wpa_s, wpa_s->bssid) < 0) {
1319 wpa_printf(MSG_DEBUG, "MLME: failed to set BSSID for the "
1322 if (wpa_drv_set_ssid(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) <
1324 wpa_printf(MSG_DEBUG, "MLME: failed to set SSID for the "
1328 /* Remove STA entry before adding a new one just in case to avoid
1329 * problems with existing configuration (e.g., keys). */
1330 wpa_drv_mlme_remove_sta(wpa_s, wpa_s->bssid);
1331 if (wpa_drv_mlme_add_sta(wpa_s, wpa_s->bssid, rates, rates_len) < 0) {
1332 wpa_printf(MSG_DEBUG, "MLME: failed to add STA entry to the "
1339 if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1340 sta->flags |= WLAN_STA_WME;
1341 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1342 elems.wmm_param_len);
1346 ieee80211_associated(wpa_s);
1350 /* Caller must hold local->sta_bss_lock */
1351 static void __ieee80211_bss_hash_add(struct wpa_supplicant *wpa_s,
1352 struct ieee80211_sta_bss *bss)
1354 bss->hnext = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1355 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)] = bss;
1359 /* Caller must hold local->sta_bss_lock */
1360 static void __ieee80211_bss_hash_del(struct wpa_supplicant *wpa_s,
1361 struct ieee80211_sta_bss *bss)
1363 struct ieee80211_sta_bss *b, *prev = NULL;
1364 b = wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)];
1368 wpa_s->mlme.sta_bss_hash[STA_HASH(bss->bssid)]
1371 prev->hnext = bss->hnext;
1381 static struct ieee80211_sta_bss *
1382 ieee80211_bss_add(struct wpa_supplicant *wpa_s, const u8 *bssid)
1384 struct ieee80211_sta_bss *bss;
1386 bss = os_zalloc(sizeof(*bss));
1389 os_memcpy(bss->bssid, bssid, ETH_ALEN);
1391 /* TODO: order by RSSI? */
1392 bss->next = wpa_s->mlme.sta_bss_list;
1393 wpa_s->mlme.sta_bss_list = bss;
1394 __ieee80211_bss_hash_add(wpa_s, bss);
1399 static struct ieee80211_sta_bss *
1400 ieee80211_bss_get(struct wpa_supplicant *wpa_s, const u8 *bssid)
1402 struct ieee80211_sta_bss *bss;
1404 bss = wpa_s->mlme.sta_bss_hash[STA_HASH(bssid)];
1406 if (os_memcmp(bss->bssid, bssid, ETH_ALEN) == 0)
1414 static void ieee80211_bss_free(struct wpa_supplicant *wpa_s,
1415 struct ieee80211_sta_bss *bss)
1417 __ieee80211_bss_hash_del(wpa_s, bss);
1419 os_free(bss->wpa_ie);
1420 os_free(bss->rsn_ie);
1421 os_free(bss->wmm_ie);
1427 static void ieee80211_bss_list_deinit(struct wpa_supplicant *wpa_s)
1429 struct ieee80211_sta_bss *bss, *prev;
1431 bss = wpa_s->mlme.sta_bss_list;
1432 wpa_s->mlme.sta_bss_list = NULL;
1436 ieee80211_bss_free(wpa_s, prev);
1441 static void ieee80211_bss_info(struct wpa_supplicant *wpa_s,
1442 struct ieee80211_mgmt *mgmt,
1444 struct ieee80211_rx_status *rx_status,
1447 struct ieee802_11_elems elems;
1449 int channel, invalid = 0, clen;
1450 struct ieee80211_sta_bss *bss;
1455 if (!beacon && os_memcmp(mgmt->da, wpa_s->own_addr, ETH_ALEN))
1456 return; /* ignore ProbeResp to foreign address */
1459 wpa_printf(MSG_MSGDUMP, "MLME: RX %s from " MACSTR " to " MACSTR,
1460 beacon ? "Beacon" : "Probe Response",
1461 MAC2STR(mgmt->sa), MAC2STR(mgmt->da));
1464 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1468 pos = mgmt->u.beacon.timestamp;
1469 timestamp = WPA_GET_LE64(pos);
1472 if (local->conf.mode == IW_MODE_ADHOC && beacon &&
1473 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0) {
1474 #ifdef IEEE80211_IBSS_DEBUG
1475 static unsigned long last_tsf_debug = 0;
1477 if (local->hw->get_tsf)
1478 tsf = local->hw->get_tsf(local->mdev);
1481 if (time_after(jiffies, last_tsf_debug + 5 * HZ)) {
1482 wpa_printf(MSG_DEBUG, "RX beacon SA=" MACSTR " BSSID="
1483 MACSTR " TSF=0x%llx BCN=0x%llx diff=%lld "
1485 MAC2STR(mgmt->sa), MAC2STR(mgmt->bssid),
1486 tsf, timestamp, tsf - timestamp, jiffies);
1487 last_tsf_debug = jiffies;
1489 #endif /* IEEE80211_IBSS_DEBUG */
1493 ie_pos = mgmt->u.beacon.variable;
1494 ie_len = len - baselen;
1495 if (ieee802_11_parse_elems(ie_pos, ie_len, &elems) == ParseFailed)
1499 if (local->conf.mode == IW_MODE_ADHOC && elems.supp_rates &&
1500 os_memcmp(mgmt->bssid, local->bssid, ETH_ALEN) == 0 &&
1501 (sta = sta_info_get(local, mgmt->sa))) {
1502 struct ieee80211_rate *rates;
1504 u32 supp_rates, prev_rates;
1505 int i, j, oper_mode;
1507 rates = local->curr_rates;
1508 num_rates = local->num_curr_rates;
1509 oper_mode = wpa_s->mlme.sta_scanning ?
1510 local->scan_oper_phymode : local->conf.phymode;
1511 for (i = 0; i < local->hw->num_modes; i++) {
1512 struct ieee80211_hw_modes *mode = &local->hw->modes[i];
1513 if (oper_mode == mode->mode) {
1514 rates = mode->rates;
1515 num_rates = mode->num_rates;
1521 for (i = 0; i < elems.supp_rates_len +
1522 elems.ext_supp_rates_len; i++) {
1525 if (i < elems.supp_rates_len)
1526 rate = elems.supp_rates[i];
1527 else if (elems.ext_supp_rates)
1528 rate = elems.ext_supp_rates
1529 [i - elems.supp_rates_len];
1530 own_rate = 5 * (rate & 0x7f);
1531 if (oper_mode == MODE_ATHEROS_TURBO)
1533 for (j = 0; j < num_rates; j++)
1534 if (rates[j].rate == own_rate)
1535 supp_rates |= BIT(j);
1538 prev_rates = sta->supp_rates;
1539 sta->supp_rates &= supp_rates;
1540 if (sta->supp_rates == 0) {
1541 /* No matching rates - this should not really happen.
1542 * Make sure that at least one rate is marked
1543 * supported to avoid issues with TX rate ctrl. */
1544 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
1546 if (sta->supp_rates != prev_rates) {
1547 wpa_printf(MSG_DEBUG, "MLME: updated supp_rates set "
1548 "for " MACSTR " based on beacon info "
1549 "(0x%x & 0x%x -> 0x%x)",
1550 MAC2STR(sta->addr), prev_rates,
1551 supp_rates, sta->supp_rates);
1553 sta_info_release(local, sta);
1557 if (elems.ssid == NULL)
1560 if (elems.ds_params && elems.ds_params_len == 1)
1561 channel = elems.ds_params[0];
1563 channel = rx_status->channel;
1565 bss = ieee80211_bss_get(wpa_s, mgmt->bssid);
1567 bss = ieee80211_bss_add(wpa_s, mgmt->bssid);
1572 /* TODO: order by RSSI? */
1573 spin_lock_bh(&local->sta_bss_lock);
1574 list_move_tail(&bss->list, &local->sta_bss_list);
1575 spin_unlock_bh(&local->sta_bss_lock);
1579 if (bss->probe_resp && beacon) {
1580 /* Do not allow beacon to override data from Probe Response. */
1584 bss->beacon_int = le_to_host16(mgmt->u.beacon.beacon_int);
1585 bss->capability = le_to_host16(mgmt->u.beacon.capab_info);
1587 if (bss->ie == NULL || bss->ie_len < ie_len) {
1589 bss->ie = os_malloc(ie_len);
1592 os_memcpy(bss->ie, ie_pos, ie_len);
1593 bss->ie_len = ie_len;
1596 if (elems.ssid && elems.ssid_len <= MAX_SSID_LEN) {
1597 os_memcpy(bss->ssid, elems.ssid, elems.ssid_len);
1598 bss->ssid_len = elems.ssid_len;
1601 bss->supp_rates_len = 0;
1602 if (elems.supp_rates) {
1603 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1604 if (clen > elems.supp_rates_len)
1605 clen = elems.supp_rates_len;
1606 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1607 elems.supp_rates, clen);
1608 bss->supp_rates_len += clen;
1610 if (elems.ext_supp_rates) {
1611 clen = IEEE80211_MAX_SUPP_RATES - bss->supp_rates_len;
1612 if (clen > elems.ext_supp_rates_len)
1613 clen = elems.ext_supp_rates_len;
1614 os_memcpy(&bss->supp_rates[bss->supp_rates_len],
1615 elems.ext_supp_rates, clen);
1616 bss->supp_rates_len += clen;
1620 (bss->wpa_ie == NULL || bss->wpa_ie_len != elems.wpa_len ||
1621 os_memcmp(bss->wpa_ie, elems.wpa, elems.wpa_len))) {
1622 os_free(bss->wpa_ie);
1623 bss->wpa_ie = os_malloc(elems.wpa_len + 2);
1625 os_memcpy(bss->wpa_ie, elems.wpa - 2,
1627 bss->wpa_ie_len = elems.wpa_len + 2;
1629 bss->wpa_ie_len = 0;
1630 } else if (!elems.wpa && bss->wpa_ie) {
1631 os_free(bss->wpa_ie);
1633 bss->wpa_ie_len = 0;
1637 (bss->rsn_ie == NULL || bss->rsn_ie_len != elems.rsn_len ||
1638 os_memcmp(bss->rsn_ie, elems.rsn, elems.rsn_len))) {
1639 os_free(bss->rsn_ie);
1640 bss->rsn_ie = os_malloc(elems.rsn_len + 2);
1642 os_memcpy(bss->rsn_ie, elems.rsn - 2,
1644 bss->rsn_ie_len = elems.rsn_len + 2;
1646 bss->rsn_ie_len = 0;
1647 } else if (!elems.rsn && bss->rsn_ie) {
1648 os_free(bss->rsn_ie);
1650 bss->rsn_ie_len = 0;
1653 if (elems.wmm_param &&
1654 (bss->wmm_ie == NULL || bss->wmm_ie_len != elems.wmm_param_len ||
1655 os_memcmp(bss->wmm_ie, elems.wmm_param, elems.wmm_param_len))) {
1656 os_free(bss->wmm_ie);
1657 bss->wmm_ie = os_malloc(elems.wmm_param_len + 2);
1659 os_memcpy(bss->wmm_ie, elems.wmm_param - 2,
1660 elems.wmm_param_len + 2);
1661 bss->wmm_ie_len = elems.wmm_param_len + 2;
1663 bss->wmm_ie_len = 0;
1664 } else if (!elems.wmm_param && bss->wmm_ie) {
1665 os_free(bss->wmm_ie);
1667 bss->wmm_ie_len = 0;
1670 #ifdef CONFIG_IEEE80211R
1672 (bss->mdie == NULL || bss->mdie_len != elems.mdie_len ||
1673 os_memcmp(bss->mdie, elems.mdie, elems.mdie_len))) {
1675 bss->mdie = os_malloc(elems.mdie_len + 2);
1677 os_memcpy(bss->mdie, elems.mdie - 2,
1678 elems.mdie_len + 2);
1679 bss->mdie_len = elems.mdie_len + 2;
1682 } else if (!elems.mdie && bss->mdie) {
1687 #endif /* CONFIG_IEEE80211R */
1689 bss->hw_mode = wpa_s->mlme.phymode;
1690 bss->channel = channel;
1691 bss->freq = wpa_s->mlme.freq;
1692 if (channel != wpa_s->mlme.channel &&
1693 (wpa_s->mlme.phymode == WPA_MODE_IEEE80211G ||
1694 wpa_s->mlme.phymode == WPA_MODE_IEEE80211B) &&
1695 channel >= 1 && channel <= 14) {
1696 static const int freq_list[] = {
1697 2412, 2417, 2422, 2427, 2432, 2437, 2442,
1698 2447, 2452, 2457, 2462, 2467, 2472, 2484
1700 /* IEEE 802.11g/b mode can receive packets from neighboring
1701 * channels, so map the channel into frequency. */
1702 bss->freq = freq_list[channel - 1];
1704 bss->timestamp = timestamp;
1705 os_get_time(&bss->last_update);
1706 bss->rssi = rx_status->ssi;
1712 static void ieee80211_rx_mgmt_probe_resp(struct wpa_supplicant *wpa_s,
1713 struct ieee80211_mgmt *mgmt,
1715 struct ieee80211_rx_status *rx_status)
1717 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 0);
1721 static void ieee80211_rx_mgmt_beacon(struct wpa_supplicant *wpa_s,
1722 struct ieee80211_mgmt *mgmt,
1724 struct ieee80211_rx_status *rx_status)
1728 struct ieee802_11_elems elems;
1730 ieee80211_bss_info(wpa_s, mgmt, len, rx_status, 1);
1732 if (!wpa_s->mlme.associated ||
1733 os_memcmp(wpa_s->bssid, mgmt->bssid, ETH_ALEN) != 0)
1736 /* Process beacon from the current BSS */
1737 baselen = (u8 *) mgmt->u.beacon.variable - (u8 *) mgmt;
1741 if (ieee802_11_parse_elems(mgmt->u.beacon.variable, len - baselen,
1742 &elems) == ParseFailed)
1746 if (elems.erp_info && elems.erp_info_len >= 1) {
1748 (elems.erp_info[0] & ERP_INFO_USE_PROTECTION) != 0;
1751 if (use_protection != !!wpa_s->mlme.use_protection) {
1752 wpa_printf(MSG_DEBUG, "MLME: CTS protection %s (BSSID=" MACSTR
1754 use_protection ? "enabled" : "disabled",
1755 MAC2STR(wpa_s->bssid));
1756 wpa_s->mlme.use_protection = use_protection ? 1 : 0;
1757 wpa_s->mlme.cts_protect_erp_frames = use_protection;
1760 if (elems.wmm_param && wpa_s->mlme.wmm_enabled) {
1761 ieee80211_sta_wmm_params(wpa_s, elems.wmm_param,
1762 elems.wmm_param_len);
1767 static void ieee80211_rx_mgmt_probe_req(struct wpa_supplicant *wpa_s,
1768 struct ieee80211_mgmt *mgmt,
1770 struct ieee80211_rx_status *rx_status)
1772 int tx_last_beacon, adhoc;
1774 struct ieee80211_mgmt *resp;
1777 struct wpa_ssid *ssid = wpa_s->current_ssid;
1779 adhoc = ssid && ssid->mode == 1;
1781 if (!adhoc || wpa_s->mlme.state != IEEE80211_IBSS_JOINED ||
1782 len < 24 + 2 || wpa_s->mlme.probe_resp == NULL)
1786 if (local->hw->tx_last_beacon)
1787 tx_last_beacon = local->hw->tx_last_beacon(local->mdev);
1792 #ifdef IEEE80211_IBSS_DEBUG
1793 wpa_printf(MSG_DEBUG, "MLME: RX ProbeReq SA=" MACSTR " DA=" MACSTR
1794 " BSSID=" MACSTR " (tx_last_beacon=%d)",
1795 MAC2STR(mgmt->sa), MAC2STR(mgmt->da),
1796 MAC2STR(mgmt->bssid), tx_last_beacon);
1797 #endif /* IEEE80211_IBSS_DEBUG */
1799 if (!tx_last_beacon)
1802 if (os_memcmp(mgmt->bssid, wpa_s->bssid, ETH_ALEN) != 0 &&
1803 os_memcmp(mgmt->bssid, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1806 end = ((u8 *) mgmt) + len;
1807 pos = mgmt->u.probe_req.variable;
1808 if (pos[0] != WLAN_EID_SSID ||
1809 pos + 2 + pos[1] > end) {
1810 wpa_printf(MSG_DEBUG, "MLME: Invalid SSID IE in ProbeReq from "
1811 MACSTR, MAC2STR(mgmt->sa));
1815 (pos[1] != wpa_s->mlme.ssid_len ||
1816 os_memcmp(pos + 2, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len) != 0))
1818 /* Ignore ProbeReq for foreign SSID */
1823 /* Reply with ProbeResp */
1824 skb = skb_copy(wpa_s->mlme.probe_resp, GFP_ATOMIC);
1828 resp = (struct ieee80211_mgmt *) skb->data;
1829 os_memcpy(resp->da, mgmt->sa, ETH_ALEN);
1830 #ifdef IEEE80211_IBSS_DEBUG
1831 wpa_printf(MSG_DEBUG, "MLME: Sending ProbeResp to " MACSTR,
1833 #endif /* IEEE80211_IBSS_DEBUG */
1834 ieee80211_sta_tx(wpa_s, skb, 0, 1);
1839 #ifdef CONFIG_IEEE80211R
1840 static void ieee80211_rx_mgmt_ft_action(struct wpa_supplicant *wpa_s,
1841 struct ieee80211_mgmt *mgmt,
1843 struct ieee80211_rx_status *rx_status)
1845 union wpa_event_data data;
1847 u8 *sta_addr, *target_ap_addr;
1849 if (len < 24 + 1 + sizeof(mgmt->u.action.u.ft_action_resp)) {
1850 wpa_printf(MSG_DEBUG, "MLME: Too short FT Action frame");
1855 * Only FT Action Response is needed for now since reservation
1856 * protocol is not supported.
1858 if (mgmt->u.action.u.ft_action_resp.action != 2) {
1859 wpa_printf(MSG_DEBUG, "MLME: Unexpected FT Action %d",
1860 mgmt->u.action.u.ft_action_resp.action);
1864 status = le_to_host16(mgmt->u.action.u.ft_action_resp.status_code);
1865 sta_addr = mgmt->u.action.u.ft_action_resp.sta_addr;
1866 target_ap_addr = mgmt->u.action.u.ft_action_resp.target_ap_addr;
1867 wpa_printf(MSG_DEBUG, "MLME: Received FT Action Response: STA " MACSTR
1868 " TargetAP " MACSTR " Status Code %d",
1869 MAC2STR(sta_addr), MAC2STR(target_ap_addr), status);
1870 if (os_memcmp(sta_addr, wpa_s->own_addr, ETH_ALEN) != 0) {
1871 wpa_printf(MSG_DEBUG, "MLME: Foreign STA Address " MACSTR
1872 " in FT Action Response", MAC2STR(sta_addr));
1878 wpa_printf(MSG_DEBUG, "MLME: FT Action Response indicates "
1879 "failure (status code %d)", status);
1880 /* TODO: report error to FT code(?) */
1884 os_memset(&data, 0, sizeof(data));
1885 data.ft_ies.ies = mgmt->u.action.u.ft_action_resp.variable;
1886 data.ft_ies.ies_len = len - (mgmt->u.action.u.ft_action_resp.variable -
1888 data.ft_ies.ft_action = 1;
1889 os_memcpy(data.ft_ies.target_ap, target_ap_addr, ETH_ALEN);
1890 wpa_supplicant_event(wpa_s, EVENT_FT_RESPONSE, &data);
1891 /* TODO: should only re-associate, if EVENT_FT_RESPONSE was processed
1893 wpa_s->mlme.prev_bssid_set = 1;
1894 wpa_s->mlme.auth_alg = WLAN_AUTH_FT;
1895 os_memcpy(wpa_s->mlme.prev_bssid, wpa_s->bssid, ETH_ALEN);
1896 os_memcpy(wpa_s->bssid, target_ap_addr, ETH_ALEN);
1897 ieee80211_associate(wpa_s);
1899 #endif /* CONFIG_IEEE80211R */
1902 #ifdef CONFIG_IEEE80211W
1904 /* MLME-PING.response */
1905 static int ieee80211_sta_send_ping_resp(struct wpa_supplicant *wpa_s,
1906 const u8 *addr, const u8 *trans_id)
1908 struct ieee80211_mgmt *mgmt;
1912 mgmt = os_zalloc(sizeof(*mgmt));
1914 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
1915 "ping action frame");
1920 os_memcpy(mgmt->da, addr, ETH_ALEN);
1921 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
1922 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
1923 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1924 WLAN_FC_STYPE_ACTION);
1925 mgmt->u.action.category = WLAN_ACTION_PING;
1926 mgmt->u.action.u.ping_resp.action = WLAN_PING_RESPONSE;
1927 os_memcpy(mgmt->u.action.u.ping_resp.trans_id, trans_id,
1928 WLAN_PING_TRANS_ID_LEN);
1929 len += 1 + sizeof(mgmt->u.action.u.ping_resp);
1931 res = ieee80211_sta_tx(wpa_s, (u8 *) mgmt, len);
1938 static void ieee80211_rx_mgmt_ping_action(
1939 struct wpa_supplicant *wpa_s, struct ieee80211_mgmt *mgmt, size_t len,
1940 struct ieee80211_rx_status *rx_status)
1942 if (len < 24 + 1 + sizeof(mgmt->u.action.u.ping_req)) {
1943 wpa_printf(MSG_DEBUG, "MLME: Too short Ping Action frame");
1947 if (mgmt->u.action.u.ping_req.action != WLAN_PING_REQUEST) {
1948 wpa_printf(MSG_DEBUG, "MLME: Unexpected Ping Action %d",
1949 mgmt->u.action.u.ping_req.action);
1953 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0) {
1954 wpa_printf(MSG_DEBUG, "MLME: Ignore ping from unknown source "
1955 MACSTR, MAC2STR(mgmt->sa));
1959 if (wpa_s->mlme.state == IEEE80211_ASSOCIATE) {
1960 wpa_printf(MSG_DEBUG, "MLME: Ignore ping request during "
1961 "association process");
1965 wpa_printf(MSG_DEBUG, "MLME: Replying to ping request");
1966 ieee80211_sta_send_ping_resp(wpa_s, mgmt->sa,
1967 mgmt->u.action.u.ping_req.trans_id);
1970 #endif /* CONFIG_IEEE80211W */
1973 static void ieee80211_rx_mgmt_action(struct wpa_supplicant *wpa_s,
1974 struct ieee80211_mgmt *mgmt,
1976 struct ieee80211_rx_status *rx_status)
1978 wpa_printf(MSG_DEBUG, "MLME: received Action frame");
1983 switch (mgmt->u.action.category) {
1984 #ifdef CONFIG_IEEE80211R
1985 case WLAN_ACTION_FT:
1986 ieee80211_rx_mgmt_ft_action(wpa_s, mgmt, len, rx_status);
1988 #endif /* CONFIG_IEEE80211R */
1989 #ifdef CONFIG_IEEE80211W
1990 case WLAN_ACTION_PING:
1991 ieee80211_rx_mgmt_ping_action(wpa_s, mgmt, len, rx_status);
1993 #endif /* CONFIG_IEEE80211W */
1995 wpa_printf(MSG_DEBUG, "MLME: unknown Action Category %d",
1996 mgmt->u.action.category);
2002 static void ieee80211_sta_rx_mgmt(struct wpa_supplicant *wpa_s,
2003 const u8 *buf, size_t len,
2004 struct ieee80211_rx_status *rx_status)
2006 struct ieee80211_mgmt *mgmt;
2012 mgmt = (struct ieee80211_mgmt *) buf;
2013 fc = le_to_host16(mgmt->frame_control);
2015 switch (WLAN_FC_GET_STYPE(fc)) {
2016 case WLAN_FC_STYPE_PROBE_REQ:
2017 ieee80211_rx_mgmt_probe_req(wpa_s, mgmt, len, rx_status);
2019 case WLAN_FC_STYPE_PROBE_RESP:
2020 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt, len, rx_status);
2022 case WLAN_FC_STYPE_BEACON:
2023 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2025 case WLAN_FC_STYPE_AUTH:
2026 ieee80211_rx_mgmt_auth(wpa_s, mgmt, len, rx_status);
2028 case WLAN_FC_STYPE_ASSOC_RESP:
2029 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 0);
2031 case WLAN_FC_STYPE_REASSOC_RESP:
2032 ieee80211_rx_mgmt_assoc_resp(wpa_s, mgmt, len, rx_status, 1);
2034 case WLAN_FC_STYPE_DEAUTH:
2035 ieee80211_rx_mgmt_deauth(wpa_s, mgmt, len, rx_status);
2037 case WLAN_FC_STYPE_DISASSOC:
2038 ieee80211_rx_mgmt_disassoc(wpa_s, mgmt, len, rx_status);
2040 case WLAN_FC_STYPE_ACTION:
2041 ieee80211_rx_mgmt_action(wpa_s, mgmt, len, rx_status);
2044 wpa_printf(MSG_DEBUG, "MLME: received unknown management "
2045 "frame - stype=%d", WLAN_FC_GET_STYPE(fc));
2051 static void ieee80211_sta_rx_scan(struct wpa_supplicant *wpa_s,
2052 const u8 *buf, size_t len,
2053 struct ieee80211_rx_status *rx_status)
2055 struct ieee80211_mgmt *mgmt;
2061 mgmt = (struct ieee80211_mgmt *) buf;
2062 fc = le_to_host16(mgmt->frame_control);
2064 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT) {
2065 if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_PROBE_RESP) {
2066 ieee80211_rx_mgmt_probe_resp(wpa_s, mgmt,
2068 } else if (WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_BEACON) {
2069 ieee80211_rx_mgmt_beacon(wpa_s, mgmt, len, rx_status);
2075 static int ieee80211_sta_active_ibss(struct wpa_supplicant *wpa_s)
2080 list_for_each(ptr, &local->sta_list) {
2081 sta = list_entry(ptr, struct sta_info, list);
2082 if (sta->dev == dev &&
2083 time_after(sta->last_rx + IEEE80211_IBSS_MERGE_INTERVAL,
2095 static void ieee80211_sta_expire(struct wpa_supplicant *wpa_s)
2098 list_for_each_safe(ptr, n, &local->sta_list) {
2099 sta = list_entry(ptr, struct sta_info, list);
2100 if (time_after(jiffies, sta->last_rx +
2101 IEEE80211_IBSS_INACTIVITY_LIMIT)) {
2102 wpa_printf(MSG_DEBUG, "MLME: expiring inactive STA "
2103 MACSTR, MAC2STR(sta->addr));
2104 sta_info_free(local, sta, 1);
2111 static void ieee80211_sta_merge_ibss(struct wpa_supplicant *wpa_s)
2113 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2115 ieee80211_sta_expire(wpa_s);
2116 if (ieee80211_sta_active_ibss(wpa_s))
2119 wpa_printf(MSG_DEBUG, "MLME: No active IBSS STAs - trying to scan for "
2120 "other IBSS networks with same SSID (merge)");
2121 ieee80211_sta_req_scan(wpa_s, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2125 static void ieee80211_sta_timer(void *eloop_ctx, void *timeout_ctx)
2127 struct wpa_supplicant *wpa_s = eloop_ctx;
2129 switch (wpa_s->mlme.state) {
2130 case IEEE80211_DISABLED:
2132 case IEEE80211_AUTHENTICATE:
2133 ieee80211_authenticate(wpa_s);
2135 case IEEE80211_ASSOCIATE:
2136 ieee80211_associate(wpa_s);
2138 case IEEE80211_ASSOCIATED:
2139 ieee80211_associated(wpa_s);
2141 case IEEE80211_IBSS_SEARCH:
2142 ieee80211_sta_find_ibss(wpa_s);
2144 case IEEE80211_IBSS_JOINED:
2145 ieee80211_sta_merge_ibss(wpa_s);
2148 wpa_printf(MSG_DEBUG, "ieee80211_sta_timer: Unknown state %d",
2153 if (ieee80211_privacy_mismatch(wpa_s)) {
2154 wpa_printf(MSG_DEBUG, "MLME: privacy configuration mismatch "
2155 "and mixed-cell disabled - disassociate");
2157 ieee80211_send_disassoc(wpa_s, WLAN_REASON_UNSPECIFIED);
2158 ieee80211_set_associated(wpa_s, 0);
2163 static void ieee80211_sta_new_auth(struct wpa_supplicant *wpa_s)
2165 struct wpa_ssid *ssid = wpa_s->current_ssid;
2166 if (ssid && ssid->mode != 0)
2170 if (local->hw->reset_tsf) {
2171 /* Reset own TSF to allow time synchronization work. */
2172 local->hw->reset_tsf(local->mdev);
2176 wpa_s->mlme.wmm_last_param_set = -1; /* allow any WMM update */
2179 if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_OPEN)
2180 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2181 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_SHARED_KEY)
2182 wpa_s->mlme.auth_alg = WLAN_AUTH_SHARED_KEY;
2183 else if (wpa_s->mlme.auth_algs & IEEE80211_AUTH_ALG_LEAP)
2184 wpa_s->mlme.auth_alg = WLAN_AUTH_LEAP;
2186 wpa_s->mlme.auth_alg = WLAN_AUTH_OPEN;
2187 wpa_printf(MSG_DEBUG, "MLME: Initial auth_alg=%d",
2188 wpa_s->mlme.auth_alg);
2189 wpa_s->mlme.auth_transaction = -1;
2190 wpa_s->mlme.auth_tries = wpa_s->mlme.assoc_tries = 0;
2191 ieee80211_authenticate(wpa_s);
2195 static int ieee80211_ibss_allowed(struct wpa_supplicant *wpa_s)
2200 for (m = 0; m < local->hw->num_modes; m++) {
2201 struct ieee80211_hw_modes *mode = &local->hw->modes[m];
2202 if (mode->mode != local->conf.phymode)
2204 for (c = 0; c < mode->num_channels; c++) {
2205 struct ieee80211_channel *chan = &mode->channels[c];
2206 if (chan->flag & IEEE80211_CHAN_W_SCAN &&
2207 chan->chan == local->conf.channel) {
2208 if (chan->flag & IEEE80211_CHAN_W_IBSS)
2220 static int ieee80211_sta_join_ibss(struct wpa_supplicant *wpa_s,
2221 struct ieee80211_sta_bss *bss)
2223 int res = 0, rates, done = 0;
2224 struct ieee80211_mgmt *mgmt;
2226 struct ieee80211_tx_control control;
2227 struct ieee80211_rate *rate;
2228 struct rate_control_extra extra;
2233 /* Remove possible STA entries from other IBSS networks. */
2235 sta_info_flush(local, NULL);
2237 if (local->hw->reset_tsf) {
2238 /* Reset own TSF to allow time synchronization work. */
2239 local->hw->reset_tsf(local->mdev);
2242 os_memcpy(wpa_s->bssid, bss->bssid, ETH_ALEN);
2245 local->conf.beacon_int = bss->beacon_int >= 10 ? bss->beacon_int : 10;
2247 sdata->drop_unencrypted = bss->capability &
2248 host_to_le16(WLAN_CAPABILITY_PRIVACY) ? 1 : 0;
2252 os_memset(&rq, 0, sizeof(rq));
2253 rq.m = bss->freq * 100000;
2255 res = ieee80211_ioctl_siwfreq(wpa_s, NULL, &rq, NULL);
2258 if (!ieee80211_ibss_allowed(wpa_s)) {
2260 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed on channel %d "
2261 "(%d MHz)", local->conf.channel,
2267 /* Set beacon template based on scan results */
2268 buf = os_malloc(400);
2274 mgmt = (struct ieee80211_mgmt *) buf;
2275 len += 24 + sizeof(mgmt->u.beacon);
2276 os_memset(mgmt, 0, 24 + sizeof(mgmt->u.beacon));
2277 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2278 WLAN_FC_STYPE_BEACON);
2279 os_memset(mgmt->da, 0xff, ETH_ALEN);
2280 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
2281 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
2283 mgmt->u.beacon.beacon_int =
2284 host_to_le16(local->conf.beacon_int);
2286 mgmt->u.beacon.capab_info = host_to_le16(bss->capability);
2289 len += 2 + wpa_s->mlme.ssid_len;
2290 *pos++ = WLAN_EID_SSID;
2291 *pos++ = wpa_s->mlme.ssid_len;
2292 os_memcpy(pos, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2294 rates = bss->supp_rates_len;
2299 *pos++ = WLAN_EID_SUPP_RATES;
2301 os_memcpy(pos, bss->supp_rates, rates);
2305 *pos++ = WLAN_EID_DS_PARAMS;
2307 *pos++ = bss->channel;
2311 *pos++ = WLAN_EID_IBSS_PARAMS;
2313 /* FIX: set ATIM window based on scan results */
2317 if (bss->supp_rates_len > 8) {
2318 rates = bss->supp_rates_len - 8;
2321 *pos++ = WLAN_EID_EXT_SUPP_RATES;
2323 os_memcpy(pos, &bss->supp_rates[8], rates);
2327 os_memset(&control, 0, sizeof(control));
2328 control.pkt_type = PKT_PROBE_RESP;
2329 os_memset(&extra, 0, sizeof(extra));
2330 extra.endidx = local->num_curr_rates;
2331 rate = rate_control_get_rate(wpa_s, skb, &extra);
2333 wpa_printf(MSG_DEBUG, "MLME: Failed to determine TX "
2334 "rate for IBSS beacon");
2337 control.tx_rate = (wpa_s->mlme.short_preamble &&
2338 (rate->flags & IEEE80211_RATE_PREAMBLE2)) ?
2339 rate->val2 : rate->val;
2340 control.antenna_sel = local->conf.antenna_sel;
2341 control.power_level = local->conf.power_level;
2343 control.retry_limit = 1;
2344 control.rts_cts_duration = 0;
2348 wpa_s->mlme.probe_resp = skb_copy(skb, GFP_ATOMIC);
2349 if (wpa_s->mlme.probe_resp) {
2350 mgmt = (struct ieee80211_mgmt *)
2351 wpa_s->mlme.probe_resp->data;
2352 mgmt->frame_control =
2353 IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2354 WLAN_FC_STYPE_PROBE_RESP);
2356 wpa_printf(MSG_DEBUG, "MLME: Could not allocate "
2357 "ProbeResp template for IBSS");
2360 if (local->hw->beacon_update &&
2361 local->hw->beacon_update(wpa_s, skb, &control) == 0) {
2362 wpa_printf(MSG_DEBUG, "MLME: Configured IBSS beacon "
2363 "template based on scan results");
2368 for (i = 0; i < bss->supp_rates_len; i++) {
2369 int rate = (bss->supp_rates[i] & 0x7f) * 5;
2370 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2372 for (j = 0; j < local->num_curr_rates; j++)
2373 if (local->curr_rates[j].rate == rate)
2376 wpa_s->mlme.supp_rates_bits = rates;
2383 wpa_printf(MSG_DEBUG, "MLME: Failed to configure IBSS beacon "
2387 wpa_s->mlme.state = IEEE80211_IBSS_JOINED;
2388 ieee80211_reschedule_timer(wpa_s, IEEE80211_IBSS_MERGE_INTERVAL);
2395 static int ieee80211_sta_create_ibss(struct wpa_supplicant *wpa_s)
2397 struct ieee80211_sta_bss *bss;
2398 u8 bssid[ETH_ALEN], *pos;
2402 /* Easier testing, use fixed BSSID. */
2403 os_memset(bssid, 0xfe, ETH_ALEN);
2405 /* Generate random, not broadcast, locally administered BSSID. Mix in
2406 * own MAC address to make sure that devices that do not have proper
2407 * random number generator get different BSSID. */
2408 os_get_random(bssid, ETH_ALEN);
2409 for (i = 0; i < ETH_ALEN; i++)
2410 bssid[i] ^= wpa_s->own_addr[i];
2415 wpa_printf(MSG_DEBUG, "MLME: Creating new IBSS network, BSSID "
2416 MACSTR "", MAC2STR(bssid));
2418 bss = ieee80211_bss_add(wpa_s, bssid);
2423 if (local->conf.beacon_int == 0)
2424 local->conf.beacon_int = 100;
2425 bss->beacon_int = local->conf.beacon_int;
2426 bss->hw_mode = local->conf.phymode;
2427 bss->channel = local->conf.channel;
2428 bss->freq = local->conf.freq;
2430 os_get_time(&bss->last_update);
2431 bss->capability = host_to_le16(WLAN_CAPABILITY_IBSS);
2433 if (sdata->default_key) {
2434 bss->capability |= host_to_le16(WLAN_CAPABILITY_PRIVACY);
2436 sdata->drop_unencrypted = 0;
2437 bss->supp_rates_len = local->num_curr_rates;
2439 pos = bss->supp_rates;
2441 for (i = 0; i < local->num_curr_rates; i++) {
2442 int rate = local->curr_rates[i].rate;
2443 if (local->conf.phymode == MODE_ATHEROS_TURBO)
2445 *pos++ = (u8) (rate / 5);
2449 return ieee80211_sta_join_ibss(wpa_s, bss);
2454 static int ieee80211_sta_find_ibss(struct wpa_supplicant *wpa_s)
2456 struct ieee80211_sta_bss *bss;
2462 if (wpa_s->mlme.ssid_len == 0)
2465 active_ibss = ieee80211_sta_active_ibss(wpa_s);
2466 #ifdef IEEE80211_IBSS_DEBUG
2467 wpa_printf(MSG_DEBUG, "MLME: sta_find_ibss (active_ibss=%d)",
2469 #endif /* IEEE80211_IBSS_DEBUG */
2470 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2471 if (wpa_s->mlme.ssid_len != bss->ssid_len ||
2472 os_memcmp(wpa_s->mlme.ssid, bss->ssid, bss->ssid_len) != 0
2473 || !(bss->capability & WLAN_CAPABILITY_IBSS))
2475 #ifdef IEEE80211_IBSS_DEBUG
2476 wpa_printf(MSG_DEBUG, " bssid=" MACSTR " found",
2477 MAC2STR(bss->bssid));
2478 #endif /* IEEE80211_IBSS_DEBUG */
2479 os_memcpy(bssid, bss->bssid, ETH_ALEN);
2482 os_memcmp(bssid, wpa_s->bssid, ETH_ALEN) != 0)
2486 #ifdef IEEE80211_IBSS_DEBUG
2487 wpa_printf(MSG_DEBUG, " sta_find_ibss: selected " MACSTR " current "
2488 MACSTR, MAC2STR(bssid), MAC2STR(wpa_s->bssid));
2489 #endif /* IEEE80211_IBSS_DEBUG */
2490 if (found && os_memcmp(wpa_s->bssid, bssid, ETH_ALEN) != 0 &&
2491 (bss = ieee80211_bss_get(wpa_s, bssid))) {
2492 wpa_printf(MSG_DEBUG, "MLME: Selected IBSS BSSID " MACSTR
2493 " based on configured SSID",
2495 return ieee80211_sta_join_ibss(wpa_s, bss);
2497 #ifdef IEEE80211_IBSS_DEBUG
2498 wpa_printf(MSG_DEBUG, " did not try to join ibss");
2499 #endif /* IEEE80211_IBSS_DEBUG */
2501 /* Selected IBSS not found in current scan results - try to scan */
2504 if (wpa_s->mlme.state == IEEE80211_IBSS_JOINED &&
2505 !ieee80211_sta_active_ibss(wpa_s)) {
2506 ieee80211_reschedule_timer(wpa_s,
2507 IEEE80211_IBSS_MERGE_INTERVAL);
2508 } else if (time_after(jiffies, wpa_s->mlme.last_scan_completed +
2509 IEEE80211_SCAN_INTERVAL)) {
2510 wpa_printf(MSG_DEBUG, "MLME: Trigger new scan to find an IBSS "
2512 return ieee80211_sta_req_scan(wpa_s->mlme.ssid,
2513 wpa_s->mlme.ssid_len);
2514 } else if (wpa_s->mlme.state != IEEE80211_IBSS_JOINED) {
2515 int interval = IEEE80211_SCAN_INTERVAL;
2517 if (time_after(jiffies, wpa_s->mlme.ibss_join_req +
2518 IEEE80211_IBSS_JOIN_TIMEOUT)) {
2519 if (wpa_s->mlme.create_ibss &&
2520 ieee80211_ibss_allowed(wpa_s))
2521 return ieee80211_sta_create_ibss(wpa_s);
2522 if (wpa_s->mlme.create_ibss) {
2523 wpa_printf(MSG_DEBUG, "MLME: IBSS not allowed "
2524 "on the configured channel %d "
2526 local->conf.channel,
2530 /* No IBSS found - decrease scan interval and continue
2532 interval = IEEE80211_SCAN_INTERVAL_SLOW;
2535 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2536 ieee80211_reschedule_timer(wpa_s, interval);
2545 int ieee80211_sta_get_ssid(struct wpa_supplicant *wpa_s, u8 *ssid,
2548 os_memcpy(ssid, wpa_s->mlme.ssid, wpa_s->mlme.ssid_len);
2549 *len = wpa_s->mlme.ssid_len;
2554 int ieee80211_sta_associate(struct wpa_supplicant *wpa_s,
2555 struct wpa_driver_associate_params *params)
2557 struct ieee80211_sta_bss *bss;
2559 wpa_s->mlme.bssid_set = 0;
2560 wpa_s->mlme.freq = params->freq;
2561 if (params->bssid) {
2562 os_memcpy(wpa_s->bssid, params->bssid, ETH_ALEN);
2563 if (!is_zero_ether_addr(params->bssid))
2564 wpa_s->mlme.bssid_set = 1;
2565 bss = ieee80211_bss_get(wpa_s, wpa_s->bssid);
2567 wpa_s->mlme.phymode = bss->hw_mode;
2568 wpa_s->mlme.channel = bss->channel;
2569 wpa_s->mlme.freq = bss->freq;
2574 /* TODO: This should always be done for IBSS, even if IEEE80211_QOS is
2576 if (local->hw->conf_tx) {
2577 struct ieee80211_tx_queue_params qparam;
2580 os_memset(&qparam, 0, sizeof(qparam));
2581 /* TODO: are these ok defaults for all hw_modes? */
2584 local->conf.phymode == MODE_IEEE80211B ? 31 : 15;
2585 qparam.cw_max = 1023;
2586 qparam.burst_time = 0;
2587 for (i = IEEE80211_TX_QUEUE_DATA0; i < NUM_TX_DATA_QUEUES; i++)
2589 local->hw->conf_tx(wpa_s, i + IEEE80211_TX_QUEUE_DATA0,
2592 /* IBSS uses different parameters for Beacon sending */
2596 local->hw->conf_tx(wpa_s, IEEE80211_TX_QUEUE_BEACON, &qparam);
2600 if (wpa_s->mlme.ssid_len != params->ssid_len ||
2601 os_memcmp(wpa_s->mlme.ssid, params->ssid, params->ssid_len) != 0)
2602 wpa_s->mlme.prev_bssid_set = 0;
2603 os_memcpy(wpa_s->mlme.ssid, params->ssid, params->ssid_len);
2604 os_memset(wpa_s->mlme.ssid + params->ssid_len, 0,
2605 MAX_SSID_LEN - params->ssid_len);
2606 wpa_s->mlme.ssid_len = params->ssid_len;
2607 wpa_s->mlme.ssid_set = 1;
2609 os_free(wpa_s->mlme.extra_ie);
2610 if (params->wpa_ie == NULL || params->wpa_ie_len == 0) {
2611 wpa_s->mlme.extra_ie = NULL;
2612 wpa_s->mlme.extra_ie_len = 0;
2614 wpa_s->mlme.extra_ie = os_malloc(params->wpa_ie_len);
2615 if (wpa_s->mlme.extra_ie == NULL) {
2616 wpa_s->mlme.extra_ie_len = 0;
2619 os_memcpy(wpa_s->mlme.extra_ie, params->wpa_ie,
2620 params->wpa_ie_len);
2621 wpa_s->mlme.extra_ie_len = params->wpa_ie_len;
2624 wpa_s->mlme.key_mgmt = params->key_mgmt_suite;
2626 ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2627 wpa_s->mlme.channel, wpa_s->mlme.freq);
2629 if (params->mode == 1 && !wpa_s->mlme.bssid_set) {
2630 os_get_time(&wpa_s->mlme.ibss_join_req);
2631 wpa_s->mlme.state = IEEE80211_IBSS_SEARCH;
2632 return ieee80211_sta_find_ibss(wpa_s);
2635 if (wpa_s->mlme.bssid_set)
2636 ieee80211_sta_new_auth(wpa_s);
2642 static void ieee80211_sta_save_oper_chan(struct wpa_supplicant *wpa_s)
2644 wpa_s->mlme.scan_oper_channel = wpa_s->mlme.channel;
2645 wpa_s->mlme.scan_oper_freq = wpa_s->mlme.freq;
2646 wpa_s->mlme.scan_oper_phymode = wpa_s->mlme.phymode;
2650 static int ieee80211_sta_restore_oper_chan(struct wpa_supplicant *wpa_s)
2652 wpa_s->mlme.channel = wpa_s->mlme.scan_oper_channel;
2653 wpa_s->mlme.freq = wpa_s->mlme.scan_oper_freq;
2654 wpa_s->mlme.phymode = wpa_s->mlme.scan_oper_phymode;
2655 if (wpa_s->mlme.freq == 0)
2657 return ieee80211_sta_set_channel(wpa_s, wpa_s->mlme.phymode,
2658 wpa_s->mlme.channel,
2663 static int ieee80211_active_scan(struct wpa_supplicant *wpa_s)
2668 for (m = 0; m < wpa_s->mlme.num_modes; m++) {
2669 struct wpa_hw_modes *mode = &wpa_s->mlme.modes[m];
2670 if ((int) mode->mode != (int) wpa_s->mlme.phymode)
2672 for (c = 0; c < mode->num_channels; c++) {
2673 struct wpa_channel_data *chan = &mode->channels[c];
2674 if (chan->flag & WPA_CHAN_W_SCAN &&
2675 chan->chan == wpa_s->mlme.channel) {
2676 if (chan->flag & WPA_CHAN_W_ACTIVE_SCAN)
2687 static void ieee80211_sta_scan_timer(void *eloop_ctx, void *timeout_ctx)
2689 struct wpa_supplicant *wpa_s = eloop_ctx;
2690 struct wpa_hw_modes *mode;
2691 struct wpa_channel_data *chan;
2694 struct wpa_ssid *ssid = wpa_s->current_ssid;
2697 if (!wpa_s->mlme.sta_scanning || wpa_s->mlme.modes == NULL)
2700 adhoc = ssid && ssid->mode == 1;
2702 switch (wpa_s->mlme.scan_state) {
2703 case SCAN_SET_CHANNEL:
2704 mode = &wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx];
2705 if (wpa_s->mlme.scan_hw_mode_idx >=
2706 (int) wpa_s->mlme.num_modes ||
2707 (wpa_s->mlme.scan_hw_mode_idx + 1 ==
2708 (int) wpa_s->mlme.num_modes
2709 && wpa_s->mlme.scan_channel_idx >= mode->num_channels)) {
2710 if (ieee80211_sta_restore_oper_chan(wpa_s)) {
2711 wpa_printf(MSG_DEBUG, "MLME: failed to "
2712 "restore operational channel after "
2715 wpa_printf(MSG_DEBUG, "MLME: scan completed");
2716 wpa_s->mlme.sta_scanning = 0;
2717 os_get_time(&wpa_s->mlme.last_scan_completed);
2718 wpa_supplicant_event(wpa_s, EVENT_SCAN_RESULTS, NULL);
2720 if (!wpa_s->mlme.bssid_set ||
2721 (wpa_s->mlme.state ==
2722 IEEE80211_IBSS_JOINED &&
2723 !ieee80211_sta_active_ibss(wpa_s)))
2724 ieee80211_sta_find_ibss(wpa_s);
2728 skip = !(wpa_s->mlme.hw_modes & (1 << mode->mode));
2729 chan = &mode->channels[wpa_s->mlme.scan_channel_idx];
2730 if (!(chan->flag & WPA_CHAN_W_SCAN) ||
2731 (adhoc && !(chan->flag & WPA_CHAN_W_IBSS)) ||
2732 (wpa_s->mlme.hw_modes & (1 << WPA_MODE_IEEE80211G) &&
2733 mode->mode == WPA_MODE_IEEE80211B &&
2734 wpa_s->mlme.scan_skip_11b))
2738 wpa_printf(MSG_MSGDUMP,
2739 "MLME: scan channel %d (%d MHz)",
2740 chan->chan, chan->freq);
2742 wpa_s->mlme.channel = chan->chan;
2743 wpa_s->mlme.freq = chan->freq;
2744 wpa_s->mlme.phymode = mode->mode;
2745 if (ieee80211_sta_set_channel(wpa_s, mode->mode,
2746 chan->chan, chan->freq))
2748 wpa_printf(MSG_DEBUG, "MLME: failed to set "
2749 "channel %d (%d MHz) for scan",
2750 chan->chan, chan->freq);
2755 wpa_s->mlme.scan_channel_idx++;
2756 if (wpa_s->mlme.scan_channel_idx >=
2757 wpa_s->mlme.modes[wpa_s->mlme.scan_hw_mode_idx].
2759 wpa_s->mlme.scan_hw_mode_idx++;
2760 wpa_s->mlme.scan_channel_idx = 0;
2768 timeout = IEEE80211_PROBE_DELAY;
2769 wpa_s->mlme.scan_state = SCAN_SEND_PROBE;
2771 case SCAN_SEND_PROBE:
2772 if (ieee80211_active_scan(wpa_s)) {
2773 ieee80211_send_probe_req(wpa_s, NULL,
2774 wpa_s->mlme.scan_ssid,
2775 wpa_s->mlme.scan_ssid_len);
2776 timeout = IEEE80211_CHANNEL_TIME;
2778 timeout = IEEE80211_PASSIVE_CHANNEL_TIME;
2780 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2784 eloop_register_timeout(timeout / 1000, 1000 * (timeout % 1000),
2785 ieee80211_sta_scan_timer, wpa_s, NULL);
2789 int ieee80211_sta_req_scan(struct wpa_supplicant *wpa_s, const u8 *ssid,
2792 if (ssid_len > MAX_SSID_LEN)
2795 /* MLME-SCAN.request (page 118) page 144 (11.1.3.1)
2796 * BSSType: INFRASTRUCTURE, INDEPENDENT, ANY_BSS
2799 * ScanType: ACTIVE, PASSIVE
2800 * ProbeDelay: delay (in microseconds) to be used prior to transmitting
2801 * a Probe frame during active scanning
2803 * MinChannelTime (>= ProbeDelay), in TU
2804 * MaxChannelTime: (>= MinChannelTime), in TU
2807 /* MLME-SCAN.confirm
2809 * ResultCode: SUCCESS, INVALID_PARAMETERS
2812 /* TODO: if assoc, move to power save mode for the duration of the
2815 if (wpa_s->mlme.sta_scanning)
2818 wpa_printf(MSG_DEBUG, "MLME: starting scan");
2820 ieee80211_sta_save_oper_chan(wpa_s);
2822 wpa_s->mlme.sta_scanning = 1;
2823 /* TODO: stop TX queue? */
2826 wpa_s->mlme.scan_ssid_len = ssid_len;
2827 os_memcpy(wpa_s->mlme.scan_ssid, ssid, ssid_len);
2829 wpa_s->mlme.scan_ssid_len = 0;
2830 wpa_s->mlme.scan_skip_11b = 1; /* FIX: clear this is 11g is not
2832 wpa_s->mlme.scan_state = SCAN_SET_CHANNEL;
2833 wpa_s->mlme.scan_hw_mode_idx = 0;
2834 wpa_s->mlme.scan_channel_idx = 0;
2835 eloop_register_timeout(0, 1, ieee80211_sta_scan_timer, wpa_s, NULL);
2841 struct wpa_scan_results *
2842 ieee80211_sta_get_scan_results(struct wpa_supplicant *wpa_s)
2845 struct wpa_scan_results *res;
2846 struct wpa_scan_res *r;
2847 struct ieee80211_sta_bss *bss;
2849 res = os_zalloc(sizeof(*res));
2850 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next)
2852 res->res = os_zalloc(ap_num * sizeof(struct wpa_scan_res *));
2853 if (res->res == NULL) {
2858 for (bss = wpa_s->mlme.sta_bss_list; bss; bss = bss->next) {
2859 r = os_zalloc(sizeof(*r) + bss->ie_len);
2862 os_memcpy(r->bssid, bss->bssid, ETH_ALEN);
2863 r->freq = bss->freq;
2864 r->beacon_int = bss->beacon_int;
2865 r->caps = bss->capability;
2866 r->level = bss->rssi;
2867 r->tsf = bss->timestamp;
2869 r->ie_len = bss->ie_len;
2870 os_memcpy(r + 1, bss->ie, bss->ie_len);
2873 res->res[res->num++] = r;
2881 struct sta_info * ieee80211_ibss_add_sta(struct wpa_supplicant *wpa_s,
2882 struct sk_buff *skb, u8 *bssid,
2885 struct ieee80211_local *local = dev->priv;
2886 struct list_head *ptr;
2887 struct sta_info *sta;
2888 struct wpa_supplicant *sta_dev = NULL;
2890 /* TODO: Could consider removing the least recently used entry and
2891 * allow new one to be added. */
2892 if (local->num_sta >= IEEE80211_IBSS_MAX_STA_ENTRIES) {
2893 if (net_ratelimit()) {
2894 wpa_printf(MSG_DEBUG, "MLME: No room for a new IBSS "
2895 "STA entry " MACSTR, MAC2STR(addr));
2900 spin_lock_bh(&local->sub_if_lock);
2901 list_for_each(ptr, &local->sub_if_list) {
2902 sdata = list_entry(ptr, struct ieee80211_sub_if_data, list);
2903 if (sdata->type == IEEE80211_SUB_IF_TYPE_STA &&
2904 os_memcmp(bssid, sdata->u.sta.bssid, ETH_ALEN) == 0) {
2905 sta_dev = sdata->dev;
2909 spin_unlock_bh(&local->sub_if_lock);
2911 if (sta_dev == NULL)
2914 wpa_printf(MSG_DEBUG, "MLME: Adding new IBSS station " MACSTR
2915 " (dev=%s)", MAC2STR(addr), sta_dev->name);
2917 sta = sta_info_add(wpa_s, addr);
2923 sta->supp_rates = wpa_s->mlme.supp_rates_bits;
2925 rate_control_rate_init(local, sta);
2927 return sta; /* caller will call sta_info_release() */
2932 int ieee80211_sta_deauthenticate(struct wpa_supplicant *wpa_s, u16 reason)
2934 wpa_printf(MSG_DEBUG, "MLME: deauthenticate(reason=%d)", reason);
2936 ieee80211_send_deauth(wpa_s, reason);
2937 ieee80211_set_associated(wpa_s, 0);
2942 int ieee80211_sta_disassociate(struct wpa_supplicant *wpa_s, u16 reason)
2944 wpa_printf(MSG_DEBUG, "MLME: disassociate(reason=%d)", reason);
2946 if (!wpa_s->mlme.associated)
2949 ieee80211_send_disassoc(wpa_s, reason);
2950 ieee80211_set_associated(wpa_s, 0);
2955 void ieee80211_sta_rx(struct wpa_supplicant *wpa_s, const u8 *buf, size_t len,
2956 struct ieee80211_rx_status *rx_status)
2958 struct ieee80211_mgmt *mgmt;
2962 /* wpa_hexdump(MSG_MSGDUMP, "MLME: Received frame", buf, len); */
2964 if (wpa_s->mlme.sta_scanning) {
2965 ieee80211_sta_rx_scan(wpa_s, buf, len, rx_status);
2972 mgmt = (struct ieee80211_mgmt *) buf;
2973 fc = le_to_host16(mgmt->frame_control);
2975 if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT)
2976 ieee80211_sta_rx_mgmt(wpa_s, buf, len, rx_status);
2977 else if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_DATA) {
2978 if ((fc & (WLAN_FC_TODS | WLAN_FC_FROMDS)) !=
2981 /* mgmt->sa is actually BSSID for FromDS data frames */
2982 if (os_memcmp(mgmt->sa, wpa_s->bssid, ETH_ALEN) != 0)
2984 /* Skip IEEE 802.11 and LLC headers */
2986 if (WPA_GET_BE16(pos) != ETH_P_EAPOL)
2989 /* mgmt->bssid is actually BSSID for SA data frames */
2990 wpa_supplicant_rx_eapol(wpa_s, mgmt->bssid,
2991 pos, buf + len - pos);
2996 void ieee80211_sta_free_hw_features(struct wpa_hw_modes *hw_features,
2997 size_t num_hw_features)
3001 if (hw_features == NULL)
3004 for (i = 0; i < num_hw_features; i++) {
3005 os_free(hw_features[i].channels);
3006 os_free(hw_features[i].rates);
3009 os_free(hw_features);
3013 int ieee80211_sta_init(struct wpa_supplicant *wpa_s)
3015 u16 num_modes, flags;
3017 wpa_s->mlme.modes = wpa_drv_get_hw_feature_data(wpa_s, &num_modes,
3019 if (wpa_s->mlme.modes == NULL) {
3020 wpa_printf(MSG_ERROR, "MLME: Failed to read supported "
3021 "channels and rates from the driver");
3025 wpa_s->mlme.num_modes = num_modes;
3027 wpa_s->mlme.hw_modes = 1 << WPA_MODE_IEEE80211A;
3028 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211B;
3029 wpa_s->mlme.hw_modes |= 1 << WPA_MODE_IEEE80211G;
3035 void ieee80211_sta_deinit(struct wpa_supplicant *wpa_s)
3037 eloop_cancel_timeout(ieee80211_sta_timer, wpa_s, NULL);
3038 eloop_cancel_timeout(ieee80211_sta_scan_timer, wpa_s, NULL);
3039 os_free(wpa_s->mlme.extra_ie);
3040 wpa_s->mlme.extra_ie = NULL;
3041 os_free(wpa_s->mlme.extra_probe_ie);
3042 wpa_s->mlme.extra_probe_ie = NULL;
3043 os_free(wpa_s->mlme.assocreq_ies);
3044 wpa_s->mlme.assocreq_ies = NULL;
3045 os_free(wpa_s->mlme.assocresp_ies);
3046 wpa_s->mlme.assocresp_ies = NULL;
3047 ieee80211_bss_list_deinit(wpa_s);
3048 ieee80211_sta_free_hw_features(wpa_s->mlme.modes,
3049 wpa_s->mlme.num_modes);
3050 #ifdef CONFIG_IEEE80211R
3051 os_free(wpa_s->mlme.ft_ies);
3052 wpa_s->mlme.ft_ies = NULL;
3053 wpa_s->mlme.ft_ies_len = 0;
3054 #endif /* CONFIG_IEEE80211R */
3058 #ifdef CONFIG_IEEE80211R
3060 int ieee80211_sta_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
3061 const u8 *ies, size_t ies_len)
3064 wpa_printf(MSG_DEBUG, "MLME: Clear FT mobility domain");
3065 os_memset(wpa_s->mlme.current_md, 0, MOBILITY_DOMAIN_ID_LEN);
3067 wpa_printf(MSG_DEBUG, "MLME: Update FT IEs for MD " MACSTR,
3069 os_memcpy(wpa_s->mlme.current_md, md, MOBILITY_DOMAIN_ID_LEN);
3072 wpa_hexdump(MSG_DEBUG, "MLME: FT IEs", ies, ies_len);
3073 os_free(wpa_s->mlme.ft_ies);
3074 wpa_s->mlme.ft_ies = os_malloc(ies_len);
3075 if (wpa_s->mlme.ft_ies == NULL)
3077 os_memcpy(wpa_s->mlme.ft_ies, ies, ies_len);
3078 wpa_s->mlme.ft_ies_len = ies_len;
3084 int ieee80211_sta_send_ft_action(struct wpa_supplicant *wpa_s, u8 action,
3085 const u8 *target_ap,
3086 const u8 *ies, size_t ies_len)
3090 struct ieee80211_mgmt *mgmt;
3094 * Action frame payload:
3095 * Category[1] = 6 (Fast BSS Transition)
3096 * Action[1] = 1 (Fast BSS Transition Request)
3102 buf = os_zalloc(sizeof(*mgmt) + ies_len);
3104 wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
3109 mgmt = (struct ieee80211_mgmt *) buf;
3111 os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
3112 os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
3113 os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
3114 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
3115 WLAN_FC_STYPE_ACTION);
3116 mgmt->u.action.category = WLAN_ACTION_FT;
3117 mgmt->u.action.u.ft_action_req.action = action;
3118 os_memcpy(mgmt->u.action.u.ft_action_req.sta_addr, wpa_s->own_addr,
3120 os_memcpy(mgmt->u.action.u.ft_action_req.target_ap_addr, target_ap,
3122 os_memcpy(mgmt->u.action.u.ft_action_req.variable, ies, ies_len);
3123 len += 1 + sizeof(mgmt->u.action.u.ft_action_req) + ies_len;
3125 wpa_printf(MSG_DEBUG, "MLME: Send FT Action Frame: Action=%d "
3126 "Target AP=" MACSTR " body_len=%d",
3127 action, MAC2STR(target_ap), ies_len);
3129 res = ieee80211_sta_tx(wpa_s, buf, len);
3135 #endif /* CONFIG_IEEE80211R */
3138 int ieee80211_sta_set_probe_req_ie(struct wpa_supplicant *wpa_s, const u8 *ies,
3141 os_free(wpa_s->mlme.extra_probe_ie);
3142 wpa_s->mlme.extra_probe_ie = NULL;
3143 wpa_s->mlme.extra_probe_ie_len = 0;
3148 wpa_s->mlme.extra_probe_ie = os_malloc(ies_len);
3149 if (wpa_s->mlme.extra_probe_ie == NULL)
3152 os_memcpy(wpa_s->mlme.extra_probe_ie, ies, ies_len);
3153 wpa_s->mlme.extra_probe_ie_len = ies_len;