git.maemo.org Git - wpasupplicant/blob - hostapd/driver_nl80211.c

   1 /*
   2  * hostapd / Kernel driver communication via nl80211
   3  * Copyright (c) 2002-2007, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 as
  10  * published by the Free Software Foundation.
  11  *
  12  * Alternatively, this software may be distributed under the terms of BSD
  13  * license.
  14  *
  15  * See README and COPYING for more details.
  16  */
  17
  18 #include "includes.h"
  19
  20 #include <sys/ioctl.h>
  21 #include <netlink/genl/genl.h>
  22 #include <netlink/genl/family.h>
  23 #include <netlink/genl/ctrl.h>
  24 #include <netlink/msg.h>
  25 #include <netlink/attr.h>
  26 #include "nl80211_copy.h"
  27 #include <net/if.h>
  28 #include <netpacket/packet.h>
  29 #include "wireless_copy.h"
  30 #include <linux/filter.h>
  31 #include <net/if_arp.h>
  32
  33 #include "hostapd.h"
  34 #include "driver.h"
  35 #include "eloop.h"
  36 #include "hw_features.h"
  37 #include "mlme.h"
  38 #include "radiotap.h"
  39 #include "radiotap_iter.h"
  40 #include "ieee802_11_defs.h"
  41 #include "ieee802_11_common.h"
  42
  43 #ifdef CONFIG_LIBNL20
  44 /* libnl 2.0 compatibility code */
  45 #define nl_handle_alloc_cb nl_socket_alloc_cb
  46 #define nl_handle_destroy nl_socket_free
  47 #endif /* CONFIG_LIBNL20 */
  48
  49 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
  50
  51 enum ieee80211_msg_type {
  52         ieee80211_msg_normal = 0,
  53         ieee80211_msg_tx_callback_ack = 1,
  54         ieee80211_msg_tx_callback_fail = 2,
  55 };
  56
  57 struct i802_driver_data {
  58         struct hostapd_data *hapd;
  59
  60         char iface[IFNAMSIZ + 1];
  61         int bridge;
  62         int ioctl_sock; /* socket for ioctl() use */
  63         int wext_sock; /* socket for wireless events */
  64         int eapol_sock; /* socket for EAPOL frames */
  65         int monitor_sock; /* socket for monitor */
  66         int monitor_ifidx;
  67
  68         int default_if_indices[16];
  69         int *if_indices;
  70         int num_if_indices;
  71
  72         int we_version;
  73         struct nl_handle *nl_handle;
  74         struct nl_cache *nl_cache;
  75         struct nl_cb *nl_cb;
  76         struct genl_family *nl80211;
  77         int dtim_period, beacon_int;
  78         unsigned int beacon_set:1;
  79         unsigned int ieee802_1x_active:1;
  80         unsigned int ht_40mhz_scan:1;
  81
  82         int last_freq;
  83         int last_freq_ht;
  84         struct hostapd_neighbor_bss *neighbors;
  85         size_t num_neighbors;
  86 };
  87
  88
  89 static int i802_sta_deauth(void *priv, const u8 *addr, int reason);
  90 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason);
  91
  92
  93 static void add_ifidx(struct i802_driver_data *drv, int ifidx)
  94 {
  95         int i;
  96         int *old;
  97
  98         for (i = 0; i < drv->num_if_indices; i++) {
  99                 if (drv->if_indices[i] == 0) {
 100                         drv->if_indices[i] = ifidx;
 101                         return;
 102                 }
 103         }
 104
 105         if (drv->if_indices != drv->default_if_indices)
 106                 old = drv->if_indices;
 107         else
 108                 old = NULL;
 109
 110         drv->if_indices = realloc(old,
 111                                   sizeof(int) * (drv->num_if_indices + 1));
 112         if (!drv->if_indices) {
 113                 if (!old)
 114                         drv->if_indices = drv->default_if_indices;
 115                 else
 116                         drv->if_indices = old;
 117                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
 118                            "interfaces");
 119                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
 120                 return;
 121         }
 122         drv->if_indices[drv->num_if_indices] = ifidx;
 123         drv->num_if_indices++;
 124 }
 125
 126
 127 static void del_ifidx(struct i802_driver_data *drv, int ifidx)
 128 {
 129         int i;
 130
 131         for (i = 0; i < drv->num_if_indices; i++) {
 132                 if (drv->if_indices[i] == ifidx) {
 133                         drv->if_indices[i] = 0;
 134                         break;
 135                 }
 136         }
 137 }
 138
 139
 140 static int have_ifidx(struct i802_driver_data *drv, int ifidx)
 141 {
 142         int i;
 143
 144         if (ifidx == drv->bridge)
 145                 return 1;
 146
 147         for (i = 0; i < drv->num_if_indices; i++)
 148                 if (drv->if_indices[i] == ifidx)
 149                         return 1;
 150
 151         return 0;
 152 }
 153
 154
 155 /* nl80211 code */
 156 static int ack_handler(struct nl_msg *msg, void *arg)
 157 {
 158         int *err = arg;
 159         *err = 0;
 160         return NL_STOP;
 161 }
 162
 163 static int finish_handler(struct nl_msg *msg, void *arg)
 164 {
 165         int *ret = arg;
 166         *ret = 0;
 167         return NL_SKIP;
 168 }
 169
 170 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 171                          void *arg)
 172 {
 173         int *ret = arg;
 174         *ret = err->error;
 175         return NL_SKIP;
 176 }
 177
 178 static int send_and_recv_msgs(struct i802_driver_data *drv,
 179                               struct nl_msg *msg,
 180                               int (*valid_handler)(struct nl_msg *, void *),
 181                               void *valid_data)
 182 {
 183         struct nl_cb *cb;
 184         int err = -ENOMEM;
 185
 186         cb = nl_cb_clone(drv->nl_cb);
 187         if (!cb)
 188                 goto out;
 189
 190         err = nl_send_auto_complete(drv->nl_handle, msg);
 191         if (err < 0)
 192                 goto out;
 193
 194         err = 1;
 195
 196         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 197         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 198         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 199
 200         if (valid_handler)
 201                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 202                           valid_handler, valid_data);
 203
 204         while (err > 0)
 205                 nl_recvmsgs(drv->nl_handle, cb);
 206  out:
 207         nl_cb_put(cb);
 208         nlmsg_free(msg);
 209         return err;
 210 }
 211
 212 static int hostapd_set_iface_flags(struct i802_driver_data *drv,
 213                                    const char *ifname, int dev_up)
 214 {
 215         struct ifreq ifr;
 216
 217         if (drv->ioctl_sock < 0)
 218                 return -1;
 219
 220         memset(&ifr, 0, sizeof(ifr));
 221         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
 222
 223         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
 224                 perror("ioctl[SIOCGIFFLAGS]");
 225                 wpa_printf(MSG_DEBUG, "Could not read interface flags (%s)",
 226                            drv->iface);
 227                 return -1;
 228         }
 229
 230         if (dev_up)
 231                 ifr.ifr_flags |= IFF_UP;
 232         else
 233                 ifr.ifr_flags &= ~IFF_UP;
 234
 235         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
 236                 perror("ioctl[SIOCSIFFLAGS]");
 237                 return -1;
 238         }
 239
 240         return 0;
 241 }
 242
 243
 244 static int nl_set_encr(int ifindex, struct i802_driver_data *drv,
 245                        const char *alg, const u8 *addr, int idx, const u8 *key,
 246                        size_t key_len, int txkey)
 247 {
 248         struct nl_msg *msg;
 249         int ret;
 250
 251         msg = nlmsg_alloc();
 252         if (!msg)
 253                 return -ENOMEM;
 254
 255         if (strcmp(alg, "none") == 0) {
 256                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 257                             0, NL80211_CMD_DEL_KEY, 0);
 258         } else {
 259                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 260                             0, NL80211_CMD_NEW_KEY, 0);
 261                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
 262                 if (strcmp(alg, "WEP") == 0) {
 263                         if (key_len == 5)
 264                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
 265                                             0x000FAC01);
 266                         else
 267                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
 268                                             0x000FAC05);
 269                 } else if (strcmp(alg, "TKIP") == 0)
 270                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
 271                 else if (strcmp(alg, "CCMP") == 0)
 272                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
 273                 else if (strcmp(alg, "IGTK") == 0)
 274                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC06);
 275                 else {
 276                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
 277                                    "algorithm '%s'", __func__, alg);
 278                         nlmsg_free(msg);
 279                         return -1;
 280                 }
 281         }
 282
 283         if (addr)
 284                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 285         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
 286         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
 287
 288         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 289         if (ret == -ENOENT)
 290                 ret = 0;
 291
 292         /*
 293          * If we failed or don't need to set the default TX key (below),
 294          * we're done here.
 295          */
 296         if (ret || !txkey || addr)
 297                 return ret;
 298
 299         msg = nlmsg_alloc();
 300         if (!msg)
 301                 return -ENOMEM;
 302
 303         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 304                     0, NL80211_CMD_SET_KEY, 0);
 305         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
 306         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
 307         if (strcmp(alg, "IGTK") == 0)
 308                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
 309         else
 310                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
 311
 312         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 313         if (ret == -ENOENT)
 314                 ret = 0;
 315         return ret;
 316  nla_put_failure:
 317         return -ENOBUFS;
 318 }
 319
 320
 321 static int i802_set_encryption(const char *iface, void *priv, const char *alg,
 322                                const u8 *addr, int idx, const u8 *key,
 323                                size_t key_len, int txkey)
 324 {
 325         struct i802_driver_data *drv = priv;
 326         int ret;
 327
 328         ret = nl_set_encr(if_nametoindex(iface), drv, alg, addr, idx, key,
 329                           key_len, txkey);
 330         if (ret < 0)
 331                 return ret;
 332
 333         return ret;
 334 }
 335
 336
 337 static inline int min_int(int a, int b)
 338 {
 339         if (a < b)
 340                 return a;
 341         return b;
 342 }
 343
 344
 345 static int get_key_handler(struct nl_msg *msg, void *arg)
 346 {
 347         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 348         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 349
 350         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 351                   genlmsg_attrlen(gnlh, 0), NULL);
 352
 353         /*
 354          * TODO: validate the key index and mac address!
 355          * Otherwise, there's a race condition as soon as
 356          * the kernel starts sending key notifications.
 357          */
 358
 359         if (tb[NL80211_ATTR_KEY_SEQ])
 360                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
 361                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
 362         return NL_SKIP;
 363 }
 364
 365
 366 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
 367                            int idx, u8 *seq)
 368 {
 369         struct i802_driver_data *drv = priv;
 370         struct nl_msg *msg;
 371
 372         msg = nlmsg_alloc();
 373         if (!msg)
 374                 return -ENOMEM;
 375
 376         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 377                     0, NL80211_CMD_GET_KEY, 0);
 378
 379         if (addr)
 380                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 381         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
 382         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
 383
 384         memset(seq, 0, 6);
 385
 386         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
 387  nla_put_failure:
 388         return -ENOBUFS;
 389 }
 390
 391
 392 static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
 393                               int mode)
 394 {
 395         struct i802_driver_data *drv = priv;
 396         struct nl_msg *msg;
 397         u8 rates[NL80211_MAX_SUPP_RATES];
 398         u8 rates_len = 0;
 399         int i;
 400
 401         msg = nlmsg_alloc();
 402         if (!msg)
 403                 return -ENOMEM;
 404
 405         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
 406                     NL80211_CMD_SET_BSS, 0);
 407
 408         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
 409                 rates[rates_len++] = basic_rates[i] / 5;
 410
 411         NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
 412
 413         /* TODO: multi-BSS support */
 414         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
 415
 416         return send_and_recv_msgs(drv, msg, NULL, NULL);
 417  nla_put_failure:
 418         return -ENOBUFS;
 419 }
 420
 421
 422 static int i802_send_frame(void *priv, const void *data, size_t len,
 423                            int encrypt, int flags)
 424 {
 425         __u8 rtap_hdr[] = {
 426                 0x00, 0x00, /* radiotap version */
 427                 0x0e, 0x00, /* radiotap length */
 428                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
 429                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
 430                 0x00,       /* padding */
 431                 0x00, 0x00, /* RX and TX flags to indicate that */
 432                 0x00, 0x00, /* this is the injected frame directly */
 433         };
 434         struct i802_driver_data *drv = priv;
 435         struct iovec iov[2] = {
 436                 {
 437                         .iov_base = &rtap_hdr,
 438                         .iov_len = sizeof(rtap_hdr),
 439                 },
 440                 {
 441                         .iov_base = (void*)data,
 442                         .iov_len = len,
 443                 }
 444         };
 445         struct msghdr msg = {
 446                 .msg_name = NULL,
 447                 .msg_namelen = 0,
 448                 .msg_iov = iov,
 449                 .msg_iovlen = 2,
 450                 .msg_control = NULL,
 451                 .msg_controllen = 0,
 452                 .msg_flags = 0,
 453         };
 454
 455         if (encrypt)
 456                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
 457
 458         return sendmsg(drv->monitor_sock, &msg, flags);
 459 }
 460
 461 static int i802_send_mgmt_frame(void *priv, const void *data, size_t len,
 462                                 int flags)
 463 {
 464         struct ieee80211_mgmt *mgmt;
 465         int do_not_encrypt = 0;
 466         u16 fc;
 467
 468         mgmt = (struct ieee80211_mgmt *) data;
 469         fc = le_to_host16(mgmt->frame_control);
 470
 471         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
 472             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
 473                 /*
 474                  * Only one of the authentication frame types is encrypted.
 475                  * In order for static WEP encryption to work properly (i.e.,
 476                  * to not encrypt the frame), we need to tell mac80211 about
 477                  * the frames that must not be encrypted.
 478                  */
 479                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
 480                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
 481                 if (auth_alg == WLAN_AUTH_OPEN ||
 482                     (auth_alg == WLAN_AUTH_SHARED_KEY && auth_trans != 3))
 483                         do_not_encrypt = 1;
 484         }
 485
 486         return i802_send_frame(priv, data, len, !do_not_encrypt, flags);
 487 }
 488
 489 /* Set kernel driver on given frequency (MHz) */
 490 static int i802_set_freq2(void *priv, struct hostapd_freq_params *freq)
 491 {
 492         struct i802_driver_data *drv = priv;
 493         struct nl_msg *msg;
 494
 495         msg = nlmsg_alloc();
 496         if (!msg)
 497                 return -1;
 498
 499         drv->last_freq = freq->freq;
 500         drv->last_freq_ht = freq->ht_enabled;
 501
 502         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
 503                     NL80211_CMD_SET_WIPHY, 0);
 504
 505         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
 506         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq->freq);
 507         if (freq->ht_enabled) {
 508                 switch (freq->sec_channel_offset) {
 509                 case -1:
 510                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
 511                                     NL80211_CHAN_HT40MINUS);
 512                         break;
 513                 case 1:
 514                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
 515                                     NL80211_CHAN_HT40PLUS);
 516                         break;
 517                 default:
 518                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
 519                                     NL80211_CHAN_HT20);
 520                         break;
 521                 }
 522         }
 523
 524         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
 525                 return 0;
 526  nla_put_failure:
 527         return -1;
 528 }
 529
 530
 531 static int i802_set_rts(void *priv, int rts)
 532 {
 533         struct i802_driver_data *drv = priv;
 534         struct iwreq iwr;
 535
 536         memset(&iwr, 0, sizeof(iwr));
 537         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 538         iwr.u.rts.value = rts;
 539         iwr.u.rts.fixed = 1;
 540
 541         if (ioctl(drv->ioctl_sock, SIOCSIWRTS, &iwr) < 0) {
 542                 perror("ioctl[SIOCSIWRTS]");
 543                 return -1;
 544         }
 545
 546         return 0;
 547 }
 548
 549
 550 static int i802_get_rts(void *priv, int *rts)
 551 {
 552         struct i802_driver_data *drv = priv;
 553         struct iwreq iwr;
 554
 555         memset(&iwr, 0, sizeof(iwr));
 556         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 557
 558         if (ioctl(drv->ioctl_sock, SIOCGIWRTS, &iwr) < 0) {
 559                 perror("ioctl[SIOCGIWRTS]");
 560                 return -1;
 561         }
 562
 563         *rts = iwr.u.rts.value;
 564
 565         return 0;
 566 }
 567
 568
 569 static int i802_set_frag(void *priv, int frag)
 570 {
 571         struct i802_driver_data *drv = priv;
 572         struct iwreq iwr;
 573
 574         memset(&iwr, 0, sizeof(iwr));
 575         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 576         iwr.u.frag.value = frag;
 577         iwr.u.frag.fixed = 1;
 578
 579         if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
 580                 perror("ioctl[SIOCSIWFRAG]");
 581                 return -1;
 582         }
 583
 584         return 0;
 585 }
 586
 587
 588 static int i802_get_frag(void *priv, int *frag)
 589 {
 590         struct i802_driver_data *drv = priv;
 591         struct iwreq iwr;
 592
 593         memset(&iwr, 0, sizeof(iwr));
 594         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 595
 596         if (ioctl(drv->ioctl_sock, SIOCGIWFRAG, &iwr) < 0) {
 597                 perror("ioctl[SIOCGIWFRAG]");
 598                 return -1;
 599         }
 600
 601         *frag = iwr.u.frag.value;
 602
 603         return 0;
 604 }
 605
 606
 607 static int i802_set_retry(void *priv, int short_retry, int long_retry)
 608 {
 609         struct i802_driver_data *drv = priv;
 610         struct iwreq iwr;
 611
 612         memset(&iwr, 0, sizeof(iwr));
 613         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 614
 615         iwr.u.retry.value = short_retry;
 616         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
 617         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
 618                 perror("ioctl[SIOCSIWRETRY(short)]");
 619                 return -1;
 620         }
 621
 622         iwr.u.retry.value = long_retry;
 623         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
 624         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
 625                 perror("ioctl[SIOCSIWRETRY(long)]");
 626                 return -1;
 627         }
 628
 629         return 0;
 630 }
 631
 632
 633 static int i802_get_retry(void *priv, int *short_retry, int *long_retry)
 634 {
 635         struct i802_driver_data *drv = priv;
 636         struct iwreq iwr;
 637
 638         memset(&iwr, 0, sizeof(iwr));
 639         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
 640
 641         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
 642         if (ioctl(drv->ioctl_sock, SIOCGIWRETRY, &iwr) < 0) {
 643                 perror("ioctl[SIOCGIWFRAG(short)]");
 644                 return -1;
 645         }
 646         *short_retry = iwr.u.retry.value;
 647
 648         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
 649         if (ioctl(drv->ioctl_sock, SIOCGIWRETRY, &iwr) < 0) {
 650                 perror("ioctl[SIOCGIWFRAG(long)]");
 651                 return -1;
 652         }
 653         *long_retry = iwr.u.retry.value;
 654
 655         return 0;
 656 }
 657
 658
 659 static int i802_flush(void *priv)
 660 {
 661         struct i802_driver_data *drv = priv;
 662         struct nl_msg *msg;
 663
 664         msg = nlmsg_alloc();
 665         if (!msg)
 666                 return -1;
 667
 668         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 669                     0, NL80211_CMD_DEL_STATION, 0);
 670
 671         /*
 672          * XXX: FIX! this needs to flush all VLANs too
 673          */
 674         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
 675                     if_nametoindex(drv->iface));
 676
 677         return send_and_recv_msgs(drv, msg, NULL, NULL);
 678  nla_put_failure:
 679         return -ENOBUFS;
 680 }
 681
 682
 683 static int get_sta_handler(struct nl_msg *msg, void *arg)
 684 {
 685         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 686         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 687         struct hostap_sta_driver_data *data = arg;
 688         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
 689         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
 690                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
 691                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
 692                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
 693                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
 694                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
 695         };
 696
 697         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 698                   genlmsg_attrlen(gnlh, 0), NULL);
 699
 700         /*
 701          * TODO: validate the interface and mac address!
 702          * Otherwise, there's a race condition as soon as
 703          * the kernel starts sending station notifications.
 704          */
 705
 706         if (!tb[NL80211_ATTR_STA_INFO]) {
 707                 wpa_printf(MSG_DEBUG, "sta stats missing!");
 708                 return NL_SKIP;
 709         }
 710         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
 711                              tb[NL80211_ATTR_STA_INFO],
 712                              stats_policy)) {
 713                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
 714                 return NL_SKIP;
 715         }
 716
 717         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
 718                 data->inactive_msec =
 719                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
 720         if (stats[NL80211_STA_INFO_RX_BYTES])
 721                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
 722         if (stats[NL80211_STA_INFO_TX_BYTES])
 723                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
 724         if (stats[NL80211_STA_INFO_RX_PACKETS])
 725                 data->rx_packets =
 726                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
 727         if (stats[NL80211_STA_INFO_TX_PACKETS])
 728                 data->tx_packets =
 729                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
 730
 731         return NL_SKIP;
 732 }
 733
 734 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
 735                               const u8 *addr)
 736 {
 737         struct i802_driver_data *drv = priv;
 738         struct nl_msg *msg;
 739
 740         os_memset(data, 0, sizeof(*data));
 741         msg = nlmsg_alloc();
 742         if (!msg)
 743                 return -ENOMEM;
 744
 745         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 746                     0, NL80211_CMD_GET_STATION, 0);
 747
 748         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 749         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
 750
 751         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
 752  nla_put_failure:
 753         return -ENOBUFS;
 754 }
 755
 756
 757 static int i802_send_eapol(void *priv, const u8 *addr, const u8 *data,
 758                            size_t data_len, int encrypt, const u8 *own_addr)
 759 {
 760         struct i802_driver_data *drv = priv;
 761         struct ieee80211_hdr *hdr;
 762         size_t len;
 763         u8 *pos;
 764         int res;
 765 #if 0 /* FIX */
 766         int qos = sta->flags & WLAN_STA_WME;
 767 #else
 768         int qos = 0;
 769 #endif
 770
 771         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
 772                 data_len;
 773         hdr = os_zalloc(len);
 774         if (hdr == NULL) {
 775                 printf("malloc() failed for i802_send_data(len=%lu)\n",
 776                        (unsigned long) len);
 777                 return -1;
 778         }
 779
 780         hdr->frame_control =
 781                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
 782         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
 783         if (encrypt)
 784                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
 785 #if 0 /* To be enabled if qos determination is added above */
 786         if (qos) {
 787                 hdr->frame_control |=
 788                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
 789         }
 790 #endif
 791
 792         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
 793         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
 794         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
 795         pos = (u8 *) (hdr + 1);
 796
 797 #if 0 /* To be enabled if qos determination is added above */
 798         if (qos) {
 799                 /* add an empty QoS header if needed */
 800                 pos[0] = 0;
 801                 pos[1] = 0;
 802                 pos += 2;
 803         }
 804 #endif
 805
 806         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
 807         pos += sizeof(rfc1042_header);
 808         WPA_PUT_BE16(pos, ETH_P_PAE);
 809         pos += 2;
 810         memcpy(pos, data, data_len);
 811
 812         res = i802_send_frame(drv, (u8 *) hdr, len, encrypt, 0);
 813         free(hdr);
 814
 815         if (res < 0) {
 816                 perror("i802_send_eapol: send");
 817                 printf("i802_send_eapol - packet len: %lu - failed\n",
 818                        (unsigned long) len);
 819         }
 820
 821         return res;
 822 }
 823
 824
 825 static int i802_sta_add2(const char *ifname, void *priv,
 826                          struct hostapd_sta_add_params *params)
 827 {
 828         struct i802_driver_data *drv = priv;
 829         struct nl_msg *msg;
 830         int ret = -ENOBUFS;
 831
 832         msg = nlmsg_alloc();
 833         if (!msg)
 834                 return -ENOMEM;
 835
 836         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 837                     0, NL80211_CMD_NEW_STATION, 0);
 838
 839         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
 840                     if_nametoindex(drv->iface));
 841         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
 842         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
 843         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
 844                 params->supp_rates);
 845         NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
 846                     params->listen_interval);
 847
 848 #ifdef CONFIG_IEEE80211N
 849         if (params->ht_capabilities) {
 850                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
 851                         params->ht_capabilities->length,
 852                         &params->ht_capabilities->data);
 853         }
 854 #endif /* CONFIG_IEEE80211N */
 855
 856         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 857         if (ret == -EEXIST)
 858                 ret = 0;
 859  nla_put_failure:
 860         return ret;
 861 }
 862
 863
 864 static int i802_sta_remove(void *priv, const u8 *addr)
 865 {
 866         struct i802_driver_data *drv = priv;
 867         struct nl_msg *msg;
 868         int ret;
 869
 870         msg = nlmsg_alloc();
 871         if (!msg)
 872                 return -ENOMEM;
 873
 874         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 875                     0, NL80211_CMD_DEL_STATION, 0);
 876
 877         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
 878                     if_nametoindex(drv->iface));
 879         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 880
 881         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
 882         if (ret == -ENOENT)
 883                 return 0;
 884         return ret;
 885  nla_put_failure:
 886         return -ENOBUFS;
 887 }
 888
 889
 890 static int i802_sta_set_flags(void *priv, const u8 *addr,
 891                               int total_flags, int flags_or, int flags_and)
 892 {
 893         struct i802_driver_data *drv = priv;
 894         struct nl_msg *msg, *flags = NULL;
 895
 896         msg = nlmsg_alloc();
 897         if (!msg)
 898                 return -ENOMEM;
 899
 900         flags = nlmsg_alloc();
 901         if (!flags) {
 902                 nlmsg_free(msg);
 903                 return -ENOMEM;
 904         }
 905
 906         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 907                     0, NL80211_CMD_SET_STATION, 0);
 908
 909         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
 910                     if_nametoindex(drv->iface));
 911         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
 912
 913         if (total_flags & WLAN_STA_AUTHORIZED || !drv->ieee802_1x_active)
 914                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
 915
 916         if (total_flags & WLAN_STA_WME)
 917                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
 918
 919         if (total_flags & WLAN_STA_SHORT_PREAMBLE)
 920                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
 921
 922         if (total_flags & WLAN_STA_MFP)
 923                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
 924
 925         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
 926                 goto nla_put_failure;
 927
 928         nlmsg_free(flags);
 929
 930         return send_and_recv_msgs(drv, msg, NULL, NULL);
 931  nla_put_failure:
 932         nlmsg_free(flags);
 933         return -ENOBUFS;
 934 }
 935
 936
 937 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
 938                                     int cw_min, int cw_max, int burst_time)
 939 {
 940         struct i802_driver_data *drv = priv;
 941         struct nl_msg *msg;
 942         struct nlattr *txq, *params;
 943
 944         msg = nlmsg_alloc();
 945         if (!msg)
 946                 return -1;
 947
 948         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 949                     0, NL80211_CMD_SET_WIPHY, 0);
 950
 951         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
 952
 953         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
 954         if (!txq)
 955                 goto nla_put_failure;
 956
 957         /* We are only sending parameters for a single TXQ at a time */
 958         params = nla_nest_start(msg, 1);
 959         if (!params)
 960                 goto nla_put_failure;
 961
 962         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue);
 963         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
 964          * 32 usec, so need to convert the value here. */
 965         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
 966         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
 967         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
 968         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
 969
 970         nla_nest_end(msg, params);
 971
 972         nla_nest_end(msg, txq);
 973
 974         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
 975                 return 0;
 976  nla_put_failure:
 977         return -1;
 978 }
 979
 980
 981 static void nl80211_remove_iface(struct i802_driver_data *drv, int ifidx)
 982 {
 983         struct nl_msg *msg;
 984
 985         /* stop listening for EAPOL on this interface */
 986         del_ifidx(drv, ifidx);
 987
 988         msg = nlmsg_alloc();
 989         if (!msg)
 990                 goto nla_put_failure;
 991
 992         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 993                     0, NL80211_CMD_DEL_INTERFACE, 0);
 994         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
 995
 996         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
 997                 return;
 998  nla_put_failure:
 999         printf("Failed to remove interface.\n");
1000 }
1001
1002
1003 static int nl80211_create_iface(struct i802_driver_data *drv,
1004                                 const char *ifname,
1005                                 enum nl80211_iftype iftype,
1006                                 const u8 *addr)
1007 {
1008         struct nl_msg *msg, *flags = NULL;
1009         int ifidx;
1010         struct ifreq ifreq;
1011         struct iwreq iwr;
1012         int ret = -ENOBUFS;
1013
1014         msg = nlmsg_alloc();
1015         if (!msg)
1016                 return -1;
1017
1018         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1019                     0, NL80211_CMD_NEW_INTERFACE, 0);
1020         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1021         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
1022         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
1023
1024         if (iftype == NL80211_IFTYPE_MONITOR) {
1025                 int err;
1026
1027                 flags = nlmsg_alloc();
1028                 if (!flags)
1029                         goto nla_put_failure;
1030
1031                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
1032
1033                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
1034
1035                 nlmsg_free(flags);
1036
1037                 if (err)
1038                         goto nla_put_failure;
1039         }
1040
1041         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1042         if (ret) {
1043  nla_put_failure:
1044                 printf("Failed to create interface %s.\n", ifname);
1045                 return ret;
1046         }
1047
1048         ifidx = if_nametoindex(ifname);
1049
1050         if (ifidx <= 0)
1051                 return -1;
1052
1053         /* start listening for EAPOL on this interface */
1054         add_ifidx(drv, ifidx);
1055
1056         if (addr) {
1057                 switch (iftype) {
1058                 case NL80211_IFTYPE_AP:
1059                         os_strlcpy(ifreq.ifr_name, ifname, IFNAMSIZ);
1060                         memcpy(ifreq.ifr_hwaddr.sa_data, addr, ETH_ALEN);
1061                         ifreq.ifr_hwaddr.sa_family = ARPHRD_ETHER;
1062
1063                         if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifreq)) {
1064                                 nl80211_remove_iface(drv, ifidx);
1065                                 return -1;
1066                         }
1067                         break;
1068                 case NL80211_IFTYPE_WDS:
1069                         memset(&iwr, 0, sizeof(iwr));
1070                         os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
1071                         iwr.u.addr.sa_family = ARPHRD_ETHER;
1072                         memcpy(iwr.u.addr.sa_data, addr, ETH_ALEN);
1073                         if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr))
1074                                 return -1;
1075                         break;
1076                 default:
1077                         /* nothing */
1078                         break;
1079                 }
1080         }
1081
1082         return ifidx;
1083 }
1084
1085
1086 static int i802_bss_add(void *priv, const char *ifname, const u8 *bssid)
1087 {
1088         int ifidx;
1089
1090         /*
1091          * The kernel supports that when the low-level driver does,
1092          * but we currently don't because we need per-BSS data that
1093          * currently we can't handle easily.
1094          */
1095         return -1;
1096
1097         ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid);
1098         if (ifidx < 0)
1099                 return -1;
1100         if (hostapd_set_iface_flags(priv, ifname, 1)) {
1101                 nl80211_remove_iface(priv, ifidx);
1102                 return -1;
1103         }
1104         return 0;
1105 }
1106
1107
1108 static int i802_bss_remove(void *priv, const char *ifname)
1109 {
1110         nl80211_remove_iface(priv, if_nametoindex(ifname));
1111         return 0;
1112 }
1113
1114
1115 static int i802_set_beacon(const char *iface, void *priv,
1116                            u8 *head, size_t head_len,
1117                            u8 *tail, size_t tail_len)
1118 {
1119         struct i802_driver_data *drv = priv;
1120         struct nl_msg *msg;
1121         u8 cmd = NL80211_CMD_NEW_BEACON;
1122         int ret;
1123
1124         msg = nlmsg_alloc();
1125         if (!msg)
1126                 return -ENOMEM;
1127
1128         if (drv->beacon_set)
1129                 cmd = NL80211_CMD_SET_BEACON;
1130
1131         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1132                     0, cmd, 0);
1133         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
1134         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
1135         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
1136         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, drv->beacon_int);
1137
1138         if (!drv->dtim_period)
1139                 drv->dtim_period = 2;
1140         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, drv->dtim_period);
1141
1142         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1143         if (!ret)
1144                 drv->beacon_set = 1;
1145         return ret;
1146  nla_put_failure:
1147         return -ENOBUFS;
1148 }
1149
1150
1151 static int i802_del_beacon(struct i802_driver_data *drv)
1152 {
1153         struct nl_msg *msg;
1154
1155         msg = nlmsg_alloc();
1156         if (!msg)
1157                 return -ENOMEM;
1158
1159         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1160                     0, NL80211_CMD_DEL_BEACON, 0);
1161         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1162
1163         return send_and_recv_msgs(drv, msg, NULL, NULL);
1164  nla_put_failure:
1165         return -ENOBUFS;
1166 }
1167
1168
1169 static int i802_set_ieee8021x(const char *ifname, void *priv, int enabled)
1170 {
1171         struct i802_driver_data *drv = priv;
1172
1173         /*
1174          * FIXME: This needs to be per interface (BSS)
1175          */
1176         drv->ieee802_1x_active = enabled;
1177         return 0;
1178 }
1179
1180
1181 static int i802_set_privacy(const char *ifname, void *priv, int enabled)
1182 {
1183         struct i802_driver_data *drv = priv;
1184         struct iwreq iwr;
1185
1186         memset(&iwr, 0, sizeof(iwr));
1187
1188         os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
1189         iwr.u.param.flags = IW_AUTH_PRIVACY_INVOKED;
1190         iwr.u.param.value = enabled;
1191
1192         ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr);
1193
1194         /* ignore errors, the kernel/driver might not care */
1195         return 0;
1196 }
1197
1198
1199 static int i802_set_internal_bridge(void *priv, int value)
1200 {
1201         return -1;
1202 }
1203
1204
1205 static int i802_set_beacon_int(void *priv, int value)
1206 {
1207         struct i802_driver_data *drv = priv;
1208         struct nl_msg *msg;
1209
1210         drv->beacon_int = value;
1211
1212         if (!drv->beacon_set)
1213                 return 0;
1214
1215         msg = nlmsg_alloc();
1216         if (!msg)
1217                 return -ENOMEM;
1218
1219         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1220                     0, NL80211_CMD_SET_BEACON, 0);
1221         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1222
1223         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
1224
1225         return send_and_recv_msgs(drv, msg, NULL, NULL);
1226  nla_put_failure:
1227         return -ENOBUFS;
1228 }
1229
1230
1231 static int i802_set_dtim_period(const char *iface, void *priv, int value)
1232 {
1233         struct i802_driver_data *drv = priv;
1234         struct nl_msg *msg;
1235
1236         msg = nlmsg_alloc();
1237         if (!msg)
1238                 return -ENOMEM;
1239
1240         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1241                     0, NL80211_CMD_SET_BEACON, 0);
1242         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
1243
1244         drv->dtim_period = value;
1245         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, drv->dtim_period);
1246
1247         return send_and_recv_msgs(drv, msg, NULL, NULL);
1248  nla_put_failure:
1249         return -ENOBUFS;
1250 }
1251
1252
1253 static int i802_set_bss(void *priv, int cts, int preamble, int slot)
1254 {
1255         struct i802_driver_data *drv = priv;
1256         struct nl_msg *msg;
1257
1258         msg = nlmsg_alloc();
1259         if (!msg)
1260                 return -ENOMEM;
1261
1262         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1263                     NL80211_CMD_SET_BSS, 0);
1264
1265         if (cts >= 0)
1266                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
1267         if (preamble >= 0)
1268                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
1269         if (slot >= 0)
1270                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
1271
1272         /* TODO: multi-BSS support */
1273         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1274
1275         return send_and_recv_msgs(drv, msg, NULL, NULL);
1276  nla_put_failure:
1277         return -ENOBUFS;
1278 }
1279
1280
1281 static int i802_set_cts_protect(void *priv, int value)
1282 {
1283         return i802_set_bss(priv, value, -1, -1);
1284 }
1285
1286
1287 static int i802_set_preamble(void *priv, int value)
1288 {
1289         return i802_set_bss(priv, -1, value, -1);
1290 }
1291
1292
1293 static int i802_set_short_slot_time(void *priv, int value)
1294 {
1295         return i802_set_bss(priv, -1, -1, value);
1296 }
1297
1298
1299 static enum nl80211_iftype i802_if_type(enum hostapd_driver_if_type type)
1300 {
1301         switch (type) {
1302         case HOSTAPD_IF_VLAN:
1303                 return NL80211_IFTYPE_AP_VLAN;
1304         case HOSTAPD_IF_WDS:
1305                 return NL80211_IFTYPE_WDS;
1306         }
1307         return -1;
1308 }
1309
1310
1311 static int i802_if_add(const char *iface, void *priv,
1312                        enum hostapd_driver_if_type type, char *ifname,
1313                        const u8 *addr)
1314 {
1315         if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr) < 0)
1316                 return -1;
1317         return 0;
1318 }
1319
1320
1321 static int i802_if_update(void *priv, enum hostapd_driver_if_type type,
1322                           char *ifname, const u8 *addr)
1323 {
1324         /* unused at the moment */
1325         return -1;
1326 }
1327
1328
1329 static int i802_if_remove(void *priv, enum hostapd_driver_if_type type,
1330                           const char *ifname, const u8 *addr)
1331 {
1332         nl80211_remove_iface(priv, if_nametoindex(ifname));
1333         return 0;
1334 }
1335
1336
1337 struct phy_info_arg {
1338         u16 *num_modes;
1339         struct hostapd_hw_modes *modes;
1340 };
1341
1342 static int phy_info_handler(struct nl_msg *msg, void *arg)
1343 {
1344         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1345         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1346         struct phy_info_arg *phy_info = arg;
1347
1348         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
1349
1350         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
1351         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
1352                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
1353                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
1354                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
1355                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
1356                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
1357                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
1358         };
1359
1360         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
1361         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
1362                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
1363                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
1364         };
1365
1366         struct nlattr *nl_band;
1367         struct nlattr *nl_freq;
1368         struct nlattr *nl_rate;
1369         int rem_band, rem_freq, rem_rate;
1370         struct hostapd_hw_modes *mode;
1371         int idx, mode_is_set;
1372
1373         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1374                   genlmsg_attrlen(gnlh, 0), NULL);
1375
1376         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
1377                 return NL_SKIP;
1378
1379         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
1380                 mode = realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode));
1381                 if (!mode)
1382                         return NL_SKIP;
1383                 phy_info->modes = mode;
1384
1385                 mode_is_set = 0;
1386
1387                 mode = &phy_info->modes[*(phy_info->num_modes)];
1388                 memset(mode, 0, sizeof(*mode));
1389                 *(phy_info->num_modes) += 1;
1390
1391                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
1392                           nla_len(nl_band), NULL);
1393
1394                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
1395                         mode->ht_capab = nla_get_u16(
1396                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
1397                 }
1398
1399                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1400                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1401                                   nla_len(nl_freq), freq_policy);
1402                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1403                                 continue;
1404                         mode->num_channels++;
1405                 }
1406
1407                 mode->channels = calloc(mode->num_channels, sizeof(struct hostapd_channel_data));
1408                 if (!mode->channels)
1409                         return NL_SKIP;
1410
1411                 idx = 0;
1412
1413                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1414                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1415                                   nla_len(nl_freq), freq_policy);
1416                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1417                                 continue;
1418
1419                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
1420                         mode->channels[idx].flag = 0;
1421
1422                         if (!mode_is_set) {
1423                                 /* crude heuristic */
1424                                 if (mode->channels[idx].freq < 4000)
1425                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
1426                                 else
1427                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
1428                                 mode_is_set = 1;
1429                         }
1430
1431                         /* crude heuristic */
1432                         if (mode->channels[idx].freq < 4000)
1433                                 if (mode->channels[idx].freq == 2848)
1434                                         mode->channels[idx].chan = 14;
1435                                 else
1436                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
1437                         else
1438                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
1439
1440                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1441                                 mode->channels[idx].flag |=
1442                                         HOSTAPD_CHAN_DISABLED;
1443                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
1444                                 mode->channels[idx].flag |=
1445                                         HOSTAPD_CHAN_PASSIVE_SCAN;
1446                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
1447                                 mode->channels[idx].flag |=
1448                                         HOSTAPD_CHAN_NO_IBSS;
1449                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
1450                                 mode->channels[idx].flag |=
1451                                         HOSTAPD_CHAN_RADAR;
1452
1453                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
1454                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1455                                 mode->channels[idx].max_tx_power =
1456                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
1457
1458                         idx++;
1459                 }
1460
1461                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1462                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1463                                   nla_len(nl_rate), rate_policy);
1464                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1465                                 continue;
1466                         mode->num_rates++;
1467                 }
1468
1469                 mode->rates = calloc(mode->num_rates, sizeof(struct hostapd_rate_data));
1470                 if (!mode->rates)
1471                         return NL_SKIP;
1472
1473                 idx = 0;
1474
1475                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1476                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1477                                   nla_len(nl_rate), rate_policy);
1478                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1479                                 continue;
1480                         mode->rates[idx].rate = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
1481
1482                         /* crude heuristic */
1483                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
1484                             mode->rates[idx].rate > 200)
1485                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
1486
1487                         if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
1488                                 mode->rates[idx].flags |= HOSTAPD_RATE_PREAMBLE2;
1489
1490                         idx++;
1491                 }
1492         }
1493
1494         return NL_SKIP;
1495 }
1496
1497 static struct hostapd_hw_modes *i802_add_11b(struct hostapd_hw_modes *modes,
1498                                              u16 *num_modes)
1499 {
1500         u16 m;
1501         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
1502         int i, mode11g_idx = -1;
1503
1504         /* If only 802.11g mode is included, use it to construct matching
1505          * 802.11b mode data. */
1506
1507         for (m = 0; m < *num_modes; m++) {
1508                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
1509                         return modes; /* 802.11b already included */
1510                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
1511                         mode11g_idx = m;
1512         }
1513
1514         if (mode11g_idx < 0)
1515                 return modes; /* 2.4 GHz band not supported at all */
1516
1517         nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes));
1518         if (nmodes == NULL)
1519                 return modes; /* Could not add 802.11b mode */
1520
1521         mode = &nmodes[*num_modes];
1522         os_memset(mode, 0, sizeof(*mode));
1523         (*num_modes)++;
1524         modes = nmodes;
1525
1526         mode->mode = HOSTAPD_MODE_IEEE80211B;
1527
1528         mode11g = &modes[mode11g_idx];
1529         mode->num_channels = mode11g->num_channels;
1530         mode->channels = os_malloc(mode11g->num_channels *
1531                                    sizeof(struct hostapd_channel_data));
1532         if (mode->channels == NULL) {
1533                 (*num_modes)--;
1534                 return modes; /* Could not add 802.11b mode */
1535         }
1536         os_memcpy(mode->channels, mode11g->channels,
1537                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
1538
1539         mode->num_rates = 0;
1540         mode->rates = os_malloc(4 * sizeof(struct hostapd_rate_data));
1541         if (mode->rates == NULL) {
1542                 os_free(mode->channels);
1543                 (*num_modes)--;
1544                 return modes; /* Could not add 802.11b mode */
1545         }
1546
1547         for (i = 0; i < mode11g->num_rates; i++) {
1548                 if (mode11g->rates[i].rate > 110 ||
1549                     mode11g->rates[i].flags &
1550                     (HOSTAPD_RATE_ERP | HOSTAPD_RATE_OFDM))
1551                         continue;
1552                 mode->rates[mode->num_rates] = mode11g->rates[i];
1553                 mode->num_rates++;
1554                 if (mode->num_rates == 4)
1555                         break;
1556         }
1557
1558         if (mode->num_rates == 0) {
1559                 os_free(mode->channels);
1560                 os_free(mode->rates);
1561                 (*num_modes)--;
1562                 return modes; /* No 802.11b rates */
1563         }
1564
1565         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
1566                    "information");
1567
1568         return modes;
1569 }
1570
1571 static struct hostapd_hw_modes *i802_get_hw_feature_data(void *priv,
1572                                                          u16 *num_modes,
1573                                                          u16 *flags)
1574 {
1575         struct i802_driver_data *drv = priv;
1576         struct nl_msg *msg;
1577         struct phy_info_arg result = {
1578                 .num_modes = num_modes,
1579                 .modes = NULL,
1580         };
1581
1582         *num_modes = 0;
1583         *flags = 0;
1584
1585         msg = nlmsg_alloc();
1586         if (!msg)
1587                 return NULL;
1588
1589         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1590                     0, NL80211_CMD_GET_WIPHY, 0);
1591
1592         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1593
1594         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
1595                 return i802_add_11b(result.modes, num_modes);
1596  nla_put_failure:
1597         return NULL;
1598 }
1599
1600
1601 static int i802_set_sta_vlan(void *priv, const u8 *addr,
1602                              const char *ifname, int vlan_id)
1603 {
1604         struct i802_driver_data *drv = priv;
1605         struct nl_msg *msg;
1606
1607         msg = nlmsg_alloc();
1608         if (!msg)
1609                 return -ENOMEM;
1610
1611         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1612                     0, NL80211_CMD_SET_STATION, 0);
1613
1614         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
1615                     if_nametoindex(drv->iface));
1616         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1617         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
1618                     if_nametoindex(ifname));
1619
1620         return send_and_recv_msgs(drv, msg, NULL, NULL);
1621  nla_put_failure:
1622         return -ENOBUFS;
1623 }
1624
1625
1626 static int i802_set_country(void *priv, const char *country)
1627 {
1628         struct i802_driver_data *drv = priv;
1629         struct nl_msg *msg;
1630         char alpha2[3];
1631
1632         msg = nlmsg_alloc();
1633         if (!msg)
1634                 return -ENOMEM;
1635
1636         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1637                     0, NL80211_CMD_REQ_SET_REG, 0);
1638
1639         alpha2[0] = country[0];
1640         alpha2[1] = country[1];
1641         alpha2[2] = '\0';
1642         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
1643
1644         return send_and_recv_msgs(drv, msg, NULL, NULL);
1645  nla_put_failure:
1646         return -ENOBUFS;
1647 }
1648
1649
1650 static void handle_tx_callback(struct hostapd_data *hapd, u8 *buf, size_t len,
1651                                int ok)
1652 {
1653         struct ieee80211_hdr *hdr;
1654         u16 fc, type, stype;
1655
1656         hdr = (struct ieee80211_hdr *) buf;
1657         fc = le_to_host16(hdr->frame_control);
1658
1659         type = WLAN_FC_GET_TYPE(fc);
1660         stype = WLAN_FC_GET_STYPE(fc);
1661
1662         switch (type) {
1663         case WLAN_FC_TYPE_MGMT:
1664                 wpa_printf(MSG_DEBUG, "MGMT (TX callback) %s",
1665                            ok ? "ACK" : "fail");
1666                 hostapd_mgmt_tx_cb(hapd, buf, len, stype, ok);
1667                 break;
1668         case WLAN_FC_TYPE_CTRL:
1669                 wpa_printf(MSG_DEBUG, "CTRL (TX callback) %s",
1670                            ok ? "ACK" : "fail");
1671                 break;
1672         case WLAN_FC_TYPE_DATA:
1673                 hostapd_tx_status(hapd, hdr->addr1, buf, len, ok);
1674                 break;
1675         default:
1676                 printf("unknown TX callback frame type %d\n", type);
1677                 break;
1678         }
1679 }
1680
1681
1682 static void handle_frame(struct i802_driver_data *drv,
1683                          struct hostapd_iface *iface, u8 *buf, size_t len,
1684                          struct hostapd_frame_info *hfi,
1685                          enum ieee80211_msg_type msg_type)
1686 {
1687         struct ieee80211_hdr *hdr;
1688         u16 fc, type, stype;
1689         size_t data_len = len;
1690         struct hostapd_data *hapd = NULL;
1691         int broadcast_bssid = 0;
1692         size_t i;
1693         u8 *bssid;
1694
1695         /*
1696          * PS-Poll frames are 16 bytes. All other frames are
1697          * 24 bytes or longer.
1698          */
1699         if (len < 16)
1700                 return;
1701
1702         hdr = (struct ieee80211_hdr *) buf;
1703         fc = le_to_host16(hdr->frame_control);
1704
1705         type = WLAN_FC_GET_TYPE(fc);
1706         stype = WLAN_FC_GET_STYPE(fc);
1707
1708         switch (type) {
1709         case WLAN_FC_TYPE_DATA:
1710                 if (len < 24)
1711                         return;
1712                 switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
1713                 case WLAN_FC_TODS:
1714                         bssid = hdr->addr1;
1715                         break;
1716                 case WLAN_FC_FROMDS:
1717                         bssid = hdr->addr2;
1718                         break;
1719                 default:
1720                         /* discard */
1721                         return;
1722                 }
1723                 break;
1724         case WLAN_FC_TYPE_CTRL:
1725                 /* discard non-ps-poll frames */
1726                 if (stype != WLAN_FC_STYPE_PSPOLL)
1727                         return;
1728                 bssid = hdr->addr1;
1729                 break;
1730         case WLAN_FC_TYPE_MGMT:
1731                 bssid = hdr->addr3;
1732                 break;
1733         default:
1734                 /* discard */
1735                 return;
1736         }
1737
1738         /* find interface frame belongs to */
1739         for (i = 0; i < iface->num_bss; i++) {
1740                 if (memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) {
1741                         hapd = iface->bss[i];
1742                         break;
1743                 }
1744         }
1745
1746         if (hapd == NULL) {
1747                 hapd = iface->bss[0];
1748
1749                 if (bssid[0] != 0xff || bssid[1] != 0xff ||
1750                     bssid[2] != 0xff || bssid[3] != 0xff ||
1751                     bssid[4] != 0xff || bssid[5] != 0xff) {
1752                         /*
1753                          * Unknown BSSID - drop frame if this is not from
1754                          * passive scanning or a beacon (at least ProbeReq
1755                          * frames to other APs may be allowed through RX
1756                          * filtering in the wlan hw/driver)
1757                          */
1758                         if ((type != WLAN_FC_TYPE_MGMT ||
1759                              stype != WLAN_FC_STYPE_BEACON))
1760                                 return;
1761                 } else
1762                         broadcast_bssid = 1;
1763         }
1764
1765         switch (msg_type) {
1766         case ieee80211_msg_normal:
1767                 /* continue processing */
1768                 break;
1769         case ieee80211_msg_tx_callback_ack:
1770                 handle_tx_callback(hapd, buf, data_len, 1);
1771                 return;
1772         case ieee80211_msg_tx_callback_fail:
1773                 handle_tx_callback(hapd, buf, data_len, 0);
1774                 return;
1775         }
1776
1777         switch (type) {
1778         case WLAN_FC_TYPE_MGMT:
1779                 if (stype != WLAN_FC_STYPE_BEACON &&
1780                     stype != WLAN_FC_STYPE_PROBE_REQ)
1781                         wpa_printf(MSG_MSGDUMP, "MGMT");
1782                 if (broadcast_bssid) {
1783                         for (i = 0; i < iface->num_bss; i++)
1784                                 hostapd_mgmt_rx(iface->bss[i], buf, data_len,
1785                                                 stype, hfi);
1786                 } else
1787                         hostapd_mgmt_rx(hapd, buf, data_len, stype, hfi);
1788                 break;
1789         case WLAN_FC_TYPE_CTRL:
1790                 /* can only get here with PS-Poll frames */
1791                 wpa_printf(MSG_DEBUG, "CTRL");
1792                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
1793                 break;
1794         case WLAN_FC_TYPE_DATA:
1795                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
1796                 break;
1797         }
1798 }
1799
1800
1801 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
1802 {
1803         struct i802_driver_data *drv = eloop_ctx;
1804         struct hostapd_data *hapd = drv->hapd;
1805         struct sockaddr_ll lladdr;
1806         unsigned char buf[3000];
1807         int len;
1808         socklen_t fromlen = sizeof(lladdr);
1809
1810         len = recvfrom(sock, buf, sizeof(buf), 0,
1811                        (struct sockaddr *)&lladdr, &fromlen);
1812         if (len < 0) {
1813                 perror("recv");
1814                 return;
1815         }
1816
1817         if (have_ifidx(drv, lladdr.sll_ifindex))
1818                 hostapd_eapol_receive(hapd, lladdr.sll_addr, buf, len);
1819 }
1820
1821
1822 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
1823 {
1824         struct i802_driver_data *drv = eloop_ctx;
1825         int len;
1826         unsigned char buf[3000];
1827         struct hostapd_data *hapd = drv->hapd;
1828         struct ieee80211_radiotap_iterator iter;
1829         int ret;
1830         struct hostapd_frame_info hfi;
1831         int injected = 0, failed = 0, msg_type, rxflags = 0;
1832
1833         len = recv(sock, buf, sizeof(buf), 0);
1834         if (len < 0) {
1835                 perror("recv");
1836                 return;
1837         }
1838
1839         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
1840                 printf("received invalid radiotap frame\n");
1841                 return;
1842         }
1843
1844         memset(&hfi, 0, sizeof(hfi));
1845
1846         while (1) {
1847                 ret = ieee80211_radiotap_iterator_next(&iter);
1848                 if (ret == -ENOENT)
1849                         break;
1850                 if (ret) {
1851                         printf("received invalid radiotap frame (%d)\n", ret);
1852                         return;
1853                 }
1854                 switch (iter.this_arg_index) {
1855                 case IEEE80211_RADIOTAP_FLAGS:
1856                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
1857                                 len -= 4;
1858                         break;
1859                 case IEEE80211_RADIOTAP_RX_FLAGS:
1860                         rxflags = 1;
1861                         break;
1862                 case IEEE80211_RADIOTAP_TX_FLAGS:
1863                         injected = 1;
1864                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
1865                                         IEEE80211_RADIOTAP_F_TX_FAIL;
1866                         break;
1867                 case IEEE80211_RADIOTAP_DATA_RETRIES:
1868                         break;
1869                 case IEEE80211_RADIOTAP_CHANNEL:
1870                         /* TODO convert from freq/flags to channel number
1871                         hfi.channel = XXX;
1872                         hfi.phytype = XXX;
1873                          */
1874                         break;
1875                 case IEEE80211_RADIOTAP_RATE:
1876                         hfi.datarate = *iter.this_arg * 5;
1877                         break;
1878                 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
1879                         hfi.ssi_signal = *iter.this_arg;
1880                         break;
1881                 }
1882         }
1883
1884         if (rxflags && injected)
1885                 return;
1886
1887         if (!injected)
1888                 msg_type = ieee80211_msg_normal;
1889         else if (failed)
1890                 msg_type = ieee80211_msg_tx_callback_fail;
1891         else
1892                 msg_type = ieee80211_msg_tx_callback_ack;
1893
1894         handle_frame(drv, hapd->iface, buf + iter.max_length,
1895                      len - iter.max_length, &hfi, msg_type);
1896 }
1897
1898
1899 /*
1900  * we post-process the filter code later and rewrite
1901  * this to the offset to the last instruction
1902  */
1903 #define PASS    0xFF
1904 #define FAIL    0xFE
1905
1906 static struct sock_filter msock_filter_insns[] = {
1907         /*
1908          * do a little-endian load of the radiotap length field
1909          */
1910         /* load lower byte into A */
1911         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
1912         /* put it into X (== index register) */
1913         BPF_STMT(BPF_MISC| BPF_TAX, 0),
1914         /* load upper byte into A */
1915         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
1916         /* left-shift it by 8 */
1917         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
1918         /* or with X */
1919         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
1920         /* put result into X */
1921         BPF_STMT(BPF_MISC| BPF_TAX, 0),
1922
1923         /*
1924          * Allow management frames through, this also gives us those
1925          * management frames that we sent ourselves with status
1926          */
1927         /* load the lower byte of the IEEE 802.11 frame control field */
1928         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
1929         /* mask off frame type and version */
1930         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
1931         /* accept frame if it's both 0, fall through otherwise */
1932         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
1933
1934         /*
1935          * TODO: add a bit to radiotap RX flags that indicates
1936          * that the sending station is not associated, then
1937          * add a filter here that filters on our DA and that flag
1938          * to allow us to deauth frames to that bad station.
1939          *
1940          * Not a regression -- we didn't do it before either.
1941          */
1942
1943 #if 0
1944         /*
1945          * drop non-data frames, WDS frames
1946          */
1947         /* load the lower byte of the frame control field */
1948         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
1949         /* mask off QoS bit */
1950         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
1951         /* drop non-data frames */
1952         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
1953         /* load the upper byte of the frame control field */
1954         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
1955         /* mask off toDS/fromDS */
1956         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
1957         /* drop WDS frames */
1958         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, FAIL, 0),
1959 #endif
1960
1961         /*
1962          * add header length to index
1963          */
1964         /* load the lower byte of the frame control field */
1965         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
1966         /* mask off QoS bit */
1967         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
1968         /* right shift it by 6 to give 0 or 2 */
1969         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
1970         /* add data frame header length */
1971         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
1972         /* add index, was start of 802.11 header */
1973         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
1974         /* move to index, now start of LL header */
1975         BPF_STMT(BPF_MISC | BPF_TAX, 0),
1976
1977         /*
1978          * Accept empty data frames, we use those for
1979          * polling activity.
1980          */
1981         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
1982         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
1983
1984         /*
1985          * Accept EAPOL frames
1986          */
1987         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
1988         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
1989         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
1990         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
1991
1992         /* keep these last two statements or change the code below */
1993         /* return 0 == "DROP" */
1994         BPF_STMT(BPF_RET | BPF_K, 0),
1995         /* return ~0 == "keep all" */
1996         BPF_STMT(BPF_RET | BPF_K, ~0),
1997 };
1998
1999 static struct sock_fprog msock_filter = {
2000         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
2001         .filter = msock_filter_insns,
2002 };
2003
2004
2005 static int add_monitor_filter(int s)
2006 {
2007         int idx;
2008
2009         /* rewrite all PASS/FAIL jump offsets */
2010         for (idx = 0; idx < msock_filter.len; idx++) {
2011                 struct sock_filter *insn = &msock_filter_insns[idx];
2012
2013                 if (BPF_CLASS(insn->code) == BPF_JMP) {
2014                         if (insn->code == (BPF_JMP|BPF_JA)) {
2015                                 if (insn->k == PASS)
2016                                         insn->k = msock_filter.len - idx - 2;
2017                                 else if (insn->k == FAIL)
2018                                         insn->k = msock_filter.len - idx - 3;
2019                         }
2020
2021                         if (insn->jt == PASS)
2022                                 insn->jt = msock_filter.len - idx - 2;
2023                         else if (insn->jt == FAIL)
2024                                 insn->jt = msock_filter.len - idx - 3;
2025
2026                         if (insn->jf == PASS)
2027                                 insn->jf = msock_filter.len - idx - 2;
2028                         else if (insn->jf == FAIL)
2029                                 insn->jf = msock_filter.len - idx - 3;
2030                 }
2031         }
2032
2033         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
2034                        &msock_filter, sizeof(msock_filter))) {
2035                 perror("SO_ATTACH_FILTER");
2036                 return -1;
2037         }
2038
2039         return 0;
2040 }
2041
2042
2043 static int nl80211_create_monitor_interface(struct i802_driver_data *drv)
2044 {
2045         char buf[IFNAMSIZ];
2046         struct sockaddr_ll ll;
2047         int optval;
2048         socklen_t optlen;
2049
2050         snprintf(buf, IFNAMSIZ, "mon.%s", drv->iface);
2051         buf[IFNAMSIZ - 1] = '\0';
2052
2053         drv->monitor_ifidx =
2054                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL);
2055
2056         if (drv->monitor_ifidx < 0)
2057                 return -1;
2058
2059         if (hostapd_set_iface_flags(drv, buf, 1))
2060                 goto error;
2061
2062         memset(&ll, 0, sizeof(ll));
2063         ll.sll_family = AF_PACKET;
2064         ll.sll_ifindex = drv->monitor_ifidx;
2065         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
2066         if (drv->monitor_sock < 0) {
2067                 perror("socket[PF_PACKET,SOCK_RAW]");
2068                 goto error;
2069         }
2070
2071         if (add_monitor_filter(drv->monitor_sock)) {
2072                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
2073                            "interface; do filtering in user space");
2074                 /* This works, but will cost in performance. */
2075         }
2076
2077         if (bind(drv->monitor_sock, (struct sockaddr *) &ll,
2078                  sizeof(ll)) < 0) {
2079                 perror("monitor socket bind");
2080                 goto error;
2081         }
2082
2083         optlen = sizeof(optval);
2084         optval = 20;
2085         if (setsockopt
2086             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
2087                 perror("Failed to set socket priority");
2088                 goto error;
2089         }
2090
2091         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
2092                                      drv, NULL)) {
2093                 printf("Could not register monitor read socket\n");
2094                 goto error;
2095         }
2096
2097         return 0;
2098  error:
2099         nl80211_remove_iface(drv, drv->monitor_ifidx);
2100         return -1;
2101 }
2102
2103
2104 static int nl80211_set_mode(struct i802_driver_data *drv, const char *ifname,
2105                             int mode)
2106 {
2107         struct nl_msg *msg;
2108         int ret = -ENOBUFS;
2109
2110         msg = nlmsg_alloc();
2111         if (!msg)
2112                 return -ENOMEM;
2113
2114         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2115                     0, NL80211_CMD_SET_INTERFACE, 0);
2116         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
2117                     if_nametoindex(ifname));
2118         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
2119
2120         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2121         if (!ret)
2122                 return 0;
2123  nla_put_failure:
2124         wpa_printf(MSG_ERROR, "Failed to set interface %s to master "
2125                    "mode.", ifname);
2126         return ret;
2127 }
2128
2129
2130 #ifdef CONFIG_IEEE80211N
2131 static void i802_add_neighbor(struct i802_driver_data *drv, u8 *bssid,
2132                               int freq, u8 *ie, size_t ie_len)
2133 {
2134         struct ieee802_11_elems elems;
2135         int ht, pri_chan = 0, sec_chan = 0;
2136         struct ieee80211_ht_operation *oper;
2137         struct hostapd_neighbor_bss *nnei;
2138
2139         ieee802_11_parse_elems(ie, ie_len, &elems, 0);
2140         ht = elems.ht_capabilities || elems.ht_operation;
2141         if (elems.ht_operation && elems.ht_operation_len >= sizeof(*oper)) {
2142                 oper = (struct ieee80211_ht_operation *) elems.ht_operation;
2143                 pri_chan = oper->control_chan;
2144                 if (oper->ht_param & HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH) {
2145                         if (oper->ht_param &
2146                             HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
2147                                 sec_chan = pri_chan + 4;
2148                         else if (oper->ht_param &
2149                             HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
2150                                 sec_chan = pri_chan - 4;
2151                 }
2152         }
2153
2154         wpa_printf(MSG_DEBUG, "nl80211: Neighboring BSS - bssid=" MACSTR
2155                    " freq=%d MHz HT=%d pri_chan=%d sec_chan=%d",
2156                    MAC2STR(bssid), freq, ht, pri_chan, sec_chan);
2157
2158         nnei = os_realloc(drv->neighbors, (drv->num_neighbors + 1) *
2159                           sizeof(struct hostapd_neighbor_bss));
2160         if (nnei == NULL)
2161                 return;
2162         drv->neighbors = nnei;
2163         nnei = &nnei[drv->num_neighbors];
2164         os_memcpy(nnei->bssid, bssid, ETH_ALEN);
2165         nnei->freq = freq;
2166         nnei->ht = !!ht;
2167         nnei->pri_chan = pri_chan;
2168         nnei->sec_chan = sec_chan;
2169         drv->num_neighbors++;
2170 }
2171
2172
2173 static int i802_get_scan_freq(struct iw_event *iwe, int *freq)
2174 {
2175         int divi = 1000000, i;
2176
2177         if (iwe->u.freq.e == 0) {
2178                 /*
2179                  * Some drivers do not report frequency, but a channel.
2180                  * Try to map this to frequency by assuming they are using
2181                  * IEEE 802.11b/g.  But don't overwrite a previously parsed
2182                  * frequency if the driver sends both frequency and channel,
2183                  * since the driver may be sending an A-band channel that we
2184                  * don't handle here.
2185                  */
2186
2187                 if (*freq)
2188                         return 0;
2189
2190                 if (iwe->u.freq.m >= 1 && iwe->u.freq.m <= 13) {
2191                         *freq = 2407 + 5 * iwe->u.freq.m;
2192                         return 0;
2193                 } else if (iwe->u.freq.m == 14) {
2194                         *freq = 2484;
2195                         return 0;
2196                 }
2197         }
2198
2199         if (iwe->u.freq.e > 6) {
2200                 wpa_printf(MSG_DEBUG, "Invalid freq in scan results: "
2201                            "m=%d e=%d", iwe->u.freq.m, iwe->u.freq.e);
2202                 return -1;
2203         }
2204
2205         for (i = 0; i < iwe->u.freq.e; i++)
2206                 divi /= 10;
2207         *freq = iwe->u.freq.m / divi;
2208         return 0;
2209 }
2210
2211
2212 static int i802_parse_scan(struct i802_driver_data *drv, u8 *res_buf,
2213                            size_t len)
2214 {
2215         size_t ap_num = 0;
2216         int first;
2217         struct iw_event iwe_buf, *iwe = &iwe_buf;
2218         char *pos, *end, *custom;
2219         u8 bssid[ETH_ALEN];
2220         int freq = 0;
2221         u8 *ie = NULL;
2222         size_t ie_len = 0;
2223
2224         ap_num = 0;
2225         first = 1;
2226
2227         pos = (char *) res_buf;
2228         end = (char *) res_buf + len;
2229
2230         while (pos + IW_EV_LCP_LEN <= end) {
2231                 /* Event data may be unaligned, so make a local, aligned copy
2232                  * before processing. */
2233                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
2234                 if (iwe->len <= IW_EV_LCP_LEN)
2235                         break;
2236
2237                 custom = pos + IW_EV_POINT_LEN;
2238                 if (iwe->cmd == IWEVGENIE) {
2239                         /* WE-19 removed the pointer from struct iw_point */
2240                         char *dpos = (char *) &iwe_buf.u.data.length;
2241                         int dlen = dpos - (char *) &iwe_buf;
2242                         os_memcpy(dpos, pos + IW_EV_LCP_LEN,
2243                                   sizeof(struct iw_event) - dlen);
2244                 } else {
2245                         os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
2246                         custom += IW_EV_POINT_OFF;
2247                 }
2248
2249                 switch (iwe->cmd) {
2250                 case SIOCGIWAP:
2251                         if (!first)
2252                                 i802_add_neighbor(drv, bssid, freq, ie,
2253                                                   ie_len);
2254                         first = 0;
2255                         os_memcpy(bssid, iwe->u.ap_addr.sa_data, ETH_ALEN);
2256                         freq = 0;
2257                         ie = NULL;
2258                         ie_len = 0;
2259                         break;
2260                 case SIOCGIWFREQ:
2261                         i802_get_scan_freq(iwe, &freq);
2262                         break;
2263                 case IWEVGENIE:
2264                         if (custom + iwe->u.data.length > end) {
2265                                 wpa_printf(MSG_ERROR, "IWEVGENIE overflow");
2266                                 return -1;
2267                         }
2268                         ie = (u8 *) custom;
2269                         ie_len = iwe->u.data.length;
2270                         break;
2271                 }
2272
2273                 pos += iwe->len;
2274         }
2275
2276         if (!first)
2277                 i802_add_neighbor(drv, bssid, freq, ie, ie_len);
2278
2279         return 0;
2280 }
2281
2282
2283 static int i802_get_ht_scan_res(struct i802_driver_data *drv)
2284 {
2285         struct iwreq iwr;
2286         u8 *res_buf;
2287         size_t res_buf_len;
2288         int res;
2289
2290         res_buf_len = IW_SCAN_MAX_DATA;
2291         for (;;) {
2292                 res_buf = os_malloc(res_buf_len);
2293                 if (res_buf == NULL)
2294                         return -1;
2295                 os_memset(&iwr, 0, sizeof(iwr));
2296                 os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
2297                 iwr.u.data.pointer = res_buf;
2298                 iwr.u.data.length = res_buf_len;
2299
2300                 if (ioctl(drv->ioctl_sock, SIOCGIWSCAN, &iwr) == 0)
2301                         break;
2302
2303                 if (errno == E2BIG && res_buf_len < 65535) {
2304                         os_free(res_buf);
2305                         res_buf = NULL;
2306                         res_buf_len *= 2;
2307                         if (res_buf_len > 65535)
2308                                 res_buf_len = 65535; /* 16-bit length field */
2309                         wpa_printf(MSG_DEBUG, "Scan results did not fit - "
2310                                    "trying larger buffer (%lu bytes)",
2311                                    (unsigned long) res_buf_len);
2312                 } else {
2313                         perror("ioctl[SIOCGIWSCAN]");
2314                         os_free(res_buf);
2315                         return -1;
2316                 }
2317         }
2318
2319         if (iwr.u.data.length > res_buf_len) {
2320                 os_free(res_buf);
2321                 return -1;
2322         }
2323
2324         res = i802_parse_scan(drv, res_buf, iwr.u.data.length);
2325         os_free(res_buf);
2326
2327         return res;
2328 }
2329
2330
2331 static int i802_is_event_wireless_scan_complete(char *data, int len)
2332 {
2333         struct iw_event iwe_buf, *iwe = &iwe_buf;
2334         char *pos, *end;
2335
2336         pos = data;
2337         end = data + len;
2338
2339         while (pos + IW_EV_LCP_LEN <= end) {
2340                 /* Event data may be unaligned, so make a local, aligned copy
2341                  * before processing. */
2342                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
2343                 if (iwe->cmd == SIOCGIWSCAN)
2344                         return 1;
2345
2346                 pos += iwe->len;
2347         }
2348
2349         return 0;
2350 }
2351
2352
2353 static int i802_is_rtm_scan_complete(int ifindex, struct nlmsghdr *h, int len)
2354 {
2355         struct ifinfomsg *ifi;
2356         int attrlen, _nlmsg_len, rta_len;
2357         struct rtattr *attr;
2358
2359         if (len < (int) sizeof(*ifi))
2360                 return 0;
2361
2362         ifi = NLMSG_DATA(h);
2363
2364         if (ifindex != ifi->ifi_index)
2365                 return 0; /* event for foreign ifindex */
2366
2367         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
2368
2369         attrlen = h->nlmsg_len - _nlmsg_len;
2370         if (attrlen < 0)
2371                 return 0;
2372
2373         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
2374
2375         rta_len = RTA_ALIGN(sizeof(struct rtattr));
2376         while (RTA_OK(attr, attrlen)) {
2377                 if (attr->rta_type == IFLA_WIRELESS &&
2378                     i802_is_event_wireless_scan_complete(
2379                             ((char *) attr) + rta_len,
2380                             attr->rta_len - rta_len))
2381                         return 1;
2382                 attr = RTA_NEXT(attr, attrlen);
2383         }
2384
2385         return 0;
2386 }
2387
2388
2389 static int i802_is_scan_complete(int s, int ifindex)
2390 {
2391         char buf[1024];
2392         int left;
2393         struct nlmsghdr *h;
2394
2395         left = recv(s, buf, sizeof(buf), MSG_DONTWAIT);
2396         if (left < 0) {
2397                 perror("recv(netlink)");
2398                 return 0;
2399         }
2400
2401         h = (struct nlmsghdr *) buf;
2402         while (left >= (int) sizeof(*h)) {
2403                 int len, plen;
2404
2405                 len = h->nlmsg_len;
2406                 plen = len - sizeof(*h);
2407                 if (len > left || plen < 0) {
2408                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
2409                                    "len=%d left=%d plen=%d",
2410                                    len, left, plen);
2411                         break;
2412                 }
2413
2414                 switch (h->nlmsg_type) {
2415                 case RTM_NEWLINK:
2416                         if (i802_is_rtm_scan_complete(ifindex, h, plen))
2417                                 return 1;
2418                         break;
2419                 }
2420
2421                 len = NLMSG_ALIGN(len);
2422                 left -= len;
2423                 h = (struct nlmsghdr *) ((char *) h + len);
2424         }
2425
2426         return 0;
2427 }
2428
2429
2430 static int i802_ht_scan(struct i802_driver_data *drv)
2431 {
2432         struct iwreq iwr;
2433         int s, res, ifindex;
2434         struct sockaddr_nl local;
2435         time_t now, end;
2436         fd_set rfds;
2437         struct timeval tv;
2438
2439         wpa_printf(MSG_DEBUG, "nl80211: Scanning overlapping BSSes before "
2440                    "starting HT 20/40 MHz BSS");
2441
2442         /* Request a new scan */
2443         /* TODO: would be enough to scan the selected band */
2444         os_memset(&iwr, 0, sizeof(iwr));
2445         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
2446         if (ioctl(drv->ioctl_sock, SIOCSIWSCAN, &iwr) < 0) {
2447                 perror("ioctl[SIOCSIWSCAN]");
2448                 return -1;
2449         }
2450
2451         ifindex = if_nametoindex(drv->iface);
2452
2453         /* Wait for scan completion event or timeout */
2454         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
2455         if (s < 0) {
2456                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
2457                 return -1;
2458         }
2459
2460         os_memset(&local, 0, sizeof(local));
2461         local.nl_family = AF_NETLINK;
2462         local.nl_groups = RTMGRP_LINK;
2463         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
2464                 perror("bind(netlink)");
2465                 close(s);
2466                 return -1;
2467         }
2468
2469         time(&end);
2470         end += 30; /* Wait at most 30 seconds for scan results */
2471         for (;;) {
2472                 time(&now);
2473                 tv.tv_sec = end > now ? end - now : 0;
2474                 tv.tv_usec = 0;
2475                 FD_ZERO(&rfds);
2476                 FD_SET(s, &rfds);
2477                 res = select(s + 1, &rfds, NULL, NULL, &tv);
2478                 if (res < 0) {
2479                         perror("select");
2480                         /* Assume results are ready after 10 seconds wait */
2481                         os_sleep(10, 0);
2482                         break;
2483                 } else if (res) {
2484                         if (i802_is_scan_complete(s, ifindex)) {
2485                                 wpa_printf(MSG_DEBUG, "nl80211: Scan "
2486                                            "completed");
2487                                 break;
2488                         }
2489                 } else {
2490                         wpa_printf(MSG_DEBUG, "nl80211: Scan timeout");
2491                         /* Assume results are ready to be read now */
2492                         break;
2493                 }
2494         }
2495
2496         close(s);
2497
2498         return i802_get_ht_scan_res(drv);
2499 }
2500 #endif /* CONFIG_IEEE80211N */
2501
2502
2503 static int i802_init_sockets(struct i802_driver_data *drv, const u8 *bssid)
2504 {
2505         struct ifreq ifr;
2506         struct sockaddr_ll addr;
2507
2508         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
2509         if (drv->ioctl_sock < 0) {
2510                 perror("socket[PF_INET,SOCK_DGRAM]");
2511                 return -1;
2512         }
2513
2514         /* start listening for EAPOL on the default AP interface */
2515         add_ifidx(drv, if_nametoindex(drv->iface));
2516
2517         if (hostapd_set_iface_flags(drv, drv->iface, 0))
2518                 return -1;
2519
2520         if (bssid) {
2521                 os_strlcpy(ifr.ifr_name, drv->iface, IFNAMSIZ);
2522                 memcpy(ifr.ifr_hwaddr.sa_data, bssid, ETH_ALEN);
2523                 ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
2524
2525                 if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifr)) {
2526                         perror("ioctl(SIOCSIFHWADDR)");
2527                         return -1;
2528                 }
2529         }
2530
2531         /*
2532          * initialise generic netlink and nl80211
2533          */
2534         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
2535         if (!drv->nl_cb) {
2536                 printf("Failed to allocate netlink callbacks.\n");
2537                 return -1;
2538         }
2539
2540         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
2541         if (!drv->nl_handle) {
2542                 printf("Failed to allocate netlink handle.\n");
2543                 return -1;
2544         }
2545
2546         if (genl_connect(drv->nl_handle)) {
2547                 printf("Failed to connect to generic netlink.\n");
2548                 return -1;
2549         }
2550
2551 #ifdef CONFIG_LIBNL20
2552         if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) {
2553                 printf("Failed to allocate generic netlink cache.\n");
2554                 return -1;
2555         }
2556 #else /* CONFIG_LIBNL20 */
2557         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
2558         if (!drv->nl_cache) {
2559                 printf("Failed to allocate generic netlink cache.\n");
2560                 return -1;
2561         }
2562 #endif /* CONFIG_LIBNL20 */
2563
2564         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
2565         if (!drv->nl80211) {
2566                 printf("nl80211 not found.\n");
2567                 return -1;
2568         }
2569
2570 #ifdef CONFIG_IEEE80211N
2571         if (drv->ht_40mhz_scan) {
2572                 if (nl80211_set_mode(drv, drv->iface, NL80211_IFTYPE_STATION)
2573                     || hostapd_set_iface_flags(drv, drv->iface, 1) ||
2574                     i802_ht_scan(drv) ||
2575                     hostapd_set_iface_flags(drv, drv->iface, 0)) {
2576                         wpa_printf(MSG_ERROR, "Failed to scan channels for "
2577                                    "HT 40 MHz operations");
2578                         return -1;
2579                 }
2580         }
2581 #endif /* CONFIG_IEEE80211N */
2582
2583         /* Initialise a monitor interface */
2584         if (nl80211_create_monitor_interface(drv))
2585                 return -1;
2586
2587         if (nl80211_set_mode(drv, drv->iface, NL80211_IFTYPE_AP))
2588                 goto fail1;
2589
2590         if (hostapd_set_iface_flags(drv, drv->iface, 1))
2591                 goto fail1;
2592
2593         memset(&addr, 0, sizeof(addr));
2594         addr.sll_family = AF_PACKET;
2595         addr.sll_ifindex = ifr.ifr_ifindex;
2596         wpa_printf(MSG_DEBUG, "Opening raw packet socket for ifindex %d",
2597                    addr.sll_ifindex);
2598
2599         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
2600         if (drv->eapol_sock < 0) {
2601                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
2602                 goto fail1;
2603         }
2604
2605         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
2606         {
2607                 printf("Could not register read socket for eapol\n");
2608                 return -1;
2609         }
2610
2611         memset(&ifr, 0, sizeof(ifr));
2612         os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
2613         if (ioctl(drv->ioctl_sock, SIOCGIFHWADDR, &ifr) != 0) {
2614                 perror("ioctl(SIOCGIFHWADDR)");
2615                 goto fail1;
2616         }
2617
2618         if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
2619                 printf("Invalid HW-addr family 0x%04x\n",
2620                        ifr.ifr_hwaddr.sa_family);
2621                 goto fail1;
2622         }
2623         memcpy(drv->hapd->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
2624
2625         return 0;
2626
2627 fail1:
2628         nl80211_remove_iface(drv, drv->monitor_ifidx);
2629         return -1;
2630 }
2631
2632
2633 static int i802_get_inact_sec(void *priv, const u8 *addr)
2634 {
2635         struct hostap_sta_driver_data data;
2636         int ret;
2637
2638         data.inactive_msec = (unsigned long) -1;
2639         ret = i802_read_sta_data(priv, &data, addr);
2640         if (ret || data.inactive_msec == (unsigned long) -1)
2641                 return -1;
2642         return data.inactive_msec / 1000;
2643 }
2644
2645
2646 static int i802_sta_clear_stats(void *priv, const u8 *addr)
2647 {
2648 #if 0
2649         /* TODO */
2650 #endif
2651         return 0;
2652 }
2653
2654
2655 static void
2656 hostapd_wireless_event_wireless_custom(struct i802_driver_data *drv,
2657                                        char *custom)
2658 {
2659         wpa_printf(MSG_DEBUG, "Custom wireless event: '%s'", custom);
2660
2661         if (strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
2662                 char *pos;
2663                 u8 addr[ETH_ALEN];
2664                 pos = strstr(custom, "addr=");
2665                 if (pos == NULL) {
2666                         wpa_printf(MSG_DEBUG,
2667                                    "MLME-MICHAELMICFAILURE.indication "
2668                                    "without sender address ignored");
2669                         return;
2670                 }
2671                 pos += 5;
2672                 if (hwaddr_aton(pos, addr) == 0) {
2673                         hostapd_michael_mic_failure(drv->hapd, addr);
2674                 } else {
2675                         wpa_printf(MSG_DEBUG,
2676                                    "MLME-MICHAELMICFAILURE.indication "
2677                                    "with invalid MAC address");
2678                 }
2679         }
2680 }
2681
2682
2683 static void hostapd_wireless_event_wireless(struct i802_driver_data *drv,
2684                                             char *data, int len)
2685 {
2686         struct iw_event iwe_buf, *iwe = &iwe_buf;
2687         char *pos, *end, *custom, *buf;
2688
2689         pos = data;
2690         end = data + len;
2691
2692         while (pos + IW_EV_LCP_LEN <= end) {
2693                 /* Event data may be unaligned, so make a local, aligned copy
2694                  * before processing. */
2695                 memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
2696                 wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
2697                            iwe->cmd, iwe->len);
2698                 if (iwe->len <= IW_EV_LCP_LEN)
2699                         return;
2700
2701                 custom = pos + IW_EV_POINT_LEN;
2702                 if (drv->we_version > 18 &&
2703                     (iwe->cmd == IWEVMICHAELMICFAILURE ||
2704                      iwe->cmd == IWEVCUSTOM)) {
2705                         /* WE-19 removed the pointer from struct iw_point */
2706                         char *dpos = (char *) &iwe_buf.u.data.length;
2707                         int dlen = dpos - (char *) &iwe_buf;
2708                         memcpy(dpos, pos + IW_EV_LCP_LEN,
2709                                sizeof(struct iw_event) - dlen);
2710                 } else {
2711                         memcpy(&iwe_buf, pos, sizeof(struct iw_event));
2712                         custom += IW_EV_POINT_OFF;
2713                 }
2714
2715                 switch (iwe->cmd) {
2716                 case IWEVCUSTOM:
2717                         if (custom + iwe->u.data.length > end)
2718                                 return;
2719                         buf = malloc(iwe->u.data.length + 1);
2720                         if (buf == NULL)
2721                                 return;
2722                         memcpy(buf, custom, iwe->u.data.length);
2723                         buf[iwe->u.data.length] = '\0';
2724                         hostapd_wireless_event_wireless_custom(drv, buf);
2725                         free(buf);
2726                         break;
2727                 }
2728
2729                 pos += iwe->len;
2730         }
2731 }
2732
2733
2734 static void hostapd_wireless_event_rtm_newlink(struct i802_driver_data *drv,
2735                                                struct nlmsghdr *h, int len)
2736 {
2737         struct ifinfomsg *ifi;
2738         int attrlen, nlmsg_len, rta_len;
2739         struct rtattr *attr;
2740
2741         if (len < (int) sizeof(*ifi))
2742                 return;
2743
2744         ifi = NLMSG_DATA(h);
2745
2746         /* TODO: use ifi->ifi_index to filter out wireless events from other
2747          * interfaces */
2748
2749         nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
2750
2751         attrlen = h->nlmsg_len - nlmsg_len;
2752         if (attrlen < 0)
2753                 return;
2754
2755         attr = (struct rtattr *) (((char *) ifi) + nlmsg_len);
2756
2757         rta_len = RTA_ALIGN(sizeof(struct rtattr));
2758         while (RTA_OK(attr, attrlen)) {
2759                 if (attr->rta_type == IFLA_WIRELESS) {
2760                         hostapd_wireless_event_wireless(
2761                                 drv, ((char *) attr) + rta_len,
2762                                 attr->rta_len - rta_len);
2763                 }
2764                 attr = RTA_NEXT(attr, attrlen);
2765         }
2766 }
2767
2768
2769 static void hostapd_wireless_event_receive(int sock, void *eloop_ctx,
2770                                            void *sock_ctx)
2771 {
2772         char buf[256];
2773         int left;
2774         struct sockaddr_nl from;
2775         socklen_t fromlen;
2776         struct nlmsghdr *h;
2777         struct i802_driver_data *drv = eloop_ctx;
2778
2779         fromlen = sizeof(from);
2780         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
2781                         (struct sockaddr *) &from, &fromlen);
2782         if (left < 0) {
2783                 if (errno != EINTR && errno != EAGAIN)
2784                         perror("recvfrom(netlink)");
2785                 return;
2786         }
2787
2788         h = (struct nlmsghdr *) buf;
2789         while (left >= (int) sizeof(*h)) {
2790                 int len, plen;
2791
2792                 len = h->nlmsg_len;
2793                 plen = len - sizeof(*h);
2794                 if (len > left || plen < 0) {
2795                         printf("Malformed netlink message: "
2796                                "len=%d left=%d plen=%d\n",
2797                                len, left, plen);
2798                         break;
2799                 }
2800
2801                 switch (h->nlmsg_type) {
2802                 case RTM_NEWLINK:
2803                         hostapd_wireless_event_rtm_newlink(drv, h, plen);
2804                         break;
2805                 }
2806
2807                 len = NLMSG_ALIGN(len);
2808                 left -= len;
2809                 h = (struct nlmsghdr *) ((char *) h + len);
2810         }
2811
2812         if (left > 0) {
2813                 printf("%d extra bytes in the end of netlink message\n", left);
2814         }
2815 }
2816
2817
2818 static int hostap_get_we_version(struct i802_driver_data *drv)
2819 {
2820         struct iw_range *range;
2821         struct iwreq iwr;
2822         int minlen;
2823         size_t buflen;
2824
2825         drv->we_version = 0;
2826
2827         /*
2828          * Use larger buffer than struct iw_range in order to allow the
2829          * structure to grow in the future.
2830          */
2831         buflen = sizeof(struct iw_range) + 500;
2832         range = os_zalloc(buflen);
2833         if (range == NULL)
2834                 return -1;
2835
2836         memset(&iwr, 0, sizeof(iwr));
2837         os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
2838         iwr.u.data.pointer = (caddr_t) range;
2839         iwr.u.data.length = buflen;
2840
2841         minlen = ((char *) &range->enc_capa) - (char *) range +
2842                 sizeof(range->enc_capa);
2843
2844         if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
2845                 perror("ioctl[SIOCGIWRANGE]");
2846                 free(range);
2847                 return -1;
2848         } else if (iwr.u.data.length >= minlen &&
2849                    range->we_version_compiled >= 18) {
2850                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
2851                            "WE(source)=%d enc_capa=0x%x",
2852                            range->we_version_compiled,
2853                            range->we_version_source,
2854                            range->enc_capa);
2855                 drv->we_version = range->we_version_compiled;
2856         }
2857
2858         free(range);
2859         return 0;
2860 }
2861
2862
2863 static int i802_wireless_event_init(void *priv)
2864 {
2865         struct i802_driver_data *drv = priv;
2866         int s;
2867         struct sockaddr_nl local;
2868
2869         hostap_get_we_version(drv);
2870
2871         drv->wext_sock = -1;
2872
2873         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
2874         if (s < 0) {
2875                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
2876                 return -1;
2877         }
2878
2879         memset(&local, 0, sizeof(local));
2880         local.nl_family = AF_NETLINK;
2881         local.nl_groups = RTMGRP_LINK;
2882         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
2883                 perror("bind(netlink)");
2884                 close(s);
2885                 return -1;
2886         }
2887
2888         eloop_register_read_sock(s, hostapd_wireless_event_receive, drv,
2889                                  NULL);
2890         drv->wext_sock = s;
2891
2892         return 0;
2893 }
2894
2895
2896 static void i802_wireless_event_deinit(void *priv)
2897 {
2898         struct i802_driver_data *drv = priv;
2899         if (drv->wext_sock < 0)
2900                 return;
2901         eloop_unregister_read_sock(drv->wext_sock);
2902         close(drv->wext_sock);
2903 }
2904
2905
2906 static int i802_sta_deauth(void *priv, const u8 *addr, int reason)
2907 {
2908         struct i802_driver_data *drv = priv;
2909         struct ieee80211_mgmt mgmt;
2910
2911         memset(&mgmt, 0, sizeof(mgmt));
2912         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2913                                           WLAN_FC_STYPE_DEAUTH);
2914         memcpy(mgmt.da, addr, ETH_ALEN);
2915         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
2916         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
2917         mgmt.u.deauth.reason_code = host_to_le16(reason);
2918         return i802_send_mgmt_frame(drv, &mgmt, IEEE80211_HDRLEN +
2919                                       sizeof(mgmt.u.deauth), 0);
2920 }
2921
2922
2923 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason)
2924 {
2925         struct i802_driver_data *drv = priv;
2926         struct ieee80211_mgmt mgmt;
2927
2928         memset(&mgmt, 0, sizeof(mgmt));
2929         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2930                                           WLAN_FC_STYPE_DISASSOC);
2931         memcpy(mgmt.da, addr, ETH_ALEN);
2932         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
2933         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
2934         mgmt.u.disassoc.reason_code = host_to_le16(reason);
2935         return  i802_send_mgmt_frame(drv, &mgmt, IEEE80211_HDRLEN +
2936                                        sizeof(mgmt.u.disassoc), 0);
2937 }
2938
2939
2940 static const struct hostapd_neighbor_bss *
2941 i802_get_neighbor_bss(void *priv, size_t *num)
2942 {
2943         struct i802_driver_data *drv = priv;
2944         *num = drv->num_neighbors;
2945         return drv->neighbors;
2946 }
2947
2948
2949 static void *i802_init_bssid(struct hostapd_data *hapd, const u8 *bssid)
2950 {
2951         struct i802_driver_data *drv;
2952
2953         drv = os_zalloc(sizeof(struct i802_driver_data));
2954         if (drv == NULL) {
2955                 printf("Could not allocate memory for i802 driver data\n");
2956                 return NULL;
2957         }
2958
2959         drv->hapd = hapd;
2960         memcpy(drv->iface, hapd->conf->iface, sizeof(drv->iface));
2961
2962         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
2963         drv->if_indices = drv->default_if_indices;
2964         drv->bridge = if_nametoindex(hapd->conf->bridge);
2965         drv->ht_40mhz_scan = hapd->iconf->secondary_channel != 0;
2966
2967         if (i802_init_sockets(drv, bssid))
2968                 goto failed;
2969
2970         return drv;
2971
2972 failed:
2973         free(drv);
2974         return NULL;
2975 }
2976
2977
2978 static void *i802_init(struct hostapd_data *hapd)
2979 {
2980         return i802_init_bssid(hapd, NULL);
2981 }
2982
2983
2984 static void i802_deinit(void *priv)
2985 {
2986         struct i802_driver_data *drv = priv;
2987
2988         if (drv->last_freq_ht) {
2989                 /* Clear HT flags from the driver */
2990                 struct hostapd_freq_params freq;
2991                 os_memset(&freq, 0, sizeof(freq));
2992                 freq.freq = drv->last_freq;
2993                 i802_set_freq2(priv, &freq);
2994         }
2995
2996         i802_del_beacon(drv);
2997
2998         /* remove monitor interface */
2999         nl80211_remove_iface(drv, drv->monitor_ifidx);
3000
3001         (void) hostapd_set_iface_flags(drv, drv->iface, 0);
3002
3003         if (drv->monitor_sock >= 0) {
3004                 eloop_unregister_read_sock(drv->monitor_sock);
3005                 close(drv->monitor_sock);
3006         }
3007         if (drv->ioctl_sock >= 0)
3008                 close(drv->ioctl_sock);
3009         if (drv->eapol_sock >= 0) {
3010                 eloop_unregister_read_sock(drv->eapol_sock);
3011                 close(drv->eapol_sock);
3012         }
3013
3014         genl_family_put(drv->nl80211);
3015         nl_cache_free(drv->nl_cache);
3016         nl_handle_destroy(drv->nl_handle);
3017         nl_cb_put(drv->nl_cb);
3018
3019         if (drv->if_indices != drv->default_if_indices)
3020                 free(drv->if_indices);
3021
3022         os_free(drv->neighbors);
3023         free(drv);
3024 }
3025
3026
3027 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
3028         .name = "nl80211",
3029         .init = i802_init,
3030         .init_bssid = i802_init_bssid,
3031         .deinit = i802_deinit,
3032         .wireless_event_init = i802_wireless_event_init,
3033         .wireless_event_deinit = i802_wireless_event_deinit,
3034         .set_ieee8021x = i802_set_ieee8021x,
3035         .set_privacy = i802_set_privacy,
3036         .set_encryption = i802_set_encryption,
3037         .get_seqnum = i802_get_seqnum,
3038         .flush = i802_flush,
3039         .read_sta_data = i802_read_sta_data,
3040         .send_eapol = i802_send_eapol,
3041         .sta_set_flags = i802_sta_set_flags,
3042         .sta_deauth = i802_sta_deauth,
3043         .sta_disassoc = i802_sta_disassoc,
3044         .sta_remove = i802_sta_remove,
3045         .send_mgmt_frame = i802_send_mgmt_frame,
3046         .sta_add2 = i802_sta_add2,
3047         .get_inact_sec = i802_get_inact_sec,
3048         .sta_clear_stats = i802_sta_clear_stats,
3049         .set_freq2 = i802_set_freq2,
3050         .set_rts = i802_set_rts,
3051         .get_rts = i802_get_rts,
3052         .set_frag = i802_set_frag,
3053         .get_frag = i802_get_frag,
3054         .set_retry = i802_set_retry,
3055         .get_retry = i802_get_retry,
3056         .set_rate_sets = i802_set_rate_sets,
3057         .set_beacon = i802_set_beacon,
3058         .set_internal_bridge = i802_set_internal_bridge,
3059         .set_beacon_int = i802_set_beacon_int,
3060         .set_dtim_period = i802_set_dtim_period,
3061         .set_cts_protect = i802_set_cts_protect,
3062         .set_preamble = i802_set_preamble,
3063         .set_short_slot_time = i802_set_short_slot_time,
3064         .set_tx_queue_params = i802_set_tx_queue_params,
3065         .bss_add = i802_bss_add,
3066         .bss_remove = i802_bss_remove,
3067         .if_add = i802_if_add,
3068         .if_update = i802_if_update,
3069         .if_remove = i802_if_remove,
3070         .get_hw_feature_data = i802_get_hw_feature_data,
3071         .set_sta_vlan = i802_set_sta_vlan,
3072         .set_country = i802_set_country,
3073         .get_neighbor_bss = i802_get_neighbor_bss,
3074 };