1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ocv.h"
14 #include "common/wpa_ctrl.h"
15 #include "hostapd.h"
16 #include "sta_info.h"
17 #include "ap_config.h"
18 #include "ap_drv_ops.h"
19 #include "wpa_auth.h"
20 #include "ieee802_11.h"
21
22
hostapd_eid_assoc_comeback_time(struct hostapd_data * hapd,struct sta_info * sta,u8 * eid)23 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
24 struct sta_info *sta, u8 *eid)
25 {
26 u8 *pos = eid;
27 u32 timeout, tu;
28 struct os_reltime now, passed;
29
30 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
31 *pos++ = 5;
32 *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
33 os_get_reltime(&now);
34 os_reltime_sub(&now, &sta->sa_query_start, &passed);
35 tu = (passed.sec * 1000000 + passed.usec) / 1024;
36 if (hapd->conf->assoc_sa_query_max_timeout > tu)
37 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
38 else
39 timeout = 0;
40 if (timeout < hapd->conf->assoc_sa_query_max_timeout)
41 timeout++; /* add some extra time for local timers */
42 WPA_PUT_LE32(pos, timeout);
43 pos += 4;
44
45 return pos;
46 }
47
48
49 /* MLME-SAQuery.request */
ieee802_11_send_sa_query_req(struct hostapd_data * hapd,const u8 * addr,const u8 * trans_id)50 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
51 const u8 *addr, const u8 *trans_id)
52 {
53 #ifdef CONFIG_OCV
54 struct sta_info *sta;
55 #endif /* CONFIG_OCV */
56 struct ieee80211_mgmt *mgmt;
57 u8 *oci_ie = NULL;
58 u8 oci_ie_len = 0;
59 u8 *end;
60
61 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
62 MACSTR, MAC2STR(addr));
63 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
64 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
65
66 #ifdef CONFIG_OCV
67 sta = ap_get_sta(hapd, addr);
68 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
69 struct wpa_channel_info ci;
70
71 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
72 wpa_printf(MSG_WARNING,
73 "Failed to get channel info for OCI element in SA Query Request");
74 return;
75 }
76 #ifdef CONFIG_TESTING_OPTIONS
77 if (hapd->conf->oci_freq_override_saquery_req) {
78 wpa_printf(MSG_INFO,
79 "TEST: Override OCI frequency %d -> %u MHz",
80 ci.frequency,
81 hapd->conf->oci_freq_override_saquery_req);
82 ci.frequency =
83 hapd->conf->oci_freq_override_saquery_req;
84 }
85 #endif /* CONFIG_TESTING_OPTIONS */
86
87 oci_ie_len = OCV_OCI_EXTENDED_LEN;
88 oci_ie = os_zalloc(oci_ie_len);
89 if (!oci_ie) {
90 wpa_printf(MSG_WARNING,
91 "Failed to allocate buffer for OCI element in SA Query Request");
92 return;
93 }
94
95 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
96 os_free(oci_ie);
97 return;
98 }
99 }
100 #endif /* CONFIG_OCV */
101
102 mgmt = os_zalloc(sizeof(*mgmt) + oci_ie_len);
103 if (!mgmt) {
104 wpa_printf(MSG_DEBUG,
105 "Failed to allocate buffer for SA Query Response frame");
106 os_free(oci_ie);
107 return;
108 }
109
110 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
111 WLAN_FC_STYPE_ACTION);
112 os_memcpy(mgmt->da, addr, ETH_ALEN);
113 os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
114 os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
115 mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
116 mgmt->u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
117 os_memcpy(mgmt->u.action.u.sa_query_req.trans_id, trans_id,
118 WLAN_SA_QUERY_TR_ID_LEN);
119 end = mgmt->u.action.u.sa_query_req.variable;
120 #ifdef CONFIG_OCV
121 if (oci_ie_len > 0) {
122 os_memcpy(end, oci_ie, oci_ie_len);
123 end += oci_ie_len;
124 }
125 #endif /* CONFIG_OCV */
126 if (hostapd_drv_send_mlme(hapd, mgmt, end - (u8 *) mgmt, 0, NULL, 0, 0)
127 < 0)
128 wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
129
130 os_free(mgmt);
131 os_free(oci_ie);
132 }
133
134
ieee802_11_send_sa_query_resp(struct hostapd_data * hapd,const u8 * sa,const u8 * trans_id)135 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
136 const u8 *sa, const u8 *trans_id)
137 {
138 struct sta_info *sta;
139 struct ieee80211_mgmt *resp;
140 u8 *oci_ie = NULL;
141 u8 oci_ie_len = 0;
142 u8 *end;
143
144 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
145 MACSTR, MAC2STR(sa));
146 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
147 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
148
149 sta = ap_get_sta(hapd, sa);
150 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
151 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
152 "from unassociated STA " MACSTR, MAC2STR(sa));
153 return;
154 }
155
156 #ifdef CONFIG_OCV
157 if (wpa_auth_uses_ocv(sta->wpa_sm)) {
158 struct wpa_channel_info ci;
159
160 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
161 wpa_printf(MSG_WARNING,
162 "Failed to get channel info for OCI element in SA Query Response");
163 return;
164 }
165 #ifdef CONFIG_TESTING_OPTIONS
166 if (hapd->conf->oci_freq_override_saquery_resp) {
167 wpa_printf(MSG_INFO,
168 "TEST: Override OCI frequency %d -> %u MHz",
169 ci.frequency,
170 hapd->conf->oci_freq_override_saquery_resp);
171 ci.frequency =
172 hapd->conf->oci_freq_override_saquery_resp;
173 }
174 #endif /* CONFIG_TESTING_OPTIONS */
175
176 oci_ie_len = OCV_OCI_EXTENDED_LEN;
177 oci_ie = os_zalloc(oci_ie_len);
178 if (!oci_ie) {
179 wpa_printf(MSG_WARNING,
180 "Failed to allocate buffer for for OCI element in SA Query Response");
181 return;
182 }
183
184 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
185 os_free(oci_ie);
186 return;
187 }
188 }
189 #endif /* CONFIG_OCV */
190
191 resp = os_zalloc(sizeof(*resp) + oci_ie_len);
192 if (!resp) {
193 wpa_printf(MSG_DEBUG,
194 "Failed to allocate buffer for SA Query Response frame");
195 os_free(oci_ie);
196 return;
197 }
198
199 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
200 MACSTR, MAC2STR(sa));
201
202 resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
203 WLAN_FC_STYPE_ACTION);
204 os_memcpy(resp->da, sa, ETH_ALEN);
205 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
206 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
207 resp->u.action.category = WLAN_ACTION_SA_QUERY;
208 resp->u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
209 os_memcpy(resp->u.action.u.sa_query_req.trans_id, trans_id,
210 WLAN_SA_QUERY_TR_ID_LEN);
211 end = resp->u.action.u.sa_query_req.variable;
212 #ifdef CONFIG_OCV
213 if (oci_ie_len > 0) {
214 os_memcpy(end, oci_ie, oci_ie_len);
215 end += oci_ie_len;
216 }
217 #endif /* CONFIG_OCV */
218 if (hostapd_drv_send_mlme(hapd, resp, end - (u8 *) resp, 0, NULL, 0, 0)
219 < 0)
220 wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
221
222 os_free(resp);
223 os_free(oci_ie);
224 }
225
226
ieee802_11_sa_query_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)227 void ieee802_11_sa_query_action(struct hostapd_data *hapd,
228 const struct ieee80211_mgmt *mgmt,
229 size_t len)
230 {
231 struct sta_info *sta;
232 int i;
233 const u8 *sa = mgmt->sa;
234 const u8 action_type = mgmt->u.action.u.sa_query_resp.action;
235 const u8 *trans_id = mgmt->u.action.u.sa_query_resp.trans_id;
236
237 if (((const u8 *) mgmt) + len <
238 mgmt->u.action.u.sa_query_resp.variable) {
239 wpa_printf(MSG_DEBUG,
240 "IEEE 802.11: Too short SA Query Action frame (len=%lu)",
241 (unsigned long) len);
242 return;
243 }
244
245 sta = ap_get_sta(hapd, sa);
246
247 #ifdef CONFIG_OCV
248 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
249 struct ieee802_11_elems elems;
250 struct wpa_channel_info ci;
251 int tx_chanwidth;
252 int tx_seg1_idx;
253 size_t ies_len;
254 const u8 *ies;
255
256 ies = mgmt->u.action.u.sa_query_resp.variable;
257 ies_len = len - (ies - (u8 *) mgmt);
258 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) ==
259 ParseFailed) {
260 wpa_printf(MSG_DEBUG,
261 "SA Query: Failed to parse elements");
262 return;
263 }
264
265 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
266 wpa_printf(MSG_WARNING,
267 "Failed to get channel info to validate received OCI in SA Query Action frame");
268 return;
269 }
270
271 if (get_sta_tx_parameters(sta->wpa_sm,
272 channel_width_to_int(ci.chanwidth),
273 ci.seg1_idx, &tx_chanwidth,
274 &tx_seg1_idx) < 0)
275 return;
276
277 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
278 tx_chanwidth, tx_seg1_idx) !=
279 OCI_SUCCESS) {
280 wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
281 MACSTR " frame=saquery%s error=%s",
282 MAC2STR(sa),
283 action_type == WLAN_SA_QUERY_REQUEST ?
284 "req" : "resp", ocv_errorstr);
285 return;
286 }
287 }
288 #endif /* CONFIG_OCV */
289
290 if (action_type == WLAN_SA_QUERY_REQUEST) {
291 if (sta)
292 sta->post_csa_sa_query = 0;
293 ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
294 return;
295 }
296
297 if (action_type != WLAN_SA_QUERY_RESPONSE) {
298 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
299 "Action %d", action_type);
300 return;
301 }
302
303 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
304 MACSTR, MAC2STR(sa));
305 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
306 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
307
308 /* MLME-SAQuery.confirm */
309
310 if (sta == NULL || sta->sa_query_trans_id == NULL) {
311 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
312 "pending SA Query request found");
313 return;
314 }
315
316 for (i = 0; i < sta->sa_query_count; i++) {
317 if (os_memcmp(sta->sa_query_trans_id +
318 i * WLAN_SA_QUERY_TR_ID_LEN,
319 trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
320 break;
321 }
322
323 if (i >= sta->sa_query_count) {
324 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
325 "transaction identifier found");
326 return;
327 }
328
329 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
330 HOSTAPD_LEVEL_DEBUG,
331 "Reply to pending SA Query received");
332 ap_sta_stop_sa_query(hapd, sta);
333 }
334
335
hostapd_ext_capab_byte(struct hostapd_data * hapd,u8 * pos,int idx)336 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx)
337 {
338 *pos = 0x00;
339
340 switch (idx) {
341 case 0: /* Bits 0-7 */
342 if (hapd->iconf->obss_interval)
343 *pos |= 0x01; /* Bit 0 - Coexistence management */
344 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)
345 *pos |= 0x04; /* Bit 2 - Extended Channel Switching */
346 break;
347 case 1: /* Bits 8-15 */
348 if (hapd->conf->proxy_arp)
349 *pos |= 0x10; /* Bit 12 - Proxy ARP */
350 if (hapd->conf->coloc_intf_reporting) {
351 /* Bit 13 - Collocated Interference Reporting */
352 *pos |= 0x20;
353 }
354 break;
355 case 2: /* Bits 16-23 */
356 if (hapd->conf->wnm_sleep_mode)
357 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
358 if (hapd->conf->bss_transition)
359 *pos |= 0x08; /* Bit 19 - BSS Transition */
360 break;
361 case 3: /* Bits 24-31 */
362 #ifdef CONFIG_WNM_AP
363 *pos |= 0x02; /* Bit 25 - SSID List */
364 #endif /* CONFIG_WNM_AP */
365 if (hapd->conf->time_advertisement == 2)
366 *pos |= 0x08; /* Bit 27 - UTC TSF Offset */
367 if (hapd->conf->interworking)
368 *pos |= 0x80; /* Bit 31 - Interworking */
369 break;
370 case 4: /* Bits 32-39 */
371 if (hapd->conf->qos_map_set_len)
372 *pos |= 0x01; /* Bit 32 - QoS Map */
373 if (hapd->conf->tdls & TDLS_PROHIBIT)
374 *pos |= 0x40; /* Bit 38 - TDLS Prohibited */
375 if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
376 /* Bit 39 - TDLS Channel Switching Prohibited */
377 *pos |= 0x80;
378 }
379 break;
380 case 5: /* Bits 40-47 */
381 #ifdef CONFIG_HS20
382 if (hapd->conf->hs20)
383 *pos |= 0x40; /* Bit 46 - WNM-Notification */
384 #endif /* CONFIG_HS20 */
385 #ifdef CONFIG_MBO
386 if (hapd->conf->mbo_enabled)
387 *pos |= 0x40; /* Bit 46 - WNM-Notification */
388 #endif /* CONFIG_MBO */
389 break;
390 case 6: /* Bits 48-55 */
391 if (hapd->conf->ssid.utf8_ssid)
392 *pos |= 0x01; /* Bit 48 - UTF-8 SSID */
393 break;
394 case 7: /* Bits 56-63 */
395 break;
396 case 8: /* Bits 64-71 */
397 if (hapd->conf->ftm_responder)
398 *pos |= 0x40; /* Bit 70 - FTM responder */
399 if (hapd->conf->ftm_initiator)
400 *pos |= 0x80; /* Bit 71 - FTM initiator */
401 break;
402 case 9: /* Bits 72-79 */
403 #ifdef CONFIG_FILS
404 if ((hapd->conf->wpa & WPA_PROTO_RSN) &&
405 wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
406 *pos |= 0x01;
407 #endif /* CONFIG_FILS */
408 #ifdef CONFIG_IEEE80211AX
409 if (hapd->iconf->ieee80211ax &&
410 hostapd_get_he_twt_responder(hapd, IEEE80211_MODE_AP))
411 *pos |= 0x40; /* Bit 78 - TWT responder */
412 #endif /* CONFIG_IEEE80211AX */
413 break;
414 case 10: /* Bits 80-87 */
415 #ifdef CONFIG_SAE
416 if (hapd->conf->wpa &&
417 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt)) {
418 int in_use = hostapd_sae_pw_id_in_use(hapd->conf);
419
420 if (in_use)
421 *pos |= 0x02; /* Bit 81 - SAE Password
422 * Identifiers In Use */
423 if (in_use == 2)
424 *pos |= 0x04; /* Bit 82 - SAE Password
425 * Identifiers Used Exclusively */
426 }
427 #endif /* CONFIG_SAE */
428 if (hapd->conf->beacon_prot &&
429 (hapd->iface->drv_flags &
430 WPA_DRIVER_FLAGS_BEACON_PROTECTION))
431 *pos |= 0x10; /* Bit 84 - Beacon Protection Enabled */
432 break;
433 case 11: /* Bits 88-95 */
434 #ifdef CONFIG_SAE_PK
435 if (hapd->conf->wpa &&
436 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
437 hostapd_sae_pk_exclusively(hapd->conf))
438 *pos |= 0x01; /* Bit 88 - SAE PK Exclusively */
439 #endif /* CONFIG_SAE_PK */
440 break;
441 }
442 }
443
444
hostapd_eid_ext_capab(struct hostapd_data * hapd,u8 * eid)445 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid)
446 {
447 u8 *pos = eid;
448 u8 len = 0, i;
449
450 if (hapd->conf->qos_map_set_len ||
451 (hapd->conf->tdls & (TDLS_PROHIBIT | TDLS_PROHIBIT_CHAN_SWITCH)))
452 len = 5;
453 if (len < 4 &&
454 (hapd->conf->time_advertisement == 2 || hapd->conf->interworking))
455 len = 4;
456 if (len < 3 &&
457 (hapd->conf->wnm_sleep_mode || hapd->conf->bss_transition))
458 len = 3;
459 if (len < 1 &&
460 (hapd->iconf->obss_interval ||
461 (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)))
462 len = 1;
463 if (len < 2 &&
464 (hapd->conf->proxy_arp || hapd->conf->coloc_intf_reporting))
465 len = 2;
466 if (len < 7 && hapd->conf->ssid.utf8_ssid)
467 len = 7;
468 if (len < 9 &&
469 (hapd->conf->ftm_initiator || hapd->conf->ftm_responder))
470 len = 9;
471 #ifdef CONFIG_WNM_AP
472 if (len < 4)
473 len = 4;
474 #endif /* CONFIG_WNM_AP */
475 #ifdef CONFIG_HS20
476 if (hapd->conf->hs20 && len < 6)
477 len = 6;
478 #endif /* CONFIG_HS20 */
479 #ifdef CONFIG_MBO
480 if (hapd->conf->mbo_enabled && len < 6)
481 len = 6;
482 #endif /* CONFIG_MBO */
483 #ifdef CONFIG_FILS
484 if ((!(hapd->conf->wpa & WPA_PROTO_RSN) ||
485 !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt)) && len < 10)
486 len = 10;
487 #endif /* CONFIG_FILS */
488 #ifdef CONFIG_IEEE80211AX
489 if (len < 10 && hapd->iconf->ieee80211ax &&
490 hostapd_get_he_twt_responder(hapd, IEEE80211_MODE_AP))
491 len = 10;
492 #endif /* CONFIG_IEEE80211AX */
493 #ifdef CONFIG_SAE
494 if (len < 11 && hapd->conf->wpa &&
495 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
496 hostapd_sae_pw_id_in_use(hapd->conf))
497 len = 11;
498 #endif /* CONFIG_SAE */
499 if (len < 11 && hapd->conf->beacon_prot &&
500 (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_BEACON_PROTECTION))
501 len = 11;
502 #ifdef CONFIG_SAE_PK
503 if (len < 12 && hapd->conf->wpa &&
504 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
505 hostapd_sae_pk_exclusively(hapd->conf))
506 len = 12;
507 #endif /* CONFIG_SAE_PK */
508 if (len < hapd->iface->extended_capa_len)
509 len = hapd->iface->extended_capa_len;
510 if (len == 0)
511 return eid;
512
513 *pos++ = WLAN_EID_EXT_CAPAB;
514 *pos++ = len;
515 for (i = 0; i < len; i++, pos++) {
516 hostapd_ext_capab_byte(hapd, pos, i);
517
518 if (i < hapd->iface->extended_capa_len) {
519 *pos &= ~hapd->iface->extended_capa_mask[i];
520 *pos |= hapd->iface->extended_capa[i];
521 }
522 }
523
524 while (len > 0 && eid[1 + len] == 0) {
525 len--;
526 eid[1] = len;
527 }
528 if (len == 0)
529 return eid;
530
531 return eid + 2 + len;
532 }
533
534
hostapd_eid_qos_map_set(struct hostapd_data * hapd,u8 * eid)535 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
536 {
537 u8 *pos = eid;
538 u8 len = hapd->conf->qos_map_set_len;
539
540 if (!len)
541 return eid;
542
543 *pos++ = WLAN_EID_QOS_MAP_SET;
544 *pos++ = len;
545 os_memcpy(pos, hapd->conf->qos_map_set, len);
546 pos += len;
547
548 return pos;
549 }
550
551
hostapd_eid_interworking(struct hostapd_data * hapd,u8 * eid)552 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
553 {
554 u8 *pos = eid;
555 #ifdef CONFIG_INTERWORKING
556 u8 *len;
557
558 if (!hapd->conf->interworking)
559 return eid;
560
561 *pos++ = WLAN_EID_INTERWORKING;
562 len = pos++;
563
564 *pos = hapd->conf->access_network_type;
565 if (hapd->conf->internet)
566 *pos |= INTERWORKING_ANO_INTERNET;
567 if (hapd->conf->asra)
568 *pos |= INTERWORKING_ANO_ASRA;
569 if (hapd->conf->esr)
570 *pos |= INTERWORKING_ANO_ESR;
571 if (hapd->conf->uesa)
572 *pos |= INTERWORKING_ANO_UESA;
573 pos++;
574
575 if (hapd->conf->venue_info_set) {
576 *pos++ = hapd->conf->venue_group;
577 *pos++ = hapd->conf->venue_type;
578 }
579
580 if (!is_zero_ether_addr(hapd->conf->hessid)) {
581 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
582 pos += ETH_ALEN;
583 }
584
585 *len = pos - len - 1;
586 #endif /* CONFIG_INTERWORKING */
587
588 return pos;
589 }
590
591
hostapd_eid_adv_proto(struct hostapd_data * hapd,u8 * eid)592 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
593 {
594 u8 *pos = eid;
595 #ifdef CONFIG_INTERWORKING
596
597 /* TODO: Separate configuration for ANQP? */
598 if (!hapd->conf->interworking)
599 return eid;
600
601 *pos++ = WLAN_EID_ADV_PROTO;
602 *pos++ = 2;
603 *pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
604 *pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
605 #endif /* CONFIG_INTERWORKING */
606
607 return pos;
608 }
609
610
hostapd_eid_roaming_consortium(struct hostapd_data * hapd,u8 * eid)611 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
612 {
613 u8 *pos = eid;
614 #ifdef CONFIG_INTERWORKING
615 u8 *len;
616 unsigned int i, count;
617
618 if (!hapd->conf->interworking ||
619 hapd->conf->roaming_consortium == NULL ||
620 hapd->conf->roaming_consortium_count == 0)
621 return eid;
622
623 *pos++ = WLAN_EID_ROAMING_CONSORTIUM;
624 len = pos++;
625
626 /* Number of ANQP OIs (in addition to the max 3 listed here) */
627 if (hapd->conf->roaming_consortium_count > 3 + 255)
628 *pos++ = 255;
629 else if (hapd->conf->roaming_consortium_count > 3)
630 *pos++ = hapd->conf->roaming_consortium_count - 3;
631 else
632 *pos++ = 0;
633
634 /* OU #1 and #2 Lengths */
635 *pos = hapd->conf->roaming_consortium[0].len;
636 if (hapd->conf->roaming_consortium_count > 1)
637 *pos |= hapd->conf->roaming_consortium[1].len << 4;
638 pos++;
639
640 if (hapd->conf->roaming_consortium_count > 3)
641 count = 3;
642 else
643 count = hapd->conf->roaming_consortium_count;
644
645 for (i = 0; i < count; i++) {
646 os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
647 hapd->conf->roaming_consortium[i].len);
648 pos += hapd->conf->roaming_consortium[i].len;
649 }
650
651 *len = pos - len - 1;
652 #endif /* CONFIG_INTERWORKING */
653
654 return pos;
655 }
656
657
hostapd_eid_time_adv(struct hostapd_data * hapd,u8 * eid)658 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
659 {
660 if (hapd->conf->time_advertisement != 2)
661 return eid;
662
663 if (hapd->time_adv == NULL &&
664 hostapd_update_time_adv(hapd) < 0)
665 return eid;
666
667 if (hapd->time_adv == NULL)
668 return eid;
669
670 os_memcpy(eid, wpabuf_head(hapd->time_adv),
671 wpabuf_len(hapd->time_adv));
672 eid += wpabuf_len(hapd->time_adv);
673
674 return eid;
675 }
676
677
hostapd_eid_time_zone(struct hostapd_data * hapd,u8 * eid)678 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
679 {
680 size_t len;
681
682 if (hapd->conf->time_advertisement != 2 || !hapd->conf->time_zone)
683 return eid;
684
685 len = os_strlen(hapd->conf->time_zone);
686
687 *eid++ = WLAN_EID_TIME_ZONE;
688 *eid++ = len;
689 os_memcpy(eid, hapd->conf->time_zone, len);
690 eid += len;
691
692 return eid;
693 }
694
695
hostapd_update_time_adv(struct hostapd_data * hapd)696 int hostapd_update_time_adv(struct hostapd_data *hapd)
697 {
698 const int elen = 2 + 1 + 10 + 5 + 1;
699 struct os_time t;
700 struct os_tm tm;
701 u8 *pos;
702
703 if (hapd->conf->time_advertisement != 2)
704 return 0;
705
706 if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
707 return -1;
708
709 if (!hapd->time_adv) {
710 hapd->time_adv = wpabuf_alloc(elen);
711 if (hapd->time_adv == NULL)
712 return -1;
713 pos = wpabuf_put(hapd->time_adv, elen);
714 } else
715 pos = wpabuf_mhead_u8(hapd->time_adv);
716
717 *pos++ = WLAN_EID_TIME_ADVERTISEMENT;
718 *pos++ = 1 + 10 + 5 + 1;
719
720 *pos++ = 2; /* UTC time at which the TSF timer is 0 */
721
722 /* Time Value at TSF 0 */
723 /* FIX: need to calculate this based on the current TSF value */
724 WPA_PUT_LE16(pos, tm.year); /* Year */
725 pos += 2;
726 *pos++ = tm.month; /* Month */
727 *pos++ = tm.day; /* Day of month */
728 *pos++ = tm.hour; /* Hours */
729 *pos++ = tm.min; /* Minutes */
730 *pos++ = tm.sec; /* Seconds */
731 WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
732 pos += 2;
733 *pos++ = 0; /* Reserved */
734
735 /* Time Error */
736 /* TODO: fill in an estimate on the error */
737 *pos++ = 0;
738 *pos++ = 0;
739 *pos++ = 0;
740 *pos++ = 0;
741 *pos++ = 0;
742
743 *pos++ = hapd->time_update_counter++;
744
745 return 0;
746 }
747
748
hostapd_eid_bss_max_idle_period(struct hostapd_data * hapd,u8 * eid)749 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid)
750 {
751 u8 *pos = eid;
752
753 #ifdef CONFIG_WNM_AP
754 if (hapd->conf->ap_max_inactivity > 0) {
755 unsigned int val;
756 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
757 *pos++ = 3;
758 val = hapd->conf->ap_max_inactivity;
759 if (val > 68000)
760 val = 68000;
761 val *= 1000;
762 val /= 1024;
763 if (val == 0)
764 val = 1;
765 if (val > 65535)
766 val = 65535;
767 WPA_PUT_LE16(pos, val);
768 pos += 2;
769 *pos++ = 0x00; /* TODO: Protected Keep-Alive Required */
770 }
771 #endif /* CONFIG_WNM_AP */
772
773 return pos;
774 }
775
776
777 #ifdef CONFIG_MBO
778
hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data * hapd,u8 * eid,size_t len,int delta)779 u8 * hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data *hapd, u8 *eid,
780 size_t len, int delta)
781 {
782 u8 mbo[4];
783
784 mbo[0] = OCE_ATTR_ID_RSSI_BASED_ASSOC_REJECT;
785 mbo[1] = 2;
786 /* Delta RSSI */
787 mbo[2] = delta;
788 /* Retry delay */
789 mbo[3] = hapd->iconf->rssi_reject_assoc_timeout;
790
791 return eid + mbo_add_ie(eid, len, mbo, 4);
792 }
793
794
hostapd_eid_mbo(struct hostapd_data * hapd,u8 * eid,size_t len)795 u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len)
796 {
797 u8 mbo[9], *mbo_pos = mbo;
798 u8 *pos = eid;
799
800 if (!hapd->conf->mbo_enabled &&
801 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
802 return eid;
803
804 if (hapd->conf->mbo_enabled) {
805 *mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND;
806 *mbo_pos++ = 1;
807 /* Not Cellular aware */
808 *mbo_pos++ = 0;
809 }
810
811 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
812 *mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW;
813 *mbo_pos++ = 1;
814 *mbo_pos++ = hapd->mbo_assoc_disallow;
815 }
816
817 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd)) {
818 u8 ctrl;
819
820 ctrl = OCE_RELEASE;
821 if (OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
822 ctrl |= OCE_IS_STA_CFON;
823
824 *mbo_pos++ = OCE_ATTR_ID_CAPA_IND;
825 *mbo_pos++ = 1;
826 *mbo_pos++ = ctrl;
827 }
828
829 pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo);
830
831 return pos;
832 }
833
834
hostapd_mbo_ie_len(struct hostapd_data * hapd)835 u8 hostapd_mbo_ie_len(struct hostapd_data *hapd)
836 {
837 u8 len;
838
839 if (!hapd->conf->mbo_enabled &&
840 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
841 return 0;
842
843 /*
844 * MBO IE header (6) + Capability Indication attribute (3) +
845 * Association Disallowed attribute (3) = 12
846 */
847 len = 6;
848 if (hapd->conf->mbo_enabled)
849 len += 3 + (hapd->mbo_assoc_disallow ? 3 : 0);
850
851 /* OCE capability indication attribute (3) */
852 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd))
853 len += 3;
854
855 return len;
856 }
857
858 #endif /* CONFIG_MBO */
859
860
861 #ifdef CONFIG_OWE
hostapd_eid_owe_trans_enabled(struct hostapd_data * hapd)862 static int hostapd_eid_owe_trans_enabled(struct hostapd_data *hapd)
863 {
864 return hapd->conf->owe_transition_ssid_len > 0 &&
865 !is_zero_ether_addr(hapd->conf->owe_transition_bssid);
866 }
867 #endif /* CONFIG_OWE */
868
869
hostapd_eid_owe_trans_len(struct hostapd_data * hapd)870 size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd)
871 {
872 #ifdef CONFIG_OWE
873 if (!hostapd_eid_owe_trans_enabled(hapd))
874 return 0;
875 return 6 + ETH_ALEN + 1 + hapd->conf->owe_transition_ssid_len;
876 #else /* CONFIG_OWE */
877 return 0;
878 #endif /* CONFIG_OWE */
879 }
880
881
hostapd_eid_owe_trans(struct hostapd_data * hapd,u8 * eid,size_t len)882 u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid,
883 size_t len)
884 {
885 #ifdef CONFIG_OWE
886 u8 *pos = eid;
887 size_t elen;
888
889 if (hapd->conf->owe_transition_ifname[0] &&
890 !hostapd_eid_owe_trans_enabled(hapd))
891 hostapd_owe_trans_get_info(hapd);
892
893 if (!hostapd_eid_owe_trans_enabled(hapd))
894 return pos;
895
896 elen = hostapd_eid_owe_trans_len(hapd);
897 if (len < elen) {
898 wpa_printf(MSG_DEBUG,
899 "OWE: Not enough room in the buffer for OWE IE");
900 return pos;
901 }
902
903 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
904 *pos++ = elen - 2;
905 WPA_PUT_BE24(pos, OUI_WFA);
906 pos += 3;
907 *pos++ = OWE_OUI_TYPE;
908 os_memcpy(pos, hapd->conf->owe_transition_bssid, ETH_ALEN);
909 pos += ETH_ALEN;
910 *pos++ = hapd->conf->owe_transition_ssid_len;
911 os_memcpy(pos, hapd->conf->owe_transition_ssid,
912 hapd->conf->owe_transition_ssid_len);
913 pos += hapd->conf->owe_transition_ssid_len;
914
915 return pos;
916 #else /* CONFIG_OWE */
917 return eid;
918 #endif /* CONFIG_OWE */
919 }
920
921
hostapd_eid_dpp_cc_len(struct hostapd_data * hapd)922 size_t hostapd_eid_dpp_cc_len(struct hostapd_data *hapd)
923 {
924 #ifdef CONFIG_DPP2
925 if (hapd->conf->dpp_configurator_connectivity)
926 return 6;
927 #endif /* CONFIG_DPP2 */
928 return 0;
929 }
930
931
hostapd_eid_dpp_cc(struct hostapd_data * hapd,u8 * eid,size_t len)932 u8 * hostapd_eid_dpp_cc(struct hostapd_data *hapd, u8 *eid, size_t len)
933 {
934 u8 *pos = eid;
935
936 #ifdef CONFIG_DPP2
937 if (!hapd->conf->dpp_configurator_connectivity || len < 6)
938 return pos;
939
940 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
941 *pos++ = 4;
942 WPA_PUT_BE24(pos, OUI_WFA);
943 pos += 3;
944 *pos++ = DPP_CC_OUI_TYPE;
945 #endif /* CONFIG_DPP2 */
946
947 return pos;
948 }
949
950
ap_copy_sta_supp_op_classes(struct sta_info * sta,const u8 * supp_op_classes,size_t supp_op_classes_len)951 void ap_copy_sta_supp_op_classes(struct sta_info *sta,
952 const u8 *supp_op_classes,
953 size_t supp_op_classes_len)
954 {
955 if (!supp_op_classes)
956 return;
957 os_free(sta->supp_op_classes);
958 sta->supp_op_classes = os_malloc(1 + supp_op_classes_len);
959 if (!sta->supp_op_classes)
960 return;
961
962 sta->supp_op_classes[0] = supp_op_classes_len;
963 os_memcpy(sta->supp_op_classes + 1, supp_op_classes,
964 supp_op_classes_len);
965 }
966
967
hostapd_eid_fils_indic(struct hostapd_data * hapd,u8 * eid,int hessid)968 u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid)
969 {
970 u8 *pos = eid;
971 #ifdef CONFIG_FILS
972 u8 *len;
973 u16 fils_info = 0;
974 size_t realms;
975 struct fils_realm *realm;
976
977 if (!(hapd->conf->wpa & WPA_PROTO_RSN) ||
978 !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
979 return pos;
980
981 realms = dl_list_len(&hapd->conf->fils_realms);
982 if (realms > 7)
983 realms = 7; /* 3 bit count field limits this to max 7 */
984
985 *pos++ = WLAN_EID_FILS_INDICATION;
986 len = pos++;
987 /* TODO: B0..B2: Number of Public Key Identifiers */
988 if (hapd->conf->erp_domain) {
989 /* B3..B5: Number of Realm Identifiers */
990 fils_info |= realms << 3;
991 }
992 /* TODO: B6: FILS IP Address Configuration */
993 if (hapd->conf->fils_cache_id_set)
994 fils_info |= BIT(7);
995 if (hessid && !is_zero_ether_addr(hapd->conf->hessid))
996 fils_info |= BIT(8); /* HESSID Included */
997 /* FILS Shared Key Authentication without PFS Supported */
998 fils_info |= BIT(9);
999 if (hapd->conf->fils_dh_group) {
1000 /* FILS Shared Key Authentication with PFS Supported */
1001 fils_info |= BIT(10);
1002 }
1003 /* TODO: B11: FILS Public Key Authentication Supported */
1004 /* B12..B15: Reserved */
1005 WPA_PUT_LE16(pos, fils_info);
1006 pos += 2;
1007 if (hapd->conf->fils_cache_id_set) {
1008 os_memcpy(pos, hapd->conf->fils_cache_id, FILS_CACHE_ID_LEN);
1009 pos += FILS_CACHE_ID_LEN;
1010 }
1011 if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) {
1012 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
1013 pos += ETH_ALEN;
1014 }
1015
1016 dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm,
1017 list) {
1018 if (realms == 0)
1019 break;
1020 realms--;
1021 os_memcpy(pos, realm->hash, 2);
1022 pos += 2;
1023 }
1024 *len = pos - len - 1;
1025 #endif /* CONFIG_FILS */
1026
1027 return pos;
1028 }
1029
1030
1031 #ifdef CONFIG_OCV
get_tx_parameters(struct sta_info * sta,int ap_max_chanwidth,int ap_seg1_idx,int * bandwidth,int * seg1_idx)1032 int get_tx_parameters(struct sta_info *sta, int ap_max_chanwidth,
1033 int ap_seg1_idx, int *bandwidth, int *seg1_idx)
1034 {
1035 int ht_40mhz = 0;
1036 int vht_80p80 = 0;
1037 int requested_bw;
1038
1039 if (sta->ht_capabilities)
1040 ht_40mhz = !!(sta->ht_capabilities->ht_capabilities_info &
1041 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET);
1042
1043 if (sta->vht_operation) {
1044 struct ieee80211_vht_operation *oper = sta->vht_operation;
1045
1046 /*
1047 * If a VHT Operation element was present, use it to determine
1048 * the supported channel bandwidth.
1049 */
1050 if (oper->vht_op_info_chwidth == 0) {
1051 requested_bw = ht_40mhz ? 40 : 20;
1052 } else if (oper->vht_op_info_chan_center_freq_seg1_idx == 0) {
1053 requested_bw = 80;
1054 } else {
1055 int diff;
1056
1057 requested_bw = 160;
1058 diff = abs((int)
1059 oper->vht_op_info_chan_center_freq_seg0_idx -
1060 (int)
1061 oper->vht_op_info_chan_center_freq_seg1_idx);
1062 vht_80p80 = oper->vht_op_info_chan_center_freq_seg1_idx
1063 != 0 && diff > 16;
1064 }
1065 } else if (sta->vht_capabilities) {
1066 struct ieee80211_vht_capabilities *capab;
1067 int vht_chanwidth;
1068
1069 capab = sta->vht_capabilities;
1070
1071 /*
1072 * If only the VHT Capabilities element is present (e.g., for
1073 * normal clients), use it to determine the supported channel
1074 * bandwidth.
1075 */
1076 vht_chanwidth = capab->vht_capabilities_info &
1077 VHT_CAP_SUPP_CHAN_WIDTH_MASK;
1078 vht_80p80 = capab->vht_capabilities_info &
1079 VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1080
1081 /* TODO: Also take into account Extended NSS BW Support field */
1082 requested_bw = vht_chanwidth ? 160 : 80;
1083 } else {
1084 requested_bw = ht_40mhz ? 40 : 20;
1085 }
1086
1087 *bandwidth = requested_bw < ap_max_chanwidth ?
1088 requested_bw : ap_max_chanwidth;
1089
1090 *seg1_idx = 0;
1091 if (ap_seg1_idx && vht_80p80)
1092 *seg1_idx = ap_seg1_idx;
1093
1094 return 0;
1095 }
1096 #endif /* CONFIG_OCV */
1097
1098
hostapd_eid_rsnxe(struct hostapd_data * hapd,u8 * eid,size_t len)1099 u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len)
1100 {
1101 u8 *pos = eid;
1102 bool sae_pk = false;
1103 u16 capab = 0;
1104 size_t flen;
1105
1106 if (!(hapd->conf->wpa & WPA_PROTO_RSN))
1107 return eid;
1108
1109 #ifdef CONFIG_SAE_PK
1110 sae_pk = hostapd_sae_pk_in_use(hapd->conf);
1111 #endif /* CONFIG_SAE_PK */
1112
1113 if (wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1114 (hapd->conf->sae_pwe == 1 || hapd->conf->sae_pwe == 2 ||
1115 hostapd_sae_pw_id_in_use(hapd->conf) || sae_pk) &&
1116 hapd->conf->sae_pwe != 3) {
1117 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1118 #ifdef CONFIG_SAE_PK
1119 if (sae_pk)
1120 capab |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
1121 #endif /* CONFIG_SAE_PK */
1122 }
1123
1124 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF)
1125 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1126 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT)
1127 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
1128 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG)
1129 capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG);
1130
1131 flen = (capab & 0xff00) ? 2 : 1;
1132 if (len < 2 + flen || !capab)
1133 return eid; /* no supported extended RSN capabilities */
1134 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
1135
1136 *pos++ = WLAN_EID_RSNX;
1137 *pos++ = flen;
1138 *pos++ = capab & 0x00ff;
1139 capab >>= 8;
1140 if (capab)
1141 *pos++ = capab;
1142
1143 return pos;
1144 }
1145