1 /*
2 * hostapd / Station table
3 * Copyright (c) 2002-2017, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/wpa_ctrl.h"
15 #include "common/sae.h"
16 #include "common/dpp.h"
17 #include "radius/radius.h"
18 #include "radius/radius_client.h"
19 #include "p2p/p2p.h"
20 #include "fst/fst.h"
21 #include "crypto/crypto.h"
22 #include "hostapd.h"
23 #include "accounting.h"
24 #include "ieee802_1x.h"
25 #include "ieee802_11.h"
26 #include "ieee802_11_auth.h"
27 #include "wpa_auth.h"
28 #include "preauth_auth.h"
29 #include "ap_config.h"
30 #include "beacon.h"
31 #include "ap_mlme.h"
32 #include "vlan_init.h"
33 #include "p2p_hostapd.h"
34 #include "ap_drv_ops.h"
35 #include "gas_serv.h"
36 #include "wnm_ap.h"
37 #include "mbo_ap.h"
38 #include "ndisc_snoop.h"
39 #include "sta_info.h"
40 #include "vlan.h"
41 #include "wps_hostapd.h"
42
43 static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd,
44 struct sta_info *sta);
45 static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx);
46 static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx);
47 static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx);
48 static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx);
49 static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx);
50 static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta);
51 static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx);
52
ap_for_each_sta(struct hostapd_data * hapd,int (* cb)(struct hostapd_data * hapd,struct sta_info * sta,void * ctx),void * ctx)53 int ap_for_each_sta(struct hostapd_data *hapd,
54 int (*cb)(struct hostapd_data *hapd, struct sta_info *sta,
55 void *ctx),
56 void *ctx)
57 {
58 struct sta_info *sta;
59
60 for (sta = hapd->sta_list; sta; sta = sta->next) {
61 if (cb(hapd, sta, ctx))
62 return 1;
63 }
64
65 return 0;
66 }
67
68
ap_get_sta(struct hostapd_data * hapd,const u8 * sta)69 struct sta_info * ap_get_sta(struct hostapd_data *hapd, const u8 *sta)
70 {
71 struct sta_info *s;
72
73 s = hapd->sta_hash[STA_HASH(sta)];
74 while (s != NULL && os_memcmp(s->addr, sta, 6) != 0)
75 s = s->hnext;
76 return s;
77 }
78
79
80 #ifdef CONFIG_P2P
ap_get_sta_p2p(struct hostapd_data * hapd,const u8 * addr)81 struct sta_info * ap_get_sta_p2p(struct hostapd_data *hapd, const u8 *addr)
82 {
83 struct sta_info *sta;
84
85 for (sta = hapd->sta_list; sta; sta = sta->next) {
86 const u8 *p2p_dev_addr;
87
88 if (sta->p2p_ie == NULL)
89 continue;
90
91 p2p_dev_addr = p2p_get_go_dev_addr(sta->p2p_ie);
92 if (p2p_dev_addr == NULL)
93 continue;
94
95 if (os_memcmp(p2p_dev_addr, addr, ETH_ALEN) == 0)
96 return sta;
97 }
98
99 return NULL;
100 }
101 #endif /* CONFIG_P2P */
102
103
ap_sta_list_del(struct hostapd_data * hapd,struct sta_info * sta)104 static void ap_sta_list_del(struct hostapd_data *hapd, struct sta_info *sta)
105 {
106 struct sta_info *tmp;
107
108 if (hapd->sta_list == sta) {
109 hapd->sta_list = sta->next;
110 return;
111 }
112
113 tmp = hapd->sta_list;
114 while (tmp != NULL && tmp->next != sta)
115 tmp = tmp->next;
116 if (tmp == NULL) {
117 wpa_printf(MSG_DEBUG, "Could not remove STA " MACSTR " from "
118 "list.", MAC2STR(sta->addr));
119 } else
120 tmp->next = sta->next;
121 }
122
123
ap_sta_hash_add(struct hostapd_data * hapd,struct sta_info * sta)124 void ap_sta_hash_add(struct hostapd_data *hapd, struct sta_info *sta)
125 {
126 sta->hnext = hapd->sta_hash[STA_HASH(sta->addr)];
127 hapd->sta_hash[STA_HASH(sta->addr)] = sta;
128 }
129
130
ap_sta_hash_del(struct hostapd_data * hapd,struct sta_info * sta)131 static void ap_sta_hash_del(struct hostapd_data *hapd, struct sta_info *sta)
132 {
133 struct sta_info *s;
134
135 s = hapd->sta_hash[STA_HASH(sta->addr)];
136 if (s == NULL) return;
137 if (os_memcmp(s->addr, sta->addr, 6) == 0) {
138 hapd->sta_hash[STA_HASH(sta->addr)] = s->hnext;
139 return;
140 }
141
142 while (s->hnext != NULL &&
143 os_memcmp(s->hnext->addr, sta->addr, ETH_ALEN) != 0)
144 s = s->hnext;
145 if (s->hnext != NULL)
146 s->hnext = s->hnext->hnext;
147 else
148 wpa_printf(MSG_DEBUG, "AP: could not remove STA " MACSTR
149 " from hash table", MAC2STR(sta->addr));
150 }
151
152
ap_sta_ip6addr_del(struct hostapd_data * hapd,struct sta_info * sta)153 void ap_sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta)
154 {
155 sta_ip6addr_del(hapd, sta);
156 }
157
158
159 #ifdef CONFIG_PASN
160
ap_free_sta_pasn(struct hostapd_data * hapd,struct sta_info * sta)161 void ap_free_sta_pasn(struct hostapd_data *hapd, struct sta_info *sta)
162 {
163 if (sta->pasn) {
164 wpa_printf(MSG_DEBUG, "PASN: Free PASN context: " MACSTR,
165 MAC2STR(sta->addr));
166
167 if (sta->pasn->ecdh)
168 crypto_ecdh_deinit(sta->pasn->ecdh);
169
170 wpabuf_free(sta->pasn->secret);
171 sta->pasn->secret = NULL;
172
173 #ifdef CONFIG_SAE
174 sae_clear_data(&sta->pasn->sae);
175 #endif /* CONFIG_SAE */
176
177 #ifdef CONFIG_FILS
178 /* In practice this pointer should be NULL */
179 wpabuf_free(sta->pasn->fils.erp_resp);
180 sta->pasn->fils.erp_resp = NULL;
181 #endif /* CONFIG_FILS */
182
183 bin_clear_free(sta->pasn, sizeof(*sta->pasn));
184 sta->pasn = NULL;
185 }
186 }
187
188 #endif /* CONFIG_PASN */
189
ap_free_sta(struct hostapd_data * hapd,struct sta_info * sta)190 void ap_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
191 {
192 int set_beacon = 0;
193
194 accounting_sta_stop(hapd, sta);
195
196 /* just in case */
197 ap_sta_set_authorized(hapd, sta, 0);
198 hostapd_set_sta_flags(hapd, sta);
199
200 if (sta->flags & (WLAN_STA_WDS | WLAN_STA_MULTI_AP))
201 hostapd_set_wds_sta(hapd, NULL, sta->addr, sta->aid, 0);
202
203 if (sta->ipaddr)
204 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
205 ap_sta_ip6addr_del(hapd, sta);
206
207 if (!hapd->iface->driver_ap_teardown &&
208 !(sta->flags & WLAN_STA_PREAUTH)) {
209 hostapd_drv_sta_remove(hapd, sta->addr);
210 sta->added_unassoc = 0;
211 }
212
213 ap_sta_hash_del(hapd, sta);
214 ap_sta_list_del(hapd, sta);
215
216 if (sta->aid > 0)
217 hapd->sta_aid[(sta->aid - 1) / 32] &=
218 ~BIT((sta->aid - 1) % 32);
219
220 hapd->num_sta--;
221 if (sta->nonerp_set) {
222 sta->nonerp_set = 0;
223 hapd->iface->num_sta_non_erp--;
224 if (hapd->iface->num_sta_non_erp == 0)
225 set_beacon++;
226 }
227
228 if (sta->no_short_slot_time_set) {
229 sta->no_short_slot_time_set = 0;
230 hapd->iface->num_sta_no_short_slot_time--;
231 if (hapd->iface->current_mode &&
232 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
233 && hapd->iface->num_sta_no_short_slot_time == 0)
234 set_beacon++;
235 }
236
237 if (sta->no_short_preamble_set) {
238 sta->no_short_preamble_set = 0;
239 hapd->iface->num_sta_no_short_preamble--;
240 if (hapd->iface->current_mode &&
241 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G
242 && hapd->iface->num_sta_no_short_preamble == 0)
243 set_beacon++;
244 }
245
246 if (sta->no_ht_gf_set) {
247 sta->no_ht_gf_set = 0;
248 hapd->iface->num_sta_ht_no_gf--;
249 }
250
251 if (sta->no_ht_set) {
252 sta->no_ht_set = 0;
253 hapd->iface->num_sta_no_ht--;
254 }
255
256 if (sta->ht_20mhz_set) {
257 sta->ht_20mhz_set = 0;
258 hapd->iface->num_sta_ht_20mhz--;
259 }
260
261 #ifdef CONFIG_TAXONOMY
262 wpabuf_free(sta->probe_ie_taxonomy);
263 sta->probe_ie_taxonomy = NULL;
264 wpabuf_free(sta->assoc_ie_taxonomy);
265 sta->assoc_ie_taxonomy = NULL;
266 #endif /* CONFIG_TAXONOMY */
267
268 ht40_intolerant_remove(hapd->iface, sta);
269
270 #ifdef CONFIG_P2P
271 if (sta->no_p2p_set) {
272 sta->no_p2p_set = 0;
273 hapd->num_sta_no_p2p--;
274 if (hapd->num_sta_no_p2p == 0)
275 hostapd_p2p_non_p2p_sta_disconnected(hapd);
276 }
277 #endif /* CONFIG_P2P */
278
279 #ifdef NEED_AP_MLME
280 if (hostapd_ht_operation_update(hapd->iface) > 0)
281 set_beacon++;
282 #endif /* NEED_AP_MLME */
283
284 #ifdef CONFIG_MESH
285 if (hapd->mesh_sta_free_cb)
286 hapd->mesh_sta_free_cb(hapd, sta);
287 #endif /* CONFIG_MESH */
288
289 if (set_beacon)
290 ieee802_11_set_beacons(hapd->iface);
291
292 wpa_printf(MSG_DEBUG, "%s: cancel ap_handle_timer for " MACSTR,
293 __func__, MAC2STR(sta->addr));
294 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
295 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
296 eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta);
297 ap_sta_clear_disconnect_timeouts(hapd, sta);
298 sae_clear_retransmit_timer(hapd, sta);
299
300 ieee802_1x_free_station(hapd, sta);
301 wpa_auth_sta_deinit(sta->wpa_sm);
302 rsn_preauth_free_station(hapd, sta);
303 #ifndef CONFIG_NO_RADIUS
304 if (hapd->radius)
305 radius_client_flush_auth(hapd->radius, sta->addr);
306 #endif /* CONFIG_NO_RADIUS */
307
308 #ifndef CONFIG_NO_VLAN
309 /*
310 * sta->wpa_sm->group needs to be released before so that
311 * vlan_remove_dynamic() can check that no stations are left on the
312 * AP_VLAN netdev.
313 */
314 if (sta->vlan_id)
315 vlan_remove_dynamic(hapd, sta->vlan_id);
316 if (sta->vlan_id_bound) {
317 /*
318 * Need to remove the STA entry before potentially removing the
319 * VLAN.
320 */
321 if (hapd->iface->driver_ap_teardown &&
322 !(sta->flags & WLAN_STA_PREAUTH)) {
323 hostapd_drv_sta_remove(hapd, sta->addr);
324 sta->added_unassoc = 0;
325 }
326 vlan_remove_dynamic(hapd, sta->vlan_id_bound);
327 }
328 #endif /* CONFIG_NO_VLAN */
329
330 os_free(sta->challenge);
331
332 os_free(sta->sa_query_trans_id);
333 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
334
335 #ifdef CONFIG_P2P
336 p2p_group_notif_disassoc(hapd->p2p_group, sta->addr);
337 #endif /* CONFIG_P2P */
338
339 #ifdef CONFIG_INTERWORKING
340 if (sta->gas_dialog) {
341 int i;
342 for (i = 0; i < GAS_DIALOG_MAX; i++)
343 gas_serv_dialog_clear(&sta->gas_dialog[i]);
344 os_free(sta->gas_dialog);
345 }
346 #endif /* CONFIG_INTERWORKING */
347
348 wpabuf_free(sta->wps_ie);
349 wpabuf_free(sta->p2p_ie);
350 wpabuf_free(sta->hs20_ie);
351 wpabuf_free(sta->roaming_consortium);
352 #ifdef CONFIG_FST
353 wpabuf_free(sta->mb_ies);
354 #endif /* CONFIG_FST */
355
356 os_free(sta->ht_capabilities);
357 os_free(sta->vht_capabilities);
358 os_free(sta->vht_operation);
359 os_free(sta->he_capab);
360 os_free(sta->he_6ghz_capab);
361 hostapd_free_psk_list(sta->psk);
362 os_free(sta->identity);
363 os_free(sta->radius_cui);
364 os_free(sta->remediation_url);
365 os_free(sta->t_c_url);
366 wpabuf_free(sta->hs20_deauth_req);
367 os_free(sta->hs20_session_info_url);
368
369 #ifdef CONFIG_SAE
370 sae_clear_data(sta->sae);
371 os_free(sta->sae);
372 #endif /* CONFIG_SAE */
373
374 mbo_ap_sta_free(sta);
375 os_free(sta->supp_op_classes);
376
377 #ifdef CONFIG_FILS
378 os_free(sta->fils_pending_assoc_req);
379 wpabuf_free(sta->fils_hlp_resp);
380 wpabuf_free(sta->hlp_dhcp_discover);
381 eloop_cancel_timeout(fils_hlp_timeout, hapd, sta);
382 #ifdef CONFIG_FILS_SK_PFS
383 crypto_ecdh_deinit(sta->fils_ecdh);
384 wpabuf_clear_free(sta->fils_dh_ss);
385 wpabuf_free(sta->fils_g_sta);
386 #endif /* CONFIG_FILS_SK_PFS */
387 #endif /* CONFIG_FILS */
388
389 #ifdef CONFIG_OWE
390 bin_clear_free(sta->owe_pmk, sta->owe_pmk_len);
391 crypto_ecdh_deinit(sta->owe_ecdh);
392 #endif /* CONFIG_OWE */
393
394 #ifdef CONFIG_DPP2
395 dpp_pfs_free(sta->dpp_pfs);
396 sta->dpp_pfs = NULL;
397 #endif /* CONFIG_DPP2 */
398
399 os_free(sta->ext_capability);
400
401 #ifdef CONFIG_WNM_AP
402 eloop_cancel_timeout(ap_sta_reset_steer_flag_timer, hapd, sta);
403 #endif /* CONFIG_WNM_AP */
404
405 #ifdef CONFIG_PASN
406 ap_free_sta_pasn(hapd, sta);
407 #endif /* CONFIG_PASN */
408
409 os_free(sta->ifname_wds);
410
411 #ifdef CONFIG_TESTING_OPTIONS
412 os_free(sta->sae_postponed_commit);
413 forced_memzero(sta->last_tk, WPA_TK_MAX_LEN);
414 #endif /* CONFIG_TESTING_OPTIONS */
415
416 os_free(sta);
417 }
418
419
hostapd_free_stas(struct hostapd_data * hapd)420 void hostapd_free_stas(struct hostapd_data *hapd)
421 {
422 struct sta_info *sta, *prev;
423
424 sta = hapd->sta_list;
425
426 while (sta) {
427 prev = sta;
428 if (sta->flags & WLAN_STA_AUTH) {
429 mlme_deauthenticate_indication(
430 hapd, sta, WLAN_REASON_UNSPECIFIED);
431 }
432 sta = sta->next;
433 wpa_printf(MSG_DEBUG, "Removing station " MACSTR,
434 MAC2STR(prev->addr));
435 ap_free_sta(hapd, prev);
436 }
437 }
438
439
440 /**
441 * ap_handle_timer - Per STA timer handler
442 * @eloop_ctx: struct hostapd_data *
443 * @timeout_ctx: struct sta_info *
444 *
445 * This function is called to check station activity and to remove inactive
446 * stations.
447 */
ap_handle_timer(void * eloop_ctx,void * timeout_ctx)448 void ap_handle_timer(void *eloop_ctx, void *timeout_ctx)
449 {
450 struct hostapd_data *hapd = eloop_ctx;
451 struct sta_info *sta = timeout_ctx;
452 unsigned long next_time = 0;
453 int reason;
454
455 wpa_printf(MSG_DEBUG, "%s: %s: " MACSTR " flags=0x%x timeout_next=%d",
456 hapd->conf->iface, __func__, MAC2STR(sta->addr), sta->flags,
457 sta->timeout_next);
458 if (sta->timeout_next == STA_REMOVE) {
459 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
460 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
461 "local deauth request");
462 ap_free_sta(hapd, sta);
463 return;
464 }
465
466 if ((sta->flags & WLAN_STA_ASSOC) &&
467 (sta->timeout_next == STA_NULLFUNC ||
468 sta->timeout_next == STA_DISASSOC)) {
469 int inactive_sec;
470 /*
471 * Add random value to timeout so that we don't end up bouncing
472 * all stations at the same time if we have lots of associated
473 * stations that are idle (but keep re-associating).
474 */
475 int fuzz = os_random() % 20;
476 inactive_sec = hostapd_drv_get_inact_sec(hapd, sta->addr);
477 if (inactive_sec == -1) {
478 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
479 "Check inactivity: Could not "
480 "get station info from kernel driver for "
481 MACSTR, MAC2STR(sta->addr));
482 /*
483 * The driver may not support this functionality.
484 * Anyway, try again after the next inactivity timeout,
485 * but do not disconnect the station now.
486 */
487 next_time = hapd->conf->ap_max_inactivity + fuzz;
488 } else if (inactive_sec == -ENOENT) {
489 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
490 "Station " MACSTR " has lost its driver entry",
491 MAC2STR(sta->addr));
492
493 /* Avoid sending client probe on removed client */
494 sta->timeout_next = STA_DISASSOC;
495 goto skip_poll;
496 } else if (inactive_sec < hapd->conf->ap_max_inactivity) {
497 /* station activity detected; reset timeout state */
498 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
499 "Station " MACSTR " has been active %is ago",
500 MAC2STR(sta->addr), inactive_sec);
501 sta->timeout_next = STA_NULLFUNC;
502 next_time = hapd->conf->ap_max_inactivity + fuzz -
503 inactive_sec;
504 } else {
505 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
506 "Station " MACSTR " has been "
507 "inactive too long: %d sec, max allowed: %d",
508 MAC2STR(sta->addr), inactive_sec,
509 hapd->conf->ap_max_inactivity);
510
511 if (hapd->conf->skip_inactivity_poll)
512 sta->timeout_next = STA_DISASSOC;
513 }
514 }
515
516 if ((sta->flags & WLAN_STA_ASSOC) &&
517 sta->timeout_next == STA_DISASSOC &&
518 !(sta->flags & WLAN_STA_PENDING_POLL) &&
519 !hapd->conf->skip_inactivity_poll) {
520 wpa_msg(hapd->msg_ctx, MSG_DEBUG, "Station " MACSTR
521 " has ACKed data poll", MAC2STR(sta->addr));
522 /* data nullfunc frame poll did not produce TX errors; assume
523 * station ACKed it */
524 sta->timeout_next = STA_NULLFUNC;
525 next_time = hapd->conf->ap_max_inactivity;
526 }
527
528 skip_poll:
529 if (next_time) {
530 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
531 "for " MACSTR " (%lu seconds)",
532 __func__, MAC2STR(sta->addr), next_time);
533 eloop_register_timeout(next_time, 0, ap_handle_timer, hapd,
534 sta);
535 return;
536 }
537
538 if (sta->timeout_next == STA_NULLFUNC &&
539 (sta->flags & WLAN_STA_ASSOC)) {
540 wpa_printf(MSG_DEBUG, " Polling STA");
541 sta->flags |= WLAN_STA_PENDING_POLL;
542 hostapd_drv_poll_client(hapd, hapd->own_addr, sta->addr,
543 sta->flags & WLAN_STA_WMM);
544 } else if (sta->timeout_next != STA_REMOVE) {
545 int deauth = sta->timeout_next == STA_DEAUTH;
546
547 if (!deauth && !(sta->flags & WLAN_STA_ASSOC)) {
548 /* Cannot disassociate not-associated STA, so move
549 * directly to deauthentication. */
550 sta->timeout_next = STA_DEAUTH;
551 deauth = 1;
552 }
553
554 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
555 "Timeout, sending %s info to STA " MACSTR,
556 deauth ? "deauthentication" : "disassociation",
557 MAC2STR(sta->addr));
558
559 if (deauth) {
560 hostapd_drv_sta_deauth(
561 hapd, sta->addr,
562 WLAN_REASON_PREV_AUTH_NOT_VALID);
563 } else {
564 reason = (sta->timeout_next == STA_DISASSOC) ?
565 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY :
566 WLAN_REASON_PREV_AUTH_NOT_VALID;
567
568 hostapd_drv_sta_disassoc(hapd, sta->addr, reason);
569 }
570 }
571
572 switch (sta->timeout_next) {
573 case STA_NULLFUNC:
574 sta->timeout_next = STA_DISASSOC;
575 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
576 "for " MACSTR " (%d seconds - AP_DISASSOC_DELAY)",
577 __func__, MAC2STR(sta->addr), AP_DISASSOC_DELAY);
578 eloop_register_timeout(AP_DISASSOC_DELAY, 0, ap_handle_timer,
579 hapd, sta);
580 break;
581 case STA_DISASSOC:
582 case STA_DISASSOC_FROM_CLI:
583 ap_sta_set_authorized(hapd, sta, 0);
584 sta->flags &= ~WLAN_STA_ASSOC;
585 hostapd_set_sta_flags(hapd, sta);
586 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
587 if (!sta->acct_terminate_cause)
588 sta->acct_terminate_cause =
589 RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT;
590 accounting_sta_stop(hapd, sta);
591 ieee802_1x_free_station(hapd, sta);
592 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
593 HOSTAPD_LEVEL_INFO, "disassociated due to "
594 "inactivity");
595 reason = (sta->timeout_next == STA_DISASSOC) ?
596 WLAN_REASON_DISASSOC_DUE_TO_INACTIVITY :
597 WLAN_REASON_PREV_AUTH_NOT_VALID;
598 sta->timeout_next = STA_DEAUTH;
599 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
600 "for " MACSTR " (%d seconds - AP_DEAUTH_DELAY)",
601 __func__, MAC2STR(sta->addr), AP_DEAUTH_DELAY);
602 eloop_register_timeout(AP_DEAUTH_DELAY, 0, ap_handle_timer,
603 hapd, sta);
604 mlme_disassociate_indication(hapd, sta, reason);
605 break;
606 case STA_DEAUTH:
607 case STA_REMOVE:
608 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
609 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
610 "inactivity (timer DEAUTH/REMOVE)");
611 if (!sta->acct_terminate_cause)
612 sta->acct_terminate_cause =
613 RADIUS_ACCT_TERMINATE_CAUSE_IDLE_TIMEOUT;
614 mlme_deauthenticate_indication(
615 hapd, sta,
616 WLAN_REASON_PREV_AUTH_NOT_VALID);
617 ap_free_sta(hapd, sta);
618 break;
619 }
620 }
621
622
ap_handle_session_timer(void * eloop_ctx,void * timeout_ctx)623 static void ap_handle_session_timer(void *eloop_ctx, void *timeout_ctx)
624 {
625 struct hostapd_data *hapd = eloop_ctx;
626 struct sta_info *sta = timeout_ctx;
627
628 wpa_printf(MSG_DEBUG, "%s: Session timer for STA " MACSTR,
629 hapd->conf->iface, MAC2STR(sta->addr));
630 if (!(sta->flags & (WLAN_STA_AUTH | WLAN_STA_ASSOC |
631 WLAN_STA_AUTHORIZED))) {
632 if (sta->flags & WLAN_STA_GAS) {
633 wpa_printf(MSG_DEBUG, "GAS: Remove temporary STA "
634 "entry " MACSTR, MAC2STR(sta->addr));
635 ap_free_sta(hapd, sta);
636 }
637 return;
638 }
639
640 hostapd_drv_sta_deauth(hapd, sta->addr,
641 WLAN_REASON_PREV_AUTH_NOT_VALID);
642 mlme_deauthenticate_indication(hapd, sta,
643 WLAN_REASON_PREV_AUTH_NOT_VALID);
644 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
645 HOSTAPD_LEVEL_INFO, "deauthenticated due to "
646 "session timeout");
647 sta->acct_terminate_cause =
648 RADIUS_ACCT_TERMINATE_CAUSE_SESSION_TIMEOUT;
649 ap_free_sta(hapd, sta);
650 }
651
652
ap_sta_replenish_timeout(struct hostapd_data * hapd,struct sta_info * sta,u32 session_timeout)653 void ap_sta_replenish_timeout(struct hostapd_data *hapd, struct sta_info *sta,
654 u32 session_timeout)
655 {
656 if (eloop_replenish_timeout(session_timeout, 0,
657 ap_handle_session_timer, hapd, sta) == 1) {
658 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
659 HOSTAPD_LEVEL_DEBUG, "setting session timeout "
660 "to %d seconds", session_timeout);
661 }
662 }
663
664
ap_sta_session_timeout(struct hostapd_data * hapd,struct sta_info * sta,u32 session_timeout)665 void ap_sta_session_timeout(struct hostapd_data *hapd, struct sta_info *sta,
666 u32 session_timeout)
667 {
668 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
669 HOSTAPD_LEVEL_DEBUG, "setting session timeout to %d "
670 "seconds", session_timeout);
671 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
672 eloop_register_timeout(session_timeout, 0, ap_handle_session_timer,
673 hapd, sta);
674 }
675
676
ap_sta_no_session_timeout(struct hostapd_data * hapd,struct sta_info * sta)677 void ap_sta_no_session_timeout(struct hostapd_data *hapd, struct sta_info *sta)
678 {
679 eloop_cancel_timeout(ap_handle_session_timer, hapd, sta);
680 }
681
682
ap_handle_session_warning_timer(void * eloop_ctx,void * timeout_ctx)683 static void ap_handle_session_warning_timer(void *eloop_ctx, void *timeout_ctx)
684 {
685 #ifdef CONFIG_WNM_AP
686 struct hostapd_data *hapd = eloop_ctx;
687 struct sta_info *sta = timeout_ctx;
688
689 wpa_printf(MSG_DEBUG, "%s: WNM: Session warning time reached for "
690 MACSTR, hapd->conf->iface, MAC2STR(sta->addr));
691 if (sta->hs20_session_info_url == NULL)
692 return;
693
694 wnm_send_ess_disassoc_imminent(hapd, sta, sta->hs20_session_info_url,
695 sta->hs20_disassoc_timer);
696 #endif /* CONFIG_WNM_AP */
697 }
698
699
ap_sta_session_warning_timeout(struct hostapd_data * hapd,struct sta_info * sta,int warning_time)700 void ap_sta_session_warning_timeout(struct hostapd_data *hapd,
701 struct sta_info *sta, int warning_time)
702 {
703 eloop_cancel_timeout(ap_handle_session_warning_timer, hapd, sta);
704 eloop_register_timeout(warning_time, 0, ap_handle_session_warning_timer,
705 hapd, sta);
706 }
707
708
ap_sta_add(struct hostapd_data * hapd,const u8 * addr)709 struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr)
710 {
711 struct sta_info *sta;
712 int i;
713
714 sta = ap_get_sta(hapd, addr);
715 if (sta)
716 return sta;
717
718 wpa_printf(MSG_DEBUG, " New STA");
719 if (hapd->num_sta >= hapd->conf->max_num_sta) {
720 /* FIX: might try to remove some old STAs first? */
721 wpa_printf(MSG_DEBUG, "no more room for new STAs (%d/%d)",
722 hapd->num_sta, hapd->conf->max_num_sta);
723 return NULL;
724 }
725
726 sta = os_zalloc(sizeof(struct sta_info));
727 if (sta == NULL) {
728 wpa_printf(MSG_ERROR, "malloc failed");
729 return NULL;
730 }
731 sta->acct_interim_interval = hapd->conf->acct_interim_interval;
732 if (accounting_sta_get_id(hapd, sta) < 0) {
733 os_free(sta);
734 return NULL;
735 }
736
737 for (i = 0; i < WLAN_SUPP_RATES_MAX; i++) {
738 if (!hapd->iface->basic_rates)
739 break;
740 if (hapd->iface->basic_rates[i] < 0)
741 break;
742 sta->supported_rates[i] = hapd->iface->basic_rates[i] / 5;
743 }
744 sta->supported_rates_len = i;
745
746 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_INACTIVITY_TIMER)) {
747 wpa_printf(MSG_DEBUG, "%s: register ap_handle_timer timeout "
748 "for " MACSTR " (%d seconds - ap_max_inactivity)",
749 __func__, MAC2STR(addr),
750 hapd->conf->ap_max_inactivity);
751 eloop_register_timeout(hapd->conf->ap_max_inactivity, 0,
752 ap_handle_timer, hapd, sta);
753 }
754
755 /* initialize STA info data */
756 os_memcpy(sta->addr, addr, ETH_ALEN);
757 sta->next = hapd->sta_list;
758 hapd->sta_list = sta;
759 hapd->num_sta++;
760 ap_sta_hash_add(hapd, sta);
761 ap_sta_remove_in_other_bss(hapd, sta);
762 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
763 dl_list_init(&sta->ip6addr);
764
765 #ifdef CONFIG_TAXONOMY
766 sta_track_claim_taxonomy_info(hapd->iface, addr,
767 &sta->probe_ie_taxonomy);
768 #endif /* CONFIG_TAXONOMY */
769
770 return sta;
771 }
772
773
ap_sta_remove(struct hostapd_data * hapd,struct sta_info * sta)774 static int ap_sta_remove(struct hostapd_data *hapd, struct sta_info *sta)
775 {
776 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
777
778 if (sta->ipaddr)
779 hostapd_drv_br_delete_ip_neigh(hapd, 4, (u8 *) &sta->ipaddr);
780 ap_sta_ip6addr_del(hapd, sta);
781
782 wpa_printf(MSG_DEBUG, "%s: Removing STA " MACSTR " from kernel driver",
783 hapd->conf->iface, MAC2STR(sta->addr));
784 if (hostapd_drv_sta_remove(hapd, sta->addr) &&
785 sta->flags & WLAN_STA_ASSOC) {
786 wpa_printf(MSG_DEBUG, "%s: Could not remove station " MACSTR
787 " from kernel driver",
788 hapd->conf->iface, MAC2STR(sta->addr));
789 return -1;
790 }
791 sta->added_unassoc = 0;
792 return 0;
793 }
794
795
ap_sta_remove_in_other_bss(struct hostapd_data * hapd,struct sta_info * sta)796 static void ap_sta_remove_in_other_bss(struct hostapd_data *hapd,
797 struct sta_info *sta)
798 {
799 struct hostapd_iface *iface = hapd->iface;
800 size_t i;
801
802 for (i = 0; i < iface->num_bss; i++) {
803 struct hostapd_data *bss = iface->bss[i];
804 struct sta_info *sta2;
805 /* bss should always be set during operation, but it may be
806 * NULL during reconfiguration. Assume the STA is not
807 * associated to another BSS in that case to avoid NULL pointer
808 * dereferences. */
809 if (bss == hapd || bss == NULL)
810 continue;
811 sta2 = ap_get_sta(bss, sta->addr);
812 if (!sta2)
813 continue;
814
815 wpa_printf(MSG_DEBUG, "%s: disconnect old STA " MACSTR
816 " association from another BSS %s",
817 hapd->conf->iface, MAC2STR(sta2->addr),
818 bss->conf->iface);
819 ap_sta_disconnect(bss, sta2, sta2->addr,
820 WLAN_REASON_PREV_AUTH_NOT_VALID);
821 }
822 }
823
824
ap_sta_disassoc_cb_timeout(void * eloop_ctx,void * timeout_ctx)825 static void ap_sta_disassoc_cb_timeout(void *eloop_ctx, void *timeout_ctx)
826 {
827 struct hostapd_data *hapd = eloop_ctx;
828 struct sta_info *sta = timeout_ctx;
829
830 wpa_printf(MSG_DEBUG, "%s: Disassociation callback for STA " MACSTR,
831 hapd->conf->iface, MAC2STR(sta->addr));
832 ap_sta_remove(hapd, sta);
833 mlme_disassociate_indication(hapd, sta, sta->disassoc_reason);
834 }
835
836
ap_sta_disassociate(struct hostapd_data * hapd,struct sta_info * sta,u16 reason)837 void ap_sta_disassociate(struct hostapd_data *hapd, struct sta_info *sta,
838 u16 reason)
839 {
840 wpa_printf(MSG_DEBUG, "%s: disassociate STA " MACSTR,
841 hapd->conf->iface, MAC2STR(sta->addr));
842 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
843 if (hapd->iface->current_mode &&
844 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
845 /* Skip deauthentication in DMG/IEEE 802.11ad */
846 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC |
847 WLAN_STA_ASSOC_REQ_OK);
848 sta->timeout_next = STA_REMOVE;
849 } else {
850 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
851 sta->timeout_next = STA_DEAUTH;
852 }
853 ap_sta_set_authorized(hapd, sta, 0);
854 hostapd_set_sta_flags(hapd, sta);
855 wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout "
856 "for " MACSTR " (%d seconds - "
857 "AP_MAX_INACTIVITY_AFTER_DISASSOC)",
858 __func__, MAC2STR(sta->addr),
859 AP_MAX_INACTIVITY_AFTER_DISASSOC);
860 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
861 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DISASSOC, 0,
862 ap_handle_timer, hapd, sta);
863 accounting_sta_stop(hapd, sta);
864 ieee802_1x_free_station(hapd, sta);
865 wpa_auth_sta_deinit(sta->wpa_sm);
866 sta->wpa_sm = NULL;
867
868 sta->disassoc_reason = reason;
869 sta->flags |= WLAN_STA_PENDING_DISASSOC_CB;
870 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
871 eloop_register_timeout(hapd->iface->drv_flags &
872 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
873 ap_sta_disassoc_cb_timeout, hapd, sta);
874 }
875
876
ap_sta_deauth_cb_timeout(void * eloop_ctx,void * timeout_ctx)877 static void ap_sta_deauth_cb_timeout(void *eloop_ctx, void *timeout_ctx)
878 {
879 struct hostapd_data *hapd = eloop_ctx;
880 struct sta_info *sta = timeout_ctx;
881
882 wpa_printf(MSG_DEBUG, "%s: Deauthentication callback for STA " MACSTR,
883 hapd->conf->iface, MAC2STR(sta->addr));
884 ap_sta_remove(hapd, sta);
885 mlme_deauthenticate_indication(hapd, sta, sta->deauth_reason);
886 }
887
888
ap_sta_deauthenticate(struct hostapd_data * hapd,struct sta_info * sta,u16 reason)889 void ap_sta_deauthenticate(struct hostapd_data *hapd, struct sta_info *sta,
890 u16 reason)
891 {
892 if (hapd->iface->current_mode &&
893 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
894 /* Deauthentication is not used in DMG/IEEE 802.11ad;
895 * disassociate the STA instead. */
896 ap_sta_disassociate(hapd, sta, reason);
897 return;
898 }
899
900 wpa_printf(MSG_DEBUG, "%s: deauthenticate STA " MACSTR,
901 hapd->conf->iface, MAC2STR(sta->addr));
902 sta->last_seq_ctrl = WLAN_INVALID_MGMT_SEQ;
903 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC | WLAN_STA_ASSOC_REQ_OK);
904 ap_sta_set_authorized(hapd, sta, 0);
905 hostapd_set_sta_flags(hapd, sta);
906 sta->timeout_next = STA_REMOVE;
907 wpa_printf(MSG_DEBUG, "%s: reschedule ap_handle_timer timeout "
908 "for " MACSTR " (%d seconds - "
909 "AP_MAX_INACTIVITY_AFTER_DEAUTH)",
910 __func__, MAC2STR(sta->addr),
911 AP_MAX_INACTIVITY_AFTER_DEAUTH);
912 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
913 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0,
914 ap_handle_timer, hapd, sta);
915 accounting_sta_stop(hapd, sta);
916 ieee802_1x_free_station(hapd, sta);
917
918 sta->deauth_reason = reason;
919 sta->flags |= WLAN_STA_PENDING_DEAUTH_CB;
920 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
921 eloop_register_timeout(hapd->iface->drv_flags &
922 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
923 ap_sta_deauth_cb_timeout, hapd, sta);
924 }
925
926
927 #ifdef CONFIG_WPS
ap_sta_wps_cancel(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)928 int ap_sta_wps_cancel(struct hostapd_data *hapd,
929 struct sta_info *sta, void *ctx)
930 {
931 if (sta && (sta->flags & WLAN_STA_WPS)) {
932 ap_sta_deauthenticate(hapd, sta,
933 WLAN_REASON_PREV_AUTH_NOT_VALID);
934 wpa_printf(MSG_DEBUG, "WPS: %s: Deauth sta=" MACSTR,
935 __func__, MAC2STR(sta->addr));
936 return 1;
937 }
938
939 return 0;
940 }
941 #endif /* CONFIG_WPS */
942
943
ap_sta_get_free_vlan_id(struct hostapd_data * hapd)944 static int ap_sta_get_free_vlan_id(struct hostapd_data *hapd)
945 {
946 struct hostapd_vlan *vlan;
947 int vlan_id = MAX_VLAN_ID + 2;
948
949 retry:
950 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
951 if (vlan->vlan_id == vlan_id) {
952 vlan_id++;
953 goto retry;
954 }
955 }
956 return vlan_id;
957 }
958
959
ap_sta_set_vlan(struct hostapd_data * hapd,struct sta_info * sta,struct vlan_description * vlan_desc)960 int ap_sta_set_vlan(struct hostapd_data *hapd, struct sta_info *sta,
961 struct vlan_description *vlan_desc)
962 {
963 struct hostapd_vlan *vlan = NULL, *wildcard_vlan = NULL;
964 int old_vlan_id, vlan_id = 0, ret = 0;
965
966 /* Check if there is something to do */
967 if (hapd->conf->ssid.per_sta_vif && !sta->vlan_id) {
968 /* This sta is lacking its own vif */
969 } else if (hapd->conf->ssid.dynamic_vlan == DYNAMIC_VLAN_DISABLED &&
970 !hapd->conf->ssid.per_sta_vif && sta->vlan_id) {
971 /* sta->vlan_id needs to be reset */
972 } else if (!vlan_compare(vlan_desc, sta->vlan_desc)) {
973 return 0; /* nothing to change */
974 }
975
976 /* Now the real VLAN changed or the STA just needs its own vif */
977 if (hapd->conf->ssid.per_sta_vif) {
978 /* Assign a new vif, always */
979 /* find a free vlan_id sufficiently big */
980 vlan_id = ap_sta_get_free_vlan_id(hapd);
981 /* Get wildcard VLAN */
982 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
983 if (vlan->vlan_id == VLAN_ID_WILDCARD)
984 break;
985 }
986 if (!vlan) {
987 hostapd_logger(hapd, sta->addr,
988 HOSTAPD_MODULE_IEEE80211,
989 HOSTAPD_LEVEL_DEBUG,
990 "per_sta_vif missing wildcard");
991 vlan_id = 0;
992 ret = -1;
993 goto done;
994 }
995 } else if (vlan_desc && vlan_desc->notempty) {
996 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
997 if (!vlan_compare(&vlan->vlan_desc, vlan_desc))
998 break;
999 if (vlan->vlan_id == VLAN_ID_WILDCARD)
1000 wildcard_vlan = vlan;
1001 }
1002 if (vlan) {
1003 vlan_id = vlan->vlan_id;
1004 } else if (wildcard_vlan) {
1005 vlan = wildcard_vlan;
1006 vlan_id = vlan_desc->untagged;
1007 if (vlan_desc->tagged[0]) {
1008 /* Tagged VLAN configuration */
1009 vlan_id = ap_sta_get_free_vlan_id(hapd);
1010 }
1011 } else {
1012 hostapd_logger(hapd, sta->addr,
1013 HOSTAPD_MODULE_IEEE80211,
1014 HOSTAPD_LEVEL_DEBUG,
1015 "missing vlan and wildcard for vlan=%d%s",
1016 vlan_desc->untagged,
1017 vlan_desc->tagged[0] ? "+" : "");
1018 vlan_id = 0;
1019 ret = -1;
1020 goto done;
1021 }
1022 }
1023
1024 if (vlan && vlan->vlan_id == VLAN_ID_WILDCARD) {
1025 vlan = vlan_add_dynamic(hapd, vlan, vlan_id, vlan_desc);
1026 if (vlan == NULL) {
1027 hostapd_logger(hapd, sta->addr,
1028 HOSTAPD_MODULE_IEEE80211,
1029 HOSTAPD_LEVEL_DEBUG,
1030 "could not add dynamic VLAN interface for vlan=%d%s",
1031 vlan_desc ? vlan_desc->untagged : -1,
1032 (vlan_desc && vlan_desc->tagged[0]) ?
1033 "+" : "");
1034 vlan_id = 0;
1035 ret = -1;
1036 goto done;
1037 }
1038
1039 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1040 HOSTAPD_LEVEL_DEBUG,
1041 "added new dynamic VLAN interface '%s'",
1042 vlan->ifname);
1043 } else if (vlan && vlan->dynamic_vlan > 0) {
1044 vlan->dynamic_vlan++;
1045 hostapd_logger(hapd, sta->addr,
1046 HOSTAPD_MODULE_IEEE80211,
1047 HOSTAPD_LEVEL_DEBUG,
1048 "updated existing dynamic VLAN interface '%s'",
1049 vlan->ifname);
1050 }
1051 done:
1052 old_vlan_id = sta->vlan_id;
1053 sta->vlan_id = vlan_id;
1054 sta->vlan_desc = vlan ? &vlan->vlan_desc : NULL;
1055
1056 if (vlan_id != old_vlan_id && old_vlan_id)
1057 vlan_remove_dynamic(hapd, old_vlan_id);
1058
1059 return ret;
1060 }
1061
1062
ap_sta_bind_vlan(struct hostapd_data * hapd,struct sta_info * sta)1063 int ap_sta_bind_vlan(struct hostapd_data *hapd, struct sta_info *sta)
1064 {
1065 #ifndef CONFIG_NO_VLAN
1066 const char *iface;
1067 struct hostapd_vlan *vlan = NULL;
1068 int ret;
1069 int old_vlanid = sta->vlan_id_bound;
1070
1071 if ((sta->flags & WLAN_STA_WDS) && sta->vlan_id == 0) {
1072 wpa_printf(MSG_DEBUG,
1073 "Do not override WDS VLAN assignment for STA "
1074 MACSTR, MAC2STR(sta->addr));
1075 return 0;
1076 }
1077
1078 iface = hapd->conf->iface;
1079 if (hapd->conf->ssid.vlan[0])
1080 iface = hapd->conf->ssid.vlan;
1081
1082 if (sta->vlan_id > 0) {
1083 for (vlan = hapd->conf->vlan; vlan; vlan = vlan->next) {
1084 if (vlan->vlan_id == sta->vlan_id)
1085 break;
1086 }
1087 if (vlan)
1088 iface = vlan->ifname;
1089 }
1090
1091 /*
1092 * Do not increment ref counters if the VLAN ID remains same, but do
1093 * not skip hostapd_drv_set_sta_vlan() as hostapd_drv_sta_remove() might
1094 * have been called before.
1095 */
1096 if (sta->vlan_id == old_vlanid)
1097 goto skip_counting;
1098
1099 if (sta->vlan_id > 0 && !vlan &&
1100 !(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_VLAN_OFFLOAD)) {
1101 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1102 HOSTAPD_LEVEL_DEBUG, "could not find VLAN for "
1103 "binding station to (vlan_id=%d)",
1104 sta->vlan_id);
1105 ret = -1;
1106 goto done;
1107 } else if (vlan && vlan->dynamic_vlan > 0) {
1108 vlan->dynamic_vlan++;
1109 hostapd_logger(hapd, sta->addr,
1110 HOSTAPD_MODULE_IEEE80211,
1111 HOSTAPD_LEVEL_DEBUG,
1112 "updated existing dynamic VLAN interface '%s'",
1113 iface);
1114 }
1115
1116 /* ref counters have been increased, so mark the station */
1117 sta->vlan_id_bound = sta->vlan_id;
1118
1119 skip_counting:
1120 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1121 HOSTAPD_LEVEL_DEBUG, "binding station to interface "
1122 "'%s'", iface);
1123
1124 if (wpa_auth_sta_set_vlan(sta->wpa_sm, sta->vlan_id) < 0)
1125 wpa_printf(MSG_INFO, "Failed to update VLAN-ID for WPA");
1126
1127 ret = hostapd_drv_set_sta_vlan(iface, hapd, sta->addr, sta->vlan_id);
1128 if (ret < 0) {
1129 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1130 HOSTAPD_LEVEL_DEBUG, "could not bind the STA "
1131 "entry to vlan_id=%d", sta->vlan_id);
1132 }
1133
1134 /* During 1x reauth, if the vlan id changes, then remove the old id. */
1135 if (old_vlanid > 0 && old_vlanid != sta->vlan_id)
1136 vlan_remove_dynamic(hapd, old_vlanid);
1137 done:
1138
1139 return ret;
1140 #else /* CONFIG_NO_VLAN */
1141 return 0;
1142 #endif /* CONFIG_NO_VLAN */
1143 }
1144
1145
ap_check_sa_query_timeout(struct hostapd_data * hapd,struct sta_info * sta)1146 int ap_check_sa_query_timeout(struct hostapd_data *hapd, struct sta_info *sta)
1147 {
1148 u32 tu;
1149 struct os_reltime now, passed;
1150 os_get_reltime(&now);
1151 os_reltime_sub(&now, &sta->sa_query_start, &passed);
1152 tu = (passed.sec * 1000000 + passed.usec) / 1024;
1153 if (hapd->conf->assoc_sa_query_max_timeout < tu) {
1154 hostapd_logger(hapd, sta->addr,
1155 HOSTAPD_MODULE_IEEE80211,
1156 HOSTAPD_LEVEL_DEBUG,
1157 "association SA Query timed out");
1158 sta->sa_query_timed_out = 1;
1159 os_free(sta->sa_query_trans_id);
1160 sta->sa_query_trans_id = NULL;
1161 sta->sa_query_count = 0;
1162 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
1163 return 1;
1164 }
1165
1166 return 0;
1167 }
1168
1169
ap_sa_query_timer(void * eloop_ctx,void * timeout_ctx)1170 static void ap_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
1171 {
1172 struct hostapd_data *hapd = eloop_ctx;
1173 struct sta_info *sta = timeout_ctx;
1174 unsigned int timeout, sec, usec;
1175 u8 *trans_id, *nbuf;
1176
1177 wpa_printf(MSG_DEBUG, "%s: SA Query timer for STA " MACSTR
1178 " (count=%d)",
1179 hapd->conf->iface, MAC2STR(sta->addr), sta->sa_query_count);
1180
1181 if (sta->sa_query_count > 0 &&
1182 ap_check_sa_query_timeout(hapd, sta))
1183 return;
1184 if (sta->sa_query_count >= 1000)
1185 return;
1186
1187 nbuf = os_realloc_array(sta->sa_query_trans_id,
1188 sta->sa_query_count + 1,
1189 WLAN_SA_QUERY_TR_ID_LEN);
1190 if (nbuf == NULL)
1191 return;
1192 if (sta->sa_query_count == 0) {
1193 /* Starting a new SA Query procedure */
1194 os_get_reltime(&sta->sa_query_start);
1195 }
1196 trans_id = nbuf + sta->sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
1197 sta->sa_query_trans_id = nbuf;
1198 sta->sa_query_count++;
1199
1200 if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
1201 /*
1202 * We don't really care which ID is used here, so simply
1203 * hardcode this if the mostly theoretical os_get_random()
1204 * failure happens.
1205 */
1206 trans_id[0] = 0x12;
1207 trans_id[1] = 0x34;
1208 }
1209
1210 timeout = hapd->conf->assoc_sa_query_retry_timeout;
1211 sec = ((timeout / 1000) * 1024) / 1000;
1212 usec = (timeout % 1000) * 1024;
1213 eloop_register_timeout(sec, usec, ap_sa_query_timer, hapd, sta);
1214
1215 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
1216 HOSTAPD_LEVEL_DEBUG,
1217 "association SA Query attempt %d", sta->sa_query_count);
1218
1219 ieee802_11_send_sa_query_req(hapd, sta->addr, trans_id);
1220 }
1221
1222
ap_sta_start_sa_query(struct hostapd_data * hapd,struct sta_info * sta)1223 void ap_sta_start_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
1224 {
1225 ap_sa_query_timer(hapd, sta);
1226 }
1227
1228
ap_sta_stop_sa_query(struct hostapd_data * hapd,struct sta_info * sta)1229 void ap_sta_stop_sa_query(struct hostapd_data *hapd, struct sta_info *sta)
1230 {
1231 eloop_cancel_timeout(ap_sa_query_timer, hapd, sta);
1232 os_free(sta->sa_query_trans_id);
1233 sta->sa_query_trans_id = NULL;
1234 sta->sa_query_count = 0;
1235 }
1236
1237
ap_sta_wpa_get_keyid(struct hostapd_data * hapd,struct sta_info * sta)1238 const char * ap_sta_wpa_get_keyid(struct hostapd_data *hapd,
1239 struct sta_info *sta)
1240 {
1241 struct hostapd_wpa_psk *psk;
1242 struct hostapd_ssid *ssid;
1243 const u8 *pmk;
1244 int pmk_len;
1245
1246 ssid = &hapd->conf->ssid;
1247
1248 pmk = wpa_auth_get_pmk(sta->wpa_sm, &pmk_len);
1249 if (!pmk || pmk_len != PMK_LEN)
1250 return NULL;
1251
1252 for (psk = ssid->wpa_psk; psk; psk = psk->next)
1253 if (os_memcmp(pmk, psk->psk, PMK_LEN) == 0)
1254 break;
1255 if (!psk || !psk->keyid[0])
1256 return NULL;
1257
1258 return psk->keyid;
1259 }
1260
1261
ap_sta_set_authorized(struct hostapd_data * hapd,struct sta_info * sta,int authorized)1262 void ap_sta_set_authorized(struct hostapd_data *hapd, struct sta_info *sta,
1263 int authorized)
1264 {
1265 const u8 *dev_addr = NULL;
1266 char buf[100];
1267 #ifdef CONFIG_P2P
1268 u8 addr[ETH_ALEN];
1269 u8 ip_addr_buf[4];
1270 #endif /* CONFIG_P2P */
1271
1272 if (!!authorized == !!(sta->flags & WLAN_STA_AUTHORIZED))
1273 return;
1274
1275 if (authorized)
1276 sta->flags |= WLAN_STA_AUTHORIZED;
1277 else
1278 sta->flags &= ~WLAN_STA_AUTHORIZED;
1279
1280 #ifdef CONFIG_P2P
1281 if (hapd->p2p_group == NULL) {
1282 if (sta->p2p_ie != NULL &&
1283 p2p_parse_dev_addr_in_p2p_ie(sta->p2p_ie, addr) == 0)
1284 dev_addr = addr;
1285 } else
1286 dev_addr = p2p_group_get_dev_addr(hapd->p2p_group, sta->addr);
1287
1288 if (dev_addr)
1289 os_snprintf(buf, sizeof(buf), MACSTR " p2p_dev_addr=" MACSTR,
1290 MAC2STR(sta->addr), MAC2STR(dev_addr));
1291 else
1292 #endif /* CONFIG_P2P */
1293 os_snprintf(buf, sizeof(buf), MACSTR, MAC2STR(sta->addr));
1294
1295 if (hapd->sta_authorized_cb)
1296 hapd->sta_authorized_cb(hapd->sta_authorized_cb_ctx,
1297 sta->addr, authorized, dev_addr);
1298
1299 if (authorized) {
1300 const char *keyid;
1301 char keyid_buf[100];
1302 char ip_addr[100];
1303
1304 keyid_buf[0] = '\0';
1305 ip_addr[0] = '\0';
1306 #ifdef CONFIG_P2P
1307 if (wpa_auth_get_ip_addr(sta->wpa_sm, ip_addr_buf) == 0) {
1308 os_snprintf(ip_addr, sizeof(ip_addr),
1309 " ip_addr=%u.%u.%u.%u",
1310 ip_addr_buf[0], ip_addr_buf[1],
1311 ip_addr_buf[2], ip_addr_buf[3]);
1312 }
1313 #endif /* CONFIG_P2P */
1314
1315 keyid = ap_sta_wpa_get_keyid(hapd, sta);
1316 if (keyid) {
1317 os_snprintf(keyid_buf, sizeof(keyid_buf),
1318 " keyid=%s", keyid);
1319 }
1320
1321 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_CONNECTED "%s%s%s",
1322 buf, ip_addr, keyid_buf);
1323
1324 if (hapd->msg_ctx_parent &&
1325 hapd->msg_ctx_parent != hapd->msg_ctx)
1326 wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
1327 AP_STA_CONNECTED "%s%s%s",
1328 buf, ip_addr, keyid_buf);
1329 } else {
1330 wpa_msg(hapd->msg_ctx, MSG_INFO, AP_STA_DISCONNECTED "%s", buf);
1331
1332 if (hapd->msg_ctx_parent &&
1333 hapd->msg_ctx_parent != hapd->msg_ctx)
1334 wpa_msg_no_global(hapd->msg_ctx_parent, MSG_INFO,
1335 AP_STA_DISCONNECTED "%s", buf);
1336 }
1337
1338 #ifdef CONFIG_FST
1339 if (hapd->iface->fst) {
1340 if (authorized)
1341 fst_notify_peer_connected(hapd->iface->fst, sta->addr);
1342 else
1343 fst_notify_peer_disconnected(hapd->iface->fst,
1344 sta->addr);
1345 }
1346 #endif /* CONFIG_FST */
1347 }
1348
1349
ap_sta_disconnect(struct hostapd_data * hapd,struct sta_info * sta,const u8 * addr,u16 reason)1350 void ap_sta_disconnect(struct hostapd_data *hapd, struct sta_info *sta,
1351 const u8 *addr, u16 reason)
1352 {
1353 if (sta)
1354 wpa_printf(MSG_DEBUG, "%s: %s STA " MACSTR " reason=%u",
1355 hapd->conf->iface, __func__, MAC2STR(sta->addr),
1356 reason);
1357 else if (addr)
1358 wpa_printf(MSG_DEBUG, "%s: %s addr " MACSTR " reason=%u",
1359 hapd->conf->iface, __func__, MAC2STR(addr),
1360 reason);
1361
1362 if (sta == NULL && addr)
1363 sta = ap_get_sta(hapd, addr);
1364
1365 if (addr)
1366 hostapd_drv_sta_deauth(hapd, addr, reason);
1367
1368 if (sta == NULL)
1369 return;
1370 ap_sta_set_authorized(hapd, sta, 0);
1371 sta->flags &= ~(WLAN_STA_AUTH | WLAN_STA_ASSOC);
1372 hostapd_set_sta_flags(hapd, sta);
1373 wpa_auth_sm_event(sta->wpa_sm, WPA_DEAUTH);
1374 ieee802_1x_notify_port_enabled(sta->eapol_sm, 0);
1375 wpa_printf(MSG_DEBUG, "%s: %s: reschedule ap_handle_timer timeout "
1376 "for " MACSTR " (%d seconds - "
1377 "AP_MAX_INACTIVITY_AFTER_DEAUTH)",
1378 hapd->conf->iface, __func__, MAC2STR(sta->addr),
1379 AP_MAX_INACTIVITY_AFTER_DEAUTH);
1380 eloop_cancel_timeout(ap_handle_timer, hapd, sta);
1381 eloop_register_timeout(AP_MAX_INACTIVITY_AFTER_DEAUTH, 0,
1382 ap_handle_timer, hapd, sta);
1383 sta->timeout_next = STA_REMOVE;
1384
1385 if (hapd->iface->current_mode &&
1386 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211AD) {
1387 /* Deauthentication is not used in DMG/IEEE 802.11ad;
1388 * disassociate the STA instead. */
1389 sta->disassoc_reason = reason;
1390 sta->flags |= WLAN_STA_PENDING_DISASSOC_CB;
1391 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
1392 eloop_register_timeout(hapd->iface->drv_flags &
1393 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ?
1394 2 : 0, 0, ap_sta_disassoc_cb_timeout,
1395 hapd, sta);
1396 return;
1397 }
1398
1399 sta->deauth_reason = reason;
1400 sta->flags |= WLAN_STA_PENDING_DEAUTH_CB;
1401 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
1402 eloop_register_timeout(hapd->iface->drv_flags &
1403 WPA_DRIVER_FLAGS_DEAUTH_TX_STATUS ? 2 : 0, 0,
1404 ap_sta_deauth_cb_timeout, hapd, sta);
1405 }
1406
1407
ap_sta_deauth_cb(struct hostapd_data * hapd,struct sta_info * sta)1408 void ap_sta_deauth_cb(struct hostapd_data *hapd, struct sta_info *sta)
1409 {
1410 if (!(sta->flags & WLAN_STA_PENDING_DEAUTH_CB)) {
1411 wpa_printf(MSG_DEBUG, "Ignore deauth cb for test frame");
1412 return;
1413 }
1414 sta->flags &= ~WLAN_STA_PENDING_DEAUTH_CB;
1415 eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta);
1416 ap_sta_deauth_cb_timeout(hapd, sta);
1417 }
1418
1419
ap_sta_disassoc_cb(struct hostapd_data * hapd,struct sta_info * sta)1420 void ap_sta_disassoc_cb(struct hostapd_data *hapd, struct sta_info *sta)
1421 {
1422 if (!(sta->flags & WLAN_STA_PENDING_DISASSOC_CB)) {
1423 wpa_printf(MSG_DEBUG, "Ignore disassoc cb for test frame");
1424 return;
1425 }
1426 sta->flags &= ~WLAN_STA_PENDING_DISASSOC_CB;
1427 eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta);
1428 ap_sta_disassoc_cb_timeout(hapd, sta);
1429 }
1430
1431
ap_sta_clear_disconnect_timeouts(struct hostapd_data * hapd,struct sta_info * sta)1432 void ap_sta_clear_disconnect_timeouts(struct hostapd_data *hapd,
1433 struct sta_info *sta)
1434 {
1435 if (eloop_cancel_timeout(ap_sta_deauth_cb_timeout, hapd, sta) > 0)
1436 wpa_printf(MSG_DEBUG,
1437 "%s: Removed ap_sta_deauth_cb_timeout timeout for "
1438 MACSTR,
1439 hapd->conf->iface, MAC2STR(sta->addr));
1440 if (eloop_cancel_timeout(ap_sta_disassoc_cb_timeout, hapd, sta) > 0)
1441 wpa_printf(MSG_DEBUG,
1442 "%s: Removed ap_sta_disassoc_cb_timeout timeout for "
1443 MACSTR,
1444 hapd->conf->iface, MAC2STR(sta->addr));
1445 if (eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta) > 0)
1446 {
1447 wpa_printf(MSG_DEBUG,
1448 "%s: Removed ap_sta_delayed_1x_auth_fail_cb timeout for "
1449 MACSTR,
1450 hapd->conf->iface, MAC2STR(sta->addr));
1451 if (sta->flags & WLAN_STA_WPS)
1452 hostapd_wps_eap_completed(hapd);
1453 }
1454 }
1455
1456
ap_sta_flags_txt(u32 flags,char * buf,size_t buflen)1457 int ap_sta_flags_txt(u32 flags, char *buf, size_t buflen)
1458 {
1459 int res;
1460
1461 buf[0] = '\0';
1462 res = os_snprintf(buf, buflen,
1463 "%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s%s",
1464 (flags & WLAN_STA_AUTH ? "[AUTH]" : ""),
1465 (flags & WLAN_STA_ASSOC ? "[ASSOC]" : ""),
1466 (flags & WLAN_STA_AUTHORIZED ? "[AUTHORIZED]" : ""),
1467 (flags & WLAN_STA_PENDING_POLL ? "[PENDING_POLL" :
1468 ""),
1469 (flags & WLAN_STA_SHORT_PREAMBLE ?
1470 "[SHORT_PREAMBLE]" : ""),
1471 (flags & WLAN_STA_PREAUTH ? "[PREAUTH]" : ""),
1472 (flags & WLAN_STA_WMM ? "[WMM]" : ""),
1473 (flags & WLAN_STA_MFP ? "[MFP]" : ""),
1474 (flags & WLAN_STA_WPS ? "[WPS]" : ""),
1475 (flags & WLAN_STA_MAYBE_WPS ? "[MAYBE_WPS]" : ""),
1476 (flags & WLAN_STA_WDS ? "[WDS]" : ""),
1477 (flags & WLAN_STA_NONERP ? "[NonERP]" : ""),
1478 (flags & WLAN_STA_WPS2 ? "[WPS2]" : ""),
1479 (flags & WLAN_STA_GAS ? "[GAS]" : ""),
1480 (flags & WLAN_STA_HT ? "[HT]" : ""),
1481 (flags & WLAN_STA_VHT ? "[VHT]" : ""),
1482 (flags & WLAN_STA_HE ? "[HE]" : ""),
1483 (flags & WLAN_STA_6GHZ ? "[6GHZ]" : ""),
1484 (flags & WLAN_STA_VENDOR_VHT ? "[VENDOR_VHT]" : ""),
1485 (flags & WLAN_STA_WNM_SLEEP_MODE ?
1486 "[WNM_SLEEP_MODE]" : ""));
1487 if (os_snprintf_error(buflen, res))
1488 res = -1;
1489
1490 return res;
1491 }
1492
1493
ap_sta_delayed_1x_auth_fail_cb(void * eloop_ctx,void * timeout_ctx)1494 static void ap_sta_delayed_1x_auth_fail_cb(void *eloop_ctx, void *timeout_ctx)
1495 {
1496 struct hostapd_data *hapd = eloop_ctx;
1497 struct sta_info *sta = timeout_ctx;
1498 u16 reason;
1499
1500 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1501 "IEEE 802.1X: Scheduled disconnection of " MACSTR
1502 " after EAP-Failure", MAC2STR(sta->addr));
1503
1504 reason = sta->disconnect_reason_code;
1505 if (!reason)
1506 reason = WLAN_REASON_IEEE_802_1X_AUTH_FAILED;
1507 ap_sta_disconnect(hapd, sta, sta->addr, reason);
1508 if (sta->flags & WLAN_STA_WPS)
1509 hostapd_wps_eap_completed(hapd);
1510 }
1511
1512
ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data * hapd,struct sta_info * sta)1513 void ap_sta_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd,
1514 struct sta_info *sta)
1515 {
1516 wpa_dbg(hapd->msg_ctx, MSG_DEBUG,
1517 "IEEE 802.1X: Force disconnection of " MACSTR
1518 " after EAP-Failure in 10 ms", MAC2STR(sta->addr));
1519
1520 /*
1521 * Add a small sleep to increase likelihood of previously requested
1522 * EAP-Failure TX getting out before this should the driver reorder
1523 * operations.
1524 */
1525 eloop_cancel_timeout(ap_sta_delayed_1x_auth_fail_cb, hapd, sta);
1526 eloop_register_timeout(0, 10000, ap_sta_delayed_1x_auth_fail_cb,
1527 hapd, sta);
1528 }
1529
1530
ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data * hapd,struct sta_info * sta)1531 int ap_sta_pending_delayed_1x_auth_fail_disconnect(struct hostapd_data *hapd,
1532 struct sta_info *sta)
1533 {
1534 return eloop_is_timeout_registered(ap_sta_delayed_1x_auth_fail_cb,
1535 hapd, sta);
1536 }
1537
1538
ap_sta_re_add(struct hostapd_data * hapd,struct sta_info * sta)1539 int ap_sta_re_add(struct hostapd_data *hapd, struct sta_info *sta)
1540 {
1541 /*
1542 * If a station that is already associated to the AP, is trying to
1543 * authenticate again, remove the STA entry, in order to make sure the
1544 * STA PS state gets cleared and configuration gets updated. To handle
1545 * this, station's added_unassoc flag is cleared once the station has
1546 * completed association.
1547 */
1548 ap_sta_set_authorized(hapd, sta, 0);
1549 hostapd_drv_sta_remove(hapd, sta->addr);
1550 sta->flags &= ~(WLAN_STA_ASSOC | WLAN_STA_AUTH | WLAN_STA_AUTHORIZED);
1551
1552 if (hostapd_sta_add(hapd, sta->addr, 0, 0,
1553 sta->supported_rates,
1554 sta->supported_rates_len,
1555 0, NULL, NULL, NULL, 0, NULL,
1556 sta->flags, 0, 0, 0, 0)) {
1557 hostapd_logger(hapd, sta->addr,
1558 HOSTAPD_MODULE_IEEE80211,
1559 HOSTAPD_LEVEL_NOTICE,
1560 "Could not add STA to kernel driver");
1561 return -1;
1562 }
1563
1564 sta->added_unassoc = 1;
1565 return 0;
1566 }
1567
