1 /*
2 * hostapd / IEEE 802.11 Management
3 * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ocv.h"
14 #include "common/wpa_ctrl.h"
15 #include "hostapd.h"
16 #include "sta_info.h"
17 #include "ap_config.h"
18 #include "ap_drv_ops.h"
19 #include "wpa_auth.h"
20 #include "ieee802_11.h"
21
22
hostapd_eid_assoc_comeback_time(struct hostapd_data * hapd,struct sta_info * sta,u8 * eid)23 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
24 struct sta_info *sta, u8 *eid)
25 {
26 u8 *pos = eid;
27 u32 timeout, tu;
28 struct os_reltime now, passed;
29
30 *pos++ = WLAN_EID_TIMEOUT_INTERVAL;
31 *pos++ = 5;
32 *pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
33 os_get_reltime(&now);
34 os_reltime_sub(&now, &sta->sa_query_start, &passed);
35 tu = (passed.sec * 1000000 + passed.usec) / 1024;
36 if (hapd->conf->assoc_sa_query_max_timeout > tu)
37 timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
38 else
39 timeout = 0;
40 if (timeout < hapd->conf->assoc_sa_query_max_timeout)
41 timeout++; /* add some extra time for local timers */
42 WPA_PUT_LE32(pos, timeout);
43 pos += 4;
44
45 return pos;
46 }
47
48
49 /* MLME-SAQuery.request */
ieee802_11_send_sa_query_req(struct hostapd_data * hapd,const u8 * addr,const u8 * trans_id)50 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
51 const u8 *addr, const u8 *trans_id)
52 {
53 #ifdef CONFIG_OCV
54 struct sta_info *sta;
55 #endif /* CONFIG_OCV */
56 struct ieee80211_mgmt *mgmt;
57 u8 *oci_ie = NULL;
58 u8 oci_ie_len = 0;
59 u8 *end;
60
61 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
62 MACSTR, MAC2STR(addr));
63 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
64 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
65
66 #ifdef CONFIG_OCV
67 sta = ap_get_sta(hapd, addr);
68 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
69 struct wpa_channel_info ci;
70
71 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
72 wpa_printf(MSG_WARNING,
73 "Failed to get channel info for OCI element in SA Query Request");
74 return;
75 }
76 #ifdef CONFIG_TESTING_OPTIONS
77 if (hapd->conf->oci_freq_override_saquery_req) {
78 wpa_printf(MSG_INFO,
79 "TEST: Override OCI frequency %d -> %u MHz",
80 ci.frequency,
81 hapd->conf->oci_freq_override_saquery_req);
82 ci.frequency =
83 hapd->conf->oci_freq_override_saquery_req;
84 }
85 #endif /* CONFIG_TESTING_OPTIONS */
86
87 oci_ie_len = OCV_OCI_EXTENDED_LEN;
88 oci_ie = os_zalloc(oci_ie_len);
89 if (!oci_ie) {
90 wpa_printf(MSG_WARNING,
91 "Failed to allocate buffer for OCI element in SA Query Request");
92 return;
93 }
94
95 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
96 os_free(oci_ie);
97 return;
98 }
99 }
100 #endif /* CONFIG_OCV */
101
102 mgmt = os_zalloc(sizeof(*mgmt) + oci_ie_len);
103 if (!mgmt) {
104 wpa_printf(MSG_DEBUG,
105 "Failed to allocate buffer for SA Query Response frame");
106 os_free(oci_ie);
107 return;
108 }
109
110 mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
111 WLAN_FC_STYPE_ACTION);
112 os_memcpy(mgmt->da, addr, ETH_ALEN);
113 os_memcpy(mgmt->sa, hapd->own_addr, ETH_ALEN);
114 os_memcpy(mgmt->bssid, hapd->own_addr, ETH_ALEN);
115 mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
116 mgmt->u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
117 os_memcpy(mgmt->u.action.u.sa_query_req.trans_id, trans_id,
118 WLAN_SA_QUERY_TR_ID_LEN);
119 end = mgmt->u.action.u.sa_query_req.variable;
120 #ifdef CONFIG_OCV
121 if (oci_ie_len > 0) {
122 os_memcpy(end, oci_ie, oci_ie_len);
123 end += oci_ie_len;
124 }
125 #endif /* CONFIG_OCV */
126 if (hostapd_drv_send_mlme(hapd, mgmt, end - (u8 *) mgmt, 0, NULL, 0, 0)
127 < 0)
128 wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
129
130 os_free(mgmt);
131 os_free(oci_ie);
132 }
133
134
ieee802_11_send_sa_query_resp(struct hostapd_data * hapd,const u8 * sa,const u8 * trans_id)135 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
136 const u8 *sa, const u8 *trans_id)
137 {
138 struct sta_info *sta;
139 struct ieee80211_mgmt *resp;
140 u8 *oci_ie = NULL;
141 u8 oci_ie_len = 0;
142 u8 *end;
143
144 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
145 MACSTR, MAC2STR(sa));
146 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
147 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
148
149 sta = ap_get_sta(hapd, sa);
150 if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
151 wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
152 "from unassociated STA " MACSTR, MAC2STR(sa));
153 return;
154 }
155
156 #ifdef CONFIG_OCV
157 if (wpa_auth_uses_ocv(sta->wpa_sm)) {
158 struct wpa_channel_info ci;
159
160 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
161 wpa_printf(MSG_WARNING,
162 "Failed to get channel info for OCI element in SA Query Response");
163 return;
164 }
165 #ifdef CONFIG_TESTING_OPTIONS
166 if (hapd->conf->oci_freq_override_saquery_resp) {
167 wpa_printf(MSG_INFO,
168 "TEST: Override OCI frequency %d -> %u MHz",
169 ci.frequency,
170 hapd->conf->oci_freq_override_saquery_resp);
171 ci.frequency =
172 hapd->conf->oci_freq_override_saquery_resp;
173 }
174 #endif /* CONFIG_TESTING_OPTIONS */
175
176 oci_ie_len = OCV_OCI_EXTENDED_LEN;
177 oci_ie = os_zalloc(oci_ie_len);
178 if (!oci_ie) {
179 wpa_printf(MSG_WARNING,
180 "Failed to allocate buffer for for OCI element in SA Query Response");
181 return;
182 }
183
184 if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
185 os_free(oci_ie);
186 return;
187 }
188 }
189 #endif /* CONFIG_OCV */
190
191 resp = os_zalloc(sizeof(*resp) + oci_ie_len);
192 if (!resp) {
193 wpa_printf(MSG_DEBUG,
194 "Failed to allocate buffer for SA Query Response frame");
195 os_free(oci_ie);
196 return;
197 }
198
199 wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
200 MACSTR, MAC2STR(sa));
201
202 resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
203 WLAN_FC_STYPE_ACTION);
204 os_memcpy(resp->da, sa, ETH_ALEN);
205 os_memcpy(resp->sa, hapd->own_addr, ETH_ALEN);
206 os_memcpy(resp->bssid, hapd->own_addr, ETH_ALEN);
207 resp->u.action.category = WLAN_ACTION_SA_QUERY;
208 resp->u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
209 os_memcpy(resp->u.action.u.sa_query_req.trans_id, trans_id,
210 WLAN_SA_QUERY_TR_ID_LEN);
211 end = resp->u.action.u.sa_query_req.variable;
212 #ifdef CONFIG_OCV
213 if (oci_ie_len > 0) {
214 os_memcpy(end, oci_ie, oci_ie_len);
215 end += oci_ie_len;
216 }
217 #endif /* CONFIG_OCV */
218 if (hostapd_drv_send_mlme(hapd, resp, end - (u8 *) resp, 0, NULL, 0, 0)
219 < 0)
220 wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
221
222 os_free(resp);
223 os_free(oci_ie);
224 }
225
226
ieee802_11_sa_query_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)227 void ieee802_11_sa_query_action(struct hostapd_data *hapd,
228 const struct ieee80211_mgmt *mgmt,
229 size_t len)
230 {
231 struct sta_info *sta;
232 int i;
233 const u8 *sa = mgmt->sa;
234 const u8 action_type = mgmt->u.action.u.sa_query_resp.action;
235 const u8 *trans_id = mgmt->u.action.u.sa_query_resp.trans_id;
236
237 if (((const u8 *) mgmt) + len <
238 mgmt->u.action.u.sa_query_resp.variable) {
239 wpa_printf(MSG_DEBUG,
240 "IEEE 802.11: Too short SA Query Action frame (len=%lu)",
241 (unsigned long) len);
242 return;
243 }
244 if (is_multicast_ether_addr(mgmt->da)) {
245 wpa_printf(MSG_DEBUG,
246 "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
247 MAC2STR(mgmt->da), MAC2STR(mgmt->sa));
248 return;
249 }
250
251 sta = ap_get_sta(hapd, sa);
252
253 #ifdef CONFIG_OCV
254 if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
255 struct ieee802_11_elems elems;
256 struct wpa_channel_info ci;
257 int tx_chanwidth;
258 int tx_seg1_idx;
259 size_t ies_len;
260 const u8 *ies;
261
262 ies = mgmt->u.action.u.sa_query_resp.variable;
263 ies_len = len - (ies - (u8 *) mgmt);
264 if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) ==
265 ParseFailed) {
266 wpa_printf(MSG_DEBUG,
267 "SA Query: Failed to parse elements");
268 return;
269 }
270
271 if (hostapd_drv_channel_info(hapd, &ci) != 0) {
272 wpa_printf(MSG_WARNING,
273 "Failed to get channel info to validate received OCI in SA Query Action frame");
274 return;
275 }
276
277 if (get_sta_tx_parameters(sta->wpa_sm,
278 channel_width_to_int(ci.chanwidth),
279 ci.seg1_idx, &tx_chanwidth,
280 &tx_seg1_idx) < 0)
281 return;
282
283 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
284 tx_chanwidth, tx_seg1_idx) !=
285 OCI_SUCCESS) {
286 wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
287 MACSTR " frame=saquery%s error=%s",
288 MAC2STR(sa),
289 action_type == WLAN_SA_QUERY_REQUEST ?
290 "req" : "resp", ocv_errorstr);
291 return;
292 }
293 }
294 #endif /* CONFIG_OCV */
295
296 if (action_type == WLAN_SA_QUERY_REQUEST) {
297 if (sta)
298 sta->post_csa_sa_query = 0;
299 ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
300 return;
301 }
302
303 if (action_type != WLAN_SA_QUERY_RESPONSE) {
304 wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
305 "Action %d", action_type);
306 return;
307 }
308
309 wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
310 MACSTR, MAC2STR(sa));
311 wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
312 trans_id, WLAN_SA_QUERY_TR_ID_LEN);
313
314 /* MLME-SAQuery.confirm */
315
316 if (sta == NULL || sta->sa_query_trans_id == NULL) {
317 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
318 "pending SA Query request found");
319 return;
320 }
321
322 for (i = 0; i < sta->sa_query_count; i++) {
323 if (os_memcmp(sta->sa_query_trans_id +
324 i * WLAN_SA_QUERY_TR_ID_LEN,
325 trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
326 break;
327 }
328
329 if (i >= sta->sa_query_count) {
330 wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
331 "transaction identifier found");
332 return;
333 }
334
335 hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
336 HOSTAPD_LEVEL_DEBUG,
337 "Reply to pending SA Query received");
338 ap_sta_stop_sa_query(hapd, sta);
339 }
340
341
hostapd_ext_capab_byte(struct hostapd_data * hapd,u8 * pos,int idx)342 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx)
343 {
344 *pos = 0x00;
345
346 switch (idx) {
347 case 0: /* Bits 0-7 */
348 if (hapd->iconf->obss_interval)
349 *pos |= 0x01; /* Bit 0 - Coexistence management */
350 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)
351 *pos |= 0x04; /* Bit 2 - Extended Channel Switching */
352 break;
353 case 1: /* Bits 8-15 */
354 if (hapd->conf->proxy_arp)
355 *pos |= 0x10; /* Bit 12 - Proxy ARP */
356 if (hapd->conf->coloc_intf_reporting) {
357 /* Bit 13 - Collocated Interference Reporting */
358 *pos |= 0x20;
359 }
360 break;
361 case 2: /* Bits 16-23 */
362 if (hapd->conf->wnm_sleep_mode)
363 *pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
364 if (hapd->conf->bss_transition)
365 *pos |= 0x08; /* Bit 19 - BSS Transition */
366 break;
367 case 3: /* Bits 24-31 */
368 #ifdef CONFIG_WNM_AP
369 *pos |= 0x02; /* Bit 25 - SSID List */
370 #endif /* CONFIG_WNM_AP */
371 if (hapd->conf->time_advertisement == 2)
372 *pos |= 0x08; /* Bit 27 - UTC TSF Offset */
373 if (hapd->conf->interworking)
374 *pos |= 0x80; /* Bit 31 - Interworking */
375 break;
376 case 4: /* Bits 32-39 */
377 if (hapd->conf->qos_map_set_len)
378 *pos |= 0x01; /* Bit 32 - QoS Map */
379 if (hapd->conf->tdls & TDLS_PROHIBIT)
380 *pos |= 0x40; /* Bit 38 - TDLS Prohibited */
381 if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
382 /* Bit 39 - TDLS Channel Switching Prohibited */
383 *pos |= 0x80;
384 }
385 break;
386 case 5: /* Bits 40-47 */
387 #ifdef CONFIG_HS20
388 if (hapd->conf->hs20)
389 *pos |= 0x40; /* Bit 46 - WNM-Notification */
390 #endif /* CONFIG_HS20 */
391 #ifdef CONFIG_MBO
392 if (hapd->conf->mbo_enabled)
393 *pos |= 0x40; /* Bit 46 - WNM-Notification */
394 #endif /* CONFIG_MBO */
395 break;
396 case 6: /* Bits 48-55 */
397 if (hapd->conf->ssid.utf8_ssid)
398 *pos |= 0x01; /* Bit 48 - UTF-8 SSID */
399 break;
400 case 7: /* Bits 56-63 */
401 break;
402 case 8: /* Bits 64-71 */
403 if (hapd->conf->ftm_responder)
404 *pos |= 0x40; /* Bit 70 - FTM responder */
405 if (hapd->conf->ftm_initiator)
406 *pos |= 0x80; /* Bit 71 - FTM initiator */
407 break;
408 case 9: /* Bits 72-79 */
409 #ifdef CONFIG_FILS
410 if ((hapd->conf->wpa & WPA_PROTO_RSN) &&
411 wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
412 *pos |= 0x01;
413 #endif /* CONFIG_FILS */
414 #ifdef CONFIG_IEEE80211AX
415 if (hapd->iconf->ieee80211ax &&
416 hostapd_get_he_twt_responder(hapd, IEEE80211_MODE_AP))
417 *pos |= 0x40; /* Bit 78 - TWT responder */
418 #endif /* CONFIG_IEEE80211AX */
419 break;
420 case 10: /* Bits 80-87 */
421 #ifdef CONFIG_SAE
422 if (hapd->conf->wpa &&
423 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt)) {
424 int in_use = hostapd_sae_pw_id_in_use(hapd->conf);
425
426 if (in_use)
427 *pos |= 0x02; /* Bit 81 - SAE Password
428 * Identifiers In Use */
429 if (in_use == 2)
430 *pos |= 0x04; /* Bit 82 - SAE Password
431 * Identifiers Used Exclusively */
432 }
433 #endif /* CONFIG_SAE */
434 if (hapd->conf->beacon_prot &&
435 (hapd->iface->drv_flags &
436 WPA_DRIVER_FLAGS_BEACON_PROTECTION))
437 *pos |= 0x10; /* Bit 84 - Beacon Protection Enabled */
438 break;
439 case 11: /* Bits 88-95 */
440 #ifdef CONFIG_SAE_PK
441 if (hapd->conf->wpa &&
442 wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
443 hostapd_sae_pk_exclusively(hapd->conf))
444 *pos |= 0x01; /* Bit 88 - SAE PK Exclusively */
445 #endif /* CONFIG_SAE_PK */
446 break;
447 }
448 }
449
450
hostapd_eid_ext_capab(struct hostapd_data * hapd,u8 * eid)451 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid)
452 {
453 u8 *pos = eid;
454 u8 len = EXT_CAPA_MAX_LEN, i;
455
456 if (len < hapd->iface->extended_capa_len)
457 len = hapd->iface->extended_capa_len;
458
459 *pos++ = WLAN_EID_EXT_CAPAB;
460 *pos++ = len;
461 for (i = 0; i < len; i++, pos++) {
462 hostapd_ext_capab_byte(hapd, pos, i);
463
464 if (i < hapd->iface->extended_capa_len) {
465 *pos &= ~hapd->iface->extended_capa_mask[i];
466 *pos |= hapd->iface->extended_capa[i];
467 }
468
469 if (i < EXT_CAPA_MAX_LEN) {
470 *pos &= ~hapd->conf->ext_capa_mask[i];
471 *pos |= hapd->conf->ext_capa[i];
472 }
473 }
474
475 while (len > 0 && eid[1 + len] == 0) {
476 len--;
477 eid[1] = len;
478 }
479 if (len == 0)
480 return eid;
481
482 return eid + 2 + len;
483 }
484
485
hostapd_eid_qos_map_set(struct hostapd_data * hapd,u8 * eid)486 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
487 {
488 u8 *pos = eid;
489 u8 len = hapd->conf->qos_map_set_len;
490
491 if (!len)
492 return eid;
493
494 *pos++ = WLAN_EID_QOS_MAP_SET;
495 *pos++ = len;
496 os_memcpy(pos, hapd->conf->qos_map_set, len);
497 pos += len;
498
499 return pos;
500 }
501
502
hostapd_eid_interworking(struct hostapd_data * hapd,u8 * eid)503 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
504 {
505 u8 *pos = eid;
506 #ifdef CONFIG_INTERWORKING
507 u8 *len;
508
509 if (!hapd->conf->interworking)
510 return eid;
511
512 *pos++ = WLAN_EID_INTERWORKING;
513 len = pos++;
514
515 *pos = hapd->conf->access_network_type;
516 if (hapd->conf->internet)
517 *pos |= INTERWORKING_ANO_INTERNET;
518 if (hapd->conf->asra)
519 *pos |= INTERWORKING_ANO_ASRA;
520 if (hapd->conf->esr)
521 *pos |= INTERWORKING_ANO_ESR;
522 if (hapd->conf->uesa)
523 *pos |= INTERWORKING_ANO_UESA;
524 pos++;
525
526 if (hapd->conf->venue_info_set) {
527 *pos++ = hapd->conf->venue_group;
528 *pos++ = hapd->conf->venue_type;
529 }
530
531 if (!is_zero_ether_addr(hapd->conf->hessid)) {
532 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
533 pos += ETH_ALEN;
534 }
535
536 *len = pos - len - 1;
537 #endif /* CONFIG_INTERWORKING */
538
539 return pos;
540 }
541
542
hostapd_eid_adv_proto(struct hostapd_data * hapd,u8 * eid)543 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
544 {
545 u8 *pos = eid;
546 #ifdef CONFIG_INTERWORKING
547
548 /* TODO: Separate configuration for ANQP? */
549 if (!hapd->conf->interworking)
550 return eid;
551
552 *pos++ = WLAN_EID_ADV_PROTO;
553 *pos++ = 2;
554 *pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
555 *pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
556 #endif /* CONFIG_INTERWORKING */
557
558 return pos;
559 }
560
561
hostapd_eid_roaming_consortium(struct hostapd_data * hapd,u8 * eid)562 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
563 {
564 u8 *pos = eid;
565 #ifdef CONFIG_INTERWORKING
566 u8 *len;
567 unsigned int i, count;
568
569 if (!hapd->conf->interworking ||
570 hapd->conf->roaming_consortium == NULL ||
571 hapd->conf->roaming_consortium_count == 0)
572 return eid;
573
574 *pos++ = WLAN_EID_ROAMING_CONSORTIUM;
575 len = pos++;
576
577 /* Number of ANQP OIs (in addition to the max 3 listed here) */
578 if (hapd->conf->roaming_consortium_count > 3 + 255)
579 *pos++ = 255;
580 else if (hapd->conf->roaming_consortium_count > 3)
581 *pos++ = hapd->conf->roaming_consortium_count - 3;
582 else
583 *pos++ = 0;
584
585 /* OU #1 and #2 Lengths */
586 *pos = hapd->conf->roaming_consortium[0].len;
587 if (hapd->conf->roaming_consortium_count > 1)
588 *pos |= hapd->conf->roaming_consortium[1].len << 4;
589 pos++;
590
591 if (hapd->conf->roaming_consortium_count > 3)
592 count = 3;
593 else
594 count = hapd->conf->roaming_consortium_count;
595
596 for (i = 0; i < count; i++) {
597 os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
598 hapd->conf->roaming_consortium[i].len);
599 pos += hapd->conf->roaming_consortium[i].len;
600 }
601
602 *len = pos - len - 1;
603 #endif /* CONFIG_INTERWORKING */
604
605 return pos;
606 }
607
608
hostapd_eid_time_adv(struct hostapd_data * hapd,u8 * eid)609 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
610 {
611 if (hapd->conf->time_advertisement != 2)
612 return eid;
613
614 if (hapd->time_adv == NULL &&
615 hostapd_update_time_adv(hapd) < 0)
616 return eid;
617
618 if (hapd->time_adv == NULL)
619 return eid;
620
621 os_memcpy(eid, wpabuf_head(hapd->time_adv),
622 wpabuf_len(hapd->time_adv));
623 eid += wpabuf_len(hapd->time_adv);
624
625 return eid;
626 }
627
628
hostapd_eid_time_zone(struct hostapd_data * hapd,u8 * eid)629 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
630 {
631 size_t len;
632
633 if (hapd->conf->time_advertisement != 2 || !hapd->conf->time_zone)
634 return eid;
635
636 len = os_strlen(hapd->conf->time_zone);
637
638 *eid++ = WLAN_EID_TIME_ZONE;
639 *eid++ = len;
640 os_memcpy(eid, hapd->conf->time_zone, len);
641 eid += len;
642
643 return eid;
644 }
645
646
hostapd_update_time_adv(struct hostapd_data * hapd)647 int hostapd_update_time_adv(struct hostapd_data *hapd)
648 {
649 const int elen = 2 + 1 + 10 + 5 + 1;
650 struct os_time t;
651 struct os_tm tm;
652 u8 *pos;
653
654 if (hapd->conf->time_advertisement != 2)
655 return 0;
656
657 if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
658 return -1;
659
660 if (!hapd->time_adv) {
661 hapd->time_adv = wpabuf_alloc(elen);
662 if (hapd->time_adv == NULL)
663 return -1;
664 pos = wpabuf_put(hapd->time_adv, elen);
665 } else
666 pos = wpabuf_mhead_u8(hapd->time_adv);
667
668 *pos++ = WLAN_EID_TIME_ADVERTISEMENT;
669 *pos++ = 1 + 10 + 5 + 1;
670
671 *pos++ = 2; /* UTC time at which the TSF timer is 0 */
672
673 /* Time Value at TSF 0 */
674 /* FIX: need to calculate this based on the current TSF value */
675 WPA_PUT_LE16(pos, tm.year); /* Year */
676 pos += 2;
677 *pos++ = tm.month; /* Month */
678 *pos++ = tm.day; /* Day of month */
679 *pos++ = tm.hour; /* Hours */
680 *pos++ = tm.min; /* Minutes */
681 *pos++ = tm.sec; /* Seconds */
682 WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
683 pos += 2;
684 *pos++ = 0; /* Reserved */
685
686 /* Time Error */
687 /* TODO: fill in an estimate on the error */
688 *pos++ = 0;
689 *pos++ = 0;
690 *pos++ = 0;
691 *pos++ = 0;
692 *pos++ = 0;
693
694 *pos++ = hapd->time_update_counter++;
695
696 return 0;
697 }
698
699
hostapd_eid_bss_max_idle_period(struct hostapd_data * hapd,u8 * eid)700 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid)
701 {
702 u8 *pos = eid;
703
704 #ifdef CONFIG_WNM_AP
705 if (hapd->conf->ap_max_inactivity > 0) {
706 unsigned int val;
707 *pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
708 *pos++ = 3;
709 val = hapd->conf->ap_max_inactivity;
710 if (val > 68000)
711 val = 68000;
712 val *= 1000;
713 val /= 1024;
714 if (val == 0)
715 val = 1;
716 if (val > 65535)
717 val = 65535;
718 WPA_PUT_LE16(pos, val);
719 pos += 2;
720 *pos++ = 0x00; /* TODO: Protected Keep-Alive Required */
721 }
722 #endif /* CONFIG_WNM_AP */
723
724 return pos;
725 }
726
727
728 #ifdef CONFIG_MBO
729
hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data * hapd,u8 * eid,size_t len,int delta)730 u8 * hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data *hapd, u8 *eid,
731 size_t len, int delta)
732 {
733 u8 mbo[4];
734
735 mbo[0] = OCE_ATTR_ID_RSSI_BASED_ASSOC_REJECT;
736 mbo[1] = 2;
737 /* Delta RSSI */
738 mbo[2] = delta;
739 /* Retry delay */
740 mbo[3] = hapd->iconf->rssi_reject_assoc_timeout;
741
742 return eid + mbo_add_ie(eid, len, mbo, 4);
743 }
744
745
hostapd_eid_mbo(struct hostapd_data * hapd,u8 * eid,size_t len)746 u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len)
747 {
748 u8 mbo[9], *mbo_pos = mbo;
749 u8 *pos = eid;
750
751 if (!hapd->conf->mbo_enabled &&
752 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
753 return eid;
754
755 if (hapd->conf->mbo_enabled) {
756 *mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND;
757 *mbo_pos++ = 1;
758 /* Not Cellular aware */
759 *mbo_pos++ = 0;
760 }
761
762 if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
763 *mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW;
764 *mbo_pos++ = 1;
765 *mbo_pos++ = hapd->mbo_assoc_disallow;
766 }
767
768 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd)) {
769 u8 ctrl;
770
771 ctrl = OCE_RELEASE;
772 if (OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
773 ctrl |= OCE_IS_STA_CFON;
774
775 *mbo_pos++ = OCE_ATTR_ID_CAPA_IND;
776 *mbo_pos++ = 1;
777 *mbo_pos++ = ctrl;
778 }
779
780 pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo);
781
782 return pos;
783 }
784
785
hostapd_mbo_ie_len(struct hostapd_data * hapd)786 u8 hostapd_mbo_ie_len(struct hostapd_data *hapd)
787 {
788 u8 len;
789
790 if (!hapd->conf->mbo_enabled &&
791 !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
792 return 0;
793
794 /*
795 * MBO IE header (6) + Capability Indication attribute (3) +
796 * Association Disallowed attribute (3) = 12
797 */
798 len = 6;
799 if (hapd->conf->mbo_enabled)
800 len += 3 + (hapd->mbo_assoc_disallow ? 3 : 0);
801
802 /* OCE capability indication attribute (3) */
803 if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd))
804 len += 3;
805
806 return len;
807 }
808
809 #endif /* CONFIG_MBO */
810
811
812 #ifdef CONFIG_OWE
hostapd_eid_owe_trans_enabled(struct hostapd_data * hapd)813 static int hostapd_eid_owe_trans_enabled(struct hostapd_data *hapd)
814 {
815 return hapd->conf->owe_transition_ssid_len > 0 &&
816 !is_zero_ether_addr(hapd->conf->owe_transition_bssid);
817 }
818 #endif /* CONFIG_OWE */
819
820
hostapd_eid_owe_trans_len(struct hostapd_data * hapd)821 size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd)
822 {
823 #ifdef CONFIG_OWE
824 if (!hostapd_eid_owe_trans_enabled(hapd))
825 return 0;
826 return 6 + ETH_ALEN + 1 + hapd->conf->owe_transition_ssid_len;
827 #else /* CONFIG_OWE */
828 return 0;
829 #endif /* CONFIG_OWE */
830 }
831
832
hostapd_eid_owe_trans(struct hostapd_data * hapd,u8 * eid,size_t len)833 u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid,
834 size_t len)
835 {
836 #ifdef CONFIG_OWE
837 u8 *pos = eid;
838 size_t elen;
839
840 if (hapd->conf->owe_transition_ifname[0] &&
841 !hostapd_eid_owe_trans_enabled(hapd))
842 hostapd_owe_trans_get_info(hapd);
843
844 if (!hostapd_eid_owe_trans_enabled(hapd))
845 return pos;
846
847 elen = hostapd_eid_owe_trans_len(hapd);
848 if (len < elen) {
849 wpa_printf(MSG_DEBUG,
850 "OWE: Not enough room in the buffer for OWE IE");
851 return pos;
852 }
853
854 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
855 *pos++ = elen - 2;
856 WPA_PUT_BE24(pos, OUI_WFA);
857 pos += 3;
858 *pos++ = OWE_OUI_TYPE;
859 os_memcpy(pos, hapd->conf->owe_transition_bssid, ETH_ALEN);
860 pos += ETH_ALEN;
861 *pos++ = hapd->conf->owe_transition_ssid_len;
862 os_memcpy(pos, hapd->conf->owe_transition_ssid,
863 hapd->conf->owe_transition_ssid_len);
864 pos += hapd->conf->owe_transition_ssid_len;
865
866 return pos;
867 #else /* CONFIG_OWE */
868 return eid;
869 #endif /* CONFIG_OWE */
870 }
871
872
hostapd_eid_dpp_cc_len(struct hostapd_data * hapd)873 size_t hostapd_eid_dpp_cc_len(struct hostapd_data *hapd)
874 {
875 #ifdef CONFIG_DPP2
876 if (hapd->conf->dpp_configurator_connectivity)
877 return 6;
878 #endif /* CONFIG_DPP2 */
879 return 0;
880 }
881
882
hostapd_eid_dpp_cc(struct hostapd_data * hapd,u8 * eid,size_t len)883 u8 * hostapd_eid_dpp_cc(struct hostapd_data *hapd, u8 *eid, size_t len)
884 {
885 u8 *pos = eid;
886
887 #ifdef CONFIG_DPP2
888 if (!hapd->conf->dpp_configurator_connectivity || len < 6)
889 return pos;
890
891 *pos++ = WLAN_EID_VENDOR_SPECIFIC;
892 *pos++ = 4;
893 WPA_PUT_BE24(pos, OUI_WFA);
894 pos += 3;
895 *pos++ = DPP_CC_OUI_TYPE;
896 #endif /* CONFIG_DPP2 */
897
898 return pos;
899 }
900
901
ap_copy_sta_supp_op_classes(struct sta_info * sta,const u8 * supp_op_classes,size_t supp_op_classes_len)902 void ap_copy_sta_supp_op_classes(struct sta_info *sta,
903 const u8 *supp_op_classes,
904 size_t supp_op_classes_len)
905 {
906 if (!supp_op_classes)
907 return;
908 os_free(sta->supp_op_classes);
909 sta->supp_op_classes = os_malloc(1 + supp_op_classes_len);
910 if (!sta->supp_op_classes)
911 return;
912
913 sta->supp_op_classes[0] = supp_op_classes_len;
914 os_memcpy(sta->supp_op_classes + 1, supp_op_classes,
915 supp_op_classes_len);
916 }
917
918
hostapd_eid_fils_indic(struct hostapd_data * hapd,u8 * eid,int hessid)919 u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid)
920 {
921 u8 *pos = eid;
922 #ifdef CONFIG_FILS
923 u8 *len;
924 u16 fils_info = 0;
925 size_t realms;
926 struct fils_realm *realm;
927
928 if (!(hapd->conf->wpa & WPA_PROTO_RSN) ||
929 !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
930 return pos;
931
932 realms = dl_list_len(&hapd->conf->fils_realms);
933 if (realms > 7)
934 realms = 7; /* 3 bit count field limits this to max 7 */
935
936 *pos++ = WLAN_EID_FILS_INDICATION;
937 len = pos++;
938 /* TODO: B0..B2: Number of Public Key Identifiers */
939 if (hapd->conf->erp_domain) {
940 /* B3..B5: Number of Realm Identifiers */
941 fils_info |= realms << 3;
942 }
943 /* TODO: B6: FILS IP Address Configuration */
944 if (hapd->conf->fils_cache_id_set)
945 fils_info |= BIT(7);
946 if (hessid && !is_zero_ether_addr(hapd->conf->hessid))
947 fils_info |= BIT(8); /* HESSID Included */
948 /* FILS Shared Key Authentication without PFS Supported */
949 fils_info |= BIT(9);
950 if (hapd->conf->fils_dh_group) {
951 /* FILS Shared Key Authentication with PFS Supported */
952 fils_info |= BIT(10);
953 }
954 /* TODO: B11: FILS Public Key Authentication Supported */
955 /* B12..B15: Reserved */
956 WPA_PUT_LE16(pos, fils_info);
957 pos += 2;
958 if (hapd->conf->fils_cache_id_set) {
959 os_memcpy(pos, hapd->conf->fils_cache_id, FILS_CACHE_ID_LEN);
960 pos += FILS_CACHE_ID_LEN;
961 }
962 if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) {
963 os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
964 pos += ETH_ALEN;
965 }
966
967 dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm,
968 list) {
969 if (realms == 0)
970 break;
971 realms--;
972 os_memcpy(pos, realm->hash, 2);
973 pos += 2;
974 }
975 *len = pos - len - 1;
976 #endif /* CONFIG_FILS */
977
978 return pos;
979 }
980
981
982 #ifdef CONFIG_OCV
get_tx_parameters(struct sta_info * sta,int ap_max_chanwidth,int ap_seg1_idx,int * bandwidth,int * seg1_idx)983 int get_tx_parameters(struct sta_info *sta, int ap_max_chanwidth,
984 int ap_seg1_idx, int *bandwidth, int *seg1_idx)
985 {
986 int ht_40mhz = 0;
987 int vht_80p80 = 0;
988 int requested_bw;
989
990 if (sta->ht_capabilities)
991 ht_40mhz = !!(sta->ht_capabilities->ht_capabilities_info &
992 HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET);
993
994 if (sta->vht_operation) {
995 struct ieee80211_vht_operation *oper = sta->vht_operation;
996
997 /*
998 * If a VHT Operation element was present, use it to determine
999 * the supported channel bandwidth.
1000 */
1001 if (oper->vht_op_info_chwidth == 0) {
1002 requested_bw = ht_40mhz ? 40 : 20;
1003 } else if (oper->vht_op_info_chan_center_freq_seg1_idx == 0) {
1004 requested_bw = 80;
1005 } else {
1006 int diff;
1007
1008 requested_bw = 160;
1009 diff = abs((int)
1010 oper->vht_op_info_chan_center_freq_seg0_idx -
1011 (int)
1012 oper->vht_op_info_chan_center_freq_seg1_idx);
1013 vht_80p80 = oper->vht_op_info_chan_center_freq_seg1_idx
1014 != 0 && diff > 16;
1015 }
1016 } else if (sta->vht_capabilities) {
1017 struct ieee80211_vht_capabilities *capab;
1018 int vht_chanwidth;
1019
1020 capab = sta->vht_capabilities;
1021
1022 /*
1023 * If only the VHT Capabilities element is present (e.g., for
1024 * normal clients), use it to determine the supported channel
1025 * bandwidth.
1026 */
1027 vht_chanwidth = capab->vht_capabilities_info &
1028 VHT_CAP_SUPP_CHAN_WIDTH_MASK;
1029 vht_80p80 = capab->vht_capabilities_info &
1030 VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1031
1032 /* TODO: Also take into account Extended NSS BW Support field */
1033 requested_bw = vht_chanwidth ? 160 : 80;
1034 } else {
1035 requested_bw = ht_40mhz ? 40 : 20;
1036 }
1037
1038 *bandwidth = requested_bw < ap_max_chanwidth ?
1039 requested_bw : ap_max_chanwidth;
1040
1041 *seg1_idx = 0;
1042 if (ap_seg1_idx && vht_80p80)
1043 *seg1_idx = ap_seg1_idx;
1044
1045 return 0;
1046 }
1047 #endif /* CONFIG_OCV */
1048
1049
hostapd_eid_rsnxe(struct hostapd_data * hapd,u8 * eid,size_t len)1050 u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len)
1051 {
1052 u8 *pos = eid;
1053 bool sae_pk = false;
1054 u16 capab = 0;
1055 size_t flen;
1056
1057 if (!(hapd->conf->wpa & WPA_PROTO_RSN))
1058 return eid;
1059
1060 #ifdef CONFIG_SAE_PK
1061 sae_pk = hostapd_sae_pk_in_use(hapd->conf);
1062 #endif /* CONFIG_SAE_PK */
1063
1064 if (wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1065 (hapd->conf->sae_pwe == 1 || hapd->conf->sae_pwe == 2 ||
1066 hostapd_sae_pw_id_in_use(hapd->conf) || sae_pk) &&
1067 hapd->conf->sae_pwe != 3) {
1068 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1069 #ifdef CONFIG_SAE_PK
1070 if (sae_pk)
1071 capab |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
1072 #endif /* CONFIG_SAE_PK */
1073 }
1074
1075 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF)
1076 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1077 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT)
1078 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
1079 if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG)
1080 capab |= BIT(WLAN_RSNX_CAPAB_PROT_RANGE_NEG);
1081
1082 flen = (capab & 0xff00) ? 2 : 1;
1083 if (len < 2 + flen || !capab)
1084 return eid; /* no supported extended RSN capabilities */
1085 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
1086
1087 *pos++ = WLAN_EID_RSNX;
1088 *pos++ = flen;
1089 *pos++ = capab & 0x00ff;
1090 capab >>= 8;
1091 if (capab)
1092 *pos++ = capab;
1093
1094 return pos;
1095 }
1096
