vcs.maemo.org Git - wpasupplicant/blob - src/drivers/driver_nl80211.c

   1 /*
   2  * WPA Supplicant - driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16 #include <sys/ioctl.h>
  17 #include <net/if_arp.h>
  18 #include <netlink/genl/genl.h>
  19 #include <netlink/genl/family.h>
  20 #include <netlink/genl/ctrl.h>
  21 #include "nl80211_copy.h"
  22 #include "wireless_copy.h"
  23
  24 #include "common.h"
  25 #include "driver.h"
  26 #include "eloop.h"
  27 #include "ieee802_11_defs.h"
  28
  29 #ifndef IFF_LOWER_UP
  30 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
  31 #endif
  32 #ifndef IFF_DORMANT
  33 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
  34 #endif
  35
  36 #ifndef IF_OPER_DORMANT
  37 #define IF_OPER_DORMANT 5
  38 #endif
  39 #ifndef IF_OPER_UP
  40 #define IF_OPER_UP 6
  41 #endif
  42
  43
  44 struct wpa_driver_nl80211_data {
  45         void *ctx;
  46         int link_event_sock;
  47         int ioctl_sock;
  48         char ifname[IFNAMSIZ + 1];
  49         int ifindex;
  50         int if_removed;
  51         struct wpa_driver_capa capa;
  52         int has_capability;
  53
  54         int operstate;
  55
  56         int scan_complete_events;
  57
  58         struct nl_handle *nl_handle;
  59         struct nl_cache *nl_cache;
  60         struct nl_cb *nl_cb;
  61         struct genl_family *nl80211;
  62
  63         u8 bssid[ETH_ALEN];
  64         int associated;
  65         u8 ssid[32];
  66         size_t ssid_len;
  67 };
  68
  69
  70 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
  71                                             void *timeout_ctx);
  72 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
  73                                        int mode);
  74 static int
  75 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
  76
  77
  78 /* nl80211 code */
  79 static int ack_handler(struct nl_msg *msg, void *arg)
  80 {
  81         int *err = arg;
  82         *err = 0;
  83         return NL_STOP;
  84 }
  85
  86 static int finish_handler(struct nl_msg *msg, void *arg)
  87 {
  88         int *ret = arg;
  89         *ret = 0;
  90         return NL_SKIP;
  91 }
  92
  93 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
  94                          void *arg)
  95 {
  96         int *ret = arg;
  97         *ret = err->error;
  98         return NL_SKIP;
  99 }
 100
 101 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 102                               struct nl_msg *msg,
 103                               int (*valid_handler)(struct nl_msg *, void *),
 104                               void *valid_data)
 105 {
 106         struct nl_cb *cb;
 107         int err = -ENOMEM;
 108
 109         cb = nl_cb_clone(drv->nl_cb);
 110         if (!cb)
 111                 goto out;
 112
 113         err = nl_send_auto_complete(drv->nl_handle, msg);
 114         if (err < 0)
 115                 goto out;
 116
 117         err = 1;
 118
 119         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 120         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 121         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 122
 123         if (valid_handler)
 124                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 125                           valid_handler, valid_data);
 126
 127         while (err > 0)
 128                 nl_recvmsgs(drv->nl_handle, cb);
 129  out:
 130         nl_cb_put(cb);
 131         nlmsg_free(msg);
 132         return err;
 133 }
 134
 135
 136 struct family_data {
 137         const char *group;
 138         int id;
 139 };
 140
 141
 142 static int family_handler(struct nl_msg *msg, void *arg)
 143 {
 144         struct family_data *res = arg;
 145         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 146         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 147         struct nlattr *mcgrp;
 148         int i;
 149
 150         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 151                   genlmsg_attrlen(gnlh, 0), NULL);
 152         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 153                 return NL_SKIP;
 154
 155         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 156                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 157                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 158                           nla_len(mcgrp), NULL);
 159                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 160                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 161                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 162                                res->group,
 163                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 164                         continue;
 165                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 166                 break;
 167         };
 168
 169         return NL_SKIP;
 170 }
 171
 172
 173 static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
 174                                const char *family, const char *group)
 175 {
 176         struct nl_msg *msg;
 177         int ret = -1;
 178         struct family_data res = { group, -ENOENT };
 179
 180         msg = nlmsg_alloc();
 181         if (!msg)
 182                 return -ENOMEM;
 183         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
 184                     0, 0, CTRL_CMD_GETFAMILY, 0);
 185         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 186
 187         ret = send_and_recv_msgs(drv, msg, family_handler, &res);
 188         msg = NULL;
 189         if (ret == 0)
 190                 ret = res.id;
 191
 192 nla_put_failure:
 193         nlmsg_free(msg);
 194         return ret;
 195 }
 196
 197
 198 static int wpa_driver_nl80211_send_oper_ifla(
 199         struct wpa_driver_nl80211_data *drv,
 200         int linkmode, int operstate)
 201 {
 202         struct {
 203                 struct nlmsghdr hdr;
 204                 struct ifinfomsg ifinfo;
 205                 char opts[16];
 206         } req;
 207         struct rtattr *rta;
 208         static int nl_seq;
 209         ssize_t ret;
 210
 211         os_memset(&req, 0, sizeof(req));
 212
 213         req.hdr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
 214         req.hdr.nlmsg_type = RTM_SETLINK;
 215         req.hdr.nlmsg_flags = NLM_F_REQUEST;
 216         req.hdr.nlmsg_seq = ++nl_seq;
 217         req.hdr.nlmsg_pid = 0;
 218
 219         req.ifinfo.ifi_family = AF_UNSPEC;
 220         req.ifinfo.ifi_type = 0;
 221         req.ifinfo.ifi_index = drv->ifindex;
 222         req.ifinfo.ifi_flags = 0;
 223         req.ifinfo.ifi_change = 0;
 224
 225         if (linkmode != -1) {
 226                 rta = (struct rtattr *)
 227                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 228                 rta->rta_type = IFLA_LINKMODE;
 229                 rta->rta_len = RTA_LENGTH(sizeof(char));
 230                 *((char *) RTA_DATA(rta)) = linkmode;
 231                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 232                         RTA_LENGTH(sizeof(char));
 233         }
 234         if (operstate != -1) {
 235                 rta = (struct rtattr *)
 236                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 237                 rta->rta_type = IFLA_OPERSTATE;
 238                 rta->rta_len = RTA_LENGTH(sizeof(char));
 239                 *((char *) RTA_DATA(rta)) = operstate;
 240                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 241                         RTA_LENGTH(sizeof(char));
 242         }
 243
 244         wpa_printf(MSG_DEBUG, "WEXT: Operstate: linkmode=%d, operstate=%d",
 245                    linkmode, operstate);
 246
 247         ret = send(drv->link_event_sock, &req, req.hdr.nlmsg_len, 0);
 248         if (ret < 0) {
 249                 wpa_printf(MSG_DEBUG, "WEXT: Sending operstate IFLA failed: "
 250                            "%s (assume operstate is not supported)",
 251                            strerror(errno));
 252         }
 253
 254         return ret < 0 ? -1 : 0;
 255 }
 256
 257
 258 static int wpa_driver_nl80211_set_auth_param(
 259         struct wpa_driver_nl80211_data *drv, int idx, u32 value)
 260 {
 261         struct iwreq iwr;
 262         int ret = 0;
 263
 264         os_memset(&iwr, 0, sizeof(iwr));
 265         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 266         iwr.u.param.flags = idx & IW_AUTH_INDEX;
 267         iwr.u.param.value = value;
 268
 269         if (ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr) < 0) {
 270                 if (errno != EOPNOTSUPP) {
 271                         wpa_printf(MSG_DEBUG, "WEXT: SIOCSIWAUTH(param %d "
 272                                    "value 0x%x) failed: %s)",
 273                                    idx, value, strerror(errno));
 274                 }
 275                 ret = errno == EOPNOTSUPP ? -2 : -1;
 276         }
 277
 278         return ret;
 279 }
 280
 281
 282 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 283 {
 284         struct wpa_driver_nl80211_data *drv = priv;
 285         if (!drv->associated)
 286                 return -1;
 287         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 288         return 0;
 289 }
 290
 291
 292 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 293 {
 294         struct wpa_driver_nl80211_data *drv = priv;
 295         if (!drv->associated)
 296                 return -1;
 297         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 298         return drv->ssid_len;
 299 }
 300
 301
 302 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 303                                           void *ctx, char *buf, size_t len,
 304                                           int del)
 305 {
 306         union wpa_event_data event;
 307
 308         os_memset(&event, 0, sizeof(event));
 309         if (len > sizeof(event.interface_status.ifname))
 310                 len = sizeof(event.interface_status.ifname) - 1;
 311         os_memcpy(event.interface_status.ifname, buf, len);
 312         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 313                 EVENT_INTERFACE_ADDED;
 314
 315         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 316                    del ? "DEL" : "NEW",
 317                    event.interface_status.ifname,
 318                    del ? "removed" : "added");
 319
 320         if (os_strcmp(drv->ifname, event.interface_status.ifname) == 0) {
 321                 if (del)
 322                         drv->if_removed = 1;
 323                 else
 324                         drv->if_removed = 0;
 325         }
 326
 327         wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
 328 }
 329
 330
 331 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 332                                          struct nlmsghdr *h)
 333 {
 334         struct ifinfomsg *ifi;
 335         int attrlen, _nlmsg_len, rta_len;
 336         struct rtattr *attr;
 337
 338         ifi = NLMSG_DATA(h);
 339
 340         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 341
 342         attrlen = h->nlmsg_len - _nlmsg_len;
 343         if (attrlen < 0)
 344                 return 0;
 345
 346         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 347
 348         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 349         while (RTA_OK(attr, attrlen)) {
 350                 if (attr->rta_type == IFLA_IFNAME) {
 351                         if (os_strcmp(((char *) attr) + rta_len, drv->ifname)
 352                             == 0)
 353                                 return 1;
 354                         else
 355                                 break;
 356                 }
 357                 attr = RTA_NEXT(attr, attrlen);
 358         }
 359
 360         return 0;
 361 }
 362
 363
 364 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 365                                           int ifindex, struct nlmsghdr *h)
 366 {
 367         if (drv->ifindex == ifindex)
 368                 return 1;
 369
 370         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, h)) {
 371                 drv->ifindex = if_nametoindex(drv->ifname);
 372                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 373                            "interface");
 374                 wpa_driver_nl80211_finish_drv_init(drv);
 375                 return 1;
 376         }
 377
 378         return 0;
 379 }
 380
 381
 382 static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data *drv,
 383                                               void *ctx, struct nlmsghdr *h,
 384                                               size_t len)
 385 {
 386         struct ifinfomsg *ifi;
 387         int attrlen, _nlmsg_len, rta_len;
 388         struct rtattr * attr;
 389
 390         if (len < sizeof(*ifi))
 391                 return;
 392
 393         ifi = NLMSG_DATA(h);
 394
 395         if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, h)) {
 396                 wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d",
 397                            ifi->ifi_index);
 398                 return;
 399         }
 400
 401         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 402                    "(%s%s%s%s)",
 403                    drv->operstate, ifi->ifi_flags,
 404                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 405                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 406                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 407                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 408         /*
 409          * Some drivers send the association event before the operup event--in
 410          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 411          * fails. This will hit us when wpa_supplicant does not need to do
 412          * IEEE 802.1X authentication
 413          */
 414         if (drv->operstate == 1 &&
 415             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 416             !(ifi->ifi_flags & IFF_RUNNING))
 417                 wpa_driver_nl80211_send_oper_ifla(drv, -1, IF_OPER_UP);
 418
 419         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 420
 421         attrlen = h->nlmsg_len - _nlmsg_len;
 422         if (attrlen < 0)
 423                 return;
 424
 425         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 426
 427         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 428         while (RTA_OK(attr, attrlen)) {
 429                 if (attr->rta_type == IFLA_IFNAME) {
 430                         wpa_driver_nl80211_event_link(
 431                                 drv, ctx,
 432                                 ((char *) attr) + rta_len,
 433                                 attr->rta_len - rta_len, 0);
 434                 }
 435                 attr = RTA_NEXT(attr, attrlen);
 436         }
 437 }
 438
 439
 440 static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data *drv,
 441                                               void *ctx, struct nlmsghdr *h,
 442                                               size_t len)
 443 {
 444         struct ifinfomsg *ifi;
 445         int attrlen, _nlmsg_len, rta_len;
 446         struct rtattr * attr;
 447
 448         if (len < sizeof(*ifi))
 449                 return;
 450
 451         ifi = NLMSG_DATA(h);
 452
 453         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 454
 455         attrlen = h->nlmsg_len - _nlmsg_len;
 456         if (attrlen < 0)
 457                 return;
 458
 459         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 460
 461         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 462         while (RTA_OK(attr, attrlen)) {
 463                 if (attr->rta_type == IFLA_IFNAME) {
 464                         wpa_driver_nl80211_event_link(
 465                                 drv, ctx,
 466                                 ((char *) attr) + rta_len,
 467                                 attr->rta_len - rta_len, 1);
 468                 }
 469                 attr = RTA_NEXT(attr, attrlen);
 470         }
 471 }
 472
 473
 474 static void wpa_driver_nl80211_event_receive_link(int sock, void *eloop_ctx,
 475                                                   void *sock_ctx)
 476 {
 477         char buf[8192];
 478         int left;
 479         struct sockaddr_nl from;
 480         socklen_t fromlen;
 481         struct nlmsghdr *h;
 482         int max_events = 10;
 483
 484 try_again:
 485         fromlen = sizeof(from);
 486         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
 487                         (struct sockaddr *) &from, &fromlen);
 488         if (left < 0) {
 489                 if (errno != EINTR && errno != EAGAIN)
 490                         perror("recvfrom(netlink)");
 491                 return;
 492         }
 493
 494         h = (struct nlmsghdr *) buf;
 495         while (left >= (int) sizeof(*h)) {
 496                 int len, plen;
 497
 498                 len = h->nlmsg_len;
 499                 plen = len - sizeof(*h);
 500                 if (len > left || plen < 0) {
 501                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
 502                                    "len=%d left=%d plen=%d",
 503                                    len, left, plen);
 504                         break;
 505                 }
 506
 507                 switch (h->nlmsg_type) {
 508                 case RTM_NEWLINK:
 509                         wpa_driver_nl80211_event_rtm_newlink(eloop_ctx, sock_ctx,
 510                                                           h, plen);
 511                         break;
 512                 case RTM_DELLINK:
 513                         wpa_driver_nl80211_event_rtm_dellink(eloop_ctx, sock_ctx,
 514                                                           h, plen);
 515                         break;
 516                 }
 517
 518                 len = NLMSG_ALIGN(len);
 519                 left -= len;
 520                 h = (struct nlmsghdr *) ((char *) h + len);
 521         }
 522
 523         if (left > 0) {
 524                 wpa_printf(MSG_DEBUG, "%d extra bytes in the end of netlink "
 525                            "message", left);
 526         }
 527
 528         if (--max_events > 0) {
 529                 /*
 530                  * Try to receive all events in one eloop call in order to
 531                  * limit race condition on cases where AssocInfo event, Assoc
 532                  * event, and EAPOL frames are received more or less at the
 533                  * same time. We want to process the event messages first
 534                  * before starting EAPOL processing.
 535                  */
 536                 goto try_again;
 537         }
 538 }
 539
 540
 541 static int no_seq_check(struct nl_msg *msg, void *arg)
 542 {
 543         return NL_OK;
 544 }
 545
 546
 547 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
 548                             const u8 *frame, size_t len)
 549 {
 550         const struct ieee80211_mgmt *mgmt;
 551         union wpa_event_data event;
 552
 553         mgmt = (const struct ieee80211_mgmt *) frame;
 554         if (len < 24 + sizeof(mgmt->u.auth)) {
 555                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 556                            "frame");
 557                 return;
 558         }
 559
 560         os_memset(&event, 0, sizeof(event));
 561         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
 562         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
 563         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
 564         if (len > 24 + sizeof(mgmt->u.auth)) {
 565                 event.auth.ies = mgmt->u.auth.variable;
 566                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
 567         }
 568
 569         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
 570 }
 571
 572
 573 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
 574                             const u8 *frame, size_t len)
 575 {
 576         const struct ieee80211_mgmt *mgmt;
 577         union wpa_event_data event;
 578         u16 status;
 579
 580         mgmt = (const struct ieee80211_mgmt *) frame;
 581         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
 582                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 583                            "frame");
 584                 return;
 585         }
 586
 587         status = le_to_host16(mgmt->u.assoc_resp.status_code);
 588         if (status != WLAN_STATUS_SUCCESS) {
 589                 wpa_printf(MSG_DEBUG, "nl80211: Association failed: status "
 590                            "code %d", status);
 591                 /* TODO: notify SME so that things like SA Query and comeback
 592                  * time can be implemented */
 593                 return;
 594         }
 595
 596         drv->associated = 1;
 597         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
 598
 599         os_memset(&event, 0, sizeof(event));
 600         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 601                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
 602                 event.assoc_info.resp_ies_len =
 603                         len - 24 - sizeof(mgmt->u.assoc_req);
 604         }
 605
 606         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 607 }
 608
 609
 610 static void mlme_event(struct wpa_driver_nl80211_data *drv,
 611                        enum nl80211_commands cmd, struct nlattr *frame)
 612 {
 613         if (frame == NULL) {
 614                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
 615                            "data", cmd);
 616                 return;
 617         }
 618
 619         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
 620         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
 621                     nla_data(frame), nla_len(frame));
 622
 623         switch (cmd) {
 624         case NL80211_CMD_AUTHENTICATE:
 625                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
 626                 break;
 627         case NL80211_CMD_ASSOCIATE:
 628                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
 629                 break;
 630         case NL80211_CMD_DEAUTHENTICATE:
 631                 drv->associated = 0;
 632                 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
 633                 break;
 634         case NL80211_CMD_DISASSOCIATE:
 635                 drv->associated = 0;
 636                 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
 637                 break;
 638         default:
 639                 break;
 640         }
 641 }
 642
 643
 644 static int process_event(struct nl_msg *msg, void *arg)
 645 {
 646         struct wpa_driver_nl80211_data *drv = arg;
 647         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 648         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 649
 650         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 651                   genlmsg_attrlen(gnlh, 0), NULL);
 652
 653         if (tb[NL80211_ATTR_IFINDEX]) {
 654                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 655                 if (ifindex != drv->ifindex) {
 656                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
 657                                    " for foreign interface (ifindex %d)",
 658                                    gnlh->cmd, ifindex);
 659                         return NL_SKIP;
 660                 }
 661         }
 662
 663         switch (gnlh->cmd) {
 664         case NL80211_CMD_NEW_SCAN_RESULTS:
 665                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
 666                 drv->scan_complete_events = 1;
 667                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 668                                      drv->ctx);
 669                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 670                 break;
 671         case NL80211_CMD_SCAN_ABORTED:
 672                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
 673                 /*
 674                  * Need to indicate that scan results are available in order
 675                  * not to make wpa_supplicant stop its scanning.
 676                  */
 677                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 678                                      drv->ctx);
 679                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 680                 break;
 681         case NL80211_CMD_AUTHENTICATE:
 682         case NL80211_CMD_ASSOCIATE:
 683         case NL80211_CMD_DEAUTHENTICATE:
 684         case NL80211_CMD_DISASSOCIATE:
 685                 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME]);
 686                 break;
 687         default:
 688                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
 689                            "(cmd=%d)", gnlh->cmd);
 690                 break;
 691         }
 692
 693         return NL_SKIP;
 694 }
 695
 696
 697 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
 698                                              void *sock_ctx)
 699 {
 700         struct nl_cb *cb;
 701         struct wpa_driver_nl80211_data *drv = eloop_ctx;
 702
 703         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
 704
 705         cb = nl_cb_clone(drv->nl_cb);
 706         if (!cb)
 707                 return;
 708         nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 709         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
 710         nl_recvmsgs(drv->nl_handle, cb);
 711         nl_cb_put(cb);
 712 }
 713
 714
 715 static int wpa_driver_nl80211_get_ifflags_ifname(struct wpa_driver_nl80211_data *drv,
 716                                               const char *ifname, int *flags)
 717 {
 718         struct ifreq ifr;
 719
 720         os_memset(&ifr, 0, sizeof(ifr));
 721         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
 722         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, (caddr_t) &ifr) < 0) {
 723                 perror("ioctl[SIOCGIFFLAGS]");
 724                 return -1;
 725         }
 726         *flags = ifr.ifr_flags & 0xffff;
 727         return 0;
 728 }
 729
 730
 731 /**
 732  * wpa_driver_nl80211_get_ifflags - Get interface flags (SIOCGIFFLAGS)
 733  * @drv: driver_nl80211 private data
 734  * @flags: Pointer to returned flags value
 735  * Returns: 0 on success, -1 on failure
 736  */
 737 static int wpa_driver_nl80211_get_ifflags(struct wpa_driver_nl80211_data *drv,
 738                                           int *flags)
 739 {
 740         return wpa_driver_nl80211_get_ifflags_ifname(drv, drv->ifname, flags);
 741 }
 742
 743
 744 static int wpa_driver_nl80211_set_ifflags_ifname(
 745         struct wpa_driver_nl80211_data *drv,
 746         const char *ifname, int flags)
 747 {
 748         struct ifreq ifr;
 749
 750         os_memset(&ifr, 0, sizeof(ifr));
 751         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
 752         ifr.ifr_flags = flags & 0xffff;
 753         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, (caddr_t) &ifr) < 0) {
 754                 perror("SIOCSIFFLAGS");
 755                 return -1;
 756         }
 757         return 0;
 758 }
 759
 760
 761 /**
 762  * wpa_driver_nl80211_set_ifflags - Set interface flags (SIOCSIFFLAGS)
 763  * @drv: driver_nl80211 private data
 764  * @flags: New value for flags
 765  * Returns: 0 on success, -1 on failure
 766  */
 767 static int wpa_driver_nl80211_set_ifflags(struct wpa_driver_nl80211_data *drv,
 768                                           int flags)
 769 {
 770         return wpa_driver_nl80211_set_ifflags_ifname(drv, drv->ifname, flags);
 771 }
 772
 773
 774 /**
 775  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
 776  * @priv: driver_nl80211 private data
 777  * @alpha2_arg: country to which to switch to
 778  * Returns: 0 on success, -1 on failure
 779  *
 780  * This asks nl80211 to set the regulatory domain for given
 781  * country ISO / IEC alpha2.
 782  */
 783 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
 784 {
 785         struct wpa_driver_nl80211_data *drv = priv;
 786         char alpha2[3];
 787         struct nl_msg *msg;
 788
 789         msg = nlmsg_alloc();
 790         if (!msg)
 791                 goto nla_put_failure;
 792
 793         alpha2[0] = alpha2_arg[0];
 794         alpha2[1] = alpha2_arg[1];
 795         alpha2[2] = '\0';
 796
 797         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 798                     0, NL80211_CMD_REQ_SET_REG, 0);
 799
 800         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
 801         if (send_and_recv_msgs(drv, msg, NULL, NULL))
 802                 return -EINVAL;
 803         return 0;
 804 nla_put_failure:
 805         return -EINVAL;
 806 }
 807
 808
 809 struct wiphy_info_data {
 810         int max_scan_ssids;
 811         int ap_supported;
 812 };
 813
 814
 815 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
 816 {
 817         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 818         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 819         struct wiphy_info_data *info = arg;
 820
 821         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 822                   genlmsg_attrlen(gnlh, 0), NULL);
 823
 824         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
 825                 info->max_scan_ssids =
 826                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
 827
 828         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
 829                 struct nlattr *nl_mode;
 830                 int i;
 831                 nla_for_each_nested(nl_mode,
 832                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
 833                         if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
 834                                 info->ap_supported = 1;
 835                                 break;
 836                         }
 837                 }
 838         }
 839
 840         return NL_SKIP;
 841 }
 842
 843
 844 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
 845                                        struct wiphy_info_data *info)
 846 {
 847         struct nl_msg *msg;
 848
 849         os_memset(info, 0, sizeof(*info));
 850         msg = nlmsg_alloc();
 851         if (!msg)
 852                 return -1;
 853
 854         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 855                     0, NL80211_CMD_GET_WIPHY, 0);
 856
 857         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 858
 859         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
 860                 return 0;
 861         msg = NULL;
 862 nla_put_failure:
 863         nlmsg_free(msg);
 864         return -1;
 865 }
 866
 867
 868 static void wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
 869 {
 870         struct wiphy_info_data info;
 871         if (wpa_driver_nl80211_get_info(drv, &info))
 872                 return;
 873         drv->has_capability = 1;
 874         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
 875         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
 876                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
 877                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
 878                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
 879         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
 880                 WPA_DRIVER_CAPA_ENC_WEP104 |
 881                 WPA_DRIVER_CAPA_ENC_TKIP |
 882                 WPA_DRIVER_CAPA_ENC_CCMP;
 883
 884         drv->capa.max_scan_ssids = info.max_scan_ssids;
 885         if (info.ap_supported)
 886                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
 887 }
 888
 889
 890 /**
 891  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
 892  * @ctx: context to be used when calling wpa_supplicant functions,
 893  * e.g., wpa_supplicant_event()
 894  * @ifname: interface name, e.g., wlan0
 895  * Returns: Pointer to private data, %NULL on failure
 896  */
 897 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
 898 {
 899         int s, ret;
 900         struct sockaddr_nl local;
 901         struct wpa_driver_nl80211_data *drv;
 902
 903         drv = os_zalloc(sizeof(*drv));
 904         if (drv == NULL)
 905                 return NULL;
 906         drv->ctx = ctx;
 907         os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
 908
 909         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
 910         if (drv->nl_cb == NULL) {
 911                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 912                            "callbacks");
 913                 goto err1;
 914         }
 915
 916         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
 917         if (drv->nl_handle == NULL) {
 918                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
 919                            "callbacks");
 920                 goto err2;
 921         }
 922
 923         if (genl_connect(drv->nl_handle)) {
 924                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
 925                            "netlink");
 926                 goto err3;
 927         }
 928
 929         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
 930         if (drv->nl_cache == NULL) {
 931                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
 932                            "netlink cache");
 933                 goto err3;
 934         }
 935
 936         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
 937         if (drv->nl80211 == NULL) {
 938                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
 939                            "found");
 940                 goto err4;
 941         }
 942
 943         ret = nl_get_multicast_id(drv, "nl80211", "scan");
 944         if (ret >= 0)
 945                 ret = nl_socket_add_membership(drv->nl_handle, ret);
 946         if (ret < 0) {
 947                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
 948                            "membership for scan events: %d (%s)",
 949                            ret, strerror(-ret));
 950                 goto err4;
 951         }
 952
 953         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
 954         if (ret >= 0)
 955                 ret = nl_socket_add_membership(drv->nl_handle, ret);
 956         if (ret < 0) {
 957                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
 958                            "membership for mlme events: %d (%s)",
 959                            ret, strerror(-ret));
 960                 goto err4;
 961         }
 962         drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
 963
 964         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
 965                                  wpa_driver_nl80211_event_receive, drv, ctx);
 966
 967         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
 968         if (drv->ioctl_sock < 0) {
 969                 perror("socket(PF_INET,SOCK_DGRAM)");
 970                 goto err5;
 971         }
 972
 973         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
 974         if (s < 0) {
 975                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
 976                 goto err6;
 977         }
 978
 979         os_memset(&local, 0, sizeof(local));
 980         local.nl_family = AF_NETLINK;
 981         local.nl_groups = RTMGRP_LINK;
 982         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
 983                 perror("bind(netlink)");
 984                 close(s);
 985                 goto err6;
 986         }
 987
 988         eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_link, drv,
 989                                  ctx);
 990         drv->link_event_sock = s;
 991
 992         if (wpa_driver_nl80211_finish_drv_init(drv))
 993                 goto err7;
 994
 995         return drv;
 996
 997 err7:
 998         eloop_unregister_read_sock(drv->link_event_sock);
 999         close(drv->link_event_sock);
1000 err6:
1001         close(drv->ioctl_sock);
1002 err5:
1003         genl_family_put(drv->nl80211);
1004 err4:
1005         nl_cache_free(drv->nl_cache);
1006 err3:
1007         nl_handle_destroy(drv->nl_handle);
1008 err2:
1009         nl_cb_put(drv->nl_cb);
1010 err1:
1011         os_free(drv);
1012         return NULL;
1013 }
1014
1015
1016 static int
1017 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
1018 {
1019         int flags;
1020
1021         drv->ifindex = if_nametoindex(drv->ifname);
1022
1023         if (wpa_driver_nl80211_set_mode(drv, 0) < 0) {
1024                 wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
1025                            "use managed mode");
1026         }
1027
1028         if (wpa_driver_nl80211_get_ifflags(drv, &flags) != 0) {
1029                 wpa_printf(MSG_ERROR, "Could not get interface '%s' flags",
1030                            drv->ifname);
1031                 return -1;
1032         }
1033         if (!(flags & IFF_UP)) {
1034                 if (wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP) != 0) {
1035                         wpa_printf(MSG_ERROR, "Could not set interface '%s' "
1036                                    "UP", drv->ifname);
1037                         return -1;
1038                 }
1039         }
1040
1041         wpa_driver_nl80211_capa(drv);
1042
1043         wpa_driver_nl80211_send_oper_ifla(drv, 1, IF_OPER_DORMANT);
1044
1045         return 0;
1046 }
1047
1048
1049 /**
1050  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
1051  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1052  *
1053  * Shut down driver interface and processing of driver events. Free
1054  * private data buffer if one was allocated in wpa_driver_nl80211_init().
1055  */
1056 static void wpa_driver_nl80211_deinit(void *priv)
1057 {
1058         struct wpa_driver_nl80211_data *drv = priv;
1059         int flags;
1060
1061         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1062
1063         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED, 0);
1064
1065         wpa_driver_nl80211_send_oper_ifla(priv, 0, IF_OPER_UP);
1066
1067         eloop_unregister_read_sock(drv->link_event_sock);
1068
1069         if (wpa_driver_nl80211_get_ifflags(drv, &flags) == 0)
1070                 (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
1071         wpa_driver_nl80211_set_mode(drv, 0);
1072
1073         close(drv->link_event_sock);
1074         close(drv->ioctl_sock);
1075
1076         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
1077         genl_family_put(drv->nl80211);
1078         nl_cache_free(drv->nl_cache);
1079         nl_handle_destroy(drv->nl_handle);
1080         nl_cb_put(drv->nl_cb);
1081
1082         os_free(drv);
1083 }
1084
1085
1086 /**
1087  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
1088  * @eloop_ctx: Unused
1089  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
1090  *
1091  * This function can be used as registered timeout when starting a scan to
1092  * generate a scan completed event if the driver does not report this.
1093  */
1094 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1095 {
1096         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
1097         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
1098 }
1099
1100
1101 /**
1102  * wpa_driver_nl80211_scan - Request the driver to initiate scan
1103  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1104  * @params: Scan parameters
1105  * Returns: 0 on success, -1 on failure
1106  */
1107 static int wpa_driver_nl80211_scan(void *priv,
1108                                    struct wpa_driver_scan_params *params)
1109 {
1110         struct wpa_driver_nl80211_data *drv = priv;
1111         int ret = 0, timeout;
1112         struct nl_msg *msg, *ssids, *freqs;
1113         size_t i;
1114
1115         msg = nlmsg_alloc();
1116         ssids = nlmsg_alloc();
1117         freqs = nlmsg_alloc();
1118         if (!msg || !ssids || !freqs) {
1119                 nlmsg_free(msg);
1120                 nlmsg_free(ssids);
1121                 nlmsg_free(freqs);
1122                 return -1;
1123         }
1124
1125         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1126                     NL80211_CMD_TRIGGER_SCAN, 0);
1127
1128         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1129
1130         for (i = 0; i < params->num_ssids; i++) {
1131                 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
1132                         params->ssids[i].ssid);
1133         }
1134         if (params->num_ssids)
1135                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
1136
1137         if (params->extra_ies) {
1138                 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
1139                         params->extra_ies);
1140         }
1141
1142         if (params->freqs) {
1143                 for (i = 0; params->freqs[i]; i++)
1144                         NLA_PUT_U32(freqs, i + 1, params->freqs[i]);
1145                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
1146         }
1147
1148         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1149         msg = NULL;
1150         if (ret) {
1151                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
1152                            "(%s)", ret, strerror(-ret));
1153                 goto nla_put_failure;
1154         }
1155
1156         /* Not all drivers generate "scan completed" wireless event, so try to
1157          * read results after a timeout. */
1158         timeout = 10;
1159         if (drv->scan_complete_events) {
1160                 /*
1161                  * The driver seems to deliver events to notify when scan is
1162                  * complete, so use longer timeout to avoid race conditions
1163                  * with scanning and following association request.
1164                  */
1165                 timeout = 30;
1166         }
1167         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
1168                    "seconds", ret, timeout);
1169         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1170         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
1171                                drv, drv->ctx);
1172
1173 nla_put_failure:
1174         nlmsg_free(ssids);
1175         nlmsg_free(msg);
1176         nlmsg_free(freqs);
1177         return ret;
1178 }
1179
1180
1181 static int bss_info_handler(struct nl_msg *msg, void *arg)
1182 {
1183         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1184         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1185         struct nlattr *bss[NL80211_BSS_MAX + 1];
1186         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1187                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
1188                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1189                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1190                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1191                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1192                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
1193                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1194                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1195         };
1196         struct wpa_scan_results *res = arg;
1197         struct wpa_scan_res **tmp;
1198         struct wpa_scan_res *r;
1199         const u8 *ie;
1200         size_t ie_len;
1201
1202         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1203                   genlmsg_attrlen(gnlh, 0), NULL);
1204         if (!tb[NL80211_ATTR_BSS])
1205                 return NL_SKIP;
1206         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
1207                              bss_policy))
1208                 return NL_SKIP;
1209         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
1210                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1211                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1212         } else {
1213                 ie = NULL;
1214                 ie_len = 0;
1215         }
1216
1217         r = os_zalloc(sizeof(*r) + ie_len);
1218         if (r == NULL)
1219                 return NL_SKIP;
1220         if (bss[NL80211_BSS_BSSID])
1221                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
1222                           ETH_ALEN);
1223         if (bss[NL80211_BSS_FREQUENCY])
1224                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1225         if (bss[NL80211_BSS_BEACON_INTERVAL])
1226                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
1227         if (bss[NL80211_BSS_CAPABILITY])
1228                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1229         r->flags |= WPA_SCAN_NOISE_INVALID;
1230         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1231                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1232                 r->level /= 100; /* mBm to dBm */
1233                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
1234         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1235                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1236                 r->flags |= WPA_SCAN_LEVEL_INVALID;
1237         } else
1238                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
1239         if (bss[NL80211_BSS_TSF])
1240                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
1241         r->ie_len = ie_len;
1242         if (ie)
1243                 os_memcpy(r + 1, ie, ie_len);
1244
1245         tmp = os_realloc(res->res,
1246                          (res->num + 1) * sizeof(struct wpa_scan_res *));
1247         if (tmp == NULL) {
1248                 os_free(r);
1249                 return NL_SKIP;
1250         }
1251         tmp[res->num++] = r;
1252         res->res = tmp;
1253
1254         return NL_SKIP;
1255 }
1256
1257
1258 /**
1259  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1260  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1261  * Returns: Scan results on success, -1 on failure
1262  */
1263 static struct wpa_scan_results *
1264 wpa_driver_nl80211_get_scan_results(void *priv)
1265 {
1266         struct wpa_driver_nl80211_data *drv = priv;
1267         struct nl_msg *msg;
1268         struct wpa_scan_results *res;
1269         int ret;
1270
1271         res = os_zalloc(sizeof(*res));
1272         if (res == NULL)
1273                 return 0;
1274         msg = nlmsg_alloc();
1275         if (!msg)
1276                 goto nla_put_failure;
1277
1278         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
1279                     NL80211_CMD_GET_SCAN, 0);
1280         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1281
1282         ret = send_and_recv_msgs(drv, msg, bss_info_handler, res);
1283         msg = NULL;
1284         if (ret == 0) {
1285                 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
1286                            (unsigned long) res->num);
1287                 return res;
1288         }
1289         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1290                    "(%s)", ret, strerror(-ret));
1291 nla_put_failure:
1292         nlmsg_free(msg);
1293         wpa_scan_results_free(res);
1294         return NULL;
1295 }
1296
1297
1298 static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
1299                                       const u8 *addr, int key_idx,
1300                                       int set_tx, const u8 *seq,
1301                                       size_t seq_len,
1302                                       const u8 *key, size_t key_len)
1303 {
1304         struct wpa_driver_nl80211_data *drv = priv;
1305         int err;
1306         struct nl_msg *msg;
1307
1308         wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
1309                    "seq_len=%lu key_len=%lu",
1310                    __func__, alg, addr, key_idx, set_tx,
1311                    (unsigned long) seq_len, (unsigned long) key_len);
1312
1313         msg = nlmsg_alloc();
1314         if (msg == NULL)
1315                 return -1;
1316
1317         if (alg == WPA_ALG_NONE) {
1318                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1319                             NL80211_CMD_DEL_KEY, 0);
1320         } else {
1321                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1322                             NL80211_CMD_NEW_KEY, 0);
1323                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
1324                 switch (alg) {
1325                 case WPA_ALG_WEP:
1326                         if (key_len == 5)
1327                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1328                                             0x000FAC01);
1329                         else
1330                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1331                                             0x000FAC05);
1332                         break;
1333                 case WPA_ALG_TKIP:
1334                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
1335                         break;
1336                 case WPA_ALG_CCMP:
1337                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
1338                         break;
1339                 default:
1340                         nlmsg_free(msg);
1341                         return -1;
1342                 }
1343         }
1344
1345         if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1346         {
1347                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
1348                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1349         }
1350         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1351         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1352
1353         err = send_and_recv_msgs(drv, msg, NULL, NULL);
1354         if (err) {
1355                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d", err);
1356                 return -1;
1357         }
1358
1359         if (set_tx && alg != WPA_ALG_NONE) {
1360                 msg = nlmsg_alloc();
1361                 if (msg == NULL)
1362                         return -1;
1363
1364                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1365                             0, NL80211_CMD_SET_KEY, 0);
1366                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1367                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1368                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
1369
1370                 err = send_and_recv_msgs(drv, msg, NULL, NULL);
1371                 if (err) {
1372                         wpa_printf(MSG_DEBUG, "nl80211: set default key "
1373                                    "failed; err=%d", err);
1374                         return -1;
1375                 }
1376         }
1377
1378         return 0;
1379
1380 nla_put_failure:
1381         return -ENOBUFS;
1382 }
1383
1384
1385 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
1386                                    const u8 *addr, int cmd, u16 reason_code)
1387 {
1388         int ret = -1;
1389         struct nl_msg *msg;
1390
1391         msg = nlmsg_alloc();
1392         if (!msg)
1393                 return -1;
1394
1395         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
1396
1397         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1398         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
1399         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1400
1401         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1402         msg = NULL;
1403         if (ret) {
1404                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1405                            "(%s)", ret, strerror(-ret));
1406                 goto nla_put_failure;
1407         }
1408         ret = 0;
1409
1410 nla_put_failure:
1411         nlmsg_free(msg);
1412         return ret;
1413 }
1414
1415
1416 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
1417                                              int reason_code)
1418 {
1419         struct wpa_driver_nl80211_data *drv = priv;
1420         wpa_printf(MSG_DEBUG, "%s", __func__);
1421         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
1422                                        reason_code);
1423 }
1424
1425
1426 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
1427                                            int reason_code)
1428 {
1429         struct wpa_driver_nl80211_data *drv = priv;
1430         wpa_printf(MSG_DEBUG, "%s", __func__);
1431         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
1432                                        reason_code);
1433 }
1434
1435
1436 static int wpa_driver_nl80211_authenticate(
1437         void *priv, struct wpa_driver_auth_params *params)
1438 {
1439         struct wpa_driver_nl80211_data *drv = priv;
1440         int ret = -1;
1441         struct nl_msg *msg;
1442         enum nl80211_auth_type type;
1443
1444         drv->associated = 0;
1445
1446         msg = nlmsg_alloc();
1447         if (!msg)
1448                 return -1;
1449
1450         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
1451                    drv->ifindex);
1452         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1453                     NL80211_CMD_AUTHENTICATE, 0);
1454
1455         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1456         if (params->bssid) {
1457                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
1458                            MAC2STR(params->bssid));
1459                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
1460         }
1461         if (params->freq) {
1462                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
1463                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
1464         }
1465         if (params->ssid) {
1466                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
1467                                   params->ssid, params->ssid_len);
1468                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
1469                         params->ssid);
1470         }
1471         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
1472         if (params->ie)
1473                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
1474         /*
1475          * TODO: if multiple auth_alg options enabled, try them one by one if
1476          * the AP rejects authentication due to unknown auth alg
1477          */
1478         if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
1479                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1480         else if (params->auth_alg & AUTH_ALG_SHARED_KEY)
1481                 type = NL80211_AUTHTYPE_SHARED_KEY;
1482         else if (params->auth_alg & AUTH_ALG_LEAP)
1483                 type = NL80211_AUTHTYPE_NETWORK_EAP;
1484         else if (params->auth_alg & AUTH_ALG_FT)
1485                 type = NL80211_AUTHTYPE_FT;
1486         else
1487                 goto nla_put_failure;
1488         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
1489         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
1490
1491         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1492         msg = NULL;
1493         if (ret) {
1494                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1495                            "(%s)", ret, strerror(-ret));
1496                 goto nla_put_failure;
1497         }
1498         ret = 0;
1499         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
1500                    "successfully");
1501
1502 nla_put_failure:
1503         nlmsg_free(msg);
1504         return ret;
1505 }
1506
1507
1508 #ifdef CONFIG_AP
1509 static int wpa_driver_nl80211_set_freq2(
1510         struct wpa_driver_nl80211_data *drv,
1511         struct wpa_driver_associate_params *params)
1512 {
1513         struct nl_msg *msg;
1514
1515         msg = nlmsg_alloc();
1516         if (!msg)
1517                 return -1;
1518
1519         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1520                     NL80211_CMD_SET_WIPHY, 0);
1521
1522         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1523
1524         /* TODO: proper channel configuration */
1525         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, 2437);
1526
1527         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
1528                 return 0;
1529 nla_put_failure:
1530         return -1;
1531 }
1532
1533
1534 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
1535                                  struct wpa_driver_associate_params *params)
1536 {
1537         if (wpa_driver_nl80211_set_mode(drv, params->mode) ||
1538             wpa_driver_nl80211_set_freq2(drv, params))
1539                 return -1;
1540
1541         /* TODO: setup monitor interface (and add code somewhere to remove this
1542          * when AP mode is stopped; associate with mode != 2 or drv_deinit) */
1543         /* TODO: setup beacon */
1544
1545         return 0;
1546 }
1547 #endif /* CONFIG_AP */
1548
1549
1550 static int wpa_driver_nl80211_associate(
1551         void *priv, struct wpa_driver_associate_params *params)
1552 {
1553         struct wpa_driver_nl80211_data *drv = priv;
1554         int ret = -1;
1555         struct nl_msg *msg;
1556
1557 #ifdef CONFIG_AP
1558         if (params->mode == 2)
1559                 return wpa_driver_nl80211_ap(drv, params);
1560 #endif /* CONFIG_AP */
1561
1562         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
1563                                           params->drop_unencrypted);
1564
1565         drv->associated = 0;
1566
1567         msg = nlmsg_alloc();
1568         if (!msg)
1569                 return -1;
1570
1571         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
1572                    drv->ifindex);
1573         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1574                     NL80211_CMD_ASSOCIATE, 0);
1575
1576         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1577         if (params->bssid) {
1578                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
1579                            MAC2STR(params->bssid));
1580                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
1581         }
1582         if (params->freq) {
1583                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
1584                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
1585         }
1586         if (params->ssid) {
1587                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
1588                                   params->ssid, params->ssid_len);
1589                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
1590                         params->ssid);
1591                 if (params->ssid_len > sizeof(drv->ssid))
1592                         goto nla_put_failure;
1593                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
1594                 drv->ssid_len = params->ssid_len;
1595         }
1596         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
1597         if (params->wpa_ie)
1598                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
1599                         params->wpa_ie);
1600
1601         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1602         msg = NULL;
1603         if (ret) {
1604                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1605                            "(%s)", ret, strerror(-ret));
1606                 goto nla_put_failure;
1607         }
1608         ret = 0;
1609         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
1610                    "successfully");
1611
1612 nla_put_failure:
1613         nlmsg_free(msg);
1614         return ret;
1615 }
1616
1617
1618 /**
1619  * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc), SIOCSIWMODE
1620  * @drv: Pointer to private driver data from wpa_driver_nl80211_init()
1621  * @mode: 0 = infra/BSS (associate with an AP), 1 = adhoc/IBSS
1622  * Returns: 0 on success, -1 on failure
1623  */
1624 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
1625                                        int mode)
1626 {
1627         int ret = -1, flags;
1628         struct nl_msg *msg;
1629         int nlmode;
1630
1631         switch (mode) {
1632         case 0:
1633                 nlmode = NL80211_IFTYPE_STATION;
1634                 break;
1635         case 1:
1636                 nlmode = NL80211_IFTYPE_ADHOC;
1637                 break;
1638         case 2:
1639                 nlmode = NL80211_IFTYPE_AP;
1640                 break;
1641         default:
1642                 return -1;
1643         }
1644
1645         msg = nlmsg_alloc();
1646         if (!msg)
1647                 return -1;
1648
1649         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1650                     0, NL80211_CMD_SET_INTERFACE, 0);
1651         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1652         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
1653
1654         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1655         if (!ret)
1656                 return 0;
1657         else
1658                 goto try_again;
1659
1660 nla_put_failure:
1661         wpa_printf(MSG_ERROR, "nl80211: Failed to set interface mode: %d (%s)",
1662                    ret, strerror(-ret));
1663         return -1;
1664
1665 try_again:
1666         /* mac80211 doesn't allow mode changes while the device is up, so
1667          * take the device down, try to set the mode again, and bring the
1668          * device back up.
1669          */
1670         if (wpa_driver_nl80211_get_ifflags(drv, &flags) == 0) {
1671                 (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
1672
1673                 /* Try to set the mode again while the interface is down */
1674                 msg = nlmsg_alloc();
1675                 if (!msg)
1676                         return -1;
1677
1678                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1679                             0, NL80211_CMD_SET_INTERFACE, 0);
1680                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1681                 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
1682                 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1683                 if (ret) {
1684                         wpa_printf(MSG_ERROR, "Failed to set interface %s "
1685                                    "mode(try_again): %d (%s)",
1686                                    drv->ifname, ret, strerror(-ret));
1687                 }
1688
1689                 /* Ignore return value of get_ifflags to ensure that the device
1690                  * is always up like it was before this function was called.
1691                  */
1692                 (void) wpa_driver_nl80211_get_ifflags(drv, &flags);
1693                 (void) wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP);
1694         }
1695
1696         return ret;
1697 }
1698
1699
1700 static int wpa_driver_nl80211_get_capa(void *priv,
1701                                        struct wpa_driver_capa *capa)
1702 {
1703         struct wpa_driver_nl80211_data *drv = priv;
1704         if (!drv->has_capability)
1705                 return -1;
1706         os_memcpy(capa, &drv->capa, sizeof(*capa));
1707         return 0;
1708 }
1709
1710
1711 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
1712 {
1713         struct wpa_driver_nl80211_data *drv = priv;
1714
1715         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
1716                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
1717         drv->operstate = state;
1718         return wpa_driver_nl80211_send_oper_ifla(
1719                 drv, -1, state ? IF_OPER_UP : IF_OPER_DORMANT);
1720 }
1721
1722
1723 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
1724         .name = "nl80211",
1725         .desc = "Linux nl80211/cfg80211",
1726         .get_bssid = wpa_driver_nl80211_get_bssid,
1727         .get_ssid = wpa_driver_nl80211_get_ssid,
1728         .set_key = wpa_driver_nl80211_set_key,
1729         .scan2 = wpa_driver_nl80211_scan,
1730         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
1731         .deauthenticate = wpa_driver_nl80211_deauthenticate,
1732         .disassociate = wpa_driver_nl80211_disassociate,
1733         .authenticate = wpa_driver_nl80211_authenticate,
1734         .associate = wpa_driver_nl80211_associate,
1735         .init = wpa_driver_nl80211_init,
1736         .deinit = wpa_driver_nl80211_deinit,
1737         .get_capa = wpa_driver_nl80211_get_capa,
1738         .set_operstate = wpa_driver_nl80211_set_operstate,
1739         .set_country = wpa_driver_nl80211_set_country,
1740 };