vcs.maemo.org Git - wpasupplicant/blob - src/drivers/driver_nl80211.c

   1 /*
   2  * Driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2002-2008, Jouni Malinen <j@w1.fi>
   4  * Copyright (c) 2003-2004, Instant802 Networks, Inc.
   5  * Copyright (c) 2005-2006, Devicescape Software, Inc.
   6  * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
   7  * Copyright (c) 2009, Atheros Communications
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License version 2 as
  11  * published by the Free Software Foundation.
  12  *
  13  * Alternatively, this software may be distributed under the terms of BSD
  14  * license.
  15  *
  16  * See README and COPYING for more details.
  17  */
  18
  19 #include "includes.h"
  20 #include <sys/ioctl.h>
  21 #include <net/if_arp.h>
  22 #include <netlink/genl/genl.h>
  23 #include <netlink/genl/family.h>
  24 #include <netlink/genl/ctrl.h>
  25 #include "nl80211_copy.h"
  26 #include "wireless_copy.h"
  27
  28 #include "common.h"
  29 #include "driver.h"
  30 #include "eloop.h"
  31 #include "ieee802_11_defs.h"
  32
  33 #if defined(CONFIG_AP) || defined(HOSTAPD)
  34 #include <netpacket/packet.h>
  35 #include <linux/filter.h>
  36 #include "radiotap.h"
  37 #include "radiotap_iter.h"
  38 #endif /* CONFIG_AP || HOSTAPD */
  39
  40 #ifdef CONFIG_AP
  41
  42 #include "../hostapd/hostapd_defs.h"
  43
  44 #ifndef ETH_P_ALL
  45 #define ETH_P_ALL 0x0003
  46 #endif
  47
  48 #endif /* CONFIG_AP */
  49
  50 #ifdef HOSTAPD
  51 #include "../../hostapd/hostapd.h"
  52 #include "../../hostapd/sta_flags.h"
  53 #include "ieee802_11_common.h"
  54
  55 #ifdef CONFIG_LIBNL20
  56 /* libnl 2.0 compatibility code */
  57 #define nl_handle_alloc_cb nl_socket_alloc_cb
  58 #define nl_handle_destroy nl_socket_free
  59 #endif /* CONFIG_LIBNL20 */
  60
  61 #endif /* HOSTAPD */
  62
  63
  64 #ifndef IFF_LOWER_UP
  65 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
  66 #endif
  67 #ifndef IFF_DORMANT
  68 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
  69 #endif
  70
  71 #ifndef IF_OPER_DORMANT
  72 #define IF_OPER_DORMANT 5
  73 #endif
  74 #ifndef IF_OPER_UP
  75 #define IF_OPER_UP 6
  76 #endif
  77
  78 enum ieee80211_msg_type {
  79         ieee80211_msg_normal = 0,
  80         ieee80211_msg_tx_callback_ack = 1,
  81         ieee80211_msg_tx_callback_fail = 2,
  82 };
  83
  84 struct i802_bss {
  85         struct i802_bss *next;
  86         int ifindex;
  87         unsigned int beacon_set:1;
  88 };
  89
  90 struct wpa_driver_nl80211_data {
  91         void *ctx;
  92         int link_event_sock;
  93         int ioctl_sock; /* socket for ioctl() use */
  94         char ifname[IFNAMSIZ + 1];
  95         int ifindex;
  96         int if_removed;
  97         struct wpa_driver_capa capa;
  98         int has_capability;
  99
 100         int operstate;
 101
 102         int scan_complete_events;
 103
 104         struct nl_handle *nl_handle;
 105         struct nl_cache *nl_cache;
 106         struct nl_cb *nl_cb;
 107         struct genl_family *nl80211;
 108
 109         u8 bssid[ETH_ALEN];
 110         int associated;
 111         u8 ssid[32];
 112         size_t ssid_len;
 113
 114 #if defined(CONFIG_AP) || defined(HOSTAPD)
 115         int beacon_int;
 116         int monitor_sock;
 117         int monitor_ifidx;
 118 #endif /* CONFIG_AP || HOSTAPD */
 119
 120 #ifdef CONFIG_AP
 121         unsigned int beacon_set:1;
 122 #endif /* CONFIG_AP */
 123
 124 #ifdef HOSTAPD
 125         struct hostapd_data *hapd;
 126
 127         int eapol_sock; /* socket for EAPOL frames */
 128
 129         int default_if_indices[16];
 130         int *if_indices;
 131         int num_if_indices;
 132
 133         struct i802_bss bss;
 134         unsigned int ht_40mhz_scan:1;
 135
 136         int last_freq;
 137         int last_freq_ht;
 138         struct hostapd_neighbor_bss *neighbors;
 139         size_t num_neighbors;
 140 #endif /* HOSTAPD */
 141 };
 142
 143
 144 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 145                                             void *timeout_ctx);
 146 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
 147                                        int mode);
 148 static int
 149 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 150
 151 #ifdef CONFIG_AP
 152 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
 153                                  int ifidx);
 154 #endif /* CONFIG_AP */
 155
 156 #ifdef HOSTAPD
 157 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 158 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx);
 159 static struct i802_bss * get_bss(struct wpa_driver_nl80211_data *drv,
 160                                  int ifindex);
 161 #endif /* HOSTAPD */
 162
 163
 164 /* nl80211 code */
 165 static int ack_handler(struct nl_msg *msg, void *arg)
 166 {
 167         int *err = arg;
 168         *err = 0;
 169         return NL_STOP;
 170 }
 171
 172 static int finish_handler(struct nl_msg *msg, void *arg)
 173 {
 174         int *ret = arg;
 175         *ret = 0;
 176         return NL_SKIP;
 177 }
 178
 179 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 180                          void *arg)
 181 {
 182         int *ret = arg;
 183         *ret = err->error;
 184         return NL_SKIP;
 185 }
 186
 187
 188 static int no_seq_check(struct nl_msg *msg, void *arg)
 189 {
 190         return NL_OK;
 191 }
 192
 193
 194 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 195                               struct nl_msg *msg,
 196                               int (*valid_handler)(struct nl_msg *, void *),
 197                               void *valid_data)
 198 {
 199         struct nl_cb *cb;
 200         int err = -ENOMEM;
 201
 202         cb = nl_cb_clone(drv->nl_cb);
 203         if (!cb)
 204                 goto out;
 205
 206         err = nl_send_auto_complete(drv->nl_handle, msg);
 207         if (err < 0)
 208                 goto out;
 209
 210         err = 1;
 211
 212         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 213         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 214         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 215
 216         if (valid_handler)
 217                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 218                           valid_handler, valid_data);
 219
 220         while (err > 0)
 221                 nl_recvmsgs(drv->nl_handle, cb);
 222  out:
 223         nl_cb_put(cb);
 224         nlmsg_free(msg);
 225         return err;
 226 }
 227
 228
 229 struct family_data {
 230         const char *group;
 231         int id;
 232 };
 233
 234
 235 static int family_handler(struct nl_msg *msg, void *arg)
 236 {
 237         struct family_data *res = arg;
 238         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 239         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 240         struct nlattr *mcgrp;
 241         int i;
 242
 243         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 244                   genlmsg_attrlen(gnlh, 0), NULL);
 245         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 246                 return NL_SKIP;
 247
 248         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 249                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 250                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 251                           nla_len(mcgrp), NULL);
 252                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 253                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 254                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 255                                res->group,
 256                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 257                         continue;
 258                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 259                 break;
 260         };
 261
 262         return NL_SKIP;
 263 }
 264
 265
 266 static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
 267                                const char *family, const char *group)
 268 {
 269         struct nl_msg *msg;
 270         int ret = -1;
 271         struct family_data res = { group, -ENOENT };
 272
 273         msg = nlmsg_alloc();
 274         if (!msg)
 275                 return -ENOMEM;
 276         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
 277                     0, 0, CTRL_CMD_GETFAMILY, 0);
 278         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 279
 280         ret = send_and_recv_msgs(drv, msg, family_handler, &res);
 281         msg = NULL;
 282         if (ret == 0)
 283                 ret = res.id;
 284
 285 nla_put_failure:
 286         nlmsg_free(msg);
 287         return ret;
 288 }
 289
 290
 291 static int wpa_driver_nl80211_send_oper_ifla(
 292         struct wpa_driver_nl80211_data *drv,
 293         int linkmode, int operstate)
 294 {
 295         struct {
 296                 struct nlmsghdr hdr;
 297                 struct ifinfomsg ifinfo;
 298                 char opts[16];
 299         } req;
 300         struct rtattr *rta;
 301         static int nl_seq;
 302         ssize_t ret;
 303
 304         os_memset(&req, 0, sizeof(req));
 305
 306         req.hdr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
 307         req.hdr.nlmsg_type = RTM_SETLINK;
 308         req.hdr.nlmsg_flags = NLM_F_REQUEST;
 309         req.hdr.nlmsg_seq = ++nl_seq;
 310         req.hdr.nlmsg_pid = 0;
 311
 312         req.ifinfo.ifi_family = AF_UNSPEC;
 313         req.ifinfo.ifi_type = 0;
 314         req.ifinfo.ifi_index = drv->ifindex;
 315         req.ifinfo.ifi_flags = 0;
 316         req.ifinfo.ifi_change = 0;
 317
 318         if (linkmode != -1) {
 319                 rta = (struct rtattr *)
 320                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 321                 rta->rta_type = IFLA_LINKMODE;
 322                 rta->rta_len = RTA_LENGTH(sizeof(char));
 323                 *((char *) RTA_DATA(rta)) = linkmode;
 324                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 325                         RTA_LENGTH(sizeof(char));
 326         }
 327         if (operstate != -1) {
 328                 rta = (struct rtattr *)
 329                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 330                 rta->rta_type = IFLA_OPERSTATE;
 331                 rta->rta_len = RTA_LENGTH(sizeof(char));
 332                 *((char *) RTA_DATA(rta)) = operstate;
 333                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 334                         RTA_LENGTH(sizeof(char));
 335         }
 336
 337         wpa_printf(MSG_DEBUG, "nl80211: Operstate: linkmode=%d, operstate=%d",
 338                    linkmode, operstate);
 339
 340         ret = send(drv->link_event_sock, &req, req.hdr.nlmsg_len, 0);
 341         if (ret < 0) {
 342                 wpa_printf(MSG_DEBUG, "nl80211: Sending operstate IFLA failed:"
 343                            " %s (assume operstate is not supported)",
 344                            strerror(errno));
 345         }
 346
 347         return ret < 0 ? -1 : 0;
 348 }
 349
 350
 351 static int wpa_driver_nl80211_set_auth_param(
 352         struct wpa_driver_nl80211_data *drv, int idx, u32 value)
 353 {
 354         struct iwreq iwr;
 355         int ret = 0;
 356
 357         os_memset(&iwr, 0, sizeof(iwr));
 358         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 359         iwr.u.param.flags = idx & IW_AUTH_INDEX;
 360         iwr.u.param.value = value;
 361
 362         if (ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr) < 0) {
 363                 if (errno != EOPNOTSUPP) {
 364                         wpa_printf(MSG_DEBUG, "WEXT: SIOCSIWAUTH(param %d "
 365                                    "value 0x%x) failed: %s)",
 366                                    idx, value, strerror(errno));
 367                 }
 368                 ret = errno == EOPNOTSUPP ? -2 : -1;
 369         }
 370
 371         return ret;
 372 }
 373
 374
 375 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 376 {
 377         struct wpa_driver_nl80211_data *drv = priv;
 378         if (!drv->associated)
 379                 return -1;
 380         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 381         return 0;
 382 }
 383
 384
 385 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 386 {
 387         struct wpa_driver_nl80211_data *drv = priv;
 388         if (!drv->associated)
 389                 return -1;
 390         os_memcpy(ssid, drv->ssid, drv->ssid_len);
 391         return drv->ssid_len;
 392 }
 393
 394
 395 #ifndef HOSTAPD
 396 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 397                                           void *ctx, char *buf, size_t len,
 398                                           int del)
 399 {
 400         union wpa_event_data event;
 401
 402         os_memset(&event, 0, sizeof(event));
 403         if (len > sizeof(event.interface_status.ifname))
 404                 len = sizeof(event.interface_status.ifname) - 1;
 405         os_memcpy(event.interface_status.ifname, buf, len);
 406         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 407                 EVENT_INTERFACE_ADDED;
 408
 409         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 410                    del ? "DEL" : "NEW",
 411                    event.interface_status.ifname,
 412                    del ? "removed" : "added");
 413
 414         if (os_strcmp(drv->ifname, event.interface_status.ifname) == 0) {
 415                 if (del)
 416                         drv->if_removed = 1;
 417                 else
 418                         drv->if_removed = 0;
 419         }
 420
 421         wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
 422 }
 423
 424
 425 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 426                                          struct nlmsghdr *h)
 427 {
 428         struct ifinfomsg *ifi;
 429         int attrlen, _nlmsg_len, rta_len;
 430         struct rtattr *attr;
 431
 432         ifi = NLMSG_DATA(h);
 433
 434         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 435
 436         attrlen = h->nlmsg_len - _nlmsg_len;
 437         if (attrlen < 0)
 438                 return 0;
 439
 440         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 441
 442         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 443         while (RTA_OK(attr, attrlen)) {
 444                 if (attr->rta_type == IFLA_IFNAME) {
 445                         if (os_strcmp(((char *) attr) + rta_len, drv->ifname)
 446                             == 0)
 447                                 return 1;
 448                         else
 449                                 break;
 450                 }
 451                 attr = RTA_NEXT(attr, attrlen);
 452         }
 453
 454         return 0;
 455 }
 456
 457
 458 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 459                                           int ifindex, struct nlmsghdr *h)
 460 {
 461         if (drv->ifindex == ifindex)
 462                 return 1;
 463
 464         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, h)) {
 465                 drv->ifindex = if_nametoindex(drv->ifname);
 466                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 467                            "interface");
 468                 wpa_driver_nl80211_finish_drv_init(drv);
 469                 return 1;
 470         }
 471
 472         return 0;
 473 }
 474
 475
 476 static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data *drv,
 477                                               void *ctx, struct nlmsghdr *h,
 478                                               size_t len)
 479 {
 480         struct ifinfomsg *ifi;
 481         int attrlen, _nlmsg_len, rta_len;
 482         struct rtattr * attr;
 483
 484         if (len < sizeof(*ifi))
 485                 return;
 486
 487         ifi = NLMSG_DATA(h);
 488
 489         if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, h)) {
 490                 wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d",
 491                            ifi->ifi_index);
 492                 return;
 493         }
 494
 495         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 496                    "(%s%s%s%s)",
 497                    drv->operstate, ifi->ifi_flags,
 498                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 499                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 500                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 501                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 502         /*
 503          * Some drivers send the association event before the operup event--in
 504          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 505          * fails. This will hit us when wpa_supplicant does not need to do
 506          * IEEE 802.1X authentication
 507          */
 508         if (drv->operstate == 1 &&
 509             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 510             !(ifi->ifi_flags & IFF_RUNNING))
 511                 wpa_driver_nl80211_send_oper_ifla(drv, -1, IF_OPER_UP);
 512
 513         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 514
 515         attrlen = h->nlmsg_len - _nlmsg_len;
 516         if (attrlen < 0)
 517                 return;
 518
 519         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 520
 521         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 522         while (RTA_OK(attr, attrlen)) {
 523                 if (attr->rta_type == IFLA_IFNAME) {
 524                         wpa_driver_nl80211_event_link(
 525                                 drv, ctx,
 526                                 ((char *) attr) + rta_len,
 527                                 attr->rta_len - rta_len, 0);
 528                 }
 529                 attr = RTA_NEXT(attr, attrlen);
 530         }
 531 }
 532
 533
 534 static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data *drv,
 535                                               void *ctx, struct nlmsghdr *h,
 536                                               size_t len)
 537 {
 538         struct ifinfomsg *ifi;
 539         int attrlen, _nlmsg_len, rta_len;
 540         struct rtattr * attr;
 541
 542         if (len < sizeof(*ifi))
 543                 return;
 544
 545         ifi = NLMSG_DATA(h);
 546
 547         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 548
 549         attrlen = h->nlmsg_len - _nlmsg_len;
 550         if (attrlen < 0)
 551                 return;
 552
 553         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 554
 555         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 556         while (RTA_OK(attr, attrlen)) {
 557                 if (attr->rta_type == IFLA_IFNAME) {
 558                         wpa_driver_nl80211_event_link(
 559                                 drv, ctx,
 560                                 ((char *) attr) + rta_len,
 561                                 attr->rta_len - rta_len, 1);
 562                 }
 563                 attr = RTA_NEXT(attr, attrlen);
 564         }
 565 }
 566
 567
 568 static void wpa_driver_nl80211_event_receive_link(int sock, void *eloop_ctx,
 569                                                   void *sock_ctx)
 570 {
 571         char buf[8192];
 572         int left;
 573         struct sockaddr_nl from;
 574         socklen_t fromlen;
 575         struct nlmsghdr *h;
 576         int max_events = 10;
 577
 578 try_again:
 579         fromlen = sizeof(from);
 580         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
 581                         (struct sockaddr *) &from, &fromlen);
 582         if (left < 0) {
 583                 if (errno != EINTR && errno != EAGAIN)
 584                         perror("recvfrom(netlink)");
 585                 return;
 586         }
 587
 588         h = (struct nlmsghdr *) buf;
 589         while (left >= (int) sizeof(*h)) {
 590                 int len, plen;
 591
 592                 len = h->nlmsg_len;
 593                 plen = len - sizeof(*h);
 594                 if (len > left || plen < 0) {
 595                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
 596                                    "len=%d left=%d plen=%d",
 597                                    len, left, plen);
 598                         break;
 599                 }
 600
 601                 switch (h->nlmsg_type) {
 602                 case RTM_NEWLINK:
 603                         wpa_driver_nl80211_event_rtm_newlink(eloop_ctx, sock_ctx,
 604                                                           h, plen);
 605                         break;
 606                 case RTM_DELLINK:
 607                         wpa_driver_nl80211_event_rtm_dellink(eloop_ctx, sock_ctx,
 608                                                           h, plen);
 609                         break;
 610                 }
 611
 612                 len = NLMSG_ALIGN(len);
 613                 left -= len;
 614                 h = (struct nlmsghdr *) ((char *) h + len);
 615         }
 616
 617         if (left > 0) {
 618                 wpa_printf(MSG_DEBUG, "%d extra bytes in the end of netlink "
 619                            "message", left);
 620         }
 621
 622         if (--max_events > 0) {
 623                 /*
 624                  * Try to receive all events in one eloop call in order to
 625                  * limit race condition on cases where AssocInfo event, Assoc
 626                  * event, and EAPOL frames are received more or less at the
 627                  * same time. We want to process the event messages first
 628                  * before starting EAPOL processing.
 629                  */
 630                 goto try_again;
 631         }
 632 }
 633
 634
 635 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
 636                             const u8 *frame, size_t len)
 637 {
 638         const struct ieee80211_mgmt *mgmt;
 639         union wpa_event_data event;
 640
 641         mgmt = (const struct ieee80211_mgmt *) frame;
 642         if (len < 24 + sizeof(mgmt->u.auth)) {
 643                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 644                            "frame");
 645                 return;
 646         }
 647
 648         os_memset(&event, 0, sizeof(event));
 649         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
 650         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
 651         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
 652         if (len > 24 + sizeof(mgmt->u.auth)) {
 653                 event.auth.ies = mgmt->u.auth.variable;
 654                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
 655         }
 656
 657         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
 658 }
 659
 660
 661 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
 662                             const u8 *frame, size_t len)
 663 {
 664         const struct ieee80211_mgmt *mgmt;
 665         union wpa_event_data event;
 666         u16 status;
 667
 668         mgmt = (const struct ieee80211_mgmt *) frame;
 669         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
 670                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
 671                            "frame");
 672                 return;
 673         }
 674
 675         status = le_to_host16(mgmt->u.assoc_resp.status_code);
 676         if (status != WLAN_STATUS_SUCCESS) {
 677                 os_memset(&event, 0, sizeof(event));
 678                 if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 679                         event.assoc_reject.resp_ies =
 680                                 (u8 *) mgmt->u.assoc_resp.variable;
 681                         event.assoc_reject.resp_ies_len =
 682                                 len - 24 - sizeof(mgmt->u.assoc_resp);
 683                 }
 684                 event.assoc_reject.status_code = status;
 685
 686                 wpa_supplicant_event(drv->ctx, EVENT_ASSOC_REJECT, &event);
 687                 return;
 688         }
 689
 690         drv->associated = 1;
 691         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
 692
 693         os_memset(&event, 0, sizeof(event));
 694         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
 695                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
 696                 event.assoc_info.resp_ies_len =
 697                         len - 24 - sizeof(mgmt->u.assoc_resp);
 698         }
 699
 700         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
 701 }
 702
 703
 704 static void mlme_event(struct wpa_driver_nl80211_data *drv,
 705                        enum nl80211_commands cmd, struct nlattr *frame)
 706 {
 707         if (frame == NULL) {
 708                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
 709                            "data", cmd);
 710                 return;
 711         }
 712
 713         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
 714         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
 715                     nla_data(frame), nla_len(frame));
 716
 717         switch (cmd) {
 718         case NL80211_CMD_AUTHENTICATE:
 719                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
 720                 break;
 721         case NL80211_CMD_ASSOCIATE:
 722                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
 723                 break;
 724         case NL80211_CMD_DEAUTHENTICATE:
 725                 drv->associated = 0;
 726                 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
 727                 break;
 728         case NL80211_CMD_DISASSOCIATE:
 729                 drv->associated = 0;
 730                 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
 731                 break;
 732         default:
 733                 break;
 734         }
 735 }
 736
 737 #endif /* HOSTAPD */
 738
 739
 740 static void mlme_event_michael_mic_failure(struct wpa_driver_nl80211_data *drv,
 741                                            struct nlattr *tb[])
 742 {
 743 #ifdef HOSTAPD
 744         if (tb[NL80211_ATTR_MAC])
 745                 hostapd_michael_mic_failure(drv->hapd,
 746                                             nla_data(tb[NL80211_ATTR_MAC]));
 747 #else /* HOSTAPD */
 748         union wpa_event_data data;
 749
 750         wpa_printf(MSG_DEBUG, "nl80211: MLME event Michael MIC failure");
 751         os_memset(&data, 0, sizeof(data));
 752         if (tb[NL80211_ATTR_MAC]) {
 753                 wpa_hexdump(MSG_DEBUG, "nl80211: Source MAC address",
 754                             nla_data(tb[NL80211_ATTR_MAC]),
 755                             nla_len(tb[NL80211_ATTR_MAC]));
 756         }
 757         if (tb[NL80211_ATTR_KEY_SEQ]) {
 758                 wpa_hexdump(MSG_DEBUG, "nl80211: TSC",
 759                             nla_data(tb[NL80211_ATTR_KEY_SEQ]),
 760                             nla_len(tb[NL80211_ATTR_KEY_SEQ]));
 761         }
 762         if (tb[NL80211_ATTR_KEY_TYPE]) {
 763                 enum nl80211_key_type key_type =
 764                         nla_get_u32(tb[NL80211_ATTR_KEY_TYPE]);
 765                 wpa_printf(MSG_DEBUG, "nl80211: Key Type %d", key_type);
 766                 if (key_type == NL80211_KEYTYPE_PAIRWISE)
 767                         data.michael_mic_failure.unicast = 1;
 768         } else
 769                 data.michael_mic_failure.unicast = 1;
 770
 771         if (tb[NL80211_ATTR_KEY_IDX]) {
 772                 u8 key_id = nla_get_u8(tb[NL80211_ATTR_KEY_IDX]);
 773                 wpa_printf(MSG_DEBUG, "nl80211: Key Id %d", key_id);
 774         }
 775
 776         wpa_supplicant_event(drv->ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
 777 #endif /* HOSTAPD */
 778 }
 779
 780
 781 static int process_event(struct nl_msg *msg, void *arg)
 782 {
 783         struct wpa_driver_nl80211_data *drv = arg;
 784         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 785         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 786
 787         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 788                   genlmsg_attrlen(gnlh, 0), NULL);
 789
 790         if (tb[NL80211_ATTR_IFINDEX]) {
 791                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
 792                 if (ifindex != drv->ifindex) {
 793                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
 794                                    " for foreign interface (ifindex %d)",
 795                                    gnlh->cmd, ifindex);
 796                         return NL_SKIP;
 797                 }
 798         }
 799
 800         switch (gnlh->cmd) {
 801 #ifndef HOSTAPD
 802         case NL80211_CMD_NEW_SCAN_RESULTS:
 803                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
 804                 drv->scan_complete_events = 1;
 805                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 806                                      drv->ctx);
 807                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 808                 break;
 809         case NL80211_CMD_SCAN_ABORTED:
 810                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
 811                 /*
 812                  * Need to indicate that scan results are available in order
 813                  * not to make wpa_supplicant stop its scanning.
 814                  */
 815                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
 816                                      drv->ctx);
 817                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
 818                 break;
 819         case NL80211_CMD_AUTHENTICATE:
 820         case NL80211_CMD_ASSOCIATE:
 821         case NL80211_CMD_DEAUTHENTICATE:
 822         case NL80211_CMD_DISASSOCIATE:
 823                 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME]);
 824                 break;
 825 #endif /* HOSTAPD */
 826         case NL80211_CMD_MICHAEL_MIC_FAILURE:
 827                 mlme_event_michael_mic_failure(drv, tb);
 828                 break;
 829         default:
 830                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
 831                            "(cmd=%d)", gnlh->cmd);
 832                 break;
 833         }
 834
 835         return NL_SKIP;
 836 }
 837
 838
 839 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
 840                                              void *sock_ctx)
 841 {
 842         struct nl_cb *cb;
 843         struct wpa_driver_nl80211_data *drv = eloop_ctx;
 844
 845         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
 846
 847         cb = nl_cb_clone(drv->nl_cb);
 848         if (!cb)
 849                 return;
 850         nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
 851         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
 852         nl_recvmsgs(drv->nl_handle, cb);
 853         nl_cb_put(cb);
 854 }
 855
 856
 857 static int hostapd_set_iface_flags(struct wpa_driver_nl80211_data *drv,
 858                                    const char *ifname, int dev_up)
 859 {
 860         struct ifreq ifr;
 861
 862         if (drv->ioctl_sock < 0)
 863                 return -1;
 864
 865         os_memset(&ifr, 0, sizeof(ifr));
 866         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
 867
 868         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
 869                 perror("ioctl[SIOCGIFFLAGS]");
 870                 wpa_printf(MSG_DEBUG, "Could not read interface flags (%s)",
 871                            ifname);
 872                 return -1;
 873         }
 874
 875         if (dev_up) {
 876                 if (ifr.ifr_flags & IFF_UP)
 877                         return 0;
 878                 ifr.ifr_flags |= IFF_UP;
 879         } else {
 880                 if (!(ifr.ifr_flags & IFF_UP))
 881                         return 0;
 882                 ifr.ifr_flags &= ~IFF_UP;
 883         }
 884
 885         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
 886                 perror("ioctl[SIOCSIFFLAGS]");
 887                 return -1;
 888         }
 889
 890         return 0;
 891 }
 892
 893
 894 /**
 895  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
 896  * @priv: driver_nl80211 private data
 897  * @alpha2_arg: country to which to switch to
 898  * Returns: 0 on success, -1 on failure
 899  *
 900  * This asks nl80211 to set the regulatory domain for given
 901  * country ISO / IEC alpha2.
 902  */
 903 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
 904 {
 905         struct wpa_driver_nl80211_data *drv = priv;
 906         char alpha2[3];
 907         struct nl_msg *msg;
 908
 909         msg = nlmsg_alloc();
 910         if (!msg)
 911                 return -ENOMEM;
 912
 913         alpha2[0] = alpha2_arg[0];
 914         alpha2[1] = alpha2_arg[1];
 915         alpha2[2] = '\0';
 916
 917         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 918                     0, NL80211_CMD_REQ_SET_REG, 0);
 919
 920         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
 921         if (send_and_recv_msgs(drv, msg, NULL, NULL))
 922                 return -EINVAL;
 923         return 0;
 924 nla_put_failure:
 925         return -EINVAL;
 926 }
 927
 928
 929 struct wiphy_info_data {
 930         int max_scan_ssids;
 931         int ap_supported;
 932 };
 933
 934
 935 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
 936 {
 937         struct nlattr *tb[NL80211_ATTR_MAX + 1];
 938         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 939         struct wiphy_info_data *info = arg;
 940
 941         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 942                   genlmsg_attrlen(gnlh, 0), NULL);
 943
 944         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
 945                 info->max_scan_ssids =
 946                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
 947
 948         if (tb[NL80211_ATTR_SUPPORTED_IFTYPES]) {
 949                 struct nlattr *nl_mode;
 950                 int i;
 951                 nla_for_each_nested(nl_mode,
 952                                     tb[NL80211_ATTR_SUPPORTED_IFTYPES], i) {
 953                         if (nl_mode->nla_type == NL80211_IFTYPE_AP) {
 954                                 info->ap_supported = 1;
 955                                 break;
 956                         }
 957                 }
 958         }
 959
 960         return NL_SKIP;
 961 }
 962
 963
 964 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
 965                                        struct wiphy_info_data *info)
 966 {
 967         struct nl_msg *msg;
 968
 969         os_memset(info, 0, sizeof(*info));
 970         msg = nlmsg_alloc();
 971         if (!msg)
 972                 return -1;
 973
 974         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
 975                     0, NL80211_CMD_GET_WIPHY, 0);
 976
 977         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
 978
 979         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
 980                 return 0;
 981         msg = NULL;
 982 nla_put_failure:
 983         nlmsg_free(msg);
 984         return -1;
 985 }
 986
 987
 988 static void wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
 989 {
 990         struct wiphy_info_data info;
 991         if (wpa_driver_nl80211_get_info(drv, &info))
 992                 return;
 993         drv->has_capability = 1;
 994         /* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
 995         drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
 996                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
 997                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
 998                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
 999         drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
1000                 WPA_DRIVER_CAPA_ENC_WEP104 |
1001                 WPA_DRIVER_CAPA_ENC_TKIP |
1002                 WPA_DRIVER_CAPA_ENC_CCMP;
1003
1004         drv->capa.max_scan_ssids = info.max_scan_ssids;
1005         if (info.ap_supported)
1006                 drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1007 }
1008
1009
1010 /**
1011  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1012  * @ctx: context to be used when calling wpa_supplicant functions,
1013  * e.g., wpa_supplicant_event()
1014  * @ifname: interface name, e.g., wlan0
1015  * Returns: Pointer to private data, %NULL on failure
1016  */
1017 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
1018 {
1019         int s, ret;
1020         struct sockaddr_nl local;
1021         struct wpa_driver_nl80211_data *drv;
1022
1023         drv = os_zalloc(sizeof(*drv));
1024         if (drv == NULL)
1025                 return NULL;
1026         drv->ctx = ctx;
1027         os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1028 #ifdef CONFIG_AP
1029         drv->monitor_ifidx = -1;
1030         drv->monitor_sock = -1;
1031 #endif /* CONFIG_AP */
1032
1033         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1034         if (drv->nl_cb == NULL) {
1035                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1036                            "callbacks");
1037                 goto err1;
1038         }
1039
1040         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
1041         if (drv->nl_handle == NULL) {
1042                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1043                            "callbacks");
1044                 goto err2;
1045         }
1046
1047         if (genl_connect(drv->nl_handle)) {
1048                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
1049                            "netlink");
1050                 goto err3;
1051         }
1052
1053         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
1054         if (drv->nl_cache == NULL) {
1055                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1056                            "netlink cache");
1057                 goto err3;
1058         }
1059
1060         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
1061         if (drv->nl80211 == NULL) {
1062                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1063                            "found");
1064                 goto err4;
1065         }
1066
1067         ret = nl_get_multicast_id(drv, "nl80211", "scan");
1068         if (ret >= 0)
1069                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1070         if (ret < 0) {
1071                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1072                            "membership for scan events: %d (%s)",
1073                            ret, strerror(-ret));
1074                 goto err4;
1075         }
1076
1077         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
1078         if (ret >= 0)
1079                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1080         if (ret < 0) {
1081                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1082                            "membership for mlme events: %d (%s)",
1083                            ret, strerror(-ret));
1084                 goto err4;
1085         }
1086         drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1087
1088         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
1089                                  wpa_driver_nl80211_event_receive, drv, ctx);
1090
1091         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1092         if (drv->ioctl_sock < 0) {
1093                 perror("socket(PF_INET,SOCK_DGRAM)");
1094                 goto err5;
1095         }
1096
1097         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
1098         if (s < 0) {
1099                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
1100                 goto err6;
1101         }
1102
1103         os_memset(&local, 0, sizeof(local));
1104         local.nl_family = AF_NETLINK;
1105         local.nl_groups = RTMGRP_LINK;
1106         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
1107                 perror("bind(netlink)");
1108                 close(s);
1109                 goto err6;
1110         }
1111
1112 #ifndef HOSTAPD
1113         eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_link, drv,
1114                                  ctx);
1115 #endif /* HOSTAPD */
1116         drv->link_event_sock = s;
1117
1118         if (wpa_driver_nl80211_finish_drv_init(drv))
1119                 goto err7;
1120
1121         return drv;
1122
1123 err7:
1124         eloop_unregister_read_sock(drv->link_event_sock);
1125         close(drv->link_event_sock);
1126 err6:
1127         close(drv->ioctl_sock);
1128 err5:
1129         genl_family_put(drv->nl80211);
1130 err4:
1131         nl_cache_free(drv->nl_cache);
1132 err3:
1133         nl_handle_destroy(drv->nl_handle);
1134 err2:
1135         nl_cb_put(drv->nl_cb);
1136 err1:
1137         os_free(drv);
1138         return NULL;
1139 }
1140
1141
1142 static int
1143 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
1144 {
1145         drv->ifindex = if_nametoindex(drv->ifname);
1146
1147         if (wpa_driver_nl80211_set_mode(drv, 0) < 0) {
1148                 wpa_printf(MSG_DEBUG, "nl80211: Could not configure driver to "
1149                            "use managed mode");
1150         }
1151
1152         if (hostapd_set_iface_flags(drv, drv->ifname, 1)) {
1153                 wpa_printf(MSG_ERROR, "Could not set interface '%s' "
1154                            "UP", drv->ifname);
1155                 return -1;
1156         }
1157
1158         wpa_driver_nl80211_capa(drv);
1159
1160         wpa_driver_nl80211_send_oper_ifla(drv, 1, IF_OPER_DORMANT);
1161
1162         return 0;
1163 }
1164
1165
1166 /**
1167  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
1168  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1169  *
1170  * Shut down driver interface and processing of driver events. Free
1171  * private data buffer if one was allocated in wpa_driver_nl80211_init().
1172  */
1173 static void wpa_driver_nl80211_deinit(void *priv)
1174 {
1175         struct wpa_driver_nl80211_data *drv = priv;
1176
1177 #ifdef CONFIG_AP
1178         if (drv->monitor_ifidx >= 0)
1179                 nl80211_remove_iface(drv, drv->monitor_ifidx);
1180         if (drv->monitor_sock >= 0) {
1181                 eloop_unregister_read_sock(drv->monitor_sock);
1182                 close(drv->monitor_sock);
1183         }
1184 #endif /* CONFIG_AP */
1185
1186         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1187
1188         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED, 0);
1189
1190         wpa_driver_nl80211_send_oper_ifla(priv, 0, IF_OPER_UP);
1191
1192         eloop_unregister_read_sock(drv->link_event_sock);
1193
1194         hostapd_set_iface_flags(drv, drv->ifname, 0);
1195         wpa_driver_nl80211_set_mode(drv, 0);
1196
1197         close(drv->link_event_sock);
1198         close(drv->ioctl_sock);
1199
1200         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
1201         genl_family_put(drv->nl80211);
1202         nl_cache_free(drv->nl_cache);
1203         nl_handle_destroy(drv->nl_handle);
1204         nl_cb_put(drv->nl_cb);
1205
1206         os_free(drv);
1207 }
1208
1209
1210 /**
1211  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
1212  * @eloop_ctx: Unused
1213  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
1214  *
1215  * This function can be used as registered timeout when starting a scan to
1216  * generate a scan completed event if the driver does not report this.
1217  */
1218 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1219 {
1220         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
1221 #ifndef HOSTAPD
1222         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
1223 #endif /* HOSTAPD */
1224 }
1225
1226
1227 /**
1228  * wpa_driver_nl80211_scan - Request the driver to initiate scan
1229  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1230  * @params: Scan parameters
1231  * Returns: 0 on success, -1 on failure
1232  */
1233 static int wpa_driver_nl80211_scan(void *priv,
1234                                    struct wpa_driver_scan_params *params)
1235 {
1236         struct wpa_driver_nl80211_data *drv = priv;
1237         int ret = 0, timeout;
1238         struct nl_msg *msg, *ssids, *freqs;
1239         size_t i;
1240
1241         msg = nlmsg_alloc();
1242         ssids = nlmsg_alloc();
1243         freqs = nlmsg_alloc();
1244         if (!msg || !ssids || !freqs) {
1245                 nlmsg_free(msg);
1246                 nlmsg_free(ssids);
1247                 nlmsg_free(freqs);
1248                 return -1;
1249         }
1250
1251         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1252                     NL80211_CMD_TRIGGER_SCAN, 0);
1253
1254         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1255
1256         for (i = 0; i < params->num_ssids; i++) {
1257                 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
1258                         params->ssids[i].ssid);
1259         }
1260         if (params->num_ssids)
1261                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
1262
1263         if (params->extra_ies) {
1264                 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
1265                         params->extra_ies);
1266         }
1267
1268         if (params->freqs) {
1269                 for (i = 0; params->freqs[i]; i++)
1270                         NLA_PUT_U32(freqs, i + 1, params->freqs[i]);
1271                 nla_put_nested(msg, NL80211_ATTR_SCAN_FREQUENCIES, freqs);
1272         }
1273
1274         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1275         msg = NULL;
1276         if (ret) {
1277                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
1278                            "(%s)", ret, strerror(-ret));
1279                 goto nla_put_failure;
1280         }
1281
1282         /* Not all drivers generate "scan completed" wireless event, so try to
1283          * read results after a timeout. */
1284         timeout = 10;
1285         if (drv->scan_complete_events) {
1286                 /*
1287                  * The driver seems to deliver events to notify when scan is
1288                  * complete, so use longer timeout to avoid race conditions
1289                  * with scanning and following association request.
1290                  */
1291                 timeout = 30;
1292         }
1293         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
1294                    "seconds", ret, timeout);
1295         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1296         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
1297                                drv, drv->ctx);
1298
1299 nla_put_failure:
1300         nlmsg_free(ssids);
1301         nlmsg_free(msg);
1302         nlmsg_free(freqs);
1303         return ret;
1304 }
1305
1306
1307 static int bss_info_handler(struct nl_msg *msg, void *arg)
1308 {
1309         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1310         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1311         struct nlattr *bss[NL80211_BSS_MAX + 1];
1312         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1313                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
1314                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1315                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1316                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1317                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1318                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
1319                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1320                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1321         };
1322         struct wpa_scan_results *res = arg;
1323         struct wpa_scan_res **tmp;
1324         struct wpa_scan_res *r;
1325         const u8 *ie;
1326         size_t ie_len;
1327
1328         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1329                   genlmsg_attrlen(gnlh, 0), NULL);
1330         if (!tb[NL80211_ATTR_BSS])
1331                 return NL_SKIP;
1332         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
1333                              bss_policy))
1334                 return NL_SKIP;
1335         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
1336                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1337                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1338         } else {
1339                 ie = NULL;
1340                 ie_len = 0;
1341         }
1342
1343         r = os_zalloc(sizeof(*r) + ie_len);
1344         if (r == NULL)
1345                 return NL_SKIP;
1346         if (bss[NL80211_BSS_BSSID])
1347                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
1348                           ETH_ALEN);
1349         if (bss[NL80211_BSS_FREQUENCY])
1350                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1351         if (bss[NL80211_BSS_BEACON_INTERVAL])
1352                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
1353         if (bss[NL80211_BSS_CAPABILITY])
1354                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1355         r->flags |= WPA_SCAN_NOISE_INVALID;
1356         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1357                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1358                 r->level /= 100; /* mBm to dBm */
1359                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
1360         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1361                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1362                 r->flags |= WPA_SCAN_LEVEL_INVALID;
1363         } else
1364                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
1365         if (bss[NL80211_BSS_TSF])
1366                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
1367         r->ie_len = ie_len;
1368         if (ie)
1369                 os_memcpy(r + 1, ie, ie_len);
1370
1371         tmp = os_realloc(res->res,
1372                          (res->num + 1) * sizeof(struct wpa_scan_res *));
1373         if (tmp == NULL) {
1374                 os_free(r);
1375                 return NL_SKIP;
1376         }
1377         tmp[res->num++] = r;
1378         res->res = tmp;
1379
1380         return NL_SKIP;
1381 }
1382
1383
1384 /**
1385  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1386  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1387  * Returns: Scan results on success, -1 on failure
1388  */
1389 static struct wpa_scan_results *
1390 wpa_driver_nl80211_get_scan_results(void *priv)
1391 {
1392         struct wpa_driver_nl80211_data *drv = priv;
1393         struct nl_msg *msg;
1394         struct wpa_scan_results *res;
1395         int ret;
1396
1397         res = os_zalloc(sizeof(*res));
1398         if (res == NULL)
1399                 return 0;
1400         msg = nlmsg_alloc();
1401         if (!msg)
1402                 goto nla_put_failure;
1403
1404         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
1405                     NL80211_CMD_GET_SCAN, 0);
1406         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1407
1408         ret = send_and_recv_msgs(drv, msg, bss_info_handler, res);
1409         msg = NULL;
1410         if (ret == 0) {
1411                 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
1412                            (unsigned long) res->num);
1413                 return res;
1414         }
1415         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
1416                    "(%s)", ret, strerror(-ret));
1417 nla_put_failure:
1418         nlmsg_free(msg);
1419         wpa_scan_results_free(res);
1420         return NULL;
1421 }
1422
1423
1424 static int nl_set_encr(int ifindex, struct wpa_driver_nl80211_data *drv,
1425                        wpa_alg alg, const u8 *addr, int key_idx, int set_tx,
1426                        const u8 *seq, size_t seq_len,
1427                        const u8 *key, size_t key_len)
1428 {
1429         struct nl_msg *msg;
1430         int ret;
1431
1432         wpa_printf(MSG_DEBUG, "%s: ifindex=%d alg=%d addr=%p key_idx=%d "
1433                    "set_tx=%d seq_len=%lu key_len=%lu",
1434                    __func__, ifindex, alg, addr, key_idx, set_tx,
1435                    (unsigned long) seq_len, (unsigned long) key_len);
1436
1437         msg = nlmsg_alloc();
1438         if (!msg)
1439                 return -ENOMEM;
1440
1441         if (alg == WPA_ALG_NONE) {
1442                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1443                             0, NL80211_CMD_DEL_KEY, 0);
1444         } else {
1445                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1446                             0, NL80211_CMD_NEW_KEY, 0);
1447                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
1448                 switch (alg) {
1449                 case WPA_ALG_WEP:
1450                         if (key_len == 5)
1451                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1452                                             0x000FAC01);
1453                         else
1454                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
1455                                             0x000FAC05);
1456                         break;
1457                 case WPA_ALG_TKIP:
1458                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
1459                         break;
1460                 case WPA_ALG_CCMP:
1461                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
1462                         break;
1463                 case WPA_ALG_IGTK:
1464                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC06);
1465                         break;
1466                 default:
1467                         wpa_printf(MSG_ERROR, "%s: Unsupported encryption "
1468                                    "algorithm %d", __func__, alg);
1469                         nlmsg_free(msg);
1470                         return -1;
1471                 }
1472         }
1473
1474         if (seq)
1475                 NLA_PUT(msg, NL80211_ATTR_KEY_SEQ, seq_len, seq);
1476
1477         if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
1478         {
1479                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
1480                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1481         }
1482         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1483         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
1484
1485         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1486         if (ret == -ENOENT && alg == WPA_ALG_NONE)
1487                 ret = 0;
1488         if (ret)
1489                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d %s)",
1490                            ret, strerror(-ret));
1491
1492         /*
1493          * If we failed or don't need to set the default TX key (below),
1494          * we're done here.
1495          */
1496         if (ret || !set_tx || alg == WPA_ALG_NONE)
1497                 return ret;
1498 #ifdef HOSTAPD /* FIX: is this needed? */
1499         if (addr)
1500                 return ret;
1501 #endif /* HOSTAPD */
1502
1503         msg = nlmsg_alloc();
1504         if (!msg)
1505                 return -ENOMEM;
1506
1507         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1508                     0, NL80211_CMD_SET_KEY, 0);
1509         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
1510         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
1511         if (alg == WPA_ALG_IGTK)
1512                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT_MGMT);
1513         else
1514                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
1515
1516         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1517         if (ret == -ENOENT)
1518                 ret = 0;
1519         if (ret)
1520                 wpa_printf(MSG_DEBUG, "nl80211: set_key default failed; "
1521                            "err=%d %s)", ret, strerror(-ret));
1522         return ret;
1523
1524 nla_put_failure:
1525         return -ENOBUFS;
1526 }
1527
1528
1529 static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
1530                                       const u8 *addr, int key_idx,
1531                                       int set_tx, const u8 *seq,
1532                                       size_t seq_len,
1533                                       const u8 *key, size_t key_len)
1534 {
1535         struct wpa_driver_nl80211_data *drv = priv;
1536         return nl_set_encr(drv->ifindex, drv, alg, addr, key_idx, set_tx, seq,
1537                            seq_len, key, key_len);
1538 }
1539
1540
1541 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
1542                                    const u8 *addr, int cmd, u16 reason_code)
1543 {
1544         int ret = -1;
1545         struct nl_msg *msg;
1546
1547         msg = nlmsg_alloc();
1548         if (!msg)
1549                 return -1;
1550
1551         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
1552
1553         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1554         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
1555         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1556
1557         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1558         msg = NULL;
1559         if (ret) {
1560                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1561                            "(%s)", ret, strerror(-ret));
1562                 goto nla_put_failure;
1563         }
1564         ret = 0;
1565
1566 nla_put_failure:
1567         nlmsg_free(msg);
1568         return ret;
1569 }
1570
1571
1572 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
1573                                              int reason_code)
1574 {
1575         struct wpa_driver_nl80211_data *drv = priv;
1576         wpa_printf(MSG_DEBUG, "%s", __func__);
1577         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
1578                                        reason_code);
1579 }
1580
1581
1582 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
1583                                            int reason_code)
1584 {
1585         struct wpa_driver_nl80211_data *drv = priv;
1586         wpa_printf(MSG_DEBUG, "%s", __func__);
1587         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
1588                                        reason_code);
1589 }
1590
1591
1592 static int wpa_driver_nl80211_authenticate(
1593         void *priv, struct wpa_driver_auth_params *params)
1594 {
1595         struct wpa_driver_nl80211_data *drv = priv;
1596         int ret = -1, i;
1597         struct nl_msg *msg;
1598         enum nl80211_auth_type type;
1599
1600         drv->associated = 0;
1601
1602         msg = nlmsg_alloc();
1603         if (!msg)
1604                 return -1;
1605
1606         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
1607                    drv->ifindex);
1608
1609         for (i = 0; i < 4; i++) {
1610                 if (!params->wep_key[i])
1611                         continue;
1612                 wpa_driver_nl80211_set_key(drv, WPA_ALG_WEP, NULL, i,
1613                                            i == params->wep_tx_keyidx, NULL, 0,
1614                                            params->wep_key[i],
1615                                            params->wep_key_len[i]);
1616         }
1617
1618         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1619                     NL80211_CMD_AUTHENTICATE, 0);
1620
1621         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1622         if (params->bssid) {
1623                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
1624                            MAC2STR(params->bssid));
1625                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
1626         }
1627         if (params->freq) {
1628                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
1629                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
1630         }
1631         if (params->ssid) {
1632                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
1633                                   params->ssid, params->ssid_len);
1634                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
1635                         params->ssid);
1636         }
1637         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
1638         if (params->ie)
1639                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
1640         /*
1641          * TODO: if multiple auth_alg options enabled, try them one by one if
1642          * the AP rejects authentication due to unknown auth alg
1643          */
1644         if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
1645                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
1646         else if (params->auth_alg & AUTH_ALG_SHARED_KEY)
1647                 type = NL80211_AUTHTYPE_SHARED_KEY;
1648         else if (params->auth_alg & AUTH_ALG_LEAP)
1649                 type = NL80211_AUTHTYPE_NETWORK_EAP;
1650         else if (params->auth_alg & AUTH_ALG_FT)
1651                 type = NL80211_AUTHTYPE_FT;
1652         else
1653                 goto nla_put_failure;
1654         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
1655         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
1656
1657         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1658         msg = NULL;
1659         if (ret) {
1660                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
1661                            "(%s)", ret, strerror(-ret));
1662                 goto nla_put_failure;
1663         }
1664         ret = 0;
1665         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
1666                    "successfully");
1667
1668 nla_put_failure:
1669         nlmsg_free(msg);
1670         return ret;
1671 }
1672
1673
1674 #if defined(CONFIG_AP) || defined(HOSTAPD)
1675
1676 struct phy_info_arg {
1677         u16 *num_modes;
1678         struct hostapd_hw_modes *modes;
1679 };
1680
1681 static int phy_info_handler(struct nl_msg *msg, void *arg)
1682 {
1683         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1684         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1685         struct phy_info_arg *phy_info = arg;
1686
1687         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
1688
1689         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
1690         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
1691                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
1692                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
1693                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
1694                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
1695                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
1696                 [NL80211_FREQUENCY_ATTR_MAX_TX_POWER] = { .type = NLA_U32 },
1697         };
1698
1699         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
1700         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
1701                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
1702                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
1703         };
1704
1705         struct nlattr *nl_band;
1706         struct nlattr *nl_freq;
1707         struct nlattr *nl_rate;
1708         int rem_band, rem_freq, rem_rate;
1709         struct hostapd_hw_modes *mode;
1710         int idx, mode_is_set;
1711
1712         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1713                   genlmsg_attrlen(gnlh, 0), NULL);
1714
1715         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
1716                 return NL_SKIP;
1717
1718         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
1719                 mode = realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode));
1720                 if (!mode)
1721                         return NL_SKIP;
1722                 phy_info->modes = mode;
1723
1724                 mode_is_set = 0;
1725
1726                 mode = &phy_info->modes[*(phy_info->num_modes)];
1727                 memset(mode, 0, sizeof(*mode));
1728                 *(phy_info->num_modes) += 1;
1729
1730                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
1731                           nla_len(nl_band), NULL);
1732
1733                 if (tb_band[NL80211_BAND_ATTR_HT_CAPA]) {
1734                         mode->ht_capab = nla_get_u16(
1735                                 tb_band[NL80211_BAND_ATTR_HT_CAPA]);
1736                 }
1737
1738                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1739                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1740                                   nla_len(nl_freq), freq_policy);
1741                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1742                                 continue;
1743                         mode->num_channels++;
1744                 }
1745
1746                 mode->channels = calloc(mode->num_channels, sizeof(struct hostapd_channel_data));
1747                 if (!mode->channels)
1748                         return NL_SKIP;
1749
1750                 idx = 0;
1751
1752                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1753                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1754                                   nla_len(nl_freq), freq_policy);
1755                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1756                                 continue;
1757
1758                         mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
1759                         mode->channels[idx].flag = 0;
1760
1761                         if (!mode_is_set) {
1762                                 /* crude heuristic */
1763                                 if (mode->channels[idx].freq < 4000)
1764                                         mode->mode = HOSTAPD_MODE_IEEE80211B;
1765                                 else
1766                                         mode->mode = HOSTAPD_MODE_IEEE80211A;
1767                                 mode_is_set = 1;
1768                         }
1769
1770                         /* crude heuristic */
1771                         if (mode->channels[idx].freq < 4000)
1772                                 if (mode->channels[idx].freq == 2484)
1773                                         mode->channels[idx].chan = 14;
1774                                 else
1775                                         mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
1776                         else
1777                                 mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
1778
1779                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1780                                 mode->channels[idx].flag |=
1781                                         HOSTAPD_CHAN_DISABLED;
1782                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
1783                                 mode->channels[idx].flag |=
1784                                         HOSTAPD_CHAN_PASSIVE_SCAN;
1785                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
1786                                 mode->channels[idx].flag |=
1787                                         HOSTAPD_CHAN_NO_IBSS;
1788                         if (tb_freq[NL80211_FREQUENCY_ATTR_RADAR])
1789                                 mode->channels[idx].flag |=
1790                                         HOSTAPD_CHAN_RADAR;
1791
1792                         if (tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER] &&
1793                             !tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1794                                 mode->channels[idx].max_tx_power =
1795                                         nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_MAX_TX_POWER]) / 100;
1796
1797                         idx++;
1798                 }
1799
1800                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1801                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1802                                   nla_len(nl_rate), rate_policy);
1803                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1804                                 continue;
1805                         mode->num_rates++;
1806                 }
1807
1808                 mode->rates = calloc(mode->num_rates, sizeof(struct hostapd_rate_data));
1809                 if (!mode->rates)
1810                         return NL_SKIP;
1811
1812                 idx = 0;
1813
1814                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1815                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1816                                   nla_len(nl_rate), rate_policy);
1817                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1818                                 continue;
1819                         mode->rates[idx].rate = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
1820
1821                         /* crude heuristic */
1822                         if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
1823                             mode->rates[idx].rate > 200)
1824                                 mode->mode = HOSTAPD_MODE_IEEE80211G;
1825
1826                         if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
1827                                 mode->rates[idx].flags |= HOSTAPD_RATE_PREAMBLE2;
1828
1829                         idx++;
1830                 }
1831         }
1832
1833         return NL_SKIP;
1834 }
1835
1836 static struct hostapd_hw_modes *
1837 wpa_driver_nl80211_add_11b(struct hostapd_hw_modes *modes, u16 *num_modes)
1838 {
1839         u16 m;
1840         struct hostapd_hw_modes *mode11g = NULL, *nmodes, *mode;
1841         int i, mode11g_idx = -1;
1842
1843         /* If only 802.11g mode is included, use it to construct matching
1844          * 802.11b mode data. */
1845
1846         for (m = 0; m < *num_modes; m++) {
1847                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211B)
1848                         return modes; /* 802.11b already included */
1849                 if (modes[m].mode == HOSTAPD_MODE_IEEE80211G)
1850                         mode11g_idx = m;
1851         }
1852
1853         if (mode11g_idx < 0)
1854                 return modes; /* 2.4 GHz band not supported at all */
1855
1856         nmodes = os_realloc(modes, (*num_modes + 1) * sizeof(*nmodes));
1857         if (nmodes == NULL)
1858                 return modes; /* Could not add 802.11b mode */
1859
1860         mode = &nmodes[*num_modes];
1861         os_memset(mode, 0, sizeof(*mode));
1862         (*num_modes)++;
1863         modes = nmodes;
1864
1865         mode->mode = HOSTAPD_MODE_IEEE80211B;
1866
1867         mode11g = &modes[mode11g_idx];
1868         mode->num_channels = mode11g->num_channels;
1869         mode->channels = os_malloc(mode11g->num_channels *
1870                                    sizeof(struct hostapd_channel_data));
1871         if (mode->channels == NULL) {
1872                 (*num_modes)--;
1873                 return modes; /* Could not add 802.11b mode */
1874         }
1875         os_memcpy(mode->channels, mode11g->channels,
1876                   mode11g->num_channels * sizeof(struct hostapd_channel_data));
1877
1878         mode->num_rates = 0;
1879         mode->rates = os_malloc(4 * sizeof(struct hostapd_rate_data));
1880         if (mode->rates == NULL) {
1881                 os_free(mode->channels);
1882                 (*num_modes)--;
1883                 return modes; /* Could not add 802.11b mode */
1884         }
1885
1886         for (i = 0; i < mode11g->num_rates; i++) {
1887                 if (mode11g->rates[i].rate > 110 ||
1888                     mode11g->rates[i].flags &
1889                     (HOSTAPD_RATE_ERP | HOSTAPD_RATE_OFDM))
1890                         continue;
1891                 mode->rates[mode->num_rates] = mode11g->rates[i];
1892                 mode->num_rates++;
1893                 if (mode->num_rates == 4)
1894                         break;
1895         }
1896
1897         if (mode->num_rates == 0) {
1898                 os_free(mode->channels);
1899                 os_free(mode->rates);
1900                 (*num_modes)--;
1901                 return modes; /* No 802.11b rates */
1902         }
1903
1904         wpa_printf(MSG_DEBUG, "nl80211: Added 802.11b mode based on 802.11g "
1905                    "information");
1906
1907         return modes;
1908 }
1909
1910
1911 static struct hostapd_hw_modes *
1912 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
1913 {
1914         struct wpa_driver_nl80211_data *drv = priv;
1915         struct nl_msg *msg;
1916         struct phy_info_arg result = {
1917                 .num_modes = num_modes,
1918                 .modes = NULL,
1919         };
1920
1921         *num_modes = 0;
1922         *flags = 0;
1923
1924         msg = nlmsg_alloc();
1925         if (!msg)
1926                 return NULL;
1927
1928         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1929                     0, NL80211_CMD_GET_WIPHY, 0);
1930
1931         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1932
1933         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
1934                 return wpa_driver_nl80211_add_11b(result.modes, num_modes);
1935  nla_put_failure:
1936         return NULL;
1937 }
1938
1939
1940 static int wpa_driver_nl80211_send_frame(struct wpa_driver_nl80211_data *drv,
1941                                          const void *data, size_t len,
1942                                          int encrypt)
1943 {
1944         __u8 rtap_hdr[] = {
1945                 0x00, 0x00, /* radiotap version */
1946                 0x0e, 0x00, /* radiotap length */
1947                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
1948                 IEEE80211_RADIOTAP_F_FRAG, /* F_FRAG (fragment if required) */
1949                 0x00,       /* padding */
1950                 0x00, 0x00, /* RX and TX flags to indicate that */
1951                 0x00, 0x00, /* this is the injected frame directly */
1952         };
1953         struct iovec iov[2] = {
1954                 {
1955                         .iov_base = &rtap_hdr,
1956                         .iov_len = sizeof(rtap_hdr),
1957                 },
1958                 {
1959                         .iov_base = (void *) data,
1960                         .iov_len = len,
1961                 }
1962         };
1963         struct msghdr msg = {
1964                 .msg_name = NULL,
1965                 .msg_namelen = 0,
1966                 .msg_iov = iov,
1967                 .msg_iovlen = 2,
1968                 .msg_control = NULL,
1969                 .msg_controllen = 0,
1970                 .msg_flags = 0,
1971         };
1972
1973         if (encrypt)
1974                 rtap_hdr[8] |= IEEE80211_RADIOTAP_F_WEP;
1975
1976         return sendmsg(drv->monitor_sock, &msg, 0);
1977 }
1978
1979
1980 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
1981                                         size_t data_len)
1982 {
1983         struct wpa_driver_nl80211_data *drv = priv;
1984         struct ieee80211_mgmt *mgmt;
1985         int do_not_encrypt = 0;
1986         u16 fc;
1987
1988         mgmt = (struct ieee80211_mgmt *) data;
1989         fc = le_to_host16(mgmt->frame_control);
1990
1991         if (WLAN_FC_GET_TYPE(fc) == WLAN_FC_TYPE_MGMT &&
1992             WLAN_FC_GET_STYPE(fc) == WLAN_FC_STYPE_AUTH) {
1993                 /*
1994                  * Only one of the authentication frame types is encrypted.
1995                  * In order for static WEP encryption to work properly (i.e.,
1996                  * to not encrypt the frame), we need to tell mac80211 about
1997                  * the frames that must not be encrypted.
1998                  */
1999                 u16 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2000                 u16 auth_trans = le_to_host16(mgmt->u.auth.auth_transaction);
2001                 if (auth_alg == WLAN_AUTH_OPEN ||
2002                     (auth_alg == WLAN_AUTH_SHARED_KEY && auth_trans != 3))
2003                         do_not_encrypt = 1;
2004         }
2005
2006         return wpa_driver_nl80211_send_frame(drv, data, data_len,
2007                                              !do_not_encrypt);
2008 }
2009
2010
2011 static int wpa_driver_nl80211_set_beacon_iface(int ifindex, void *priv,
2012                                                const u8 *head, size_t head_len,
2013                                                const u8 *tail, size_t tail_len,
2014                                                int dtim_period)
2015 {
2016         struct wpa_driver_nl80211_data *drv = priv;
2017         struct nl_msg *msg;
2018         u8 cmd = NL80211_CMD_NEW_BEACON;
2019         int ret;
2020         int beacon_set;
2021 #ifdef HOSTAPD
2022         struct i802_bss *bss;
2023
2024         bss = get_bss(drv, ifindex);
2025         if (bss == NULL)
2026                 return -ENOENT;
2027         beacon_set = bss->beacon_set;
2028 #else /* HOSTAPD */
2029         beacon_set = drv->beacon_set;
2030 #endif /* HOSTAPD */
2031
2032         msg = nlmsg_alloc();
2033         if (!msg)
2034                 return -ENOMEM;
2035
2036         wpa_printf(MSG_DEBUG, "nl80211: Set beacon (beacon_set=%d)",
2037                    beacon_set);
2038         if (beacon_set)
2039                 cmd = NL80211_CMD_SET_BEACON;
2040
2041         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2042                     0, cmd, 0);
2043         NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
2044         NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
2045         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifindex);
2046         if (!drv->beacon_int)
2047                 drv->beacon_int = 100;
2048         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, drv->beacon_int);
2049         NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, dtim_period);
2050
2051         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2052         if (ret) {
2053                 wpa_printf(MSG_DEBUG, "nl80211: Beacon set failed: %d (%s)",
2054                            ret, strerror(-ret));
2055         } else {
2056 #ifdef HOSTAPD
2057                 bss->beacon_set = 1;
2058 #else /* HOSTAPD */
2059                 drv->beacon_set = 1;
2060 #endif /* HOSTAPD */
2061         }
2062         return ret;
2063  nla_put_failure:
2064         return -ENOBUFS;
2065 }
2066
2067
2068 static int wpa_driver_nl80211_set_beacon_int(void *priv, int value)
2069 {
2070         struct wpa_driver_nl80211_data *drv = priv;
2071         struct nl_msg *msg;
2072
2073         drv->beacon_int = value;
2074
2075 #ifdef HOSTAPD
2076         if (!drv->bss.beacon_set)
2077                 return 0;
2078 #else /* HOSTAPD */
2079         if (!drv->beacon_set)
2080                 return 0;
2081 #endif /* HOSTAPD */
2082
2083         msg = nlmsg_alloc();
2084         if (!msg)
2085                 return -ENOMEM;
2086
2087         wpa_printf(MSG_DEBUG, "nl80211: Set beacon interval %d", value);
2088         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2089                     0, NL80211_CMD_SET_BEACON, 0);
2090         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2091
2092         NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
2093
2094         return send_and_recv_msgs(drv, msg, NULL, NULL);
2095  nla_put_failure:
2096         return -ENOBUFS;
2097 }
2098
2099
2100 static int wpa_driver_nl80211_set_freq(struct wpa_driver_nl80211_data *drv,
2101                                        int freq, int ht_enabled,
2102                                        int sec_channel_offset)
2103 {
2104         struct nl_msg *msg;
2105         int ret;
2106
2107         msg = nlmsg_alloc();
2108         if (!msg)
2109                 return -1;
2110
2111         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2112                     NL80211_CMD_SET_WIPHY, 0);
2113
2114         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2115         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, freq);
2116         if (ht_enabled) {
2117                 switch (sec_channel_offset) {
2118                 case -1:
2119                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2120                                     NL80211_CHAN_HT40MINUS);
2121                         break;
2122                 case 1:
2123                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2124                                     NL80211_CHAN_HT40PLUS);
2125                         break;
2126                 default:
2127                         NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2128                                     NL80211_CHAN_HT20);
2129                         break;
2130                 }
2131         }
2132
2133         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2134         if (ret == 0)
2135                 return 0;
2136         wpa_printf(MSG_DEBUG, "nl80211: Failed to set channel (freq=%d): "
2137                    "%d (%s)", freq, ret, strerror(-ret));
2138 nla_put_failure:
2139         return -1;
2140 }
2141
2142 #endif /* CONFIG_AP || HOSTAPD */
2143
2144
2145 #ifdef CONFIG_AP
2146
2147 static int wpa_driver_nl80211_set_beacon(void *priv,
2148                                          const u8 *head, size_t head_len,
2149                                          const u8 *tail, size_t tail_len,
2150                                          int dtim_period)
2151 {
2152         struct wpa_driver_nl80211_data *drv = priv;
2153         return wpa_driver_nl80211_set_beacon_iface(drv->ifindex, priv,
2154                                                    head, head_len,
2155                                                    tail, tail_len,
2156                                                    dtim_period);
2157 }
2158
2159 #endif /* CONFIG_AP */
2160
2161 #if defined(CONFIG_AP) || defined(HOSTAPD)
2162
2163 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
2164                                  int ifidx)
2165 {
2166         struct nl_msg *msg;
2167
2168 #ifdef HOSTAPD
2169         /* stop listening for EAPOL on this interface */
2170         del_ifidx(drv, ifidx);
2171 #endif /* HOSTAPD */
2172
2173         msg = nlmsg_alloc();
2174         if (!msg)
2175                 goto nla_put_failure;
2176
2177         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2178                     0, NL80211_CMD_DEL_INTERFACE, 0);
2179         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
2180
2181         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
2182                 return;
2183  nla_put_failure:
2184         wpa_printf(MSG_ERROR, "Failed to remove interface (ifidx=%d).\n",
2185                    ifidx);
2186 }
2187
2188
2189 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
2190                                 const char *ifname, enum nl80211_iftype iftype,
2191                                 const u8 *addr)
2192 {
2193         struct nl_msg *msg, *flags = NULL;
2194         int ifidx;
2195         int ret = -ENOBUFS;
2196 #ifdef HOSTAPD
2197         struct ifreq ifreq;
2198         struct iwreq iwr;
2199 #endif /* HOSTAPD */
2200
2201         msg = nlmsg_alloc();
2202         if (!msg)
2203                 return -1;
2204
2205         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2206                     0, NL80211_CMD_NEW_INTERFACE, 0);
2207         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2208         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
2209         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
2210
2211         if (iftype == NL80211_IFTYPE_MONITOR) {
2212                 int err;
2213
2214                 flags = nlmsg_alloc();
2215                 if (!flags)
2216                         goto nla_put_failure;
2217
2218                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
2219
2220                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
2221
2222                 nlmsg_free(flags);
2223
2224                 if (err)
2225                         goto nla_put_failure;
2226         }
2227
2228         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2229         if (ret) {
2230  nla_put_failure:
2231                 wpa_printf(MSG_ERROR, "Failed to create interface %s.",
2232                            ifname);
2233                 return ret;
2234         }
2235
2236         ifidx = if_nametoindex(ifname);
2237
2238         if (ifidx <= 0)
2239                 return -1;
2240
2241 #ifdef HOSTAPD
2242         /* start listening for EAPOL on this interface */
2243         add_ifidx(drv, ifidx);
2244
2245         if (addr) {
2246                 switch (iftype) {
2247                 case NL80211_IFTYPE_AP:
2248                         os_strlcpy(ifreq.ifr_name, ifname, IFNAMSIZ);
2249                         memcpy(ifreq.ifr_hwaddr.sa_data, addr, ETH_ALEN);
2250                         ifreq.ifr_hwaddr.sa_family = ARPHRD_ETHER;
2251
2252                         if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifreq)) {
2253                                 nl80211_remove_iface(drv, ifidx);
2254                                 return -1;
2255                         }
2256                         break;
2257                 case NL80211_IFTYPE_WDS:
2258                         memset(&iwr, 0, sizeof(iwr));
2259                         os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
2260                         iwr.u.addr.sa_family = ARPHRD_ETHER;
2261                         memcpy(iwr.u.addr.sa_data, addr, ETH_ALEN);
2262                         if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr))
2263                                 return -1;
2264                         break;
2265                 default:
2266                         /* nothing */
2267                         break;
2268                 }
2269         }
2270 #endif /* HOSTAPD */
2271
2272         return ifidx;
2273 }
2274
2275 #endif /* CONFIG_AP || HOSTAPD */
2276
2277 #ifdef CONFIG_AP
2278
2279 void ap_tx_status(void *ctx, const u8 *addr,
2280                   const u8 *buf, size_t len, int ack);
2281 void ap_rx_from_unknown_sta(void *ctx, const u8 *addr);
2282 void ap_mgmt_rx(void *ctx, u8 *buf, size_t len, u16 stype,
2283                 struct hostapd_frame_info *fi);
2284 void ap_mgmt_tx_cb(void *ctx, u8 *buf, size_t len, u16 stype, int ok);
2285
2286 #endif /* CONFIG_AP */
2287
2288 #if defined(CONFIG_AP) || defined(HOSTAPD)
2289
2290 static void handle_tx_callback(void *ctx, u8 *buf, size_t len, int ok)
2291 {
2292         struct ieee80211_hdr *hdr;
2293         u16 fc, type, stype;
2294
2295         hdr = (struct ieee80211_hdr *) buf;
2296         fc = le_to_host16(hdr->frame_control);
2297
2298         type = WLAN_FC_GET_TYPE(fc);
2299         stype = WLAN_FC_GET_STYPE(fc);
2300
2301         switch (type) {
2302         case WLAN_FC_TYPE_MGMT:
2303                 wpa_printf(MSG_DEBUG, "MGMT (TX callback) %s",
2304                            ok ? "ACK" : "fail");
2305 #ifdef HOSTAPD
2306                 hostapd_mgmt_tx_cb(ctx, buf, len, stype, ok);
2307 #else /* HOSTAPD */
2308                 ap_mgmt_tx_cb(ctx, buf, len, stype, ok);
2309 #endif /* HOSTAPD */
2310                 break;
2311         case WLAN_FC_TYPE_CTRL:
2312                 wpa_printf(MSG_DEBUG, "CTRL (TX callback) %s",
2313                            ok ? "ACK" : "fail");
2314                 break;
2315         case WLAN_FC_TYPE_DATA:
2316 #ifdef HOSTAPD
2317                 hostapd_tx_status(ctx, hdr->addr1, buf, len, ok);
2318 #else /* HOSTAPD */
2319                 ap_tx_status(ctx, hdr->addr1, buf, len, ok);
2320 #endif /* HOSTAPD */
2321                 break;
2322         default:
2323                 wpa_printf(MSG_DEBUG, "unknown TX callback frame type %d",
2324                            type);
2325                 break;
2326         }
2327 }
2328
2329
2330 static void handle_frame(struct wpa_driver_nl80211_data *drv,
2331                          u8 *buf, size_t len,
2332                          struct hostapd_frame_info *hfi,
2333                          enum ieee80211_msg_type msg_type)
2334 {
2335         struct ieee80211_hdr *hdr;
2336         u16 fc, type, stype;
2337         size_t data_len = len;
2338         u8 *bssid;
2339         void *ctx = drv->ctx;
2340 #ifdef HOSTAPD
2341         struct hostapd_iface *iface = drv->hapd->iface;
2342         struct hostapd_data *hapd = NULL;
2343         int broadcast_bssid = 0;
2344         size_t i;
2345 #endif /* HOSTAPD */
2346
2347         /*
2348          * PS-Poll frames are 16 bytes. All other frames are
2349          * 24 bytes or longer.
2350          */
2351         if (len < 16)
2352                 return;
2353
2354         hdr = (struct ieee80211_hdr *) buf;
2355         fc = le_to_host16(hdr->frame_control);
2356
2357         type = WLAN_FC_GET_TYPE(fc);
2358         stype = WLAN_FC_GET_STYPE(fc);
2359
2360         switch (type) {
2361         case WLAN_FC_TYPE_DATA:
2362                 if (len < 24)
2363                         return;
2364                 switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
2365                 case WLAN_FC_TODS:
2366                         bssid = hdr->addr1;
2367                         break;
2368                 case WLAN_FC_FROMDS:
2369                         bssid = hdr->addr2;
2370                         break;
2371                 default:
2372                         /* discard */
2373                         return;
2374                 }
2375                 break;
2376         case WLAN_FC_TYPE_CTRL:
2377                 /* discard non-ps-poll frames */
2378                 if (stype != WLAN_FC_STYPE_PSPOLL)
2379                         return;
2380                 bssid = hdr->addr1;
2381                 break;
2382         case WLAN_FC_TYPE_MGMT:
2383                 bssid = hdr->addr3;
2384                 break;
2385         default:
2386                 /* discard */
2387                 return;
2388         }
2389
2390 #ifdef HOSTAPD
2391         /* find interface frame belongs to */
2392         for (i = 0; i < iface->num_bss; i++) {
2393                 if (memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) {
2394                         hapd = iface->bss[i];
2395                         break;
2396                 }
2397         }
2398
2399         if (hapd == NULL) {
2400                 hapd = iface->bss[0];
2401
2402                 if (bssid[0] != 0xff || bssid[1] != 0xff ||
2403                     bssid[2] != 0xff || bssid[3] != 0xff ||
2404                     bssid[4] != 0xff || bssid[5] != 0xff) {
2405                         /*
2406                          * Unknown BSSID - drop frame if this is not from
2407                          * passive scanning or a beacon (at least ProbeReq
2408                          * frames to other APs may be allowed through RX
2409                          * filtering in the wlan hw/driver)
2410                          */
2411                         if ((type != WLAN_FC_TYPE_MGMT ||
2412                              stype != WLAN_FC_STYPE_BEACON))
2413                                 return;
2414                 } else
2415                         broadcast_bssid = 1;
2416         }
2417         ctx = hapd;
2418 #endif /* HOSTAPD */
2419
2420         switch (msg_type) {
2421         case ieee80211_msg_normal:
2422                 /* continue processing */
2423                 break;
2424         case ieee80211_msg_tx_callback_ack:
2425                 handle_tx_callback(ctx, buf, data_len, 1);
2426                 return;
2427         case ieee80211_msg_tx_callback_fail:
2428                 handle_tx_callback(ctx, buf, data_len, 0);
2429                 return;
2430         }
2431
2432         switch (type) {
2433         case WLAN_FC_TYPE_MGMT:
2434                 if (stype != WLAN_FC_STYPE_BEACON &&
2435                     stype != WLAN_FC_STYPE_PROBE_REQ)
2436                         wpa_printf(MSG_MSGDUMP, "MGMT");
2437 #ifdef HOSTAPD
2438                 if (broadcast_bssid) {
2439                         for (i = 0; i < iface->num_bss; i++)
2440                                 hostapd_mgmt_rx(iface->bss[i], buf, data_len,
2441                                                 stype, hfi);
2442                 } else
2443                         hostapd_mgmt_rx(hapd, buf, data_len, stype, hfi);
2444 #else /* HOSTAPD */
2445                 ap_mgmt_rx(drv->ctx, buf, data_len, stype, hfi);
2446 #endif /* HOSTAPD */
2447                 break;
2448         case WLAN_FC_TYPE_CTRL:
2449                 /* can only get here with PS-Poll frames */
2450                 wpa_printf(MSG_DEBUG, "CTRL");
2451 #ifdef HOSTAPD
2452                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
2453 #else /* HOSTAPD */
2454                 ap_rx_from_unknown_sta(drv->ctx, hdr->addr2);
2455 #endif /* HOSTAPD */
2456                 break;
2457         case WLAN_FC_TYPE_DATA:
2458 #ifdef HOSTAPD
2459                 hostapd_rx_from_unknown_sta(drv->hapd, hdr->addr2);
2460 #else /* HOSTAPD */
2461                 ap_rx_from_unknown_sta(drv->ctx, hdr->addr2);
2462 #endif /* HOSTAPD */
2463                 break;
2464         }
2465 }
2466
2467
2468 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
2469 {
2470         struct wpa_driver_nl80211_data *drv = eloop_ctx;
2471         int len;
2472         unsigned char buf[3000];
2473         struct ieee80211_radiotap_iterator iter;
2474         int ret;
2475         struct hostapd_frame_info hfi;
2476         int injected = 0, failed = 0, msg_type, rxflags = 0;
2477
2478         len = recv(sock, buf, sizeof(buf), 0);
2479         if (len < 0) {
2480                 perror("recv");
2481                 return;
2482         }
2483
2484         if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
2485                 printf("received invalid radiotap frame\n");
2486                 return;
2487         }
2488
2489         memset(&hfi, 0, sizeof(hfi));
2490
2491         while (1) {
2492                 ret = ieee80211_radiotap_iterator_next(&iter);
2493                 if (ret == -ENOENT)
2494                         break;
2495                 if (ret) {
2496                         printf("received invalid radiotap frame (%d)\n", ret);
2497                         return;
2498                 }
2499                 switch (iter.this_arg_index) {
2500                 case IEEE80211_RADIOTAP_FLAGS:
2501                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
2502                                 len -= 4;
2503                         break;
2504                 case IEEE80211_RADIOTAP_RX_FLAGS:
2505                         rxflags = 1;
2506                         break;
2507                 case IEEE80211_RADIOTAP_TX_FLAGS:
2508                         injected = 1;
2509                         failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
2510                                         IEEE80211_RADIOTAP_F_TX_FAIL;
2511                         break;
2512                 case IEEE80211_RADIOTAP_DATA_RETRIES:
2513                         break;
2514                 case IEEE80211_RADIOTAP_CHANNEL:
2515                         /* TODO convert from freq/flags to channel number
2516                         hfi.channel = XXX;
2517                         hfi.phytype = XXX;
2518                          */
2519                         break;
2520                 case IEEE80211_RADIOTAP_RATE:
2521                         hfi.datarate = *iter.this_arg * 5;
2522                         break;
2523                 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
2524                         hfi.ssi_signal = *iter.this_arg;
2525                         break;
2526                 }
2527         }
2528
2529         if (rxflags && injected)
2530                 return;
2531
2532         if (!injected)
2533                 msg_type = ieee80211_msg_normal;
2534         else if (failed)
2535                 msg_type = ieee80211_msg_tx_callback_fail;
2536         else
2537                 msg_type = ieee80211_msg_tx_callback_ack;
2538
2539         handle_frame(drv, buf + iter.max_length,
2540                      len - iter.max_length, &hfi, msg_type);
2541 }
2542
2543
2544 /*
2545  * we post-process the filter code later and rewrite
2546  * this to the offset to the last instruction
2547  */
2548 #define PASS    0xFF
2549 #define FAIL    0xFE
2550
2551 static struct sock_filter msock_filter_insns[] = {
2552         /*
2553          * do a little-endian load of the radiotap length field
2554          */
2555         /* load lower byte into A */
2556         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 2),
2557         /* put it into X (== index register) */
2558         BPF_STMT(BPF_MISC| BPF_TAX, 0),
2559         /* load upper byte into A */
2560         BPF_STMT(BPF_LD  | BPF_B | BPF_ABS, 3),
2561         /* left-shift it by 8 */
2562         BPF_STMT(BPF_ALU | BPF_LSH | BPF_K, 8),
2563         /* or with X */
2564         BPF_STMT(BPF_ALU | BPF_OR | BPF_X, 0),
2565         /* put result into X */
2566         BPF_STMT(BPF_MISC| BPF_TAX, 0),
2567
2568         /*
2569          * Allow management frames through, this also gives us those
2570          * management frames that we sent ourselves with status
2571          */
2572         /* load the lower byte of the IEEE 802.11 frame control field */
2573         BPF_STMT(BPF_LD  | BPF_B | BPF_IND, 0),
2574         /* mask off frame type and version */
2575         BPF_STMT(BPF_ALU | BPF_AND | BPF_K, 0xF),
2576         /* accept frame if it's both 0, fall through otherwise */
2577         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0, PASS, 0),
2578
2579         /*
2580          * TODO: add a bit to radiotap RX flags that indicates
2581          * that the sending station is not associated, then
2582          * add a filter here that filters on our DA and that flag
2583          * to allow us to deauth frames to that bad station.
2584          *
2585          * Not a regression -- we didn't do it before either.
2586          */
2587
2588 #if 0
2589         /*
2590          * drop non-data frames, WDS frames
2591          */
2592         /* load the lower byte of the frame control field */
2593         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2594         /* mask off QoS bit */
2595         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x0c),
2596         /* drop non-data frames */
2597         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 8, 0, FAIL),
2598         /* load the upper byte of the frame control field */
2599         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2600         /* mask off toDS/fromDS */
2601         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x03),
2602         /* drop WDS frames */
2603         BPF_JUMP(BPF_JMP  | BPF_JEQ | BPF_K, 3, FAIL, 0),
2604 #endif
2605
2606         /*
2607          * add header length to index
2608          */
2609         /* load the lower byte of the frame control field */
2610         BPF_STMT(BPF_LD   | BPF_B | BPF_IND, 0),
2611         /* mask off QoS bit */
2612         BPF_STMT(BPF_ALU  | BPF_AND | BPF_K, 0x80),
2613         /* right shift it by 6 to give 0 or 2 */
2614         BPF_STMT(BPF_ALU  | BPF_RSH | BPF_K, 6),
2615         /* add data frame header length */
2616         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_K, 24),
2617         /* add index, was start of 802.11 header */
2618         BPF_STMT(BPF_ALU  | BPF_ADD | BPF_X, 0),
2619         /* move to index, now start of LL header */
2620         BPF_STMT(BPF_MISC | BPF_TAX, 0),
2621
2622         /*
2623          * Accept empty data frames, we use those for
2624          * polling activity.
2625          */
2626         BPF_STMT(BPF_LD  | BPF_W | BPF_LEN, 0),
2627         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_X, 0, PASS, 0),
2628
2629         /*
2630          * Accept EAPOL frames
2631          */
2632         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 0),
2633         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0xAAAA0300, 0, FAIL),
2634         BPF_STMT(BPF_LD  | BPF_W | BPF_IND, 4),
2635         BPF_JUMP(BPF_JMP | BPF_JEQ | BPF_K, 0x0000888E, PASS, FAIL),
2636
2637         /* keep these last two statements or change the code below */
2638         /* return 0 == "DROP" */
2639         BPF_STMT(BPF_RET | BPF_K, 0),
2640         /* return ~0 == "keep all" */
2641         BPF_STMT(BPF_RET | BPF_K, ~0),
2642 };
2643
2644 static struct sock_fprog msock_filter = {
2645         .len = sizeof(msock_filter_insns)/sizeof(msock_filter_insns[0]),
2646         .filter = msock_filter_insns,
2647 };
2648
2649
2650 static int add_monitor_filter(int s)
2651 {
2652         int idx;
2653
2654         /* rewrite all PASS/FAIL jump offsets */
2655         for (idx = 0; idx < msock_filter.len; idx++) {
2656                 struct sock_filter *insn = &msock_filter_insns[idx];
2657
2658                 if (BPF_CLASS(insn->code) == BPF_JMP) {
2659                         if (insn->code == (BPF_JMP|BPF_JA)) {
2660                                 if (insn->k == PASS)
2661                                         insn->k = msock_filter.len - idx - 2;
2662                                 else if (insn->k == FAIL)
2663                                         insn->k = msock_filter.len - idx - 3;
2664                         }
2665
2666                         if (insn->jt == PASS)
2667                                 insn->jt = msock_filter.len - idx - 2;
2668                         else if (insn->jt == FAIL)
2669                                 insn->jt = msock_filter.len - idx - 3;
2670
2671                         if (insn->jf == PASS)
2672                                 insn->jf = msock_filter.len - idx - 2;
2673                         else if (insn->jf == FAIL)
2674                                 insn->jf = msock_filter.len - idx - 3;
2675                 }
2676         }
2677
2678         if (setsockopt(s, SOL_SOCKET, SO_ATTACH_FILTER,
2679                        &msock_filter, sizeof(msock_filter))) {
2680                 perror("SO_ATTACH_FILTER");
2681                 return -1;
2682         }
2683
2684         return 0;
2685 }
2686
2687
2688 static int
2689 nl80211_create_monitor_interface(struct wpa_driver_nl80211_data *drv)
2690 {
2691         char buf[IFNAMSIZ];
2692         struct sockaddr_ll ll;
2693         int optval;
2694         socklen_t optlen;
2695
2696         snprintf(buf, IFNAMSIZ, "mon.%s", drv->ifname);
2697         buf[IFNAMSIZ - 1] = '\0';
2698
2699         drv->monitor_ifidx =
2700                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL);
2701
2702         if (drv->monitor_ifidx < 0)
2703                 return -1;
2704
2705         if (hostapd_set_iface_flags(drv, buf, 1))
2706                 goto error;
2707
2708         memset(&ll, 0, sizeof(ll));
2709         ll.sll_family = AF_PACKET;
2710         ll.sll_ifindex = drv->monitor_ifidx;
2711         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
2712         if (drv->monitor_sock < 0) {
2713                 perror("socket[PF_PACKET,SOCK_RAW]");
2714                 goto error;
2715         }
2716
2717         if (add_monitor_filter(drv->monitor_sock)) {
2718                 wpa_printf(MSG_INFO, "Failed to set socket filter for monitor "
2719                            "interface; do filtering in user space");
2720                 /* This works, but will cost in performance. */
2721         }
2722
2723         if (bind(drv->monitor_sock, (struct sockaddr *) &ll, sizeof(ll)) < 0) {
2724                 perror("monitor socket bind");
2725                 goto error;
2726         }
2727
2728         optlen = sizeof(optval);
2729         optval = 20;
2730         if (setsockopt
2731             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
2732                 perror("Failed to set socket priority");
2733                 goto error;
2734         }
2735
2736         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
2737                                      drv, NULL)) {
2738                 printf("Could not register monitor read socket\n");
2739                 goto error;
2740         }
2741
2742         return 0;
2743  error:
2744         nl80211_remove_iface(drv, drv->monitor_ifidx);
2745         return -1;
2746 }
2747
2748 #endif /* CONFIG_AP || HOSTAPD */
2749
2750 #ifdef CONFIG_AP
2751
2752 static int wpa_driver_nl80211_ap(struct wpa_driver_nl80211_data *drv,
2753                                  struct wpa_driver_associate_params *params)
2754 {
2755         if (drv->monitor_ifidx < 0 &&
2756             nl80211_create_monitor_interface(drv))
2757                 return -1;
2758
2759         if (wpa_driver_nl80211_set_mode(drv, params->mode) ||
2760             wpa_driver_nl80211_set_freq(drv, params->freq, 0, 0)) {
2761                 nl80211_remove_iface(drv, drv->monitor_ifidx);
2762                 drv->monitor_ifidx = -1;
2763                 return -1;
2764         }
2765
2766         /* TODO: setup monitor interface (and add code somewhere to remove this
2767          * when AP mode is stopped; associate with mode != 2 or drv_deinit) */
2768
2769         return 0;
2770 }
2771 #endif /* CONFIG_AP */
2772
2773
2774 static int wpa_driver_nl80211_associate(
2775         void *priv, struct wpa_driver_associate_params *params)
2776 {
2777         struct wpa_driver_nl80211_data *drv = priv;
2778         int ret = -1;
2779         struct nl_msg *msg;
2780
2781 #ifdef CONFIG_AP
2782         if (params->mode == 2)
2783                 return wpa_driver_nl80211_ap(drv, params);
2784 #endif /* CONFIG_AP */
2785
2786         wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
2787                                           params->drop_unencrypted);
2788
2789         drv->associated = 0;
2790
2791         msg = nlmsg_alloc();
2792         if (!msg)
2793                 return -1;
2794
2795         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
2796                    drv->ifindex);
2797         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2798                     NL80211_CMD_ASSOCIATE, 0);
2799
2800         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2801         if (params->bssid) {
2802                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2803                            MAC2STR(params->bssid));
2804                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
2805         }
2806         if (params->freq) {
2807                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2808                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2809         }
2810         if (params->ssid) {
2811                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2812                                   params->ssid, params->ssid_len);
2813                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
2814                         params->ssid);
2815                 if (params->ssid_len > sizeof(drv->ssid))
2816                         goto nla_put_failure;
2817                 os_memcpy(drv->ssid, params->ssid, params->ssid_len);
2818                 drv->ssid_len = params->ssid_len;
2819         }
2820         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
2821         if (params->wpa_ie)
2822                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
2823                         params->wpa_ie);
2824
2825         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2826         msg = NULL;
2827         if (ret) {
2828                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2829                            "(%s)", ret, strerror(-ret));
2830                 goto nla_put_failure;
2831         }
2832         ret = 0;
2833         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
2834                    "successfully");
2835
2836 nla_put_failure:
2837         nlmsg_free(msg);
2838         return ret;
2839 }
2840
2841
2842 /**
2843  * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc)
2844  * @drv: Pointer to private driver data from wpa_driver_nl80211_init()
2845  * @mode: 0 = infra/BSS (associate with an AP), 1 = adhoc/IBSS
2846  * Returns: 0 on success, -1 on failure
2847  */
2848 static int wpa_driver_nl80211_set_mode(struct wpa_driver_nl80211_data *drv,
2849                                        int mode)
2850 {
2851         int ret = -1;
2852         struct nl_msg *msg;
2853         int nlmode;
2854
2855         switch (mode) {
2856         case 0:
2857                 nlmode = NL80211_IFTYPE_STATION;
2858                 break;
2859         case 1:
2860                 nlmode = NL80211_IFTYPE_ADHOC;
2861                 break;
2862         case 2:
2863                 nlmode = NL80211_IFTYPE_AP;
2864                 break;
2865         default:
2866                 return -1;
2867         }
2868
2869         msg = nlmsg_alloc();
2870         if (!msg)
2871                 return -1;
2872
2873         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2874                     0, NL80211_CMD_SET_INTERFACE, 0);
2875         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2876         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
2877
2878         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2879         if (!ret)
2880                 return 0;
2881         else
2882                 goto try_again;
2883
2884 nla_put_failure:
2885         wpa_printf(MSG_ERROR, "nl80211: Failed to set interface mode: %d (%s)",
2886                    ret, strerror(-ret));
2887         return -1;
2888
2889 try_again:
2890         /* mac80211 doesn't allow mode changes while the device is up, so
2891          * take the device down, try to set the mode again, and bring the
2892          * device back up.
2893          */
2894         if (hostapd_set_iface_flags(drv, drv->ifname, 0) == 0) {
2895                 /* Try to set the mode again while the interface is down */
2896                 msg = nlmsg_alloc();
2897                 if (!msg)
2898                         return -1;
2899
2900                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2901                             0, NL80211_CMD_SET_INTERFACE, 0);
2902                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2903                 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, nlmode);
2904                 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2905                 if (ret) {
2906                         wpa_printf(MSG_ERROR, "Failed to set interface %s "
2907                                    "mode(try_again): %d (%s)",
2908                                    drv->ifname, ret, strerror(-ret));
2909                 }
2910
2911                 if (hostapd_set_iface_flags(drv, drv->ifname, 1))
2912                         ret = -1;
2913         }
2914
2915         return ret;
2916 }
2917
2918
2919 static int wpa_driver_nl80211_get_capa(void *priv,
2920                                        struct wpa_driver_capa *capa)
2921 {
2922         struct wpa_driver_nl80211_data *drv = priv;
2923         if (!drv->has_capability)
2924                 return -1;
2925         os_memcpy(capa, &drv->capa, sizeof(*capa));
2926         return 0;
2927 }
2928
2929
2930 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
2931 {
2932         struct wpa_driver_nl80211_data *drv = priv;
2933
2934         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
2935                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
2936         drv->operstate = state;
2937         return wpa_driver_nl80211_send_oper_ifla(
2938                 drv, -1, state ? IF_OPER_UP : IF_OPER_DORMANT);
2939 }
2940
2941
2942 #ifdef HOSTAPD
2943
2944 static const u8 rfc1042_header[6] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
2945
2946 static int i802_sta_deauth(void *priv, const u8 *addr, int reason);
2947 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason);
2948
2949
2950 static struct i802_bss * get_bss(struct wpa_driver_nl80211_data *drv,
2951                                  int ifindex)
2952 {
2953         struct i802_bss *bss = &drv->bss;
2954         while (bss) {
2955                 if (ifindex == bss->ifindex)
2956                         return bss;
2957                 bss = bss->next;
2958         }
2959         wpa_printf(MSG_DEBUG, "nl80211: get_bss(%d) failed", ifindex);
2960         return NULL;
2961 }
2962
2963
2964 static void add_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
2965 {
2966         int i;
2967         int *old;
2968
2969         wpa_printf(MSG_DEBUG, "nl80211: Add own interface ifindex %d",
2970                    ifidx);
2971         for (i = 0; i < drv->num_if_indices; i++) {
2972                 if (drv->if_indices[i] == 0) {
2973                         drv->if_indices[i] = ifidx;
2974                         return;
2975                 }
2976         }
2977
2978         if (drv->if_indices != drv->default_if_indices)
2979                 old = drv->if_indices;
2980         else
2981                 old = NULL;
2982
2983         drv->if_indices = realloc(old,
2984                                   sizeof(int) * (drv->num_if_indices + 1));
2985         if (!drv->if_indices) {
2986                 if (!old)
2987                         drv->if_indices = drv->default_if_indices;
2988                 else
2989                         drv->if_indices = old;
2990                 wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
2991                            "interfaces");
2992                 wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
2993                 return;
2994         }
2995         drv->if_indices[drv->num_if_indices] = ifidx;
2996         drv->num_if_indices++;
2997 }
2998
2999
3000 static void del_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
3001 {
3002         int i;
3003
3004         for (i = 0; i < drv->num_if_indices; i++) {
3005                 if (drv->if_indices[i] == ifidx) {
3006                         drv->if_indices[i] = 0;
3007                         break;
3008                 }
3009         }
3010 }
3011
3012
3013 static int have_ifidx(struct wpa_driver_nl80211_data *drv, int ifidx)
3014 {
3015         int i;
3016
3017         for (i = 0; i < drv->num_if_indices; i++)
3018                 if (drv->if_indices[i] == ifidx)
3019                         return 1;
3020
3021         return 0;
3022 }
3023
3024
3025 static int i802_set_key(const char *iface, void *priv, wpa_alg alg,
3026                         const u8 *addr, int key_idx, int set_tx, const u8 *seq,
3027                         size_t seq_len, const u8 *key, size_t key_len)
3028 {
3029         struct wpa_driver_nl80211_data *drv = priv;
3030         return nl_set_encr(if_nametoindex(iface), drv, alg, addr, key_idx,
3031                            set_tx, seq, seq_len, key, key_len);
3032 }
3033
3034
3035 static inline int min_int(int a, int b)
3036 {
3037         if (a < b)
3038                 return a;
3039         return b;
3040 }
3041
3042
3043 static int get_key_handler(struct nl_msg *msg, void *arg)
3044 {
3045         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3046         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3047
3048         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3049                   genlmsg_attrlen(gnlh, 0), NULL);
3050
3051         /*
3052          * TODO: validate the key index and mac address!
3053          * Otherwise, there's a race condition as soon as
3054          * the kernel starts sending key notifications.
3055          */
3056
3057         if (tb[NL80211_ATTR_KEY_SEQ])
3058                 memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
3059                        min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
3060         return NL_SKIP;
3061 }
3062
3063
3064 static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
3065                            int idx, u8 *seq)
3066 {
3067         struct wpa_driver_nl80211_data *drv = priv;
3068         struct nl_msg *msg;
3069
3070         msg = nlmsg_alloc();
3071         if (!msg)
3072                 return -ENOMEM;
3073
3074         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3075                     0, NL80211_CMD_GET_KEY, 0);
3076
3077         if (addr)
3078                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3079         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
3080         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
3081
3082         memset(seq, 0, 6);
3083
3084         return send_and_recv_msgs(drv, msg, get_key_handler, seq);
3085  nla_put_failure:
3086         return -ENOBUFS;
3087 }
3088
3089
3090 static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
3091                               int mode)
3092 {
3093         struct wpa_driver_nl80211_data *drv = priv;
3094         struct nl_msg *msg;
3095         u8 rates[NL80211_MAX_SUPP_RATES];
3096         u8 rates_len = 0;
3097         int i;
3098
3099         msg = nlmsg_alloc();
3100         if (!msg)
3101                 return -ENOMEM;
3102
3103         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3104                     NL80211_CMD_SET_BSS, 0);
3105
3106         for (i = 0; i < NL80211_MAX_SUPP_RATES && basic_rates[i] >= 0; i++)
3107                 rates[rates_len++] = basic_rates[i] / 5;
3108
3109         NLA_PUT(msg, NL80211_ATTR_BSS_BASIC_RATES, rates_len, rates);
3110
3111         /* TODO: multi-BSS support */
3112         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3113
3114         return send_and_recv_msgs(drv, msg, NULL, NULL);
3115  nla_put_failure:
3116         return -ENOBUFS;
3117 }
3118
3119
3120 /* Set kernel driver on given frequency (MHz) */
3121 static int i802_set_freq(void *priv, struct hostapd_freq_params *freq)
3122 {
3123         struct wpa_driver_nl80211_data *drv = priv;
3124         return wpa_driver_nl80211_set_freq(drv, freq->freq, freq->ht_enabled,
3125                                            freq->sec_channel_offset);
3126 }
3127
3128
3129 static int i802_set_rts(void *priv, int rts)
3130 {
3131         struct wpa_driver_nl80211_data *drv = priv;
3132         struct iwreq iwr;
3133
3134         memset(&iwr, 0, sizeof(iwr));
3135         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3136         iwr.u.rts.value = rts;
3137         iwr.u.rts.fixed = 1;
3138
3139         if (ioctl(drv->ioctl_sock, SIOCSIWRTS, &iwr) < 0) {
3140                 perror("ioctl[SIOCSIWRTS]");
3141                 return -1;
3142         }
3143
3144         return 0;
3145 }
3146
3147
3148 static int i802_set_frag(void *priv, int frag)
3149 {
3150         struct wpa_driver_nl80211_data *drv = priv;
3151         struct iwreq iwr;
3152
3153         memset(&iwr, 0, sizeof(iwr));
3154         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3155         iwr.u.frag.value = frag;
3156         iwr.u.frag.fixed = 1;
3157
3158         if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
3159                 perror("ioctl[SIOCSIWFRAG]");
3160                 return -1;
3161         }
3162
3163         return 0;
3164 }
3165
3166
3167 static int i802_set_retry(void *priv, int short_retry, int long_retry)
3168 {
3169         struct wpa_driver_nl80211_data *drv = priv;
3170         struct iwreq iwr;
3171
3172         memset(&iwr, 0, sizeof(iwr));
3173         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3174
3175         iwr.u.retry.value = short_retry;
3176         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
3177         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
3178                 perror("ioctl[SIOCSIWRETRY(short)]");
3179                 return -1;
3180         }
3181
3182         iwr.u.retry.value = long_retry;
3183         iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
3184         if (ioctl(drv->ioctl_sock, SIOCSIWRETRY, &iwr) < 0) {
3185                 perror("ioctl[SIOCSIWRETRY(long)]");
3186                 return -1;
3187         }
3188
3189         return 0;
3190 }
3191
3192
3193 static int i802_flush(void *priv)
3194 {
3195         struct wpa_driver_nl80211_data *drv = priv;
3196         struct nl_msg *msg;
3197
3198         msg = nlmsg_alloc();
3199         if (!msg)
3200                 return -1;
3201
3202         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3203                     0, NL80211_CMD_DEL_STATION, 0);
3204
3205         /*
3206          * XXX: FIX! this needs to flush all VLANs too
3207          */
3208         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3209                     if_nametoindex(drv->ifname));
3210
3211         return send_and_recv_msgs(drv, msg, NULL, NULL);
3212  nla_put_failure:
3213         return -ENOBUFS;
3214 }
3215
3216
3217 static int get_sta_handler(struct nl_msg *msg, void *arg)
3218 {
3219         struct nlattr *tb[NL80211_ATTR_MAX + 1];
3220         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
3221         struct hostap_sta_driver_data *data = arg;
3222         struct nlattr *stats[NL80211_STA_INFO_MAX + 1];
3223         static struct nla_policy stats_policy[NL80211_STA_INFO_MAX + 1] = {
3224                 [NL80211_STA_INFO_INACTIVE_TIME] = { .type = NLA_U32 },
3225                 [NL80211_STA_INFO_RX_BYTES] = { .type = NLA_U32 },
3226                 [NL80211_STA_INFO_TX_BYTES] = { .type = NLA_U32 },
3227                 [NL80211_STA_INFO_RX_PACKETS] = { .type = NLA_U32 },
3228                 [NL80211_STA_INFO_TX_PACKETS] = { .type = NLA_U32 },
3229         };
3230
3231         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
3232                   genlmsg_attrlen(gnlh, 0), NULL);
3233
3234         /*
3235          * TODO: validate the interface and mac address!
3236          * Otherwise, there's a race condition as soon as
3237          * the kernel starts sending station notifications.
3238          */
3239
3240         if (!tb[NL80211_ATTR_STA_INFO]) {
3241                 wpa_printf(MSG_DEBUG, "sta stats missing!");
3242                 return NL_SKIP;
3243         }
3244         if (nla_parse_nested(stats, NL80211_STA_INFO_MAX,
3245                              tb[NL80211_ATTR_STA_INFO],
3246                              stats_policy)) {
3247                 wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
3248                 return NL_SKIP;
3249         }
3250
3251         if (stats[NL80211_STA_INFO_INACTIVE_TIME])
3252                 data->inactive_msec =
3253                         nla_get_u32(stats[NL80211_STA_INFO_INACTIVE_TIME]);
3254         if (stats[NL80211_STA_INFO_RX_BYTES])
3255                 data->rx_bytes = nla_get_u32(stats[NL80211_STA_INFO_RX_BYTES]);
3256         if (stats[NL80211_STA_INFO_TX_BYTES])
3257                 data->tx_bytes = nla_get_u32(stats[NL80211_STA_INFO_TX_BYTES]);
3258         if (stats[NL80211_STA_INFO_RX_PACKETS])
3259                 data->rx_packets =
3260                         nla_get_u32(stats[NL80211_STA_INFO_RX_PACKETS]);
3261         if (stats[NL80211_STA_INFO_TX_PACKETS])
3262                 data->tx_packets =
3263                         nla_get_u32(stats[NL80211_STA_INFO_TX_PACKETS]);
3264
3265         return NL_SKIP;
3266 }
3267
3268 static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
3269                               const u8 *addr)
3270 {
3271         struct wpa_driver_nl80211_data *drv = priv;
3272         struct nl_msg *msg;
3273
3274         os_memset(data, 0, sizeof(*data));
3275         msg = nlmsg_alloc();
3276         if (!msg)
3277                 return -ENOMEM;
3278
3279         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3280                     0, NL80211_CMD_GET_STATION, 0);
3281
3282         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3283         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3284
3285         return send_and_recv_msgs(drv, msg, get_sta_handler, data);
3286  nla_put_failure:
3287         return -ENOBUFS;
3288 }
3289
3290
3291 static int i802_send_eapol(void *priv, const u8 *addr, const u8 *data,
3292                            size_t data_len, int encrypt, const u8 *own_addr)
3293 {
3294         struct wpa_driver_nl80211_data *drv = priv;
3295         struct ieee80211_hdr *hdr;
3296         size_t len;
3297         u8 *pos;
3298         int res;
3299 #if 0 /* FIX */
3300         int qos = sta->flags & WLAN_STA_WME;
3301 #else
3302         int qos = 0;
3303 #endif
3304
3305         len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
3306                 data_len;
3307         hdr = os_zalloc(len);
3308         if (hdr == NULL) {
3309                 printf("malloc() failed for i802_send_data(len=%lu)\n",
3310                        (unsigned long) len);
3311                 return -1;
3312         }
3313
3314         hdr->frame_control =
3315                 IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
3316         hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
3317         if (encrypt)
3318                 hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
3319 #if 0 /* To be enabled if qos determination is added above */
3320         if (qos) {
3321                 hdr->frame_control |=
3322                         host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
3323         }
3324 #endif
3325
3326         memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
3327         memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
3328         memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
3329         pos = (u8 *) (hdr + 1);
3330
3331 #if 0 /* To be enabled if qos determination is added above */
3332         if (qos) {
3333                 /* add an empty QoS header if needed */
3334                 pos[0] = 0;
3335                 pos[1] = 0;
3336                 pos += 2;
3337         }
3338 #endif
3339
3340         memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
3341         pos += sizeof(rfc1042_header);
3342         WPA_PUT_BE16(pos, ETH_P_PAE);
3343         pos += 2;
3344         memcpy(pos, data, data_len);
3345
3346         res = wpa_driver_nl80211_send_frame(drv, (u8 *) hdr, len, encrypt);
3347         if (res < 0) {
3348                 wpa_printf(MSG_ERROR, "i802_send_eapol - packet len: %lu - "
3349                            "failed: %d (%s)",
3350                            (unsigned long) len, errno, strerror(errno));
3351         }
3352         free(hdr);
3353
3354         return res;
3355 }
3356
3357
3358 static int i802_sta_add(const char *ifname, void *priv,
3359                         struct hostapd_sta_add_params *params)
3360 {
3361         struct wpa_driver_nl80211_data *drv = priv;
3362         struct nl_msg *msg;
3363         int ret = -ENOBUFS;
3364
3365         msg = nlmsg_alloc();
3366         if (!msg)
3367                 return -ENOMEM;
3368
3369         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3370                     0, NL80211_CMD_NEW_STATION, 0);
3371
3372         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3373                     if_nametoindex(drv->ifname));
3374         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->addr);
3375         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, params->aid);
3376         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, params->supp_rates_len,
3377                 params->supp_rates);
3378         NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL,
3379                     params->listen_interval);
3380
3381 #ifdef CONFIG_IEEE80211N
3382         if (params->ht_capabilities) {
3383                 NLA_PUT(msg, NL80211_ATTR_HT_CAPABILITY,
3384                         params->ht_capabilities->length,
3385                         &params->ht_capabilities->data);
3386         }
3387 #endif /* CONFIG_IEEE80211N */
3388
3389         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3390         if (ret)
3391                 wpa_printf(MSG_DEBUG, "nl80211: NL80211_CMD_NEW_STATION "
3392                            "result: %d (%s)", ret, strerror(-ret));
3393         if (ret == -EEXIST)
3394                 ret = 0;
3395  nla_put_failure:
3396         return ret;
3397 }
3398
3399
3400 static int i802_sta_remove(void *priv, const u8 *addr)
3401 {
3402         struct wpa_driver_nl80211_data *drv = priv;
3403         struct nl_msg *msg;
3404         int ret;
3405
3406         msg = nlmsg_alloc();
3407         if (!msg)
3408                 return -ENOMEM;
3409
3410         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3411                     0, NL80211_CMD_DEL_STATION, 0);
3412
3413         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3414                     if_nametoindex(drv->ifname));
3415         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3416
3417         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3418         if (ret == -ENOENT)
3419                 return 0;
3420         return ret;
3421  nla_put_failure:
3422         return -ENOBUFS;
3423 }
3424
3425
3426 static int i802_sta_set_flags(void *priv, const u8 *addr,
3427                               int total_flags, int flags_or, int flags_and)
3428 {
3429         struct wpa_driver_nl80211_data *drv = priv;
3430         struct nl_msg *msg, *flags = NULL;
3431
3432         msg = nlmsg_alloc();
3433         if (!msg)
3434                 return -ENOMEM;
3435
3436         flags = nlmsg_alloc();
3437         if (!flags) {
3438                 nlmsg_free(msg);
3439                 return -ENOMEM;
3440         }
3441
3442         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3443                     0, NL80211_CMD_SET_STATION, 0);
3444
3445         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3446                     if_nametoindex(drv->ifname));
3447         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3448
3449         if (total_flags & WLAN_STA_AUTHORIZED)
3450                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
3451
3452         if (total_flags & WLAN_STA_WMM)
3453                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
3454
3455         if (total_flags & WLAN_STA_SHORT_PREAMBLE)
3456                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
3457
3458         if (total_flags & WLAN_STA_MFP)
3459                 NLA_PUT_FLAG(flags, NL80211_STA_FLAG_MFP);
3460
3461         if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
3462                 goto nla_put_failure;
3463
3464         nlmsg_free(flags);
3465
3466         return send_and_recv_msgs(drv, msg, NULL, NULL);
3467  nla_put_failure:
3468         nlmsg_free(flags);
3469         return -ENOBUFS;
3470 }
3471
3472
3473 static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
3474                                     int cw_min, int cw_max, int burst_time)
3475 {
3476         struct wpa_driver_nl80211_data *drv = priv;
3477         struct nl_msg *msg;
3478         struct nlattr *txq, *params;
3479
3480         msg = nlmsg_alloc();
3481         if (!msg)
3482                 return -1;
3483
3484         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3485                     0, NL80211_CMD_SET_WIPHY, 0);
3486
3487         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3488
3489         txq = nla_nest_start(msg, NL80211_ATTR_WIPHY_TXQ_PARAMS);
3490         if (!txq)
3491                 goto nla_put_failure;
3492
3493         /* We are only sending parameters for a single TXQ at a time */
3494         params = nla_nest_start(msg, 1);
3495         if (!params)
3496                 goto nla_put_failure;
3497
3498         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_QUEUE, queue);
3499         /* Burst time is configured in units of 0.1 msec and TXOP parameter in
3500          * 32 usec, so need to convert the value here. */
3501         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_TXOP, (burst_time * 100 + 16) / 32);
3502         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMIN, cw_min);
3503         NLA_PUT_U16(msg, NL80211_TXQ_ATTR_CWMAX, cw_max);
3504         NLA_PUT_U8(msg, NL80211_TXQ_ATTR_AIFS, aifs);
3505
3506         nla_nest_end(msg, params);
3507
3508         nla_nest_end(msg, txq);
3509
3510         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
3511                 return 0;
3512  nla_put_failure:
3513         return -1;
3514 }
3515
3516
3517 static int i802_bss_add(void *priv, const char *ifname, const u8 *bssid)
3518 {
3519         struct wpa_driver_nl80211_data *drv = priv;
3520         int ifidx;
3521         struct i802_bss *bss;
3522
3523         bss = os_zalloc(sizeof(*bss));
3524         if (bss == NULL)
3525                 return -1;
3526         bss->ifindex = if_nametoindex(ifname);
3527
3528         ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid);
3529         if (ifidx < 0) {
3530                 os_free(bss);
3531                 return -1;
3532         }
3533         if (hostapd_set_iface_flags(priv, ifname, 1)) {
3534                 nl80211_remove_iface(priv, ifidx);
3535                 os_free(bss);
3536                 return -1;
3537         }
3538         bss->next = drv->bss.next;
3539         drv->bss.next = bss;
3540         return 0;
3541 }
3542
3543
3544 static int i802_bss_remove(void *priv, const char *ifname)
3545 {
3546         struct wpa_driver_nl80211_data *drv = priv;
3547         struct i802_bss *bss, *prev;
3548         int ifindex = if_nametoindex(ifname);
3549         nl80211_remove_iface(priv, ifindex);
3550         prev = &drv->bss;
3551         bss = drv->bss.next;
3552         while (bss) {
3553                 if (ifindex == bss->ifindex) {
3554                         prev->next = bss->next;
3555                         os_free(bss);
3556                         break;
3557                 }
3558                 prev = bss;
3559                 bss = bss->next;
3560         }
3561         return 0;
3562 }
3563
3564
3565 static int i802_set_beacon(const char *iface, void *priv,
3566                            const u8 *head, size_t head_len,
3567                            const u8 *tail, size_t tail_len, int dtim_period)
3568 {
3569         return wpa_driver_nl80211_set_beacon_iface(if_nametoindex(iface), priv,
3570                                                    head, head_len,
3571                                                    tail, tail_len,
3572                                                    dtim_period);
3573 }
3574
3575
3576 static int i802_del_beacon(struct wpa_driver_nl80211_data *drv)
3577 {
3578         struct nl_msg *msg;
3579
3580         msg = nlmsg_alloc();
3581         if (!msg)
3582                 return -ENOMEM;
3583
3584         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3585                     0, NL80211_CMD_DEL_BEACON, 0);
3586         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3587
3588         return send_and_recv_msgs(drv, msg, NULL, NULL);
3589  nla_put_failure:
3590         return -ENOBUFS;
3591 }
3592
3593
3594 static int i802_set_bss(void *priv, int cts, int preamble, int slot)
3595 {
3596         struct wpa_driver_nl80211_data *drv = priv;
3597         struct nl_msg *msg;
3598
3599         msg = nlmsg_alloc();
3600         if (!msg)
3601                 return -ENOMEM;
3602
3603         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
3604                     NL80211_CMD_SET_BSS, 0);
3605
3606         if (cts >= 0)
3607                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_CTS_PROT, cts);
3608         if (preamble >= 0)
3609                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_PREAMBLE, preamble);
3610         if (slot >= 0)
3611                 NLA_PUT_U8(msg, NL80211_ATTR_BSS_SHORT_SLOT_TIME, slot);
3612
3613         /* TODO: multi-BSS support */
3614         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
3615
3616         return send_and_recv_msgs(drv, msg, NULL, NULL);
3617  nla_put_failure:
3618         return -ENOBUFS;
3619 }
3620
3621
3622 static int i802_set_cts_protect(void *priv, int value)
3623 {
3624         return i802_set_bss(priv, value, -1, -1);
3625 }
3626
3627
3628 static int i802_set_preamble(void *priv, int value)
3629 {
3630         return i802_set_bss(priv, -1, value, -1);
3631 }
3632
3633
3634 static int i802_set_short_slot_time(void *priv, int value)
3635 {
3636         return i802_set_bss(priv, -1, -1, value);
3637 }
3638
3639
3640 static enum nl80211_iftype i802_if_type(enum hostapd_driver_if_type type)
3641 {
3642         switch (type) {
3643         case HOSTAPD_IF_VLAN:
3644                 return NL80211_IFTYPE_AP_VLAN;
3645         case HOSTAPD_IF_WDS:
3646                 return NL80211_IFTYPE_WDS;
3647         }
3648         return -1;
3649 }
3650
3651
3652 static int i802_if_add(const char *iface, void *priv,
3653                        enum hostapd_driver_if_type type, char *ifname,
3654                        const u8 *addr)
3655 {
3656         if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr) < 0)
3657                 return -1;
3658         return 0;
3659 }
3660
3661
3662 static int i802_if_update(void *priv, enum hostapd_driver_if_type type,
3663                           char *ifname, const u8 *addr)
3664 {
3665         /* unused at the moment */
3666         return -1;
3667 }
3668
3669
3670 static int i802_if_remove(void *priv, enum hostapd_driver_if_type type,
3671                           const char *ifname, const u8 *addr)
3672 {
3673         nl80211_remove_iface(priv, if_nametoindex(ifname));
3674         return 0;
3675 }
3676
3677
3678 static int i802_set_sta_vlan(void *priv, const u8 *addr,
3679                              const char *ifname, int vlan_id)
3680 {
3681         struct wpa_driver_nl80211_data *drv = priv;
3682         struct nl_msg *msg;
3683
3684         msg = nlmsg_alloc();
3685         if (!msg)
3686                 return -ENOMEM;
3687
3688         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3689                     0, NL80211_CMD_SET_STATION, 0);
3690
3691         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3692                     if_nametoindex(drv->ifname));
3693         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3694         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3695                     if_nametoindex(ifname));
3696
3697         return send_and_recv_msgs(drv, msg, NULL, NULL);
3698  nla_put_failure:
3699         return -ENOBUFS;
3700 }
3701
3702
3703 static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
3704 {
3705         struct wpa_driver_nl80211_data *drv = eloop_ctx;
3706         struct sockaddr_ll lladdr;
3707         unsigned char buf[3000];
3708         int len;
3709         socklen_t fromlen = sizeof(lladdr);
3710
3711         len = recvfrom(sock, buf, sizeof(buf), 0,
3712                        (struct sockaddr *)&lladdr, &fromlen);
3713         if (len < 0) {
3714                 perror("recv");
3715                 return;
3716         }
3717
3718         if (have_ifidx(drv, lladdr.sll_ifindex)) {
3719                 struct hostapd_data *hapd;
3720                 hapd = hostapd_sta_get_bss(drv->hapd, lladdr.sll_addr);
3721                 if (!hapd)
3722                         return;
3723                 hostapd_eapol_receive(hapd, lladdr.sll_addr, buf, len);
3724         }
3725 }
3726
3727
3728 static int nl80211_set_mode(struct wpa_driver_nl80211_data *drv, const char *ifname,
3729                             int mode)
3730 {
3731         struct nl_msg *msg;
3732         int ret = -ENOBUFS;
3733
3734         msg = nlmsg_alloc();
3735         if (!msg)
3736                 return -ENOMEM;
3737
3738         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3739                     0, NL80211_CMD_SET_INTERFACE, 0);
3740         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
3741                     if_nametoindex(ifname));
3742         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, mode);
3743
3744         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3745         if (!ret)
3746                 return 0;
3747  nla_put_failure:
3748         wpa_printf(MSG_ERROR, "Failed to set interface %s to master "
3749                    "mode.", ifname);
3750         return ret;
3751 }
3752
3753
3754 #ifdef CONFIG_IEEE80211N
3755 static void i802_add_neighbor(struct wpa_driver_nl80211_data *drv, u8 *bssid,
3756                               int freq, u8 *ie, size_t ie_len)
3757 {
3758         struct ieee802_11_elems elems;
3759         int ht, pri_chan = 0, sec_chan = 0;
3760         struct ieee80211_ht_operation *oper;
3761         struct hostapd_neighbor_bss *nnei;
3762
3763         ieee802_11_parse_elems(ie, ie_len, &elems, 0);
3764         ht = elems.ht_capabilities || elems.ht_operation;
3765         if (elems.ht_operation && elems.ht_operation_len >= sizeof(*oper)) {
3766                 oper = (struct ieee80211_ht_operation *) elems.ht_operation;
3767                 pri_chan = oper->control_chan;
3768                 if (oper->ht_param & HT_INFO_HT_PARAM_REC_TRANS_CHNL_WIDTH) {
3769                         if (oper->ht_param &
3770                             HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
3771                                 sec_chan = pri_chan + 4;
3772                         else if (oper->ht_param &
3773                             HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
3774                                 sec_chan = pri_chan - 4;
3775                 }
3776         }
3777
3778         wpa_printf(MSG_DEBUG, "nl80211: Neighboring BSS - bssid=" MACSTR
3779                    " freq=%d MHz HT=%d pri_chan=%d sec_chan=%d",
3780                    MAC2STR(bssid), freq, ht, pri_chan, sec_chan);
3781
3782         nnei = os_realloc(drv->neighbors, (drv->num_neighbors + 1) *
3783                           sizeof(struct hostapd_neighbor_bss));
3784         if (nnei == NULL)
3785                 return;
3786         drv->neighbors = nnei;
3787         nnei = &nnei[drv->num_neighbors];
3788         os_memcpy(nnei->bssid, bssid, ETH_ALEN);
3789         nnei->freq = freq;
3790         nnei->ht = !!ht;
3791         nnei->pri_chan = pri_chan;
3792         nnei->sec_chan = sec_chan;
3793         drv->num_neighbors++;
3794 }
3795
3796
3797 static int i802_get_scan_freq(struct iw_event *iwe, int *freq)
3798 {
3799         int divi = 1000000, i;
3800
3801         if (iwe->u.freq.e == 0) {
3802                 /*
3803                  * Some drivers do not report frequency, but a channel.
3804                  * Try to map this to frequency by assuming they are using
3805                  * IEEE 802.11b/g.  But don't overwrite a previously parsed
3806                  * frequency if the driver sends both frequency and channel,
3807                  * since the driver may be sending an A-band channel that we
3808                  * don't handle here.
3809                  */
3810
3811                 if (*freq)
3812                         return 0;
3813
3814                 if (iwe->u.freq.m >= 1 && iwe->u.freq.m <= 13) {
3815                         *freq = 2407 + 5 * iwe->u.freq.m;
3816                         return 0;
3817                 } else if (iwe->u.freq.m == 14) {
3818                         *freq = 2484;
3819                         return 0;
3820                 }
3821         }
3822
3823         if (iwe->u.freq.e > 6) {
3824                 wpa_printf(MSG_DEBUG, "Invalid freq in scan results: "
3825                            "m=%d e=%d", iwe->u.freq.m, iwe->u.freq.e);
3826                 return -1;
3827         }
3828
3829         for (i = 0; i < iwe->u.freq.e; i++)
3830                 divi /= 10;
3831         *freq = iwe->u.freq.m / divi;
3832         return 0;
3833 }
3834
3835
3836 static int i802_parse_scan(struct wpa_driver_nl80211_data *drv, u8 *res_buf,
3837                            size_t len)
3838 {
3839         size_t ap_num = 0;
3840         int first;
3841         struct iw_event iwe_buf, *iwe = &iwe_buf;
3842         char *pos, *end, *custom;
3843         u8 bssid[ETH_ALEN];
3844         int freq = 0;
3845         u8 *ie = NULL;
3846         size_t ie_len = 0;
3847
3848         ap_num = 0;
3849         first = 1;
3850
3851         pos = (char *) res_buf;
3852         end = (char *) res_buf + len;
3853
3854         while (pos + IW_EV_LCP_LEN <= end) {
3855                 /* Event data may be unaligned, so make a local, aligned copy
3856                  * before processing. */
3857                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
3858                 if (iwe->len <= IW_EV_LCP_LEN)
3859                         break;
3860
3861                 custom = pos + IW_EV_POINT_LEN;
3862                 if (iwe->cmd == IWEVGENIE) {
3863                         /* WE-19 removed the pointer from struct iw_point */
3864                         char *dpos = (char *) &iwe_buf.u.data.length;
3865                         int dlen = dpos - (char *) &iwe_buf;
3866                         os_memcpy(dpos, pos + IW_EV_LCP_LEN,
3867                                   sizeof(struct iw_event) - dlen);
3868                 } else {
3869                         os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
3870                         custom += IW_EV_POINT_OFF;
3871                 }
3872
3873                 switch (iwe->cmd) {
3874                 case SIOCGIWAP:
3875                         if (!first)
3876                                 i802_add_neighbor(drv, bssid, freq, ie,
3877                                                   ie_len);
3878                         first = 0;
3879                         os_memcpy(bssid, iwe->u.ap_addr.sa_data, ETH_ALEN);
3880                         freq = 0;
3881                         ie = NULL;
3882                         ie_len = 0;
3883                         break;
3884                 case SIOCGIWFREQ:
3885                         i802_get_scan_freq(iwe, &freq);
3886                         break;
3887                 case IWEVGENIE:
3888                         if (custom + iwe->u.data.length > end) {
3889                                 wpa_printf(MSG_ERROR, "IWEVGENIE overflow");
3890                                 return -1;
3891                         }
3892                         ie = (u8 *) custom;
3893                         ie_len = iwe->u.data.length;
3894                         break;
3895                 }
3896
3897                 pos += iwe->len;
3898         }
3899
3900         if (!first)
3901                 i802_add_neighbor(drv, bssid, freq, ie, ie_len);
3902
3903         return 0;
3904 }
3905
3906
3907 static int i802_get_ht_scan_res(struct wpa_driver_nl80211_data *drv)
3908 {
3909         struct iwreq iwr;
3910         u8 *res_buf;
3911         size_t res_buf_len;
3912         int res;
3913
3914         res_buf_len = IW_SCAN_MAX_DATA;
3915         for (;;) {
3916                 res_buf = os_malloc(res_buf_len);
3917                 if (res_buf == NULL)
3918                         return -1;
3919                 os_memset(&iwr, 0, sizeof(iwr));
3920                 os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
3921                 iwr.u.data.pointer = res_buf;
3922                 iwr.u.data.length = res_buf_len;
3923
3924                 if (ioctl(drv->ioctl_sock, SIOCGIWSCAN, &iwr) == 0)
3925                         break;
3926
3927                 if (errno == E2BIG && res_buf_len < 65535) {
3928                         os_free(res_buf);
3929                         res_buf = NULL;
3930                         res_buf_len *= 2;
3931                         if (res_buf_len > 65535)
3932                                 res_buf_len = 65535; /* 16-bit length field */
3933                         wpa_printf(MSG_DEBUG, "Scan results did not fit - "
3934                                    "trying larger buffer (%lu bytes)",
3935                                    (unsigned long) res_buf_len);
3936                 } else {
3937                         perror("ioctl[SIOCGIWSCAN]");
3938                         os_free(res_buf);
3939                         return -1;
3940                 }
3941         }
3942
3943         if (iwr.u.data.length > res_buf_len) {
3944                 os_free(res_buf);
3945                 return -1;
3946         }
3947
3948         res = i802_parse_scan(drv, res_buf, iwr.u.data.length);
3949         os_free(res_buf);
3950
3951         return res;
3952 }
3953
3954
3955 static int i802_is_event_wireless_scan_complete(char *data, int len)
3956 {
3957         struct iw_event iwe_buf, *iwe = &iwe_buf;
3958         char *pos, *end;
3959
3960         pos = data;
3961         end = data + len;
3962
3963         while (pos + IW_EV_LCP_LEN <= end) {
3964                 /* Event data may be unaligned, so make a local, aligned copy
3965                  * before processing. */
3966                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
3967                 if (iwe->cmd == SIOCGIWSCAN)
3968                         return 1;
3969
3970                 pos += iwe->len;
3971         }
3972
3973         return 0;
3974 }
3975
3976
3977 static int i802_is_rtm_scan_complete(int ifindex, struct nlmsghdr *h, int len)
3978 {
3979         struct ifinfomsg *ifi;
3980         int attrlen, _nlmsg_len, rta_len;
3981         struct rtattr *attr;
3982
3983         if (len < (int) sizeof(*ifi))
3984                 return 0;
3985
3986         ifi = NLMSG_DATA(h);
3987
3988         if (ifindex != ifi->ifi_index)
3989                 return 0; /* event for foreign ifindex */
3990
3991         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
3992
3993         attrlen = h->nlmsg_len - _nlmsg_len;
3994         if (attrlen < 0)
3995                 return 0;
3996
3997         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
3998
3999         rta_len = RTA_ALIGN(sizeof(struct rtattr));
4000         while (RTA_OK(attr, attrlen)) {
4001                 if (attr->rta_type == IFLA_WIRELESS &&
4002                     i802_is_event_wireless_scan_complete(
4003                             ((char *) attr) + rta_len,
4004                             attr->rta_len - rta_len))
4005                         return 1;
4006                 attr = RTA_NEXT(attr, attrlen);
4007         }
4008
4009         return 0;
4010 }
4011
4012
4013 static int i802_is_scan_complete(int s, int ifindex)
4014 {
4015         char buf[1024];
4016         int left;
4017         struct nlmsghdr *h;
4018
4019         left = recv(s, buf, sizeof(buf), MSG_DONTWAIT);
4020         if (left < 0) {
4021                 perror("recv(netlink)");
4022                 return 0;
4023         }
4024
4025         h = (struct nlmsghdr *) buf;
4026         while (left >= (int) sizeof(*h)) {
4027                 int len, plen;
4028
4029                 len = h->nlmsg_len;
4030                 plen = len - sizeof(*h);
4031                 if (len > left || plen < 0) {
4032                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
4033                                    "len=%d left=%d plen=%d",
4034                                    len, left, plen);
4035                         break;
4036                 }
4037
4038                 switch (h->nlmsg_type) {
4039                 case RTM_NEWLINK:
4040                         if (i802_is_rtm_scan_complete(ifindex, h, plen))
4041                                 return 1;
4042                         break;
4043                 }
4044
4045                 len = NLMSG_ALIGN(len);
4046                 left -= len;
4047                 h = (struct nlmsghdr *) ((char *) h + len);
4048         }
4049
4050         return 0;
4051 }
4052
4053
4054 static int i802_ht_scan(struct wpa_driver_nl80211_data *drv)
4055 {
4056         struct iwreq iwr;
4057         int s, res, ifindex;
4058         struct sockaddr_nl local;
4059         time_t now, end;
4060         fd_set rfds;
4061         struct timeval tv;
4062
4063         wpa_printf(MSG_DEBUG, "nl80211: Scanning overlapping BSSes before "
4064                    "starting HT 20/40 MHz BSS");
4065
4066         /* Request a new scan */
4067         /* TODO: would be enough to scan the selected band */
4068         os_memset(&iwr, 0, sizeof(iwr));
4069         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
4070         if (ioctl(drv->ioctl_sock, SIOCSIWSCAN, &iwr) < 0) {
4071                 perror("ioctl[SIOCSIWSCAN]");
4072                 return -1;
4073         }
4074
4075         ifindex = if_nametoindex(drv->ifname);
4076
4077         /* Wait for scan completion event or timeout */
4078         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
4079         if (s < 0) {
4080                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
4081                 return -1;
4082         }
4083
4084         os_memset(&local, 0, sizeof(local));
4085         local.nl_family = AF_NETLINK;
4086         local.nl_groups = RTMGRP_LINK;
4087         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
4088                 perror("bind(netlink)");
4089                 close(s);
4090                 return -1;
4091         }
4092
4093         time(&end);
4094         end += 30; /* Wait at most 30 seconds for scan results */
4095         for (;;) {
4096                 time(&now);
4097                 tv.tv_sec = end > now ? end - now : 0;
4098                 tv.tv_usec = 0;
4099                 FD_ZERO(&rfds);
4100                 FD_SET(s, &rfds);
4101                 res = select(s + 1, &rfds, NULL, NULL, &tv);
4102                 if (res < 0) {
4103                         perror("select");
4104                         /* Assume results are ready after 10 seconds wait */
4105                         os_sleep(10, 0);
4106                         break;
4107                 } else if (res) {
4108                         if (i802_is_scan_complete(s, ifindex)) {
4109                                 wpa_printf(MSG_DEBUG, "nl80211: Scan "
4110                                            "completed");
4111                                 break;
4112                         }
4113                 } else {
4114                         wpa_printf(MSG_DEBUG, "nl80211: Scan timeout");
4115                         /* Assume results are ready to be read now */
4116                         break;
4117                 }
4118         }
4119
4120         close(s);
4121
4122         return i802_get_ht_scan_res(drv);
4123 }
4124 #endif /* CONFIG_IEEE80211N */
4125
4126
4127 static int i802_init_sockets(struct wpa_driver_nl80211_data *drv, const u8 *bssid)
4128 {
4129         struct ifreq ifr;
4130         int ret;
4131
4132         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
4133         if (drv->ioctl_sock < 0) {
4134                 perror("socket[PF_INET,SOCK_DGRAM]");
4135                 return -1;
4136         }
4137
4138         /* start listening for EAPOL on the default AP interface */
4139         add_ifidx(drv, if_nametoindex(drv->ifname));
4140
4141         if (hostapd_set_iface_flags(drv, drv->ifname, 0))
4142                 return -1;
4143
4144         if (bssid) {
4145                 os_strlcpy(ifr.ifr_name, drv->ifname, IFNAMSIZ);
4146                 memcpy(ifr.ifr_hwaddr.sa_data, bssid, ETH_ALEN);
4147                 ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
4148
4149                 if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifr)) {
4150                         perror("ioctl(SIOCSIFHWADDR)");
4151                         return -1;
4152                 }
4153         }
4154
4155         /*
4156          * initialise generic netlink and nl80211
4157          */
4158         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
4159         if (!drv->nl_cb) {
4160                 printf("Failed to allocate netlink callbacks.\n");
4161                 return -1;
4162         }
4163
4164         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
4165         if (!drv->nl_handle) {
4166                 printf("Failed to allocate netlink handle.\n");
4167                 return -1;
4168         }
4169
4170         if (genl_connect(drv->nl_handle)) {
4171                 printf("Failed to connect to generic netlink.\n");
4172                 return -1;
4173         }
4174
4175 #ifdef CONFIG_LIBNL20
4176         if (genl_ctrl_alloc_cache(drv->nl_handle, &drv->nl_cache) < 0) {
4177                 printf("Failed to allocate generic netlink cache.\n");
4178                 return -1;
4179         }
4180 #else /* CONFIG_LIBNL20 */
4181         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
4182         if (!drv->nl_cache) {
4183                 printf("Failed to allocate generic netlink cache.\n");
4184                 return -1;
4185         }
4186 #endif /* CONFIG_LIBNL20 */
4187
4188         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
4189         if (!drv->nl80211) {
4190                 printf("nl80211 not found.\n");
4191                 return -1;
4192         }
4193
4194         ret = nl_get_multicast_id(drv, "nl80211", "scan");
4195         if (ret >= 0)
4196                 ret = nl_socket_add_membership(drv->nl_handle, ret);
4197         if (ret < 0) {
4198                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4199                            "membership for scan events: %d (%s)",
4200                            ret, strerror(-ret));
4201         }
4202
4203         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
4204         if (ret >= 0)
4205                 ret = nl_socket_add_membership(drv->nl_handle, ret);
4206         if (ret < 0) {
4207                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
4208                            "membership for mlme events: %d (%s)",
4209                            ret, strerror(-ret));
4210         }
4211
4212         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
4213                                  wpa_driver_nl80211_event_receive, drv,
4214                                  drv->hapd);
4215
4216 #ifdef CONFIG_IEEE80211N
4217         if (drv->ht_40mhz_scan) {
4218                 if (nl80211_set_mode(drv, drv->ifname, NL80211_IFTYPE_STATION)
4219                     || hostapd_set_iface_flags(drv, drv->ifname, 1) ||
4220                     i802_ht_scan(drv) ||
4221                     hostapd_set_iface_flags(drv, drv->ifname, 0)) {
4222                         wpa_printf(MSG_ERROR, "Failed to scan channels for "
4223                                    "HT 40 MHz operations");
4224                         return -1;
4225                 }
4226         }
4227 #endif /* CONFIG_IEEE80211N */
4228
4229         /* Initialise a monitor interface */
4230         if (nl80211_create_monitor_interface(drv))
4231                 return -1;
4232
4233         if (nl80211_set_mode(drv, drv->ifname, NL80211_IFTYPE_AP))
4234                 goto fail1;
4235
4236         if (hostapd_set_iface_flags(drv, drv->ifname, 1))
4237                 goto fail1;
4238
4239         drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
4240         if (drv->eapol_sock < 0) {
4241                 perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
4242                 goto fail1;
4243         }
4244
4245         if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
4246         {
4247                 printf("Could not register read socket for eapol\n");
4248                 return -1;
4249         }
4250
4251         memset(&ifr, 0, sizeof(ifr));
4252         os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
4253         if (ioctl(drv->ioctl_sock, SIOCGIFHWADDR, &ifr) != 0) {
4254                 perror("ioctl(SIOCGIFHWADDR)");
4255                 goto fail1;
4256         }
4257
4258         if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
4259                 printf("Invalid HW-addr family 0x%04x\n",
4260                        ifr.ifr_hwaddr.sa_family);
4261                 goto fail1;
4262         }
4263         memcpy(drv->hapd->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
4264
4265         return 0;
4266
4267 fail1:
4268         nl80211_remove_iface(drv, drv->monitor_ifidx);
4269         return -1;
4270 }
4271
4272
4273 static int i802_get_inact_sec(void *priv, const u8 *addr)
4274 {
4275         struct hostap_sta_driver_data data;
4276         int ret;
4277
4278         data.inactive_msec = (unsigned long) -1;
4279         ret = i802_read_sta_data(priv, &data, addr);
4280         if (ret || data.inactive_msec == (unsigned long) -1)
4281                 return -1;
4282         return data.inactive_msec / 1000;
4283 }
4284
4285
4286 static int i802_sta_clear_stats(void *priv, const u8 *addr)
4287 {
4288 #if 0
4289         /* TODO */
4290 #endif
4291         return 0;
4292 }
4293
4294
4295 static int i802_sta_deauth(void *priv, const u8 *addr, int reason)
4296 {
4297         struct wpa_driver_nl80211_data *drv = priv;
4298         struct ieee80211_mgmt mgmt;
4299
4300         memset(&mgmt, 0, sizeof(mgmt));
4301         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4302                                           WLAN_FC_STYPE_DEAUTH);
4303         memcpy(mgmt.da, addr, ETH_ALEN);
4304         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
4305         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
4306         mgmt.u.deauth.reason_code = host_to_le16(reason);
4307         return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt,
4308                                             IEEE80211_HDRLEN +
4309                                             sizeof(mgmt.u.deauth));
4310 }
4311
4312
4313 static int i802_sta_disassoc(void *priv, const u8 *addr, int reason)
4314 {
4315         struct wpa_driver_nl80211_data *drv = priv;
4316         struct ieee80211_mgmt mgmt;
4317
4318         memset(&mgmt, 0, sizeof(mgmt));
4319         mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
4320                                           WLAN_FC_STYPE_DISASSOC);
4321         memcpy(mgmt.da, addr, ETH_ALEN);
4322         memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
4323         memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
4324         mgmt.u.disassoc.reason_code = host_to_le16(reason);
4325         return wpa_driver_nl80211_send_mlme(drv, (u8 *) &mgmt,
4326                                             IEEE80211_HDRLEN +
4327                                             sizeof(mgmt.u.disassoc));
4328 }
4329
4330
4331 static const struct hostapd_neighbor_bss *
4332 i802_get_neighbor_bss(void *priv, size_t *num)
4333 {
4334         struct wpa_driver_nl80211_data *drv = priv;
4335         *num = drv->num_neighbors;
4336         return drv->neighbors;
4337 }
4338
4339
4340 static void *i802_init(struct hostapd_data *hapd,
4341                        struct wpa_init_params *params)
4342 {
4343         struct wpa_driver_nl80211_data *drv;
4344         size_t i;
4345
4346         drv = os_zalloc(sizeof(struct wpa_driver_nl80211_data));
4347         if (drv == NULL) {
4348                 printf("Could not allocate memory for i802 driver data\n");
4349                 return NULL;
4350         }
4351
4352         drv->hapd = hapd;
4353         memcpy(drv->ifname, params->ifname, sizeof(drv->ifname));
4354         drv->ifindex = if_nametoindex(drv->ifname);
4355         drv->bss.ifindex = drv->ifindex;
4356
4357         drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
4358         drv->if_indices = drv->default_if_indices;
4359         for (i = 0; i < params->num_bridge; i++) {
4360                 if (params->bridge[i])
4361                         add_ifidx(drv, if_nametoindex(params->bridge[i]));
4362         }
4363         drv->ht_40mhz_scan = params->ht_40mhz_scan;
4364
4365         if (i802_init_sockets(drv, params->bssid))
4366                 goto failed;
4367
4368         return drv;
4369
4370 failed:
4371         free(drv);
4372         return NULL;
4373 }
4374
4375
4376 static void i802_deinit(void *priv)
4377 {
4378         struct wpa_driver_nl80211_data *drv = priv;
4379         struct i802_bss *bss, *prev;
4380
4381         if (drv->last_freq_ht) {
4382                 /* Clear HT flags from the driver */
4383                 struct hostapd_freq_params freq;
4384                 os_memset(&freq, 0, sizeof(freq));
4385                 freq.freq = drv->last_freq;
4386                 i802_set_freq(priv, &freq);
4387         }
4388
4389         i802_del_beacon(drv);
4390
4391         /* remove monitor interface */
4392         nl80211_remove_iface(drv, drv->monitor_ifidx);
4393
4394         (void) hostapd_set_iface_flags(drv, drv->ifname, 0);
4395
4396         if (drv->monitor_sock >= 0) {
4397                 eloop_unregister_read_sock(drv->monitor_sock);
4398                 close(drv->monitor_sock);
4399         }
4400         if (drv->ioctl_sock >= 0)
4401                 close(drv->ioctl_sock);
4402         if (drv->eapol_sock >= 0) {
4403                 eloop_unregister_read_sock(drv->eapol_sock);
4404                 close(drv->eapol_sock);
4405         }
4406
4407         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
4408         genl_family_put(drv->nl80211);
4409         nl_cache_free(drv->nl_cache);
4410         nl_handle_destroy(drv->nl_handle);
4411         nl_cb_put(drv->nl_cb);
4412
4413         if (drv->if_indices != drv->default_if_indices)
4414                 free(drv->if_indices);
4415
4416         os_free(drv->neighbors);
4417
4418         bss = drv->bss.next;
4419         while (bss) {
4420                 prev = bss;
4421                 bss = bss->next;
4422                 os_free(bss);
4423         }
4424
4425         free(drv);
4426 }
4427
4428 #endif /* HOSTAPD */
4429
4430
4431 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
4432         .name = "nl80211",
4433         .desc = "Linux nl80211/cfg80211",
4434         .get_bssid = wpa_driver_nl80211_get_bssid,
4435         .get_ssid = wpa_driver_nl80211_get_ssid,
4436         .set_key = wpa_driver_nl80211_set_key,
4437         .scan2 = wpa_driver_nl80211_scan,
4438         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
4439         .deauthenticate = wpa_driver_nl80211_deauthenticate,
4440         .disassociate = wpa_driver_nl80211_disassociate,
4441         .authenticate = wpa_driver_nl80211_authenticate,
4442         .associate = wpa_driver_nl80211_associate,
4443         .init = wpa_driver_nl80211_init,
4444         .deinit = wpa_driver_nl80211_deinit,
4445         .get_capa = wpa_driver_nl80211_get_capa,
4446         .set_operstate = wpa_driver_nl80211_set_operstate,
4447         .set_country = wpa_driver_nl80211_set_country,
4448 #ifdef CONFIG_AP
4449         .set_beacon = wpa_driver_nl80211_set_beacon,
4450 #endif /* CONFIG_AP */
4451 #if defined(CONFIG_AP) || defined(HOSTAPD)
4452         .send_mlme = wpa_driver_nl80211_send_mlme,
4453         .set_beacon_int = wpa_driver_nl80211_set_beacon_int,
4454         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
4455 #endif /* CONFIG_AP || HOSTAPD */
4456 #ifdef HOSTAPD
4457         .hapd_init = i802_init,
4458         .hapd_deinit = i802_deinit,
4459         .hapd_set_key = i802_set_key,
4460         .get_seqnum = i802_get_seqnum,
4461         .flush = i802_flush,
4462         .read_sta_data = i802_read_sta_data,
4463         .hapd_send_eapol = i802_send_eapol,
4464         .sta_set_flags = i802_sta_set_flags,
4465         .sta_deauth = i802_sta_deauth,
4466         .sta_disassoc = i802_sta_disassoc,
4467         .sta_remove = i802_sta_remove,
4468         .sta_add = i802_sta_add,
4469         .get_inact_sec = i802_get_inact_sec,
4470         .sta_clear_stats = i802_sta_clear_stats,
4471         .set_freq = i802_set_freq,
4472         .set_rts = i802_set_rts,
4473         .set_frag = i802_set_frag,
4474         .set_retry = i802_set_retry,
4475         .set_rate_sets = i802_set_rate_sets,
4476         .hapd_set_beacon = i802_set_beacon,
4477         .set_cts_protect = i802_set_cts_protect,
4478         .set_preamble = i802_set_preamble,
4479         .set_short_slot_time = i802_set_short_slot_time,
4480         .set_tx_queue_params = i802_set_tx_queue_params,
4481         .bss_add = i802_bss_add,
4482         .bss_remove = i802_bss_remove,
4483         .if_add = i802_if_add,
4484         .if_update = i802_if_update,
4485         .if_remove = i802_if_remove,
4486         .set_sta_vlan = i802_set_sta_vlan,
4487         .get_neighbor_bss = i802_get_neighbor_bss,
4488 #endif /* HOSTAPD */
4489 };