vcs.maemo.org Git - wpasupplicant/blob - src/drivers/driver_nl80211.c

   1 /*
   2  * WPA Supplicant - driver interaction with Linux nl80211/cfg80211
   3  * Copyright (c) 2003-2008, Jouni Malinen <j@w1.fi>
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "includes.h"
  16 #include <sys/ioctl.h>
  17 #include <net/if_arp.h>
  18 #include <netlink/genl/genl.h>
  19 #include <netlink/genl/family.h>
  20 #include <netlink/genl/ctrl.h>
  21 #include "nl80211_copy.h"
  22 #ifdef CONFIG_CLIENT_MLME
  23 #include <netpacket/packet.h>
  24 #include <linux/if_ether.h>
  25 #include "radiotap.h"
  26 #include "radiotap_iter.h"
  27 #endif /* CONFIG_CLIENT_MLME */
  28
  29 #include "wireless_copy.h"
  30 #include "common.h"
  31 #include "driver.h"
  32 #include "eloop.h"
  33 #include "ieee802_11_defs.h"
  34
  35 #ifndef IFF_LOWER_UP
  36 #define IFF_LOWER_UP   0x10000         /* driver signals L1 up         */
  37 #endif
  38 #ifndef IFF_DORMANT
  39 #define IFF_DORMANT    0x20000         /* driver signals dormant       */
  40 #endif
  41
  42 #ifndef IF_OPER_DORMANT
  43 #define IF_OPER_DORMANT 5
  44 #endif
  45 #ifndef IF_OPER_UP
  46 #define IF_OPER_UP 6
  47 #endif
  48
  49
  50 #ifndef NO_WEXT_COMPAT
  51 /*
  52  * Fall back to WEXT association, if the kernel does not support nl80211 MLME
  53  * commands. This is temporary backwards compatibility version that will be
  54  * removed at some point.
  55  */
  56 #define WEXT_COMPAT
  57 #endif /* NO_WEXT_COMPAT */
  58
  59
  60 struct wpa_driver_nl80211_data {
  61         void *ctx;
  62         int wext_event_sock;
  63         int ioctl_sock;
  64         char ifname[IFNAMSIZ + 1];
  65         int ifindex;
  66         int if_removed;
  67         struct wpa_driver_capa capa;
  68         int has_capability;
  69         int we_version_compiled;
  70
  71 #ifdef WEXT_COMPAT
  72         u8 *assoc_req_ies;
  73         size_t assoc_req_ies_len;
  74         u8 *assoc_resp_ies;
  75         size_t assoc_resp_ies_len;
  76
  77         /* for set_auth_alg fallback */
  78         int use_crypt;
  79         int auth_alg_fallback;
  80 #endif /* WEXT_COMPAT */
  81
  82         int operstate;
  83
  84         char mlmedev[IFNAMSIZ + 1];
  85
  86         int scan_complete_events;
  87
  88         struct nl_handle *nl_handle;
  89         struct nl_cache *nl_cache;
  90         struct nl_cb *nl_cb;
  91         struct genl_family *nl80211;
  92
  93 #ifdef CONFIG_CLIENT_MLME
  94         int monitor_sock; /* socket for monitor */
  95         int monitor_ifidx;
  96 #endif /* CONFIG_CLIENT_MLME */
  97
  98         u8 bssid[ETH_ALEN];
  99         int associated;
 100 };
 101
 102
 103 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx,
 104                                             void *timeout_ctx);
 105 static int wpa_driver_nl80211_set_mode(void *priv, int mode);
 106 static int wpa_driver_nl80211_flush_pmkid(void *priv);
 107 static int wpa_driver_nl80211_get_range(void *priv);
 108 static int
 109 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv);
 110
 111
 112 /* nl80211 code */
 113 static int ack_handler(struct nl_msg *msg, void *arg)
 114 {
 115         int *err = arg;
 116         *err = 0;
 117         return NL_STOP;
 118 }
 119
 120 static int finish_handler(struct nl_msg *msg, void *arg)
 121 {
 122         int *ret = arg;
 123         *ret = 0;
 124         return NL_SKIP;
 125 }
 126
 127 static int error_handler(struct sockaddr_nl *nla, struct nlmsgerr *err,
 128                          void *arg)
 129 {
 130         int *ret = arg;
 131         *ret = err->error;
 132         return NL_SKIP;
 133 }
 134
 135 static int send_and_recv_msgs(struct wpa_driver_nl80211_data *drv,
 136                               struct nl_msg *msg,
 137                               int (*valid_handler)(struct nl_msg *, void *),
 138                               void *valid_data)
 139 {
 140         struct nl_cb *cb;
 141         int err = -ENOMEM;
 142
 143         cb = nl_cb_clone(drv->nl_cb);
 144         if (!cb)
 145                 goto out;
 146
 147         err = nl_send_auto_complete(drv->nl_handle, msg);
 148         if (err < 0)
 149                 goto out;
 150
 151         err = 1;
 152
 153         nl_cb_err(cb, NL_CB_CUSTOM, error_handler, &err);
 154         nl_cb_set(cb, NL_CB_FINISH, NL_CB_CUSTOM, finish_handler, &err);
 155         nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_handler, &err);
 156
 157         if (valid_handler)
 158                 nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM,
 159                           valid_handler, valid_data);
 160
 161         while (err > 0)
 162                 nl_recvmsgs(drv->nl_handle, cb);
 163  out:
 164         nl_cb_put(cb);
 165         nlmsg_free(msg);
 166         return err;
 167 }
 168
 169
 170 struct family_data {
 171         const char *group;
 172         int id;
 173 };
 174
 175
 176 static int family_handler(struct nl_msg *msg, void *arg)
 177 {
 178         struct family_data *res = arg;
 179         struct nlattr *tb[CTRL_ATTR_MAX + 1];
 180         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
 181         struct nlattr *mcgrp;
 182         int i;
 183
 184         nla_parse(tb, CTRL_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
 185                   genlmsg_attrlen(gnlh, 0), NULL);
 186         if (!tb[CTRL_ATTR_MCAST_GROUPS])
 187                 return NL_SKIP;
 188
 189         nla_for_each_nested(mcgrp, tb[CTRL_ATTR_MCAST_GROUPS], i) {
 190                 struct nlattr *tb2[CTRL_ATTR_MCAST_GRP_MAX + 1];
 191                 nla_parse(tb2, CTRL_ATTR_MCAST_GRP_MAX, nla_data(mcgrp),
 192                           nla_len(mcgrp), NULL);
 193                 if (!tb2[CTRL_ATTR_MCAST_GRP_NAME] ||
 194                     !tb2[CTRL_ATTR_MCAST_GRP_ID] ||
 195                     os_strncmp(nla_data(tb2[CTRL_ATTR_MCAST_GRP_NAME]),
 196                                res->group,
 197                                nla_len(tb2[CTRL_ATTR_MCAST_GRP_NAME])) != 0)
 198                         continue;
 199                 res->id = nla_get_u32(tb2[CTRL_ATTR_MCAST_GRP_ID]);
 200                 break;
 201         };
 202
 203         return NL_SKIP;
 204 }
 205
 206
 207 static int nl_get_multicast_id(struct wpa_driver_nl80211_data *drv,
 208                                const char *family, const char *group)
 209 {
 210         struct nl_msg *msg;
 211         int ret = -1;
 212         struct family_data res = { group, -ENOENT };
 213
 214         msg = nlmsg_alloc();
 215         if (!msg)
 216                 return -ENOMEM;
 217         genlmsg_put(msg, 0, 0, genl_ctrl_resolve(drv->nl_handle, "nlctrl"),
 218                     0, 0, CTRL_CMD_GETFAMILY, 0);
 219         NLA_PUT_STRING(msg, CTRL_ATTR_FAMILY_NAME, family);
 220
 221         ret = send_and_recv_msgs(drv, msg, family_handler, &res);
 222         msg = NULL;
 223         if (ret == 0)
 224                 ret = res.id;
 225
 226 nla_put_failure:
 227         nlmsg_free(msg);
 228         return ret;
 229 }
 230
 231
 232 static int wpa_driver_nl80211_send_oper_ifla(
 233         struct wpa_driver_nl80211_data *drv,
 234         int linkmode, int operstate)
 235 {
 236         struct {
 237                 struct nlmsghdr hdr;
 238                 struct ifinfomsg ifinfo;
 239                 char opts[16];
 240         } req;
 241         struct rtattr *rta;
 242         static int nl_seq;
 243         ssize_t ret;
 244
 245         os_memset(&req, 0, sizeof(req));
 246
 247         req.hdr.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifinfomsg));
 248         req.hdr.nlmsg_type = RTM_SETLINK;
 249         req.hdr.nlmsg_flags = NLM_F_REQUEST;
 250         req.hdr.nlmsg_seq = ++nl_seq;
 251         req.hdr.nlmsg_pid = 0;
 252
 253         req.ifinfo.ifi_family = AF_UNSPEC;
 254         req.ifinfo.ifi_type = 0;
 255         req.ifinfo.ifi_index = drv->ifindex;
 256         req.ifinfo.ifi_flags = 0;
 257         req.ifinfo.ifi_change = 0;
 258
 259         if (linkmode != -1) {
 260                 rta = (struct rtattr *)
 261                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 262                 rta->rta_type = IFLA_LINKMODE;
 263                 rta->rta_len = RTA_LENGTH(sizeof(char));
 264                 *((char *) RTA_DATA(rta)) = linkmode;
 265                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 266                         RTA_LENGTH(sizeof(char));
 267         }
 268         if (operstate != -1) {
 269                 rta = (struct rtattr *)
 270                         ((char *) &req + NLMSG_ALIGN(req.hdr.nlmsg_len));
 271                 rta->rta_type = IFLA_OPERSTATE;
 272                 rta->rta_len = RTA_LENGTH(sizeof(char));
 273                 *((char *) RTA_DATA(rta)) = operstate;
 274                 req.hdr.nlmsg_len = NLMSG_ALIGN(req.hdr.nlmsg_len) +
 275                         RTA_LENGTH(sizeof(char));
 276         }
 277
 278         wpa_printf(MSG_DEBUG, "WEXT: Operstate: linkmode=%d, operstate=%d",
 279                    linkmode, operstate);
 280
 281         ret = send(drv->wext_event_sock, &req, req.hdr.nlmsg_len, 0);
 282         if (ret < 0) {
 283                 wpa_printf(MSG_DEBUG, "WEXT: Sending operstate IFLA failed: "
 284                            "%s (assume operstate is not supported)",
 285                            strerror(errno));
 286         }
 287
 288         return ret < 0 ? -1 : 0;
 289 }
 290
 291
 292 static int wpa_driver_nl80211_set_auth_param(
 293         struct wpa_driver_nl80211_data *drv, int idx, u32 value)
 294 {
 295         struct iwreq iwr;
 296         int ret = 0;
 297
 298         os_memset(&iwr, 0, sizeof(iwr));
 299         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 300         iwr.u.param.flags = idx & IW_AUTH_INDEX;
 301         iwr.u.param.value = value;
 302
 303         if (ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr) < 0) {
 304                 if (errno != EOPNOTSUPP) {
 305                         wpa_printf(MSG_DEBUG, "WEXT: SIOCSIWAUTH(param %d "
 306                                    "value 0x%x) failed: %s)",
 307                                    idx, value, strerror(errno));
 308                 }
 309                 ret = errno == EOPNOTSUPP ? -2 : -1;
 310         }
 311
 312         return ret;
 313 }
 314
 315
 316 static int wpa_driver_nl80211_get_bssid(void *priv, u8 *bssid)
 317 {
 318         struct wpa_driver_nl80211_data *drv = priv;
 319 #ifdef WEXT_COMPAT
 320         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME)) {
 321                 struct iwreq iwr;
 322                 int ret = 0;
 323
 324                 os_memset(&iwr, 0, sizeof(iwr));
 325                 os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 326
 327                 if (ioctl(drv->ioctl_sock, SIOCGIWAP, &iwr) < 0) {
 328                         perror("ioctl[SIOCGIWAP]");
 329                         ret = -1;
 330                 }
 331                 os_memcpy(bssid, iwr.u.ap_addr.sa_data, ETH_ALEN);
 332
 333                 return ret;
 334         }
 335 #endif /* WEXT_COMPAT */
 336         if (!drv->associated)
 337                 return -1;
 338         os_memcpy(bssid, drv->bssid, ETH_ALEN);
 339         return 0;
 340 }
 341
 342
 343 static int wpa_driver_nl80211_set_bssid(void *priv, const u8 *bssid)
 344 {
 345         struct wpa_driver_nl80211_data *drv = priv;
 346         struct iwreq iwr;
 347         int ret = 0;
 348
 349         os_memset(&iwr, 0, sizeof(iwr));
 350         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 351         iwr.u.ap_addr.sa_family = ARPHRD_ETHER;
 352         if (bssid)
 353                 os_memcpy(iwr.u.ap_addr.sa_data, bssid, ETH_ALEN);
 354         else
 355                 os_memset(iwr.u.ap_addr.sa_data, 0, ETH_ALEN);
 356
 357         if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr) < 0) {
 358                 perror("ioctl[SIOCSIWAP]");
 359                 ret = -1;
 360         }
 361
 362         return ret;
 363 }
 364
 365
 366 static int wpa_driver_nl80211_get_ssid(void *priv, u8 *ssid)
 367 {
 368         struct wpa_driver_nl80211_data *drv = priv;
 369         struct iwreq iwr;
 370         int ret = 0;
 371
 372         os_memset(&iwr, 0, sizeof(iwr));
 373         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 374         iwr.u.essid.pointer = (caddr_t) ssid;
 375         iwr.u.essid.length = 32;
 376
 377         if (ioctl(drv->ioctl_sock, SIOCGIWESSID, &iwr) < 0) {
 378                 perror("ioctl[SIOCGIWESSID]");
 379                 ret = -1;
 380         } else {
 381                 ret = iwr.u.essid.length;
 382                 if (ret > 32)
 383                         ret = 32;
 384                 /* Some drivers include nul termination in the SSID, so let's
 385                  * remove it here before further processing. WE-21 changes this
 386                  * to explicitly require the length _not_ to include nul
 387                  * termination. */
 388                 if (ret > 0 && ssid[ret - 1] == '\0' &&
 389                     drv->we_version_compiled < 21)
 390                         ret--;
 391         }
 392
 393         return ret;
 394 }
 395
 396
 397 static int wpa_driver_nl80211_set_ssid(void *priv, const u8 *ssid,
 398                                        size_t ssid_len)
 399 {
 400         struct wpa_driver_nl80211_data *drv = priv;
 401         struct iwreq iwr;
 402         int ret = 0;
 403         char buf[33];
 404
 405         if (ssid_len > 32)
 406                 return -1;
 407
 408         os_memset(&iwr, 0, sizeof(iwr));
 409         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 410         /* flags: 1 = ESSID is active, 0 = not (promiscuous) */
 411         iwr.u.essid.flags = (ssid_len != 0);
 412         os_memset(buf, 0, sizeof(buf));
 413         os_memcpy(buf, ssid, ssid_len);
 414         iwr.u.essid.pointer = (caddr_t) buf;
 415         if (drv->we_version_compiled < 21) {
 416                 /* For historic reasons, set SSID length to include one extra
 417                  * character, C string nul termination, even though SSID is
 418                  * really an octet string that should not be presented as a C
 419                  * string. Some Linux drivers decrement the length by one and
 420                  * can thus end up missing the last octet of the SSID if the
 421                  * length is not incremented here. WE-21 changes this to
 422                  * explicitly require the length _not_ to include nul
 423                  * termination. */
 424                 if (ssid_len)
 425                         ssid_len++;
 426         }
 427         iwr.u.essid.length = ssid_len;
 428
 429         if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
 430                 perror("ioctl[SIOCSIWESSID]");
 431                 ret = -1;
 432         }
 433
 434         return ret;
 435 }
 436
 437
 438 static int wpa_driver_nl80211_set_freq(void *priv, int freq)
 439 {
 440         struct wpa_driver_nl80211_data *drv = priv;
 441         struct iwreq iwr;
 442         int ret = 0;
 443
 444         os_memset(&iwr, 0, sizeof(iwr));
 445         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
 446         iwr.u.freq.m = freq * 100000;
 447         iwr.u.freq.e = 1;
 448
 449         if (ioctl(drv->ioctl_sock, SIOCSIWFREQ, &iwr) < 0) {
 450                 perror("ioctl[SIOCSIWFREQ]");
 451                 ret = -1;
 452         }
 453
 454         return ret;
 455 }
 456
 457
 458 #ifdef WEXT_COMPAT
 459 static void
 460 wpa_driver_nl80211_event_wireless_custom(void *ctx, char *custom)
 461 {
 462         union wpa_event_data data;
 463
 464         wpa_printf(MSG_MSGDUMP, "WEXT: Custom wireless event: '%s'",
 465                    custom);
 466
 467         os_memset(&data, 0, sizeof(data));
 468         /* Host AP driver */
 469         if (os_strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
 470                 data.michael_mic_failure.unicast =
 471                         os_strstr(custom, " unicast ") != NULL;
 472                 /* TODO: parse parameters(?) */
 473                 wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
 474         } else if (os_strncmp(custom, "ASSOCINFO(ReqIEs=", 17) == 0) {
 475                 char *spos;
 476                 int bytes;
 477
 478                 spos = custom + 17;
 479
 480                 bytes = strspn(spos, "0123456789abcdefABCDEF");
 481                 if (!bytes || (bytes & 1))
 482                         return;
 483                 bytes /= 2;
 484
 485                 data.assoc_info.req_ies = os_malloc(bytes);
 486                 if (data.assoc_info.req_ies == NULL)
 487                         return;
 488
 489                 data.assoc_info.req_ies_len = bytes;
 490                 hexstr2bin(spos, data.assoc_info.req_ies, bytes);
 491
 492                 spos += bytes * 2;
 493
 494                 data.assoc_info.resp_ies = NULL;
 495                 data.assoc_info.resp_ies_len = 0;
 496
 497                 if (os_strncmp(spos, " RespIEs=", 9) == 0) {
 498                         spos += 9;
 499
 500                         bytes = strspn(spos, "0123456789abcdefABCDEF");
 501                         if (!bytes || (bytes & 1))
 502                                 goto done;
 503                         bytes /= 2;
 504
 505                         data.assoc_info.resp_ies = os_malloc(bytes);
 506                         if (data.assoc_info.resp_ies == NULL)
 507                                 goto done;
 508
 509                         data.assoc_info.resp_ies_len = bytes;
 510                         hexstr2bin(spos, data.assoc_info.resp_ies, bytes);
 511                 }
 512
 513                 wpa_supplicant_event(ctx, EVENT_ASSOCINFO, &data);
 514
 515         done:
 516                 os_free(data.assoc_info.resp_ies);
 517                 os_free(data.assoc_info.req_ies);
 518 #ifdef CONFIG_PEERKEY
 519         } else if (os_strncmp(custom, "STKSTART.request=", 17) == 0) {
 520                 if (hwaddr_aton(custom + 17, data.stkstart.peer)) {
 521                         wpa_printf(MSG_DEBUG, "WEXT: unrecognized "
 522                                    "STKSTART.request '%s'", custom + 17);
 523                         return;
 524                 }
 525                 wpa_supplicant_event(ctx, EVENT_STKSTART, &data);
 526 #endif /* CONFIG_PEERKEY */
 527         }
 528 }
 529 #endif /* WEXT_COMPAT */
 530
 531
 532 static int wpa_driver_nl80211_event_wireless_michaelmicfailure(
 533         void *ctx, const char *ev, size_t len)
 534 {
 535         const struct iw_michaelmicfailure *mic;
 536         union wpa_event_data data;
 537
 538         if (len < sizeof(*mic))
 539                 return -1;
 540
 541         mic = (const struct iw_michaelmicfailure *) ev;
 542
 543         wpa_printf(MSG_DEBUG, "Michael MIC failure wireless event: "
 544                    "flags=0x%x src_addr=" MACSTR, mic->flags,
 545                    MAC2STR(mic->src_addr.sa_data));
 546
 547         os_memset(&data, 0, sizeof(data));
 548         data.michael_mic_failure.unicast = !(mic->flags & IW_MICFAILURE_GROUP);
 549         wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE, &data);
 550
 551         return 0;
 552 }
 553
 554
 555 static int wpa_driver_nl80211_event_wireless_pmkidcand(
 556         struct wpa_driver_nl80211_data *drv, const char *ev, size_t len)
 557 {
 558         const struct iw_pmkid_cand *cand;
 559         union wpa_event_data data;
 560         const u8 *addr;
 561
 562         if (len < sizeof(*cand))
 563                 return -1;
 564
 565         cand = (const struct iw_pmkid_cand *) ev;
 566         addr = (const u8 *) cand->bssid.sa_data;
 567
 568         wpa_printf(MSG_DEBUG, "PMKID candidate wireless event: "
 569                    "flags=0x%x index=%d bssid=" MACSTR, cand->flags,
 570                    cand->index, MAC2STR(addr));
 571
 572         os_memset(&data, 0, sizeof(data));
 573         os_memcpy(data.pmkid_candidate.bssid, addr, ETH_ALEN);
 574         data.pmkid_candidate.index = cand->index;
 575         data.pmkid_candidate.preauth = cand->flags & IW_PMKID_CAND_PREAUTH;
 576         wpa_supplicant_event(drv->ctx, EVENT_PMKID_CANDIDATE, &data);
 577
 578         return 0;
 579 }
 580
 581
 582 #ifdef WEXT_COMPAT
 583 static int wpa_driver_nl80211_event_wireless_assocreqie(
 584         struct wpa_driver_nl80211_data *drv, const char *ev, int len)
 585 {
 586         if (len < 0)
 587                 return -1;
 588
 589         wpa_hexdump(MSG_DEBUG, "AssocReq IE wireless event", (const u8 *) ev,
 590                     len);
 591         os_free(drv->assoc_req_ies);
 592         drv->assoc_req_ies = os_malloc(len);
 593         if (drv->assoc_req_ies == NULL) {
 594                 drv->assoc_req_ies_len = 0;
 595                 return -1;
 596         }
 597         os_memcpy(drv->assoc_req_ies, ev, len);
 598         drv->assoc_req_ies_len = len;
 599
 600         return 0;
 601 }
 602
 603
 604 static int wpa_driver_nl80211_event_wireless_assocrespie(
 605         struct wpa_driver_nl80211_data *drv, const char *ev, int len)
 606 {
 607         if (len < 0)
 608                 return -1;
 609
 610         wpa_hexdump(MSG_DEBUG, "AssocResp IE wireless event", (const u8 *) ev,
 611                     len);
 612         os_free(drv->assoc_resp_ies);
 613         drv->assoc_resp_ies = os_malloc(len);
 614         if (drv->assoc_resp_ies == NULL) {
 615                 drv->assoc_resp_ies_len = 0;
 616                 return -1;
 617         }
 618         os_memcpy(drv->assoc_resp_ies, ev, len);
 619         drv->assoc_resp_ies_len = len;
 620
 621         return 0;
 622 }
 623
 624
 625 static void wpa_driver_nl80211_event_assoc_ies(struct wpa_driver_nl80211_data *drv)
 626 {
 627         union wpa_event_data data;
 628
 629         if (drv->assoc_req_ies == NULL && drv->assoc_resp_ies == NULL)
 630                 return;
 631
 632         os_memset(&data, 0, sizeof(data));
 633         if (drv->assoc_req_ies) {
 634                 data.assoc_info.req_ies = drv->assoc_req_ies;
 635                 drv->assoc_req_ies = NULL;
 636                 data.assoc_info.req_ies_len = drv->assoc_req_ies_len;
 637         }
 638         if (drv->assoc_resp_ies) {
 639                 data.assoc_info.resp_ies = drv->assoc_resp_ies;
 640                 drv->assoc_resp_ies = NULL;
 641                 data.assoc_info.resp_ies_len = drv->assoc_resp_ies_len;
 642         }
 643
 644         wpa_supplicant_event(drv->ctx, EVENT_ASSOCINFO, &data);
 645
 646         os_free(data.assoc_info.req_ies);
 647         os_free(data.assoc_info.resp_ies);
 648 }
 649 #endif /* WEXT_COMPAT */
 650
 651
 652 static void wpa_driver_nl80211_event_wireless(struct wpa_driver_nl80211_data *drv,
 653                                            void *ctx, char *data, int len)
 654 {
 655         struct iw_event iwe_buf, *iwe = &iwe_buf;
 656         char *pos, *end, *custom;
 657 #ifdef WEXT_COMPAT
 658         char *buf;
 659 #endif /* WEXT_COMPAT */
 660
 661         pos = data;
 662         end = data + len;
 663
 664         while (pos + IW_EV_LCP_LEN <= end) {
 665                 /* Event data may be unaligned, so make a local, aligned copy
 666                  * before processing. */
 667                 os_memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
 668                 wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
 669                            iwe->cmd, iwe->len);
 670                 if (iwe->len <= IW_EV_LCP_LEN)
 671                         return;
 672
 673                 custom = pos + IW_EV_POINT_LEN;
 674                 if (drv->we_version_compiled > 18 &&
 675                     (iwe->cmd == IWEVMICHAELMICFAILURE ||
 676                      iwe->cmd == IWEVCUSTOM ||
 677                      iwe->cmd == IWEVASSOCREQIE ||
 678                      iwe->cmd == IWEVASSOCRESPIE ||
 679                      iwe->cmd == IWEVPMKIDCAND)) {
 680                         /* WE-19 removed the pointer from struct iw_point */
 681                         char *dpos = (char *) &iwe_buf.u.data.length;
 682                         int dlen = dpos - (char *) &iwe_buf;
 683                         os_memcpy(dpos, pos + IW_EV_LCP_LEN,
 684                                   sizeof(struct iw_event) - dlen);
 685                 } else {
 686                         os_memcpy(&iwe_buf, pos, sizeof(struct iw_event));
 687                         custom += IW_EV_POINT_OFF;
 688                 }
 689
 690                 switch (iwe->cmd) {
 691 #ifdef WEXT_COMPAT
 692                 case SIOCGIWAP:
 693                         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
 694                                 break;
 695                         wpa_printf(MSG_DEBUG, "Wireless event: new AP: "
 696                                    MACSTR,
 697                                    MAC2STR((u8 *) iwe->u.ap_addr.sa_data));
 698                         if (is_zero_ether_addr(
 699                                     (const u8 *) iwe->u.ap_addr.sa_data) ||
 700                             os_memcmp(iwe->u.ap_addr.sa_data,
 701                                       "\x44\x44\x44\x44\x44\x44", ETH_ALEN) ==
 702                             0) {
 703                                 os_free(drv->assoc_req_ies);
 704                                 drv->assoc_req_ies = NULL;
 705                                 os_free(drv->assoc_resp_ies);
 706                                 drv->assoc_resp_ies = NULL;
 707                                 wpa_supplicant_event(ctx, EVENT_DISASSOC,
 708                                                      NULL);
 709
 710                         } else {
 711                                 wpa_driver_nl80211_event_assoc_ies(drv);
 712                                 wpa_supplicant_event(ctx, EVENT_ASSOC, NULL);
 713                         }
 714                         break;
 715 #endif /* WEXT_COMPAT */
 716                 case IWEVMICHAELMICFAILURE:
 717                         wpa_driver_nl80211_event_wireless_michaelmicfailure(
 718                                 ctx, custom, iwe->u.data.length);
 719                         break;
 720 #ifdef WEXT_COMPAT
 721                 case IWEVCUSTOM:
 722                         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
 723                                 break;
 724                         if (custom + iwe->u.data.length > end)
 725                                 return;
 726                         buf = os_malloc(iwe->u.data.length + 1);
 727                         if (buf == NULL)
 728                                 return;
 729                         os_memcpy(buf, custom, iwe->u.data.length);
 730                         buf[iwe->u.data.length] = '\0';
 731                         wpa_driver_nl80211_event_wireless_custom(ctx, buf);
 732                         os_free(buf);
 733                         break;
 734                 case IWEVASSOCREQIE:
 735                         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
 736                                 break;
 737                         wpa_driver_nl80211_event_wireless_assocreqie(
 738                                 drv, custom, iwe->u.data.length);
 739                         break;
 740                 case IWEVASSOCRESPIE:
 741                         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
 742                                 break;
 743                         wpa_driver_nl80211_event_wireless_assocrespie(
 744                                 drv, custom, iwe->u.data.length);
 745                         break;
 746 #endif /* WEXT_COMPAT */
 747                 case IWEVPMKIDCAND:
 748                         wpa_driver_nl80211_event_wireless_pmkidcand(
 749                                 drv, custom, iwe->u.data.length);
 750                         break;
 751                 }
 752
 753                 pos += iwe->len;
 754         }
 755 }
 756
 757
 758 static void wpa_driver_nl80211_event_link(struct wpa_driver_nl80211_data *drv,
 759                                           void *ctx, char *buf, size_t len,
 760                                           int del)
 761 {
 762         union wpa_event_data event;
 763
 764         os_memset(&event, 0, sizeof(event));
 765         if (len > sizeof(event.interface_status.ifname))
 766                 len = sizeof(event.interface_status.ifname) - 1;
 767         os_memcpy(event.interface_status.ifname, buf, len);
 768         event.interface_status.ievent = del ? EVENT_INTERFACE_REMOVED :
 769                 EVENT_INTERFACE_ADDED;
 770
 771         wpa_printf(MSG_DEBUG, "RTM_%sLINK, IFLA_IFNAME: Interface '%s' %s",
 772                    del ? "DEL" : "NEW",
 773                    event.interface_status.ifname,
 774                    del ? "removed" : "added");
 775
 776         if (os_strcmp(drv->ifname, event.interface_status.ifname) == 0) {
 777                 if (del)
 778                         drv->if_removed = 1;
 779                 else
 780                         drv->if_removed = 0;
 781         }
 782
 783         wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
 784 }
 785
 786
 787 static int wpa_driver_nl80211_own_ifname(struct wpa_driver_nl80211_data *drv,
 788                                          struct nlmsghdr *h)
 789 {
 790         struct ifinfomsg *ifi;
 791         int attrlen, _nlmsg_len, rta_len;
 792         struct rtattr *attr;
 793
 794         ifi = NLMSG_DATA(h);
 795
 796         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 797
 798         attrlen = h->nlmsg_len - _nlmsg_len;
 799         if (attrlen < 0)
 800                 return 0;
 801
 802         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 803
 804         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 805         while (RTA_OK(attr, attrlen)) {
 806                 if (attr->rta_type == IFLA_IFNAME) {
 807                         if (os_strcmp(((char *) attr) + rta_len, drv->ifname)
 808                             == 0)
 809                                 return 1;
 810                         else
 811                                 break;
 812                 }
 813                 attr = RTA_NEXT(attr, attrlen);
 814         }
 815
 816         return 0;
 817 }
 818
 819
 820 static int wpa_driver_nl80211_own_ifindex(struct wpa_driver_nl80211_data *drv,
 821                                           int ifindex, struct nlmsghdr *h)
 822 {
 823         if (drv->ifindex == ifindex)
 824                 return 1;
 825
 826         if (drv->if_removed && wpa_driver_nl80211_own_ifname(drv, h)) {
 827                 drv->ifindex = if_nametoindex(drv->ifname);
 828                 wpa_printf(MSG_DEBUG, "nl80211: Update ifindex for a removed "
 829                            "interface");
 830                 wpa_driver_nl80211_finish_drv_init(drv);
 831                 return 1;
 832         }
 833
 834         return 0;
 835 }
 836
 837
 838 static void wpa_driver_nl80211_event_rtm_newlink(struct wpa_driver_nl80211_data *drv,
 839                                               void *ctx, struct nlmsghdr *h,
 840                                               size_t len)
 841 {
 842         struct ifinfomsg *ifi;
 843         int attrlen, _nlmsg_len, rta_len;
 844         struct rtattr * attr;
 845
 846         if (len < sizeof(*ifi))
 847                 return;
 848
 849         ifi = NLMSG_DATA(h);
 850
 851         if (!wpa_driver_nl80211_own_ifindex(drv, ifi->ifi_index, h)) {
 852                 wpa_printf(MSG_DEBUG, "Ignore event for foreign ifindex %d",
 853                            ifi->ifi_index);
 854                 return;
 855         }
 856
 857         wpa_printf(MSG_DEBUG, "RTM_NEWLINK: operstate=%d ifi_flags=0x%x "
 858                    "(%s%s%s%s)",
 859                    drv->operstate, ifi->ifi_flags,
 860                    (ifi->ifi_flags & IFF_UP) ? "[UP]" : "",
 861                    (ifi->ifi_flags & IFF_RUNNING) ? "[RUNNING]" : "",
 862                    (ifi->ifi_flags & IFF_LOWER_UP) ? "[LOWER_UP]" : "",
 863                    (ifi->ifi_flags & IFF_DORMANT) ? "[DORMANT]" : "");
 864         /*
 865          * Some drivers send the association event before the operup event--in
 866          * this case, lifting operstate in wpa_driver_nl80211_set_operstate()
 867          * fails. This will hit us when wpa_supplicant does not need to do
 868          * IEEE 802.1X authentication
 869          */
 870         if (drv->operstate == 1 &&
 871             (ifi->ifi_flags & (IFF_LOWER_UP | IFF_DORMANT)) == IFF_LOWER_UP &&
 872             !(ifi->ifi_flags & IFF_RUNNING))
 873                 wpa_driver_nl80211_send_oper_ifla(drv, -1, IF_OPER_UP);
 874
 875         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 876
 877         attrlen = h->nlmsg_len - _nlmsg_len;
 878         if (attrlen < 0)
 879                 return;
 880
 881         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 882
 883         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 884         while (RTA_OK(attr, attrlen)) {
 885                 if (attr->rta_type == IFLA_WIRELESS) {
 886                         wpa_driver_nl80211_event_wireless(
 887                                 drv, ctx, ((char *) attr) + rta_len,
 888                                 attr->rta_len - rta_len);
 889                 } else if (attr->rta_type == IFLA_IFNAME) {
 890                         wpa_driver_nl80211_event_link(
 891                                 drv, ctx,
 892                                 ((char *) attr) + rta_len,
 893                                 attr->rta_len - rta_len, 0);
 894                 }
 895                 attr = RTA_NEXT(attr, attrlen);
 896         }
 897 }
 898
 899
 900 static void wpa_driver_nl80211_event_rtm_dellink(struct wpa_driver_nl80211_data *drv,
 901                                               void *ctx, struct nlmsghdr *h,
 902                                               size_t len)
 903 {
 904         struct ifinfomsg *ifi;
 905         int attrlen, _nlmsg_len, rta_len;
 906         struct rtattr * attr;
 907
 908         if (len < sizeof(*ifi))
 909                 return;
 910
 911         ifi = NLMSG_DATA(h);
 912
 913         _nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
 914
 915         attrlen = h->nlmsg_len - _nlmsg_len;
 916         if (attrlen < 0)
 917                 return;
 918
 919         attr = (struct rtattr *) (((char *) ifi) + _nlmsg_len);
 920
 921         rta_len = RTA_ALIGN(sizeof(struct rtattr));
 922         while (RTA_OK(attr, attrlen)) {
 923                 if (attr->rta_type == IFLA_IFNAME) {
 924                         wpa_driver_nl80211_event_link(
 925                                 drv, ctx,
 926                                 ((char *) attr) + rta_len,
 927                                 attr->rta_len - rta_len, 1);
 928                 }
 929                 attr = RTA_NEXT(attr, attrlen);
 930         }
 931 }
 932
 933
 934 static void wpa_driver_nl80211_event_receive_wext(int sock, void *eloop_ctx,
 935                                                   void *sock_ctx)
 936 {
 937         char buf[8192];
 938         int left;
 939         struct sockaddr_nl from;
 940         socklen_t fromlen;
 941         struct nlmsghdr *h;
 942         int max_events = 10;
 943
 944 try_again:
 945         fromlen = sizeof(from);
 946         left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
 947                         (struct sockaddr *) &from, &fromlen);
 948         if (left < 0) {
 949                 if (errno != EINTR && errno != EAGAIN)
 950                         perror("recvfrom(netlink)");
 951                 return;
 952         }
 953
 954         h = (struct nlmsghdr *) buf;
 955         while (left >= (int) sizeof(*h)) {
 956                 int len, plen;
 957
 958                 len = h->nlmsg_len;
 959                 plen = len - sizeof(*h);
 960                 if (len > left || plen < 0) {
 961                         wpa_printf(MSG_DEBUG, "Malformed netlink message: "
 962                                    "len=%d left=%d plen=%d",
 963                                    len, left, plen);
 964                         break;
 965                 }
 966
 967                 switch (h->nlmsg_type) {
 968                 case RTM_NEWLINK:
 969                         wpa_driver_nl80211_event_rtm_newlink(eloop_ctx, sock_ctx,
 970                                                           h, plen);
 971                         break;
 972                 case RTM_DELLINK:
 973                         wpa_driver_nl80211_event_rtm_dellink(eloop_ctx, sock_ctx,
 974                                                           h, plen);
 975                         break;
 976                 }
 977
 978                 len = NLMSG_ALIGN(len);
 979                 left -= len;
 980                 h = (struct nlmsghdr *) ((char *) h + len);
 981         }
 982
 983         if (left > 0) {
 984                 wpa_printf(MSG_DEBUG, "%d extra bytes in the end of netlink "
 985                            "message", left);
 986         }
 987
 988         if (--max_events > 0) {
 989                 /*
 990                  * Try to receive all events in one eloop call in order to
 991                  * limit race condition on cases where AssocInfo event, Assoc
 992                  * event, and EAPOL frames are received more or less at the
 993                  * same time. We want to process the event messages first
 994                  * before starting EAPOL processing.
 995                  */
 996                 goto try_again;
 997         }
 998 }
 999
1000
1001 static int no_seq_check(struct nl_msg *msg, void *arg)
1002 {
1003         return NL_OK;
1004 }
1005
1006
1007 static void mlme_event_auth(struct wpa_driver_nl80211_data *drv,
1008                             const u8 *frame, size_t len)
1009 {
1010         const struct ieee80211_mgmt *mgmt;
1011         union wpa_event_data event;
1012
1013         mgmt = (const struct ieee80211_mgmt *) frame;
1014         if (len < 24 + sizeof(mgmt->u.auth)) {
1015                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1016                            "frame");
1017                 return;
1018         }
1019
1020         os_memset(&event, 0, sizeof(event));
1021         os_memcpy(event.auth.peer, mgmt->sa, ETH_ALEN);
1022         event.auth.auth_type = le_to_host16(mgmt->u.auth.auth_alg);
1023         event.auth.status_code = le_to_host16(mgmt->u.auth.status_code);
1024         if (len > 24 + sizeof(mgmt->u.auth)) {
1025                 event.auth.ies = mgmt->u.auth.variable;
1026                 event.auth.ies_len = len - 24 - sizeof(mgmt->u.auth);
1027         }
1028
1029         wpa_supplicant_event(drv->ctx, EVENT_AUTH, &event);
1030 }
1031
1032
1033 static void mlme_event_assoc(struct wpa_driver_nl80211_data *drv,
1034                             const u8 *frame, size_t len)
1035 {
1036         const struct ieee80211_mgmt *mgmt;
1037         union wpa_event_data event;
1038         u16 status;
1039
1040         mgmt = (const struct ieee80211_mgmt *) frame;
1041         if (len < 24 + sizeof(mgmt->u.assoc_resp)) {
1042                 wpa_printf(MSG_DEBUG, "nl80211: Too short association event "
1043                            "frame");
1044                 return;
1045         }
1046
1047         status = le_to_host16(mgmt->u.assoc_resp.status_code);
1048         if (status != WLAN_STATUS_SUCCESS) {
1049                 wpa_printf(MSG_DEBUG, "nl80211: Association failed: status "
1050                            "code %d", status);
1051                 /* TODO: notify SME so that things like SA Query and comeback
1052                  * time can be implemented */
1053                 return;
1054         }
1055
1056         drv->associated = 1;
1057         os_memcpy(drv->bssid, mgmt->sa, ETH_ALEN);
1058
1059         os_memset(&event, 0, sizeof(event));
1060         if (len > 24 + sizeof(mgmt->u.assoc_resp)) {
1061                 event.assoc_info.resp_ies = (u8 *) mgmt->u.assoc_resp.variable;
1062                 event.assoc_info.resp_ies_len =
1063                         len - 24 - sizeof(mgmt->u.assoc_req);
1064         }
1065
1066         wpa_supplicant_event(drv->ctx, EVENT_ASSOC, &event);
1067 }
1068
1069
1070 static void mlme_event(struct wpa_driver_nl80211_data *drv,
1071                        enum nl80211_commands cmd, struct nlattr *frame)
1072 {
1073         if (frame == NULL) {
1074                 wpa_printf(MSG_DEBUG, "nl80211: MLME event %d without frame "
1075                            "data", cmd);
1076                 return;
1077         }
1078
1079         wpa_printf(MSG_DEBUG, "nl80211: MLME event %d", cmd);
1080         wpa_hexdump(MSG_MSGDUMP, "nl80211: MLME event frame",
1081                     nla_data(frame), nla_len(frame));
1082
1083         switch (cmd) {
1084         case NL80211_CMD_AUTHENTICATE:
1085                 mlme_event_auth(drv, nla_data(frame), nla_len(frame));
1086                 break;
1087         case NL80211_CMD_ASSOCIATE:
1088                 mlme_event_assoc(drv, nla_data(frame), nla_len(frame));
1089                 break;
1090         case NL80211_CMD_DEAUTHENTICATE:
1091                 drv->associated = 0;
1092                 wpa_supplicant_event(drv->ctx, EVENT_DEAUTH, NULL);
1093                 break;
1094         case NL80211_CMD_DISASSOCIATE:
1095                 drv->associated = 0;
1096                 wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
1097                 break;
1098         default:
1099                 break;
1100         }
1101 }
1102
1103
1104 static int process_event(struct nl_msg *msg, void *arg)
1105 {
1106         struct wpa_driver_nl80211_data *drv = arg;
1107         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1108         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1109
1110         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1111                   genlmsg_attrlen(gnlh, 0), NULL);
1112
1113         if (tb[NL80211_ATTR_IFINDEX]) {
1114                 int ifindex = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1115                 if (ifindex != drv->ifindex) {
1116                         wpa_printf(MSG_DEBUG, "nl80211: Ignored event (cmd=%d)"
1117                                    " for foreign interface (ifindex %d)",
1118                                    gnlh->cmd, ifindex);
1119                         return NL_SKIP;
1120                 }
1121         }
1122
1123         switch (gnlh->cmd) {
1124         case NL80211_CMD_NEW_SCAN_RESULTS:
1125                 wpa_printf(MSG_DEBUG, "nl80211: New scan results available");
1126                 drv->scan_complete_events = 1;
1127                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
1128                                      drv->ctx);
1129                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
1130                 break;
1131         case NL80211_CMD_SCAN_ABORTED:
1132                 wpa_printf(MSG_DEBUG, "nl80211: Scan aborted");
1133                 /*
1134                  * Need to indicate that scan results are available in order
1135                  * not to make wpa_supplicant stop its scanning.
1136                  */
1137                 eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv,
1138                                      drv->ctx);
1139                 wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS, NULL);
1140                 break;
1141         case NL80211_CMD_AUTHENTICATE:
1142         case NL80211_CMD_ASSOCIATE:
1143         case NL80211_CMD_DEAUTHENTICATE:
1144         case NL80211_CMD_DISASSOCIATE:
1145                 mlme_event(drv, gnlh->cmd, tb[NL80211_ATTR_FRAME]);
1146                 break;
1147         default:
1148                 wpa_printf(MSG_DEBUG, "nl80211: Ignored unknown event "
1149                            "(cmd=%d)", gnlh->cmd);
1150                 break;
1151         }
1152
1153         return NL_SKIP;
1154 }
1155
1156
1157 static void wpa_driver_nl80211_event_receive(int sock, void *eloop_ctx,
1158                                              void *sock_ctx)
1159 {
1160         struct nl_cb *cb;
1161         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1162
1163         wpa_printf(MSG_DEBUG, "nl80211: Event message available");
1164
1165         cb = nl_cb_clone(drv->nl_cb);
1166         if (!cb)
1167                 return;
1168         nl_cb_set(cb, NL_CB_SEQ_CHECK, NL_CB_CUSTOM, no_seq_check, NULL);
1169         nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, process_event, drv);
1170         nl_recvmsgs(drv->nl_handle, cb);
1171         nl_cb_put(cb);
1172 }
1173
1174
1175 static int wpa_driver_nl80211_get_ifflags_ifname(struct wpa_driver_nl80211_data *drv,
1176                                               const char *ifname, int *flags)
1177 {
1178         struct ifreq ifr;
1179
1180         os_memset(&ifr, 0, sizeof(ifr));
1181         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
1182         if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, (caddr_t) &ifr) < 0) {
1183                 perror("ioctl[SIOCGIFFLAGS]");
1184                 return -1;
1185         }
1186         *flags = ifr.ifr_flags & 0xffff;
1187         return 0;
1188 }
1189
1190
1191 /**
1192  * wpa_driver_nl80211_get_ifflags - Get interface flags (SIOCGIFFLAGS)
1193  * @drv: driver_nl80211 private data
1194  * @flags: Pointer to returned flags value
1195  * Returns: 0 on success, -1 on failure
1196  */
1197 static int wpa_driver_nl80211_get_ifflags(struct wpa_driver_nl80211_data *drv,
1198                                           int *flags)
1199 {
1200         return wpa_driver_nl80211_get_ifflags_ifname(drv, drv->ifname, flags);
1201 }
1202
1203
1204 static int wpa_driver_nl80211_set_ifflags_ifname(
1205         struct wpa_driver_nl80211_data *drv,
1206         const char *ifname, int flags)
1207 {
1208         struct ifreq ifr;
1209
1210         os_memset(&ifr, 0, sizeof(ifr));
1211         os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
1212         ifr.ifr_flags = flags & 0xffff;
1213         if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, (caddr_t) &ifr) < 0) {
1214                 perror("SIOCSIFFLAGS");
1215                 return -1;
1216         }
1217         return 0;
1218 }
1219
1220
1221 /**
1222  * wpa_driver_nl80211_set_ifflags - Set interface flags (SIOCSIFFLAGS)
1223  * @drv: driver_nl80211 private data
1224  * @flags: New value for flags
1225  * Returns: 0 on success, -1 on failure
1226  */
1227 static int wpa_driver_nl80211_set_ifflags(struct wpa_driver_nl80211_data *drv,
1228                                           int flags)
1229 {
1230         return wpa_driver_nl80211_set_ifflags_ifname(drv, drv->ifname, flags);
1231 }
1232
1233
1234 /**
1235  * wpa_driver_nl80211_set_country - ask nl80211 to set the regulatory domain
1236  * @priv: driver_nl80211 private data
1237  * @alpha2_arg: country to which to switch to
1238  * Returns: 0 on success, -1 on failure
1239  *
1240  * This asks nl80211 to set the regulatory domain for given
1241  * country ISO / IEC alpha2.
1242  */
1243 static int wpa_driver_nl80211_set_country(void *priv, const char *alpha2_arg)
1244 {
1245         struct wpa_driver_nl80211_data *drv = priv;
1246         char alpha2[3];
1247         struct nl_msg *msg;
1248
1249         msg = nlmsg_alloc();
1250         if (!msg)
1251                 goto nla_put_failure;
1252
1253         alpha2[0] = alpha2_arg[0];
1254         alpha2[1] = alpha2_arg[1];
1255         alpha2[2] = '\0';
1256
1257         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1258                     0, NL80211_CMD_REQ_SET_REG, 0);
1259
1260         NLA_PUT_STRING(msg, NL80211_ATTR_REG_ALPHA2, alpha2);
1261         if (send_and_recv_msgs(drv, msg, NULL, NULL))
1262                 return -EINVAL;
1263         return 0;
1264 nla_put_failure:
1265         return -EINVAL;
1266 }
1267
1268
1269 #ifdef CONFIG_CLIENT_MLME
1270
1271 static int nl80211_set_vif(struct wpa_driver_nl80211_data *drv,
1272                            int drop_unencrypted, int userspace_mlme)
1273 {
1274 #ifdef NL80211_CMD_SET_VIF
1275         struct nl_msg *msg;
1276         int ret = -1;
1277
1278         msg = nlmsg_alloc();
1279         if (!msg)
1280                 return -ENOMEM;
1281
1282         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1283                     NL80211_CMD_SET_VIF, 0);
1284
1285         if (drop_unencrypted >= 0)
1286                 NLA_PUT_U8(msg, NL80211_ATTR_VIF_DROP_UNENCRYPTED,
1287                            drop_unencrypted);
1288         if (userspace_mlme >= 0)
1289                 NLA_PUT_U8(msg, NL80211_ATTR_VIF_USERSPACE_MLME,
1290                            userspace_mlme);
1291
1292         ret = 0;
1293
1294         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1295
1296         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1297         return ret;
1298
1299 nla_put_failure:
1300         return -ENOBUFS;
1301 #else /* NL80211_CMD_SET_VIF */
1302         return -1;
1303 #endif /* NL80211_CMD_SET_VIF */
1304 }
1305
1306
1307 static int wpa_driver_nl80211_set_userspace_mlme(
1308         struct wpa_driver_nl80211_data *drv, int enabled)
1309 {
1310         return nl80211_set_vif(drv, -1, enabled);
1311 }
1312
1313
1314 static void nl80211_remove_iface(struct wpa_driver_nl80211_data *drv,
1315                                  int ifidx)
1316 {
1317         struct nl_msg *msg;
1318
1319         msg = nlmsg_alloc();
1320         if (!msg)
1321                 goto nla_put_failure;
1322
1323         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1324                     0, NL80211_CMD_DEL_INTERFACE, 0);
1325         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
1326         if (send_and_recv_msgs(drv, msg, NULL, NULL) == 0)
1327                 return;
1328 nla_put_failure:
1329         wpa_printf(MSG_ERROR, "nl80211: Failed to remove interface.");
1330 }
1331
1332
1333 static int nl80211_create_iface(struct wpa_driver_nl80211_data *drv,
1334                                 const char *ifname, enum nl80211_iftype iftype)
1335 {
1336         struct nl_msg *msg, *flags = NULL;
1337         int ifidx, err;
1338         int ret = -ENOBUFS;
1339
1340         msg = nlmsg_alloc();
1341         if (!msg)
1342                 return -1;
1343
1344         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1345                     0, NL80211_CMD_NEW_INTERFACE, 0);
1346         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->ifname));
1347         NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
1348         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
1349
1350         if (iftype == NL80211_IFTYPE_MONITOR) {
1351                 flags = nlmsg_alloc();
1352                 if (!flags)
1353                         goto nla_put_failure;
1354
1355                 NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
1356
1357                 err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
1358
1359                 nlmsg_free(flags);
1360
1361                 if (err)
1362                         goto nla_put_failure;
1363         }
1364
1365         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1366         if (ret) {
1367         nla_put_failure:
1368                 wpa_printf(MSG_ERROR, "nl80211: Failed to create interface %d",
1369                            ret);
1370                 return ret;
1371         }
1372
1373         ifidx = if_nametoindex(ifname);
1374         if (ifidx <= 0)
1375                 return -1;
1376
1377         return ifidx;
1378 }
1379
1380
1381 static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
1382 {
1383         struct wpa_driver_nl80211_data *drv = eloop_ctx;
1384         int len;
1385         unsigned char buf[3000];
1386         struct ieee80211_radiotap_iterator iter;
1387         int ret;
1388         int injected = 0, failed = 0, rxflags = 0;
1389         struct ieee80211_rx_status rx_status;
1390
1391         len = recv(sock, buf, sizeof(buf), 0);
1392         if (len < 0) {
1393                 perror("recv");
1394                 return;
1395         }
1396
1397         if (ieee80211_radiotap_iterator_init(&iter, (void *) buf, len)) {
1398                 wpa_printf(MSG_DEBUG, "nl80211: received invalid radiotap "
1399                            "frame");
1400                 return;
1401         }
1402
1403         os_memset(&rx_status, 0, sizeof(rx_status));
1404
1405         while (1) {
1406                 ret = ieee80211_radiotap_iterator_next(&iter);
1407                 if (ret == -ENOENT)
1408                         break;
1409                 if (ret) {
1410                         wpa_printf(MSG_DEBUG, "nl80211: received invalid "
1411                                    "radiotap frame (%d)", ret);
1412                         return;
1413                 }
1414                 switch (iter.this_arg_index) {
1415                 case IEEE80211_RADIOTAP_FLAGS:
1416                         if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
1417                                 len -= 4;
1418                         break;
1419                 case IEEE80211_RADIOTAP_RX_FLAGS:
1420                         rxflags = 1;
1421                         break;
1422                 case IEEE80211_RADIOTAP_TX_FLAGS:
1423                         injected = 1;
1424                         failed = le_to_host16((*(u16 *) iter.this_arg)) &
1425                                 IEEE80211_RADIOTAP_F_TX_FAIL;
1426                         break;
1427                 case IEEE80211_RADIOTAP_DATA_RETRIES:
1428                         break;
1429                 case IEEE80211_RADIOTAP_CHANNEL:
1430                         /* TODO convert from freq/flags to channel number
1431                          * rx_status.channel = XXX;
1432                         */
1433                         break;
1434                 case IEEE80211_RADIOTAP_RATE:
1435                         break;
1436                 case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
1437                         rx_status.ssi = *iter.this_arg;
1438                         break;
1439                 }
1440         }
1441
1442         if (rxflags && injected)
1443                 return;
1444
1445         if (!injected) {
1446                 wpa_supplicant_sta_rx(drv->ctx, buf + iter.max_length,
1447                                       len - iter.max_length, &rx_status);
1448         } else if (failed) {
1449                 /* TX failure callback */
1450         } else {
1451                 /* TX success (ACK) callback */
1452         }
1453 }
1454
1455
1456 static int wpa_driver_nl80211_create_monitor_interface(
1457         struct wpa_driver_nl80211_data *drv)
1458 {
1459         char buf[IFNAMSIZ];
1460         struct sockaddr_ll ll;
1461         int optval, flags;
1462         socklen_t optlen;
1463
1464         os_snprintf(buf, IFNAMSIZ, "mon.%s", drv->ifname);
1465         buf[IFNAMSIZ - 1] = '\0';
1466
1467         drv->monitor_ifidx =
1468                 nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR);
1469
1470         if (drv->monitor_ifidx < 0)
1471                 return -1;
1472
1473         if (wpa_driver_nl80211_get_ifflags_ifname(drv, buf, &flags) != 0 ||
1474             wpa_driver_nl80211_set_ifflags_ifname(drv, buf, flags | IFF_UP) !=
1475             0) {
1476                 wpa_printf(MSG_ERROR, "nl80211: Could not set interface '%s' "
1477                            "UP", buf);
1478                 goto error;
1479         }
1480
1481         os_memset(&ll, 0, sizeof(ll));
1482         ll.sll_family = AF_PACKET;
1483         ll.sll_ifindex = drv->monitor_ifidx;
1484         drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1485         if (drv->monitor_sock < 0) {
1486                 perror("socket[PF_PACKET,SOCK_RAW]");
1487                 goto error;
1488         }
1489
1490         if (bind(drv->monitor_sock, (struct sockaddr *) &ll,
1491                  sizeof(ll)) < 0) {
1492                 perror("monitor socket bind");
1493                 goto error;
1494         }
1495
1496         optlen = sizeof(optval);
1497         optval = 20;
1498         if (setsockopt
1499             (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
1500                 perror("Failed to set socket priority");
1501                 goto error;
1502         }
1503
1504         if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
1505                                      drv, NULL)) {
1506                 wpa_printf(MSG_ERROR, "nl80211: Could not register monitor "
1507                            "read socket");
1508                 goto error;
1509         }
1510
1511         return 0;
1512
1513  error:
1514         nl80211_remove_iface(drv, drv->monitor_ifidx);
1515         return -1;
1516 }
1517
1518 #endif /* CONFIG_CLIENT_MLME */
1519
1520
1521 struct wiphy_info_data {
1522         int max_scan_ssids;
1523 };
1524
1525
1526 static int wiphy_info_handler(struct nl_msg *msg, void *arg)
1527 {
1528         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1529         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1530         struct wiphy_info_data *info = arg;
1531
1532         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1533                   genlmsg_attrlen(gnlh, 0), NULL);
1534
1535         if (tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS])
1536                 info->max_scan_ssids =
1537                         nla_get_u8(tb[NL80211_ATTR_MAX_NUM_SCAN_SSIDS]);
1538
1539         return NL_SKIP;
1540 }
1541
1542
1543 static int wpa_driver_nl80211_get_info(struct wpa_driver_nl80211_data *drv,
1544                                        struct wiphy_info_data *info)
1545 {
1546         struct nl_msg *msg;
1547
1548         os_memset(info, 0, sizeof(*info));
1549         msg = nlmsg_alloc();
1550         if (!msg)
1551                 return -1;
1552
1553         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1554                     0, NL80211_CMD_GET_WIPHY, 0);
1555
1556         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1557
1558         if (send_and_recv_msgs(drv, msg, wiphy_info_handler, info) == 0)
1559                 return 0;
1560         msg = NULL;
1561 nla_put_failure:
1562         nlmsg_free(msg);
1563         return -1;
1564 }
1565
1566
1567 static void wpa_driver_nl80211_capa(struct wpa_driver_nl80211_data *drv)
1568 {
1569         struct wiphy_info_data info;
1570         if (wpa_driver_nl80211_get_info(drv, &info))
1571                 return;
1572         drv->has_capability = 1;
1573         drv->capa.max_scan_ssids = info.max_scan_ssids;
1574 }
1575
1576
1577 /**
1578  * wpa_driver_nl80211_init - Initialize nl80211 driver interface
1579  * @ctx: context to be used when calling wpa_supplicant functions,
1580  * e.g., wpa_supplicant_event()
1581  * @ifname: interface name, e.g., wlan0
1582  * Returns: Pointer to private data, %NULL on failure
1583  */
1584 static void * wpa_driver_nl80211_init(void *ctx, const char *ifname)
1585 {
1586         int s, ret;
1587         struct sockaddr_nl local;
1588         struct wpa_driver_nl80211_data *drv;
1589
1590         drv = os_zalloc(sizeof(*drv));
1591         if (drv == NULL)
1592                 return NULL;
1593         drv->ctx = ctx;
1594         os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1595
1596         drv->nl_cb = nl_cb_alloc(NL_CB_DEFAULT);
1597         if (drv->nl_cb == NULL) {
1598                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1599                            "callbacks");
1600                 goto err1;
1601         }
1602
1603         drv->nl_handle = nl_handle_alloc_cb(drv->nl_cb);
1604         if (drv->nl_handle == NULL) {
1605                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate netlink "
1606                            "callbacks");
1607                 goto err2;
1608         }
1609
1610         if (genl_connect(drv->nl_handle)) {
1611                 wpa_printf(MSG_ERROR, "nl80211: Failed to connect to generic "
1612                            "netlink");
1613                 goto err3;
1614         }
1615
1616         drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
1617         if (drv->nl_cache == NULL) {
1618                 wpa_printf(MSG_ERROR, "nl80211: Failed to allocate generic "
1619                            "netlink cache");
1620                 goto err3;
1621         }
1622
1623         drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
1624         if (drv->nl80211 == NULL) {
1625                 wpa_printf(MSG_ERROR, "nl80211: 'nl80211' generic netlink not "
1626                            "found");
1627                 goto err4;
1628         }
1629
1630         ret = nl_get_multicast_id(drv, "nl80211", "scan");
1631         if (ret >= 0)
1632                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1633         if (ret < 0) {
1634                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1635                            "membership for scan events: %d (%s)",
1636                            ret, strerror(-ret));
1637                 goto err4;
1638         }
1639
1640         ret = nl_get_multicast_id(drv, "nl80211", "mlme");
1641         if (ret >= 0)
1642                 ret = nl_socket_add_membership(drv->nl_handle, ret);
1643 #ifdef WEXT_COMPAT
1644         if (ret < 0) {
1645                 wpa_printf(MSG_DEBUG, "nl80211: Could not add multicast "
1646                            "membership for mlme events: %d (%s)",
1647                            ret, strerror(-ret));
1648                 /* Use WEXT for association request */
1649         } else
1650                 drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1651 #else /* WEXT_COMPAT */
1652         if (ret < 0) {
1653                 wpa_printf(MSG_ERROR, "nl80211: Could not add multicast "
1654                            "membership for mlme events: %d (%s)",
1655                            ret, strerror(-ret));
1656                 goto err4;
1657         }
1658         drv->capa.flags |= WPA_DRIVER_FLAGS_SME;
1659 #endif /* WEXT_COMPAT */
1660
1661         eloop_register_read_sock(nl_socket_get_fd(drv->nl_handle),
1662                                  wpa_driver_nl80211_event_receive, drv, ctx);
1663
1664         drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1665         if (drv->ioctl_sock < 0) {
1666                 perror("socket(PF_INET,SOCK_DGRAM)");
1667                 goto err5;
1668         }
1669
1670         s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
1671         if (s < 0) {
1672                 perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
1673                 goto err6;
1674         }
1675
1676         os_memset(&local, 0, sizeof(local));
1677         local.nl_family = AF_NETLINK;
1678         local.nl_groups = RTMGRP_LINK;
1679         if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
1680                 perror("bind(netlink)");
1681                 close(s);
1682                 goto err6;
1683         }
1684
1685         eloop_register_read_sock(s, wpa_driver_nl80211_event_receive_wext, drv,
1686                                  ctx);
1687         drv->wext_event_sock = s;
1688
1689         if (wpa_driver_nl80211_finish_drv_init(drv))
1690                 goto err7;
1691
1692         return drv;
1693
1694 err7:
1695         eloop_unregister_read_sock(drv->wext_event_sock);
1696         close(drv->wext_event_sock);
1697 err6:
1698         close(drv->ioctl_sock);
1699 err5:
1700         genl_family_put(drv->nl80211);
1701 err4:
1702         nl_cache_free(drv->nl_cache);
1703 err3:
1704         nl_handle_destroy(drv->nl_handle);
1705 err2:
1706         nl_cb_put(drv->nl_cb);
1707 err1:
1708         os_free(drv);
1709         return NULL;
1710 }
1711
1712
1713 static int
1714 wpa_driver_nl80211_finish_drv_init(struct wpa_driver_nl80211_data *drv)
1715 {
1716         int flags;
1717
1718         if (wpa_driver_nl80211_get_ifflags(drv, &flags) != 0) {
1719                 wpa_printf(MSG_ERROR, "Could not get interface '%s' flags",
1720                            drv->ifname);
1721                 return -1;
1722         }
1723         if (!(flags & IFF_UP)) {
1724                 if (wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP) != 0) {
1725                         wpa_printf(MSG_ERROR, "Could not set interface '%s' "
1726                                    "UP", drv->ifname);
1727                         return -1;
1728                 }
1729         }
1730
1731         /*
1732          * Make sure that the driver does not have any obsolete PMKID entries.
1733          */
1734         wpa_driver_nl80211_flush_pmkid(drv);
1735
1736         if (wpa_driver_nl80211_set_mode(drv, 0) < 0) {
1737                 printf("Could not configure driver to use managed mode\n");
1738         }
1739
1740         wpa_driver_nl80211_get_range(drv);
1741
1742         drv->ifindex = if_nametoindex(drv->ifname);
1743
1744         wpa_driver_nl80211_capa(drv);
1745
1746         wpa_driver_nl80211_send_oper_ifla(drv, 1, IF_OPER_DORMANT);
1747
1748         return 0;
1749 }
1750
1751
1752 /**
1753  * wpa_driver_nl80211_deinit - Deinitialize nl80211 driver interface
1754  * @priv: Pointer to private nl80211 data from wpa_driver_nl80211_init()
1755  *
1756  * Shut down driver interface and processing of driver events. Free
1757  * private data buffer if one was allocated in wpa_driver_nl80211_init().
1758  */
1759 static void wpa_driver_nl80211_deinit(void *priv)
1760 {
1761         struct wpa_driver_nl80211_data *drv = priv;
1762         int flags;
1763
1764 #ifdef CONFIG_CLIENT_MLME
1765         if (drv->monitor_sock >= 0) {
1766                 eloop_unregister_read_sock(drv->monitor_sock);
1767                 close(drv->monitor_sock);
1768         }
1769         if (drv->monitor_ifidx > 0)
1770                 nl80211_remove_iface(drv, drv->monitor_ifidx);
1771         if (drv->capa.flags & WPA_DRIVER_FLAGS_USER_SPACE_MLME)
1772                 wpa_driver_nl80211_set_userspace_mlme(drv, 0);
1773 #endif /* CONFIG_CLIENT_MLME */
1774
1775         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1776
1777         /*
1778          * Clear possibly configured driver parameters in order to make it
1779          * easier to use the driver after wpa_supplicant has been terminated.
1780          */
1781         (void) wpa_driver_nl80211_set_bssid(drv,
1782                                          (u8 *) "\x00\x00\x00\x00\x00\x00");
1783
1784         wpa_driver_nl80211_send_oper_ifla(priv, 0, IF_OPER_UP);
1785
1786         eloop_unregister_read_sock(drv->wext_event_sock);
1787
1788         if (wpa_driver_nl80211_get_ifflags(drv, &flags) == 0)
1789                 (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
1790
1791         close(drv->wext_event_sock);
1792         close(drv->ioctl_sock);
1793 #ifdef WEXT_COMPAT
1794         os_free(drv->assoc_req_ies);
1795         os_free(drv->assoc_resp_ies);
1796 #endif /* WEXT_COMPAT */
1797
1798         eloop_unregister_read_sock(nl_socket_get_fd(drv->nl_handle));
1799         genl_family_put(drv->nl80211);
1800         nl_cache_free(drv->nl_cache);
1801         nl_handle_destroy(drv->nl_handle);
1802         nl_cb_put(drv->nl_cb);
1803
1804         os_free(drv);
1805 }
1806
1807
1808 /**
1809  * wpa_driver_nl80211_scan_timeout - Scan timeout to report scan completion
1810  * @eloop_ctx: Unused
1811  * @timeout_ctx: ctx argument given to wpa_driver_nl80211_init()
1812  *
1813  * This function can be used as registered timeout when starting a scan to
1814  * generate a scan completed event if the driver does not report this.
1815  */
1816 static void wpa_driver_nl80211_scan_timeout(void *eloop_ctx, void *timeout_ctx)
1817 {
1818         wpa_printf(MSG_DEBUG, "Scan timeout - try to get results");
1819         wpa_supplicant_event(timeout_ctx, EVENT_SCAN_RESULTS, NULL);
1820 }
1821
1822
1823 /**
1824  * wpa_driver_nl80211_scan - Request the driver to initiate scan
1825  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1826  * @params: Scan parameters
1827  * Returns: 0 on success, -1 on failure
1828  */
1829 static int wpa_driver_nl80211_scan(void *priv,
1830                                    struct wpa_driver_scan_params *params)
1831 {
1832         struct wpa_driver_nl80211_data *drv = priv;
1833         int ret = 0, timeout;
1834         struct nl_msg *msg, *ssids;
1835         size_t i;
1836
1837         msg = nlmsg_alloc();
1838         ssids = nlmsg_alloc();
1839         if (!msg || !ssids) {
1840                 nlmsg_free(msg);
1841                 nlmsg_free(ssids);
1842                 return -1;
1843         }
1844
1845         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
1846                     NL80211_CMD_TRIGGER_SCAN, 0);
1847
1848         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1849
1850         for (i = 0; i < params->num_ssids; i++) {
1851                 NLA_PUT(ssids, i + 1, params->ssids[i].ssid_len,
1852                         params->ssids[i].ssid);
1853         }
1854         if (params->num_ssids)
1855                 nla_put_nested(msg, NL80211_ATTR_SCAN_SSIDS, ssids);
1856
1857         if (params->extra_ies) {
1858                 NLA_PUT(msg, NL80211_ATTR_IE, params->extra_ies_len,
1859                         params->extra_ies);
1860         }
1861
1862         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
1863         msg = NULL;
1864         if (ret) {
1865                 wpa_printf(MSG_DEBUG, "nl80211: Scan trigger failed: ret=%d "
1866                            "(%s)", ret, strerror(-ret));
1867                 goto nla_put_failure;
1868         }
1869
1870         /* Not all drivers generate "scan completed" wireless event, so try to
1871          * read results after a timeout. */
1872         timeout = 10;
1873         if (drv->scan_complete_events) {
1874                 /*
1875                  * The driver seems to deliver events to notify when scan is
1876                  * complete, so use longer timeout to avoid race conditions
1877                  * with scanning and following association request.
1878                  */
1879                 timeout = 30;
1880         }
1881         wpa_printf(MSG_DEBUG, "Scan requested (ret=%d) - scan timeout %d "
1882                    "seconds", ret, timeout);
1883         eloop_cancel_timeout(wpa_driver_nl80211_scan_timeout, drv, drv->ctx);
1884         eloop_register_timeout(timeout, 0, wpa_driver_nl80211_scan_timeout,
1885                                drv, drv->ctx);
1886
1887 nla_put_failure:
1888         nlmsg_free(ssids);
1889         nlmsg_free(msg);
1890         return ret;
1891 }
1892
1893
1894 static int bss_info_handler(struct nl_msg *msg, void *arg)
1895 {
1896         struct nlattr *tb[NL80211_ATTR_MAX + 1];
1897         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1898         struct nlattr *bss[NL80211_BSS_MAX + 1];
1899         static struct nla_policy bss_policy[NL80211_BSS_MAX + 1] = {
1900                 [NL80211_BSS_BSSID] = { .type = NLA_UNSPEC },
1901                 [NL80211_BSS_FREQUENCY] = { .type = NLA_U32 },
1902                 [NL80211_BSS_TSF] = { .type = NLA_U64 },
1903                 [NL80211_BSS_BEACON_INTERVAL] = { .type = NLA_U16 },
1904                 [NL80211_BSS_CAPABILITY] = { .type = NLA_U16 },
1905                 [NL80211_BSS_INFORMATION_ELEMENTS] = { .type = NLA_UNSPEC },
1906                 [NL80211_BSS_SIGNAL_MBM] = { .type = NLA_U32 },
1907                 [NL80211_BSS_SIGNAL_UNSPEC] = { .type = NLA_U8 },
1908         };
1909         struct wpa_scan_results *res = arg;
1910         struct wpa_scan_res **tmp;
1911         struct wpa_scan_res *r;
1912         const u8 *ie;
1913         size_t ie_len;
1914
1915         nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1916                   genlmsg_attrlen(gnlh, 0), NULL);
1917         if (!tb[NL80211_ATTR_BSS])
1918                 return NL_SKIP;
1919         if (nla_parse_nested(bss, NL80211_BSS_MAX, tb[NL80211_ATTR_BSS],
1920                              bss_policy))
1921                 return NL_SKIP;
1922         if (bss[NL80211_BSS_INFORMATION_ELEMENTS]) {
1923                 ie = nla_data(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1924                 ie_len = nla_len(bss[NL80211_BSS_INFORMATION_ELEMENTS]);
1925         } else {
1926                 ie = NULL;
1927                 ie_len = 0;
1928         }
1929
1930         r = os_zalloc(sizeof(*r) + ie_len);
1931         if (r == NULL)
1932                 return NL_SKIP;
1933         if (bss[NL80211_BSS_BSSID])
1934                 os_memcpy(r->bssid, nla_data(bss[NL80211_BSS_BSSID]),
1935                           ETH_ALEN);
1936         if (bss[NL80211_BSS_FREQUENCY])
1937                 r->freq = nla_get_u32(bss[NL80211_BSS_FREQUENCY]);
1938         if (bss[NL80211_BSS_BEACON_INTERVAL])
1939                 r->beacon_int = nla_get_u16(bss[NL80211_BSS_BEACON_INTERVAL]);
1940         if (bss[NL80211_BSS_CAPABILITY])
1941                 r->caps = nla_get_u16(bss[NL80211_BSS_CAPABILITY]);
1942         r->flags |= WPA_SCAN_NOISE_INVALID;
1943         if (bss[NL80211_BSS_SIGNAL_MBM]) {
1944                 r->level = nla_get_u32(bss[NL80211_BSS_SIGNAL_MBM]);
1945                 r->level /= 100; /* mBm to dBm */
1946                 r->flags |= WPA_SCAN_LEVEL_DBM | WPA_SCAN_QUAL_INVALID;
1947         } else if (bss[NL80211_BSS_SIGNAL_UNSPEC]) {
1948                 r->level = nla_get_u8(bss[NL80211_BSS_SIGNAL_UNSPEC]);
1949                 r->flags |= WPA_SCAN_LEVEL_INVALID;
1950         } else
1951                 r->flags |= WPA_SCAN_LEVEL_INVALID | WPA_SCAN_QUAL_INVALID;
1952         if (bss[NL80211_BSS_TSF])
1953                 r->tsf = nla_get_u64(bss[NL80211_BSS_TSF]);
1954         r->ie_len = ie_len;
1955         if (ie)
1956                 os_memcpy(r + 1, ie, ie_len);
1957
1958         tmp = os_realloc(res->res,
1959                          (res->num + 1) * sizeof(struct wpa_scan_res *));
1960         if (tmp == NULL) {
1961                 os_free(r);
1962                 return NL_SKIP;
1963         }
1964         tmp[res->num++] = r;
1965         res->res = tmp;
1966
1967         return NL_SKIP;
1968 }
1969
1970
1971 /**
1972  * wpa_driver_nl80211_get_scan_results - Fetch the latest scan results
1973  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
1974  * Returns: Scan results on success, -1 on failure
1975  */
1976 static struct wpa_scan_results *
1977 wpa_driver_nl80211_get_scan_results(void *priv)
1978 {
1979         struct wpa_driver_nl80211_data *drv = priv;
1980         struct nl_msg *msg;
1981         struct wpa_scan_results *res;
1982         int ret;
1983
1984         res = os_zalloc(sizeof(*res));
1985         if (res == NULL)
1986                 return 0;
1987         msg = nlmsg_alloc();
1988         if (!msg)
1989                 goto nla_put_failure;
1990
1991         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, NLM_F_DUMP,
1992                     NL80211_CMD_GET_SCAN, 0);
1993         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
1994
1995         ret = send_and_recv_msgs(drv, msg, bss_info_handler, res);
1996         msg = NULL;
1997         if (ret == 0) {
1998                 wpa_printf(MSG_DEBUG, "Received scan results (%lu BSSes)",
1999                            (unsigned long) res->num);
2000                 return res;
2001         }
2002         wpa_printf(MSG_DEBUG, "nl80211: Scan result fetch failed: ret=%d "
2003                    "(%s)", ret, strerror(-ret));
2004 nla_put_failure:
2005         nlmsg_free(msg);
2006         wpa_scan_results_free(res);
2007         return NULL;
2008 }
2009
2010
2011 static int wpa_driver_nl80211_get_range(void *priv)
2012 {
2013         struct wpa_driver_nl80211_data *drv = priv;
2014         struct iw_range *range;
2015         struct iwreq iwr;
2016         int minlen;
2017         size_t buflen;
2018
2019         /*
2020          * Use larger buffer than struct iw_range in order to allow the
2021          * structure to grow in the future.
2022          */
2023         buflen = sizeof(struct iw_range) + 500;
2024         range = os_zalloc(buflen);
2025         if (range == NULL)
2026                 return -1;
2027
2028         os_memset(&iwr, 0, sizeof(iwr));
2029         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
2030         iwr.u.data.pointer = (caddr_t) range;
2031         iwr.u.data.length = buflen;
2032
2033         minlen = ((char *) &range->enc_capa) - (char *) range +
2034                 sizeof(range->enc_capa);
2035
2036         if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
2037                 perror("ioctl[SIOCGIWRANGE]");
2038                 os_free(range);
2039                 return -1;
2040         } else if (iwr.u.data.length >= minlen &&
2041                    range->we_version_compiled >= 18) {
2042                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
2043                            "WE(source)=%d enc_capa=0x%x",
2044                            range->we_version_compiled,
2045                            range->we_version_source,
2046                            range->enc_capa);
2047                 drv->has_capability = 1;
2048                 drv->we_version_compiled = range->we_version_compiled;
2049                 if (range->enc_capa & IW_ENC_CAPA_WPA) {
2050                         drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA |
2051                                 WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
2052                 }
2053                 if (range->enc_capa & IW_ENC_CAPA_WPA2) {
2054                         drv->capa.key_mgmt |= WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
2055                                 WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
2056                 }
2057                 drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
2058                         WPA_DRIVER_CAPA_ENC_WEP104;
2059                 if (range->enc_capa & IW_ENC_CAPA_CIPHER_TKIP)
2060                         drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
2061                 if (range->enc_capa & IW_ENC_CAPA_CIPHER_CCMP)
2062                         drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
2063                 wpa_printf(MSG_DEBUG, "  capabilities: key_mgmt 0x%x enc 0x%x",
2064                            drv->capa.key_mgmt, drv->capa.enc);
2065         } else {
2066                 wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: too old (short) data - "
2067                            "assuming WPA is not supported");
2068         }
2069
2070         os_free(range);
2071         return 0;
2072 }
2073
2074
2075 #ifdef WEXT_COMPAT
2076 static int wpa_driver_nl80211_set_wpa(void *priv, int enabled)
2077 {
2078         struct wpa_driver_nl80211_data *drv = priv;
2079         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
2080                 return 0;
2081         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
2082
2083         return wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_WPA_ENABLED,
2084                                               enabled);
2085 }
2086 #endif /* WEXT_COMPAT */
2087
2088
2089 static int wpa_driver_nl80211_set_key(void *priv, wpa_alg alg,
2090                                       const u8 *addr, int key_idx,
2091                                       int set_tx, const u8 *seq,
2092                                       size_t seq_len,
2093                                       const u8 *key, size_t key_len)
2094 {
2095         struct wpa_driver_nl80211_data *drv = priv;
2096         int err;
2097         struct nl_msg *msg;
2098
2099         wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
2100                    "seq_len=%lu key_len=%lu",
2101                    __func__, alg, addr, key_idx, set_tx,
2102                    (unsigned long) seq_len, (unsigned long) key_len);
2103
2104         msg = nlmsg_alloc();
2105         if (msg == NULL)
2106                 return -1;
2107
2108         if (alg == WPA_ALG_NONE) {
2109                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2110                             NL80211_CMD_DEL_KEY, 0);
2111         } else {
2112                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2113                             NL80211_CMD_NEW_KEY, 0);
2114                 NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
2115                 switch (alg) {
2116                 case WPA_ALG_WEP:
2117                         if (key_len == 5)
2118                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2119                                             0x000FAC01);
2120                         else
2121                                 NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
2122                                             0x000FAC05);
2123                         break;
2124                 case WPA_ALG_TKIP:
2125                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
2126                         break;
2127                 case WPA_ALG_CCMP:
2128                         NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
2129                         break;
2130                 default:
2131                         nlmsg_free(msg);
2132                         return -1;
2133                 }
2134         }
2135
2136         if (addr && os_memcmp(addr, "\xff\xff\xff\xff\xff\xff", ETH_ALEN) != 0)
2137         {
2138                 wpa_printf(MSG_DEBUG, "   addr=" MACSTR, MAC2STR(addr));
2139                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
2140         }
2141         NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
2142         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2143
2144         err = send_and_recv_msgs(drv, msg, NULL, NULL);
2145         if (err) {
2146                 wpa_printf(MSG_DEBUG, "nl80211: set_key failed; err=%d", err);
2147                 return -1;
2148         }
2149
2150         if (set_tx && alg != WPA_ALG_NONE) {
2151                 msg = nlmsg_alloc();
2152                 if (msg == NULL)
2153                         return -1;
2154
2155                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2156                             0, NL80211_CMD_SET_KEY, 0);
2157                 NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, key_idx);
2158                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2159                 NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
2160
2161                 err = send_and_recv_msgs(drv, msg, NULL, NULL);
2162                 if (err) {
2163                         wpa_printf(MSG_DEBUG, "nl80211: set default key "
2164                                    "failed; err=%d", err);
2165                         return -1;
2166                 }
2167         }
2168
2169         return 0;
2170
2171 nla_put_failure:
2172         return -ENOBUFS;
2173 }
2174
2175
2176 #ifdef WEXT_COMPAT
2177 static int wpa_driver_nl80211_set_countermeasures(void *priv,
2178                                                int enabled)
2179 {
2180         struct wpa_driver_nl80211_data *drv = priv;
2181         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
2182                 return 0;
2183         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
2184         return wpa_driver_nl80211_set_auth_param(drv,
2185                                               IW_AUTH_TKIP_COUNTERMEASURES,
2186                                               enabled);
2187 }
2188 #endif /* WEXT_COMPAT */
2189
2190
2191 static int wpa_driver_nl80211_set_drop_unencrypted(void *priv,
2192                                                 int enabled)
2193 {
2194         struct wpa_driver_nl80211_data *drv = priv;
2195         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
2196 #ifdef WEXT_COMPAT
2197         drv->use_crypt = enabled;
2198 #endif /* WEXT_COMPAT */
2199         return wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_DROP_UNENCRYPTED,
2200                                               enabled);
2201 }
2202
2203
2204 #ifdef WEXT_COMPAT
2205 static int wpa_driver_nl80211_mlme_wext(struct wpa_driver_nl80211_data *drv,
2206                                         const u8 *addr, int cmd,
2207                                         int reason_code)
2208 {
2209         struct iwreq iwr;
2210         struct iw_mlme mlme;
2211         int ret = 0;
2212
2213         os_memset(&iwr, 0, sizeof(iwr));
2214         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
2215         os_memset(&mlme, 0, sizeof(mlme));
2216         mlme.cmd = cmd;
2217         mlme.reason_code = reason_code;
2218         mlme.addr.sa_family = ARPHRD_ETHER;
2219         os_memcpy(mlme.addr.sa_data, addr, ETH_ALEN);
2220         iwr.u.data.pointer = (caddr_t) &mlme;
2221         iwr.u.data.length = sizeof(mlme);
2222
2223         if (ioctl(drv->ioctl_sock, SIOCSIWMLME, &iwr) < 0) {
2224                 perror("ioctl[SIOCSIWMLME]");
2225                 ret = -1;
2226         }
2227
2228         return ret;
2229 }
2230 #endif /* WEXT_COMPAT */
2231
2232
2233 static int wpa_driver_nl80211_mlme(struct wpa_driver_nl80211_data *drv,
2234                                    const u8 *addr, int cmd, u16 reason_code)
2235 {
2236         int ret = -1;
2237         struct nl_msg *msg;
2238
2239         msg = nlmsg_alloc();
2240         if (!msg)
2241                 return -1;
2242
2243         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0, cmd, 0);
2244
2245         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2246         NLA_PUT_U16(msg, NL80211_ATTR_REASON_CODE, reason_code);
2247         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
2248
2249         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2250         msg = NULL;
2251         if (ret) {
2252                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2253                            "(%s)", ret, strerror(-ret));
2254                 goto nla_put_failure;
2255         }
2256         ret = 0;
2257
2258 nla_put_failure:
2259         nlmsg_free(msg);
2260         return ret;
2261 }
2262
2263
2264 static int wpa_driver_nl80211_deauthenticate(void *priv, const u8 *addr,
2265                                              int reason_code)
2266 {
2267         struct wpa_driver_nl80211_data *drv = priv;
2268         wpa_printf(MSG_DEBUG, "%s", __func__);
2269 #ifdef WEXT_COMPAT
2270         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2271                 return wpa_driver_nl80211_mlme_wext(drv, addr, IW_MLME_DEAUTH,
2272                                                     reason_code);
2273 #endif /* WEXT_COMPAT */
2274
2275         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DEAUTHENTICATE,
2276                                        reason_code);
2277 }
2278
2279
2280 static int wpa_driver_nl80211_disassociate(void *priv, const u8 *addr,
2281                                            int reason_code)
2282 {
2283         struct wpa_driver_nl80211_data *drv = priv;
2284         wpa_printf(MSG_DEBUG, "%s", __func__);
2285 #ifdef WEXT_COMPAT
2286         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2287                 return wpa_driver_nl80211_mlme_wext(drv, addr,
2288                                                     IW_MLME_DISASSOC,
2289                                                     reason_code);
2290 #endif /* WEXT_COMPAT */
2291         return wpa_driver_nl80211_mlme(drv, addr, NL80211_CMD_DISASSOCIATE,
2292                                        reason_code);
2293 }
2294
2295
2296 #ifdef WEXT_COMPAT
2297 static int wpa_driver_nl80211_set_gen_ie(void *priv, const u8 *ie,
2298                                       size_t ie_len)
2299 {
2300         struct wpa_driver_nl80211_data *drv = priv;
2301         struct iwreq iwr;
2302         int ret = 0;
2303
2304         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
2305                 return 0;
2306         os_memset(&iwr, 0, sizeof(iwr));
2307         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
2308         iwr.u.data.pointer = (caddr_t) ie;
2309         iwr.u.data.length = ie_len;
2310
2311         if (ioctl(drv->ioctl_sock, SIOCSIWGENIE, &iwr) < 0) {
2312                 perror("ioctl[SIOCSIWGENIE]");
2313                 ret = -1;
2314         }
2315
2316         return ret;
2317 }
2318
2319
2320 static int wpa_driver_nl80211_cipher2wext(int cipher)
2321 {
2322         switch (cipher) {
2323         case CIPHER_NONE:
2324                 return IW_AUTH_CIPHER_NONE;
2325         case CIPHER_WEP40:
2326                 return IW_AUTH_CIPHER_WEP40;
2327         case CIPHER_TKIP:
2328                 return IW_AUTH_CIPHER_TKIP;
2329         case CIPHER_CCMP:
2330                 return IW_AUTH_CIPHER_CCMP;
2331         case CIPHER_WEP104:
2332                 return IW_AUTH_CIPHER_WEP104;
2333         default:
2334                 return 0;
2335         }
2336 }
2337
2338
2339 static int wpa_driver_nl80211_keymgmt2wext(int keymgmt)
2340 {
2341         switch (keymgmt) {
2342         case KEY_MGMT_802_1X:
2343         case KEY_MGMT_802_1X_NO_WPA:
2344                 return IW_AUTH_KEY_MGMT_802_1X;
2345         case KEY_MGMT_PSK:
2346                 return IW_AUTH_KEY_MGMT_PSK;
2347         default:
2348                 return 0;
2349         }
2350 }
2351
2352
2353 static int
2354 wpa_driver_nl80211_auth_alg_fallback(struct wpa_driver_nl80211_data *drv,
2355                                   struct wpa_driver_associate_params *params)
2356 {
2357         struct iwreq iwr;
2358         int ret = 0;
2359
2360         wpa_printf(MSG_DEBUG, "WEXT: Driver did not support "
2361                    "SIOCSIWAUTH for AUTH_ALG, trying SIOCSIWENCODE");
2362
2363         os_memset(&iwr, 0, sizeof(iwr));
2364         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
2365         /* Just changing mode, not actual keys */
2366         iwr.u.encoding.flags = 0;
2367         iwr.u.encoding.pointer = (caddr_t) NULL;
2368         iwr.u.encoding.length = 0;
2369
2370         /*
2371          * Note: IW_ENCODE_{OPEN,RESTRICTED} can be interpreted to mean two
2372          * different things. Here they are used to indicate Open System vs.
2373          * Shared Key authentication algorithm. However, some drivers may use
2374          * them to select between open/restricted WEP encrypted (open = allow
2375          * both unencrypted and encrypted frames; restricted = only allow
2376          * encrypted frames).
2377          */
2378
2379         if (!drv->use_crypt) {
2380                 iwr.u.encoding.flags |= IW_ENCODE_DISABLED;
2381         } else {
2382                 if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
2383                         iwr.u.encoding.flags |= IW_ENCODE_OPEN;
2384                 if (params->auth_alg & AUTH_ALG_SHARED_KEY)
2385                         iwr.u.encoding.flags |= IW_ENCODE_RESTRICTED;
2386         }
2387
2388         if (ioctl(drv->ioctl_sock, SIOCSIWENCODE, &iwr) < 0) {
2389                 perror("ioctl[SIOCSIWENCODE]");
2390                 ret = -1;
2391         }
2392
2393         return ret;
2394 }
2395
2396
2397 static int wpa_driver_nl80211_associate_wext(
2398         void *priv, struct wpa_driver_associate_params *params)
2399 {
2400         struct wpa_driver_nl80211_data *drv = priv;
2401         int ret = 0;
2402         int allow_unencrypted_eapol;
2403         int value;
2404
2405         wpa_printf(MSG_DEBUG, "%s", __FUNCTION__);
2406
2407         /*
2408          * If the driver did not support SIOCSIWAUTH, fallback to
2409          * SIOCSIWENCODE here.
2410          */
2411         if (drv->auth_alg_fallback &&
2412             wpa_driver_nl80211_auth_alg_fallback(drv, params) < 0)
2413                 ret = -1;
2414
2415         if (!params->bssid &&
2416             wpa_driver_nl80211_set_bssid(drv, NULL) < 0)
2417                 ret = -1;
2418
2419         /* TODO: should consider getting wpa version and cipher/key_mgmt suites
2420          * from configuration, not from here, where only the selected suite is
2421          * available */
2422         if (wpa_driver_nl80211_set_gen_ie(drv, params->wpa_ie, params->wpa_ie_len)
2423             < 0)
2424                 ret = -1;
2425         if (params->wpa_ie == NULL || params->wpa_ie_len == 0)
2426                 value = IW_AUTH_WPA_VERSION_DISABLED;
2427         else if (params->wpa_ie[0] == WLAN_EID_RSN)
2428                 value = IW_AUTH_WPA_VERSION_WPA2;
2429         else
2430                 value = IW_AUTH_WPA_VERSION_WPA;
2431         if (wpa_driver_nl80211_set_auth_param(drv,
2432                                            IW_AUTH_WPA_VERSION, value) < 0)
2433                 ret = -1;
2434         value = wpa_driver_nl80211_cipher2wext(params->pairwise_suite);
2435         if (wpa_driver_nl80211_set_auth_param(drv,
2436                                            IW_AUTH_CIPHER_PAIRWISE, value) < 0)
2437                 ret = -1;
2438         value = wpa_driver_nl80211_cipher2wext(params->group_suite);
2439         if (wpa_driver_nl80211_set_auth_param(drv,
2440                                            IW_AUTH_CIPHER_GROUP, value) < 0)
2441                 ret = -1;
2442         value = wpa_driver_nl80211_keymgmt2wext(params->key_mgmt_suite);
2443         if (wpa_driver_nl80211_set_auth_param(drv,
2444                                            IW_AUTH_KEY_MGMT, value) < 0)
2445                 ret = -1;
2446         value = params->key_mgmt_suite != KEY_MGMT_NONE ||
2447                 params->pairwise_suite != CIPHER_NONE ||
2448                 params->group_suite != CIPHER_NONE ||
2449                 params->wpa_ie_len;
2450         if (wpa_driver_nl80211_set_auth_param(drv,
2451                                            IW_AUTH_PRIVACY_INVOKED, value) < 0)
2452                 ret = -1;
2453
2454         /* Allow unencrypted EAPOL messages even if pairwise keys are set when
2455          * not using WPA. IEEE 802.1X specifies that these frames are not
2456          * encrypted, but WPA encrypts them when pairwise keys are in use. */
2457         if (params->key_mgmt_suite == KEY_MGMT_802_1X ||
2458             params->key_mgmt_suite == KEY_MGMT_PSK)
2459                 allow_unencrypted_eapol = 0;
2460         else
2461                 allow_unencrypted_eapol = 1;
2462
2463         if (wpa_driver_nl80211_set_auth_param(drv,
2464                                            IW_AUTH_RX_UNENCRYPTED_EAPOL,
2465                                            allow_unencrypted_eapol) < 0)
2466                 ret = -1;
2467         if (params->freq && wpa_driver_nl80211_set_freq(drv, params->freq) < 0)
2468                 ret = -1;
2469         if (wpa_driver_nl80211_set_ssid(drv, params->ssid, params->ssid_len) < 0)
2470                 ret = -1;
2471         if (params->bssid &&
2472             wpa_driver_nl80211_set_bssid(drv, params->bssid) < 0)
2473                 ret = -1;
2474
2475         return ret;
2476 }
2477
2478
2479 static int wpa_driver_nl80211_set_auth_alg(void *priv, int auth_alg)
2480 {
2481         struct wpa_driver_nl80211_data *drv = priv;
2482         int algs = 0, res;
2483
2484         if (drv->capa.flags & WPA_DRIVER_FLAGS_SME)
2485                 return 0;
2486
2487         if (auth_alg & AUTH_ALG_OPEN_SYSTEM)
2488                 algs |= IW_AUTH_ALG_OPEN_SYSTEM;
2489         if (auth_alg & AUTH_ALG_SHARED_KEY)
2490                 algs |= IW_AUTH_ALG_SHARED_KEY;
2491         if (auth_alg & AUTH_ALG_LEAP)
2492                 algs |= IW_AUTH_ALG_LEAP;
2493         if (algs == 0) {
2494                 /* at least one algorithm should be set */
2495                 algs = IW_AUTH_ALG_OPEN_SYSTEM;
2496         }
2497
2498         res = wpa_driver_nl80211_set_auth_param(drv, IW_AUTH_80211_AUTH_ALG,
2499                                              algs);
2500         drv->auth_alg_fallback = res == -2;
2501         return res;
2502 }
2503 #endif /* WEXT_COMPAT */
2504
2505
2506 static int wpa_driver_nl80211_authenticate(
2507         void *priv, struct wpa_driver_auth_params *params)
2508 {
2509         struct wpa_driver_nl80211_data *drv = priv;
2510         int ret = -1;
2511         struct nl_msg *msg;
2512         enum nl80211_auth_type type;
2513
2514         drv->associated = 0;
2515
2516         msg = nlmsg_alloc();
2517         if (!msg)
2518                 return -1;
2519
2520         wpa_printf(MSG_DEBUG, "nl80211: Authenticate (ifindex=%d)",
2521                    drv->ifindex);
2522         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2523                     NL80211_CMD_AUTHENTICATE, 0);
2524
2525         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2526         if (params->bssid) {
2527                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2528                            MAC2STR(params->bssid));
2529                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
2530         }
2531         if (params->freq) {
2532                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2533                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2534         }
2535         if (params->ssid) {
2536                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2537                                   params->ssid, params->ssid_len);
2538                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
2539                         params->ssid);
2540         }
2541         wpa_hexdump(MSG_DEBUG, "  * IEs", params->ie, params->ie_len);
2542         if (params->ie)
2543                 NLA_PUT(msg, NL80211_ATTR_IE, params->ie_len, params->ie);
2544         /*
2545          * TODO: if multiple auth_alg options enabled, try them one by one if
2546          * the AP rejects authentication due to unknown auth alg
2547          */
2548         if (params->auth_alg & AUTH_ALG_OPEN_SYSTEM)
2549                 type = NL80211_AUTHTYPE_OPEN_SYSTEM;
2550         else if (params->auth_alg & AUTH_ALG_SHARED_KEY)
2551                 type = NL80211_AUTHTYPE_SHARED_KEY;
2552         else if (params->auth_alg & AUTH_ALG_LEAP)
2553                 type = NL80211_AUTHTYPE_NETWORK_EAP;
2554         else if (params->auth_alg & AUTH_ALG_FT)
2555                 type = NL80211_AUTHTYPE_FT;
2556         else
2557                 goto nla_put_failure;
2558         wpa_printf(MSG_DEBUG, "  * Auth Type %d", type);
2559         NLA_PUT_U32(msg, NL80211_ATTR_AUTH_TYPE, type);
2560
2561         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2562         msg = NULL;
2563         if (ret) {
2564                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2565                            "(%s)", ret, strerror(-ret));
2566                 goto nla_put_failure;
2567         }
2568         ret = 0;
2569         wpa_printf(MSG_DEBUG, "nl80211: Authentication request send "
2570                    "successfully");
2571
2572 nla_put_failure:
2573         nlmsg_free(msg);
2574         return ret;
2575 }
2576
2577
2578 static int wpa_driver_nl80211_associate(
2579         void *priv, struct wpa_driver_associate_params *params)
2580 {
2581         struct wpa_driver_nl80211_data *drv = priv;
2582         int ret = -1;
2583         struct nl_msg *msg;
2584
2585 #ifdef WEXT_COMPAT
2586         if (!(drv->capa.flags & WPA_DRIVER_FLAGS_SME))
2587                 return wpa_driver_nl80211_associate_wext(drv, params);
2588 #endif /* WEXT_COMPAT */
2589
2590         drv->associated = 0;
2591
2592         msg = nlmsg_alloc();
2593         if (!msg)
2594                 return -1;
2595
2596         wpa_printf(MSG_DEBUG, "nl80211: Associate (ifindex=%d)",
2597                    drv->ifindex);
2598         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0, 0,
2599                     NL80211_CMD_ASSOCIATE, 0);
2600
2601         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2602         if (params->bssid) {
2603                 wpa_printf(MSG_DEBUG, "  * bssid=" MACSTR,
2604                            MAC2STR(params->bssid));
2605                 NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, params->bssid);
2606         }
2607         if (params->freq) {
2608                 wpa_printf(MSG_DEBUG, "  * freq=%d", params->freq);
2609                 NLA_PUT_U32(msg, NL80211_ATTR_WIPHY_FREQ, params->freq);
2610         }
2611         if (params->ssid) {
2612                 wpa_hexdump_ascii(MSG_DEBUG, "  * SSID",
2613                                   params->ssid, params->ssid_len);
2614                 NLA_PUT(msg, NL80211_ATTR_SSID, params->ssid_len,
2615                         params->ssid);
2616         }
2617         wpa_hexdump(MSG_DEBUG, "  * IEs", params->wpa_ie, params->wpa_ie_len);
2618         if (params->wpa_ie)
2619                 NLA_PUT(msg, NL80211_ATTR_IE, params->wpa_ie_len,
2620                         params->wpa_ie);
2621
2622         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2623         msg = NULL;
2624         if (ret) {
2625                 wpa_printf(MSG_DEBUG, "nl80211: MLME command failed: ret=%d "
2626                            "(%s)", ret, strerror(-ret));
2627                 goto nla_put_failure;
2628         }
2629         ret = 0;
2630         wpa_printf(MSG_DEBUG, "nl80211: Association request send "
2631                    "successfully");
2632
2633 nla_put_failure:
2634         nlmsg_free(msg);
2635         return ret;
2636 }
2637
2638
2639 /**
2640  * wpa_driver_nl80211_set_mode - Set wireless mode (infra/adhoc), SIOCSIWMODE
2641  * @priv: Pointer to private wext data from wpa_driver_nl80211_init()
2642  * @mode: 0 = infra/BSS (associate with an AP), 1 = adhoc/IBSS
2643  * Returns: 0 on success, -1 on failure
2644  */
2645 static int wpa_driver_nl80211_set_mode(void *priv, int mode)
2646 {
2647         struct wpa_driver_nl80211_data *drv = priv;
2648         int ret = -1, flags;
2649         struct nl_msg *msg;
2650
2651         msg = nlmsg_alloc();
2652         if (!msg)
2653                 return -1;
2654
2655         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2656                     0, NL80211_CMD_SET_INTERFACE, 0);
2657         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2658         NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE,
2659                     mode ? NL80211_IFTYPE_ADHOC : NL80211_IFTYPE_STATION);
2660
2661         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2662         if (!ret)
2663                 return 0;
2664         else
2665                 goto try_again;
2666
2667 nla_put_failure:
2668         wpa_printf(MSG_ERROR, "nl80211: Failed to set interface mode");
2669         return -1;
2670
2671 try_again:
2672         /* mac80211 doesn't allow mode changes while the device is up, so
2673          * take the device down, try to set the mode again, and bring the
2674          * device back up.
2675          */
2676         if (wpa_driver_nl80211_get_ifflags(drv, &flags) == 0) {
2677                 (void) wpa_driver_nl80211_set_ifflags(drv, flags & ~IFF_UP);
2678
2679                 /* Try to set the mode again while the interface is down */
2680                 msg = nlmsg_alloc();
2681                 if (!msg)
2682                         return -1;
2683
2684                 genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
2685                             0, NL80211_CMD_SET_INTERFACE, 0);
2686                 NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
2687                 NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE,
2688                             mode ? NL80211_IFTYPE_ADHOC :
2689                             NL80211_IFTYPE_STATION);
2690                 ret = send_and_recv_msgs(drv, msg, NULL, NULL);
2691                 if (ret) {
2692                         wpa_printf(MSG_ERROR, "Failed to set interface %s "
2693                                    "mode", drv->ifname);
2694                 }
2695
2696                 /* Ignore return value of get_ifflags to ensure that the device
2697                  * is always up like it was before this function was called.
2698                  */
2699                 (void) wpa_driver_nl80211_get_ifflags(drv, &flags);
2700                 (void) wpa_driver_nl80211_set_ifflags(drv, flags | IFF_UP);
2701         }
2702
2703         return ret;
2704 }
2705
2706
2707 static int wpa_driver_nl80211_pmksa(struct wpa_driver_nl80211_data *drv,
2708                                  u32 cmd, const u8 *bssid, const u8 *pmkid)
2709 {
2710         struct iwreq iwr;
2711         struct iw_pmksa pmksa;
2712         int ret = 0;
2713
2714         os_memset(&iwr, 0, sizeof(iwr));
2715         os_strlcpy(iwr.ifr_name, drv->ifname, IFNAMSIZ);
2716         os_memset(&pmksa, 0, sizeof(pmksa));
2717         pmksa.cmd = cmd;
2718         pmksa.bssid.sa_family = ARPHRD_ETHER;
2719         if (bssid)
2720                 os_memcpy(pmksa.bssid.sa_data, bssid, ETH_ALEN);
2721         if (pmkid)
2722                 os_memcpy(pmksa.pmkid, pmkid, IW_PMKID_LEN);
2723         iwr.u.data.pointer = (caddr_t) &pmksa;
2724         iwr.u.data.length = sizeof(pmksa);
2725
2726         if (ioctl(drv->ioctl_sock, SIOCSIWPMKSA, &iwr) < 0) {
2727                 if (errno != EOPNOTSUPP)
2728                         perror("ioctl[SIOCSIWPMKSA]");
2729                 ret = -1;
2730         }
2731
2732         return ret;
2733 }
2734
2735
2736 static int wpa_driver_nl80211_add_pmkid(void *priv, const u8 *bssid,
2737                                      const u8 *pmkid)
2738 {
2739         struct wpa_driver_nl80211_data *drv = priv;
2740         return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_ADD, bssid, pmkid);
2741 }
2742
2743
2744 static int wpa_driver_nl80211_remove_pmkid(void *priv, const u8 *bssid,
2745                                         const u8 *pmkid)
2746 {
2747         struct wpa_driver_nl80211_data *drv = priv;
2748         return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_REMOVE, bssid, pmkid);
2749 }
2750
2751
2752 static int wpa_driver_nl80211_flush_pmkid(void *priv)
2753 {
2754         struct wpa_driver_nl80211_data *drv = priv;
2755         return wpa_driver_nl80211_pmksa(drv, IW_PMKSA_FLUSH, NULL, NULL);
2756 }
2757
2758
2759 static int wpa_driver_nl80211_get_capa(void *priv,
2760                                        struct wpa_driver_capa *capa)
2761 {
2762         struct wpa_driver_nl80211_data *drv = priv;
2763         if (!drv->has_capability)
2764                 return -1;
2765         os_memcpy(capa, &drv->capa, sizeof(*capa));
2766         return 0;
2767 }
2768
2769
2770 static int wpa_driver_nl80211_set_operstate(void *priv, int state)
2771 {
2772         struct wpa_driver_nl80211_data *drv = priv;
2773
2774         wpa_printf(MSG_DEBUG, "%s: operstate %d->%d (%s)",
2775                    __func__, drv->operstate, state, state ? "UP" : "DORMANT");
2776         drv->operstate = state;
2777         return wpa_driver_nl80211_send_oper_ifla(
2778                 drv, -1, state ? IF_OPER_UP : IF_OPER_DORMANT);
2779 }
2780
2781
2782 #ifdef CONFIG_CLIENT_MLME
2783 static int wpa_driver_nl80211_open_mlme(struct wpa_driver_nl80211_data *drv)
2784 {
2785         if (wpa_driver_nl80211_set_userspace_mlme(drv, 1) < 0) {
2786                 wpa_printf(MSG_ERROR, "nl80211: Failed to enable userspace "
2787                            "MLME");
2788                 return -1;
2789         }
2790         if (wpa_driver_nl80211_create_monitor_interface(drv)) {
2791                 wpa_printf(MSG_ERROR, "nl80211: Failed to create monitor "
2792                            "interface");
2793                 return -1;
2794         }
2795         return 0;
2796 }
2797 #endif /* CONFIG_CLIENT_MLME */
2798
2799
2800 static int wpa_driver_nl80211_set_param(void *priv, const char *param)
2801 {
2802 #ifdef CONFIG_CLIENT_MLME
2803         struct wpa_driver_nl80211_data *drv = priv;
2804
2805         if (param == NULL)
2806                 return 0;
2807
2808         wpa_printf(MSG_DEBUG, "%s: param='%s'", __func__, param);
2809
2810         if (os_strstr(param, "use_mlme=1")) {
2811                 wpa_printf(MSG_DEBUG, "nl80211: Using user space MLME");
2812                 drv->capa.flags |= WPA_DRIVER_FLAGS_USER_SPACE_MLME;
2813
2814                 if (wpa_driver_nl80211_open_mlme(drv))
2815                         return -1;
2816         }
2817 #endif /* CONFIG_CLIENT_MLME */
2818
2819         return 0;
2820 }
2821
2822
2823 #ifdef CONFIG_CLIENT_MLME
2824
2825 struct phy_info_arg {
2826         u16 *num_modes;
2827         struct wpa_hw_modes *modes;
2828 };
2829
2830
2831 static int phy_info_handler(struct nl_msg *msg, void *arg)
2832 {
2833         struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
2834         struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
2835         struct phy_info_arg *phy_info = arg;
2836
2837         struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
2838
2839         struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
2840         static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1]
2841                 = {
2842                 [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
2843                 [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
2844                 [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
2845                 [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
2846                 [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
2847         };
2848
2849         struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
2850         static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
2851                 [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
2852                 [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] =
2853                 { .type = NLA_FLAG },
2854         };
2855
2856         struct nlattr *nl_band;
2857         struct nlattr *nl_freq;
2858         struct nlattr *nl_rate;
2859         int rem_band, rem_freq, rem_rate;
2860         struct wpa_hw_modes *mode;
2861         int idx, mode_is_set;
2862
2863         nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
2864                   genlmsg_attrlen(gnlh, 0), NULL);
2865
2866         if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
2867                 return NL_SKIP;
2868
2869         nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS],
2870                             rem_band) {
2871                 mode = os_realloc(phy_info->modes,
2872                                   (*phy_info->num_modes + 1) * sizeof(*mode));
2873                 if (!mode)
2874                         return NL_SKIP;
2875                 phy_info->modes = mode;
2876
2877                 mode_is_set = 0;
2878
2879                 mode = &phy_info->modes[*(phy_info->num_modes)];
2880                 os_memset(mode, 0, sizeof(*mode));
2881                 *(phy_info->num_modes) += 1;
2882
2883                 nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
2884                           nla_len(nl_band), NULL);
2885
2886                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS],
2887                                     rem_freq) {
2888                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
2889                                   nla_data(nl_freq), nla_len(nl_freq),
2890                                   freq_policy);
2891                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
2892                                 continue;
2893                         mode->num_channels++;
2894                 }
2895
2896                 mode->channels = os_zalloc(mode->num_channels *
2897                                            sizeof(struct wpa_channel_data));
2898                 if (!mode->channels)
2899                         return NL_SKIP;
2900
2901                 idx = 0;
2902
2903                 nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS],
2904                                     rem_freq) {
2905                         nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX,
2906                                   nla_data(nl_freq), nla_len(nl_freq),
2907                                   freq_policy);
2908                         if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
2909                                 continue;
2910
2911                         mode->channels[idx].freq = nla_get_u32(
2912                                 tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
2913                         mode->channels[idx].flag |= WPA_CHAN_W_SCAN |
2914                                 WPA_CHAN_W_ACTIVE_SCAN |
2915                                 WPA_CHAN_W_IBSS;
2916
2917                         if (!mode_is_set) {
2918                                 /* crude heuristic */
2919                                 if (mode->channels[idx].freq < 4000)
2920                                         mode->mode = WPA_MODE_IEEE80211B;
2921                                 else
2922                                         mode->mode = WPA_MODE_IEEE80211A;
2923                                 mode_is_set = 1;
2924                         }
2925
2926                         /* crude heuristic */
2927                         if (mode->channels[idx].freq < 4000) {
2928                                 if (mode->channels[idx].freq == 2848)
2929                                         mode->channels[idx].chan = 14;
2930                                 else
2931                                         mode->channels[idx].chan =
2932                                                 (mode->channels[idx].freq -
2933                                                  2407) / 5;
2934                         } else
2935                                 mode->channels[idx].chan =
2936                                         mode->channels[idx].freq / 5 - 1000;
2937
2938                         if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
2939                                 mode->channels[idx].flag &= ~WPA_CHAN_W_SCAN;
2940                         if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
2941                                 mode->channels[idx].flag &=
2942                                         ~WPA_CHAN_W_ACTIVE_SCAN;
2943                         if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
2944                                 mode->channels[idx].flag &= ~WPA_CHAN_W_IBSS;
2945                         idx++;
2946                 }
2947
2948                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES],
2949                                     rem_rate) {
2950                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
2951                                   nla_data(nl_rate), nla_len(nl_rate),
2952                                   rate_policy);
2953                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
2954                                 continue;
2955                         mode->num_rates++;
2956                 }
2957
2958                 mode->rates = os_zalloc(mode->num_rates *
2959                                         sizeof(struct wpa_rate_data));
2960                 if (!mode->rates)
2961                         return NL_SKIP;
2962
2963                 idx = 0;
2964
2965                 nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES],
2966                                     rem_rate) {
2967                         nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX,
2968                                   nla_data(nl_rate), nla_len(nl_rate),
2969                                   rate_policy);
2970                         if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
2971                                 continue;
2972                         mode->rates[idx].rate = nla_get_u32(
2973                                 tb_rate[NL80211_BITRATE_ATTR_RATE]);
2974
2975                         /* crude heuristic */
2976                         if (mode->mode == WPA_MODE_IEEE80211B &&
2977                             mode->rates[idx].rate > 200)
2978                                 mode->mode = WPA_MODE_IEEE80211G;
2979
2980                         if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
2981                                 mode->rates[idx].flags |= WPA_RATE_PREAMBLE2;
2982
2983                         idx++;
2984                 }
2985         }
2986
2987         return NL_SKIP;
2988 }
2989
2990
2991 static struct wpa_hw_modes *
2992 wpa_driver_nl80211_get_hw_feature_data(void *priv, u16 *num_modes, u16 *flags)
2993 {
2994         struct wpa_driver_nl80211_data *drv = priv;
2995         struct nl_msg *msg;
2996         struct phy_info_arg result = {
2997                 .num_modes = num_modes,
2998                 .modes = NULL,
2999         };
3000
3001         *num_modes = 0;
3002         *flags = 0;
3003
3004         msg = nlmsg_alloc();
3005         if (!msg)
3006                 return NULL;
3007
3008         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3009                     0, NL80211_CMD_GET_WIPHY, 0);
3010
3011         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3012
3013         if (send_and_recv_msgs(drv, msg, phy_info_handler, &result) == 0)
3014                 return result.modes;
3015 nla_put_failure:
3016         return NULL;
3017 }
3018
3019
3020 static int wpa_driver_nl80211_set_channel(void *priv, wpa_hw_mode phymode,
3021                                           int chan, int freq)
3022 {
3023         return wpa_driver_nl80211_set_freq(priv, freq);
3024 }
3025
3026
3027 static int wpa_driver_nl80211_send_mlme(void *priv, const u8 *data,
3028                                         size_t data_len)
3029 {
3030         struct wpa_driver_nl80211_data *drv = priv;
3031         __u8 rtap_hdr[] = {
3032                 0x00, 0x00, /* radiotap version */
3033                 0x0e, 0x00, /* radiotap length */
3034                 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
3035                 0x0c,       /* F_WEP | F_FRAG (encrypt/fragment if required) */
3036                 0x00,       /* padding */
3037                 0x00, 0x00, /* RX and TX flags to indicate that */
3038                 0x00, 0x00, /* this is the injected frame directly */
3039         };
3040         struct iovec iov[2] = {
3041                 {
3042                         .iov_base = &rtap_hdr,
3043                         .iov_len = sizeof(rtap_hdr),
3044                 },
3045                 {
3046                         .iov_base = (void *) data,
3047                         .iov_len = data_len,
3048                 }
3049         };
3050         struct msghdr msg = {
3051                 .msg_name = NULL,
3052                 .msg_namelen = 0,
3053                 .msg_iov = iov,
3054                 .msg_iovlen = 2,
3055                 .msg_control = NULL,
3056                 .msg_controllen = 0,
3057                 .msg_flags = 0,
3058         };
3059
3060         if (sendmsg(drv->monitor_sock, &msg, 0) < 0) {
3061                 perror("send[MLME]");
3062                 return -1;
3063         }
3064
3065         return 0;
3066 }
3067
3068
3069 static int wpa_driver_nl80211_mlme_add_sta(void *priv, const u8 *addr,
3070                                            const u8 *supp_rates,
3071                                            size_t supp_rates_len)
3072 {
3073         struct wpa_driver_nl80211_data *drv = priv;
3074         struct nl_msg *msg;
3075         int ret = -1;
3076
3077         msg = nlmsg_alloc();
3078         if (!msg)
3079                 return -ENOMEM;
3080
3081         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3082                     0, NL80211_CMD_NEW_STATION, 0);
3083
3084         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3085         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3086         /* TODO: Get proper Association ID and listen interval */
3087         NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, 1);
3088         NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, supp_rates_len,
3089                 supp_rates);
3090         NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL, 1);
3091
3092         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3093         /* ignore EEXIST, this happens if a STA associates while associated */
3094         if (ret == -EEXIST || ret >= 0)
3095                 ret = 0;
3096
3097 nla_put_failure:
3098         return ret;
3099 }
3100
3101
3102 static int wpa_driver_nl80211_mlme_remove_sta(void *priv, const u8 *addr)
3103 {
3104         struct wpa_driver_nl80211_data *drv = priv;
3105         struct nl_msg *msg;
3106         int ret = -1;
3107
3108         msg = nlmsg_alloc();
3109         if (!msg)
3110                 return -ENOMEM;
3111
3112         genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
3113                     0, NL80211_CMD_DEL_STATION, 0);
3114
3115         NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, drv->ifindex);
3116         NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
3117
3118         ret = 0;
3119
3120         ret = send_and_recv_msgs(drv, msg, NULL, NULL);
3121         return ret;
3122
3123 nla_put_failure:
3124         return -ENOBUFS;
3125 }
3126
3127 #endif /* CONFIG_CLIENT_MLME */
3128
3129
3130 const struct wpa_driver_ops wpa_driver_nl80211_ops = {
3131         .name = "nl80211",
3132         .desc = "Linux nl80211/cfg80211",
3133         .get_bssid = wpa_driver_nl80211_get_bssid,
3134         .get_ssid = wpa_driver_nl80211_get_ssid,
3135         .set_key = wpa_driver_nl80211_set_key,
3136         .set_drop_unencrypted = wpa_driver_nl80211_set_drop_unencrypted,
3137         .scan2 = wpa_driver_nl80211_scan,
3138         .get_scan_results2 = wpa_driver_nl80211_get_scan_results,
3139         .deauthenticate = wpa_driver_nl80211_deauthenticate,
3140         .disassociate = wpa_driver_nl80211_disassociate,
3141         .set_mode = wpa_driver_nl80211_set_mode,
3142         .authenticate = wpa_driver_nl80211_authenticate,
3143         .associate = wpa_driver_nl80211_associate,
3144         .init = wpa_driver_nl80211_init,
3145         .deinit = wpa_driver_nl80211_deinit,
3146         .set_param = wpa_driver_nl80211_set_param,
3147         .add_pmkid = wpa_driver_nl80211_add_pmkid,
3148         .remove_pmkid = wpa_driver_nl80211_remove_pmkid,
3149         .flush_pmkid = wpa_driver_nl80211_flush_pmkid,
3150         .get_capa = wpa_driver_nl80211_get_capa,
3151         .set_operstate = wpa_driver_nl80211_set_operstate,
3152         .set_country = wpa_driver_nl80211_set_country,
3153 #ifdef CONFIG_CLIENT_MLME
3154         .get_hw_feature_data = wpa_driver_nl80211_get_hw_feature_data,
3155         .set_channel = wpa_driver_nl80211_set_channel,
3156         .set_ssid = wpa_driver_nl80211_set_ssid,
3157         .set_bssid = wpa_driver_nl80211_set_bssid,
3158         .send_mlme = wpa_driver_nl80211_send_mlme,
3159         .mlme_add_sta = wpa_driver_nl80211_mlme_add_sta,
3160         .mlme_remove_sta = wpa_driver_nl80211_mlme_remove_sta,
3161 #endif /* CONFIG_CLIENT_MLME */
3162 #ifdef WEXT_COMPAT
3163         .set_wpa = wpa_driver_nl80211_set_wpa,
3164         .set_countermeasures = wpa_driver_nl80211_set_countermeasures,
3165         .set_auth_alg = wpa_driver_nl80211_set_auth_alg,
3166 #endif /* WEXT_COMPAT */
3167 };