1 /*
2  * hostapd / IEEE 802.11 Management
3  * Copyright (c) 2002-2012, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "hostapd.h"
14 #include "sta_info.h"
15 #include "ap_config.h"
16 #include "ap_drv_ops.h"
17 #include "ieee802_11.h"
18 
19 
20 #ifdef CONFIG_IEEE80211W
21 
22 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
23 				     struct sta_info *sta, u8 *eid)
24 {
25 	u8 *pos = eid;
26 	u32 timeout, tu;
27 	struct os_reltime now, passed;
28 
29 	*pos++ = WLAN_EID_TIMEOUT_INTERVAL;
30 	*pos++ = 5;
31 	*pos++ = WLAN_TIMEOUT_ASSOC_COMEBACK;
32 	os_get_reltime(&now);
33 	os_reltime_sub(&now, &sta->sa_query_start, &passed);
34 	tu = (passed.sec * 1000000 + passed.usec) / 1024;
35 	if (hapd->conf->assoc_sa_query_max_timeout > tu)
36 		timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
37 	else
38 		timeout = 0;
39 	if (timeout < hapd->conf->assoc_sa_query_max_timeout)
40 		timeout++; /* add some extra time for local timers */
41 	WPA_PUT_LE32(pos, timeout);
42 	pos += 4;
43 
44 	return pos;
45 }
46 
47 
48 /* MLME-SAQuery.request */
49 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
50 				  const u8 *addr, const u8 *trans_id)
51 {
52 	struct ieee80211_mgmt mgmt;
53 	u8 *end;
54 
55 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
56 		   MACSTR, MAC2STR(addr));
57 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
58 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
59 
60 	os_memset(&mgmt, 0, sizeof(mgmt));
61 	mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
62 					  WLAN_FC_STYPE_ACTION);
63 	os_memcpy(mgmt.da, addr, ETH_ALEN);
64 	os_memcpy(mgmt.sa, hapd->own_addr, ETH_ALEN);
65 	os_memcpy(mgmt.bssid, hapd->own_addr, ETH_ALEN);
66 	mgmt.u.action.category = WLAN_ACTION_SA_QUERY;
67 	mgmt.u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
68 	os_memcpy(mgmt.u.action.u.sa_query_req.trans_id, trans_id,
69 		  WLAN_SA_QUERY_TR_ID_LEN);
70 	end = mgmt.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
71 	if (hostapd_drv_send_mlme(hapd, &mgmt, end - (u8 *) &mgmt, 0) < 0)
72 		wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
73 }
74 
75 
76 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
77 					  const u8 *sa, const u8 *trans_id)
78 {
79 	struct sta_info *sta;
80 	struct ieee80211_mgmt resp;
81 	u8 *end;
82 
83 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
84 		   MACSTR, MAC2STR(sa));
85 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
86 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
87 
88 	sta = ap_get_sta(hapd, sa);
89 	if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
90 		wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
91 			   "from unassociated STA " MACSTR, MAC2STR(sa));
92 		return;
93 	}
94 
95 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
96 		   MACSTR, MAC2STR(sa));
97 
98 	os_memset(&resp, 0, sizeof(resp));
99 	resp.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
100 					  WLAN_FC_STYPE_ACTION);
101 	os_memcpy(resp.da, sa, ETH_ALEN);
102 	os_memcpy(resp.sa, hapd->own_addr, ETH_ALEN);
103 	os_memcpy(resp.bssid, hapd->own_addr, ETH_ALEN);
104 	resp.u.action.category = WLAN_ACTION_SA_QUERY;
105 	resp.u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
106 	os_memcpy(resp.u.action.u.sa_query_req.trans_id, trans_id,
107 		  WLAN_SA_QUERY_TR_ID_LEN);
108 	end = resp.u.action.u.sa_query_req.trans_id + WLAN_SA_QUERY_TR_ID_LEN;
109 	if (hostapd_drv_send_mlme(hapd, &resp, end - (u8 *) &resp, 0) < 0)
110 		wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
111 }
112 
113 
114 void ieee802_11_sa_query_action(struct hostapd_data *hapd, const u8 *sa,
115 				const u8 action_type, const u8 *trans_id)
116 {
117 	struct sta_info *sta;
118 	int i;
119 
120 	if (action_type == WLAN_SA_QUERY_REQUEST) {
121 		ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
122 		return;
123 	}
124 
125 	if (action_type != WLAN_SA_QUERY_RESPONSE) {
126 		wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
127 			   "Action %d", action_type);
128 		return;
129 	}
130 
131 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
132 		   MACSTR, MAC2STR(sa));
133 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
134 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
135 
136 	/* MLME-SAQuery.confirm */
137 
138 	sta = ap_get_sta(hapd, sa);
139 	if (sta == NULL || sta->sa_query_trans_id == NULL) {
140 		wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
141 			   "pending SA Query request found");
142 		return;
143 	}
144 
145 	for (i = 0; i < sta->sa_query_count; i++) {
146 		if (os_memcmp(sta->sa_query_trans_id +
147 			      i * WLAN_SA_QUERY_TR_ID_LEN,
148 			      trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
149 			break;
150 	}
151 
152 	if (i >= sta->sa_query_count) {
153 		wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
154 			   "transaction identifier found");
155 		return;
156 	}
157 
158 	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
159 		       HOSTAPD_LEVEL_DEBUG,
160 		       "Reply to pending SA Query received");
161 	ap_sta_stop_sa_query(hapd, sta);
162 }
163 
164 #endif /* CONFIG_IEEE80211W */
165 
166 
167 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx)
168 {
169 	*pos = 0x00;
170 
171 	switch (idx) {
172 	case 0: /* Bits 0-7 */
173 		break;
174 	case 1: /* Bits 8-15 */
175 		break;
176 	case 2: /* Bits 16-23 */
177 		if (hapd->conf->wnm_sleep_mode)
178 			*pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
179 		if (hapd->conf->bss_transition)
180 			*pos |= 0x08; /* Bit 19 - BSS Transition */
181 		break;
182 	case 3: /* Bits 24-31 */
183 #ifdef CONFIG_WNM
184 		*pos |= 0x02; /* Bit 25 - SSID List */
185 #endif /* CONFIG_WNM */
186 		if (hapd->conf->time_advertisement == 2)
187 			*pos |= 0x08; /* Bit 27 - UTC TSF Offset */
188 		if (hapd->conf->interworking)
189 			*pos |= 0x80; /* Bit 31 - Interworking */
190 		break;
191 	case 4: /* Bits 32-39 */
192 		if (hapd->conf->qos_map_set_len)
193 			*pos |= 0x01; /* Bit 32 - QoS Map */
194 		if (hapd->conf->tdls & TDLS_PROHIBIT)
195 			*pos |= 0x40; /* Bit 38 - TDLS Prohibited */
196 		if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
197 			/* Bit 39 - TDLS Channel Switching Prohibited */
198 			*pos |= 0x80;
199 		}
200 		break;
201 	case 5: /* Bits 40-47 */
202 		break;
203 	case 6: /* Bits 48-55 */
204 		if (hapd->conf->ssid.utf8_ssid)
205 			*pos |= 0x01; /* Bit 48 - UTF-8 SSID */
206 		break;
207 	}
208 }
209 
210 
211 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid)
212 {
213 	u8 *pos = eid;
214 	u8 len = 0, i;
215 
216 	if (hapd->conf->tdls & (TDLS_PROHIBIT | TDLS_PROHIBIT_CHAN_SWITCH))
217 		len = 5;
218 	if (len < 4 && hapd->conf->interworking)
219 		len = 4;
220 	if (len < 3 && hapd->conf->wnm_sleep_mode)
221 		len = 3;
222 	if (len < 7 && hapd->conf->ssid.utf8_ssid)
223 		len = 7;
224 #ifdef CONFIG_WNM
225 	if (len < 4)
226 		len = 4;
227 #endif /* CONFIG_WNM */
228 	if (len < hapd->iface->extended_capa_len)
229 		len = hapd->iface->extended_capa_len;
230 	if (len == 0)
231 		return eid;
232 
233 	*pos++ = WLAN_EID_EXT_CAPAB;
234 	*pos++ = len;
235 	for (i = 0; i < len; i++, pos++) {
236 		hostapd_ext_capab_byte(hapd, pos, i);
237 
238 		if (i < hapd->iface->extended_capa_len) {
239 			*pos &= ~hapd->iface->extended_capa_mask[i];
240 			*pos |= hapd->iface->extended_capa[i];
241 		}
242 	}
243 
244 	while (len > 0 && eid[1 + len] == 0) {
245 		len--;
246 		eid[1] = len;
247 	}
248 	if (len == 0)
249 		return eid;
250 
251 	return eid + 2 + len;
252 }
253 
254 
255 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
256 {
257 	u8 *pos = eid;
258 	u8 len = hapd->conf->qos_map_set_len;
259 
260 	if (!len)
261 		return eid;
262 
263 	*pos++ = WLAN_EID_QOS_MAP_SET;
264 	*pos++ = len;
265 	os_memcpy(pos, hapd->conf->qos_map_set, len);
266 	pos += len;
267 
268 	return pos;
269 }
270 
271 
272 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
273 {
274 	u8 *pos = eid;
275 #ifdef CONFIG_INTERWORKING
276 	u8 *len;
277 
278 	if (!hapd->conf->interworking)
279 		return eid;
280 
281 	*pos++ = WLAN_EID_INTERWORKING;
282 	len = pos++;
283 
284 	*pos = hapd->conf->access_network_type;
285 	if (hapd->conf->internet)
286 		*pos |= INTERWORKING_ANO_INTERNET;
287 	if (hapd->conf->asra)
288 		*pos |= INTERWORKING_ANO_ASRA;
289 	if (hapd->conf->esr)
290 		*pos |= INTERWORKING_ANO_ESR;
291 	if (hapd->conf->uesa)
292 		*pos |= INTERWORKING_ANO_UESA;
293 	pos++;
294 
295 	if (hapd->conf->venue_info_set) {
296 		*pos++ = hapd->conf->venue_group;
297 		*pos++ = hapd->conf->venue_type;
298 	}
299 
300 	if (!is_zero_ether_addr(hapd->conf->hessid)) {
301 		os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
302 		pos += ETH_ALEN;
303 	}
304 
305 	*len = pos - len - 1;
306 #endif /* CONFIG_INTERWORKING */
307 
308 	return pos;
309 }
310 
311 
312 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
313 {
314 	u8 *pos = eid;
315 #ifdef CONFIG_INTERWORKING
316 
317 	/* TODO: Separate configuration for ANQP? */
318 	if (!hapd->conf->interworking)
319 		return eid;
320 
321 	*pos++ = WLAN_EID_ADV_PROTO;
322 	*pos++ = 2;
323 	*pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
324 	*pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
325 #endif /* CONFIG_INTERWORKING */
326 
327 	return pos;
328 }
329 
330 
331 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
332 {
333 	u8 *pos = eid;
334 #ifdef CONFIG_INTERWORKING
335 	u8 *len;
336 	unsigned int i, count;
337 
338 	if (!hapd->conf->interworking ||
339 	    hapd->conf->roaming_consortium == NULL ||
340 	    hapd->conf->roaming_consortium_count == 0)
341 		return eid;
342 
343 	*pos++ = WLAN_EID_ROAMING_CONSORTIUM;
344 	len = pos++;
345 
346 	/* Number of ANQP OIs (in addition to the max 3 listed here) */
347 	if (hapd->conf->roaming_consortium_count > 3 + 255)
348 		*pos++ = 255;
349 	else if (hapd->conf->roaming_consortium_count > 3)
350 		*pos++ = hapd->conf->roaming_consortium_count - 3;
351 	else
352 		*pos++ = 0;
353 
354 	/* OU #1 and #2 Lengths */
355 	*pos = hapd->conf->roaming_consortium[0].len;
356 	if (hapd->conf->roaming_consortium_count > 1)
357 		*pos |= hapd->conf->roaming_consortium[1].len << 4;
358 	pos++;
359 
360 	if (hapd->conf->roaming_consortium_count > 3)
361 		count = 3;
362 	else
363 		count = hapd->conf->roaming_consortium_count;
364 
365 	for (i = 0; i < count; i++) {
366 		os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
367 			  hapd->conf->roaming_consortium[i].len);
368 		pos += hapd->conf->roaming_consortium[i].len;
369 	}
370 
371 	*len = pos - len - 1;
372 #endif /* CONFIG_INTERWORKING */
373 
374 	return pos;
375 }
376 
377 
378 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
379 {
380 	if (hapd->conf->time_advertisement != 2)
381 		return eid;
382 
383 	if (hapd->time_adv == NULL &&
384 	    hostapd_update_time_adv(hapd) < 0)
385 		return eid;
386 
387 	if (hapd->time_adv == NULL)
388 		return eid;
389 
390 	os_memcpy(eid, wpabuf_head(hapd->time_adv),
391 		  wpabuf_len(hapd->time_adv));
392 	eid += wpabuf_len(hapd->time_adv);
393 
394 	return eid;
395 }
396 
397 
398 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
399 {
400 	size_t len;
401 
402 	if (hapd->conf->time_advertisement != 2)
403 		return eid;
404 
405 	len = os_strlen(hapd->conf->time_zone);
406 
407 	*eid++ = WLAN_EID_TIME_ZONE;
408 	*eid++ = len;
409 	os_memcpy(eid, hapd->conf->time_zone, len);
410 	eid += len;
411 
412 	return eid;
413 }
414 
415 
416 int hostapd_update_time_adv(struct hostapd_data *hapd)
417 {
418 	const int elen = 2 + 1 + 10 + 5 + 1;
419 	struct os_time t;
420 	struct os_tm tm;
421 	u8 *pos;
422 
423 	if (hapd->conf->time_advertisement != 2)
424 		return 0;
425 
426 	if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
427 		return -1;
428 
429 	if (!hapd->time_adv) {
430 		hapd->time_adv = wpabuf_alloc(elen);
431 		if (hapd->time_adv == NULL)
432 			return -1;
433 		pos = wpabuf_put(hapd->time_adv, elen);
434 	} else
435 		pos = wpabuf_mhead_u8(hapd->time_adv);
436 
437 	*pos++ = WLAN_EID_TIME_ADVERTISEMENT;
438 	*pos++ = 1 + 10 + 5 + 1;
439 
440 	*pos++ = 2; /* UTC time at which the TSF timer is 0 */
441 
442 	/* Time Value at TSF 0 */
443 	/* FIX: need to calculate this based on the current TSF value */
444 	WPA_PUT_LE16(pos, tm.year); /* Year */
445 	pos += 2;
446 	*pos++ = tm.month; /* Month */
447 	*pos++ = tm.day; /* Day of month */
448 	*pos++ = tm.hour; /* Hours */
449 	*pos++ = tm.min; /* Minutes */
450 	*pos++ = tm.sec; /* Seconds */
451 	WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
452 	pos += 2;
453 	*pos++ = 0; /* Reserved */
454 
455 	/* Time Error */
456 	/* TODO: fill in an estimate on the error */
457 	*pos++ = 0;
458 	*pos++ = 0;
459 	*pos++ = 0;
460 	*pos++ = 0;
461 	*pos++ = 0;
462 
463 	*pos++ = hapd->time_update_counter++;
464 
465 	return 0;
466 }
467 
468 
469 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid)
470 {
471 	u8 *pos = eid;
472 
473 #ifdef CONFIG_WNM
474 	if (hapd->conf->ap_max_inactivity > 0) {
475 		unsigned int val;
476 		*pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
477 		*pos++ = 3;
478 		val = hapd->conf->ap_max_inactivity;
479 		if (val > 68000)
480 			val = 68000;
481 		val *= 1000;
482 		val /= 1024;
483 		if (val == 0)
484 			val = 1;
485 		if (val > 65535)
486 			val = 65535;
487 		WPA_PUT_LE16(pos, val);
488 		pos += 2;
489 		*pos++ = 0x00; /* TODO: Protected Keep-Alive Required */
490 	}
491 #endif /* CONFIG_WNM */
492 
493 	return pos;
494 }
495