1 /*
2 * hostapd / IEEE 802.11 Management: Beacon and Probe Request/Response
3 * Copyright (c) 2002-2004, Instant802 Networks, Inc.
4 * Copyright (c) 2005-2006, Devicescape Software, Inc.
5 * Copyright (c) 2008-2012, Jouni Malinen <j@w1.fi>
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "utils/includes.h"
12
13 #ifndef CONFIG_NATIVE_WINDOWS
14
15 #include "utils/common.h"
16 #include "common/ieee802_11_defs.h"
17 #include "common/ieee802_11_common.h"
18 #include "common/hw_features_common.h"
19 #include "common/wpa_ctrl.h"
20 #include "crypto/sha1.h"
21 #include "wps/wps_defs.h"
22 #include "p2p/p2p.h"
23 #include "hostapd.h"
24 #include "ieee802_11.h"
25 #include "wpa_auth.h"
26 #include "wmm.h"
27 #include "ap_config.h"
28 #include "sta_info.h"
29 #include "p2p_hostapd.h"
30 #include "ap_drv_ops.h"
31 #include "beacon.h"
32 #include "hs20.h"
33 #include "dfs.h"
34 #include "taxonomy.h"
35 #include "ieee802_11_auth.h"
36
37
38 #ifdef NEED_AP_MLME
39
hostapd_eid_bss_load(struct hostapd_data * hapd,u8 * eid,size_t len)40 static u8 * hostapd_eid_bss_load(struct hostapd_data *hapd, u8 *eid, size_t len)
41 {
42 if (len < 2 + 5)
43 return eid;
44
45 #ifdef CONFIG_TESTING_OPTIONS
46 if (hapd->conf->bss_load_test_set) {
47 *eid++ = WLAN_EID_BSS_LOAD;
48 *eid++ = 5;
49 os_memcpy(eid, hapd->conf->bss_load_test, 5);
50 eid += 5;
51 return eid;
52 }
53 #endif /* CONFIG_TESTING_OPTIONS */
54 if (hapd->conf->bss_load_update_period) {
55 *eid++ = WLAN_EID_BSS_LOAD;
56 *eid++ = 5;
57 WPA_PUT_LE16(eid, hapd->num_sta);
58 eid += 2;
59 *eid++ = hapd->iface->channel_utilization;
60 WPA_PUT_LE16(eid, 0); /* no available admission capabity */
61 eid += 2;
62 }
63 return eid;
64 }
65
66
ieee802_11_erp_info(struct hostapd_data * hapd)67 static u8 ieee802_11_erp_info(struct hostapd_data *hapd)
68 {
69 u8 erp = 0;
70
71 if (hapd->iface->current_mode == NULL ||
72 hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
73 return 0;
74
75 if (hapd->iface->olbc)
76 erp |= ERP_INFO_USE_PROTECTION;
77 if (hapd->iface->num_sta_non_erp > 0) {
78 erp |= ERP_INFO_NON_ERP_PRESENT |
79 ERP_INFO_USE_PROTECTION;
80 }
81 if (hapd->iface->num_sta_no_short_preamble > 0 ||
82 hapd->iconf->preamble == LONG_PREAMBLE)
83 erp |= ERP_INFO_BARKER_PREAMBLE_MODE;
84
85 return erp;
86 }
87
88
hostapd_eid_ds_params(struct hostapd_data * hapd,u8 * eid)89 static u8 * hostapd_eid_ds_params(struct hostapd_data *hapd, u8 *eid)
90 {
91 enum hostapd_hw_mode hw_mode = hapd->iconf->hw_mode;
92
93 if (hw_mode != HOSTAPD_MODE_IEEE80211G &&
94 hw_mode != HOSTAPD_MODE_IEEE80211B)
95 return eid;
96
97 *eid++ = WLAN_EID_DS_PARAMS;
98 *eid++ = 1;
99 *eid++ = hapd->iconf->channel;
100 return eid;
101 }
102
103
hostapd_eid_erp_info(struct hostapd_data * hapd,u8 * eid)104 static u8 * hostapd_eid_erp_info(struct hostapd_data *hapd, u8 *eid)
105 {
106 if (hapd->iface->current_mode == NULL ||
107 hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211G)
108 return eid;
109
110 /* Set NonERP_present and use_protection bits if there
111 * are any associated NonERP stations. */
112 /* TODO: use_protection bit can be set to zero even if
113 * there are NonERP stations present. This optimization
114 * might be useful if NonERP stations are "quiet".
115 * See 802.11g/D6 E-1 for recommended practice.
116 * In addition, Non ERP present might be set, if AP detects Non ERP
117 * operation on other APs. */
118
119 /* Add ERP Information element */
120 *eid++ = WLAN_EID_ERP_INFO;
121 *eid++ = 1;
122 *eid++ = ieee802_11_erp_info(hapd);
123
124 return eid;
125 }
126
127
hostapd_eid_pwr_constraint(struct hostapd_data * hapd,u8 * eid)128 static u8 * hostapd_eid_pwr_constraint(struct hostapd_data *hapd, u8 *eid)
129 {
130 u8 *pos = eid;
131 u8 local_pwr_constraint = 0;
132 int dfs;
133
134 if (hapd->iface->current_mode == NULL ||
135 hapd->iface->current_mode->mode != HOSTAPD_MODE_IEEE80211A)
136 return eid;
137
138 /* Let host drivers add this IE if DFS support is offloaded */
139 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_DFS_OFFLOAD)
140 return eid;
141
142 /*
143 * There is no DFS support and power constraint was not directly
144 * requested by config option.
145 */
146 if (!hapd->iconf->ieee80211h &&
147 hapd->iconf->local_pwr_constraint == -1)
148 return eid;
149
150 /* Check if DFS is required by regulatory. */
151 dfs = hostapd_is_dfs_required(hapd->iface);
152 if (dfs < 0) {
153 wpa_printf(MSG_WARNING, "Failed to check if DFS is required; ret=%d",
154 dfs);
155 dfs = 0;
156 }
157
158 if (dfs == 0 && hapd->iconf->local_pwr_constraint == -1)
159 return eid;
160
161 /*
162 * ieee80211h (DFS) is enabled so Power Constraint element shall
163 * be added when running on DFS channel whenever local_pwr_constraint
164 * is configured or not. In order to meet regulations when TPC is not
165 * implemented using a transmit power that is below the legal maximum
166 * (including any mitigation factor) should help. In this case,
167 * indicate 3 dB below maximum allowed transmit power.
168 */
169 if (hapd->iconf->local_pwr_constraint == -1)
170 local_pwr_constraint = 3;
171
172 /*
173 * A STA that is not an AP shall use a transmit power less than or
174 * equal to the local maximum transmit power level for the channel.
175 * The local maximum transmit power can be calculated from the formula:
176 * local max TX pwr = max TX pwr - local pwr constraint
177 * Where max TX pwr is maximum transmit power level specified for
178 * channel in Country element and local pwr constraint is specified
179 * for channel in this Power Constraint element.
180 */
181
182 /* Element ID */
183 *pos++ = WLAN_EID_PWR_CONSTRAINT;
184 /* Length */
185 *pos++ = 1;
186 /* Local Power Constraint */
187 if (local_pwr_constraint)
188 *pos++ = local_pwr_constraint;
189 else
190 *pos++ = hapd->iconf->local_pwr_constraint;
191
192 return pos;
193 }
194
195
hostapd_eid_country_add(struct hostapd_data * hapd,u8 * pos,u8 * end,int chan_spacing,struct hostapd_channel_data * start,struct hostapd_channel_data * prev)196 static u8 * hostapd_eid_country_add(struct hostapd_data *hapd, u8 *pos,
197 u8 *end, int chan_spacing,
198 struct hostapd_channel_data *start,
199 struct hostapd_channel_data *prev)
200 {
201 if (end - pos < 3)
202 return pos;
203
204 /* first channel number */
205 *pos++ = start->chan;
206 /* number of channels */
207 *pos++ = (prev->chan - start->chan) / chan_spacing + 1;
208 /* maximum transmit power level */
209 if (!is_6ghz_op_class(hapd->iconf->op_class))
210 *pos++ = start->max_tx_power;
211 else
212 *pos++ = 0; /* Reserved when operating on the 6 GHz band */
213
214 return pos;
215 }
216
217
hostapd_fill_subband_triplets(struct hostapd_data * hapd,u8 * pos,u8 * end)218 static u8 * hostapd_fill_subband_triplets(struct hostapd_data *hapd, u8 *pos,
219 u8 *end)
220 {
221 int i;
222 struct hostapd_hw_modes *mode;
223 struct hostapd_channel_data *start, *prev;
224 int chan_spacing = 1;
225
226 mode = hapd->iface->current_mode;
227 if (mode->mode == HOSTAPD_MODE_IEEE80211A)
228 chan_spacing = 4;
229
230 start = prev = NULL;
231 for (i = 0; i < mode->num_channels; i++) {
232 struct hostapd_channel_data *chan = &mode->channels[i];
233 if (chan->flag & HOSTAPD_CHAN_DISABLED)
234 continue;
235 if (start && prev &&
236 prev->chan + chan_spacing == chan->chan &&
237 start->max_tx_power == chan->max_tx_power) {
238 prev = chan;
239 continue; /* can use same entry */
240 }
241
242 if (start && prev)
243 pos = hostapd_eid_country_add(hapd, pos, end,
244 chan_spacing,
245 start, prev);
246
247 /* Start new group */
248 start = prev = chan;
249 }
250
251 if (start) {
252 pos = hostapd_eid_country_add(hapd, pos, end, chan_spacing,
253 start, prev);
254 }
255
256 return pos;
257 }
258
259
hostapd_eid_country(struct hostapd_data * hapd,u8 * eid,int max_len)260 static u8 * hostapd_eid_country(struct hostapd_data *hapd, u8 *eid,
261 int max_len)
262 {
263 u8 *pos = eid;
264 u8 *end = eid + max_len;
265
266 if (!hapd->iconf->ieee80211d || max_len < 6 ||
267 hapd->iface->current_mode == NULL)
268 return eid;
269
270 *pos++ = WLAN_EID_COUNTRY;
271 pos++; /* length will be set later */
272 os_memcpy(pos, hapd->iconf->country, 3); /* e.g., 'US ' */
273 pos += 3;
274
275 if (is_6ghz_op_class(hapd->iconf->op_class)) {
276 /* Force the third octet of the country string to indicate
277 * Global Operating Class (Table E-4) */
278 eid[4] = 0x04;
279
280 /* Operating Triplet field */
281 /* Operating Extension Identifier (>= 201 to indicate this is
282 * not a Subband Triplet field) */
283 *pos++ = 201;
284 /* Operating Class */
285 *pos++ = hapd->iconf->op_class;
286 /* Coverage Class */
287 *pos++ = 0;
288 /* Subband Triplets are required only for the 20 MHz case */
289 if (hapd->iconf->op_class == 131 ||
290 hapd->iconf->op_class == 136)
291 pos = hostapd_fill_subband_triplets(hapd, pos, end);
292 } else {
293 pos = hostapd_fill_subband_triplets(hapd, pos, end);
294 }
295
296 if ((pos - eid) & 1) {
297 if (end - pos < 1)
298 return eid;
299 *pos++ = 0; /* pad for 16-bit alignment */
300 }
301
302 eid[1] = (pos - eid) - 2;
303
304 return pos;
305 }
306
307
hostapd_wpa_ie(struct hostapd_data * hapd,u8 eid)308 const u8 * hostapd_wpa_ie(struct hostapd_data *hapd, u8 eid)
309 {
310 const u8 *ies;
311 size_t ies_len;
312
313 ies = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ies_len);
314 if (!ies)
315 return NULL;
316
317 return get_ie(ies, ies_len, eid);
318 }
319
320
hostapd_vendor_wpa_ie(struct hostapd_data * hapd,u32 vendor_type)321 static const u8 * hostapd_vendor_wpa_ie(struct hostapd_data *hapd,
322 u32 vendor_type)
323 {
324 const u8 *ies;
325 size_t ies_len;
326
327 ies = wpa_auth_get_wpa_ie(hapd->wpa_auth, &ies_len);
328 if (!ies)
329 return NULL;
330
331 return get_vendor_ie(ies, ies_len, vendor_type);
332 }
333
334
hostapd_get_rsne(struct hostapd_data * hapd,u8 * pos,size_t len)335 static u8 * hostapd_get_rsne(struct hostapd_data *hapd, u8 *pos, size_t len)
336 {
337 const u8 *ie;
338
339 ie = hostapd_wpa_ie(hapd, WLAN_EID_RSN);
340 if (!ie || 2U + ie[1] > len)
341 return pos;
342
343 os_memcpy(pos, ie, 2 + ie[1]);
344 return pos + 2 + ie[1];
345 }
346
347
hostapd_get_mde(struct hostapd_data * hapd,u8 * pos,size_t len)348 static u8 * hostapd_get_mde(struct hostapd_data *hapd, u8 *pos, size_t len)
349 {
350 const u8 *ie;
351
352 ie = hostapd_wpa_ie(hapd, WLAN_EID_MOBILITY_DOMAIN);
353 if (!ie || 2U + ie[1] > len)
354 return pos;
355
356 os_memcpy(pos, ie, 2 + ie[1]);
357 return pos + 2 + ie[1];
358 }
359
360
hostapd_get_rsnxe(struct hostapd_data * hapd,u8 * pos,size_t len)361 static u8 * hostapd_get_rsnxe(struct hostapd_data *hapd, u8 *pos, size_t len)
362 {
363 const u8 *ie;
364
365 #ifdef CONFIG_TESTING_OPTIONS
366 if (hapd->conf->no_beacon_rsnxe) {
367 wpa_printf(MSG_INFO, "TESTING: Do not add RSNXE into Beacon");
368 return pos;
369 }
370 #endif /* CONFIG_TESTING_OPTIONS */
371 ie = hostapd_wpa_ie(hapd, WLAN_EID_RSNX);
372 if (!ie || 2U + ie[1] > len)
373 return pos;
374
375 os_memcpy(pos, ie, 2 + ie[1]);
376 return pos + 2 + ie[1];
377 }
378
379
hostapd_get_wpa_ie(struct hostapd_data * hapd,u8 * pos,size_t len)380 static u8 * hostapd_get_wpa_ie(struct hostapd_data *hapd, u8 *pos, size_t len)
381 {
382 const u8 *ie;
383
384 ie = hostapd_vendor_wpa_ie(hapd, WPA_IE_VENDOR_TYPE);
385 if (!ie || 2U + ie[1] > len)
386 return pos;
387
388 os_memcpy(pos, ie, 2 + ie[1]);
389 return pos + 2 + ie[1];
390 }
391
392
hostapd_get_osen_ie(struct hostapd_data * hapd,u8 * pos,size_t len)393 static u8 * hostapd_get_osen_ie(struct hostapd_data *hapd, u8 *pos, size_t len)
394 {
395 const u8 *ie;
396
397 ie = hostapd_vendor_wpa_ie(hapd, OSEN_IE_VENDOR_TYPE);
398 if (!ie || 2U + ie[1] > len)
399 return pos;
400
401 os_memcpy(pos, ie, 2 + ie[1]);
402 return pos + 2 + ie[1];
403 }
404
405
hostapd_eid_csa(struct hostapd_data * hapd,u8 * eid)406 static u8 * hostapd_eid_csa(struct hostapd_data *hapd, u8 *eid)
407 {
408 #ifdef CONFIG_TESTING_OPTIONS
409 if (hapd->iface->cs_oper_class && hapd->iconf->ecsa_ie_only)
410 return eid;
411 #endif /* CONFIG_TESTING_OPTIONS */
412
413 if (!hapd->cs_freq_params.channel)
414 return eid;
415
416 *eid++ = WLAN_EID_CHANNEL_SWITCH;
417 *eid++ = 3;
418 *eid++ = hapd->cs_block_tx;
419 *eid++ = hapd->cs_freq_params.channel;
420 *eid++ = hapd->cs_count;
421
422 return eid;
423 }
424
425
hostapd_eid_ecsa(struct hostapd_data * hapd,u8 * eid)426 static u8 * hostapd_eid_ecsa(struct hostapd_data *hapd, u8 *eid)
427 {
428 if (!hapd->cs_freq_params.channel || !hapd->iface->cs_oper_class)
429 return eid;
430
431 *eid++ = WLAN_EID_EXT_CHANSWITCH_ANN;
432 *eid++ = 4;
433 *eid++ = hapd->cs_block_tx;
434 *eid++ = hapd->iface->cs_oper_class;
435 *eid++ = hapd->cs_freq_params.channel;
436 *eid++ = hapd->cs_count;
437
438 return eid;
439 }
440
441
hostapd_eid_supported_op_classes(struct hostapd_data * hapd,u8 * eid)442 static u8 * hostapd_eid_supported_op_classes(struct hostapd_data *hapd, u8 *eid)
443 {
444 u8 op_class, channel;
445
446 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA) ||
447 !hapd->iface->freq)
448 return eid;
449
450 if (ieee80211_freq_to_channel_ext(hapd->iface->freq,
451 hapd->iconf->secondary_channel,
452 hostapd_get_oper_chwidth(hapd->iconf),
453 &op_class, &channel) ==
454 NUM_HOSTAPD_MODES)
455 return eid;
456
457 *eid++ = WLAN_EID_SUPPORTED_OPERATING_CLASSES;
458 *eid++ = 2;
459
460 /* Current Operating Class */
461 *eid++ = op_class;
462
463 /* TODO: Advertise all the supported operating classes */
464 *eid++ = 0;
465
466 return eid;
467 }
468
469
470 static int
ieee802_11_build_ap_params_mbssid(struct hostapd_data * hapd,struct wpa_driver_ap_params * params)471 ieee802_11_build_ap_params_mbssid(struct hostapd_data *hapd,
472 struct wpa_driver_ap_params *params)
473 {
474 struct hostapd_iface *iface = hapd->iface;
475 struct hostapd_data *tx_bss;
476 size_t len, rnr_len = 0;
477 u8 elem_count = 0, *elem = NULL, **elem_offset = NULL, *end;
478 u8 rnr_elem_count = 0, *rnr_elem = NULL, **rnr_elem_offset = NULL;
479 size_t i;
480
481 if (!iface->mbssid_max_interfaces ||
482 iface->num_bss > iface->mbssid_max_interfaces ||
483 (iface->conf->mbssid == ENHANCED_MBSSID_ENABLED &&
484 !iface->ema_max_periodicity))
485 goto fail;
486
487 /* Make sure bss->xrates_supported is set for all BSSs to know whether
488 * it need to be non-inherited. */
489 for (i = 0; i < iface->num_bss; i++) {
490 u8 buf[100];
491
492 hostapd_eid_ext_supp_rates(iface->bss[i], buf);
493 }
494
495 tx_bss = hostapd_mbssid_get_tx_bss(hapd);
496 len = hostapd_eid_mbssid_len(tx_bss, WLAN_FC_STYPE_BEACON, &elem_count,
497 NULL, 0, &rnr_len);
498 if (!len || (iface->conf->mbssid == ENHANCED_MBSSID_ENABLED &&
499 elem_count > iface->ema_max_periodicity))
500 goto fail;
501
502 elem = os_zalloc(len);
503 if (!elem)
504 goto fail;
505
506 elem_offset = os_zalloc(elem_count * sizeof(u8 *));
507 if (!elem_offset)
508 goto fail;
509
510 if (rnr_len) {
511 rnr_elem = os_zalloc(rnr_len);
512 if (!rnr_elem)
513 goto fail;
514
515 rnr_elem_offset = os_calloc(elem_count + 1, sizeof(u8 *));
516 if (!rnr_elem_offset)
517 goto fail;
518 }
519
520 end = hostapd_eid_mbssid(tx_bss, elem, elem + len, WLAN_FC_STYPE_BEACON,
521 elem_count, elem_offset, NULL, 0, rnr_elem,
522 &rnr_elem_count, rnr_elem_offset, rnr_len);
523
524 params->mbssid_tx_iface = tx_bss->conf->iface;
525 params->mbssid_index = hostapd_mbssid_get_bss_index(hapd);
526 params->mbssid_elem = elem;
527 params->mbssid_elem_len = end - elem;
528 params->mbssid_elem_count = elem_count;
529 params->mbssid_elem_offset = elem_offset;
530 params->rnr_elem = rnr_elem;
531 params->rnr_elem_len = rnr_len;
532 params->rnr_elem_count = rnr_elem_count;
533 params->rnr_elem_offset = rnr_elem_offset;
534 if (iface->conf->mbssid == ENHANCED_MBSSID_ENABLED)
535 params->ema = true;
536
537 return 0;
538
539 fail:
540 os_free(rnr_elem);
541 os_free(rnr_elem_offset);
542 os_free(elem_offset);
543 os_free(elem);
544 wpa_printf(MSG_ERROR, "MBSSID: Configuration failed");
545 return -1;
546 }
547
548
hostapd_eid_mbssid_config(struct hostapd_data * hapd,u8 * eid,u8 mbssid_elem_count)549 static u8 * hostapd_eid_mbssid_config(struct hostapd_data *hapd, u8 *eid,
550 u8 mbssid_elem_count)
551 {
552 struct hostapd_iface *iface = hapd->iface;
553
554 if (iface->conf->mbssid == ENHANCED_MBSSID_ENABLED) {
555 *eid++ = WLAN_EID_EXTENSION;
556 *eid++ = 3;
557 *eid++ = WLAN_EID_EXT_MULTIPLE_BSSID_CONFIGURATION;
558 *eid++ = iface->num_bss;
559 *eid++ = mbssid_elem_count;
560 }
561
562 return eid;
563 }
564
565
he_elem_len(struct hostapd_data * hapd)566 static size_t he_elem_len(struct hostapd_data *hapd)
567 {
568 size_t len = 0;
569
570 #ifdef CONFIG_IEEE80211AX
571 if (!hapd->iconf->ieee80211ax || hapd->conf->disable_11ax)
572 return len;
573
574 len += 3 + sizeof(struct ieee80211_he_capabilities) +
575 3 + sizeof(struct ieee80211_he_operation) +
576 3 + sizeof(struct ieee80211_he_mu_edca_parameter_set) +
577 3 + sizeof(struct ieee80211_spatial_reuse);
578 if (is_6ghz_op_class(hapd->iconf->op_class)) {
579 len += sizeof(struct ieee80211_he_6ghz_oper_info) +
580 3 + sizeof(struct ieee80211_he_6ghz_band_cap);
581 /* An additional Transmit Power Envelope element for
582 * subordinate client */
583 if (he_reg_is_indoor(hapd->iconf->he_6ghz_reg_pwr_type))
584 len += 4;
585
586 /* An additional Transmit Power Envelope element for
587 * default client with unit interpretation of regulatory
588 * client EIRP */
589 if (hapd->iconf->reg_def_cli_eirp != -1 &&
590 he_reg_is_sp(hapd->iconf->he_6ghz_reg_pwr_type))
591 len += 4;
592 }
593 #endif /* CONFIG_IEEE80211AX */
594
595 return len;
596 }
597
598
599 struct probe_resp_params {
600 const struct ieee80211_mgmt *req;
601 bool is_p2p;
602
603 /* Generated IEs will be included inside an ML element */
604 bool is_ml_sta_info;
605 struct hostapd_data *mld_ap;
606 struct mld_info *mld_info;
607
608 struct ieee80211_mgmt *resp;
609 size_t resp_len;
610 u8 *csa_pos;
611 u8 *ecsa_pos;
612 const u8 *known_bss;
613 u8 known_bss_len;
614
615 #ifdef CONFIG_IEEE80211AX
616 u8 *cca_pos;
617 #endif /* CONFIG_IEEE80211AX */
618 };
619
620
hostapd_free_probe_resp_params(struct probe_resp_params * params)621 static void hostapd_free_probe_resp_params(struct probe_resp_params *params)
622 {
623 #ifdef CONFIG_IEEE80211BE
624 if (!params)
625 return;
626 ap_sta_free_sta_profile(params->mld_info);
627 os_free(params->mld_info);
628 params->mld_info = NULL;
629 #endif /* CONFIG_IEEE80211BE */
630 }
631
632
hostapd_probe_resp_elems_len(struct hostapd_data * hapd,struct probe_resp_params * params)633 static size_t hostapd_probe_resp_elems_len(struct hostapd_data *hapd,
634 struct probe_resp_params *params)
635 {
636 size_t buflen = 0;
637
638 #ifdef CONFIG_WPS
639 if (hapd->wps_probe_resp_ie)
640 buflen += wpabuf_len(hapd->wps_probe_resp_ie);
641 #endif /* CONFIG_WPS */
642 #ifdef CONFIG_P2P
643 if (hapd->p2p_probe_resp_ie)
644 buflen += wpabuf_len(hapd->p2p_probe_resp_ie);
645 #endif /* CONFIG_P2P */
646 #ifdef CONFIG_FST
647 if (hapd->iface->fst_ies)
648 buflen += wpabuf_len(hapd->iface->fst_ies);
649 #endif /* CONFIG_FST */
650 if (hapd->conf->vendor_elements)
651 buflen += wpabuf_len(hapd->conf->vendor_elements);
652 #ifdef CONFIG_TESTING_OPTIONS
653 if (hapd->conf->presp_elements)
654 buflen += wpabuf_len(hapd->conf->presp_elements);
655 #endif /* CONFIG_TESTING_OPTIONS */
656 if (hapd->conf->vendor_vht) {
657 buflen += 5 + 2 + sizeof(struct ieee80211_vht_capabilities) +
658 2 + sizeof(struct ieee80211_vht_operation);
659 }
660
661 buflen += he_elem_len(hapd);
662
663 #ifdef CONFIG_IEEE80211BE
664 if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
665 buflen += hostapd_eid_eht_capab_len(hapd, IEEE80211_MODE_AP);
666 buflen += 3 + sizeof(struct ieee80211_eht_operation);
667 if (hapd->iconf->punct_bitmap)
668 buflen += EHT_OPER_DISABLED_SUBCHAN_BITMAP_SIZE;
669
670 if (!params->is_ml_sta_info && hapd->conf->mld_ap) {
671 struct hostapd_data *ml_elem_ap =
672 params->mld_ap ? params->mld_ap : hapd;
673
674 buflen += hostapd_eid_eht_ml_beacon_len(
675 ml_elem_ap, params->mld_info, !!params->mld_ap);
676 }
677 }
678 #endif /* CONFIG_IEEE80211BE */
679
680 buflen += hostapd_eid_mbssid_len(hapd, WLAN_FC_STYPE_PROBE_RESP, NULL,
681 params->known_bss,
682 params->known_bss_len, NULL);
683 if (!params->is_ml_sta_info)
684 buflen += hostapd_eid_rnr_len(hapd, WLAN_FC_STYPE_PROBE_RESP,
685 true);
686 buflen += hostapd_mbo_ie_len(hapd);
687 buflen += hostapd_eid_owe_trans_len(hapd);
688 buflen += hostapd_eid_dpp_cc_len(hapd);
689
690 return buflen;
691 }
692
693
hostapd_probe_resp_fill_elems(struct hostapd_data * hapd,struct probe_resp_params * params,u8 * pos,size_t len)694 static u8 * hostapd_probe_resp_fill_elems(struct hostapd_data *hapd,
695 struct probe_resp_params *params,
696 u8 *pos, size_t len)
697 {
698 u8 *csa_pos;
699 u8 *epos;
700
701 epos = pos + len;
702
703 if (!params->is_ml_sta_info) {
704 *pos++ = WLAN_EID_SSID;
705 *pos++ = hapd->conf->ssid.ssid_len;
706 os_memcpy(pos, hapd->conf->ssid.ssid,
707 hapd->conf->ssid.ssid_len);
708 pos += hapd->conf->ssid.ssid_len;
709 }
710
711 /* Supported rates */
712 pos = hostapd_eid_supp_rates(hapd, pos);
713
714 /* DS Params */
715 pos = hostapd_eid_ds_params(hapd, pos);
716
717 pos = hostapd_eid_country(hapd, pos, epos - pos);
718
719 /* Power Constraint element */
720 pos = hostapd_eid_pwr_constraint(hapd, pos);
721
722 /*
723 * CSA IE
724 * TODO: This should be included inside the ML sta profile
725 */
726 if (!params->is_ml_sta_info) {
727 csa_pos = hostapd_eid_csa(hapd, pos);
728 if (csa_pos != pos)
729 params->csa_pos = csa_pos - 1;
730 else
731 params->csa_pos = NULL;
732 pos = csa_pos;
733 }
734
735 /* ERP Information element */
736 pos = hostapd_eid_erp_info(hapd, pos);
737
738 /* Extended supported rates */
739 pos = hostapd_eid_ext_supp_rates(hapd, pos);
740
741 pos = hostapd_get_rsne(hapd, pos, epos - pos);
742 pos = hostapd_eid_bss_load(hapd, pos, epos - pos);
743 pos = hostapd_eid_mbssid(hapd, pos, epos, WLAN_FC_STYPE_PROBE_RESP, 0,
744 NULL, params->known_bss, params->known_bss_len,
745 NULL, NULL, NULL, 0);
746 pos = hostapd_eid_rm_enabled_capab(hapd, pos, epos - pos);
747 pos = hostapd_get_mde(hapd, pos, epos - pos);
748
749 /*
750 * eCSA IE
751 * TODO: This should be included inside the ML sta profile
752 */
753 if (!params->is_ml_sta_info) {
754 csa_pos = hostapd_eid_ecsa(hapd, pos);
755 if (csa_pos != pos)
756 params->ecsa_pos = csa_pos - 1;
757 else
758 params->ecsa_pos = NULL;
759 pos = csa_pos;
760 }
761
762 pos = hostapd_eid_supported_op_classes(hapd, pos);
763 pos = hostapd_eid_ht_capabilities(hapd, pos);
764 pos = hostapd_eid_ht_operation(hapd, pos);
765
766 /* Probe Response frames always include all non-TX profiles except
767 * when a list of known BSSes is included in the Probe Request frame. */
768 pos = hostapd_eid_ext_capab(hapd, pos,
769 hapd->iconf->mbssid >= MBSSID_ENABLED &&
770 !params->known_bss_len);
771
772 pos = hostapd_eid_time_adv(hapd, pos);
773 pos = hostapd_eid_time_zone(hapd, pos);
774
775 pos = hostapd_eid_interworking(hapd, pos);
776 pos = hostapd_eid_adv_proto(hapd, pos);
777 pos = hostapd_eid_roaming_consortium(hapd, pos);
778
779 #ifdef CONFIG_FST
780 if (hapd->iface->fst_ies) {
781 os_memcpy(pos, wpabuf_head(hapd->iface->fst_ies),
782 wpabuf_len(hapd->iface->fst_ies));
783 pos += wpabuf_len(hapd->iface->fst_ies);
784 }
785 #endif /* CONFIG_FST */
786
787 #ifdef CONFIG_IEEE80211AC
788 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac &&
789 !is_6ghz_op_class(hapd->iconf->op_class)) {
790 pos = hostapd_eid_vht_capabilities(hapd, pos, 0);
791 pos = hostapd_eid_vht_operation(hapd, pos);
792 pos = hostapd_eid_txpower_envelope(hapd, pos);
793 }
794 #endif /* CONFIG_IEEE80211AC */
795
796 #ifdef CONFIG_IEEE80211AX
797 if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
798 is_6ghz_op_class(hapd->iconf->op_class))
799 pos = hostapd_eid_txpower_envelope(hapd, pos);
800 #endif /* CONFIG_IEEE80211AX */
801
802 pos = hostapd_eid_wb_chsw_wrapper(hapd, pos);
803
804 if (!params->is_ml_sta_info)
805 pos = hostapd_eid_rnr(hapd, pos, WLAN_FC_STYPE_PROBE_RESP,
806 true);
807 pos = hostapd_eid_fils_indic(hapd, pos, 0);
808 pos = hostapd_get_rsnxe(hapd, pos, epos - pos);
809
810 #ifdef CONFIG_IEEE80211AX
811 if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
812 u8 *cca_pos;
813
814 pos = hostapd_eid_he_capab(hapd, pos, IEEE80211_MODE_AP);
815 pos = hostapd_eid_he_operation(hapd, pos);
816
817 /* BSS Color Change Announcement element */
818 cca_pos = hostapd_eid_cca(hapd, pos);
819 if (cca_pos != pos)
820 params->cca_pos = cca_pos - 2;
821 else
822 params->cca_pos = NULL;
823 pos = cca_pos;
824
825 pos = hostapd_eid_spatial_reuse(hapd, pos);
826 pos = hostapd_eid_he_mu_edca_parameter_set(hapd, pos);
827 pos = hostapd_eid_he_6ghz_band_cap(hapd, pos);
828 }
829 #endif /* CONFIG_IEEE80211AX */
830
831 #ifdef CONFIG_IEEE80211BE
832 if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
833 struct hostapd_data *ml_elem_ap =
834 params->mld_ap ? params->mld_ap : hapd;
835
836 if (ml_elem_ap->conf->mld_ap)
837 pos = hostapd_eid_eht_ml_beacon(
838 ml_elem_ap, params->mld_info,
839 pos, !!params->mld_ap);
840
841 pos = hostapd_eid_eht_capab(hapd, pos, IEEE80211_MODE_AP);
842 pos = hostapd_eid_eht_operation(hapd, pos);
843 }
844 #endif /* CONFIG_IEEE80211BE */
845
846 #ifdef CONFIG_IEEE80211AC
847 if (hapd->conf->vendor_vht)
848 pos = hostapd_eid_vendor_vht(hapd, pos);
849 #endif /* CONFIG_IEEE80211AC */
850
851 /* WPA / OSEN */
852 pos = hostapd_get_wpa_ie(hapd, pos, epos - pos);
853 pos = hostapd_get_osen_ie(hapd, pos, epos - pos);
854
855 /* Wi-Fi Alliance WMM */
856 pos = hostapd_eid_wmm(hapd, pos);
857
858 #ifdef CONFIG_WPS
859 if (hapd->conf->wps_state && hapd->wps_probe_resp_ie) {
860 os_memcpy(pos, wpabuf_head(hapd->wps_probe_resp_ie),
861 wpabuf_len(hapd->wps_probe_resp_ie));
862 pos += wpabuf_len(hapd->wps_probe_resp_ie);
863 }
864 #endif /* CONFIG_WPS */
865
866 #ifdef CONFIG_P2P
867 if ((hapd->conf->p2p & P2P_ENABLED) && params->is_p2p &&
868 hapd->p2p_probe_resp_ie) {
869 os_memcpy(pos, wpabuf_head(hapd->p2p_probe_resp_ie),
870 wpabuf_len(hapd->p2p_probe_resp_ie));
871 pos += wpabuf_len(hapd->p2p_probe_resp_ie);
872 }
873 #endif /* CONFIG_P2P */
874 #ifdef CONFIG_P2P_MANAGER
875 if ((hapd->conf->p2p & (P2P_MANAGE | P2P_ENABLED | P2P_GROUP_OWNER)) ==
876 P2P_MANAGE)
877 pos = hostapd_eid_p2p_manage(hapd, pos);
878 #endif /* CONFIG_P2P_MANAGER */
879
880 #ifdef CONFIG_HS20
881 pos = hostapd_eid_hs20_indication(hapd, pos);
882 #endif /* CONFIG_HS20 */
883
884 pos = hostapd_eid_mbo(hapd, pos, epos - pos);
885 pos = hostapd_eid_owe_trans(hapd, pos, epos - pos);
886 pos = hostapd_eid_dpp_cc(hapd, pos, epos - pos);
887
888 if (hapd->conf->vendor_elements) {
889 os_memcpy(pos, wpabuf_head(hapd->conf->vendor_elements),
890 wpabuf_len(hapd->conf->vendor_elements));
891 pos += wpabuf_len(hapd->conf->vendor_elements);
892 }
893
894 #ifdef CONFIG_TESTING_OPTIONS
895 if (hapd->conf->presp_elements) {
896 os_memcpy(pos, wpabuf_head(hapd->conf->presp_elements),
897 wpabuf_len(hapd->conf->presp_elements));
898 pos += wpabuf_len(hapd->conf->presp_elements);
899 }
900 #endif /* CONFIG_TESTING_OPTIONS */
901
902 return pos;
903 }
904
905
hostapd_gen_probe_resp(struct hostapd_data * hapd,struct probe_resp_params * params)906 static void hostapd_gen_probe_resp(struct hostapd_data *hapd,
907 struct probe_resp_params *params)
908 {
909 u8 *pos;
910 size_t buflen;
911
912 hapd = hostapd_mbssid_get_tx_bss(hapd);
913
914 #define MAX_PROBERESP_LEN 768
915 buflen = MAX_PROBERESP_LEN;
916 buflen += hostapd_probe_resp_elems_len(hapd, params);
917 params->resp = os_zalloc(buflen);
918 if (!params->resp) {
919 params->resp_len = 0;
920 return;
921 }
922
923 params->resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
924 WLAN_FC_STYPE_PROBE_RESP);
925 /* Unicast the response to all requests on bands other than 6 GHz. For
926 * the 6 GHz, unicast is used only if the actual SSID is not included in
927 * the Beacon frames. Otherwise, broadcast response is used per IEEE
928 * Std 802.11ax-2021, 26.17.2.3.2. Broadcast address is also used for
929 * the Probe Response frame template for the unsolicited (i.e., not as
930 * a response to a specific request) case. */
931 if (params->req && (!is_6ghz_op_class(hapd->iconf->op_class) ||
932 hapd->conf->ignore_broadcast_ssid))
933 os_memcpy(params->resp->da, params->req->sa, ETH_ALEN);
934 else
935 os_memset(params->resp->da, 0xff, ETH_ALEN);
936 os_memcpy(params->resp->sa, hapd->own_addr, ETH_ALEN);
937
938 os_memcpy(params->resp->bssid, hapd->own_addr, ETH_ALEN);
939 params->resp->u.probe_resp.beacon_int =
940 host_to_le16(hapd->iconf->beacon_int);
941
942 /* hardware or low-level driver will setup seq_ctrl and timestamp */
943 params->resp->u.probe_resp.capab_info =
944 host_to_le16(hostapd_own_capab_info(hapd));
945
946 pos = hostapd_probe_resp_fill_elems(hapd, params,
947 params->resp->u.probe_resp.variable,
948 buflen);
949
950 params->resp_len = pos - (u8 *) params->resp;
951 }
952
953
954 #ifdef CONFIG_IEEE80211BE
hostapd_fill_probe_resp_ml_params(struct hostapd_data * hapd,struct probe_resp_params * params,const struct ieee80211_mgmt * mgmt,int mld_id,u16 links)955 static void hostapd_fill_probe_resp_ml_params(struct hostapd_data *hapd,
956 struct probe_resp_params *params,
957 const struct ieee80211_mgmt *mgmt,
958 int mld_id, u16 links)
959 {
960 struct probe_resp_params sta_info_params;
961 struct hostapd_data *link;
962
963 params->mld_ap = NULL;
964 params->mld_info = os_zalloc(sizeof(*params->mld_info));
965 if (!params->mld_info)
966 return;
967
968 wpa_printf(MSG_DEBUG,
969 "MLD: Got ML probe request with AP MLD ID %d for links %04x",
970 mld_id, links);
971
972 for_each_mld_link(link, hapd) {
973 struct mld_link_info *link_info;
974 size_t buflen;
975 u8 mld_link_id = link->mld_link_id;
976 u8 *epos;
977 u8 buf[EHT_ML_MAX_STA_PROF_LEN];
978
979 /*
980 * Set mld_ap iff the ML probe request explicitly
981 * requested a specific MLD ID. In that case, the targeted
982 * AP may have been a nontransmitted BSSID on the same
983 * interface.
984 */
985 if (mld_id != -1 && link->iface == hapd->iface)
986 params->mld_ap = link;
987
988 /* Never duplicate main Probe Response frame body */
989 if (link == hapd)
990 continue;
991
992 /* Only include requested links */
993 if (!(BIT(mld_link_id) & links))
994 continue;
995
996 link_info = ¶ms->mld_info->links[mld_link_id];
997
998 sta_info_params.req = params->req;
999 sta_info_params.is_p2p = false;
1000 sta_info_params.is_ml_sta_info = true;
1001 sta_info_params.mld_ap = NULL;
1002 sta_info_params.mld_info = NULL;
1003
1004 buflen = MAX_PROBERESP_LEN;
1005 buflen += hostapd_probe_resp_elems_len(link, &sta_info_params);
1006
1007 if (buflen > EHT_ML_MAX_STA_PROF_LEN) {
1008 wpa_printf(MSG_DEBUG,
1009 "MLD: Not including link %d in ML probe response (%zu bytes is too long)",
1010 mld_link_id, buflen);
1011 goto fail;
1012 }
1013
1014 /*
1015 * NOTE: This does not properly handle inheritance and
1016 * various other things.
1017 */
1018 link_info->valid = true;
1019 epos = buf;
1020
1021 /* Capabilities is the only fixed parameter */
1022 WPA_PUT_LE16(epos, hostapd_own_capab_info(hapd));
1023 epos += 2;
1024
1025 epos = hostapd_probe_resp_fill_elems(
1026 link, &sta_info_params, epos,
1027 EHT_ML_MAX_STA_PROF_LEN - 2);
1028 link_info->resp_sta_profile_len = epos - buf;
1029 os_free(link_info->resp_sta_profile);
1030 link_info->resp_sta_profile = os_memdup(
1031 buf, link_info->resp_sta_profile_len);
1032 if (!link_info->resp_sta_profile)
1033 link_info->resp_sta_profile_len = 0;
1034 os_memcpy(link_info->local_addr, link->own_addr, ETH_ALEN);
1035
1036 wpa_printf(MSG_DEBUG,
1037 "MLD: ML probe response includes link sta info for %d: %u bytes (estimate %zu)",
1038 mld_link_id, link_info->resp_sta_profile_len,
1039 buflen);
1040 }
1041
1042 if (mld_id != -1 && !params->mld_ap) {
1043 wpa_printf(MSG_DEBUG,
1044 "MLD: No nontransmitted BSSID for MLD ID %d",
1045 mld_id);
1046 goto fail;
1047 }
1048
1049 return;
1050
1051 fail:
1052 hostapd_free_probe_resp_params(params);
1053 params->mld_ap = NULL;
1054 params->mld_info = NULL;
1055 }
1056 #endif /* CONFIG_IEEE80211BE */
1057
1058
1059 enum ssid_match_result {
1060 NO_SSID_MATCH,
1061 EXACT_SSID_MATCH,
1062 WILDCARD_SSID_MATCH,
1063 CO_LOCATED_SSID_MATCH,
1064 };
1065
ssid_match(struct hostapd_data * hapd,const u8 * ssid,size_t ssid_len,const u8 * ssid_list,size_t ssid_list_len,const u8 * short_ssid_list,size_t short_ssid_list_len)1066 static enum ssid_match_result ssid_match(struct hostapd_data *hapd,
1067 const u8 *ssid, size_t ssid_len,
1068 const u8 *ssid_list,
1069 size_t ssid_list_len,
1070 const u8 *short_ssid_list,
1071 size_t short_ssid_list_len)
1072 {
1073 const u8 *pos, *end;
1074 struct hostapd_iface *iface = hapd->iface;
1075 int wildcard = 0;
1076 size_t i, j;
1077
1078 if (ssid_len == 0)
1079 wildcard = 1;
1080 if (ssid_len == hapd->conf->ssid.ssid_len &&
1081 os_memcmp(ssid, hapd->conf->ssid.ssid, ssid_len) == 0)
1082 return EXACT_SSID_MATCH;
1083
1084 if (ssid_list) {
1085 pos = ssid_list;
1086 end = ssid_list + ssid_list_len;
1087 while (end - pos >= 2) {
1088 if (2 + pos[1] > end - pos)
1089 break;
1090 if (pos[1] == 0)
1091 wildcard = 1;
1092 if (pos[1] == hapd->conf->ssid.ssid_len &&
1093 os_memcmp(pos + 2, hapd->conf->ssid.ssid,
1094 pos[1]) == 0)
1095 return EXACT_SSID_MATCH;
1096 pos += 2 + pos[1];
1097 }
1098 }
1099
1100 if (short_ssid_list) {
1101 pos = short_ssid_list;
1102 end = short_ssid_list + short_ssid_list_len;
1103 while (end - pos >= 4) {
1104 if (hapd->conf->ssid.short_ssid == WPA_GET_LE32(pos))
1105 return EXACT_SSID_MATCH;
1106 pos += 4;
1107 }
1108 }
1109
1110 if (wildcard)
1111 return WILDCARD_SSID_MATCH;
1112
1113 if (!iface->interfaces || iface->interfaces->count <= 1 ||
1114 is_6ghz_op_class(hapd->iconf->op_class))
1115 return NO_SSID_MATCH;
1116
1117 for (i = 0; i < iface->interfaces->count; i++) {
1118 struct hostapd_iface *colocated;
1119
1120 colocated = iface->interfaces->iface[i];
1121
1122 if (colocated == iface ||
1123 !is_6ghz_op_class(colocated->conf->op_class))
1124 continue;
1125
1126 for (j = 0; j < colocated->num_bss; j++) {
1127 struct hostapd_bss_config *conf;
1128
1129 conf = colocated->bss[j]->conf;
1130 if (ssid_len == conf->ssid.ssid_len &&
1131 os_memcmp(ssid, conf->ssid.ssid, ssid_len) == 0)
1132 return CO_LOCATED_SSID_MATCH;
1133 }
1134 }
1135
1136 return NO_SSID_MATCH;
1137 }
1138
1139
sta_track_expire(struct hostapd_iface * iface,int force)1140 void sta_track_expire(struct hostapd_iface *iface, int force)
1141 {
1142 struct os_reltime now;
1143 struct hostapd_sta_info *info;
1144
1145 if (!iface->num_sta_seen)
1146 return;
1147
1148 os_get_reltime(&now);
1149 while ((info = dl_list_first(&iface->sta_seen, struct hostapd_sta_info,
1150 list))) {
1151 if (!force &&
1152 !os_reltime_expired(&now, &info->last_seen,
1153 iface->conf->track_sta_max_age))
1154 break;
1155 force = 0;
1156
1157 wpa_printf(MSG_MSGDUMP, "%s: Expire STA tracking entry for "
1158 MACSTR, iface->bss[0]->conf->iface,
1159 MAC2STR(info->addr));
1160 dl_list_del(&info->list);
1161 iface->num_sta_seen--;
1162 sta_track_del(info);
1163 }
1164 }
1165
1166
sta_track_get(struct hostapd_iface * iface,const u8 * addr)1167 static struct hostapd_sta_info * sta_track_get(struct hostapd_iface *iface,
1168 const u8 *addr)
1169 {
1170 struct hostapd_sta_info *info;
1171
1172 dl_list_for_each(info, &iface->sta_seen, struct hostapd_sta_info, list)
1173 if (ether_addr_equal(addr, info->addr))
1174 return info;
1175
1176 return NULL;
1177 }
1178
1179
sta_track_add(struct hostapd_iface * iface,const u8 * addr,int ssi_signal)1180 void sta_track_add(struct hostapd_iface *iface, const u8 *addr, int ssi_signal)
1181 {
1182 struct hostapd_sta_info *info;
1183
1184 info = sta_track_get(iface, addr);
1185 if (info) {
1186 /* Move the most recent entry to the end of the list */
1187 dl_list_del(&info->list);
1188 dl_list_add_tail(&iface->sta_seen, &info->list);
1189 os_get_reltime(&info->last_seen);
1190 info->ssi_signal = ssi_signal;
1191 return;
1192 }
1193
1194 /* Add a new entry */
1195 info = os_zalloc(sizeof(*info));
1196 if (info == NULL)
1197 return;
1198 os_memcpy(info->addr, addr, ETH_ALEN);
1199 os_get_reltime(&info->last_seen);
1200 info->ssi_signal = ssi_signal;
1201
1202 if (iface->num_sta_seen >= iface->conf->track_sta_max_num) {
1203 /* Expire oldest entry to make room for a new one */
1204 sta_track_expire(iface, 1);
1205 }
1206
1207 wpa_printf(MSG_MSGDUMP, "%s: Add STA tracking entry for "
1208 MACSTR, iface->bss[0]->conf->iface, MAC2STR(addr));
1209 dl_list_add_tail(&iface->sta_seen, &info->list);
1210 iface->num_sta_seen++;
1211 }
1212
1213
1214 struct hostapd_data *
sta_track_seen_on(struct hostapd_iface * iface,const u8 * addr,const char * ifname)1215 sta_track_seen_on(struct hostapd_iface *iface, const u8 *addr,
1216 const char *ifname)
1217 {
1218 struct hapd_interfaces *interfaces = iface->interfaces;
1219 size_t i, j;
1220
1221 for (i = 0; i < interfaces->count; i++) {
1222 struct hostapd_data *hapd = NULL;
1223
1224 iface = interfaces->iface[i];
1225 for (j = 0; j < iface->num_bss; j++) {
1226 hapd = iface->bss[j];
1227 if (os_strcmp(ifname, hapd->conf->iface) == 0)
1228 break;
1229 hapd = NULL;
1230 }
1231
1232 if (hapd && sta_track_get(iface, addr))
1233 return hapd;
1234 }
1235
1236 return NULL;
1237 }
1238
1239
1240 #ifdef CONFIG_TAXONOMY
sta_track_claim_taxonomy_info(struct hostapd_iface * iface,const u8 * addr,struct wpabuf ** probe_ie_taxonomy)1241 void sta_track_claim_taxonomy_info(struct hostapd_iface *iface, const u8 *addr,
1242 struct wpabuf **probe_ie_taxonomy)
1243 {
1244 struct hostapd_sta_info *info;
1245
1246 info = sta_track_get(iface, addr);
1247 if (!info)
1248 return;
1249
1250 wpabuf_free(*probe_ie_taxonomy);
1251 *probe_ie_taxonomy = info->probe_ie_taxonomy;
1252 info->probe_ie_taxonomy = NULL;
1253 }
1254 #endif /* CONFIG_TAXONOMY */
1255
1256
1257 #ifdef CONFIG_IEEE80211BE
parse_ml_probe_req(const struct ieee80211_eht_ml * ml,size_t ml_len,int * mld_id,u16 * links)1258 static bool parse_ml_probe_req(const struct ieee80211_eht_ml *ml, size_t ml_len,
1259 int *mld_id, u16 *links)
1260 {
1261 u16 ml_control;
1262 const struct element *sub;
1263 const u8 *pos;
1264 size_t len;
1265
1266 *mld_id = -1;
1267 *links = 0xffff;
1268
1269 if (ml_len < sizeof(struct ieee80211_eht_ml))
1270 return false;
1271
1272 ml_control = le_to_host16(ml->ml_control);
1273 if ((ml_control & MULTI_LINK_CONTROL_TYPE_MASK) !=
1274 MULTI_LINK_CONTROL_TYPE_PROBE_REQ) {
1275 wpa_printf(MSG_DEBUG, "MLD: Not an ML probe req");
1276 return false;
1277 }
1278
1279 if (sizeof(struct ieee80211_eht_ml) + 1 > ml_len) {
1280 wpa_printf(MSG_DEBUG, "MLD: ML probe req too short");
1281 return false;
1282 }
1283
1284 pos = ml->variable;
1285 len = pos[0];
1286 if (len < 1 || sizeof(struct ieee80211_eht_ml) + len > ml_len) {
1287 wpa_printf(MSG_DEBUG,
1288 "MLD: ML probe request with invalid length");
1289 return false;
1290 }
1291
1292 if (ml_control & EHT_ML_PRES_BM_PROBE_REQ_AP_MLD_ID) {
1293 if (len < 2) {
1294 wpa_printf(MSG_DEBUG,
1295 "MLD: ML probe req too short for MLD ID");
1296 return false;
1297 }
1298
1299 *mld_id = pos[1];
1300 }
1301 pos += len;
1302
1303 /* Parse subelements (if there are any) */
1304 len = ml_len - len - sizeof(struct ieee80211_eht_ml);
1305 for_each_element_id(sub, 0, pos, len) {
1306 const struct ieee80211_eht_per_sta_profile *sta;
1307 u16 sta_control;
1308
1309 if (*links == 0xffff)
1310 *links = 0;
1311
1312 if (sub->datalen <
1313 sizeof(struct ieee80211_eht_per_sta_profile)) {
1314 wpa_printf(MSG_DEBUG,
1315 "MLD: ML probe req %d too short for sta profile",
1316 sub->datalen);
1317 return false;
1318 }
1319
1320 sta = (struct ieee80211_eht_per_sta_profile *) sub->data;
1321
1322 /*
1323 * Extract the link ID, do not return whether a complete or
1324 * partial profile was requested.
1325 */
1326 sta_control = le_to_host16(sta->sta_control);
1327 *links |= BIT(sta_control & EHT_PER_STA_CTRL_LINK_ID_MSK);
1328 }
1329
1330 if (!for_each_element_completed(sub, pos, len)) {
1331 wpa_printf(MSG_DEBUG,
1332 "MLD: ML probe req sub-elements parsing error");
1333 return false;
1334 }
1335
1336 return true;
1337 }
1338 #endif /* CONFIG_IEEE80211BE */
1339
1340
handle_probe_req(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len,int ssi_signal)1341 void handle_probe_req(struct hostapd_data *hapd,
1342 const struct ieee80211_mgmt *mgmt, size_t len,
1343 int ssi_signal)
1344 {
1345 struct ieee802_11_elems elems;
1346 const u8 *ie;
1347 size_t ie_len;
1348 size_t i;
1349 int noack;
1350 enum ssid_match_result res;
1351 int ret;
1352 u16 csa_offs[2];
1353 size_t csa_offs_len;
1354 struct radius_sta rad_info;
1355 struct probe_resp_params params;
1356 #ifdef CONFIG_IEEE80211BE
1357 int mld_id;
1358 u16 links;
1359 #endif /* CONFIG_IEEE80211BE */
1360
1361 if (hapd->iconf->rssi_ignore_probe_request && ssi_signal &&
1362 ssi_signal < hapd->iconf->rssi_ignore_probe_request)
1363 return;
1364
1365 if (len < IEEE80211_HDRLEN)
1366 return;
1367 ie = ((const u8 *) mgmt) + IEEE80211_HDRLEN;
1368 if (hapd->iconf->track_sta_max_num)
1369 sta_track_add(hapd->iface, mgmt->sa, ssi_signal);
1370 ie_len = len - IEEE80211_HDRLEN;
1371
1372 ret = hostapd_allowed_address(hapd, mgmt->sa, (const u8 *) mgmt, len,
1373 &rad_info, 1);
1374 if (ret == HOSTAPD_ACL_REJECT) {
1375 wpa_msg(hapd->msg_ctx, MSG_DEBUG,
1376 "Ignore Probe Request frame from " MACSTR
1377 " due to ACL reject ", MAC2STR(mgmt->sa));
1378 return;
1379 }
1380
1381 for (i = 0; hapd->probereq_cb && i < hapd->num_probereq_cb; i++)
1382 if (hapd->probereq_cb[i].cb(hapd->probereq_cb[i].ctx,
1383 mgmt->sa, mgmt->da, mgmt->bssid,
1384 ie, ie_len, ssi_signal) > 0)
1385 return;
1386
1387 if (!hapd->conf->send_probe_response)
1388 return;
1389
1390 if (ieee802_11_parse_elems(ie, ie_len, &elems, 0) == ParseFailed) {
1391 wpa_printf(MSG_DEBUG, "Could not parse ProbeReq from " MACSTR,
1392 MAC2STR(mgmt->sa));
1393 return;
1394 }
1395
1396 if ((!elems.ssid || !elems.supp_rates)) {
1397 wpa_printf(MSG_DEBUG, "STA " MACSTR " sent probe request "
1398 "without SSID or supported rates element",
1399 MAC2STR(mgmt->sa));
1400 return;
1401 }
1402
1403 /*
1404 * No need to reply if the Probe Request frame was sent on an adjacent
1405 * channel. IEEE Std 802.11-2012 describes this as a requirement for an
1406 * AP with dot11RadioMeasurementActivated set to true, but strictly
1407 * speaking does not allow such ignoring of Probe Request frames if
1408 * dot11RadioMeasurementActivated is false. Anyway, this can help reduce
1409 * number of unnecessary Probe Response frames for cases where the STA
1410 * is less likely to see them (Probe Request frame sent on a
1411 * neighboring, but partially overlapping, channel).
1412 */
1413 if (elems.ds_params &&
1414 hapd->iface->current_mode &&
1415 (hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G ||
1416 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211B) &&
1417 hapd->iconf->channel != elems.ds_params[0]) {
1418 wpa_printf(MSG_DEBUG,
1419 "Ignore Probe Request due to DS Params mismatch: chan=%u != ds.chan=%u",
1420 hapd->iconf->channel, elems.ds_params[0]);
1421 return;
1422 }
1423
1424 #ifdef CONFIG_P2P
1425 if (hapd->p2p && hapd->p2p_group && elems.wps_ie) {
1426 struct wpabuf *wps;
1427 wps = ieee802_11_vendor_ie_concat(ie, ie_len, WPS_DEV_OUI_WFA);
1428 if (wps && !p2p_group_match_dev_type(hapd->p2p_group, wps)) {
1429 wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request "
1430 "due to mismatch with Requested Device "
1431 "Type");
1432 wpabuf_free(wps);
1433 return;
1434 }
1435 wpabuf_free(wps);
1436 }
1437
1438 if (hapd->p2p && hapd->p2p_group && elems.p2p) {
1439 struct wpabuf *p2p;
1440 p2p = ieee802_11_vendor_ie_concat(ie, ie_len, P2P_IE_VENDOR_TYPE);
1441 if (p2p && !p2p_group_match_dev_id(hapd->p2p_group, p2p)) {
1442 wpa_printf(MSG_MSGDUMP, "P2P: Ignore Probe Request "
1443 "due to mismatch with Device ID");
1444 wpabuf_free(p2p);
1445 return;
1446 }
1447 wpabuf_free(p2p);
1448 }
1449 #endif /* CONFIG_P2P */
1450
1451 if (hapd->conf->ignore_broadcast_ssid && elems.ssid_len == 0 &&
1452 elems.ssid_list_len == 0 && elems.short_ssid_list_len == 0) {
1453 wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for "
1454 "broadcast SSID ignored", MAC2STR(mgmt->sa));
1455 return;
1456 }
1457
1458 #ifdef CONFIG_P2P
1459 if ((hapd->conf->p2p & P2P_GROUP_OWNER) &&
1460 elems.ssid_len == P2P_WILDCARD_SSID_LEN &&
1461 os_memcmp(elems.ssid, P2P_WILDCARD_SSID,
1462 P2P_WILDCARD_SSID_LEN) == 0) {
1463 /* Process P2P Wildcard SSID like Wildcard SSID */
1464 elems.ssid_len = 0;
1465 }
1466 #endif /* CONFIG_P2P */
1467
1468 #ifdef CONFIG_TAXONOMY
1469 {
1470 struct sta_info *sta;
1471 struct hostapd_sta_info *info;
1472
1473 if ((sta = ap_get_sta(hapd, mgmt->sa)) != NULL) {
1474 taxonomy_sta_info_probe_req(hapd, sta, ie, ie_len);
1475 } else if ((info = sta_track_get(hapd->iface,
1476 mgmt->sa)) != NULL) {
1477 taxonomy_hostapd_sta_info_probe_req(hapd, info,
1478 ie, ie_len);
1479 }
1480 }
1481 #endif /* CONFIG_TAXONOMY */
1482
1483 res = ssid_match(hapd, elems.ssid, elems.ssid_len,
1484 elems.ssid_list, elems.ssid_list_len,
1485 elems.short_ssid_list, elems.short_ssid_list_len);
1486 if (res == NO_SSID_MATCH) {
1487 if (!(mgmt->da[0] & 0x01)) {
1488 wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR
1489 " for foreign SSID '%s' (DA " MACSTR ")%s",
1490 MAC2STR(mgmt->sa),
1491 wpa_ssid_txt(elems.ssid, elems.ssid_len),
1492 MAC2STR(mgmt->da),
1493 elems.ssid_list ? " (SSID list)" : "");
1494 }
1495 return;
1496 }
1497
1498 if (hapd->conf->ignore_broadcast_ssid && res == WILDCARD_SSID_MATCH) {
1499 wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR " for "
1500 "broadcast SSID ignored", MAC2STR(mgmt->sa));
1501 return;
1502 }
1503
1504 #ifdef CONFIG_INTERWORKING
1505 if (hapd->conf->interworking &&
1506 elems.interworking && elems.interworking_len >= 1) {
1507 u8 ant = elems.interworking[0] & 0x0f;
1508 if (ant != INTERWORKING_ANT_WILDCARD &&
1509 ant != hapd->conf->access_network_type) {
1510 wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR
1511 " for mismatching ANT %u ignored",
1512 MAC2STR(mgmt->sa), ant);
1513 return;
1514 }
1515 }
1516
1517 if (hapd->conf->interworking && elems.interworking &&
1518 (elems.interworking_len == 7 || elems.interworking_len == 9)) {
1519 const u8 *hessid;
1520 if (elems.interworking_len == 7)
1521 hessid = elems.interworking + 1;
1522 else
1523 hessid = elems.interworking + 1 + 2;
1524 if (!is_broadcast_ether_addr(hessid) &&
1525 !ether_addr_equal(hessid, hapd->conf->hessid)) {
1526 wpa_printf(MSG_MSGDUMP, "Probe Request from " MACSTR
1527 " for mismatching HESSID " MACSTR
1528 " ignored",
1529 MAC2STR(mgmt->sa), MAC2STR(hessid));
1530 return;
1531 }
1532 }
1533 #endif /* CONFIG_INTERWORKING */
1534
1535 #ifdef CONFIG_P2P
1536 if ((hapd->conf->p2p & P2P_GROUP_OWNER) &&
1537 supp_rates_11b_only(&elems)) {
1538 /* Indicates support for 11b rates only */
1539 wpa_printf(MSG_EXCESSIVE, "P2P: Ignore Probe Request from "
1540 MACSTR " with only 802.11b rates",
1541 MAC2STR(mgmt->sa));
1542 return;
1543 }
1544 #endif /* CONFIG_P2P */
1545
1546 /* TODO: verify that supp_rates contains at least one matching rate
1547 * with AP configuration */
1548
1549 if (hapd->conf->no_probe_resp_if_seen_on &&
1550 is_multicast_ether_addr(mgmt->da) &&
1551 is_multicast_ether_addr(mgmt->bssid) &&
1552 sta_track_seen_on(hapd->iface, mgmt->sa,
1553 hapd->conf->no_probe_resp_if_seen_on)) {
1554 wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
1555 " since STA has been seen on %s",
1556 hapd->conf->iface, MAC2STR(mgmt->sa),
1557 hapd->conf->no_probe_resp_if_seen_on);
1558 return;
1559 }
1560
1561 if (hapd->conf->no_probe_resp_if_max_sta &&
1562 is_multicast_ether_addr(mgmt->da) &&
1563 is_multicast_ether_addr(mgmt->bssid) &&
1564 hapd->num_sta >= hapd->conf->max_num_sta &&
1565 !ap_get_sta(hapd, mgmt->sa)) {
1566 wpa_printf(MSG_MSGDUMP, "%s: Ignore Probe Request from " MACSTR
1567 " since no room for additional STA",
1568 hapd->conf->iface, MAC2STR(mgmt->sa));
1569 return;
1570 }
1571
1572 #ifdef CONFIG_TESTING_OPTIONS
1573 if (hapd->iconf->ignore_probe_probability > 0.0 &&
1574 drand48() < hapd->iconf->ignore_probe_probability) {
1575 wpa_printf(MSG_INFO,
1576 "TESTING: ignoring probe request from " MACSTR,
1577 MAC2STR(mgmt->sa));
1578 return;
1579 }
1580 #endif /* CONFIG_TESTING_OPTIONS */
1581
1582 /* Do not send Probe Response frame from a non-transmitting multiple
1583 * BSSID profile unless the Probe Request frame is directed at that
1584 * particular BSS. */
1585 if (hapd != hostapd_mbssid_get_tx_bss(hapd) && res != EXACT_SSID_MATCH)
1586 return;
1587
1588 wpa_msg_ctrl(hapd->msg_ctx, MSG_INFO, RX_PROBE_REQUEST "sa=" MACSTR
1589 " signal=%d", MAC2STR(mgmt->sa), ssi_signal);
1590
1591 os_memset(¶ms, 0, sizeof(params));
1592
1593 #ifdef CONFIG_IEEE80211BE
1594 if (hapd->conf->mld_ap && elems.probe_req_mle &&
1595 parse_ml_probe_req((struct ieee80211_eht_ml *) elems.probe_req_mle,
1596 elems.probe_req_mle_len, &mld_id, &links)) {
1597 hostapd_fill_probe_resp_ml_params(hapd, ¶ms, mgmt,
1598 mld_id, links);
1599 }
1600 #endif /* CONFIG_IEEE80211BE */
1601
1602 params.req = mgmt;
1603 params.is_p2p = !!elems.p2p;
1604 params.known_bss = elems.mbssid_known_bss;
1605 params.known_bss_len = elems.mbssid_known_bss_len;
1606 params.is_ml_sta_info = false;
1607
1608 hostapd_gen_probe_resp(hapd, ¶ms);
1609
1610 hostapd_free_probe_resp_params(¶ms);
1611
1612 if (!params.resp)
1613 return;
1614
1615 /*
1616 * If this is a broadcast probe request, apply no ack policy to avoid
1617 * excessive retries.
1618 */
1619 noack = !!(res == WILDCARD_SSID_MATCH &&
1620 is_broadcast_ether_addr(mgmt->da));
1621
1622 csa_offs_len = 0;
1623 if (hapd->csa_in_progress) {
1624 if (params.csa_pos)
1625 csa_offs[csa_offs_len++] =
1626 params.csa_pos - (u8 *) params.resp;
1627
1628 if (params.ecsa_pos)
1629 csa_offs[csa_offs_len++] =
1630 params.ecsa_pos - (u8 *) params.resp;
1631 }
1632
1633 ret = hostapd_drv_send_mlme(hapd, params.resp, params.resp_len, noack,
1634 csa_offs_len ? csa_offs : NULL,
1635 csa_offs_len, 0);
1636
1637 if (ret < 0)
1638 wpa_printf(MSG_INFO, "handle_probe_req: send failed");
1639
1640 os_free(params.resp);
1641
1642 wpa_printf(MSG_EXCESSIVE, "STA " MACSTR " sent probe request for %s "
1643 "SSID", MAC2STR(mgmt->sa),
1644 elems.ssid_len == 0 ? "broadcast" : "our");
1645 }
1646
1647
hostapd_probe_resp_offloads(struct hostapd_data * hapd,size_t * resp_len)1648 static u8 * hostapd_probe_resp_offloads(struct hostapd_data *hapd,
1649 size_t *resp_len)
1650 {
1651 struct probe_resp_params params;
1652
1653 /* check probe response offloading caps and print warnings */
1654 if (!(hapd->iface->drv_flags & WPA_DRIVER_FLAGS_PROBE_RESP_OFFLOAD))
1655 return NULL;
1656
1657 #ifdef CONFIG_WPS
1658 if (hapd->conf->wps_state && hapd->wps_probe_resp_ie &&
1659 (!(hapd->iface->probe_resp_offloads &
1660 (WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS |
1661 WPA_DRIVER_PROBE_RESP_OFFLOAD_WPS2))))
1662 wpa_printf(MSG_WARNING, "Device is trying to offload WPS "
1663 "Probe Response while not supporting this");
1664 #endif /* CONFIG_WPS */
1665
1666 #ifdef CONFIG_P2P
1667 if ((hapd->conf->p2p & P2P_ENABLED) && hapd->p2p_probe_resp_ie &&
1668 !(hapd->iface->probe_resp_offloads &
1669 WPA_DRIVER_PROBE_RESP_OFFLOAD_P2P))
1670 wpa_printf(MSG_WARNING, "Device is trying to offload P2P "
1671 "Probe Response while not supporting this");
1672 #endif /* CONFIG_P2P */
1673
1674 if (hapd->conf->interworking &&
1675 !(hapd->iface->probe_resp_offloads &
1676 WPA_DRIVER_PROBE_RESP_OFFLOAD_INTERWORKING))
1677 wpa_printf(MSG_WARNING, "Device is trying to offload "
1678 "Interworking Probe Response while not supporting "
1679 "this");
1680
1681 /* Generate a Probe Response template for the non-P2P case */
1682 os_memset(¶ms, 0, sizeof(params));
1683 params.req = NULL;
1684 params.is_p2p = false;
1685 params.known_bss = NULL;
1686 params.known_bss_len = 0;
1687 params.is_ml_sta_info = false;
1688 params.mld_ap = NULL;
1689 params.mld_info = NULL;
1690
1691 hostapd_gen_probe_resp(hapd, ¶ms);
1692 *resp_len = params.resp_len;
1693 if (!params.resp)
1694 return NULL;
1695
1696 /* TODO: Avoid passing these through struct hostapd_data */
1697 if (params.csa_pos)
1698 hapd->cs_c_off_proberesp = params.csa_pos - (u8 *) params.resp;
1699 if (params.ecsa_pos)
1700 hapd->cs_c_off_ecsa_proberesp = params.ecsa_pos -
1701 (u8 *) params.resp;
1702 #ifdef CONFIG_IEEE80211AX
1703 if (params.cca_pos)
1704 hapd->cca_c_off_proberesp = params.cca_pos - (u8 *) params.resp;
1705 #endif /* CONFIG_IEEE80211AX */
1706
1707 return (u8 *) params.resp;
1708 }
1709
1710 #endif /* NEED_AP_MLME */
1711
1712
1713 #ifdef CONFIG_IEEE80211AX
1714 /* Unsolicited broadcast Probe Response transmission, 6 GHz only */
hostapd_unsol_bcast_probe_resp(struct hostapd_data * hapd,struct unsol_bcast_probe_resp * ubpr)1715 u8 * hostapd_unsol_bcast_probe_resp(struct hostapd_data *hapd,
1716 struct unsol_bcast_probe_resp *ubpr)
1717 {
1718 struct probe_resp_params probe_params;
1719
1720 if (!is_6ghz_op_class(hapd->iconf->op_class))
1721 return NULL;
1722
1723 ubpr->unsol_bcast_probe_resp_interval =
1724 hapd->conf->unsol_bcast_probe_resp_interval;
1725
1726 os_memset(&probe_params, 0, sizeof(probe_params));
1727 probe_params.req = NULL;
1728 probe_params.is_p2p = false;
1729 probe_params.known_bss = NULL;
1730 probe_params.known_bss_len = 0;
1731 probe_params.is_ml_sta_info = false;
1732 probe_params.mld_ap = NULL;
1733 probe_params.mld_info = NULL;
1734
1735 hostapd_gen_probe_resp(hapd, &probe_params);
1736 ubpr->unsol_bcast_probe_resp_tmpl_len = probe_params.resp_len;
1737 return (u8 *) probe_params.resp;
1738 }
1739 #endif /* CONFIG_IEEE80211AX */
1740
1741
sta_track_del(struct hostapd_sta_info * info)1742 void sta_track_del(struct hostapd_sta_info *info)
1743 {
1744 #ifdef CONFIG_TAXONOMY
1745 wpabuf_free(info->probe_ie_taxonomy);
1746 info->probe_ie_taxonomy = NULL;
1747 #endif /* CONFIG_TAXONOMY */
1748 os_free(info);
1749 }
1750
1751
1752 #ifdef CONFIG_FILS
1753
hostapd_gen_fils_discovery_phy_index(struct hostapd_data * hapd)1754 static u16 hostapd_gen_fils_discovery_phy_index(struct hostapd_data *hapd)
1755 {
1756 #ifdef CONFIG_IEEE80211BE
1757 if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be)
1758 return FD_CAP_PHY_INDEX_EHT;
1759 #endif /* CONFIG_IEEE80211BE */
1760
1761 #ifdef CONFIG_IEEE80211AX
1762 if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax)
1763 return FD_CAP_PHY_INDEX_HE;
1764 #endif /* CONFIG_IEEE80211AX */
1765
1766 #ifdef CONFIG_IEEE80211AC
1767 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac)
1768 return FD_CAP_PHY_INDEX_VHT;
1769 #endif /* CONFIG_IEEE80211AC */
1770
1771 if (hapd->iconf->ieee80211n && !hapd->conf->disable_11n)
1772 return FD_CAP_PHY_INDEX_HT;
1773
1774 return 0;
1775 }
1776
1777
hostapd_gen_fils_discovery_nss(struct hostapd_hw_modes * mode,u16 phy_index,u8 he_mcs_nss_size)1778 static u16 hostapd_gen_fils_discovery_nss(struct hostapd_hw_modes *mode,
1779 u16 phy_index, u8 he_mcs_nss_size)
1780 {
1781 u16 nss = 0;
1782
1783 if (!mode)
1784 return 0;
1785
1786 if (phy_index == FD_CAP_PHY_INDEX_HE) {
1787 const u8 *he_mcs = mode->he_capab[IEEE80211_MODE_AP].mcs;
1788 int i;
1789 u16 mcs[6];
1790
1791 os_memset(mcs, 0xff, 6 * sizeof(u16));
1792
1793 if (he_mcs_nss_size == 4) {
1794 mcs[0] = WPA_GET_LE16(&he_mcs[0]);
1795 mcs[1] = WPA_GET_LE16(&he_mcs[2]);
1796 }
1797
1798 if (he_mcs_nss_size == 8) {
1799 mcs[2] = WPA_GET_LE16(&he_mcs[4]);
1800 mcs[3] = WPA_GET_LE16(&he_mcs[6]);
1801 }
1802
1803 if (he_mcs_nss_size == 12) {
1804 mcs[4] = WPA_GET_LE16(&he_mcs[8]);
1805 mcs[5] = WPA_GET_LE16(&he_mcs[10]);
1806 }
1807
1808 for (i = 0; i < HE_NSS_MAX_STREAMS; i++) {
1809 u16 nss_mask = 0x3 << (i * 2);
1810
1811 /*
1812 * If Tx and/or Rx indicate support for a given NSS,
1813 * count it towards the maximum NSS.
1814 */
1815 if (he_mcs_nss_size == 4 &&
1816 (((mcs[0] & nss_mask) != nss_mask) ||
1817 ((mcs[1] & nss_mask) != nss_mask))) {
1818 nss++;
1819 continue;
1820 }
1821
1822 if (he_mcs_nss_size == 8 &&
1823 (((mcs[2] & nss_mask) != nss_mask) ||
1824 ((mcs[3] & nss_mask) != nss_mask))) {
1825 nss++;
1826 continue;
1827 }
1828
1829 if (he_mcs_nss_size == 12 &&
1830 (((mcs[4] & nss_mask) != nss_mask) ||
1831 ((mcs[5] & nss_mask) != nss_mask))) {
1832 nss++;
1833 continue;
1834 }
1835 }
1836 } else if (phy_index == FD_CAP_PHY_INDEX_EHT) {
1837 u8 rx_nss, tx_nss, max_nss = 0, i;
1838 u8 *mcs = mode->eht_capab[IEEE80211_MODE_AP].mcs;
1839
1840 /*
1841 * The Supported EHT-MCS And NSS Set field for the AP contains
1842 * one to three EHT-MCS Map fields based on the supported
1843 * bandwidth. Check the first byte (max NSS for Rx/Tx that
1844 * supports EHT-MCS 0-9) for each bandwidth (<= 80,
1845 * 160, 320) to find the maximum NSS. This assumes that
1846 * the lowest MCS rates support the largest number of spatial
1847 * streams. If values are different between Tx, Rx or the
1848 * bandwidths, choose the highest value.
1849 */
1850 for (i = 0; i < 3; i++) {
1851 rx_nss = mcs[3 * i] & 0x0F;
1852 if (rx_nss > max_nss)
1853 max_nss = rx_nss;
1854
1855 tx_nss = (mcs[3 * i] & 0xF0) >> 4;
1856 if (tx_nss > max_nss)
1857 max_nss = tx_nss;
1858 }
1859
1860 nss = max_nss;
1861 }
1862
1863 if (nss > 4)
1864 return FD_CAP_NSS_5_8 << FD_CAP_NSS_SHIFT;
1865 if (nss)
1866 return (nss - 1) << FD_CAP_NSS_SHIFT;
1867
1868 return 0;
1869 }
1870
1871
hostapd_fils_discovery_cap(struct hostapd_data * hapd)1872 static u16 hostapd_fils_discovery_cap(struct hostapd_data *hapd)
1873 {
1874 u16 cap_info, phy_index;
1875 u8 chwidth = FD_CAP_BSS_CHWIDTH_20, he_mcs_nss_size = 4;
1876 struct hostapd_hw_modes *mode = hapd->iface->current_mode;
1877
1878 cap_info = FD_CAP_ESS;
1879 if (hapd->conf->wpa)
1880 cap_info |= FD_CAP_PRIVACY;
1881
1882 if (is_6ghz_op_class(hapd->iconf->op_class)) {
1883 switch (hapd->iconf->op_class) {
1884 case 137:
1885 chwidth = FD_CAP_BSS_CHWIDTH_320;
1886 break;
1887 case 135:
1888 he_mcs_nss_size += 4;
1889 /* fallthrough */
1890 case 134:
1891 he_mcs_nss_size += 4;
1892 chwidth = FD_CAP_BSS_CHWIDTH_160_80_80;
1893 break;
1894 case 133:
1895 chwidth = FD_CAP_BSS_CHWIDTH_80;
1896 break;
1897 case 132:
1898 chwidth = FD_CAP_BSS_CHWIDTH_40;
1899 break;
1900 }
1901 } else {
1902 switch (hostapd_get_oper_chwidth(hapd->iconf)) {
1903 case CONF_OPER_CHWIDTH_80P80MHZ:
1904 he_mcs_nss_size += 4;
1905 /* fallthrough */
1906 case CONF_OPER_CHWIDTH_160MHZ:
1907 he_mcs_nss_size += 4;
1908 chwidth = FD_CAP_BSS_CHWIDTH_160_80_80;
1909 break;
1910 case CONF_OPER_CHWIDTH_80MHZ:
1911 chwidth = FD_CAP_BSS_CHWIDTH_80;
1912 break;
1913 case CONF_OPER_CHWIDTH_USE_HT:
1914 if (hapd->iconf->secondary_channel)
1915 chwidth = FD_CAP_BSS_CHWIDTH_40;
1916 else
1917 chwidth = FD_CAP_BSS_CHWIDTH_20;
1918 break;
1919 default:
1920 break;
1921 }
1922 }
1923
1924 phy_index = hostapd_gen_fils_discovery_phy_index(hapd);
1925 cap_info |= phy_index << FD_CAP_PHY_INDEX_SHIFT;
1926 cap_info |= chwidth << FD_CAP_BSS_CHWIDTH_SHIFT;
1927 cap_info |= hostapd_gen_fils_discovery_nss(mode, phy_index,
1928 he_mcs_nss_size);
1929 return cap_info;
1930 }
1931
1932
hostapd_gen_fils_discovery(struct hostapd_data * hapd,size_t * len)1933 static u8 * hostapd_gen_fils_discovery(struct hostapd_data *hapd, size_t *len)
1934 {
1935 struct ieee80211_mgmt *head;
1936 const u8 *mobility_domain;
1937 u8 *pos, *length_pos, buf[200];
1938 u16 ctl = 0;
1939 u8 fd_rsn_info[5];
1940 size_t total_len, buf_len;
1941
1942 total_len = 24 + 2 + 12;
1943
1944 /* FILS Discovery Frame Control */
1945 ctl = (sizeof(hapd->conf->ssid.short_ssid) - 1) |
1946 FD_FRAME_CTL_SHORT_SSID_PRESENT |
1947 FD_FRAME_CTL_LENGTH_PRESENT |
1948 FD_FRAME_CTL_CAP_PRESENT;
1949 total_len += 4 + 1 + 2;
1950
1951 /* Fill primary channel information for 6 GHz channels with over 20 MHz
1952 * bandwidth, if the primary channel is not a PSC */
1953 if (is_6ghz_op_class(hapd->iconf->op_class) &&
1954 !is_6ghz_psc_frequency(ieee80211_chan_to_freq(
1955 NULL, hapd->iconf->op_class,
1956 hapd->iconf->channel)) &&
1957 op_class_to_bandwidth(hapd->iconf->op_class) > 20) {
1958 ctl |= FD_FRAME_CTL_PRI_CHAN_PRESENT;
1959 total_len += 2;
1960 }
1961
1962 /* Check for optional subfields and calculate length */
1963 if (wpa_auth_write_fd_rsn_info(hapd->wpa_auth, fd_rsn_info)) {
1964 ctl |= FD_FRAME_CTL_RSN_INFO_PRESENT;
1965 total_len += sizeof(fd_rsn_info);
1966 }
1967
1968 mobility_domain = hostapd_wpa_ie(hapd, WLAN_EID_MOBILITY_DOMAIN);
1969 if (mobility_domain) {
1970 ctl |= FD_FRAME_CTL_MD_PRESENT;
1971 total_len += 3;
1972 }
1973
1974 total_len += hostapd_eid_rnr_len(hapd, WLAN_FC_STYPE_ACTION, true);
1975
1976 pos = hostapd_eid_fils_indic(hapd, buf, 0);
1977 buf_len = pos - buf;
1978 total_len += buf_len;
1979
1980 /* he_elem_len() may return too large a value for FD frame, but that is
1981 * fine here since this is used as the maximum length of the buffer. */
1982 total_len += he_elem_len(hapd);
1983
1984 head = os_zalloc(total_len);
1985 if (!head)
1986 return NULL;
1987
1988 head->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
1989 WLAN_FC_STYPE_ACTION);
1990 os_memset(head->da, 0xff, ETH_ALEN);
1991 os_memcpy(head->sa, hapd->own_addr, ETH_ALEN);
1992 os_memcpy(head->bssid, hapd->own_addr, ETH_ALEN);
1993
1994 head->u.action.category = WLAN_ACTION_PUBLIC;
1995 head->u.action.u.public_action.action = WLAN_PA_FILS_DISCOVERY;
1996
1997 pos = &head->u.action.u.public_action.variable[0];
1998
1999 /* FILS Discovery Information field */
2000
2001 /* FILS Discovery Frame Control */
2002 WPA_PUT_LE16(pos, ctl);
2003 pos += 2;
2004
2005 /* Hardware or low-level driver will fill in the Timestamp value */
2006 pos += 8;
2007
2008 /* Beacon Interval */
2009 WPA_PUT_LE16(pos, hapd->iconf->beacon_int);
2010 pos += 2;
2011
2012 /* Short SSID */
2013 WPA_PUT_LE32(pos, hapd->conf->ssid.short_ssid);
2014 pos += sizeof(hapd->conf->ssid.short_ssid);
2015
2016 /* Store position of FILS discovery information element Length field */
2017 length_pos = pos++;
2018
2019 /* FD Capability */
2020 WPA_PUT_LE16(pos, hostapd_fils_discovery_cap(hapd));
2021 pos += 2;
2022
2023 /* Operating Class and Primary Channel - if a 6 GHz chan is non PSC */
2024 if (ctl & FD_FRAME_CTL_PRI_CHAN_PRESENT) {
2025 *pos++ = hapd->iconf->op_class;
2026 *pos++ = hapd->iconf->channel;
2027 }
2028
2029 /* AP Configuration Sequence Number - not present */
2030
2031 /* Access Network Options - not present */
2032
2033 /* FD RSN Information */
2034 if (ctl & FD_FRAME_CTL_RSN_INFO_PRESENT) {
2035 os_memcpy(pos, fd_rsn_info, sizeof(fd_rsn_info));
2036 pos += sizeof(fd_rsn_info);
2037 }
2038
2039 /* Channel Center Frequency Segment 1 - not present */
2040
2041 /* Mobility Domain */
2042 if (ctl & FD_FRAME_CTL_MD_PRESENT) {
2043 os_memcpy(pos, &mobility_domain[2], 3);
2044 pos += 3;
2045 }
2046
2047 /* Fill in the Length field value */
2048 *length_pos = pos - (length_pos + 1);
2049
2050 pos = hostapd_eid_rnr(hapd, pos, WLAN_FC_STYPE_ACTION, true);
2051
2052 /* FILS Indication element */
2053 if (buf_len) {
2054 os_memcpy(pos, buf, buf_len);
2055 pos += buf_len;
2056 }
2057
2058 if (is_6ghz_op_class(hapd->iconf->op_class))
2059 pos = hostapd_eid_txpower_envelope(hapd, pos);
2060
2061 *len = pos - (u8 *) head;
2062 wpa_hexdump(MSG_DEBUG, "FILS Discovery frame template",
2063 head, pos - (u8 *) head);
2064 return (u8 *) head;
2065 }
2066
2067
2068 /* Configure FILS Discovery frame transmission parameters */
hostapd_fils_discovery(struct hostapd_data * hapd,struct wpa_driver_ap_params * params)2069 static u8 * hostapd_fils_discovery(struct hostapd_data *hapd,
2070 struct wpa_driver_ap_params *params)
2071 {
2072 params->fd_max_int = hapd->conf->fils_discovery_max_int;
2073 if (is_6ghz_op_class(hapd->iconf->op_class) &&
2074 params->fd_max_int > FD_MAX_INTERVAL_6GHZ)
2075 params->fd_max_int = FD_MAX_INTERVAL_6GHZ;
2076
2077 params->fd_min_int = hapd->conf->fils_discovery_min_int;
2078 if (params->fd_min_int > params->fd_max_int)
2079 params->fd_min_int = params->fd_max_int;
2080
2081 if (params->fd_max_int)
2082 return hostapd_gen_fils_discovery(hapd,
2083 ¶ms->fd_frame_tmpl_len);
2084
2085 return NULL;
2086 }
2087
2088 #endif /* CONFIG_FILS */
2089
2090
ieee802_11_build_ap_params(struct hostapd_data * hapd,struct wpa_driver_ap_params * params)2091 int ieee802_11_build_ap_params(struct hostapd_data *hapd,
2092 struct wpa_driver_ap_params *params)
2093 {
2094 struct ieee80211_mgmt *head = NULL;
2095 u8 *tail = NULL;
2096 size_t head_len = 0, tail_len = 0;
2097 u8 *resp = NULL;
2098 size_t resp_len = 0;
2099 #ifdef NEED_AP_MLME
2100 u16 capab_info;
2101 u8 *pos, *tailpos, *tailend, *csa_pos;
2102 bool complete = false;
2103 #endif /* NEED_AP_MLME */
2104
2105 os_memset(params, 0, sizeof(*params));
2106
2107 #ifdef NEED_AP_MLME
2108 #define BEACON_HEAD_BUF_SIZE 256
2109 #define BEACON_TAIL_BUF_SIZE 512
2110 head = os_zalloc(BEACON_HEAD_BUF_SIZE);
2111 tail_len = BEACON_TAIL_BUF_SIZE;
2112 #ifdef CONFIG_WPS
2113 if (hapd->conf->wps_state && hapd->wps_beacon_ie)
2114 tail_len += wpabuf_len(hapd->wps_beacon_ie);
2115 #endif /* CONFIG_WPS */
2116 #ifdef CONFIG_P2P
2117 if (hapd->p2p_beacon_ie)
2118 tail_len += wpabuf_len(hapd->p2p_beacon_ie);
2119 #endif /* CONFIG_P2P */
2120 #ifdef CONFIG_FST
2121 if (hapd->iface->fst_ies)
2122 tail_len += wpabuf_len(hapd->iface->fst_ies);
2123 #endif /* CONFIG_FST */
2124 if (hapd->conf->vendor_elements)
2125 tail_len += wpabuf_len(hapd->conf->vendor_elements);
2126
2127 #ifdef CONFIG_IEEE80211AC
2128 if (hapd->conf->vendor_vht) {
2129 tail_len += 5 + 2 + sizeof(struct ieee80211_vht_capabilities) +
2130 2 + sizeof(struct ieee80211_vht_operation);
2131 }
2132 #endif /* CONFIG_IEEE80211AC */
2133
2134 tail_len += he_elem_len(hapd);
2135
2136 #ifdef CONFIG_IEEE80211BE
2137 if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
2138 tail_len += hostapd_eid_eht_capab_len(hapd, IEEE80211_MODE_AP);
2139 tail_len += 3 + sizeof(struct ieee80211_eht_operation);
2140 if (hapd->iconf->punct_bitmap)
2141 tail_len += EHT_OPER_DISABLED_SUBCHAN_BITMAP_SIZE;
2142
2143 /*
2144 * TODO: Multi-Link element has variable length and can be
2145 * long based on the common info and number of per
2146 * station profiles. For now use 256.
2147 */
2148 if (hapd->conf->mld_ap)
2149 tail_len += 256;
2150 }
2151 #endif /* CONFIG_IEEE80211BE */
2152
2153 if (hapd->iconf->mbssid == ENHANCED_MBSSID_ENABLED &&
2154 hapd == hostapd_mbssid_get_tx_bss(hapd))
2155 tail_len += 5; /* Multiple BSSID Configuration element */
2156 tail_len += hostapd_eid_rnr_len(hapd, WLAN_FC_STYPE_BEACON, true);
2157 tail_len += hostapd_mbo_ie_len(hapd);
2158 tail_len += hostapd_eid_owe_trans_len(hapd);
2159 tail_len += hostapd_eid_dpp_cc_len(hapd);
2160
2161 tailpos = tail = os_malloc(tail_len);
2162 if (head == NULL || tail == NULL) {
2163 wpa_printf(MSG_ERROR, "Failed to set beacon data");
2164 os_free(head);
2165 os_free(tail);
2166 return -1;
2167 }
2168 tailend = tail + tail_len;
2169
2170 head->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2171 WLAN_FC_STYPE_BEACON);
2172 head->duration = host_to_le16(0);
2173 os_memset(head->da, 0xff, ETH_ALEN);
2174
2175 os_memcpy(head->sa, hapd->own_addr, ETH_ALEN);
2176 os_memcpy(head->bssid, hapd->own_addr, ETH_ALEN);
2177 head->u.beacon.beacon_int =
2178 host_to_le16(hapd->iconf->beacon_int);
2179
2180 /* hardware or low-level driver will setup seq_ctrl and timestamp */
2181 capab_info = hostapd_own_capab_info(hapd);
2182 head->u.beacon.capab_info = host_to_le16(capab_info);
2183 pos = &head->u.beacon.variable[0];
2184
2185 /* SSID */
2186 *pos++ = WLAN_EID_SSID;
2187 if (hapd->conf->ignore_broadcast_ssid == 2) {
2188 /* clear the data, but keep the correct length of the SSID */
2189 *pos++ = hapd->conf->ssid.ssid_len;
2190 os_memset(pos, 0, hapd->conf->ssid.ssid_len);
2191 pos += hapd->conf->ssid.ssid_len;
2192 } else if (hapd->conf->ignore_broadcast_ssid) {
2193 *pos++ = 0; /* empty SSID */
2194 } else {
2195 *pos++ = hapd->conf->ssid.ssid_len;
2196 os_memcpy(pos, hapd->conf->ssid.ssid,
2197 hapd->conf->ssid.ssid_len);
2198 pos += hapd->conf->ssid.ssid_len;
2199 }
2200
2201 /* Supported rates */
2202 pos = hostapd_eid_supp_rates(hapd, pos);
2203
2204 /* DS Params */
2205 pos = hostapd_eid_ds_params(hapd, pos);
2206
2207 head_len = pos - (u8 *) head;
2208
2209 tailpos = hostapd_eid_country(hapd, tailpos, tailend - tailpos);
2210
2211 /* Power Constraint element */
2212 tailpos = hostapd_eid_pwr_constraint(hapd, tailpos);
2213
2214 /* CSA IE */
2215 csa_pos = hostapd_eid_csa(hapd, tailpos);
2216 if (csa_pos != tailpos)
2217 hapd->cs_c_off_beacon = csa_pos - tail - 1;
2218 tailpos = csa_pos;
2219
2220 /* ERP Information element */
2221 tailpos = hostapd_eid_erp_info(hapd, tailpos);
2222
2223 /* Extended supported rates */
2224 tailpos = hostapd_eid_ext_supp_rates(hapd, tailpos);
2225
2226 tailpos = hostapd_get_rsne(hapd, tailpos, tailend - tailpos);
2227 tailpos = hostapd_eid_bss_load(hapd, tailpos, tailend - tailpos);
2228 tailpos = hostapd_eid_rm_enabled_capab(hapd, tailpos,
2229 tailend - tailpos);
2230 tailpos = hostapd_get_mde(hapd, tailpos, tailend - tailpos);
2231
2232 /* eCSA IE */
2233 csa_pos = hostapd_eid_ecsa(hapd, tailpos);
2234 if (csa_pos != tailpos)
2235 hapd->cs_c_off_ecsa_beacon = csa_pos - tail - 1;
2236 tailpos = csa_pos;
2237
2238 tailpos = hostapd_eid_supported_op_classes(hapd, tailpos);
2239 tailpos = hostapd_eid_ht_capabilities(hapd, tailpos);
2240 tailpos = hostapd_eid_ht_operation(hapd, tailpos);
2241
2242 if (hapd->iconf->mbssid && hapd->iconf->num_bss > 1) {
2243 if (ieee802_11_build_ap_params_mbssid(hapd, params)) {
2244 os_free(head);
2245 os_free(tail);
2246 wpa_printf(MSG_ERROR,
2247 "MBSSID: Failed to set beacon data");
2248 return -1;
2249 }
2250 complete = hapd->iconf->mbssid == MBSSID_ENABLED ||
2251 (hapd->iconf->mbssid == ENHANCED_MBSSID_ENABLED &&
2252 params->mbssid_elem_count == 1);
2253 }
2254
2255 tailpos = hostapd_eid_ext_capab(hapd, tailpos, complete);
2256
2257 /*
2258 * TODO: Time Advertisement element should only be included in some
2259 * DTIM Beacon frames.
2260 */
2261 tailpos = hostapd_eid_time_adv(hapd, tailpos);
2262
2263 tailpos = hostapd_eid_interworking(hapd, tailpos);
2264 tailpos = hostapd_eid_adv_proto(hapd, tailpos);
2265 tailpos = hostapd_eid_roaming_consortium(hapd, tailpos);
2266
2267 #ifdef CONFIG_FST
2268 if (hapd->iface->fst_ies) {
2269 os_memcpy(tailpos, wpabuf_head(hapd->iface->fst_ies),
2270 wpabuf_len(hapd->iface->fst_ies));
2271 tailpos += wpabuf_len(hapd->iface->fst_ies);
2272 }
2273 #endif /* CONFIG_FST */
2274
2275 #ifdef CONFIG_IEEE80211AC
2276 if (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac &&
2277 !is_6ghz_op_class(hapd->iconf->op_class)) {
2278 tailpos = hostapd_eid_vht_capabilities(hapd, tailpos, 0);
2279 tailpos = hostapd_eid_vht_operation(hapd, tailpos);
2280 tailpos = hostapd_eid_txpower_envelope(hapd, tailpos);
2281 }
2282 #endif /* CONFIG_IEEE80211AC */
2283
2284 #ifdef CONFIG_IEEE80211AX
2285 if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax &&
2286 is_6ghz_op_class(hapd->iconf->op_class))
2287 tailpos = hostapd_eid_txpower_envelope(hapd, tailpos);
2288 #endif /* CONFIG_IEEE80211AX */
2289
2290 tailpos = hostapd_eid_wb_chsw_wrapper(hapd, tailpos);
2291
2292 tailpos = hostapd_eid_rnr(hapd, tailpos, WLAN_FC_STYPE_BEACON, true);
2293 tailpos = hostapd_eid_fils_indic(hapd, tailpos, 0);
2294 tailpos = hostapd_get_rsnxe(hapd, tailpos, tailend - tailpos);
2295 tailpos = hostapd_eid_mbssid_config(hapd, tailpos,
2296 params->mbssid_elem_count);
2297
2298 #ifdef CONFIG_IEEE80211AX
2299 if (hapd->iconf->ieee80211ax && !hapd->conf->disable_11ax) {
2300 u8 *cca_pos;
2301
2302 tailpos = hostapd_eid_he_capab(hapd, tailpos,
2303 IEEE80211_MODE_AP);
2304 tailpos = hostapd_eid_he_operation(hapd, tailpos);
2305
2306 /* BSS Color Change Announcement element */
2307 cca_pos = hostapd_eid_cca(hapd, tailpos);
2308 if (cca_pos != tailpos)
2309 hapd->cca_c_off_beacon = cca_pos - tail - 2;
2310 tailpos = cca_pos;
2311
2312 tailpos = hostapd_eid_spatial_reuse(hapd, tailpos);
2313 tailpos = hostapd_eid_he_mu_edca_parameter_set(hapd, tailpos);
2314 tailpos = hostapd_eid_he_6ghz_band_cap(hapd, tailpos);
2315 }
2316 #endif /* CONFIG_IEEE80211AX */
2317
2318 #ifdef CONFIG_IEEE80211BE
2319 if (hapd->iconf->ieee80211be && !hapd->conf->disable_11be) {
2320 if (hapd->conf->mld_ap)
2321 tailpos = hostapd_eid_eht_ml_beacon(hapd, NULL,
2322 tailpos, false);
2323 tailpos = hostapd_eid_eht_capab(hapd, tailpos,
2324 IEEE80211_MODE_AP);
2325 tailpos = hostapd_eid_eht_operation(hapd, tailpos);
2326 }
2327 #endif /* CONFIG_IEEE80211BE */
2328
2329 #ifdef CONFIG_IEEE80211AC
2330 if (hapd->conf->vendor_vht)
2331 tailpos = hostapd_eid_vendor_vht(hapd, tailpos);
2332 #endif /* CONFIG_IEEE80211AC */
2333
2334 /* WPA / OSEN */
2335 tailpos = hostapd_get_wpa_ie(hapd, tailpos, tailend - tailpos);
2336 tailpos = hostapd_get_osen_ie(hapd, tailpos, tailend - tailpos);
2337
2338 /* Wi-Fi Alliance WMM */
2339 tailpos = hostapd_eid_wmm(hapd, tailpos);
2340
2341 #ifdef CONFIG_WPS
2342 if (hapd->conf->wps_state && hapd->wps_beacon_ie) {
2343 os_memcpy(tailpos, wpabuf_head(hapd->wps_beacon_ie),
2344 wpabuf_len(hapd->wps_beacon_ie));
2345 tailpos += wpabuf_len(hapd->wps_beacon_ie);
2346 }
2347 #endif /* CONFIG_WPS */
2348
2349 #ifdef CONFIG_P2P
2350 if ((hapd->conf->p2p & P2P_ENABLED) && hapd->p2p_beacon_ie) {
2351 os_memcpy(tailpos, wpabuf_head(hapd->p2p_beacon_ie),
2352 wpabuf_len(hapd->p2p_beacon_ie));
2353 tailpos += wpabuf_len(hapd->p2p_beacon_ie);
2354 }
2355 #endif /* CONFIG_P2P */
2356 #ifdef CONFIG_P2P_MANAGER
2357 if ((hapd->conf->p2p & (P2P_MANAGE | P2P_ENABLED | P2P_GROUP_OWNER)) ==
2358 P2P_MANAGE)
2359 tailpos = hostapd_eid_p2p_manage(hapd, tailpos);
2360 #endif /* CONFIG_P2P_MANAGER */
2361
2362 #ifdef CONFIG_HS20
2363 tailpos = hostapd_eid_hs20_indication(hapd, tailpos);
2364 #endif /* CONFIG_HS20 */
2365
2366 tailpos = hostapd_eid_mbo(hapd, tailpos, tail + tail_len - tailpos);
2367 tailpos = hostapd_eid_owe_trans(hapd, tailpos,
2368 tail + tail_len - tailpos);
2369 tailpos = hostapd_eid_dpp_cc(hapd, tailpos, tail + tail_len - tailpos);
2370
2371 if (hapd->conf->vendor_elements) {
2372 os_memcpy(tailpos, wpabuf_head(hapd->conf->vendor_elements),
2373 wpabuf_len(hapd->conf->vendor_elements));
2374 tailpos += wpabuf_len(hapd->conf->vendor_elements);
2375 }
2376
2377 tail_len = tailpos > tail ? tailpos - tail : 0;
2378
2379 resp = hostapd_probe_resp_offloads(hapd, &resp_len);
2380 #endif /* NEED_AP_MLME */
2381
2382 /* If key management offload is enabled, configure PSK to the driver. */
2383 if (wpa_key_mgmt_wpa_psk_no_sae(hapd->conf->wpa_key_mgmt) &&
2384 (hapd->iface->drv_flags2 &
2385 WPA_DRIVER_FLAGS2_4WAY_HANDSHAKE_AP_PSK)) {
2386 if (hapd->conf->ssid.wpa_psk && hapd->conf->ssid.wpa_psk_set) {
2387 os_memcpy(params->psk, hapd->conf->ssid.wpa_psk->psk,
2388 PMK_LEN);
2389 params->psk_len = PMK_LEN;
2390 } else if (hapd->conf->ssid.wpa_passphrase &&
2391 pbkdf2_sha1(hapd->conf->ssid.wpa_passphrase,
2392 hapd->conf->ssid.ssid,
2393 hapd->conf->ssid.ssid_len, 4096,
2394 params->psk, PMK_LEN) == 0) {
2395 params->psk_len = PMK_LEN;
2396 }
2397 }
2398
2399 #ifdef CONFIG_SAE
2400 /* If SAE offload is enabled, provide password to lower layer for
2401 * SAE authentication and PMK generation.
2402 */
2403 if (wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
2404 (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SAE_OFFLOAD_AP)) {
2405 if (hostapd_sae_pk_in_use(hapd->conf)) {
2406 wpa_printf(MSG_ERROR,
2407 "SAE PK not supported with SAE offload");
2408 return -1;
2409 }
2410
2411 if (hostapd_sae_pw_id_in_use(hapd->conf)) {
2412 wpa_printf(MSG_ERROR,
2413 "SAE Password Identifiers not supported with SAE offload");
2414 return -1;
2415 }
2416
2417 params->sae_password = sae_get_password(hapd, NULL, NULL, NULL,
2418 NULL, NULL);
2419 if (!params->sae_password) {
2420 wpa_printf(MSG_ERROR, "SAE password not configured for offload");
2421 return -1;
2422 }
2423 }
2424 #endif /* CONFIG_SAE */
2425
2426 params->head = (u8 *) head;
2427 params->head_len = head_len;
2428 params->tail = tail;
2429 params->tail_len = tail_len;
2430 params->proberesp = resp;
2431 params->proberesp_len = resp_len;
2432 params->dtim_period = hapd->conf->dtim_period;
2433 params->beacon_int = hapd->iconf->beacon_int;
2434 params->basic_rates = hapd->iface->basic_rates;
2435 params->beacon_rate = hapd->iconf->beacon_rate;
2436 params->rate_type = hapd->iconf->rate_type;
2437 params->ssid = hapd->conf->ssid.ssid;
2438 params->ssid_len = hapd->conf->ssid.ssid_len;
2439 if ((hapd->conf->wpa & (WPA_PROTO_WPA | WPA_PROTO_RSN)) ==
2440 (WPA_PROTO_WPA | WPA_PROTO_RSN))
2441 params->pairwise_ciphers = hapd->conf->wpa_pairwise |
2442 hapd->conf->rsn_pairwise;
2443 else if (hapd->conf->wpa & WPA_PROTO_RSN)
2444 params->pairwise_ciphers = hapd->conf->rsn_pairwise;
2445 else if (hapd->conf->wpa & WPA_PROTO_WPA)
2446 params->pairwise_ciphers = hapd->conf->wpa_pairwise;
2447 params->group_cipher = hapd->conf->wpa_group;
2448 params->key_mgmt_suites = hapd->conf->wpa_key_mgmt;
2449 params->auth_algs = hapd->conf->auth_algs;
2450 params->wpa_version = hapd->conf->wpa;
2451 params->privacy = hapd->conf->wpa;
2452 #ifdef CONFIG_WEP
2453 params->privacy |= hapd->conf->ssid.wep.keys_set ||
2454 (hapd->conf->ieee802_1x &&
2455 (hapd->conf->default_wep_key_len ||
2456 hapd->conf->individual_wep_key_len));
2457 #endif /* CONFIG_WEP */
2458 switch (hapd->conf->ignore_broadcast_ssid) {
2459 case 0:
2460 params->hide_ssid = NO_SSID_HIDING;
2461 break;
2462 case 1:
2463 params->hide_ssid = HIDDEN_SSID_ZERO_LEN;
2464 break;
2465 case 2:
2466 params->hide_ssid = HIDDEN_SSID_ZERO_CONTENTS;
2467 break;
2468 }
2469 params->isolate = hapd->conf->isolate;
2470 #ifdef NEED_AP_MLME
2471 params->cts_protect = !!(ieee802_11_erp_info(hapd) &
2472 ERP_INFO_USE_PROTECTION);
2473 params->preamble = hapd->iface->num_sta_no_short_preamble == 0 &&
2474 hapd->iconf->preamble == SHORT_PREAMBLE;
2475 if (hapd->iface->current_mode &&
2476 hapd->iface->current_mode->mode == HOSTAPD_MODE_IEEE80211G)
2477 params->short_slot_time =
2478 hapd->iface->num_sta_no_short_slot_time > 0 ? 0 : 1;
2479 else
2480 params->short_slot_time = -1;
2481 if (!hapd->iconf->ieee80211n || hapd->conf->disable_11n)
2482 params->ht_opmode = -1;
2483 else
2484 params->ht_opmode = hapd->iface->ht_op_mode;
2485 #endif /* NEED_AP_MLME */
2486 params->interworking = hapd->conf->interworking;
2487 if (hapd->conf->interworking &&
2488 !is_zero_ether_addr(hapd->conf->hessid))
2489 params->hessid = hapd->conf->hessid;
2490 params->access_network_type = hapd->conf->access_network_type;
2491 params->ap_max_inactivity = hapd->conf->ap_max_inactivity;
2492 #ifdef CONFIG_P2P
2493 params->p2p_go_ctwindow = hapd->iconf->p2p_go_ctwindow;
2494 #endif /* CONFIG_P2P */
2495 #ifdef CONFIG_HS20
2496 params->disable_dgaf = hapd->conf->disable_dgaf;
2497 if (hapd->conf->osen) {
2498 params->privacy = 1;
2499 params->osen = 1;
2500 }
2501 #endif /* CONFIG_HS20 */
2502 params->multicast_to_unicast = hapd->conf->multicast_to_unicast;
2503 params->pbss = hapd->conf->pbss;
2504
2505 if (hapd->conf->ftm_responder) {
2506 if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_FTM_RESPONDER) {
2507 params->ftm_responder = 1;
2508 params->lci = hapd->iface->conf->lci;
2509 params->civic = hapd->iface->conf->civic;
2510 } else {
2511 wpa_printf(MSG_WARNING,
2512 "Not configuring FTM responder as the driver doesn't advertise support for it");
2513 }
2514 }
2515
2516 #ifdef CONFIG_IEEE80211BE
2517 if (hapd->conf->mld_ap && hapd->iconf->ieee80211be &&
2518 !hapd->conf->disable_11be) {
2519 params->mld_ap = true;
2520 params->mld_link_id = hapd->mld_link_id;
2521 }
2522 #endif /* CONFIG_IEEE80211BE */
2523
2524 return 0;
2525 }
2526
2527
ieee802_11_free_ap_params(struct wpa_driver_ap_params * params)2528 void ieee802_11_free_ap_params(struct wpa_driver_ap_params *params)
2529 {
2530 os_free(params->tail);
2531 params->tail = NULL;
2532 os_free(params->head);
2533 params->head = NULL;
2534 os_free(params->proberesp);
2535 params->proberesp = NULL;
2536 os_free(params->mbssid_elem);
2537 params->mbssid_elem = NULL;
2538 os_free(params->mbssid_elem_offset);
2539 params->mbssid_elem_offset = NULL;
2540 os_free(params->rnr_elem);
2541 params->rnr_elem = NULL;
2542 os_free(params->rnr_elem_offset);
2543 params->rnr_elem_offset = NULL;
2544 #ifdef CONFIG_FILS
2545 os_free(params->fd_frame_tmpl);
2546 params->fd_frame_tmpl = NULL;
2547 #endif /* CONFIG_FILS */
2548 #ifdef CONFIG_IEEE80211AX
2549 os_free(params->ubpr.unsol_bcast_probe_resp_tmpl);
2550 params->ubpr.unsol_bcast_probe_resp_tmpl = NULL;
2551 #endif /* CONFIG_IEEE80211AX */
2552 os_free(params->allowed_freqs);
2553 params->allowed_freqs = NULL;
2554 }
2555
2556
__ieee802_11_set_beacon(struct hostapd_data * hapd)2557 static int __ieee802_11_set_beacon(struct hostapd_data *hapd)
2558 {
2559 struct wpa_driver_ap_params params;
2560 struct hostapd_freq_params freq;
2561 struct hostapd_iface *iface = hapd->iface;
2562 struct hostapd_config *iconf = iface->conf;
2563 struct hostapd_hw_modes *cmode = iface->current_mode;
2564 struct wpabuf *beacon, *proberesp, *assocresp;
2565 bool twt_he_responder = false;
2566 int res, ret = -1, i;
2567 struct hostapd_hw_modes *mode;
2568
2569 if (!hapd->drv_priv) {
2570 wpa_printf(MSG_ERROR, "Interface is disabled");
2571 return -1;
2572 }
2573
2574 if (hapd->csa_in_progress) {
2575 wpa_printf(MSG_ERROR, "Cannot set beacons during CSA period");
2576 return -1;
2577 }
2578
2579 hapd->beacon_set_done = 1;
2580
2581 if (ieee802_11_build_ap_params(hapd, ¶ms) < 0)
2582 return -1;
2583
2584 if (hostapd_build_ap_extra_ies(hapd, &beacon, &proberesp, &assocresp) <
2585 0)
2586 goto fail;
2587
2588 params.beacon_ies = beacon;
2589 params.proberesp_ies = proberesp;
2590 params.assocresp_ies = assocresp;
2591 params.reenable = hapd->reenable_beacon;
2592 #ifdef CONFIG_IEEE80211AX
2593 params.he_spr_ctrl = hapd->iface->conf->spr.sr_control;
2594 params.he_spr_non_srg_obss_pd_max_offset =
2595 hapd->iface->conf->spr.non_srg_obss_pd_max_offset;
2596 params.he_spr_srg_obss_pd_min_offset =
2597 hapd->iface->conf->spr.srg_obss_pd_min_offset;
2598 params.he_spr_srg_obss_pd_max_offset =
2599 hapd->iface->conf->spr.srg_obss_pd_max_offset;
2600 os_memcpy(params.he_spr_bss_color_bitmap,
2601 hapd->iface->conf->spr.srg_bss_color_bitmap, 8);
2602 os_memcpy(params.he_spr_partial_bssid_bitmap,
2603 hapd->iface->conf->spr.srg_partial_bssid_bitmap, 8);
2604 params.he_bss_color_disabled =
2605 hapd->iface->conf->he_op.he_bss_color_disabled;
2606 params.he_bss_color_partial =
2607 hapd->iface->conf->he_op.he_bss_color_partial;
2608 params.he_bss_color = hapd->iface->conf->he_op.he_bss_color;
2609 twt_he_responder = hostapd_get_he_twt_responder(hapd,
2610 IEEE80211_MODE_AP);
2611 params.ubpr.unsol_bcast_probe_resp_tmpl =
2612 hostapd_unsol_bcast_probe_resp(hapd, ¶ms.ubpr);
2613 #endif /* CONFIG_IEEE80211AX */
2614 params.twt_responder =
2615 twt_he_responder || hostapd_get_ht_vht_twt_responder(hapd);
2616 hapd->reenable_beacon = 0;
2617 #ifdef CONFIG_SAE
2618 params.sae_pwe = hapd->conf->sae_pwe;
2619 #endif /* CONFIG_SAE */
2620
2621 #ifdef CONFIG_FILS
2622 params.fd_frame_tmpl = hostapd_fils_discovery(hapd, ¶ms);
2623 #endif /* CONFIG_FILS */
2624
2625 #ifdef CONFIG_IEEE80211BE
2626 params.punct_bitmap = iconf->punct_bitmap;
2627 #endif /* CONFIG_IEEE80211BE */
2628
2629 if (cmode &&
2630 hostapd_set_freq_params(&freq, iconf->hw_mode, iface->freq,
2631 iconf->channel, iconf->enable_edmg,
2632 iconf->edmg_channel, iconf->ieee80211n,
2633 iconf->ieee80211ac, iconf->ieee80211ax,
2634 iconf->ieee80211be,
2635 iconf->secondary_channel,
2636 hostapd_get_oper_chwidth(iconf),
2637 hostapd_get_oper_centr_freq_seg0_idx(iconf),
2638 hostapd_get_oper_centr_freq_seg1_idx(iconf),
2639 cmode->vht_capab,
2640 &cmode->he_capab[IEEE80211_MODE_AP],
2641 &cmode->eht_capab[IEEE80211_MODE_AP],
2642 hostapd_get_punct_bitmap(hapd)) == 0) {
2643 freq.link_id = -1;
2644 #ifdef CONFIG_IEEE80211BE
2645 if (hapd->conf->mld_ap)
2646 freq.link_id = hapd->mld_link_id;
2647 #endif /* CONFIG_IEEE80211BE */
2648 params.freq = &freq;
2649 }
2650
2651 for (i = 0; i < hapd->iface->num_hw_features; i++) {
2652 mode = &hapd->iface->hw_features[i];
2653
2654 if (iconf->hw_mode != HOSTAPD_MODE_IEEE80211ANY &&
2655 iconf->hw_mode != mode->mode)
2656 continue;
2657
2658 hostapd_get_hw_mode_any_channels(hapd, mode,
2659 !(iconf->acs_freq_list.num ||
2660 iconf->acs_ch_list.num),
2661 true, ¶ms.allowed_freqs);
2662 }
2663
2664 res = hostapd_drv_set_ap(hapd, ¶ms);
2665 hostapd_free_ap_extra_ies(hapd, beacon, proberesp, assocresp);
2666 if (res)
2667 wpa_printf(MSG_ERROR, "Failed to set beacon parameters");
2668 else
2669 ret = 0;
2670 fail:
2671 ieee802_11_free_ap_params(¶ms);
2672 return ret;
2673 }
2674
2675
ieee802_11_set_beacon_per_bss_only(struct hostapd_data * hapd)2676 void ieee802_11_set_beacon_per_bss_only(struct hostapd_data *hapd)
2677 {
2678 __ieee802_11_set_beacon(hapd);
2679 }
2680
2681
ieee802_11_set_beacon(struct hostapd_data * hapd)2682 int ieee802_11_set_beacon(struct hostapd_data *hapd)
2683 {
2684 struct hostapd_iface *iface = hapd->iface;
2685 int ret;
2686 size_t i, j;
2687 bool is_6g, hapd_mld = false;
2688
2689 ret = __ieee802_11_set_beacon(hapd);
2690 if (ret != 0)
2691 return ret;
2692
2693 if (!iface->interfaces || iface->interfaces->count <= 1)
2694 return 0;
2695
2696 #ifdef CONFIG_IEEE80211BE
2697 hapd_mld = hapd->conf->mld_ap;
2698 #endif /* CONFIG_IEEE80211BE */
2699
2700 /* Update Beacon frames in case of 6 GHz colocation or AP MLD */
2701 is_6g = is_6ghz_op_class(iface->conf->op_class);
2702 for (j = 0; j < iface->interfaces->count; j++) {
2703 struct hostapd_iface *other;
2704 bool other_iface_6g;
2705
2706 other = iface->interfaces->iface[j];
2707 if (other == iface || !other || !other->conf)
2708 continue;
2709
2710 other_iface_6g = is_6ghz_op_class(other->conf->op_class);
2711
2712 if (is_6g == other_iface_6g && !hapd_mld)
2713 continue;
2714
2715 for (i = 0; i < other->num_bss; i++) {
2716 #ifdef CONFIG_IEEE80211BE
2717 if (is_6g == other_iface_6g &&
2718 !(hapd_mld && other->bss[i]->conf->mld_ap &&
2719 hostapd_is_ml_partner(hapd, other->bss[i])))
2720 continue;
2721 #endif /* CONFIG_IEEE80211BE */
2722
2723 if (other->bss[i] && other->bss[i]->started)
2724 __ieee802_11_set_beacon(other->bss[i]);
2725 }
2726 }
2727
2728 return 0;
2729 }
2730
2731
ieee802_11_set_beacons(struct hostapd_iface * iface)2732 int ieee802_11_set_beacons(struct hostapd_iface *iface)
2733 {
2734 size_t i;
2735 int ret = 0;
2736
2737 for (i = 0; i < iface->num_bss; i++) {
2738 if (iface->bss[i]->started &&
2739 ieee802_11_set_beacon(iface->bss[i]) < 0)
2740 ret = -1;
2741 }
2742
2743 return ret;
2744 }
2745
2746
2747 /* only update beacons if started */
ieee802_11_update_beacons(struct hostapd_iface * iface)2748 int ieee802_11_update_beacons(struct hostapd_iface *iface)
2749 {
2750 size_t i;
2751 int ret = 0;
2752
2753 for (i = 0; i < iface->num_bss; i++) {
2754 if (iface->bss[i]->beacon_set_done && iface->bss[i]->started &&
2755 ieee802_11_set_beacon(iface->bss[i]) < 0)
2756 ret = -1;
2757 }
2758
2759 return ret;
2760 }
2761
2762 #endif /* CONFIG_NATIVE_WINDOWS */
2763