projects / openwrt.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
history | raw | HEAD
GPIODEV: Fix open-count race condition.
[openwrt.git] / package / hostapd / patches / 002-add-nl80211-driver.patch
1 diff -urN hostapd.orig/driver_nl80211.c hostapd/driver_nl80211.c
2 --- a/hostapd/driver_nl80211.c 1970-01-01 01:00:00.000000000 +0100
3 +++ b/hostapd/driver_nl80211.c 2008-02-16 19:46:38.000000000 +0100
4 @@ -0,0 +1,2382 @@
5 +/*
6 + * hostapd / Kernel driver communication via nl80211
7 + * Copyright (c) 2002-2007, Jouni Malinen <j@w1.fi>
8 + * Copyright (c) 2003-2004, Instant802 Networks, Inc.
9 + * Copyright (c) 2005-2006, Devicescape Software, Inc.
10 + * Copyright (c) 2007, Johannes Berg <johannes@sipsolutions.net>
11 + *
12 + * This program is free software; you can redistribute it and/or modify
13 + * it under the terms of the GNU General Public License version 2 as
14 + * published by the Free Software Foundation.
15 + *
16 + * Alternatively, this software may be distributed under the terms of BSD
17 + * license.
18 + *
19 + * See README and COPYING for more details.
20 + */
21 +
22 +#include "includes.h"
23 +
24 +#include <sys/ioctl.h>
25 +#include <netlink/genl/genl.h>
26 +#include <netlink/genl/family.h>
27 +#include <netlink/genl/ctrl.h>
28 +#include <netlink/msg.h>
29 +#include <netlink/attr.h>
30 +#include <linux/nl80211.h>
31 +#include <net/if.h>
32 +#include <linux/if_packet.h>
33 +#include <linux/if_ether.h> /* The L2 protocols */
34 +#include <linux/wireless.h>
35 +#include <net/if_arp.h>
36 +
37 +#include "hostapd.h"
38 +#include "driver.h"
39 +#include "ieee802_1x.h"
40 +#include "eloop.h"
41 +#include "ieee802_11.h"
42 +#include "sta_info.h"
43 +#include "hw_features.h"
44 +#include "mlme.h"
45 +#include "radiotap.h"
46 +#include "radiotap_iter.h"
47 +
48 +enum ieee80211_msg_type {
49 + ieee80211_msg_normal = 0,
50 + ieee80211_msg_tx_callback_ack = 1,
51 + ieee80211_msg_tx_callback_fail = 2,
52 +};
53 +
54 +struct i802_driver_data {
55 + struct hostapd_data *hapd;
56 +
57 + char iface[IFNAMSIZ + 1];
58 + int ioctl_sock; /* socket for ioctl() use */
59 + int wext_sock; /* socket for wireless events */
60 + int eapol_sock; /* socket for EAPOL frames */
61 + int monitor_sock; /* socket for monitor */
62 + int monitor_ifidx;
63 +
64 + int default_if_indices[16];
65 + int *if_indices;
66 + int num_if_indices;
67 +
68 + int we_version;
69 + struct nl_handle *nl_handle;
70 + struct nl_cache *nl_cache;
71 + struct genl_family *nl80211;
72 + int dtim_period;
73 + unsigned int beacon_set:1;
74 + unsigned int ieee802_1x_active:1;
75 +};
76 +
77 +
78 +static void add_ifidx(struct i802_driver_data *drv, int ifidx)
79 +{
80 + int i;
81 + int *old;
82 +
83 + for (i = 0; i < drv->num_if_indices; i++) {
84 + if (drv->if_indices[i] == 0) {
85 + drv->if_indices[i] = ifidx;
86 + return;
87 + }
88 + }
89 +
90 + if (drv->if_indices != drv->default_if_indices)
91 + old = drv->if_indices;
92 + else
93 + old = NULL;
94 +
95 + drv->if_indices = realloc(old,
96 + sizeof(int) * (drv->num_if_indices + 1));
97 + if (!drv->if_indices) {
98 + if (!old)
99 + drv->if_indices = drv->default_if_indices;
100 + else
101 + drv->if_indices = old;
102 + wpa_printf(MSG_ERROR, "Failed to reallocate memory for "
103 + "interfaces");
104 + wpa_printf(MSG_ERROR, "Ignoring EAPOL on interface %d", ifidx);
105 + return;
106 + }
107 + drv->if_indices[drv->num_if_indices] = ifidx;
108 + drv->num_if_indices++;
109 +}
110 +
111 +
112 +static void del_ifidx(struct i802_driver_data *drv, int ifidx)
113 +{
114 + int i;
115 +
116 + for (i = 0; i < drv->num_if_indices; i++) {
117 + if (drv->if_indices[i] == ifidx) {
118 + drv->if_indices[i] = 0;
119 + break;
120 + }
121 + }
122 +}
123 +
124 +
125 +static int have_ifidx(struct i802_driver_data *drv, int ifidx)
126 +{
127 + int i;
128 +
129 + for (i = 0; i < drv->num_if_indices; i++)
130 + if (drv->if_indices[i] == ifidx)
131 + return 1;
132 +
133 + return 0;
134 +}
135 +
136 +
137 +/* helper for netlink get routines */
138 +static int ack_wait_handler(struct nl_msg *msg, void *arg)
139 +{
140 + int *finished = arg;
141 +
142 + *finished = 1;
143 + return NL_STOP;
144 +}
145 +
146 +
147 +static int hostapd_set_iface_flags(struct i802_driver_data *drv,
148 + const char *ifname, int dev_up)
149 +{
150 + struct ifreq ifr;
151 +
152 + if (drv->ioctl_sock < 0)
153 + return -1;
154 +
155 + memset(&ifr, 0, sizeof(ifr));
156 + os_strlcpy(ifr.ifr_name, ifname, IFNAMSIZ);
157 +
158 + if (ioctl(drv->ioctl_sock, SIOCGIFFLAGS, &ifr) != 0) {
159 + perror("ioctl[SIOCGIFFLAGS]");
160 + wpa_printf(MSG_DEBUG, "Could not read interface flags (%s)",
161 + drv->iface);
162 + return -1;
163 + }
164 +
165 + if (dev_up)
166 + ifr.ifr_flags |= IFF_UP;
167 + else
168 + ifr.ifr_flags &= ~IFF_UP;
169 +
170 + if (ioctl(drv->ioctl_sock, SIOCSIFFLAGS, &ifr) != 0) {
171 + perror("ioctl[SIOCSIFFLAGS]");
172 + return -1;
173 + }
174 +
175 + return 0;
176 +}
177 +
178 +
179 +static int i802_set_encryption(const char *iface, void *priv, const char *alg,
180 + const u8 *addr, int idx, const u8 *key,
181 + size_t key_len, int txkey)
182 +{
183 + struct i802_driver_data *drv = priv;
184 + struct nl_msg *msg;
185 + int ret = -1;
186 + int err = 0;
187 +
188 + msg = nlmsg_alloc();
189 + if (!msg)
190 + goto out;
191 +
192 + if (strcmp(alg, "none") == 0) {
193 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
194 + 0, NL80211_CMD_DEL_KEY, 0);
195 + } else {
196 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
197 + 0, NL80211_CMD_NEW_KEY, 0);
198 + NLA_PUT(msg, NL80211_ATTR_KEY_DATA, key_len, key);
199 + if (strcmp(alg, "WEP") == 0) {
200 + if (key_len == 5)
201 + NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
202 + 0x000FAC01);
203 + else
204 + NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER,
205 + 0x000FAC05);
206 + } else if (strcmp(alg, "TKIP") == 0)
207 + NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC02);
208 + else if (strcmp(alg, "CCMP") == 0)
209 + NLA_PUT_U32(msg, NL80211_ATTR_KEY_CIPHER, 0x000FAC04);
210 + else
211 + goto out;
212 + }
213 +
214 + if (addr)
215 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
216 + NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
217 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
218 +
219 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
220 + (err = nl_wait_for_ack(drv->nl_handle)) < 0) {
221 + if (err != -ENOENT) {
222 + err = 0;
223 + goto out;
224 + }
225 + }
226 +
227 + /*
228 + * If we need to set the default TX key we do that below,
229 + * otherwise we're done here.
230 + */
231 + if (!txkey || addr) {
232 + ret = 0;
233 + goto out;
234 + }
235 +
236 + nlmsg_free(msg);
237 +
238 + msg = nlmsg_alloc();
239 + if (!msg)
240 + goto out;
241 +
242 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
243 + 0, NL80211_CMD_SET_KEY, 0);
244 + NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
245 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
246 + NLA_PUT_FLAG(msg, NL80211_ATTR_KEY_DEFAULT);
247 +
248 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
249 + (err = nl_wait_for_ack(drv->nl_handle)) < 0) {
250 + if (err != -ENOENT) {
251 + err = 0;
252 + goto out;
253 + }
254 + }
255 +
256 + ret = 0;
257 +
258 + out:
259 + nla_put_failure:
260 + nlmsg_free(msg);
261 + return ret;
262 +}
263 +
264 +
265 +static inline int min_int(int a, int b)
266 +{
267 + if (a < b)
268 + return a;
269 + return b;
270 +}
271 +
272 +
273 +static int get_key_handler(struct nl_msg *msg, void *arg)
274 +{
275 + struct nlattr *tb[NL80211_ATTR_MAX];
276 + struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
277 +
278 + nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
279 + genlmsg_attrlen(gnlh, 0), NULL);
280 +
281 + /*
282 + * TODO: validate the key index and mac address!
283 + * Otherwise, there's a race condition as soon as
284 + * the kernel starts sending key notifications.
285 + */
286 +
287 + if (tb[NL80211_ATTR_KEY_SEQ])
288 + memcpy(arg, nla_data(tb[NL80211_ATTR_KEY_SEQ]),
289 + min_int(nla_len(tb[NL80211_ATTR_KEY_SEQ]), 6));
290 + return NL_SKIP;
291 +}
292 +
293 +
294 +static int i802_get_seqnum(const char *iface, void *priv, const u8 *addr,
295 + int idx, u8 *seq)
296 +{
297 + struct i802_driver_data *drv = priv;
298 + struct nl_msg *msg;
299 + struct nl_cb *cb = NULL;
300 + int ret = -1;
301 + int err = 0;
302 + int finished = 0;
303 +
304 + msg = nlmsg_alloc();
305 + if (!msg)
306 + goto out;
307 +
308 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
309 + 0, NL80211_CMD_GET_KEY, 0);
310 +
311 + if (addr)
312 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
313 + NLA_PUT_U8(msg, NL80211_ATTR_KEY_IDX, idx);
314 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
315 +
316 + cb = nl_cb_alloc(NL_CB_CUSTOM);
317 + if (!cb)
318 + goto out;
319 +
320 + memset(seq, 0, 6);
321 +
322 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0)
323 + goto out;
324 +
325 + nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, get_key_handler, seq);
326 + nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_wait_handler, &finished);
327 +
328 + err = nl_recvmsgs(drv->nl_handle, cb);
329 +
330 + if (!finished)
331 + err = nl_wait_for_ack(drv->nl_handle);
332 +
333 + if (err < 0)
334 + goto out;
335 +
336 + ret = 0;
337 +
338 + out:
339 + nl_cb_put(cb);
340 + nla_put_failure:
341 + nlmsg_free(msg);
342 + return ret;
343 +}
344 +
345 +
346 +static int i802_set_rate_sets(void *priv, int *supp_rates, int *basic_rates,
347 + int mode)
348 +{
349 + return -1;
350 +}
351 +
352 +
353 +static int i802_set_ssid(const char *ifname, void *priv, const u8 *buf,
354 + int len)
355 +{
356 + struct i802_driver_data *drv = priv;
357 + struct iwreq iwr;
358 +
359 + memset(&iwr, 0, sizeof(iwr));
360 + os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
361 + iwr.u.essid.flags = 1; /* SSID active */
362 + iwr.u.essid.pointer = (caddr_t) buf;
363 + iwr.u.essid.length = len;
364 +
365 + if (ioctl(drv->ioctl_sock, SIOCSIWESSID, &iwr) < 0) {
366 + perror("ioctl[SIOCSIWESSID]");
367 + printf("len=%d\n", len);
368 + return -1;
369 + }
370 +
371 + return 0;
372 +}
373 +
374 +
375 +static int i802_send_mgmt_frame(void *priv, const void *data, size_t len,
376 + int flags)
377 +{
378 + struct ieee80211_hdr *hdr = (void*) data;
379 + __u8 rtap_hdr[] = {
380 + 0x00, 0x00, /* radiotap version */
381 + 0x0e, 0x00, /* radiotap length */
382 + 0x02, 0xc0, 0x00, 0x00, /* bmap: flags, tx and rx flags */
383 + 0x0c, /* F_WEP | F_FRAG (encrypt/fragment if required) */
384 + 0x00, /* padding */
385 + 0x00, 0x00, /* RX and TX flags to indicate that */
386 + 0x00, 0x00, /* this is the injected frame directly */
387 + };
388 + struct i802_driver_data *drv = priv;
389 + struct iovec iov[2] = {
390 + {
391 + .iov_base = &rtap_hdr,
392 + .iov_len = sizeof(rtap_hdr),
393 + },
394 + {
395 + .iov_base = (void*)data,
396 + .iov_len = len,
397 + }
398 + };
399 + struct msghdr msg = {
400 + .msg_name = NULL,
401 + .msg_namelen = 0,
402 + .msg_iov = iov,
403 + .msg_iovlen = 2,
404 + .msg_control = NULL,
405 + .msg_controllen = 0,
406 + .msg_flags = 0,
407 + };
408 +
409 + /*
410 + * ugh, guess what, the generic code sets one of the version
411 + * bits to request tx callback
412 + */
413 + hdr->frame_control &= ~host_to_le16(BIT(1));
414 + return sendmsg(drv->monitor_sock, &msg, flags);
415 +}
416 +
417 +
418 +/* Set kernel driver on given frequency (MHz) */
419 +static int i802_set_freq(void *priv, int mode, int freq)
420 +{
421 + struct i802_driver_data *drv = priv;
422 + struct iwreq iwr;
423 +
424 + memset(&iwr, 0, sizeof(iwr));
425 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
426 + iwr.u.freq.m = freq;
427 + iwr.u.freq.e = 6;
428 +
429 + if (ioctl(drv->ioctl_sock, SIOCSIWFREQ, &iwr) < 0) {
430 + perror("ioctl[SIOCSIWFREQ]");
431 + return -1;
432 + }
433 +
434 + return 0;
435 +}
436 +
437 +
438 +static int i802_set_rts(void *priv, int rts)
439 +{
440 + struct i802_driver_data *drv = priv;
441 + struct iwreq iwr;
442 +
443 + memset(&iwr, 0, sizeof(iwr));
444 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
445 + iwr.u.rts.value = rts;
446 + iwr.u.rts.fixed = 1;
447 +
448 + if (ioctl(drv->ioctl_sock, SIOCSIWRTS, &iwr) < 0) {
449 + perror("ioctl[SIOCSIWRTS]");
450 + return -1;
451 + }
452 +
453 + return 0;
454 +}
455 +
456 +
457 +static int i802_get_rts(void *priv, int *rts)
458 +{
459 + struct i802_driver_data *drv = priv;
460 + struct iwreq iwr;
461 +
462 + memset(&iwr, 0, sizeof(iwr));
463 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
464 +
465 + if (ioctl(drv->ioctl_sock, SIOCGIWRTS, &iwr) < 0) {
466 + perror("ioctl[SIOCGIWRTS]");
467 + return -1;
468 + }
469 +
470 + *rts = iwr.u.rts.value;
471 +
472 + return 0;
473 +}
474 +
475 +
476 +static int i802_set_frag(void *priv, int frag)
477 +{
478 + struct i802_driver_data *drv = priv;
479 + struct iwreq iwr;
480 +
481 + memset(&iwr, 0, sizeof(iwr));
482 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
483 + iwr.u.frag.value = frag;
484 + iwr.u.frag.fixed = 1;
485 +
486 + if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
487 + perror("ioctl[SIOCSIWFRAG]");
488 + return -1;
489 + }
490 +
491 + return 0;
492 +}
493 +
494 +
495 +static int i802_get_frag(void *priv, int *frag)
496 +{
497 + struct i802_driver_data *drv = priv;
498 + struct iwreq iwr;
499 +
500 + memset(&iwr, 0, sizeof(iwr));
501 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
502 +
503 + if (ioctl(drv->ioctl_sock, SIOCGIWFRAG, &iwr) < 0) {
504 + perror("ioctl[SIOCGIWFRAG]");
505 + return -1;
506 + }
507 +
508 + *frag = iwr.u.frag.value;
509 +
510 + return 0;
511 +}
512 +
513 +
514 +static int i802_set_retry(void *priv, int short_retry, int long_retry)
515 +{
516 + struct i802_driver_data *drv = priv;
517 + struct iwreq iwr;
518 +
519 + memset(&iwr, 0, sizeof(iwr));
520 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
521 +
522 + iwr.u.retry.value = short_retry;
523 + iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
524 + if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
525 + perror("ioctl[SIOCSIWRETRY(short)]");
526 + return -1;
527 + }
528 +
529 + iwr.u.retry.value = long_retry;
530 + iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
531 + if (ioctl(drv->ioctl_sock, SIOCSIWFRAG, &iwr) < 0) {
532 + perror("ioctl[SIOCSIWRETRY(long)]");
533 + return -1;
534 + }
535 +
536 + return 0;
537 +}
538 +
539 +
540 +static int i802_get_retry(void *priv, int *short_retry, int *long_retry)
541 +{
542 + struct i802_driver_data *drv = priv;
543 + struct iwreq iwr;
544 +
545 + memset(&iwr, 0, sizeof(iwr));
546 + os_strlcpy(iwr.ifr_name, drv->hapd->conf->iface, IFNAMSIZ);
547 +
548 + iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MIN;
549 + if (ioctl(drv->ioctl_sock, SIOCGIWRETRY, &iwr) < 0) {
550 + perror("ioctl[SIOCGIWFRAG(short)]");
551 + return -1;
552 + }
553 + *short_retry = iwr.u.retry.value;
554 +
555 + iwr.u.retry.flags = IW_RETRY_LIMIT | IW_RETRY_MAX;
556 + if (ioctl(drv->ioctl_sock, SIOCGIWRETRY, &iwr) < 0) {
557 + perror("ioctl[SIOCGIWFRAG(long)]");
558 + return -1;
559 + }
560 + *long_retry = iwr.u.retry.value;
561 +
562 + return 0;
563 +}
564 +
565 +
566 +static int i802_flush(void *priv)
567 +{
568 + struct i802_driver_data *drv = priv;
569 + struct nl_msg *msg;
570 + int ret = -1;
571 +
572 + msg = nlmsg_alloc();
573 + if (!msg)
574 + goto out;
575 +
576 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
577 + 0, NL80211_CMD_NEW_STATION, 0);
578 +
579 + /*
580 + * XXX: FIX! this needs to flush all VLANs too
581 + */
582 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
583 + if_nametoindex(drv->iface));
584 +
585 + ret = 0;
586 +
587 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
588 + nl_wait_for_ack(drv->nl_handle) < 0) {
589 + ret = -1;
590 + }
591 +
592 + nla_put_failure:
593 + nlmsg_free(msg);
594 +
595 + out:
596 + return ret;
597 +}
598 +
599 +
600 +static int get_sta_handler(struct nl_msg *msg, void *arg)
601 +{
602 + struct nlattr *tb[NL80211_ATTR_MAX + 1];
603 + struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
604 + struct hostap_sta_driver_data *data = arg;
605 + struct nlattr *stats[NL80211_STA_STAT_MAX + 1];
606 + static struct nla_policy stats_policy[NL80211_STA_STAT_MAX + 1] = {
607 + [NL80211_STA_STAT_INACTIVE_TIME] = { .type = NLA_U32 },
608 + [NL80211_STA_STAT_RX_BYTES] = { .type = NLA_U32 },
609 + [NL80211_STA_STAT_TX_BYTES] = { .type = NLA_U32 },
610 + };
611 +
612 + nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
613 + genlmsg_attrlen(gnlh, 0), NULL);
614 +
615 + /*
616 + * TODO: validate the interface and mac address!
617 + * Otherwise, there's a race condition as soon as
618 + * the kernel starts sending station notifications.
619 + */
620 +
621 + if (!tb[NL80211_ATTR_STA_STATS]) {
622 + wpa_printf(MSG_DEBUG, "sta stats missing!");
623 + return NL_SKIP;
624 + }
625 + if (nla_parse_nested(stats, NL80211_STA_STAT_MAX,
626 + tb[NL80211_ATTR_STA_STATS],
627 + stats_policy)) {
628 + wpa_printf(MSG_DEBUG, "failed to parse nested attributes!");
629 + return NL_SKIP;
630 + }
631 +
632 + if (stats[NL80211_STA_STAT_INACTIVE_TIME])
633 + data->inactive_msec =
634 + nla_get_u32(stats[NL80211_STA_STAT_INACTIVE_TIME]);
635 + if (stats[NL80211_STA_STAT_RX_BYTES])
636 + data->rx_bytes = nla_get_u32(stats[NL80211_STA_STAT_RX_BYTES]);
637 + if (stats[NL80211_STA_STAT_TX_BYTES])
638 + data->rx_bytes = nla_get_u32(stats[NL80211_STA_STAT_TX_BYTES]);
639 +
640 + return NL_SKIP;
641 +}
642 +
643 +static int i802_read_sta_data(void *priv, struct hostap_sta_driver_data *data,
644 + const u8 *addr)
645 +{
646 + struct i802_driver_data *drv = priv;
647 + struct nl_msg *msg;
648 + struct nl_cb *cb = NULL;
649 + int ret = -1;
650 + int err = 0;
651 + int finished = 0;
652 +
653 + msg = nlmsg_alloc();
654 + if (!msg)
655 + goto out;
656 +
657 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
658 + 0, NL80211_CMD_GET_STATION, 0);
659 +
660 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
661 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
662 +
663 + cb = nl_cb_alloc(NL_CB_CUSTOM);
664 + if (!cb)
665 + goto out;
666 +
667 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0)
668 + goto out;
669 +
670 + nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, get_sta_handler, data);
671 + nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_wait_handler, &finished);
672 +
673 + err = nl_recvmsgs(drv->nl_handle, cb);
674 +
675 + if (!finished)
676 + err = nl_wait_for_ack(drv->nl_handle);
677 +
678 + if (err < 0)
679 + goto out;
680 +
681 + ret = 0;
682 +
683 + out:
684 + nl_cb_put(cb);
685 + nla_put_failure:
686 + nlmsg_free(msg);
687 + return ret;
688 +
689 +}
690 +
691 +
692 +static int i802_send_eapol(void *priv, const u8 *addr, const u8 *data,
693 + size_t data_len, int encrypt, const u8 *own_addr)
694 +{
695 + struct i802_driver_data *drv = priv;
696 + struct ieee80211_hdr *hdr;
697 + size_t len;
698 + u8 *pos;
699 + int res;
700 +#if 0 /* FIX */
701 + int qos = sta->flags & WLAN_STA_WME;
702 +#else
703 + int qos = 0;
704 +#endif
705 +
706 + len = sizeof(*hdr) + (qos ? 2 : 0) + sizeof(rfc1042_header) + 2 +
707 + data_len;
708 + hdr = os_zalloc(len);
709 + if (hdr == NULL) {
710 + printf("malloc() failed for i802_send_data(len=%lu)\n",
711 + (unsigned long) len);
712 + return -1;
713 + }
714 +
715 + hdr->frame_control =
716 + IEEE80211_FC(WLAN_FC_TYPE_DATA, WLAN_FC_STYPE_DATA);
717 + hdr->frame_control |= host_to_le16(WLAN_FC_FROMDS);
718 + if (encrypt)
719 + hdr->frame_control |= host_to_le16(WLAN_FC_ISWEP);
720 +#if 0 /* To be enabled if qos determination is added above */
721 + if (qos) {
722 + hdr->frame_control |=
723 + host_to_le16(WLAN_FC_STYPE_QOS_DATA << 4);
724 + }
725 +#endif
726 +
727 + memcpy(hdr->IEEE80211_DA_FROMDS, addr, ETH_ALEN);
728 + memcpy(hdr->IEEE80211_BSSID_FROMDS, own_addr, ETH_ALEN);
729 + memcpy(hdr->IEEE80211_SA_FROMDS, own_addr, ETH_ALEN);
730 + pos = (u8 *) (hdr + 1);
731 +
732 +#if 0 /* To be enabled if qos determination is added above */
733 + if (qos) {
734 + /* add an empty QoS header if needed */
735 + pos[0] = 0;
736 + pos[1] = 0;
737 + pos += 2;
738 + }
739 +#endif
740 +
741 + memcpy(pos, rfc1042_header, sizeof(rfc1042_header));
742 + pos += sizeof(rfc1042_header);
743 + WPA_PUT_BE16(pos, ETH_P_PAE);
744 + pos += 2;
745 + memcpy(pos, data, data_len);
746 +
747 + res = i802_send_mgmt_frame(drv, (u8 *) hdr, len, 0);
748 + free(hdr);
749 +
750 + if (res < 0) {
751 + perror("i802_send_eapol: send");
752 + printf("i802_send_eapol - packet len: %lu - failed\n",
753 + (unsigned long) len);
754 + }
755 +
756 + return res;
757 +}
758 +
759 +
760 +static int i802_sta_add(const char *ifname, void *priv, const u8 *addr,
761 + u16 aid, u16 capability, u8 *supp_rates,
762 + size_t supp_rates_len, int flags)
763 +{
764 + struct i802_driver_data *drv = priv;
765 + struct nl_msg *msg;
766 + int ret = -1;
767 +
768 + msg = nlmsg_alloc();
769 + if (!msg)
770 + goto out;
771 +
772 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
773 + 0, NL80211_CMD_NEW_STATION, 0);
774 +
775 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
776 + if_nametoindex(drv->iface));
777 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
778 + NLA_PUT_U16(msg, NL80211_ATTR_STA_AID, aid);
779 + NLA_PUT(msg, NL80211_ATTR_STA_SUPPORTED_RATES, supp_rates_len,
780 + supp_rates);
781 + NLA_PUT_U16(msg, NL80211_ATTR_STA_LISTEN_INTERVAL, 0);
782 +
783 + ret = nl_send_auto_complete(drv->nl_handle, msg);
784 + if (ret < 0)
785 + goto nla_put_failure;
786 +
787 + ret = nl_wait_for_ack(drv->nl_handle);
788 + /* ignore EEXIST, this happens if a STA associates while associated */
789 + if (ret == -EEXIST || ret >= 0)
790 + ret = 0;
791 +
792 + nla_put_failure:
793 + nlmsg_free(msg);
794 +
795 + out:
796 + return ret;
797 +}
798 +
799 +
800 +static int i802_sta_remove(void *priv, const u8 *addr)
801 +{
802 + struct i802_driver_data *drv = priv;
803 + struct nl_msg *msg;
804 + int ret = -1;
805 +
806 + msg = nlmsg_alloc();
807 + if (!msg)
808 + goto out;
809 +
810 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
811 + 0, NL80211_CMD_DEL_STATION, 0);
812 +
813 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
814 + if_nametoindex(drv->iface));
815 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
816 +
817 + ret = 0;
818 +
819 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
820 + nl_wait_for_ack(drv->nl_handle) < 0) {
821 + ret = -1;
822 + }
823 +
824 + nla_put_failure:
825 + nlmsg_free(msg);
826 +
827 + out:
828 + return ret;
829 +}
830 +
831 +
832 +static int i802_sta_set_flags(void *priv, const u8 *addr,
833 + int total_flags, int flags_or, int flags_and)
834 +{
835 + struct i802_driver_data *drv = priv;
836 + struct nl_msg *msg, *flags = NULL;
837 + int ret = -1;
838 +
839 + msg = nlmsg_alloc();
840 + if (!msg)
841 + goto out;
842 +
843 + flags = nlmsg_alloc();
844 + if (!flags)
845 + goto free_msg;
846 +
847 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
848 + 0, NL80211_CMD_SET_STATION, 0);
849 +
850 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
851 + if_nametoindex(drv->iface));
852 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
853 +
854 + if (total_flags & WLAN_STA_AUTHORIZED || !drv->ieee802_1x_active)
855 + NLA_PUT_FLAG(flags, NL80211_STA_FLAG_AUTHORIZED);
856 +
857 + if (total_flags & WLAN_STA_WME)
858 + NLA_PUT_FLAG(flags, NL80211_STA_FLAG_WME);
859 +
860 + if (total_flags & WLAN_STA_SHORT_PREAMBLE)
861 + NLA_PUT_FLAG(flags, NL80211_STA_FLAG_SHORT_PREAMBLE);
862 +
863 + if (nla_put_nested(msg, NL80211_ATTR_STA_FLAGS, flags))
864 + goto nla_put_failure;
865 +
866 + ret = 0;
867 +
868 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
869 + nl_wait_for_ack(drv->nl_handle) < 0) {
870 + ret = -1;
871 + }
872 +
873 + nla_put_failure:
874 + nlmsg_free(flags);
875 +
876 + free_msg:
877 + nlmsg_free(msg);
878 +
879 + out:
880 + return ret;
881 +}
882 +
883 +
884 +static int i802_set_channel_flag(void *priv, int mode, int chan, int flag,
885 + unsigned char power_level,
886 + unsigned char antenna_max)
887 +{
888 + return -1;
889 +}
890 +
891 +
892 +static int i802_set_regulatory_domain(void *priv, unsigned int rd)
893 +{
894 + return -1;
895 +}
896 +
897 +
898 +static int i802_set_tx_queue_params(void *priv, int queue, int aifs,
899 + int cw_min, int cw_max, int burst_time)
900 +{
901 + return -1;
902 +}
903 +
904 +
905 +static void nl80211_remove_iface(struct i802_driver_data *drv, int ifidx)
906 +{
907 + struct nl_msg *msg;
908 +
909 + /* stop listening for EAPOL on this interface */
910 + del_ifidx(drv, ifidx);
911 +
912 + msg = nlmsg_alloc();
913 + if (!msg)
914 + goto nla_put_failure;
915 +
916 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
917 + 0, NL80211_CMD_DEL_INTERFACE, 0);
918 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, ifidx);
919 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
920 + nl_wait_for_ack(drv->nl_handle) < 0)
921 + nla_put_failure:
922 + printf("Failed to remove interface.\n");
923 + nlmsg_free(msg);
924 +}
925 +
926 +
927 +static int nl80211_create_iface(struct i802_driver_data *drv,
928 + const char *ifname,
929 + enum nl80211_iftype iftype,
930 + const u8 *addr)
931 +{
932 + struct nl_msg *msg, *flags = NULL;
933 + int ifidx;
934 + struct ifreq ifreq;
935 + struct iwreq iwr;
936 +
937 + msg = nlmsg_alloc();
938 + if (!msg)
939 + return -1;
940 +
941 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
942 + 0, NL80211_CMD_NEW_INTERFACE, 0);
943 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
944 + if_nametoindex(drv->hapd->conf->iface));
945 + NLA_PUT_STRING(msg, NL80211_ATTR_IFNAME, ifname);
946 + NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, iftype);
947 +
948 + if (iftype == NL80211_IFTYPE_MONITOR) {
949 + int err;
950 +
951 + flags = nlmsg_alloc();
952 + if (!flags)
953 + goto nla_put_failure;
954 +
955 + NLA_PUT_FLAG(flags, NL80211_MNTR_FLAG_COOK_FRAMES);
956 +
957 + err = nla_put_nested(msg, NL80211_ATTR_MNTR_FLAGS, flags);
958 +
959 + nlmsg_free(flags);
960 +
961 + if (err)
962 + goto nla_put_failure;
963 + }
964 +
965 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
966 + nl_wait_for_ack(drv->nl_handle) < 0) {
967 + nla_put_failure:
968 + printf("Failed to create interface %s.\n", ifname);
969 + nlmsg_free(msg);
970 + return -1;
971 + }
972 +
973 + nlmsg_free(msg);
974 +
975 + ifidx = if_nametoindex(ifname);
976 +
977 + if (ifidx <= 0)
978 + return -1;
979 +
980 + /* start listening for EAPOL on this interface */
981 + add_ifidx(drv, ifidx);
982 +
983 + if (addr) {
984 + switch (iftype) {
985 + case NL80211_IFTYPE_AP:
986 + os_strlcpy(ifreq.ifr_name, ifname, IFNAMSIZ);
987 + memcpy(ifreq.ifr_hwaddr.sa_data, addr, ETH_ALEN);
988 + ifreq.ifr_hwaddr.sa_family = ARPHRD_ETHER;
989 +
990 + if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifreq)) {
991 + nl80211_remove_iface(drv, ifidx);
992 + return -1;
993 + }
994 + break;
995 + case NL80211_IFTYPE_WDS:
996 + memset(&iwr, 0, sizeof(iwr));
997 + os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
998 + iwr.u.addr.sa_family = ARPHRD_ETHER;
999 + memcpy(iwr.u.addr.sa_data, addr, ETH_ALEN);
1000 + if (ioctl(drv->ioctl_sock, SIOCSIWAP, &iwr))
1001 + return -1;
1002 + break;
1003 + default:
1004 + /* nothing */
1005 + break;
1006 + }
1007 + }
1008 +
1009 + return ifidx;
1010 +}
1011 +
1012 +
1013 +static int i802_bss_add(void *priv, const char *ifname, const u8 *bssid)
1014 +{
1015 + int ifidx;
1016 +
1017 + /*
1018 + * The kernel supports that when the low-level driver does,
1019 + * but we currently don't because we need per-BSS data that
1020 + * currently we can't handle easily.
1021 + */
1022 + return -1;
1023 +
1024 + ifidx = nl80211_create_iface(priv, ifname, NL80211_IFTYPE_AP, bssid);
1025 + if (ifidx < 0)
1026 + return -1;
1027 + if (hostapd_set_iface_flags(priv, ifname, 1)) {
1028 + nl80211_remove_iface(priv, ifidx);
1029 + return -1;
1030 + }
1031 + return 0;
1032 +}
1033 +
1034 +
1035 +static int i802_bss_remove(void *priv, const char *ifname)
1036 +{
1037 + nl80211_remove_iface(priv, if_nametoindex(ifname));
1038 + return 0;
1039 +}
1040 +
1041 +
1042 +static int i802_set_beacon(const char *iface, void *priv,
1043 + u8 *head, size_t head_len,
1044 + u8 *tail, size_t tail_len)
1045 +{
1046 + struct i802_driver_data *drv = priv;
1047 + struct nl_msg *msg;
1048 + u8 cmd = NL80211_CMD_NEW_BEACON;
1049 + int ret = -1;
1050 +
1051 + msg = nlmsg_alloc();
1052 + if (!msg)
1053 + goto out;
1054 +
1055 + if (drv->beacon_set)
1056 + cmd = NL80211_CMD_SET_BEACON;
1057 +
1058 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1059 + 0, cmd, 0);
1060 + NLA_PUT(msg, NL80211_ATTR_BEACON_HEAD, head_len, head);
1061 + NLA_PUT(msg, NL80211_ATTR_BEACON_TAIL, tail_len, tail);
1062 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
1063 + NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, 1000);
1064 +
1065 + if (!drv->dtim_period)
1066 + drv->dtim_period = 2;
1067 + NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, drv->dtim_period);
1068 +
1069 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1070 + nl_wait_for_ack(drv->nl_handle) < 0)
1071 + goto out;
1072 +
1073 + ret = 0;
1074 +
1075 + drv->beacon_set = 1;
1076 +
1077 + out:
1078 + nla_put_failure:
1079 + nlmsg_free(msg);
1080 + return ret;
1081 +}
1082 +
1083 +
1084 +static int i802_del_beacon(struct i802_driver_data *drv)
1085 +{
1086 + struct nl_msg *msg;
1087 + int ret = -1;
1088 +
1089 + msg = nlmsg_alloc();
1090 + if (!msg)
1091 + goto out;
1092 +
1093 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1094 + 0, NL80211_CMD_DEL_BEACON, 0);
1095 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1096 +
1097 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1098 + nl_wait_for_ack(drv->nl_handle) < 0)
1099 + goto out;
1100 +
1101 + ret = 0;
1102 +
1103 + out:
1104 + nla_put_failure:
1105 + nlmsg_free(msg);
1106 + return ret;
1107 +}
1108 +
1109 +
1110 +static int i802_set_ieee8021x(const char *ifname, void *priv, int enabled)
1111 +{
1112 + struct i802_driver_data *drv = priv;
1113 +
1114 + /*
1115 + * FIXME: This needs to be per interface (BSS)
1116 + */
1117 + drv->ieee802_1x_active = enabled;
1118 + return 0;
1119 +}
1120 +
1121 +
1122 +static int i802_set_privacy(const char *ifname, void *priv, int enabled)
1123 +{
1124 + struct i802_driver_data *drv = priv;
1125 + struct iwreq iwr;
1126 +
1127 + memset(&iwr, 0, sizeof(iwr));
1128 +
1129 + os_strlcpy(iwr.ifr_name, ifname, IFNAMSIZ);
1130 + iwr.u.param.flags = IW_AUTH_PRIVACY_INVOKED;
1131 + iwr.u.param.value = enabled;
1132 +
1133 + ioctl(drv->ioctl_sock, SIOCSIWAUTH, &iwr);
1134 +
1135 + /* ignore errors, the kernel/driver might not care */
1136 + return 0;
1137 +}
1138 +
1139 +
1140 +static int i802_set_internal_bridge(void *priv, int value)
1141 +{
1142 + return -1;
1143 +}
1144 +
1145 +
1146 +static int i802_set_beacon_int(void *priv, int value)
1147 +{
1148 + struct i802_driver_data *drv = priv;
1149 + struct nl_msg *msg;
1150 + int ret = -1;
1151 +
1152 + msg = nlmsg_alloc();
1153 + if (!msg)
1154 + goto out;
1155 +
1156 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1157 + 0, NL80211_CMD_SET_BEACON, 0);
1158 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1159 +
1160 + NLA_PUT_U32(msg, NL80211_ATTR_BEACON_INTERVAL, value);
1161 +
1162 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1163 + nl_wait_for_ack(drv->nl_handle) < 0)
1164 + goto out;
1165 +
1166 + ret = 0;
1167 +
1168 + out:
1169 + nla_put_failure:
1170 + nlmsg_free(msg);
1171 + return ret;
1172 +}
1173 +
1174 +
1175 +static int i802_set_dtim_period(const char *iface, void *priv, int value)
1176 +{
1177 + struct i802_driver_data *drv = priv;
1178 + struct nl_msg *msg;
1179 + int ret = -1;
1180 +
1181 + msg = nlmsg_alloc();
1182 + if (!msg)
1183 + goto out;
1184 +
1185 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1186 + 0, NL80211_CMD_SET_BEACON, 0);
1187 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(iface));
1188 +
1189 + drv->dtim_period = value;
1190 + NLA_PUT_U32(msg, NL80211_ATTR_DTIM_PERIOD, drv->dtim_period);
1191 +
1192 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1193 + nl_wait_for_ack(drv->nl_handle) < 0)
1194 + goto out;
1195 +
1196 + ret = 0;
1197 +
1198 + out:
1199 + nla_put_failure:
1200 + nlmsg_free(msg);
1201 + return ret;
1202 +}
1203 +
1204 +
1205 +static int i802_set_cts_protect(void *priv, int value)
1206 +{
1207 + return -1;
1208 +}
1209 +
1210 +
1211 +static int i802_set_preamble(void *priv, int value)
1212 +{
1213 + return -1;
1214 +}
1215 +
1216 +
1217 +static int i802_set_short_slot_time(void *priv, int value)
1218 +{
1219 + return -1;
1220 +}
1221 +
1222 +
1223 +static enum nl80211_iftype i802_if_type(enum hostapd_driver_if_type type)
1224 +{
1225 + switch (type) {
1226 + case HOSTAPD_IF_VLAN:
1227 + return NL80211_IFTYPE_AP_VLAN;
1228 + case HOSTAPD_IF_WDS:
1229 + return NL80211_IFTYPE_WDS;
1230 + }
1231 + return -1;
1232 +}
1233 +
1234 +
1235 +static int i802_if_add(const char *iface, void *priv,
1236 + enum hostapd_driver_if_type type, char *ifname,
1237 + const u8 *addr)
1238 +{
1239 + if (nl80211_create_iface(priv, ifname, i802_if_type(type), addr) < 0)
1240 + return -1;
1241 + return 0;
1242 +}
1243 +
1244 +
1245 +static int i802_if_update(void *priv, enum hostapd_driver_if_type type,
1246 + char *ifname, const u8 *addr)
1247 +{
1248 + /* unused at the moment */
1249 + return -1;
1250 +}
1251 +
1252 +
1253 +static int i802_if_remove(void *priv, enum hostapd_driver_if_type type,
1254 + const char *ifname, const u8 *addr)
1255 +{
1256 + nl80211_remove_iface(priv, if_nametoindex(ifname));
1257 + return 0;
1258 +}
1259 +
1260 +
1261 +struct phy_info_arg {
1262 + u16 *num_modes;
1263 + struct hostapd_hw_modes *modes;
1264 + int error;
1265 +};
1266 +
1267 +static int phy_info_handler(struct nl_msg *msg, void *arg)
1268 +{
1269 + struct nlattr *tb_msg[NL80211_ATTR_MAX + 1];
1270 + struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
1271 + struct phy_info_arg *phy_info = arg;
1272 +
1273 + struct nlattr *tb_band[NL80211_BAND_ATTR_MAX + 1];
1274 +
1275 + struct nlattr *tb_freq[NL80211_FREQUENCY_ATTR_MAX + 1];
1276 + static struct nla_policy freq_policy[NL80211_FREQUENCY_ATTR_MAX + 1] = {
1277 + [NL80211_FREQUENCY_ATTR_FREQ] = { .type = NLA_U32 },
1278 + [NL80211_FREQUENCY_ATTR_DISABLED] = { .type = NLA_FLAG },
1279 + [NL80211_FREQUENCY_ATTR_PASSIVE_SCAN] = { .type = NLA_FLAG },
1280 + [NL80211_FREQUENCY_ATTR_NO_IBSS] = { .type = NLA_FLAG },
1281 + [NL80211_FREQUENCY_ATTR_RADAR] = { .type = NLA_FLAG },
1282 + };
1283 +
1284 + struct nlattr *tb_rate[NL80211_BITRATE_ATTR_MAX + 1];
1285 + static struct nla_policy rate_policy[NL80211_BITRATE_ATTR_MAX + 1] = {
1286 + [NL80211_BITRATE_ATTR_RATE] = { .type = NLA_U32 },
1287 + [NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE] = { .type = NLA_FLAG },
1288 + };
1289 +
1290 + struct nlattr *nl_band;
1291 + struct nlattr *nl_freq;
1292 + struct nlattr *nl_rate;
1293 + int rem_band, rem_freq, rem_rate;
1294 + struct hostapd_hw_modes *mode;
1295 + int idx, mode_is_set;
1296 +
1297 + nla_parse(tb_msg, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
1298 + genlmsg_attrlen(gnlh, 0), NULL);
1299 +
1300 + if (!tb_msg[NL80211_ATTR_WIPHY_BANDS])
1301 + return NL_SKIP;
1302 +
1303 + nla_for_each_nested(nl_band, tb_msg[NL80211_ATTR_WIPHY_BANDS], rem_band) {
1304 + mode = realloc(phy_info->modes, (*phy_info->num_modes + 1) * sizeof(*mode));
1305 + if (!mode)
1306 + return NL_SKIP;
1307 + phy_info->modes = mode;
1308 +
1309 + mode_is_set = 0;
1310 +
1311 + mode = &phy_info->modes[*(phy_info->num_modes)];
1312 + memset(mode, 0, sizeof(*mode));
1313 + *(phy_info->num_modes) += 1;
1314 +
1315 + nla_parse(tb_band, NL80211_BAND_ATTR_MAX, nla_data(nl_band),
1316 + nla_len(nl_band), NULL);
1317 +
1318 + nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1319 + nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1320 + nla_len(nl_freq), freq_policy);
1321 + if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1322 + continue;
1323 + mode->num_channels++;
1324 + }
1325 +
1326 + mode->channels = calloc(mode->num_channels, sizeof(struct hostapd_channel_data));
1327 + if (!mode->channels)
1328 + return NL_SKIP;
1329 +
1330 + idx = 0;
1331 +
1332 + nla_for_each_nested(nl_freq, tb_band[NL80211_BAND_ATTR_FREQS], rem_freq) {
1333 + nla_parse(tb_freq, NL80211_FREQUENCY_ATTR_MAX, nla_data(nl_freq),
1334 + nla_len(nl_freq), freq_policy);
1335 + if (!tb_freq[NL80211_FREQUENCY_ATTR_FREQ])
1336 + continue;
1337 +
1338 + mode->channels[idx].freq = nla_get_u32(tb_freq[NL80211_FREQUENCY_ATTR_FREQ]);
1339 + mode->channels[idx].flag |= HOSTAPD_CHAN_W_SCAN |
1340 + HOSTAPD_CHAN_W_ACTIVE_SCAN |
1341 + HOSTAPD_CHAN_W_IBSS;
1342 +
1343 + if (!mode_is_set) {
1344 + /* crude heuristic */
1345 + if (mode->channels[idx].freq < 4000)
1346 + mode->mode = HOSTAPD_MODE_IEEE80211B;
1347 + else
1348 + mode->mode = HOSTAPD_MODE_IEEE80211A;
1349 + mode_is_set = 1;
1350 + }
1351 +
1352 + /* crude heuristic */
1353 + if (mode->channels[idx].freq < 4000)
1354 + if (mode->channels[idx].freq == 2848)
1355 + mode->channels[idx].chan = 14;
1356 + else
1357 + mode->channels[idx].chan = (mode->channels[idx].freq - 2407) / 5;
1358 + else
1359 + mode->channels[idx].chan = mode->channels[idx].freq/5 - 1000;
1360 +
1361 + if (tb_freq[NL80211_FREQUENCY_ATTR_DISABLED])
1362 + mode->channels[idx].flag &= ~HOSTAPD_CHAN_W_SCAN;
1363 + if (tb_freq[NL80211_FREQUENCY_ATTR_PASSIVE_SCAN])
1364 + mode->channels[idx].flag &= ~HOSTAPD_CHAN_W_ACTIVE_SCAN;
1365 + if (tb_freq[NL80211_FREQUENCY_ATTR_NO_IBSS])
1366 + mode->channels[idx].flag &= ~HOSTAPD_CHAN_W_IBSS;
1367 + idx++;
1368 + }
1369 +
1370 + nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1371 + nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1372 + nla_len(nl_rate), rate_policy);
1373 + if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1374 + continue;
1375 + mode->num_rates++;
1376 + }
1377 +
1378 + mode->rates = calloc(mode->num_rates, sizeof(struct hostapd_rate_data));
1379 + if (!mode->rates)
1380 + return NL_SKIP;
1381 +
1382 + idx = 0;
1383 +
1384 + nla_for_each_nested(nl_rate, tb_band[NL80211_BAND_ATTR_RATES], rem_rate) {
1385 + nla_parse(tb_rate, NL80211_BITRATE_ATTR_MAX, nla_data(nl_rate),
1386 + nla_len(nl_rate), rate_policy);
1387 + if (!tb_rate[NL80211_BITRATE_ATTR_RATE])
1388 + continue;
1389 + mode->rates[idx].rate = nla_get_u32(tb_rate[NL80211_BITRATE_ATTR_RATE]);
1390 +
1391 + /* crude heuristic */
1392 + if (mode->mode == HOSTAPD_MODE_IEEE80211B &&
1393 + mode->rates[idx].rate > 200)
1394 + mode->mode = HOSTAPD_MODE_IEEE80211G;
1395 +
1396 + if (tb_rate[NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE])
1397 + mode->rates[idx].flags |= HOSTAPD_RATE_PREAMBLE2;
1398 +
1399 + idx++;
1400 + }
1401 + }
1402 +
1403 + phy_info->error = 0;
1404 +
1405 + return NL_SKIP;
1406 +}
1407 +
1408 +static struct hostapd_hw_modes *i802_get_hw_feature_data(void *priv,
1409 + u16 *num_modes,
1410 + u16 *flags)
1411 +{
1412 + struct i802_driver_data *drv = priv;
1413 + struct nl_msg *msg;
1414 + int err = -1;
1415 + struct nl_cb *cb = NULL;
1416 + int finished;
1417 + struct phy_info_arg result = {
1418 + .num_modes = num_modes,
1419 + .modes = NULL,
1420 + .error = 1,
1421 + };
1422 +
1423 + *num_modes = 0;
1424 + *flags = 0;
1425 +
1426 + msg = nlmsg_alloc();
1427 + if (!msg)
1428 + return NULL;
1429 +
1430 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1431 + 0, NL80211_CMD_GET_WIPHY, 0);
1432 +
1433 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX, if_nametoindex(drv->iface));
1434 +
1435 + cb = nl_cb_alloc(NL_CB_CUSTOM);
1436 + if (!cb)
1437 + goto out;
1438 +
1439 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0)
1440 + goto out;
1441 +
1442 + nl_cb_set(cb, NL_CB_VALID, NL_CB_CUSTOM, phy_info_handler, &result);
1443 + nl_cb_set(cb, NL_CB_ACK, NL_CB_CUSTOM, ack_wait_handler, &finished);
1444 +
1445 + err = nl_recvmsgs(drv->nl_handle, cb);
1446 +
1447 + if (!finished)
1448 + err = nl_wait_for_ack(drv->nl_handle);
1449 +
1450 + if (err < 0 || result.error) {
1451 + hostapd_free_hw_features(result.modes, *num_modes);
1452 + result.modes = NULL;
1453 + }
1454 +
1455 + out:
1456 + nl_cb_put(cb);
1457 + nla_put_failure:
1458 + if (err)
1459 + fprintf(stderr, "failed to get information: %d\n", err);
1460 + nlmsg_free(msg);
1461 + return result.modes;
1462 +}
1463 +
1464 +
1465 +static int i802_set_sta_vlan(void *priv, const u8 *addr,
1466 + const char *ifname, int vlan_id)
1467 +{
1468 + struct i802_driver_data *drv = priv;
1469 + struct nl_msg *msg;
1470 + int ret = -1;
1471 +
1472 + msg = nlmsg_alloc();
1473 + if (!msg)
1474 + goto out;
1475 +
1476 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1477 + 0, NL80211_CMD_SET_STATION, 0);
1478 +
1479 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
1480 + if_nametoindex(drv->iface));
1481 + NLA_PUT(msg, NL80211_ATTR_MAC, ETH_ALEN, addr);
1482 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
1483 + if_nametoindex(ifname));
1484 +
1485 + ret = 0;
1486 +
1487 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1488 + (errno = nl_wait_for_ack(drv->nl_handle) < 0)) {
1489 + ret = -1;
1490 + }
1491 +
1492 + nla_put_failure:
1493 + nlmsg_free(msg);
1494 +
1495 + out:
1496 + return ret;
1497 +}
1498 +
1499 +
1500 +static void handle_unknown_sta(struct hostapd_data *hapd, u8 *ta)
1501 +{
1502 + struct sta_info *sta;
1503 +
1504 + sta = ap_get_sta(hapd, ta);
1505 + if (!sta || !(sta->flags & WLAN_STA_ASSOC)) {
1506 + printf("Data/PS-poll frame from not associated STA "
1507 + MACSTR "\n", MAC2STR(ta));
1508 + if (sta && (sta->flags & WLAN_STA_AUTH))
1509 + hostapd_sta_disassoc(
1510 + hapd, ta,
1511 + WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
1512 + else
1513 + hostapd_sta_deauth(
1514 + hapd, ta,
1515 + WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA);
1516 + }
1517 +}
1518 +
1519 +
1520 +static void handle_tx_callback(struct hostapd_data *hapd, u8 *buf, size_t len,
1521 + int ok)
1522 +{
1523 + struct ieee80211_hdr *hdr;
1524 + u16 fc, type, stype;
1525 + struct sta_info *sta;
1526 +
1527 + hdr = (struct ieee80211_hdr *) buf;
1528 + fc = le_to_host16(hdr->frame_control);
1529 +
1530 + type = WLAN_FC_GET_TYPE(fc);
1531 + stype = WLAN_FC_GET_STYPE(fc);
1532 +
1533 + switch (type) {
1534 + case WLAN_FC_TYPE_MGMT:
1535 + wpa_printf(MSG_DEBUG, "MGMT (TX callback) %s",
1536 + ok ? "ACK" : "fail");
1537 + ieee802_11_mgmt_cb(hapd, buf, len, stype, ok);
1538 + break;
1539 + case WLAN_FC_TYPE_CTRL:
1540 + wpa_printf(MSG_DEBUG, "CTRL (TX callback) %s",
1541 + ok ? "ACK" : "fail");
1542 + break;
1543 + case WLAN_FC_TYPE_DATA:
1544 + wpa_printf(MSG_DEBUG, "DATA (TX callback) %s",
1545 + ok ? "ACK" : "fail");
1546 + sta = ap_get_sta(hapd, hdr->addr1);
1547 + if (sta && sta->flags & WLAN_STA_PENDING_POLL) {
1548 + wpa_printf(MSG_DEBUG, "STA " MACSTR " %s pending "
1549 + "activity poll", MAC2STR(sta->addr),
1550 + ok ? "ACKed" : "did not ACK");
1551 + if (ok)
1552 + sta->flags &= ~WLAN_STA_PENDING_POLL;
1553 + }
1554 + if (sta)
1555 + ieee802_1x_tx_status(hapd, sta, buf, len, ok);
1556 + break;
1557 + default:
1558 + printf("unknown TX callback frame type %d\n", type);
1559 + break;
1560 + }
1561 +}
1562 +
1563 +
1564 +static void handle_frame(struct hostapd_iface *iface, u8 *buf, size_t len,
1565 + struct hostapd_frame_info *hfi,
1566 + enum ieee80211_msg_type msg_type)
1567 +{
1568 + struct ieee80211_hdr *hdr;
1569 + u16 fc, type, stype;
1570 + size_t data_len = len;
1571 + struct hostapd_data *hapd = NULL;
1572 + int broadcast_bssid = 0;
1573 + size_t i;
1574 + u8 *bssid;
1575 +
1576 + /*
1577 + * PS-Poll frames are 16 bytes. All other frames are
1578 + * 24 bytes or longer.
1579 + */
1580 + if (len < 16)
1581 + return;
1582 +
1583 + hdr = (struct ieee80211_hdr *) buf;
1584 + fc = le_to_host16(hdr->frame_control);
1585 +
1586 + type = WLAN_FC_GET_TYPE(fc);
1587 + stype = WLAN_FC_GET_STYPE(fc);
1588 +
1589 + switch (type) {
1590 + case WLAN_FC_TYPE_DATA:
1591 + if (len < 24)
1592 + return;
1593 + switch (fc & (WLAN_FC_FROMDS | WLAN_FC_TODS)) {
1594 + case WLAN_FC_TODS:
1595 + bssid = hdr->addr1;
1596 + break;
1597 + default:
1598 + /* discard */
1599 + return;
1600 + }
1601 + break;
1602 + case WLAN_FC_TYPE_CTRL:
1603 + /* discard non-ps-poll frames */
1604 + if (stype != WLAN_FC_STYPE_PSPOLL)
1605 + return;
1606 + bssid = hdr->addr1;
1607 + break;
1608 + case WLAN_FC_TYPE_MGMT:
1609 + bssid = hdr->addr3;
1610 + break;
1611 + default:
1612 + /* discard */
1613 + return;
1614 + }
1615 +
1616 + /* find interface frame belongs to */
1617 + for (i = 0; i < iface->num_bss; i++) {
1618 + if (memcmp(bssid, iface->bss[i]->own_addr, ETH_ALEN) == 0) {
1619 + hapd = iface->bss[i];
1620 + break;
1621 + }
1622 + }
1623 +
1624 + if (hapd == NULL) {
1625 + hapd = iface->bss[0];
1626 +
1627 + if (bssid[0] != 0xff || bssid[1] != 0xff ||
1628 + bssid[2] != 0xff || bssid[3] != 0xff ||
1629 + bssid[4] != 0xff || bssid[5] != 0xff) {
1630 + /*
1631 + * Unknown BSSID - drop frame if this is not from
1632 + * passive scanning or a beacon (at least ProbeReq
1633 + * frames to other APs may be allowed through RX
1634 + * filtering in the wlan hw/driver)
1635 + */
1636 + if ((type != WLAN_FC_TYPE_MGMT ||
1637 + stype != WLAN_FC_STYPE_BEACON))
1638 + return;
1639 + } else
1640 + broadcast_bssid = 1;
1641 + }
1642 +
1643 + switch (msg_type) {
1644 + case ieee80211_msg_normal:
1645 + /* continue processing */
1646 + break;
1647 + case ieee80211_msg_tx_callback_ack:
1648 + handle_tx_callback(hapd, buf, data_len, 1);
1649 + return;
1650 + case ieee80211_msg_tx_callback_fail:
1651 + handle_tx_callback(hapd, buf, data_len, 0);
1652 + return;
1653 + }
1654 +
1655 + switch (type) {
1656 + case WLAN_FC_TYPE_MGMT:
1657 + if (stype != WLAN_FC_STYPE_BEACON &&
1658 + stype != WLAN_FC_STYPE_PROBE_REQ)
1659 + wpa_printf(MSG_MSGDUMP, "MGMT");
1660 + if (broadcast_bssid) {
1661 + for (i = 0; i < iface->num_bss; i++)
1662 + ieee802_11_mgmt(iface->bss[i], buf, data_len,
1663 + stype, hfi);
1664 + } else
1665 + ieee802_11_mgmt(hapd, buf, data_len, stype, hfi);
1666 + break;
1667 + case WLAN_FC_TYPE_CTRL:
1668 + /* can only get here with PS-Poll frames */
1669 + wpa_printf(MSG_DEBUG, "CTRL");
1670 + handle_unknown_sta(hapd, hdr->addr2);
1671 + break;
1672 + case WLAN_FC_TYPE_DATA:
1673 + wpa_printf(MSG_DEBUG, "DATA");
1674 + handle_unknown_sta(hapd, hdr->addr2);
1675 + break;
1676 + }
1677 +}
1678 +
1679 +
1680 +static void handle_eapol(int sock, void *eloop_ctx, void *sock_ctx)
1681 +{
1682 + struct i802_driver_data *drv = eloop_ctx;
1683 + struct hostapd_data *hapd = drv->hapd;
1684 + struct sockaddr_ll lladdr;
1685 + unsigned char buf[3000];
1686 + int len;
1687 + socklen_t fromlen = sizeof(lladdr);
1688 +
1689 + len = recvfrom(sock, buf, sizeof(buf), 0,
1690 + (struct sockaddr *)&lladdr, &fromlen);
1691 + if (len < 0) {
1692 + perror("recv");
1693 + return;
1694 + }
1695 +
1696 + if (have_ifidx(drv, lladdr.sll_ifindex))
1697 + ieee802_1x_receive(hapd, lladdr.sll_addr, buf, len);
1698 +}
1699 +
1700 +
1701 +static void handle_monitor_read(int sock, void *eloop_ctx, void *sock_ctx)
1702 +{
1703 + struct i802_driver_data *drv = eloop_ctx;
1704 + int len;
1705 + unsigned char buf[3000];
1706 + struct hostapd_data *hapd = drv->hapd;
1707 + struct ieee80211_radiotap_iterator iter;
1708 + int ret;
1709 + struct hostapd_frame_info hfi;
1710 + int injected = 0, failed = 0, msg_type, rxflags = 0;
1711 +
1712 + len = recv(sock, buf, sizeof(buf), 0);
1713 + if (len < 0) {
1714 + perror("recv");
1715 + return;
1716 + }
1717 +
1718 + if (ieee80211_radiotap_iterator_init(&iter, (void*)buf, len)) {
1719 + printf("received invalid radiotap frame\n");
1720 + return;
1721 + }
1722 +
1723 + memset(&hfi, 0, sizeof(hfi));
1724 +
1725 + while (1) {
1726 + ret = ieee80211_radiotap_iterator_next(&iter);
1727 + if (ret == -ENOENT)
1728 + break;
1729 + if (ret) {
1730 + printf("received invalid radiotap frame (%d)\n", ret);
1731 + return;
1732 + }
1733 + switch (iter.this_arg_index) {
1734 + case IEEE80211_RADIOTAP_FLAGS:
1735 + if (*iter.this_arg & IEEE80211_RADIOTAP_F_FCS)
1736 + len -= 4;
1737 + break;
1738 + case IEEE80211_RADIOTAP_RX_FLAGS:
1739 + rxflags = 1;
1740 + break;
1741 + case IEEE80211_RADIOTAP_TX_FLAGS:
1742 + injected = 1;
1743 + failed = le_to_host16((*(uint16_t *) iter.this_arg)) &
1744 + IEEE80211_RADIOTAP_F_TX_FAIL;
1745 + break;
1746 + case IEEE80211_RADIOTAP_DATA_RETRIES:
1747 + break;
1748 + case IEEE80211_RADIOTAP_CHANNEL:
1749 + /* TODO convert from freq/flags to channel number
1750 + hfi.channel = XXX;
1751 + hfi.phytype = XXX;
1752 + */
1753 + break;
1754 + case IEEE80211_RADIOTAP_RATE:
1755 + hfi.datarate = *iter.this_arg * 5;
1756 + break;
1757 + case IEEE80211_RADIOTAP_DB_ANTSIGNAL:
1758 + hfi.ssi_signal = *iter.this_arg;
1759 + break;
1760 + }
1761 + }
1762 +
1763 + if (rxflags && injected)
1764 + return;
1765 +
1766 + if (!injected)
1767 + msg_type = ieee80211_msg_normal;
1768 + else if (failed)
1769 + msg_type = ieee80211_msg_tx_callback_fail;
1770 + else
1771 + msg_type = ieee80211_msg_tx_callback_ack;
1772 +
1773 + handle_frame(hapd->iface, buf + iter.max_length,
1774 + len - iter.max_length, &hfi, msg_type);
1775 +}
1776 +
1777 +
1778 +static int nl80211_create_monitor_interface(struct i802_driver_data *drv)
1779 +{
1780 + char buf[IFNAMSIZ];
1781 + struct sockaddr_ll ll;
1782 + int optval;
1783 + socklen_t optlen;
1784 +
1785 + snprintf(buf, IFNAMSIZ, "mon.%s", drv->iface);
1786 + buf[IFNAMSIZ - 1] = '\0';
1787 +
1788 + drv->monitor_ifidx =
1789 + nl80211_create_iface(drv, buf, NL80211_IFTYPE_MONITOR, NULL);
1790 +
1791 + if (drv->monitor_ifidx < 0)
1792 + return -1;
1793 +
1794 + if (hostapd_set_iface_flags(drv, buf, 1))
1795 + goto error;
1796 +
1797 + memset(&ll, 0, sizeof(ll));
1798 + ll.sll_family = AF_PACKET;
1799 + ll.sll_ifindex = drv->monitor_ifidx;
1800 + drv->monitor_sock = socket(PF_PACKET, SOCK_RAW, htons(ETH_P_ALL));
1801 + if (drv->monitor_sock < 0) {
1802 + perror("socket[PF_PACKET,SOCK_RAW]");
1803 + goto error;
1804 + }
1805 +
1806 + if (bind(drv->monitor_sock, (struct sockaddr *) &ll,
1807 + sizeof(ll)) < 0) {
1808 + perror("monitor socket bind");
1809 + goto error;
1810 + }
1811 +
1812 + optlen = sizeof(optval);
1813 + optval = 20;
1814 + if (setsockopt
1815 + (drv->monitor_sock, SOL_SOCKET, SO_PRIORITY, &optval, optlen)) {
1816 + perror("Failed to set socket priority");
1817 + goto error;
1818 + }
1819 +
1820 + if (eloop_register_read_sock(drv->monitor_sock, handle_monitor_read,
1821 + drv, NULL)) {
1822 + printf("Could not register monitor read socket\n");
1823 + goto error;
1824 + }
1825 +
1826 + return 0;
1827 + error:
1828 + nl80211_remove_iface(drv, drv->monitor_ifidx);
1829 + return -1;
1830 +}
1831 +
1832 +
1833 +static int nl80211_set_master_mode(struct i802_driver_data *drv,
1834 + const char *ifname)
1835 +{
1836 + struct nl_msg *msg;
1837 +
1838 + msg = nlmsg_alloc();
1839 + if (!msg)
1840 + return -1;
1841 +
1842 + genlmsg_put(msg, 0, 0, genl_family_get_id(drv->nl80211), 0,
1843 + 0, NL80211_CMD_SET_INTERFACE, 0);
1844 + NLA_PUT_U32(msg, NL80211_ATTR_IFINDEX,
1845 + if_nametoindex(ifname));
1846 + NLA_PUT_U32(msg, NL80211_ATTR_IFTYPE, NL80211_IFTYPE_AP);
1847 +
1848 + if (nl_send_auto_complete(drv->nl_handle, msg) < 0 ||
1849 + nl_wait_for_ack(drv->nl_handle) < 0) {
1850 + nla_put_failure:
1851 + wpa_printf(MSG_ERROR, "Failed to set interface %s to master "
1852 + "mode.", ifname);
1853 + nlmsg_free(msg);
1854 + return -1;
1855 + }
1856 +
1857 + nlmsg_free(msg);
1858 +
1859 + return 0;
1860 +}
1861 +
1862 +
1863 +static int i802_init_sockets(struct i802_driver_data *drv, const u8 *bssid)
1864 +{
1865 + struct ifreq ifr;
1866 + struct sockaddr_ll addr;
1867 +
1868 + drv->ioctl_sock = -1;
1869 +
1870 + drv->ioctl_sock = socket(PF_INET, SOCK_DGRAM, 0);
1871 + if (drv->ioctl_sock < 0) {
1872 + perror("socket[PF_INET,SOCK_DGRAM]");
1873 + return -1;
1874 + }
1875 +
1876 + /* start listening for EAPOL on the default AP interface */
1877 + add_ifidx(drv, if_nametoindex(drv->iface));
1878 +
1879 + if (hostapd_set_iface_flags(drv, drv->iface, 0))
1880 + return -1;
1881 +
1882 + if (bssid) {
1883 + os_strlcpy(ifr.ifr_name, drv->iface, IFNAMSIZ);
1884 + memcpy(ifr.ifr_hwaddr.sa_data, bssid, ETH_ALEN);
1885 + ifr.ifr_hwaddr.sa_family = ARPHRD_ETHER;
1886 +
1887 + if (ioctl(drv->ioctl_sock, SIOCSIFHWADDR, &ifr)) {
1888 + perror("ioctl(SIOCSIFHWADDR)");
1889 + return -1;
1890 + }
1891 + }
1892 +
1893 + /*
1894 + * initialise generic netlink and nl80211
1895 + */
1896 + drv->nl_handle = nl_handle_alloc();
1897 + if (!drv->nl_handle) {
1898 + printf("Failed to allocate netlink handle.\n");
1899 + return -1;
1900 + }
1901 +
1902 + if (genl_connect(drv->nl_handle)) {
1903 + printf("Failed to connect to generic netlink.\n");
1904 + return -1;
1905 + }
1906 +
1907 + drv->nl_cache = genl_ctrl_alloc_cache(drv->nl_handle);
1908 + if (!drv->nl_cache) {
1909 + printf("Failed to allocate generic netlink cache.\n");
1910 + return -1;
1911 + }
1912 +
1913 + drv->nl80211 = genl_ctrl_search_by_name(drv->nl_cache, "nl80211");
1914 + if (!drv->nl80211) {
1915 + printf("nl80211 not found.\n");
1916 + return -1;
1917 + }
1918 +
1919 + /* Initialise a monitor interface */
1920 + if (nl80211_create_monitor_interface(drv))
1921 + return -1;
1922 +
1923 + if (nl80211_set_master_mode(drv, drv->iface))
1924 + return -1;
1925 +
1926 + if (hostapd_set_iface_flags(drv, drv->iface, 1))
1927 + return -1;
1928 +
1929 + memset(&addr, 0, sizeof(addr));
1930 + addr.sll_family = AF_PACKET;
1931 + addr.sll_ifindex = ifr.ifr_ifindex;
1932 + wpa_printf(MSG_DEBUG, "Opening raw packet socket for ifindex %d",
1933 + addr.sll_ifindex);
1934 +
1935 + drv->eapol_sock = socket(PF_PACKET, SOCK_DGRAM, htons(ETH_P_PAE));
1936 + if (drv->eapol_sock < 0) {
1937 + perror("socket(PF_PACKET, SOCK_DGRAM, ETH_P_PAE)");
1938 + return -1;
1939 + }
1940 +
1941 + if (eloop_register_read_sock(drv->eapol_sock, handle_eapol, drv, NULL))
1942 + {
1943 + printf("Could not register read socket for eapol\n");
1944 + return -1;
1945 + }
1946 +
1947 + memset(&ifr, 0, sizeof(ifr));
1948 + os_strlcpy(ifr.ifr_name, drv->iface, sizeof(ifr.ifr_name));
1949 + if (ioctl(drv->ioctl_sock, SIOCGIFHWADDR, &ifr) != 0) {
1950 + perror("ioctl(SIOCGIFHWADDR)");
1951 + return -1;
1952 + }
1953 +
1954 + if (ifr.ifr_hwaddr.sa_family != ARPHRD_ETHER) {
1955 + printf("Invalid HW-addr family 0x%04x\n",
1956 + ifr.ifr_hwaddr.sa_family);
1957 + return -1;
1958 + }
1959 + memcpy(drv->hapd->own_addr, ifr.ifr_hwaddr.sa_data, ETH_ALEN);
1960 +
1961 + return 0;
1962 +}
1963 +
1964 +
1965 +static int i802_get_inact_sec(void *priv, const u8 *addr)
1966 +{
1967 + struct hostap_sta_driver_data data;
1968 + int ret;
1969 +
1970 + data.inactive_msec = (unsigned long) -1;
1971 + ret = i802_read_sta_data(priv, &data, addr);
1972 + if (ret || data.inactive_msec == (unsigned long) -1)
1973 + return -1;
1974 + return data.inactive_msec / 1000;
1975 +}
1976 +
1977 +
1978 +static int i802_sta_clear_stats(void *priv, const u8 *addr)
1979 +{
1980 +#if 0
1981 + /* TODO */
1982 +#endif
1983 + return 0;
1984 +}
1985 +
1986 +
1987 +static void
1988 +hostapd_wireless_event_wireless_custom(struct i802_driver_data *drv,
1989 + char *custom)
1990 +{
1991 + wpa_printf(MSG_DEBUG, "Custom wireless event: '%s'", custom);
1992 +
1993 + if (strncmp(custom, "MLME-MICHAELMICFAILURE.indication", 33) == 0) {
1994 + char *pos;
1995 + u8 addr[ETH_ALEN];
1996 + pos = strstr(custom, "addr=");
1997 + if (pos == NULL) {
1998 + wpa_printf(MSG_DEBUG,
1999 + "MLME-MICHAELMICFAILURE.indication "
2000 + "without sender address ignored");
2001 + return;
2002 + }
2003 + pos += 5;
2004 + if (hwaddr_aton(pos, addr) == 0) {
2005 + ieee80211_michael_mic_failure(drv->hapd, addr, 1);
2006 + } else {
2007 + wpa_printf(MSG_DEBUG,
2008 + "MLME-MICHAELMICFAILURE.indication "
2009 + "with invalid MAC address");
2010 + }
2011 + }
2012 +}
2013 +
2014 +
2015 +static void hostapd_wireless_event_wireless(struct i802_driver_data *drv,
2016 + char *data, int len)
2017 +{
2018 + struct iw_event iwe_buf, *iwe = &iwe_buf;
2019 + char *pos, *end, *custom, *buf;
2020 +
2021 + pos = data;
2022 + end = data + len;
2023 +
2024 + while (pos + IW_EV_LCP_LEN <= end) {
2025 + /* Event data may be unaligned, so make a local, aligned copy
2026 + * before processing. */
2027 + memcpy(&iwe_buf, pos, IW_EV_LCP_LEN);
2028 + wpa_printf(MSG_DEBUG, "Wireless event: cmd=0x%x len=%d",
2029 + iwe->cmd, iwe->len);
2030 + if (iwe->len <= IW_EV_LCP_LEN)
2031 + return;
2032 +
2033 + custom = pos + IW_EV_POINT_LEN;
2034 + if (drv->we_version > 18 &&
2035 + (iwe->cmd == IWEVMICHAELMICFAILURE ||
2036 + iwe->cmd == IWEVCUSTOM)) {
2037 + /* WE-19 removed the pointer from struct iw_point */
2038 + char *dpos = (char *) &iwe_buf.u.data.length;
2039 + int dlen = dpos - (char *) &iwe_buf;
2040 + memcpy(dpos, pos + IW_EV_LCP_LEN,
2041 + sizeof(struct iw_event) - dlen);
2042 + } else {
2043 + memcpy(&iwe_buf, pos, sizeof(struct iw_event));
2044 + custom += IW_EV_POINT_OFF;
2045 + }
2046 +
2047 + switch (iwe->cmd) {
2048 + case IWEVCUSTOM:
2049 + if (custom + iwe->u.data.length > end)
2050 + return;
2051 + buf = malloc(iwe->u.data.length + 1);
2052 + if (buf == NULL)
2053 + return;
2054 + memcpy(buf, custom, iwe->u.data.length);
2055 + buf[iwe->u.data.length] = '\0';
2056 + hostapd_wireless_event_wireless_custom(drv, buf);
2057 + free(buf);
2058 + break;
2059 + }
2060 +
2061 + pos += iwe->len;
2062 + }
2063 +}
2064 +
2065 +
2066 +static void hostapd_wireless_event_rtm_newlink(struct i802_driver_data *drv,
2067 + struct nlmsghdr *h, int len)
2068 +{
2069 + struct ifinfomsg *ifi;
2070 + int attrlen, nlmsg_len, rta_len;
2071 + struct rtattr *attr;
2072 +
2073 + if (len < (int) sizeof(*ifi))
2074 + return;
2075 +
2076 + ifi = NLMSG_DATA(h);
2077 +
2078 + /* TODO: use ifi->ifi_index to filter out wireless events from other
2079 + * interfaces */
2080 +
2081 + nlmsg_len = NLMSG_ALIGN(sizeof(struct ifinfomsg));
2082 +
2083 + attrlen = h->nlmsg_len - nlmsg_len;
2084 + if (attrlen < 0)
2085 + return;
2086 +
2087 + attr = (struct rtattr *) (((char *) ifi) + nlmsg_len);
2088 +
2089 + rta_len = RTA_ALIGN(sizeof(struct rtattr));
2090 + while (RTA_OK(attr, attrlen)) {
2091 + if (attr->rta_type == IFLA_WIRELESS) {
2092 + hostapd_wireless_event_wireless(
2093 + drv, ((char *) attr) + rta_len,
2094 + attr->rta_len - rta_len);
2095 + }
2096 + attr = RTA_NEXT(attr, attrlen);
2097 + }
2098 +}
2099 +
2100 +
2101 +static void hostapd_wireless_event_receive(int sock, void *eloop_ctx,
2102 + void *sock_ctx)
2103 +{
2104 + char buf[256];
2105 + int left;
2106 + struct sockaddr_nl from;
2107 + socklen_t fromlen;
2108 + struct nlmsghdr *h;
2109 + struct i802_driver_data *drv = eloop_ctx;
2110 +
2111 + fromlen = sizeof(from);
2112 + left = recvfrom(sock, buf, sizeof(buf), MSG_DONTWAIT,
2113 + (struct sockaddr *) &from, &fromlen);
2114 + if (left < 0) {
2115 + if (errno != EINTR && errno != EAGAIN)
2116 + perror("recvfrom(netlink)");
2117 + return;
2118 + }
2119 +
2120 + h = (struct nlmsghdr *) buf;
2121 + while (left >= (int) sizeof(*h)) {
2122 + int len, plen;
2123 +
2124 + len = h->nlmsg_len;
2125 + plen = len - sizeof(*h);
2126 + if (len > left || plen < 0) {
2127 + printf("Malformed netlink message: "
2128 + "len=%d left=%d plen=%d\n",
2129 + len, left, plen);
2130 + break;
2131 + }
2132 +
2133 + switch (h->nlmsg_type) {
2134 + case RTM_NEWLINK:
2135 + hostapd_wireless_event_rtm_newlink(drv, h, plen);
2136 + break;
2137 + }
2138 +
2139 + len = NLMSG_ALIGN(len);
2140 + left -= len;
2141 + h = (struct nlmsghdr *) ((char *) h + len);
2142 + }
2143 +
2144 + if (left > 0) {
2145 + printf("%d extra bytes in the end of netlink message\n", left);
2146 + }
2147 +}
2148 +
2149 +
2150 +static int hostap_get_we_version(struct i802_driver_data *drv)
2151 +{
2152 + struct iw_range *range;
2153 + struct iwreq iwr;
2154 + int minlen;
2155 + size_t buflen;
2156 +
2157 + drv->we_version = 0;
2158 +
2159 + /*
2160 + * Use larger buffer than struct iw_range in order to allow the
2161 + * structure to grow in the future.
2162 + */
2163 + buflen = sizeof(struct iw_range) + 500;
2164 + range = os_zalloc(buflen);
2165 + if (range == NULL)
2166 + return -1;
2167 +
2168 + memset(&iwr, 0, sizeof(iwr));
2169 + os_strlcpy(iwr.ifr_name, drv->iface, IFNAMSIZ);
2170 + iwr.u.data.pointer = (caddr_t) range;
2171 + iwr.u.data.length = buflen;
2172 +
2173 + minlen = ((char *) &range->enc_capa) - (char *) range +
2174 + sizeof(range->enc_capa);
2175 +
2176 + if (ioctl(drv->ioctl_sock, SIOCGIWRANGE, &iwr) < 0) {
2177 + perror("ioctl[SIOCGIWRANGE]");
2178 + free(range);
2179 + return -1;
2180 + } else if (iwr.u.data.length >= minlen &&
2181 + range->we_version_compiled >= 18) {
2182 + wpa_printf(MSG_DEBUG, "SIOCGIWRANGE: WE(compiled)=%d "
2183 + "WE(source)=%d enc_capa=0x%x",
2184 + range->we_version_compiled,
2185 + range->we_version_source,
2186 + range->enc_capa);
2187 + drv->we_version = range->we_version_compiled;
2188 + }
2189 +
2190 + free(range);
2191 + return 0;
2192 +}
2193 +
2194 +
2195 +static int i802_wireless_event_init(void *priv)
2196 +{
2197 + struct i802_driver_data *drv = priv;
2198 + int s;
2199 + struct sockaddr_nl local;
2200 +
2201 + hostap_get_we_version(drv);
2202 +
2203 + drv->wext_sock = -1;
2204 +
2205 + s = socket(PF_NETLINK, SOCK_RAW, NETLINK_ROUTE);
2206 + if (s < 0) {
2207 + perror("socket(PF_NETLINK,SOCK_RAW,NETLINK_ROUTE)");
2208 + return -1;
2209 + }
2210 +
2211 + memset(&local, 0, sizeof(local));
2212 + local.nl_family = AF_NETLINK;
2213 + local.nl_groups = RTMGRP_LINK;
2214 + if (bind(s, (struct sockaddr *) &local, sizeof(local)) < 0) {
2215 + perror("bind(netlink)");
2216 + close(s);
2217 + return -1;
2218 + }
2219 +
2220 + eloop_register_read_sock(s, hostapd_wireless_event_receive, drv,
2221 + NULL);
2222 + drv->wext_sock = s;
2223 +
2224 + return 0;
2225 +}
2226 +
2227 +
2228 +static void i802_wireless_event_deinit(void *priv)
2229 +{
2230 + struct i802_driver_data *drv = priv;
2231 + if (drv->wext_sock < 0)
2232 + return;
2233 + eloop_unregister_read_sock(drv->wext_sock);
2234 + close(drv->wext_sock);
2235 +}
2236 +
2237 +
2238 +static int i802_sta_deauth(void *priv, const u8 *addr, int reason)
2239 +{
2240 + struct i802_driver_data *drv = priv;
2241 + struct ieee80211_mgmt mgmt;
2242 +
2243 + memset(&mgmt, 0, sizeof(mgmt));
2244 + mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2245 + WLAN_FC_STYPE_DEAUTH);
2246 + memcpy(mgmt.da, addr, ETH_ALEN);
2247 + memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
2248 + memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
2249 + mgmt.u.deauth.reason_code = host_to_le16(reason);
2250 + return i802_send_mgmt_frame(drv, &mgmt, IEEE80211_HDRLEN +
2251 + sizeof(mgmt.u.deauth), 0);
2252 +}
2253 +
2254 +
2255 +static int i802_sta_disassoc(void *priv, const u8 *addr, int reason)
2256 +{
2257 + struct i802_driver_data *drv = priv;
2258 + struct ieee80211_mgmt mgmt;
2259 +
2260 + memset(&mgmt, 0, sizeof(mgmt));
2261 + mgmt.frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
2262 + WLAN_FC_STYPE_DISASSOC);
2263 + memcpy(mgmt.da, addr, ETH_ALEN);
2264 + memcpy(mgmt.sa, drv->hapd->own_addr, ETH_ALEN);
2265 + memcpy(mgmt.bssid, drv->hapd->own_addr, ETH_ALEN);
2266 + mgmt.u.disassoc.reason_code = host_to_le16(reason);
2267 + return i802_send_mgmt_frame(drv, &mgmt, IEEE80211_HDRLEN +
2268 + sizeof(mgmt.u.disassoc), 0);
2269 +}
2270 +
2271 +
2272 +static void *i802_init_bssid(struct hostapd_data *hapd, const u8 *bssid)
2273 +{
2274 + struct i802_driver_data *drv;
2275 +
2276 + drv = os_zalloc(sizeof(struct i802_driver_data));
2277 + if (drv == NULL) {
2278 + printf("Could not allocate memory for i802 driver data\n");
2279 + return NULL;
2280 + }
2281 +
2282 + drv->hapd = hapd;
2283 + memcpy(drv->iface, hapd->conf->iface, sizeof(drv->iface));
2284 +
2285 + drv->num_if_indices = sizeof(drv->default_if_indices) / sizeof(int);
2286 + drv->if_indices = drv->default_if_indices;
2287 +
2288 + if (i802_init_sockets(drv, bssid))
2289 + goto failed;
2290 +
2291 + return drv;
2292 +
2293 +failed:
2294 + free(drv);
2295 + return NULL;
2296 +}
2297 +
2298 +
2299 +static void *i802_init(struct hostapd_data *hapd)
2300 +{
2301 + return i802_init_bssid(hapd, NULL);
2302 +}
2303 +
2304 +
2305 +static void i802_deinit(void *priv)
2306 +{
2307 + struct i802_driver_data *drv = priv;
2308 +
2309 + i802_del_beacon(drv);
2310 +
2311 + /* remove monitor interface */
2312 + nl80211_remove_iface(drv, drv->monitor_ifidx);
2313 +
2314 + (void) hostapd_set_iface_flags(drv, drv->iface, 0);
2315 +
2316 + if (drv->monitor_sock >= 0) {
2317 + eloop_unregister_read_sock(drv->monitor_sock);
2318 + close(drv->monitor_sock);
2319 + }
2320 + if (drv->ioctl_sock >= 0)
2321 + close(drv->ioctl_sock);
2322 + if (drv->eapol_sock >= 0) {
2323 + eloop_unregister_read_sock(drv->eapol_sock);
2324 + close(drv->eapol_sock);
2325 + }
2326 +
2327 + genl_family_put(drv->nl80211);
2328 + nl_cache_free(drv->nl_cache);
2329 + nl_handle_destroy(drv->nl_handle);
2330 +
2331 + if (drv->if_indices != drv->default_if_indices)
2332 + free(drv->if_indices);
2333 +
2334 + free(drv);
2335 +}
2336 +
2337 +
2338 +const struct wpa_driver_ops wpa_driver_nl80211_ops = {
2339 + .name = "nl80211",
2340 + .init = i802_init,
2341 +// .init_bssid = i802_init_bssid,
2342 + .deinit = i802_deinit,
2343 + .wireless_event_init = i802_wireless_event_init,
2344 + .wireless_event_deinit = i802_wireless_event_deinit,
2345 + .set_ieee8021x = i802_set_ieee8021x,
2346 + .set_privacy = i802_set_privacy,
2347 + .set_encryption = i802_set_encryption,
2348 + .get_seqnum = i802_get_seqnum,
2349 + .flush = i802_flush,
2350 + .read_sta_data = i802_read_sta_data,
2351 + .send_eapol = i802_send_eapol,
2352 + .sta_set_flags = i802_sta_set_flags,
2353 + .sta_deauth = i802_sta_deauth,
2354 + .sta_disassoc = i802_sta_disassoc,
2355 + .sta_remove = i802_sta_remove,
2356 + .set_ssid = i802_set_ssid,
2357 + .send_mgmt_frame = i802_send_mgmt_frame,
2358 + .sta_add = i802_sta_add,
2359 + .get_inact_sec = i802_get_inact_sec,
2360 + .sta_clear_stats = i802_sta_clear_stats,
2361 + .set_freq = i802_set_freq,
2362 + .set_rts = i802_set_rts,
2363 + .get_rts = i802_get_rts,
2364 + .set_frag = i802_set_frag,
2365 + .get_frag = i802_get_frag,
2366 + .set_retry = i802_set_retry,
2367 + .get_retry = i802_get_retry,
2368 + .set_rate_sets = i802_set_rate_sets,
2369 + .set_channel_flag = i802_set_channel_flag,
2370 + .set_regulatory_domain = i802_set_regulatory_domain,
2371 + .set_beacon = i802_set_beacon,
2372 + .set_internal_bridge = i802_set_internal_bridge,
2373 + .set_beacon_int = i802_set_beacon_int,
2374 + .set_dtim_period = i802_set_dtim_period,
2375 + .set_cts_protect = i802_set_cts_protect,
2376 + .set_preamble = i802_set_preamble,
2377 + .set_short_slot_time = i802_set_short_slot_time,
2378 + .set_tx_queue_params = i802_set_tx_queue_params,
2379 + .bss_add = i802_bss_add,
2380 + .bss_remove = i802_bss_remove,
2381 + .if_add = i802_if_add,
2382 + .if_update = i802_if_update,
2383 + .if_remove = i802_if_remove,
2384 + .get_hw_feature_data = i802_get_hw_feature_data,
2385 + .set_sta_vlan = i802_set_sta_vlan,
2386 +};
2387 diff -urN hostapd.orig/radiotap.c hostapd/radiotap.c
2388 --- a/hostapd/radiotap.c 1970-01-01 01:00:00.000000000 +0100
2389 +++ b/hostapd/radiotap.c 2008-02-15 23:05:17.000000000 +0100
2390 @@ -0,0 +1,287 @@
2391 +/*
2392 + * Radiotap parser
2393 + *
2394 + * Copyright 2007 Andy Green <andy@warmcat.com>
2395 + *
2396 + * This program is free software; you can redistribute it and/or modify
2397 + * it under the terms of the GNU General Public License version 2 as
2398 + * published by the Free Software Foundation.
2399 + *
2400 + * Alternatively, this software may be distributed under the terms of BSD
2401 + * license.
2402 + *
2403 + * See README and COPYING for more details.
2404 + *
2405 + *
2406 + * Modified for userspace by Johannes Berg <johannes@sipsolutions.net>
2407 + * I only modified some things on top to ease syncing should bugs be found.
2408 + */
2409 +
2410 +#include "includes.h"
2411 +
2412 +#include "common.h"
2413 +#include "radiotap_iter.h"
2414 +
2415 +#define le16_to_cpu le_to_host16
2416 +#define le32_to_cpu le_to_host32
2417 +#define __le32 uint32_t
2418 +#define ulong unsigned long
2419 +#define unlikely(cond) (cond)
2420 +#define get_unaligned(p) \
2421 +({ \
2422 + struct packed_dummy_struct { \
2423 + typeof(*(p)) __val; \
2424 + } __attribute__((packed)) *__ptr = (void *) (p); \
2425 + \
2426 + __ptr->__val; \
2427 +})
2428 +
2429 +/* function prototypes and related defs are in radiotap_iter.h */
2430 +
2431 +/**
2432 + * ieee80211_radiotap_iterator_init - radiotap parser iterator initialization
2433 + * @iterator: radiotap_iterator to initialize
2434 + * @radiotap_header: radiotap header to parse
2435 + * @max_length: total length we can parse into (eg, whole packet length)
2436 + *
2437 + * Returns: 0 or a negative error code if there is a problem.
2438 + *
2439 + * This function initializes an opaque iterator struct which can then
2440 + * be passed to ieee80211_radiotap_iterator_next() to visit every radiotap
2441 + * argument which is present in the header. It knows about extended
2442 + * present headers and handles them.
2443 + *
2444 + * How to use:
2445 + * call __ieee80211_radiotap_iterator_init() to init a semi-opaque iterator
2446 + * struct ieee80211_radiotap_iterator (no need to init the struct beforehand)
2447 + * checking for a good 0 return code. Then loop calling
2448 + * __ieee80211_radiotap_iterator_next()... it returns either 0,
2449 + * -ENOENT if there are no more args to parse, or -EINVAL if there is a problem.
2450 + * The iterator's @this_arg member points to the start of the argument
2451 + * associated with the current argument index that is present, which can be
2452 + * found in the iterator's @this_arg_index member. This arg index corresponds
2453 + * to the IEEE80211_RADIOTAP_... defines.
2454 + *
2455 + * Radiotap header length:
2456 + * You can find the CPU-endian total radiotap header length in
2457 + * iterator->max_length after executing ieee80211_radiotap_iterator_init()
2458 + * successfully.
2459 + *
2460 + * Alignment Gotcha:
2461 + * You must take care when dereferencing iterator.this_arg
2462 + * for multibyte types... the pointer is not aligned. Use
2463 + * get_unaligned((type *)iterator.this_arg) to dereference
2464 + * iterator.this_arg for type "type" safely on all arches.
2465 + *
2466 + * Example code:
2467 + * See Documentation/networking/radiotap-headers.txt
2468 + */
2469 +
2470 +int ieee80211_radiotap_iterator_init(
2471 + struct ieee80211_radiotap_iterator *iterator,
2472 + struct ieee80211_radiotap_header *radiotap_header,
2473 + int max_length)
2474 +{
2475 + /* Linux only supports version 0 radiotap format */
2476 + if (radiotap_header->it_version)
2477 + return -EINVAL;
2478 +
2479 + /* sanity check for allowed length and radiotap length field */
2480 + if (max_length < le16_to_cpu(get_unaligned(&radiotap_header->it_len)))
2481 + return -EINVAL;
2482 +
2483 + iterator->rtheader = radiotap_header;
2484 + iterator->max_length = le16_to_cpu(get_unaligned(
2485 + &radiotap_header->it_len));
2486 + iterator->arg_index = 0;
2487 + iterator->bitmap_shifter = le32_to_cpu(get_unaligned(
2488 + &radiotap_header->it_present));
2489 + iterator->arg = (u8 *)radiotap_header + sizeof(*radiotap_header);
2490 + iterator->this_arg = NULL;
2491 +
2492 + /* find payload start allowing for extended bitmap(s) */
2493 +
2494 + if (unlikely(iterator->bitmap_shifter & (1<<IEEE80211_RADIOTAP_EXT))) {
2495 + while (le32_to_cpu(get_unaligned((__le32 *)iterator->arg)) &
2496 + (1<<IEEE80211_RADIOTAP_EXT)) {
2497 + iterator->arg += sizeof(u32);
2498 +
2499 + /*
2500 + * check for insanity where the present bitmaps
2501 + * keep claiming to extend up to or even beyond the
2502 + * stated radiotap header length
2503 + */
2504 +
2505 + if (((ulong)iterator->arg - (ulong)iterator->rtheader)
2506 + > (ulong)iterator->max_length)
2507 + return -EINVAL;
2508 + }
2509 +
2510 + iterator->arg += sizeof(u32);
2511 +
2512 + /*
2513 + * no need to check again for blowing past stated radiotap
2514 + * header length, because ieee80211_radiotap_iterator_next
2515 + * checks it before it is dereferenced
2516 + */
2517 + }
2518 +
2519 + /* we are all initialized happily */
2520 +
2521 + return 0;
2522 +}
2523 +
2524 +
2525 +/**
2526 + * ieee80211_radiotap_iterator_next - return next radiotap parser iterator arg
2527 + * @iterator: radiotap_iterator to move to next arg (if any)
2528 + *
2529 + * Returns: 0 if there is an argument to handle,
2530 + * -ENOENT if there are no more args or -EINVAL
2531 + * if there is something else wrong.
2532 + *
2533 + * This function provides the next radiotap arg index (IEEE80211_RADIOTAP_*)
2534 + * in @this_arg_index and sets @this_arg to point to the
2535 + * payload for the field. It takes care of alignment handling and extended
2536 + * present fields. @this_arg can be changed by the caller (eg,
2537 + * incremented to move inside a compound argument like
2538 + * IEEE80211_RADIOTAP_CHANNEL). The args pointed to are in
2539 + * little-endian format whatever the endianess of your CPU.
2540 + *
2541 + * Alignment Gotcha:
2542 + * You must take care when dereferencing iterator.this_arg
2543 + * for multibyte types... the pointer is not aligned. Use
2544 + * get_unaligned((type *)iterator.this_arg) to dereference
2545 + * iterator.this_arg for type "type" safely on all arches.
2546 + */
2547 +
2548 +int ieee80211_radiotap_iterator_next(
2549 + struct ieee80211_radiotap_iterator *iterator)
2550 +{
2551 +
2552 + /*
2553 + * small length lookup table for all radiotap types we heard of
2554 + * starting from b0 in the bitmap, so we can walk the payload
2555 + * area of the radiotap header
2556 + *
2557 + * There is a requirement to pad args, so that args
2558 + * of a given length must begin at a boundary of that length
2559 + * -- but note that compound args are allowed (eg, 2 x u16
2560 + * for IEEE80211_RADIOTAP_CHANNEL) so total arg length is not
2561 + * a reliable indicator of alignment requirement.
2562 + *
2563 + * upper nybble: content alignment for arg
2564 + * lower nybble: content length for arg
2565 + */
2566 +
2567 + static const u8 rt_sizes[] = {
2568 + [IEEE80211_RADIOTAP_TSFT] = 0x88,
2569 + [IEEE80211_RADIOTAP_FLAGS] = 0x11,
2570 + [IEEE80211_RADIOTAP_RATE] = 0x11,
2571 + [IEEE80211_RADIOTAP_CHANNEL] = 0x24,
2572 + [IEEE80211_RADIOTAP_FHSS] = 0x22,
2573 + [IEEE80211_RADIOTAP_DBM_ANTSIGNAL] = 0x11,
2574 + [IEEE80211_RADIOTAP_DBM_ANTNOISE] = 0x11,
2575 + [IEEE80211_RADIOTAP_LOCK_QUALITY] = 0x22,
2576 + [IEEE80211_RADIOTAP_TX_ATTENUATION] = 0x22,
2577 + [IEEE80211_RADIOTAP_DB_TX_ATTENUATION] = 0x22,
2578 + [IEEE80211_RADIOTAP_DBM_TX_POWER] = 0x11,
2579 + [IEEE80211_RADIOTAP_ANTENNA] = 0x11,
2580 + [IEEE80211_RADIOTAP_DB_ANTSIGNAL] = 0x11,
2581 + [IEEE80211_RADIOTAP_DB_ANTNOISE] = 0x11,
2582 + [IEEE80211_RADIOTAP_RX_FLAGS] = 0x22,
2583 + [IEEE80211_RADIOTAP_TX_FLAGS] = 0x22,
2584 + [IEEE80211_RADIOTAP_RTS_RETRIES] = 0x11,
2585 + [IEEE80211_RADIOTAP_DATA_RETRIES] = 0x11,
2586 + /*
2587 + * add more here as they are defined in
2588 + * include/net/ieee80211_radiotap.h
2589 + */
2590 + };
2591 +
2592 + /*
2593 + * for every radiotap entry we can at
2594 + * least skip (by knowing the length)...
2595 + */
2596 +
2597 + while (iterator->arg_index < (int) sizeof(rt_sizes)) {
2598 + int hit = 0;
2599 + int pad;
2600 +
2601 + if (!(iterator->bitmap_shifter & 1))
2602 + goto next_entry; /* arg not present */
2603 +
2604 + /*
2605 + * arg is present, account for alignment padding
2606 + * 8-bit args can be at any alignment
2607 + * 16-bit args must start on 16-bit boundary
2608 + * 32-bit args must start on 32-bit boundary
2609 + * 64-bit args must start on 64-bit boundary
2610 + *
2611 + * note that total arg size can differ from alignment of
2612 + * elements inside arg, so we use upper nybble of length
2613 + * table to base alignment on
2614 + *
2615 + * also note: these alignments are ** relative to the
2616 + * start of the radiotap header **. There is no guarantee
2617 + * that the radiotap header itself is aligned on any
2618 + * kind of boundary.
2619 + *
2620 + * the above is why get_unaligned() is used to dereference
2621 + * multibyte elements from the radiotap area
2622 + */
2623 +
2624 + pad = (((ulong)iterator->arg) -
2625 + ((ulong)iterator->rtheader)) &
2626 + ((rt_sizes[iterator->arg_index] >> 4) - 1);
2627 +
2628 + if (pad)
2629 + iterator->arg +=
2630 + (rt_sizes[iterator->arg_index] >> 4) - pad;
2631 +
2632 + /*
2633 + * this is what we will return to user, but we need to
2634 + * move on first so next call has something fresh to test
2635 + */
2636 + iterator->this_arg_index = iterator->arg_index;
2637 + iterator->this_arg = iterator->arg;
2638 + hit = 1;
2639 +
2640 + /* internally move on the size of this arg */
2641 + iterator->arg += rt_sizes[iterator->arg_index] & 0x0f;
2642 +
2643 + /*
2644 + * check for insanity where we are given a bitmap that
2645 + * claims to have more arg content than the length of the
2646 + * radiotap section. We will normally end up equalling this
2647 + * max_length on the last arg, never exceeding it.
2648 + */
2649 +
2650 + if (((ulong)iterator->arg - (ulong)iterator->rtheader) >
2651 + (ulong) iterator->max_length)
2652 + return -EINVAL;
2653 +
2654 + next_entry:
2655 + iterator->arg_index++;
2656 + if (unlikely((iterator->arg_index & 31) == 0)) {
2657 + /* completed current u32 bitmap */
2658 + if (iterator->bitmap_shifter & 1) {
2659 + /* b31 was set, there is more */
2660 + /* move to next u32 bitmap */
2661 + iterator->bitmap_shifter = le32_to_cpu(
2662 + get_unaligned(iterator->next_bitmap));
2663 + iterator->next_bitmap++;
2664 + } else
2665 + /* no more bitmaps: end */
2666 + iterator->arg_index = sizeof(rt_sizes);
2667 + } else /* just try the next bit */
2668 + iterator->bitmap_shifter >>= 1;
2669 +
2670 + /* if we found a valid arg earlier, return it now */
2671 + if (hit)
2672 + return 0;
2673 + }
2674 +
2675 + /* we don't know how to handle any more args, we're done */
2676 + return -ENOENT;
2677 +}
2678 diff -urN hostapd.orig/radiotap.h hostapd/radiotap.h
2679 --- a/hostapd/radiotap.h 1970-01-01 01:00:00.000000000 +0100
2680 +++ b/hostapd/radiotap.h 2008-02-15 23:05:17.000000000 +0100
2681 @@ -0,0 +1,242 @@
2682 +/* $FreeBSD: src/sys/net80211/ieee80211_radiotap.h,v 1.5 2005/01/22 20:12:05 sam Exp $ */
2683 +/* $NetBSD: ieee80211_radiotap.h,v 1.11 2005/06/22 06:16:02 dyoung Exp $ */
2684 +
2685 +/*-
2686 + * Copyright (c) 2003, 2004 David Young. All rights reserved.
2687 + *
2688 + * Redistribution and use in source and binary forms, with or without
2689 + * modification, are permitted provided that the following conditions
2690 + * are met:
2691 + * 1. Redistributions of source code must retain the above copyright
2692 + * notice, this list of conditions and the following disclaimer.
2693 + * 2. Redistributions in binary form must reproduce the above copyright
2694 + * notice, this list of conditions and the following disclaimer in the
2695 + * documentation and/or other materials provided with the distribution.
2696 + * 3. The name of David Young may not be used to endorse or promote
2697 + * products derived from this software without specific prior
2698 + * written permission.
2699 + *
2700 + * THIS SOFTWARE IS PROVIDED BY DAVID YOUNG ``AS IS'' AND ANY
2701 + * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
2702 + * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
2703 + * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL DAVID
2704 + * YOUNG BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
2705 + * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED
2706 + * TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
2707 + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
2708 + * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
2709 + * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
2710 + * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
2711 + * OF SUCH DAMAGE.
2712 + */
2713 +
2714 +/*
2715 + * Modifications to fit into the linux IEEE 802.11 stack,
2716 + * Mike Kershaw (dragorn@kismetwireless.net)
2717 + */
2718 +
2719 +#ifndef IEEE80211RADIOTAP_H
2720 +#define IEEE80211RADIOTAP_H
2721 +
2722 +#include <stdint.h>
2723 +
2724 +/* Base version of the radiotap packet header data */
2725 +#define PKTHDR_RADIOTAP_VERSION 0
2726 +
2727 +/* A generic radio capture format is desirable. There is one for
2728 + * Linux, but it is neither rigidly defined (there were not even
2729 + * units given for some fields) nor easily extensible.
2730 + *
2731 + * I suggest the following extensible radio capture format. It is
2732 + * based on a bitmap indicating which fields are present.
2733 + *
2734 + * I am trying to describe precisely what the application programmer
2735 + * should expect in the following, and for that reason I tell the
2736 + * units and origin of each measurement (where it applies), or else I
2737 + * use sufficiently weaselly language ("is a monotonically nondecreasing
2738 + * function of...") that I cannot set false expectations for lawyerly
2739 + * readers.
2740 + */
2741 +
2742 +/* The radio capture header precedes the 802.11 header.
2743 + * All data in the header is little endian on all platforms.
2744 + */
2745 +struct ieee80211_radiotap_header {
2746 + uint8_t it_version; /* Version 0. Only increases
2747 + * for drastic changes,
2748 + * introduction of compatible
2749 + * new fields does not count.
2750 + */
2751 + uint8_t it_pad;
2752 + uint16_t it_len; /* length of the whole
2753 + * header in bytes, including
2754 + * it_version, it_pad,
2755 + * it_len, and data fields.
2756 + */
2757 + uint32_t it_present; /* A bitmap telling which
2758 + * fields are present. Set bit 31
2759 + * (0x80000000) to extend the
2760 + * bitmap by another 32 bits.
2761 + * Additional extensions are made
2762 + * by setting bit 31.
2763 + */
2764 +};
2765 +
2766 +/* Name Data type Units
2767 + * ---- --------- -----
2768 + *
2769 + * IEEE80211_RADIOTAP_TSFT __le64 microseconds
2770 + *
2771 + * Value in microseconds of the MAC's 64-bit 802.11 Time
2772 + * Synchronization Function timer when the first bit of the
2773 + * MPDU arrived at the MAC. For received frames, only.
2774 + *
2775 + * IEEE80211_RADIOTAP_CHANNEL 2 x uint16_t MHz, bitmap
2776 + *
2777 + * Tx/Rx frequency in MHz, followed by flags (see below).
2778 + *
2779 + * IEEE80211_RADIOTAP_FHSS uint16_t see below
2780 + *
2781 + * For frequency-hopping radios, the hop set (first byte)
2782 + * and pattern (second byte).
2783 + *
2784 + * IEEE80211_RADIOTAP_RATE u8 500kb/s
2785 + *
2786 + * Tx/Rx data rate
2787 + *
2788 + * IEEE80211_RADIOTAP_DBM_ANTSIGNAL s8 decibels from
2789 + * one milliwatt (dBm)
2790 + *
2791 + * RF signal power at the antenna, decibel difference from
2792 + * one milliwatt.
2793 + *
2794 + * IEEE80211_RADIOTAP_DBM_ANTNOISE s8 decibels from
2795 + * one milliwatt (dBm)
2796 + *
2797 + * RF noise power at the antenna, decibel difference from one
2798 + * milliwatt.
2799 + *
2800 + * IEEE80211_RADIOTAP_DB_ANTSIGNAL u8 decibel (dB)
2801 + *
2802 + * RF signal power at the antenna, decibel difference from an
2803 + * arbitrary, fixed reference.
2804 + *
2805 + * IEEE80211_RADIOTAP_DB_ANTNOISE u8 decibel (dB)
2806 + *
2807 + * RF noise power at the antenna, decibel difference from an
2808 + * arbitrary, fixed reference point.
2809 + *
2810 + * IEEE80211_RADIOTAP_LOCK_QUALITY uint16_t unitless
2811 + *
2812 + * Quality of Barker code lock. Unitless. Monotonically
2813 + * nondecreasing with "better" lock strength. Called "Signal
2814 + * Quality" in datasheets. (Is there a standard way to measure
2815 + * this?)
2816 + *
2817 + * IEEE80211_RADIOTAP_TX_ATTENUATION uint16_t unitless
2818 + *
2819 + * Transmit power expressed as unitless distance from max
2820 + * power set at factory calibration. 0 is max power.
2821 + * Monotonically nondecreasing with lower power levels.
2822 + *
2823 + * IEEE80211_RADIOTAP_DB_TX_ATTENUATION uint16_t decibels (dB)
2824 + *
2825 + * Transmit power expressed as decibel distance from max power
2826 + * set at factory calibration. 0 is max power. Monotonically
2827 + * nondecreasing with lower power levels.
2828 + *
2829 + * IEEE80211_RADIOTAP_DBM_TX_POWER s8 decibels from
2830 + * one milliwatt (dBm)
2831 + *
2832 + * Transmit power expressed as dBm (decibels from a 1 milliwatt
2833 + * reference). This is the absolute power level measured at
2834 + * the antenna port.
2835 + *
2836 + * IEEE80211_RADIOTAP_FLAGS u8 bitmap
2837 + *
2838 + * Properties of transmitted and received frames. See flags
2839 + * defined below.
2840 + *
2841 + * IEEE80211_RADIOTAP_ANTENNA u8 antenna index
2842 + *
2843 + * Unitless indication of the Rx/Tx antenna for this packet.
2844 + * The first antenna is antenna 0.
2845 + *
2846 + * IEEE80211_RADIOTAP_RX_FLAGS uint16_t bitmap
2847 + *
2848 + * Properties of received frames. See flags defined below.
2849 + *
2850 + * IEEE80211_RADIOTAP_TX_FLAGS uint16_t bitmap
2851 + *
2852 + * Properties of transmitted frames. See flags defined below.
2853 + *
2854 + * IEEE80211_RADIOTAP_RTS_RETRIES u8 data
2855 + *
2856 + * Number of rts retries a transmitted frame used.
2857 + *
2858 + * IEEE80211_RADIOTAP_DATA_RETRIES u8 data
2859 + *
2860 + * Number of unicast retries a transmitted frame used.
2861 + *
2862 + */
2863 +enum ieee80211_radiotap_type {
2864 + IEEE80211_RADIOTAP_TSFT = 0,
2865 + IEEE80211_RADIOTAP_FLAGS = 1,
2866 + IEEE80211_RADIOTAP_RATE = 2,
2867 + IEEE80211_RADIOTAP_CHANNEL = 3,
2868 + IEEE80211_RADIOTAP_FHSS = 4,
2869 + IEEE80211_RADIOTAP_DBM_ANTSIGNAL = 5,
2870 + IEEE80211_RADIOTAP_DBM_ANTNOISE = 6,
2871 + IEEE80211_RADIOTAP_LOCK_QUALITY = 7,
2872 + IEEE80211_RADIOTAP_TX_ATTENUATION = 8,
2873 + IEEE80211_RADIOTAP_DB_TX_ATTENUATION = 9,
2874 + IEEE80211_RADIOTAP_DBM_TX_POWER = 10,
2875 + IEEE80211_RADIOTAP_ANTENNA = 11,
2876 + IEEE80211_RADIOTAP_DB_ANTSIGNAL = 12,
2877 + IEEE80211_RADIOTAP_DB_ANTNOISE = 13,
2878 + IEEE80211_RADIOTAP_RX_FLAGS = 14,
2879 + IEEE80211_RADIOTAP_TX_FLAGS = 15,
2880 + IEEE80211_RADIOTAP_RTS_RETRIES = 16,
2881 + IEEE80211_RADIOTAP_DATA_RETRIES = 17,
2882 + IEEE80211_RADIOTAP_EXT = 31
2883 +};
2884 +
2885 +/* Channel flags. */
2886 +#define IEEE80211_CHAN_TURBO 0x0010 /* Turbo channel */
2887 +#define IEEE80211_CHAN_CCK 0x0020 /* CCK channel */
2888 +#define IEEE80211_CHAN_OFDM 0x0040 /* OFDM channel */
2889 +#define IEEE80211_CHAN_2GHZ 0x0080 /* 2 GHz spectrum channel. */
2890 +#define IEEE80211_CHAN_5GHZ 0x0100 /* 5 GHz spectrum channel */
2891 +#define IEEE80211_CHAN_PASSIVE 0x0200 /* Only passive scan allowed */
2892 +#define IEEE80211_CHAN_DYN 0x0400 /* Dynamic CCK-OFDM channel */
2893 +#define IEEE80211_CHAN_GFSK 0x0800 /* GFSK channel (FHSS PHY) */
2894 +
2895 +/* For IEEE80211_RADIOTAP_FLAGS */
2896 +#define IEEE80211_RADIOTAP_F_CFP 0x01 /* sent/received
2897 + * during CFP
2898 + */
2899 +#define IEEE80211_RADIOTAP_F_SHORTPRE 0x02 /* sent/received
2900 + * with short
2901 + * preamble
2902 + */
2903 +#define IEEE80211_RADIOTAP_F_WEP 0x04 /* sent/received
2904 + * with WEP encryption
2905 + */
2906 +#define IEEE80211_RADIOTAP_F_FRAG 0x08 /* sent/received
2907 + * with fragmentation
2908 + */
2909 +#define IEEE80211_RADIOTAP_F_FCS 0x10 /* frame includes FCS */
2910 +#define IEEE80211_RADIOTAP_F_DATAPAD 0x20 /* frame has padding between
2911 + * 802.11 header and payload
2912 + * (to 32-bit boundary)
2913 + */
2914 +/* For IEEE80211_RADIOTAP_RX_FLAGS */
2915 +#define IEEE80211_RADIOTAP_F_RX_BADFCS 0x0001 /* frame failed crc check */
2916 +
2917 +/* For IEEE80211_RADIOTAP_TX_FLAGS */
2918 +#define IEEE80211_RADIOTAP_F_TX_FAIL 0x0001 /* failed due to excessive
2919 + * retries */
2920 +#define IEEE80211_RADIOTAP_F_TX_CTS 0x0002 /* used cts 'protection' */
2921 +#define IEEE80211_RADIOTAP_F_TX_RTS 0x0004 /* used rts/cts handshake */
2922 +
2923 +#endif /* IEEE80211_RADIOTAP_H */
2924 diff -urN hostapd.orig/radiotap_iter.h hostapd/radiotap_iter.h
2925 --- a/hostapd/radiotap_iter.h 1970-01-01 01:00:00.000000000 +0100
2926 +++ b/hostapd/radiotap_iter.h 2008-02-15 23:05:17.000000000 +0100
2927 @@ -0,0 +1,41 @@
2928 +#ifndef __RADIOTAP_ITER_H
2929 +#define __RADIOTAP_ITER_H
2930 +
2931 +#include "radiotap.h"
2932 +
2933 +/* Radiotap header iteration
2934 + * implemented in radiotap.c
2935 + */
2936 +/**
2937 + * struct ieee80211_radiotap_iterator - tracks walk thru present radiotap args
2938 + * @rtheader: pointer to the radiotap header we are walking through
2939 + * @max_length: length of radiotap header in cpu byte ordering
2940 + * @this_arg_index: IEEE80211_RADIOTAP_... index of current arg
2941 + * @this_arg: pointer to current radiotap arg
2942 + * @arg_index: internal next argument index
2943 + * @arg: internal next argument pointer
2944 + * @next_bitmap: internal pointer to next present u32
2945 + * @bitmap_shifter: internal shifter for curr u32 bitmap, b0 set == arg present
2946 + */
2947 +
2948 +struct ieee80211_radiotap_iterator {
2949 + struct ieee80211_radiotap_header *rtheader;
2950 + int max_length;
2951 + int this_arg_index;
2952 + unsigned char *this_arg;
2953 +
2954 + int arg_index;
2955 + unsigned char *arg;
2956 + uint32_t *next_bitmap;
2957 + uint32_t bitmap_shifter;
2958 +};
2959 +
2960 +extern int ieee80211_radiotap_iterator_init(
2961 + struct ieee80211_radiotap_iterator *iterator,
2962 + struct ieee80211_radiotap_header *radiotap_header,
2963 + int max_length);
2964 +
2965 +extern int ieee80211_radiotap_iterator_next(
2966 + struct ieee80211_radiotap_iterator *iterator);
2967 +
2968 +#endif /* __RADIOTAP_ITER_H */
Personal OpenWRT clone
This page took 0.189128 seconds and 5 git commands to generate.