net/wireless/mlme.c

   1 /*
   2  * cfg80211 MLME SAP interface
   3  *
   4  * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
   5  */
   6
   7 #include <linux/kernel.h>
   8 #include <linux/module.h>
   9 #include <linux/netdevice.h>
  10 #include <linux/nl80211.h>
  11 #include <linux/slab.h>
  12 #include <linux/wireless.h>
  13 #include <net/cfg80211.h>
  14 #include <net/iw_handler.h>
  15 #include "core.h"
  16 #include "nl80211.h"
  17
  18 void cfg80211_send_rx_auth(struct net_device *dev, const u8 *buf, size_t len)
  19 {
  20         struct wireless_dev *wdev = dev->ieee80211_ptr;
  21         struct wiphy *wiphy = wdev->wiphy;
  22         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  23         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  24         u8 *bssid = mgmt->bssid;
  25         int i;
  26         u16 status = le16_to_cpu(mgmt->u.auth.status_code);
  27         bool done = false;
  28
  29         wdev_lock(wdev);
  30
  31         for (i = 0; i < MAX_AUTH_BSSES; i++) {
  32                 if (wdev->authtry_bsses[i] &&
  33                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
  34                                                         ETH_ALEN) == 0) {
  35                         if (status == WLAN_STATUS_SUCCESS) {
  36                                 wdev->auth_bsses[i] = wdev->authtry_bsses[i];
  37                         } else {
  38                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
  39                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
  40                         }
  41                         wdev->authtry_bsses[i] = NULL;
  42                         done = true;
  43                         break;
  44                 }
  45         }
  46
  47         if (done) {
  48                 nl80211_send_rx_auth(rdev, dev, buf, len, GFP_KERNEL);
  49                 cfg80211_sme_rx_auth(dev, buf, len);
  50         }
  51
  52         wdev_unlock(wdev);
  53 }
  54 EXPORT_SYMBOL(cfg80211_send_rx_auth);
  55
  56 void cfg80211_send_rx_assoc(struct net_device *dev, const u8 *buf, size_t len)
  57 {
  58         u16 status_code;
  59         struct wireless_dev *wdev = dev->ieee80211_ptr;
  60         struct wiphy *wiphy = wdev->wiphy;
  61         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
  62         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  63         u8 *ie = mgmt->u.assoc_resp.variable;
  64         int i, ieoffs = offsetof(struct ieee80211_mgmt, u.assoc_resp.variable);
  65         struct cfg80211_internal_bss *bss = NULL;
  66
  67         wdev_lock(wdev);
  68
  69         status_code = le16_to_cpu(mgmt->u.assoc_resp.status_code);
  70
  71         /*
  72          * This is a bit of a hack, we don't notify userspace of
  73          * a (re-)association reply if we tried to send a reassoc
  74          * and got a reject -- we only try again with an assoc
  75          * frame instead of reassoc.
  76          */
  77         if (status_code != WLAN_STATUS_SUCCESS && wdev->conn &&
  78             cfg80211_sme_failed_reassoc(wdev))
  79                 goto out;
  80
  81         nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL);
  82
  83         if (status_code == WLAN_STATUS_SUCCESS) {
  84                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
  85                         if (!wdev->auth_bsses[i])
  86                                 continue;
  87                         if (memcmp(wdev->auth_bsses[i]->pub.bssid, mgmt->bssid,
  88                                    ETH_ALEN) == 0) {
  89                                 bss = wdev->auth_bsses[i];
  90                                 wdev->auth_bsses[i] = NULL;
  91                                 /* additional reference to drop hold */
  92                                 cfg80211_ref_bss(bss);
  93                                 break;
  94                         }
  95                 }
  96
  97                 /*
  98                  * We might be coming here because the driver reported
  99                  * a successful association at the same time as the
 100                  * user requested a deauth. In that case, we will have
 101                  * removed the BSS from the auth_bsses list due to the
 102                  * deauth request when the assoc response makes it. If
 103                  * the two code paths acquire the lock the other way
 104                  * around, that's just the standard situation of a
 105                  * deauth being requested while connected.
 106                  */
 107                 if (!bss)
 108                         goto out;
 109         } else if (wdev->conn) {
 110                 cfg80211_sme_failed_assoc(wdev);
 111                 /*
 112                  * do not call connect_result() now because the
 113                  * sme will schedule work that does it later.
 114                  */
 115                 goto out;
 116         }
 117
 118         if (!wdev->conn && wdev->sme_state == CFG80211_SME_IDLE) {
 119                 /*
 120                  * This is for the userspace SME, the CONNECTING
 121                  * state will be changed to CONNECTED by
 122                  * __cfg80211_connect_result() below.
 123                  */
 124                 wdev->sme_state = CFG80211_SME_CONNECTING;
 125         }
 126
 127         /* this consumes one bss reference (unless bss is NULL) */
 128         __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, ie, len - ieoffs,
 129                                   status_code,
 130                                   status_code == WLAN_STATUS_SUCCESS,
 131                                   bss ? &bss->pub : NULL);
 132         /* drop hold now, and also reference acquired above */
 133         if (bss) {
 134                 cfg80211_unhold_bss(bss);
 135                 cfg80211_put_bss(&bss->pub);
 136         }
 137
 138  out:
 139         wdev_unlock(wdev);
 140 }
 141 EXPORT_SYMBOL(cfg80211_send_rx_assoc);
 142
 143 void __cfg80211_send_deauth(struct net_device *dev,
 144                                    const u8 *buf, size_t len)
 145 {
 146         struct wireless_dev *wdev = dev->ieee80211_ptr;
 147         struct wiphy *wiphy = wdev->wiphy;
 148         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 149         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 150         const u8 *bssid = mgmt->bssid;
 151         int i;
 152         bool found = false, was_current = false;
 153
 154         ASSERT_WDEV_LOCK(wdev);
 155
 156         if (wdev->current_bss &&
 157             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 158                 cfg80211_unhold_bss(wdev->current_bss);
 159                 cfg80211_put_bss(&wdev->current_bss->pub);
 160                 wdev->current_bss = NULL;
 161                 found = true;
 162                 was_current = true;
 163         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 164                 if (wdev->auth_bsses[i] &&
 165                     memcmp(wdev->auth_bsses[i]->pub.bssid, bssid, ETH_ALEN) == 0) {
 166                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
 167                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 168                         wdev->auth_bsses[i] = NULL;
 169                         found = true;
 170                         break;
 171                 }
 172                 if (wdev->authtry_bsses[i] &&
 173                     memcmp(wdev->authtry_bsses[i]->pub.bssid, bssid,
 174                            ETH_ALEN) == 0 &&
 175                     memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) == 0) {
 176                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 177                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 178                         wdev->authtry_bsses[i] = NULL;
 179                         found = true;
 180                         break;
 181                 }
 182         }
 183
 184         if (!found)
 185                 return;
 186
 187         nl80211_send_deauth(rdev, dev, buf, len, GFP_KERNEL);
 188
 189         if (wdev->sme_state == CFG80211_SME_CONNECTED && was_current) {
 190                 u16 reason_code;
 191                 bool from_ap;
 192
 193                 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 194
 195                 from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 196                 __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 197         } else if (wdev->sme_state == CFG80211_SME_CONNECTING) {
 198                 __cfg80211_connect_result(dev, mgmt->bssid, NULL, 0, NULL, 0,
 199                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 200                                           false, NULL);
 201         }
 202 }
 203 EXPORT_SYMBOL(__cfg80211_send_deauth);
 204
 205 void cfg80211_send_deauth(struct net_device *dev, const u8 *buf, size_t len)
 206 {
 207         struct wireless_dev *wdev = dev->ieee80211_ptr;
 208
 209         wdev_lock(wdev);
 210         __cfg80211_send_deauth(dev, buf, len);
 211         wdev_unlock(wdev);
 212 }
 213 EXPORT_SYMBOL(cfg80211_send_deauth);
 214
 215 void __cfg80211_send_disassoc(struct net_device *dev,
 216                                      const u8 *buf, size_t len)
 217 {
 218         struct wireless_dev *wdev = dev->ieee80211_ptr;
 219         struct wiphy *wiphy = wdev->wiphy;
 220         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 221         struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
 222         const u8 *bssid = mgmt->bssid;
 223         int i;
 224         u16 reason_code;
 225         bool from_ap;
 226         bool done = false;
 227
 228         ASSERT_WDEV_LOCK(wdev);
 229
 230         nl80211_send_disassoc(rdev, dev, buf, len, GFP_KERNEL);
 231
 232         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 233                 return;
 234
 235         if (wdev->current_bss &&
 236             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 237                 for (i = 0; i < MAX_AUTH_BSSES; i++) {
 238                         if (wdev->authtry_bsses[i] || wdev->auth_bsses[i])
 239                                 continue;
 240                         wdev->auth_bsses[i] = wdev->current_bss;
 241                         wdev->current_bss = NULL;
 242                         done = true;
 243                         cfg80211_sme_disassoc(dev, i);
 244                         break;
 245                 }
 246                 WARN_ON(!done);
 247         } else
 248                 WARN_ON(1);
 249
 250
 251         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 252
 253         from_ap = memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0;
 254         __cfg80211_disconnected(dev, NULL, 0, reason_code, from_ap);
 255 }
 256 EXPORT_SYMBOL(__cfg80211_send_disassoc);
 257
 258 void cfg80211_send_disassoc(struct net_device *dev, const u8 *buf, size_t len)
 259 {
 260         struct wireless_dev *wdev = dev->ieee80211_ptr;
 261
 262         wdev_lock(wdev);
 263         __cfg80211_send_disassoc(dev, buf, len);
 264         wdev_unlock(wdev);
 265 }
 266 EXPORT_SYMBOL(cfg80211_send_disassoc);
 267
 268 void cfg80211_send_unprot_deauth(struct net_device *dev, const u8 *buf,
 269                                  size_t len)
 270 {
 271         struct wireless_dev *wdev = dev->ieee80211_ptr;
 272         struct wiphy *wiphy = wdev->wiphy;
 273         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 274
 275         nl80211_send_unprot_deauth(rdev, dev, buf, len, GFP_ATOMIC);
 276 }
 277 EXPORT_SYMBOL(cfg80211_send_unprot_deauth);
 278
 279 void cfg80211_send_unprot_disassoc(struct net_device *dev, const u8 *buf,
 280                                    size_t len)
 281 {
 282         struct wireless_dev *wdev = dev->ieee80211_ptr;
 283         struct wiphy *wiphy = wdev->wiphy;
 284         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 285
 286         nl80211_send_unprot_disassoc(rdev, dev, buf, len, GFP_ATOMIC);
 287 }
 288 EXPORT_SYMBOL(cfg80211_send_unprot_disassoc);
 289
 290 static void __cfg80211_auth_remove(struct wireless_dev *wdev, const u8 *addr)
 291 {
 292         int i;
 293         bool done = false;
 294
 295         ASSERT_WDEV_LOCK(wdev);
 296
 297         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 298                 if (wdev->authtry_bsses[i] &&
 299                     memcmp(wdev->authtry_bsses[i]->pub.bssid,
 300                            addr, ETH_ALEN) == 0) {
 301                         cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 302                         cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 303                         wdev->authtry_bsses[i] = NULL;
 304                         done = true;
 305                         break;
 306                 }
 307         }
 308
 309         WARN_ON(!done);
 310 }
 311
 312 void __cfg80211_auth_canceled(struct net_device *dev, const u8 *addr)
 313 {
 314         __cfg80211_auth_remove(dev->ieee80211_ptr, addr);
 315 }
 316 EXPORT_SYMBOL(__cfg80211_auth_canceled);
 317
 318 void cfg80211_send_auth_timeout(struct net_device *dev, const u8 *addr)
 319 {
 320         struct wireless_dev *wdev = dev->ieee80211_ptr;
 321         struct wiphy *wiphy = wdev->wiphy;
 322         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 323
 324         wdev_lock(wdev);
 325
 326         nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
 327         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 328                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 329                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 330                                           false, NULL);
 331
 332         __cfg80211_auth_remove(wdev, addr);
 333
 334         wdev_unlock(wdev);
 335 }
 336 EXPORT_SYMBOL(cfg80211_send_auth_timeout);
 337
 338 void cfg80211_send_assoc_timeout(struct net_device *dev, const u8 *addr)
 339 {
 340         struct wireless_dev *wdev = dev->ieee80211_ptr;
 341         struct wiphy *wiphy = wdev->wiphy;
 342         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 343         int i;
 344         bool done = false;
 345
 346         wdev_lock(wdev);
 347
 348         nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);
 349         if (wdev->sme_state == CFG80211_SME_CONNECTING)
 350                 __cfg80211_connect_result(dev, addr, NULL, 0, NULL, 0,
 351                                           WLAN_STATUS_UNSPECIFIED_FAILURE,
 352                                           false, NULL);
 353
 354         for (i = 0; addr && i < MAX_AUTH_BSSES; i++) {
 355                 if (wdev->auth_bsses[i] &&
 356                     memcmp(wdev->auth_bsses[i]->pub.bssid,
 357                            addr, ETH_ALEN) == 0) {
 358                         cfg80211_unhold_bss(wdev->auth_bsses[i]);
 359                         cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 360                         wdev->auth_bsses[i] = NULL;
 361                         done = true;
 362                         break;
 363                 }
 364         }
 365
 366         WARN_ON(!done);
 367
 368         wdev_unlock(wdev);
 369 }
 370 EXPORT_SYMBOL(cfg80211_send_assoc_timeout);
 371
 372 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
 373                                   enum nl80211_key_type key_type, int key_id,
 374                                   const u8 *tsc, gfp_t gfp)
 375 {
 376         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 377         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 378 #ifdef CONFIG_CFG80211_WEXT
 379         union iwreq_data wrqu;
 380         char *buf = kmalloc(128, gfp);
 381
 382         if (buf) {
 383                 sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
 384                         "keyid=%d %scast addr=%pM)", key_id,
 385                         key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
 386                         addr);
 387                 memset(&wrqu, 0, sizeof(wrqu));
 388                 wrqu.data.length = strlen(buf);
 389                 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
 390                 kfree(buf);
 391         }
 392 #endif
 393
 394         nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
 395 }
 396 EXPORT_SYMBOL(cfg80211_michael_mic_failure);
 397
 398 /* some MLME handling for userspace SME */
 399 int __cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 400                          struct net_device *dev,
 401                          struct ieee80211_channel *chan,
 402                          enum nl80211_auth_type auth_type,
 403                          const u8 *bssid,
 404                          const u8 *ssid, int ssid_len,
 405                          const u8 *ie, int ie_len,
 406                          const u8 *key, int key_len, int key_idx,
 407                          bool local_state_change)
 408 {
 409         struct wireless_dev *wdev = dev->ieee80211_ptr;
 410         struct cfg80211_auth_request req;
 411         struct cfg80211_internal_bss *bss;
 412         int i, err, slot = -1, nfree = 0;
 413
 414         ASSERT_WDEV_LOCK(wdev);
 415
 416         if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
 417                 if (!key || !key_len || key_idx < 0 || key_idx > 4)
 418                         return -EINVAL;
 419
 420         if (wdev->current_bss &&
 421             memcmp(bssid, wdev->current_bss->pub.bssid, ETH_ALEN) == 0)
 422                 return -EALREADY;
 423
 424         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 425                 if (wdev->authtry_bsses[i] &&
 426                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid,
 427                                                 ETH_ALEN) == 0)
 428                         return -EALREADY;
 429                 if (wdev->auth_bsses[i] &&
 430                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid,
 431                                                 ETH_ALEN) == 0)
 432                         return -EALREADY;
 433         }
 434
 435         memset(&req, 0, sizeof(req));
 436
 437         req.local_state_change = local_state_change;
 438         req.ie = ie;
 439         req.ie_len = ie_len;
 440         req.auth_type = auth_type;
 441         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 442                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 443         req.key = key;
 444         req.key_len = key_len;
 445         req.key_idx = key_idx;
 446         if (!req.bss)
 447                 return -ENOENT;
 448
 449         bss = bss_from_pub(req.bss);
 450
 451         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 452                 if (!wdev->auth_bsses[i] && !wdev->authtry_bsses[i]) {
 453                         slot = i;
 454                         nfree++;
 455                 }
 456         }
 457
 458         /* we need one free slot for disassoc and one for this auth */
 459         if (nfree < 2) {
 460                 err = -ENOSPC;
 461                 goto out;
 462         }
 463
 464         if (local_state_change)
 465                 wdev->auth_bsses[slot] = bss;
 466         else
 467                 wdev->authtry_bsses[slot] = bss;
 468         cfg80211_hold_bss(bss);
 469
 470         err = rdev->ops->auth(&rdev->wiphy, dev, &req);
 471         if (err) {
 472                 if (local_state_change)
 473                         wdev->auth_bsses[slot] = NULL;
 474                 else
 475                         wdev->authtry_bsses[slot] = NULL;
 476                 cfg80211_unhold_bss(bss);
 477         }
 478
 479  out:
 480         if (err)
 481                 cfg80211_put_bss(req.bss);
 482         return err;
 483 }
 484
 485 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
 486                        struct net_device *dev, struct ieee80211_channel *chan,
 487                        enum nl80211_auth_type auth_type, const u8 *bssid,
 488                        const u8 *ssid, int ssid_len,
 489                        const u8 *ie, int ie_len,
 490                        const u8 *key, int key_len, int key_idx,
 491                        bool local_state_change)
 492 {
 493         int err;
 494
 495         wdev_lock(dev->ieee80211_ptr);
 496         err = __cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
 497                                    ssid, ssid_len, ie, ie_len,
 498                                    key, key_len, key_idx, local_state_change);
 499         wdev_unlock(dev->ieee80211_ptr);
 500
 501         return err;
 502 }
 503
 504 int __cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 505                           struct net_device *dev,
 506                           struct ieee80211_channel *chan,
 507                           const u8 *bssid, const u8 *prev_bssid,
 508                           const u8 *ssid, int ssid_len,
 509                           const u8 *ie, int ie_len, bool use_mfp,
 510                           struct cfg80211_crypto_settings *crypt)
 511 {
 512         struct wireless_dev *wdev = dev->ieee80211_ptr;
 513         struct cfg80211_assoc_request req;
 514         struct cfg80211_internal_bss *bss;
 515         int i, err, slot = -1;
 516         bool was_connected = false;
 517
 518         ASSERT_WDEV_LOCK(wdev);
 519
 520         memset(&req, 0, sizeof(req));
 521
 522         if (wdev->current_bss && prev_bssid &&
 523             memcmp(wdev->current_bss->pub.bssid, prev_bssid, ETH_ALEN) == 0) {
 524                 /*
 525                  * Trying to reassociate: Allow this to proceed and let the old
 526                  * association to be dropped when the new one is completed.
 527                  */
 528                 if (wdev->sme_state == CFG80211_SME_CONNECTED) {
 529                         was_connected = true;
 530                         wdev->sme_state = CFG80211_SME_CONNECTING;
 531                 }
 532         } else if (wdev->current_bss)
 533                 return -EALREADY;
 534
 535         req.ie = ie;
 536         req.ie_len = ie_len;
 537         memcpy(&req.crypto, crypt, sizeof(req.crypto));
 538         req.use_mfp = use_mfp;
 539         req.prev_bssid = prev_bssid;
 540         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
 541                                    WLAN_CAPABILITY_ESS, WLAN_CAPABILITY_ESS);
 542         if (!req.bss) {
 543                 if (was_connected)
 544                         wdev->sme_state = CFG80211_SME_CONNECTED;
 545                 return -ENOENT;
 546         }
 547
 548         bss = bss_from_pub(req.bss);
 549
 550         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 551                 if (bss == wdev->auth_bsses[i]) {
 552                         slot = i;
 553                         break;
 554                 }
 555         }
 556
 557         if (slot < 0) {
 558                 err = -ENOTCONN;
 559                 goto out;
 560         }
 561
 562         err = rdev->ops->assoc(&rdev->wiphy, dev, &req);
 563  out:
 564         if (err && was_connected)
 565                 wdev->sme_state = CFG80211_SME_CONNECTED;
 566         /* still a reference in wdev->auth_bsses[slot] */
 567         cfg80211_put_bss(req.bss);
 568         return err;
 569 }
 570
 571 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
 572                         struct net_device *dev,
 573                         struct ieee80211_channel *chan,
 574                         const u8 *bssid, const u8 *prev_bssid,
 575                         const u8 *ssid, int ssid_len,
 576                         const u8 *ie, int ie_len, bool use_mfp,
 577                         struct cfg80211_crypto_settings *crypt)
 578 {
 579         struct wireless_dev *wdev = dev->ieee80211_ptr;
 580         int err;
 581
 582         wdev_lock(wdev);
 583         err = __cfg80211_mlme_assoc(rdev, dev, chan, bssid, prev_bssid,
 584                                     ssid, ssid_len, ie, ie_len, use_mfp, crypt);
 585         wdev_unlock(wdev);
 586
 587         return err;
 588 }
 589
 590 int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 591                            struct net_device *dev, const u8 *bssid,
 592                            const u8 *ie, int ie_len, u16 reason,
 593                            bool local_state_change)
 594 {
 595         struct wireless_dev *wdev = dev->ieee80211_ptr;
 596         struct cfg80211_deauth_request req;
 597         int i;
 598
 599         ASSERT_WDEV_LOCK(wdev);
 600
 601         memset(&req, 0, sizeof(req));
 602         req.reason_code = reason;
 603         req.local_state_change = local_state_change;
 604         req.ie = ie;
 605         req.ie_len = ie_len;
 606         if (wdev->current_bss &&
 607             memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0) {
 608                 req.bss = &wdev->current_bss->pub;
 609         } else for (i = 0; i < MAX_AUTH_BSSES; i++) {
 610                 if (wdev->auth_bsses[i] &&
 611                     memcmp(bssid, wdev->auth_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 612                         req.bss = &wdev->auth_bsses[i]->pub;
 613                         break;
 614                 }
 615                 if (wdev->authtry_bsses[i] &&
 616                     memcmp(bssid, wdev->authtry_bsses[i]->pub.bssid, ETH_ALEN) == 0) {
 617                         req.bss = &wdev->authtry_bsses[i]->pub;
 618                         break;
 619                 }
 620         }
 621
 622         if (!req.bss)
 623                 return -ENOTCONN;
 624
 625         return rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 626 }
 627
 628 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
 629                          struct net_device *dev, const u8 *bssid,
 630                          const u8 *ie, int ie_len, u16 reason,
 631                          bool local_state_change)
 632 {
 633         struct wireless_dev *wdev = dev->ieee80211_ptr;
 634         int err;
 635
 636         wdev_lock(wdev);
 637         err = __cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason,
 638                                      local_state_change);
 639         wdev_unlock(wdev);
 640
 641         return err;
 642 }
 643
 644 static int __cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 645                                     struct net_device *dev, const u8 *bssid,
 646                                     const u8 *ie, int ie_len, u16 reason,
 647                                     bool local_state_change)
 648 {
 649         struct wireless_dev *wdev = dev->ieee80211_ptr;
 650         struct cfg80211_disassoc_request req;
 651
 652         ASSERT_WDEV_LOCK(wdev);
 653
 654         if (wdev->sme_state != CFG80211_SME_CONNECTED)
 655                 return -ENOTCONN;
 656
 657         if (WARN_ON(!wdev->current_bss))
 658                 return -ENOTCONN;
 659
 660         memset(&req, 0, sizeof(req));
 661         req.reason_code = reason;
 662         req.local_state_change = local_state_change;
 663         req.ie = ie;
 664         req.ie_len = ie_len;
 665         if (memcmp(wdev->current_bss->pub.bssid, bssid, ETH_ALEN) == 0)
 666                 req.bss = &wdev->current_bss->pub;
 667         else
 668                 return -ENOTCONN;
 669
 670         return rdev->ops->disassoc(&rdev->wiphy, dev, &req, wdev);
 671 }
 672
 673 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
 674                            struct net_device *dev, const u8 *bssid,
 675                            const u8 *ie, int ie_len, u16 reason,
 676                            bool local_state_change)
 677 {
 678         struct wireless_dev *wdev = dev->ieee80211_ptr;
 679         int err;
 680
 681         wdev_lock(wdev);
 682         err = __cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason,
 683                                        local_state_change);
 684         wdev_unlock(wdev);
 685
 686         return err;
 687 }
 688
 689 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
 690                         struct net_device *dev)
 691 {
 692         struct wireless_dev *wdev = dev->ieee80211_ptr;
 693         struct cfg80211_deauth_request req;
 694         int i;
 695
 696         ASSERT_WDEV_LOCK(wdev);
 697
 698         if (!rdev->ops->deauth)
 699                 return;
 700
 701         memset(&req, 0, sizeof(req));
 702         req.reason_code = WLAN_REASON_DEAUTH_LEAVING;
 703         req.ie = NULL;
 704         req.ie_len = 0;
 705
 706         if (wdev->current_bss) {
 707                 req.bss = &wdev->current_bss->pub;
 708                 rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 709                 if (wdev->current_bss) {
 710                         cfg80211_unhold_bss(wdev->current_bss);
 711                         cfg80211_put_bss(&wdev->current_bss->pub);
 712                         wdev->current_bss = NULL;
 713                 }
 714         }
 715
 716         for (i = 0; i < MAX_AUTH_BSSES; i++) {
 717                 if (wdev->auth_bsses[i]) {
 718                         req.bss = &wdev->auth_bsses[i]->pub;
 719                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 720                         if (wdev->auth_bsses[i]) {
 721                                 cfg80211_unhold_bss(wdev->auth_bsses[i]);
 722                                 cfg80211_put_bss(&wdev->auth_bsses[i]->pub);
 723                                 wdev->auth_bsses[i] = NULL;
 724                         }
 725                 }
 726                 if (wdev->authtry_bsses[i]) {
 727                         req.bss = &wdev->authtry_bsses[i]->pub;
 728                         rdev->ops->deauth(&rdev->wiphy, dev, &req, wdev);
 729                         if (wdev->authtry_bsses[i]) {
 730                                 cfg80211_unhold_bss(wdev->authtry_bsses[i]);
 731                                 cfg80211_put_bss(&wdev->authtry_bsses[i]->pub);
 732                                 wdev->authtry_bsses[i] = NULL;
 733                         }
 734                 }
 735         }
 736 }
 737
 738 void cfg80211_ready_on_channel(struct net_device *dev, u64 cookie,
 739                                struct ieee80211_channel *chan,
 740                                enum nl80211_channel_type channel_type,
 741                                unsigned int duration, gfp_t gfp)
 742 {
 743         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 744         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 745
 746         nl80211_send_remain_on_channel(rdev, dev, cookie, chan, channel_type,
 747                                        duration, gfp);
 748 }
 749 EXPORT_SYMBOL(cfg80211_ready_on_channel);
 750
 751 void cfg80211_remain_on_channel_expired(struct net_device *dev,
 752                                         u64 cookie,
 753                                         struct ieee80211_channel *chan,
 754                                         enum nl80211_channel_type channel_type,
 755                                         gfp_t gfp)
 756 {
 757         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 758         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 759
 760         nl80211_send_remain_on_channel_cancel(rdev, dev, cookie, chan,
 761                                               channel_type, gfp);
 762 }
 763 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
 764
 765 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
 766                       struct station_info *sinfo, gfp_t gfp)
 767 {
 768         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 769         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 770
 771         nl80211_send_sta_event(rdev, dev, mac_addr, sinfo, gfp);
 772 }
 773 EXPORT_SYMBOL(cfg80211_new_sta);
 774
 775 void cfg80211_del_sta(struct net_device *dev, const u8 *mac_addr, gfp_t gfp)
 776 {
 777         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
 778         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 779
 780         nl80211_send_sta_del_event(rdev, dev, mac_addr, gfp);
 781 }
 782 EXPORT_SYMBOL(cfg80211_del_sta);
 783
 784 struct cfg80211_mgmt_registration {
 785         struct list_head list;
 786
 787         u32 nlpid;
 788
 789         int match_len;
 790
 791         __le16 frame_type;
 792
 793         u8 match[];
 794 };
 795
 796 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_pid,
 797                                 u16 frame_type, const u8 *match_data,
 798                                 int match_len)
 799 {
 800         struct wiphy *wiphy = wdev->wiphy;
 801         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 802         struct cfg80211_mgmt_registration *reg, *nreg;
 803         int err = 0;
 804         u16 mgmt_type;
 805
 806         if (!wdev->wiphy->mgmt_stypes)
 807                 return -EOPNOTSUPP;
 808
 809         if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT)
 810                 return -EINVAL;
 811
 812         if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE))
 813                 return -EINVAL;
 814
 815         mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
 816         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type)))
 817                 return -EINVAL;
 818
 819         nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
 820         if (!nreg)
 821                 return -ENOMEM;
 822
 823         spin_lock_bh(&wdev->mgmt_registrations_lock);
 824
 825         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
 826                 int mlen = min(match_len, reg->match_len);
 827
 828                 if (frame_type != le16_to_cpu(reg->frame_type))
 829                         continue;
 830
 831                 if (memcmp(reg->match, match_data, mlen) == 0) {
 832                         err = -EALREADY;
 833                         break;
 834                 }
 835         }
 836
 837         if (err) {
 838                 kfree(nreg);
 839                 goto out;
 840         }
 841
 842         memcpy(nreg->match, match_data, match_len);
 843         nreg->match_len = match_len;
 844         nreg->nlpid = snd_pid;
 845         nreg->frame_type = cpu_to_le16(frame_type);
 846         list_add(&nreg->list, &wdev->mgmt_registrations);
 847
 848         if (rdev->ops->mgmt_frame_register)
 849                 rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 850                                                frame_type, true);
 851
 852  out:
 853         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 854
 855         return err;
 856 }
 857
 858 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlpid)
 859 {
 860         struct wiphy *wiphy = wdev->wiphy;
 861         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
 862         struct cfg80211_mgmt_registration *reg, *tmp;
 863
 864         spin_lock_bh(&wdev->mgmt_registrations_lock);
 865
 866         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 867                 if (reg->nlpid != nlpid)
 868                         continue;
 869
 870                 if (rdev->ops->mgmt_frame_register) {
 871                         u16 frame_type = le16_to_cpu(reg->frame_type);
 872
 873                         rdev->ops->mgmt_frame_register(wiphy, wdev->netdev,
 874                                                        frame_type, false);
 875                 }
 876
 877                 list_del(&reg->list);
 878                 kfree(reg);
 879         }
 880
 881         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 882 }
 883
 884 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
 885 {
 886         struct cfg80211_mgmt_registration *reg, *tmp;
 887
 888         spin_lock_bh(&wdev->mgmt_registrations_lock);
 889
 890         list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
 891                 list_del(&reg->list);
 892                 kfree(reg);
 893         }
 894
 895         spin_unlock_bh(&wdev->mgmt_registrations_lock);
 896 }
 897
 898 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
 899                           struct net_device *dev,
 900                           struct ieee80211_channel *chan, bool offchan,
 901                           enum nl80211_channel_type channel_type,
 902                           bool channel_type_valid, unsigned int wait,
 903                           const u8 *buf, size_t len, u64 *cookie)
 904 {
 905         struct wireless_dev *wdev = dev->ieee80211_ptr;
 906         const struct ieee80211_mgmt *mgmt;
 907         u16 stype;
 908
 909         if (!wdev->wiphy->mgmt_stypes)
 910                 return -EOPNOTSUPP;
 911
 912         if (!rdev->ops->mgmt_tx)
 913                 return -EOPNOTSUPP;
 914
 915         if (len < 24 + 1)
 916                 return -EINVAL;
 917
 918         mgmt = (const struct ieee80211_mgmt *) buf;
 919
 920         if (!ieee80211_is_mgmt(mgmt->frame_control))
 921                 return -EINVAL;
 922
 923         stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
 924         if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
 925                 return -EINVAL;
 926
 927         if (ieee80211_is_action(mgmt->frame_control) &&
 928             mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
 929                 int err = 0;
 930
 931                 wdev_lock(wdev);
 932
 933                 switch (wdev->iftype) {
 934                 case NL80211_IFTYPE_ADHOC:
 935                 case NL80211_IFTYPE_STATION:
 936                 case NL80211_IFTYPE_P2P_CLIENT:
 937                         if (!wdev->current_bss) {
 938                                 err = -ENOTCONN;
 939                                 break;
 940                         }
 941
 942                         if (memcmp(wdev->current_bss->pub.bssid,
 943                                    mgmt->bssid, ETH_ALEN)) {
 944                                 err = -ENOTCONN;
 945                                 break;
 946                         }
 947
 948                         /*
 949                          * check for IBSS DA must be done by driver as
 950                          * cfg80211 doesn't track the stations
 951                          */
 952                         if (wdev->iftype == NL80211_IFTYPE_ADHOC)
 953                                 break;
 954
 955                         /* for station, check that DA is the AP */
 956                         if (memcmp(wdev->current_bss->pub.bssid,
 957                                    mgmt->da, ETH_ALEN)) {
 958                                 err = -ENOTCONN;
 959                                 break;
 960                         }
 961                         break;
 962                 case NL80211_IFTYPE_AP:
 963                 case NL80211_IFTYPE_P2P_GO:
 964                 case NL80211_IFTYPE_AP_VLAN:
 965                         if (memcmp(mgmt->bssid, dev->dev_addr, ETH_ALEN))
 966                                 err = -EINVAL;
 967                         break;
 968                 case NL80211_IFTYPE_MESH_POINT:
 969                         if (memcmp(mgmt->sa, mgmt->bssid, ETH_ALEN)) {
 970                                 err = -EINVAL;
 971                                 break;
 972                         }
 973                         /*
 974                          * check for mesh DA must be done by driver as
 975                          * cfg80211 doesn't track the stations
 976                          */
 977                         break;
 978                 default:
 979                         err = -EOPNOTSUPP;
 980                         break;
 981                 }
 982                 wdev_unlock(wdev);
 983
 984                 if (err)
 985                         return err;
 986         }
 987
 988         if (memcmp(mgmt->sa, dev->dev_addr, ETH_ALEN) != 0)
 989                 return -EINVAL;
 990
 991         /* Transmit the Action frame as requested by user space */
 992         return rdev->ops->mgmt_tx(&rdev->wiphy, dev, chan, offchan,
 993                                   channel_type, channel_type_valid,
 994                                   wait, buf, len, cookie);
 995 }
 996
 997 bool cfg80211_rx_mgmt(struct net_device *dev, int freq, const u8 *buf,
 998                       size_t len, gfp_t gfp)
 999 {
1000         struct wireless_dev *wdev = dev->ieee80211_ptr;
1001         struct wiphy *wiphy = wdev->wiphy;
1002         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1003         struct cfg80211_mgmt_registration *reg;
1004         const struct ieee80211_txrx_stypes *stypes =
1005                 &wiphy->mgmt_stypes[wdev->iftype];
1006         struct ieee80211_mgmt *mgmt = (void *)buf;
1007         const u8 *data;
1008         int data_len;
1009         bool result = false;
1010         __le16 ftype = mgmt->frame_control &
1011                 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
1012         u16 stype;
1013
1014         stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
1015
1016         if (!(stypes->rx & BIT(stype)))
1017                 return false;
1018
1019         data = buf + ieee80211_hdrlen(mgmt->frame_control);
1020         data_len = len - ieee80211_hdrlen(mgmt->frame_control);
1021
1022         spin_lock_bh(&wdev->mgmt_registrations_lock);
1023
1024         list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
1025                 if (reg->frame_type != ftype)
1026                         continue;
1027
1028                 if (reg->match_len > data_len)
1029                         continue;
1030
1031                 if (memcmp(reg->match, data, reg->match_len))
1032                         continue;
1033
1034                 /* found match! */
1035
1036                 /* Indicate the received Action frame to user space */
1037                 if (nl80211_send_mgmt(rdev, dev, reg->nlpid, freq,
1038                                       buf, len, gfp))
1039                         continue;
1040
1041                 result = true;
1042                 break;
1043         }
1044
1045         spin_unlock_bh(&wdev->mgmt_registrations_lock);
1046
1047         return result;
1048 }
1049 EXPORT_SYMBOL(cfg80211_rx_mgmt);
1050
1051 void cfg80211_mgmt_tx_status(struct net_device *dev, u64 cookie,
1052                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
1053 {
1054         struct wireless_dev *wdev = dev->ieee80211_ptr;
1055         struct wiphy *wiphy = wdev->wiphy;
1056         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1057
1058         /* Indicate TX status of the Action frame to user space */
1059         nl80211_send_mgmt_tx_status(rdev, dev, cookie, buf, len, ack, gfp);
1060 }
1061 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
1062
1063 void cfg80211_cqm_rssi_notify(struct net_device *dev,
1064                               enum nl80211_cqm_rssi_threshold_event rssi_event,
1065                               gfp_t gfp)
1066 {
1067         struct wireless_dev *wdev = dev->ieee80211_ptr;
1068         struct wiphy *wiphy = wdev->wiphy;
1069         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1070
1071         /* Indicate roaming trigger event to user space */
1072         nl80211_send_cqm_rssi_notify(rdev, dev, rssi_event, gfp);
1073 }
1074 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
1075
1076 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
1077                                  const u8 *peer, u32 num_packets, gfp_t gfp)
1078 {
1079         struct wireless_dev *wdev = dev->ieee80211_ptr;
1080         struct wiphy *wiphy = wdev->wiphy;
1081         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1082
1083         /* Indicate roaming trigger event to user space */
1084         nl80211_send_cqm_pktloss_notify(rdev, dev, peer, num_packets, gfp);
1085 }
1086 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
1087
1088 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
1089                                const u8 *replay_ctr, gfp_t gfp)
1090 {
1091         struct wireless_dev *wdev = dev->ieee80211_ptr;
1092         struct wiphy *wiphy = wdev->wiphy;
1093         struct cfg80211_registered_device *rdev = wiphy_to_dev(wiphy);
1094
1095         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
1096 }
1097 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);