1 /*
2  * hostapd / IEEE 802.11 Management
3  * Copyright (c) 2002-2024, Jouni Malinen <j@w1.fi>
4  *
5  * This software may be distributed under the terms of the BSD license.
6  * See README for more details.
7  */
8 
9 #include "utils/includes.h"
10 
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ocv.h"
14 #include "common/wpa_ctrl.h"
15 #include "hostapd.h"
16 #include "sta_info.h"
17 #include "ap_config.h"
18 #include "ap_drv_ops.h"
19 #include "wpa_auth.h"
20 #include "dpp_hostapd.h"
21 #include "ieee802_11.h"
22 
23 
hostapd_eid_timeout_interval(u8 * pos,u8 type,u32 value)24 static u8 * hostapd_eid_timeout_interval(u8 *pos, u8 type, u32 value)
25 {
26 	*pos++ = WLAN_EID_TIMEOUT_INTERVAL;
27 	*pos++ = 5;
28 	*pos++ = type;
29 	WPA_PUT_LE32(pos, value);
30 	pos += 4;
31 
32 	return pos;
33 }
34 
35 
hostapd_eid_assoc_comeback_time(struct hostapd_data * hapd,struct sta_info * sta,u8 * eid)36 u8 * hostapd_eid_assoc_comeback_time(struct hostapd_data *hapd,
37 				     struct sta_info *sta, u8 *eid)
38 {
39 	u32 timeout, tu;
40 	struct os_reltime now, passed;
41 	u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
42 
43 	os_get_reltime(&now);
44 	os_reltime_sub(&now, &sta->sa_query_start, &passed);
45 	tu = (passed.sec * 1000000 + passed.usec) / 1024;
46 	if (hapd->conf->assoc_sa_query_max_timeout > tu)
47 		timeout = hapd->conf->assoc_sa_query_max_timeout - tu;
48 	else
49 		timeout = 0;
50 	if (timeout < hapd->conf->assoc_sa_query_max_timeout)
51 		timeout++; /* add some extra time for local timers */
52 
53 #ifdef CONFIG_TESTING_OPTIONS
54 	if (hapd->conf->test_assoc_comeback_type != -1)
55 		type = hapd->conf->test_assoc_comeback_type;
56 #endif /* CONFIG_TESTING_OPTIONS */
57 	return hostapd_eid_timeout_interval(eid, type, timeout);
58 }
59 
60 
61 /* MLME-SAQuery.request */
ieee802_11_send_sa_query_req(struct hostapd_data * hapd,const u8 * addr,const u8 * trans_id)62 void ieee802_11_send_sa_query_req(struct hostapd_data *hapd,
63 				  const u8 *addr, const u8 *trans_id)
64 {
65 #if defined(CONFIG_OCV) || defined(CONFIG_IEEE80211BE)
66 	struct sta_info *sta = ap_get_sta(hapd, addr);
67 #endif /* CONFIG_OCV || CONFIG_IEEE80211BE */
68 	struct ieee80211_mgmt *mgmt;
69 	u8 *oci_ie = NULL;
70 	u8 oci_ie_len = 0;
71 	u8 *end;
72 	const u8 *own_addr = hapd->own_addr;
73 
74 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Request to "
75 		   MACSTR, MAC2STR(addr));
76 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
77 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
78 
79 #ifdef CONFIG_OCV
80 	if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
81 		struct wpa_channel_info ci;
82 
83 		if (hostapd_drv_channel_info(hapd, &ci) != 0) {
84 			wpa_printf(MSG_WARNING,
85 				   "Failed to get channel info for OCI element in SA Query Request");
86 			return;
87 		}
88 #ifdef CONFIG_TESTING_OPTIONS
89 		if (hapd->conf->oci_freq_override_saquery_req) {
90 			wpa_printf(MSG_INFO,
91 				   "TEST: Override OCI frequency %d -> %u MHz",
92 				   ci.frequency,
93 				   hapd->conf->oci_freq_override_saquery_req);
94 			ci.frequency =
95 				hapd->conf->oci_freq_override_saquery_req;
96 		}
97 #endif /* CONFIG_TESTING_OPTIONS */
98 
99 		oci_ie_len = OCV_OCI_EXTENDED_LEN;
100 		oci_ie = os_zalloc(oci_ie_len);
101 		if (!oci_ie) {
102 			wpa_printf(MSG_WARNING,
103 				   "Failed to allocate buffer for OCI element in SA Query Request");
104 			return;
105 		}
106 
107 		if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
108 			os_free(oci_ie);
109 			return;
110 		}
111 	}
112 #endif /* CONFIG_OCV */
113 
114 	mgmt = os_zalloc(sizeof(*mgmt) + oci_ie_len);
115 	if (!mgmt) {
116 		wpa_printf(MSG_DEBUG,
117 			   "Failed to allocate buffer for SA Query Response frame");
118 		os_free(oci_ie);
119 		return;
120 	}
121 
122 #ifdef CONFIG_IEEE80211BE
123 	if (ap_sta_is_mld(hapd, sta))
124 		own_addr = hapd->mld->mld_addr;
125 #endif /* CONFIG_IEEE80211BE */
126 
127 	mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
128 					   WLAN_FC_STYPE_ACTION);
129 	os_memcpy(mgmt->da, addr, ETH_ALEN);
130 	os_memcpy(mgmt->sa, own_addr, ETH_ALEN);
131 	os_memcpy(mgmt->bssid, own_addr, ETH_ALEN);
132 	mgmt->u.action.category = WLAN_ACTION_SA_QUERY;
133 	mgmt->u.action.u.sa_query_req.action = WLAN_SA_QUERY_REQUEST;
134 	os_memcpy(mgmt->u.action.u.sa_query_req.trans_id, trans_id,
135 		  WLAN_SA_QUERY_TR_ID_LEN);
136 	end = mgmt->u.action.u.sa_query_req.variable;
137 #ifdef CONFIG_OCV
138 	if (oci_ie_len > 0) {
139 		os_memcpy(end, oci_ie, oci_ie_len);
140 		end += oci_ie_len;
141 	}
142 #endif /* CONFIG_OCV */
143 	if (hostapd_drv_send_mlme(hapd, mgmt, end - (u8 *) mgmt, 0, NULL, 0, 0)
144 	    < 0)
145 		wpa_printf(MSG_INFO, "ieee802_11_send_sa_query_req: send failed");
146 
147 	os_free(mgmt);
148 	os_free(oci_ie);
149 }
150 
151 
ieee802_11_send_sa_query_resp(struct hostapd_data * hapd,const u8 * sa,const u8 * trans_id)152 static void ieee802_11_send_sa_query_resp(struct hostapd_data *hapd,
153 					  const u8 *sa, const u8 *trans_id)
154 {
155 	struct sta_info *sta;
156 	struct ieee80211_mgmt *resp;
157 	u8 *oci_ie = NULL;
158 	u8 oci_ie_len = 0;
159 	u8 *end;
160 	const u8 *own_addr = hapd->own_addr;
161 
162 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Request from "
163 		   MACSTR, MAC2STR(sa));
164 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
165 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
166 
167 	sta = ap_get_sta(hapd, sa);
168 	if (sta == NULL || !(sta->flags & WLAN_STA_ASSOC)) {
169 		wpa_printf(MSG_DEBUG, "IEEE 802.11: Ignore SA Query Request "
170 			   "from unassociated STA " MACSTR, MAC2STR(sa));
171 		return;
172 	}
173 
174 #ifdef CONFIG_OCV
175 	if (wpa_auth_uses_ocv(sta->wpa_sm)) {
176 		struct wpa_channel_info ci;
177 
178 		if (hostapd_drv_channel_info(hapd, &ci) != 0) {
179 			wpa_printf(MSG_WARNING,
180 				   "Failed to get channel info for OCI element in SA Query Response");
181 			return;
182 		}
183 #ifdef CONFIG_TESTING_OPTIONS
184 		if (hapd->conf->oci_freq_override_saquery_resp) {
185 			wpa_printf(MSG_INFO,
186 				   "TEST: Override OCI frequency %d -> %u MHz",
187 				   ci.frequency,
188 				   hapd->conf->oci_freq_override_saquery_resp);
189 			ci.frequency =
190 				hapd->conf->oci_freq_override_saquery_resp;
191 		}
192 #endif /* CONFIG_TESTING_OPTIONS */
193 
194 		oci_ie_len = OCV_OCI_EXTENDED_LEN;
195 		oci_ie = os_zalloc(oci_ie_len);
196 		if (!oci_ie) {
197 			wpa_printf(MSG_WARNING,
198 				   "Failed to allocate buffer for for OCI element in SA Query Response");
199 			return;
200 		}
201 
202 		if (ocv_insert_extended_oci(&ci, oci_ie) < 0) {
203 			os_free(oci_ie);
204 			return;
205 		}
206 	}
207 #endif /* CONFIG_OCV */
208 
209 	resp = os_zalloc(sizeof(*resp) + oci_ie_len);
210 	if (!resp) {
211 		wpa_printf(MSG_DEBUG,
212 			   "Failed to allocate buffer for SA Query Response frame");
213 		os_free(oci_ie);
214 		return;
215 	}
216 
217 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Sending SA Query Response to "
218 		   MACSTR, MAC2STR(sa));
219 
220 #ifdef CONFIG_IEEE80211BE
221 	if (ap_sta_is_mld(hapd, sta))
222 		own_addr = hapd->mld->mld_addr;
223 #endif /* CONFIG_IEEE80211BE */
224 
225 	resp->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
226 					   WLAN_FC_STYPE_ACTION);
227 	os_memcpy(resp->da, sa, ETH_ALEN);
228 	os_memcpy(resp->sa, own_addr, ETH_ALEN);
229 	os_memcpy(resp->bssid, own_addr, ETH_ALEN);
230 	resp->u.action.category = WLAN_ACTION_SA_QUERY;
231 	resp->u.action.u.sa_query_req.action = WLAN_SA_QUERY_RESPONSE;
232 	os_memcpy(resp->u.action.u.sa_query_req.trans_id, trans_id,
233 		  WLAN_SA_QUERY_TR_ID_LEN);
234 	end = resp->u.action.u.sa_query_req.variable;
235 #ifdef CONFIG_OCV
236 	if (oci_ie_len > 0) {
237 		os_memcpy(end, oci_ie, oci_ie_len);
238 		end += oci_ie_len;
239 	}
240 #endif /* CONFIG_OCV */
241 	if (hostapd_drv_send_mlme(hapd, resp, end - (u8 *) resp, 0, NULL, 0, 0)
242 	    < 0)
243 		wpa_printf(MSG_INFO, "ieee80211_mgmt_sa_query_request: send failed");
244 
245 	os_free(resp);
246 	os_free(oci_ie);
247 }
248 
249 
ieee802_11_sa_query_action(struct hostapd_data * hapd,const struct ieee80211_mgmt * mgmt,size_t len)250 void ieee802_11_sa_query_action(struct hostapd_data *hapd,
251 				const struct ieee80211_mgmt *mgmt,
252 				size_t len)
253 {
254 	struct sta_info *sta;
255 	int i;
256 	const u8 *sa = mgmt->sa;
257 	const u8 action_type = mgmt->u.action.u.sa_query_resp.action;
258 	const u8 *trans_id = mgmt->u.action.u.sa_query_resp.trans_id;
259 
260 	if (((const u8 *) mgmt) + len <
261 	    mgmt->u.action.u.sa_query_resp.variable) {
262 		wpa_printf(MSG_DEBUG,
263 			   "IEEE 802.11: Too short SA Query Action frame (len=%lu)",
264 			   (unsigned long) len);
265 		return;
266 	}
267 	if (is_multicast_ether_addr(mgmt->da)) {
268 		wpa_printf(MSG_DEBUG,
269 			   "IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
270 			   MAC2STR(mgmt->da), MAC2STR(mgmt->sa));
271 		return;
272 	}
273 
274 	sta = ap_get_sta(hapd, sa);
275 
276 #ifdef CONFIG_OCV
277 	if (sta && wpa_auth_uses_ocv(sta->wpa_sm)) {
278 		struct ieee802_11_elems elems;
279 		struct wpa_channel_info ci;
280 		int tx_chanwidth;
281 		int tx_seg1_idx;
282 		size_t ies_len;
283 		const u8 *ies;
284 
285 		ies = mgmt->u.action.u.sa_query_resp.variable;
286 		ies_len = len - (ies - (u8 *) mgmt);
287 		if (ieee802_11_parse_elems(ies, ies_len, &elems, 1) ==
288 		    ParseFailed) {
289 			wpa_printf(MSG_DEBUG,
290 				   "SA Query: Failed to parse elements");
291 			return;
292 		}
293 
294 		if (hostapd_drv_channel_info(hapd, &ci) != 0) {
295 			wpa_printf(MSG_WARNING,
296 				   "Failed to get channel info to validate received OCI in SA Query Action frame");
297 			return;
298 		}
299 
300 		if (get_sta_tx_parameters(sta->wpa_sm,
301 					  channel_width_to_int(ci.chanwidth),
302 					  ci.seg1_idx, &tx_chanwidth,
303 					  &tx_seg1_idx) < 0)
304 			return;
305 
306 		if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
307 					 tx_chanwidth, tx_seg1_idx) !=
308 		    OCI_SUCCESS) {
309 			wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
310 				MACSTR " frame=saquery%s error=%s",
311 				MAC2STR(sa),
312 				action_type == WLAN_SA_QUERY_REQUEST ?
313 				"req" : "resp", ocv_errorstr);
314 			return;
315 		}
316 	}
317 #endif /* CONFIG_OCV */
318 
319 	if (action_type == WLAN_SA_QUERY_REQUEST) {
320 		if (sta)
321 			sta->post_csa_sa_query = 0;
322 		ieee802_11_send_sa_query_resp(hapd, sa, trans_id);
323 		return;
324 	}
325 
326 	if (action_type != WLAN_SA_QUERY_RESPONSE) {
327 		wpa_printf(MSG_DEBUG, "IEEE 802.11: Unexpected SA Query "
328 			   "Action %d", action_type);
329 		return;
330 	}
331 
332 	wpa_printf(MSG_DEBUG, "IEEE 802.11: Received SA Query Response from "
333 		   MACSTR, MAC2STR(sa));
334 	wpa_hexdump(MSG_DEBUG, "IEEE 802.11: SA Query Transaction ID",
335 		    trans_id, WLAN_SA_QUERY_TR_ID_LEN);
336 
337 	/* MLME-SAQuery.confirm */
338 
339 	if (sta == NULL || sta->sa_query_trans_id == NULL) {
340 		wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching STA with "
341 			   "pending SA Query request found");
342 		return;
343 	}
344 
345 	for (i = 0; i < sta->sa_query_count; i++) {
346 		if (os_memcmp(sta->sa_query_trans_id +
347 			      i * WLAN_SA_QUERY_TR_ID_LEN,
348 			      trans_id, WLAN_SA_QUERY_TR_ID_LEN) == 0)
349 			break;
350 	}
351 
352 	if (i >= sta->sa_query_count) {
353 		wpa_printf(MSG_DEBUG, "IEEE 802.11: No matching SA Query "
354 			   "transaction identifier found");
355 		return;
356 	}
357 
358 	hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
359 		       HOSTAPD_LEVEL_DEBUG,
360 		       "Reply to pending SA Query received");
361 	ap_sta_stop_sa_query(hapd, sta);
362 }
363 
364 
hostapd_ext_capab_byte(struct hostapd_data * hapd,u8 * pos,int idx,bool mbssid_complete)365 static void hostapd_ext_capab_byte(struct hostapd_data *hapd, u8 *pos, int idx,
366 				   bool mbssid_complete)
367 {
368 	*pos = 0x00;
369 
370 	switch (idx) {
371 	case 0: /* Bits 0-7 */
372 		if (hapd->iconf->obss_interval)
373 			*pos |= 0x01; /* Bit 0 - Coexistence management */
374 		if (hapd->iface->drv_flags & WPA_DRIVER_FLAGS_AP_CSA)
375 			*pos |= 0x04; /* Bit 2 - Extended Channel Switching */
376 		break;
377 	case 1: /* Bits 8-15 */
378 		if (hapd->conf->proxy_arp)
379 			*pos |= 0x10; /* Bit 12 - Proxy ARP */
380 		if (hapd->conf->coloc_intf_reporting) {
381 			/* Bit 13 - Collocated Interference Reporting */
382 			*pos |= 0x20;
383 		}
384 		break;
385 	case 2: /* Bits 16-23 */
386 		if (hapd->conf->wnm_sleep_mode)
387 			*pos |= 0x02; /* Bit 17 - WNM-Sleep Mode */
388 		if (hapd->conf->bss_transition)
389 			*pos |= 0x08; /* Bit 19 - BSS Transition */
390 		if (hapd->iconf->mbssid)
391 			*pos |= 0x40; /* Bit 22 - Multiple BSSID */
392 		break;
393 	case 3: /* Bits 24-31 */
394 #ifdef CONFIG_WNM_AP
395 		*pos |= 0x02; /* Bit 25 - SSID List */
396 #endif /* CONFIG_WNM_AP */
397 		if (hapd->conf->time_advertisement == 2)
398 			*pos |= 0x08; /* Bit 27 - UTC TSF Offset */
399 		if (hapd->conf->interworking)
400 			*pos |= 0x80; /* Bit 31 - Interworking */
401 		break;
402 	case 4: /* Bits 32-39 */
403 		if (hapd->conf->qos_map_set_len)
404 			*pos |= 0x01; /* Bit 32 - QoS Map */
405 		if (hapd->conf->tdls & TDLS_PROHIBIT)
406 			*pos |= 0x40; /* Bit 38 - TDLS Prohibited */
407 		if (hapd->conf->tdls & TDLS_PROHIBIT_CHAN_SWITCH) {
408 			/* Bit 39 - TDLS Channel Switching Prohibited */
409 			*pos |= 0x80;
410 		}
411 		break;
412 	case 5: /* Bits 40-47 */
413 #ifdef CONFIG_HS20
414 		if (hapd->conf->hs20)
415 			*pos |= 0x40; /* Bit 46 - WNM-Notification */
416 #endif /* CONFIG_HS20 */
417 #ifdef CONFIG_MBO
418 		if (hapd->conf->mbo_enabled)
419 			*pos |= 0x40; /* Bit 46 - WNM-Notification */
420 #endif /* CONFIG_MBO */
421 		break;
422 	case 6: /* Bits 48-55 */
423 		if (hapd->conf->ssid.utf8_ssid)
424 			*pos |= 0x01; /* Bit 48 - UTF-8 SSID */
425 		break;
426 	case 7: /* Bits 56-63 */
427 		break;
428 	case 8: /* Bits 64-71 */
429 		if (hapd->conf->ftm_responder)
430 			*pos |= 0x40; /* Bit 70 - FTM responder */
431 		if (hapd->conf->ftm_initiator)
432 			*pos |= 0x80; /* Bit 71 - FTM initiator */
433 		break;
434 	case 9: /* Bits 72-79 */
435 #ifdef CONFIG_FILS
436 		if ((hapd->conf->wpa & WPA_PROTO_RSN) &&
437 		    wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
438 			*pos |= 0x01;
439 #endif /* CONFIG_FILS */
440 #ifdef CONFIG_IEEE80211AX
441 		if (hostapd_get_he_twt_responder(hapd, IEEE80211_MODE_AP))
442 			*pos |= 0x40; /* Bit 78 - TWT responder */
443 #endif /* CONFIG_IEEE80211AX */
444 		if (hostapd_get_ht_vht_twt_responder(hapd))
445 			*pos |= 0x40; /* Bit 78 - TWT responder */
446 		break;
447 	case 10: /* Bits 80-87 */
448 #ifdef CONFIG_SAE
449 		if (hapd->conf->wpa &&
450 		    wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt)) {
451 			int in_use = hostapd_sae_pw_id_in_use(hapd->conf);
452 
453 			if (in_use)
454 				*pos |= 0x02; /* Bit 81 - SAE Password
455 					       * Identifiers In Use */
456 			if (in_use == 2)
457 				*pos |= 0x04; /* Bit 82 - SAE Password
458 					       * Identifiers Used Exclusively */
459 		}
460 #endif /* CONFIG_SAE */
461 		if (hapd->conf->beacon_prot &&
462 		    (hapd->iface->drv_flags &
463 		     WPA_DRIVER_FLAGS_BEACON_PROTECTION))
464 			*pos |= 0x10; /* Bit 84 - Beacon Protection Enabled */
465 		if (hapd->iconf->mbssid == ENHANCED_MBSSID_ENABLED)
466 			*pos |= 0x08; /* Bit 83 - Enhanced multiple BSSID */
467 		if (mbssid_complete)
468 			*pos |= 0x01; /* Bit 80 - Complete List of NonTxBSSID
469 				       * Profiles */
470 		break;
471 	case 11: /* Bits 88-95 */
472 #ifdef CONFIG_SAE_PK
473 		if (hapd->conf->wpa &&
474 		    wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
475 		    hostapd_sae_pk_exclusively(hapd->conf))
476 			*pos |= 0x01; /* Bit 88 - SAE PK Exclusively */
477 #endif /* CONFIG_SAE_PK */
478 		break;
479 	case 12: /* Bits 96-103 */
480 		if (hapd->iconf->peer_to_peer_twt)
481 			*pos |= 0x10; /* Bit 100 - Peer to Peer TWT */
482 		if (hapd->conf->known_sta_identification)
483 			*pos |= 0x40; /* Bit 102 - Known STA Identification
484 				       * Enabled */
485 		break;
486 	case 13: /* Bits 104-111 */
487 		if (hapd->iconf->channel_usage)
488 			*pos |= 0x01; /* Bit 104 - Channel Usage support */
489 		break;
490 	}
491 }
492 
493 
hostapd_eid_ext_capab(struct hostapd_data * hapd,u8 * eid,bool mbssid_complete)494 u8 * hostapd_eid_ext_capab(struct hostapd_data *hapd, u8 *eid,
495 			   bool mbssid_complete)
496 {
497 	u8 *pos = eid;
498 	u8 len = EXT_CAPA_MAX_LEN, i;
499 
500 	if (len < hapd->iface->extended_capa_len)
501 		len = hapd->iface->extended_capa_len;
502 
503 	*pos++ = WLAN_EID_EXT_CAPAB;
504 	*pos++ = len;
505 	for (i = 0; i < len; i++, pos++) {
506 		hostapd_ext_capab_byte(hapd, pos, i, mbssid_complete);
507 
508 		if (i < hapd->iface->extended_capa_len) {
509 			*pos &= ~hapd->iface->extended_capa_mask[i];
510 			*pos |= hapd->iface->extended_capa[i];
511 		}
512 
513 		if (i < EXT_CAPA_MAX_LEN) {
514 			*pos &= ~hapd->conf->ext_capa_mask[i];
515 			*pos |= hapd->conf->ext_capa[i];
516 		}
517 
518 		/* Clear bits 83 and 22 if EMA and MBSSID are not enabled
519 		 * otherwise association fails with some clients */
520 		if (i == 10 && hapd->iconf->mbssid < ENHANCED_MBSSID_ENABLED)
521 			*pos &= ~0x08;
522 		if (i == 2 && !hapd->iconf->mbssid)
523 			*pos &= ~0x40;
524 	}
525 
526 	while (len > 0 && eid[1 + len] == 0) {
527 		len--;
528 		eid[1] = len;
529 	}
530 	if (len == 0)
531 		return eid;
532 
533 	return eid + 2 + len;
534 }
535 
536 
hostapd_eid_qos_map_set(struct hostapd_data * hapd,u8 * eid)537 u8 * hostapd_eid_qos_map_set(struct hostapd_data *hapd, u8 *eid)
538 {
539 	u8 *pos = eid;
540 	u8 len = hapd->conf->qos_map_set_len;
541 
542 	if (!len)
543 		return eid;
544 
545 	*pos++ = WLAN_EID_QOS_MAP_SET;
546 	*pos++ = len;
547 	os_memcpy(pos, hapd->conf->qos_map_set, len);
548 	pos += len;
549 
550 	return pos;
551 }
552 
553 
hostapd_eid_interworking(struct hostapd_data * hapd,u8 * eid)554 u8 * hostapd_eid_interworking(struct hostapd_data *hapd, u8 *eid)
555 {
556 	u8 *pos = eid;
557 #ifdef CONFIG_INTERWORKING
558 	u8 *len;
559 
560 	if (!hapd->conf->interworking)
561 		return eid;
562 
563 	*pos++ = WLAN_EID_INTERWORKING;
564 	len = pos++;
565 
566 	*pos = hapd->conf->access_network_type;
567 	if (hapd->conf->internet)
568 		*pos |= INTERWORKING_ANO_INTERNET;
569 	if (hapd->conf->asra)
570 		*pos |= INTERWORKING_ANO_ASRA;
571 	if (hapd->conf->esr)
572 		*pos |= INTERWORKING_ANO_ESR;
573 	if (hapd->conf->uesa)
574 		*pos |= INTERWORKING_ANO_UESA;
575 	pos++;
576 
577 	if (hapd->conf->venue_info_set) {
578 		*pos++ = hapd->conf->venue_group;
579 		*pos++ = hapd->conf->venue_type;
580 	}
581 
582 	if (!is_zero_ether_addr(hapd->conf->hessid)) {
583 		os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
584 		pos += ETH_ALEN;
585 	}
586 
587 	*len = pos - len - 1;
588 #endif /* CONFIG_INTERWORKING */
589 
590 	return pos;
591 }
592 
593 
hostapd_eid_adv_proto(struct hostapd_data * hapd,u8 * eid)594 u8 * hostapd_eid_adv_proto(struct hostapd_data *hapd, u8 *eid)
595 {
596 	u8 *pos = eid;
597 #ifdef CONFIG_INTERWORKING
598 
599 	/* TODO: Separate configuration for ANQP? */
600 	if (!hapd->conf->interworking)
601 		return eid;
602 
603 	*pos++ = WLAN_EID_ADV_PROTO;
604 	*pos++ = 2;
605 	*pos++ = 0x7F; /* Query Response Length Limit | PAME-BI */
606 	*pos++ = ACCESS_NETWORK_QUERY_PROTOCOL;
607 #endif /* CONFIG_INTERWORKING */
608 
609 	return pos;
610 }
611 
612 
hostapd_eid_roaming_consortium(struct hostapd_data * hapd,u8 * eid)613 u8 * hostapd_eid_roaming_consortium(struct hostapd_data *hapd, u8 *eid)
614 {
615 	u8 *pos = eid;
616 #ifdef CONFIG_INTERWORKING
617 	u8 *len;
618 	unsigned int i, count;
619 
620 	if (!hapd->conf->interworking ||
621 	    hapd->conf->roaming_consortium == NULL ||
622 	    hapd->conf->roaming_consortium_count == 0)
623 		return eid;
624 
625 	*pos++ = WLAN_EID_ROAMING_CONSORTIUM;
626 	len = pos++;
627 
628 	/* Number of ANQP OIs (in addition to the max 3 listed here) */
629 	if (hapd->conf->roaming_consortium_count > 3 + 255)
630 		*pos++ = 255;
631 	else if (hapd->conf->roaming_consortium_count > 3)
632 		*pos++ = hapd->conf->roaming_consortium_count - 3;
633 	else
634 		*pos++ = 0;
635 
636 	/* OU #1 and #2 Lengths */
637 	*pos = hapd->conf->roaming_consortium[0].len;
638 	if (hapd->conf->roaming_consortium_count > 1)
639 		*pos |= hapd->conf->roaming_consortium[1].len << 4;
640 	pos++;
641 
642 	if (hapd->conf->roaming_consortium_count > 3)
643 		count = 3;
644 	else
645 		count = hapd->conf->roaming_consortium_count;
646 
647 	for (i = 0; i < count; i++) {
648 		os_memcpy(pos, hapd->conf->roaming_consortium[i].oi,
649 			  hapd->conf->roaming_consortium[i].len);
650 		pos += hapd->conf->roaming_consortium[i].len;
651 	}
652 
653 	*len = pos - len - 1;
654 #endif /* CONFIG_INTERWORKING */
655 
656 	return pos;
657 }
658 
659 
hostapd_eid_time_adv(struct hostapd_data * hapd,u8 * eid)660 u8 * hostapd_eid_time_adv(struct hostapd_data *hapd, u8 *eid)
661 {
662 	if (hapd->conf->time_advertisement != 2)
663 		return eid;
664 
665 	if (hapd->time_adv == NULL &&
666 	    hostapd_update_time_adv(hapd) < 0)
667 		return eid;
668 
669 	if (hapd->time_adv == NULL)
670 		return eid;
671 
672 	os_memcpy(eid, wpabuf_head(hapd->time_adv),
673 		  wpabuf_len(hapd->time_adv));
674 	eid += wpabuf_len(hapd->time_adv);
675 
676 	return eid;
677 }
678 
679 
hostapd_eid_time_zone(struct hostapd_data * hapd,u8 * eid)680 u8 * hostapd_eid_time_zone(struct hostapd_data *hapd, u8 *eid)
681 {
682 	size_t len;
683 
684 	if (hapd->conf->time_advertisement != 2 || !hapd->conf->time_zone)
685 		return eid;
686 
687 	len = os_strlen(hapd->conf->time_zone);
688 
689 	*eid++ = WLAN_EID_TIME_ZONE;
690 	*eid++ = len;
691 	os_memcpy(eid, hapd->conf->time_zone, len);
692 	eid += len;
693 
694 	return eid;
695 }
696 
697 
hostapd_update_time_adv(struct hostapd_data * hapd)698 int hostapd_update_time_adv(struct hostapd_data *hapd)
699 {
700 	const int elen = 2 + 1 + 10 + 5 + 1;
701 	struct os_time t;
702 	struct os_tm tm;
703 	u8 *pos;
704 
705 	if (hapd->conf->time_advertisement != 2)
706 		return 0;
707 
708 	if (os_get_time(&t) < 0 || os_gmtime(t.sec, &tm) < 0)
709 		return -1;
710 
711 	if (!hapd->time_adv) {
712 		hapd->time_adv = wpabuf_alloc(elen);
713 		if (hapd->time_adv == NULL)
714 			return -1;
715 		pos = wpabuf_put(hapd->time_adv, elen);
716 	} else
717 		pos = wpabuf_mhead_u8(hapd->time_adv);
718 
719 	*pos++ = WLAN_EID_TIME_ADVERTISEMENT;
720 	*pos++ = 1 + 10 + 5 + 1;
721 
722 	*pos++ = 2; /* UTC time at which the TSF timer is 0 */
723 
724 	/* Time Value at TSF 0 */
725 	/* FIX: need to calculate this based on the current TSF value */
726 	WPA_PUT_LE16(pos, tm.year); /* Year */
727 	pos += 2;
728 	*pos++ = tm.month; /* Month */
729 	*pos++ = tm.day; /* Day of month */
730 	*pos++ = tm.hour; /* Hours */
731 	*pos++ = tm.min; /* Minutes */
732 	*pos++ = tm.sec; /* Seconds */
733 	WPA_PUT_LE16(pos, 0); /* Milliseconds (not used) */
734 	pos += 2;
735 	*pos++ = 0; /* Reserved */
736 
737 	/* Time Error */
738 	/* TODO: fill in an estimate on the error */
739 	*pos++ = 0;
740 	*pos++ = 0;
741 	*pos++ = 0;
742 	*pos++ = 0;
743 	*pos++ = 0;
744 
745 	*pos++ = hapd->time_update_counter++;
746 
747 	return 0;
748 }
749 
750 
hostapd_eid_bss_max_idle_period(struct hostapd_data * hapd,u8 * eid,u16 value)751 u8 * hostapd_eid_bss_max_idle_period(struct hostapd_data *hapd, u8 *eid,
752 				     u16 value)
753 {
754 	u8 *pos = eid;
755 
756 #ifdef CONFIG_WNM_AP
757 	if (hapd->conf->ap_max_inactivity > 0 &&
758 	    hapd->conf->bss_max_idle) {
759 		unsigned int val;
760 		*pos++ = WLAN_EID_BSS_MAX_IDLE_PERIOD;
761 		*pos++ = 3;
762 		val = hapd->conf->ap_max_inactivity;
763 		if (val > 68000)
764 			val = 68000;
765 		val *= 1000;
766 		val /= 1024;
767 		if (val == 0)
768 			val = 1;
769 		if (val > 65535)
770 			val = 65535;
771 		if (value)
772 			val = value;
773 		WPA_PUT_LE16(pos, val);
774 		pos += 2;
775 		/* Set the Protected Keep-Alive Required bit based on
776 		 * configuration */
777 		*pos++ = hapd->conf->bss_max_idle == 2 ? BIT(0) : 0x00;
778 	}
779 #endif /* CONFIG_WNM_AP */
780 
781 	return pos;
782 }
783 
784 
785 #ifdef CONFIG_MBO
786 
hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data * hapd,u8 * eid,size_t len,int delta)787 u8 * hostapd_eid_mbo_rssi_assoc_rej(struct hostapd_data *hapd, u8 *eid,
788 				    size_t len, int delta)
789 {
790 	u8 mbo[4];
791 
792 	mbo[0] = OCE_ATTR_ID_RSSI_BASED_ASSOC_REJECT;
793 	mbo[1] = 2;
794 	/* Delta RSSI */
795 	mbo[2] = delta;
796 	/* Retry delay */
797 	mbo[3] = hapd->iconf->rssi_reject_assoc_timeout;
798 
799 	return eid + mbo_add_ie(eid, len, mbo, 4);
800 }
801 
802 
hostapd_eid_mbo(struct hostapd_data * hapd,u8 * eid,size_t len)803 u8 * hostapd_eid_mbo(struct hostapd_data *hapd, u8 *eid, size_t len)
804 {
805 	u8 mbo[9], *mbo_pos = mbo;
806 	u8 *pos = eid;
807 
808 	if (!hapd->conf->mbo_enabled &&
809 	    !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
810 		return eid;
811 
812 	if (hapd->conf->mbo_enabled) {
813 		*mbo_pos++ = MBO_ATTR_ID_AP_CAPA_IND;
814 		*mbo_pos++ = 1;
815 		/* Not Cellular aware */
816 		*mbo_pos++ = 0;
817 	}
818 
819 	if (hapd->conf->mbo_enabled && hapd->mbo_assoc_disallow) {
820 		*mbo_pos++ = MBO_ATTR_ID_ASSOC_DISALLOW;
821 		*mbo_pos++ = 1;
822 		*mbo_pos++ = hapd->mbo_assoc_disallow;
823 	}
824 
825 	if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd)) {
826 		u8 ctrl;
827 
828 		ctrl = OCE_RELEASE;
829 		if (OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
830 			ctrl |= OCE_IS_STA_CFON;
831 
832 		*mbo_pos++ = OCE_ATTR_ID_CAPA_IND;
833 		*mbo_pos++ = 1;
834 		*mbo_pos++ = ctrl;
835 	}
836 
837 	pos += mbo_add_ie(pos, len, mbo, mbo_pos - mbo);
838 
839 	return pos;
840 }
841 
842 
hostapd_mbo_ie_len(struct hostapd_data * hapd)843 u8 hostapd_mbo_ie_len(struct hostapd_data *hapd)
844 {
845 	u8 len;
846 
847 	if (!hapd->conf->mbo_enabled &&
848 	    !OCE_STA_CFON_ENABLED(hapd) && !OCE_AP_ENABLED(hapd))
849 		return 0;
850 
851 	/*
852 	 * MBO IE header (6) + Capability Indication attribute (3) +
853 	 * Association Disallowed attribute (3) = 12
854 	 */
855 	len = 6;
856 	if (hapd->conf->mbo_enabled)
857 		len += 3 + (hapd->mbo_assoc_disallow ? 3 : 0);
858 
859 	/* OCE capability indication attribute (3) */
860 	if (OCE_STA_CFON_ENABLED(hapd) || OCE_AP_ENABLED(hapd))
861 		len += 3;
862 
863 	return len;
864 }
865 
866 #endif /* CONFIG_MBO */
867 
868 
869 #ifdef CONFIG_OWE
hostapd_eid_owe_trans_enabled(struct hostapd_data * hapd)870 static int hostapd_eid_owe_trans_enabled(struct hostapd_data *hapd)
871 {
872 	return hapd->conf->owe_transition_ssid_len > 0 &&
873 		!is_zero_ether_addr(hapd->conf->owe_transition_bssid);
874 }
875 #endif /* CONFIG_OWE */
876 
877 
hostapd_eid_owe_trans_len(struct hostapd_data * hapd)878 size_t hostapd_eid_owe_trans_len(struct hostapd_data *hapd)
879 {
880 #ifdef CONFIG_OWE
881 	if (!hostapd_eid_owe_trans_enabled(hapd))
882 		return 0;
883 	return 6 + ETH_ALEN + 1 + hapd->conf->owe_transition_ssid_len;
884 #else /* CONFIG_OWE */
885 	return 0;
886 #endif /* CONFIG_OWE */
887 }
888 
889 
hostapd_eid_owe_trans(struct hostapd_data * hapd,u8 * eid,size_t len)890 u8 * hostapd_eid_owe_trans(struct hostapd_data *hapd, u8 *eid,
891 				  size_t len)
892 {
893 #ifdef CONFIG_OWE
894 	u8 *pos = eid;
895 	size_t elen;
896 
897 	if (hapd->conf->owe_transition_ifname[0] &&
898 	    !hostapd_eid_owe_trans_enabled(hapd))
899 		hostapd_owe_trans_get_info(hapd);
900 
901 	if (!hostapd_eid_owe_trans_enabled(hapd))
902 		return pos;
903 
904 	elen = hostapd_eid_owe_trans_len(hapd);
905 	if (len < elen) {
906 		wpa_printf(MSG_DEBUG,
907 			   "OWE: Not enough room in the buffer for OWE IE");
908 		return pos;
909 	}
910 
911 	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
912 	*pos++ = elen - 2;
913 	WPA_PUT_BE24(pos, OUI_WFA);
914 	pos += 3;
915 	*pos++ = OWE_OUI_TYPE;
916 	os_memcpy(pos, hapd->conf->owe_transition_bssid, ETH_ALEN);
917 	pos += ETH_ALEN;
918 	*pos++ = hapd->conf->owe_transition_ssid_len;
919 	os_memcpy(pos, hapd->conf->owe_transition_ssid,
920 		  hapd->conf->owe_transition_ssid_len);
921 	pos += hapd->conf->owe_transition_ssid_len;
922 
923 	return pos;
924 #else /* CONFIG_OWE */
925 	return eid;
926 #endif /* CONFIG_OWE */
927 }
928 
929 
hostapd_eid_dpp_cc_len(struct hostapd_data * hapd)930 size_t hostapd_eid_dpp_cc_len(struct hostapd_data *hapd)
931 {
932 #ifdef CONFIG_DPP2
933 	if (hostapd_dpp_configurator_connectivity(hapd))
934 		return 6;
935 #endif /* CONFIG_DPP2 */
936 	return 0;
937 }
938 
939 
hostapd_eid_dpp_cc(struct hostapd_data * hapd,u8 * eid,size_t len)940 u8 * hostapd_eid_dpp_cc(struct hostapd_data *hapd, u8 *eid, size_t len)
941 {
942 	u8 *pos = eid;
943 
944 #ifdef CONFIG_DPP2
945 	if (!hostapd_dpp_configurator_connectivity(hapd) || len < 6)
946 		return pos;
947 
948 	*pos++ = WLAN_EID_VENDOR_SPECIFIC;
949 	*pos++ = 4;
950 	WPA_PUT_BE24(pos, OUI_WFA);
951 	pos += 3;
952 	*pos++ = DPP_CC_OUI_TYPE;
953 #endif /* CONFIG_DPP2 */
954 
955 	return pos;
956 }
957 
958 
ap_copy_sta_supp_op_classes(struct sta_info * sta,const u8 * supp_op_classes,size_t supp_op_classes_len)959 void ap_copy_sta_supp_op_classes(struct sta_info *sta,
960 				 const u8 *supp_op_classes,
961 				 size_t supp_op_classes_len)
962 {
963 	if (!supp_op_classes)
964 		return;
965 	os_free(sta->supp_op_classes);
966 	sta->supp_op_classes = os_malloc(1 + supp_op_classes_len);
967 	if (!sta->supp_op_classes)
968 		return;
969 
970 	sta->supp_op_classes[0] = supp_op_classes_len;
971 	os_memcpy(sta->supp_op_classes + 1, supp_op_classes,
972 		  supp_op_classes_len);
973 }
974 
975 
hostapd_eid_fils_indic(struct hostapd_data * hapd,u8 * eid,int hessid)976 u8 * hostapd_eid_fils_indic(struct hostapd_data *hapd, u8 *eid, int hessid)
977 {
978 	u8 *pos = eid;
979 #ifdef CONFIG_FILS
980 	u8 *len;
981 	u16 fils_info = 0;
982 	size_t realms;
983 	struct fils_realm *realm;
984 
985 	if (!(hapd->conf->wpa & WPA_PROTO_RSN) ||
986 	    !wpa_key_mgmt_fils(hapd->conf->wpa_key_mgmt))
987 		return pos;
988 
989 	realms = dl_list_len(&hapd->conf->fils_realms);
990 	if (realms > 7)
991 		realms = 7; /* 3 bit count field limits this to max 7 */
992 
993 	*pos++ = WLAN_EID_FILS_INDICATION;
994 	len = pos++;
995 	/* TODO: B0..B2: Number of Public Key Identifiers */
996 	if (hapd->conf->erp_domain) {
997 		/* B3..B5: Number of Realm Identifiers */
998 		fils_info |= realms << 3;
999 	}
1000 	/* TODO: B6: FILS IP Address Configuration */
1001 	if (hapd->conf->fils_cache_id_set)
1002 		fils_info |= BIT(7);
1003 	if (hessid && !is_zero_ether_addr(hapd->conf->hessid))
1004 		fils_info |= BIT(8); /* HESSID Included */
1005 	/* FILS Shared Key Authentication without PFS Supported */
1006 	fils_info |= BIT(9);
1007 	if (hapd->conf->fils_dh_group) {
1008 		/* FILS Shared Key Authentication with PFS Supported */
1009 		fils_info |= BIT(10);
1010 	}
1011 	/* TODO: B11: FILS Public Key Authentication Supported */
1012 	/* B12..B15: Reserved */
1013 	WPA_PUT_LE16(pos, fils_info);
1014 	pos += 2;
1015 	if (hapd->conf->fils_cache_id_set) {
1016 		os_memcpy(pos, hapd->conf->fils_cache_id, FILS_CACHE_ID_LEN);
1017 		pos += FILS_CACHE_ID_LEN;
1018 	}
1019 	if (hessid && !is_zero_ether_addr(hapd->conf->hessid)) {
1020 		os_memcpy(pos, hapd->conf->hessid, ETH_ALEN);
1021 		pos += ETH_ALEN;
1022 	}
1023 
1024 	dl_list_for_each(realm, &hapd->conf->fils_realms, struct fils_realm,
1025 			 list) {
1026 		if (realms == 0)
1027 			break;
1028 		realms--;
1029 		os_memcpy(pos, realm->hash, 2);
1030 		pos += 2;
1031 	}
1032 	*len = pos - len - 1;
1033 #endif /* CONFIG_FILS */
1034 
1035 	return pos;
1036 }
1037 
1038 
1039 #ifdef CONFIG_OCV
get_tx_parameters(struct sta_info * sta,int ap_max_chanwidth,int ap_seg1_idx,int * bandwidth,int * seg1_idx)1040 int get_tx_parameters(struct sta_info *sta, int ap_max_chanwidth,
1041 		      int ap_seg1_idx, int *bandwidth, int *seg1_idx)
1042 {
1043 	int ht_40mhz = 0;
1044 	int vht_80p80 = 0;
1045 	int requested_bw;
1046 
1047 	if (sta->ht_capabilities)
1048 		ht_40mhz = !!(le_to_host16(sta->ht_capabilities->
1049 					   ht_capabilities_info) &
1050 			      HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET);
1051 
1052 	if (sta->vht_operation) {
1053 		struct ieee80211_vht_operation *oper = sta->vht_operation;
1054 
1055 		/*
1056 		 * If a VHT Operation element was present, use it to determine
1057 		 * the supported channel bandwidth.
1058 		 */
1059 		if (oper->vht_op_info_chwidth == CHANWIDTH_USE_HT) {
1060 			requested_bw = ht_40mhz ? 40 : 20;
1061 		} else if (oper->vht_op_info_chan_center_freq_seg1_idx == 0) {
1062 			requested_bw = 80;
1063 		} else {
1064 			int diff;
1065 
1066 			requested_bw = 160;
1067 			diff = abs((int)
1068 				   oper->vht_op_info_chan_center_freq_seg0_idx -
1069 				   (int)
1070 				   oper->vht_op_info_chan_center_freq_seg1_idx);
1071 			vht_80p80 = oper->vht_op_info_chan_center_freq_seg1_idx
1072 				!= 0 &&	diff > 16;
1073 		}
1074 	} else if (sta->vht_capabilities) {
1075 		struct ieee80211_vht_capabilities *capab;
1076 		int vht_chanwidth;
1077 
1078 		capab = sta->vht_capabilities;
1079 
1080 		/*
1081 		 * If only the VHT Capabilities element is present (e.g., for
1082 		 * normal clients), use it to determine the supported channel
1083 		 * bandwidth.
1084 		 */
1085 		vht_chanwidth = le_to_host32(capab->vht_capabilities_info) &
1086 			VHT_CAP_SUPP_CHAN_WIDTH_MASK;
1087 		vht_80p80 = le_to_host32(capab->vht_capabilities_info) &
1088 			VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ;
1089 
1090 		/* TODO: Also take into account Extended NSS BW Support field */
1091 		requested_bw = vht_chanwidth ? 160 : 80;
1092 	} else {
1093 		requested_bw = ht_40mhz ? 40 : 20;
1094 	}
1095 
1096 	*bandwidth = requested_bw < ap_max_chanwidth ?
1097 		requested_bw : ap_max_chanwidth;
1098 
1099 	*seg1_idx = 0;
1100 	if (ap_seg1_idx && vht_80p80)
1101 		*seg1_idx = ap_seg1_idx;
1102 
1103 	return 0;
1104 }
1105 #endif /* CONFIG_OCV */
1106 
1107 
hostapd_eid_rsnxe(struct hostapd_data * hapd,u8 * eid,size_t len)1108 u8 * hostapd_eid_rsnxe(struct hostapd_data *hapd, u8 *eid, size_t len)
1109 {
1110 	u8 *pos = eid;
1111 	bool sae_pk = false;
1112 	u32 capab = 0, tmp;
1113 	size_t flen;
1114 
1115 	if (!(hapd->conf->wpa & WPA_PROTO_RSN))
1116 		return eid;
1117 
1118 #ifdef CONFIG_SAE_PK
1119 	sae_pk = hostapd_sae_pk_in_use(hapd->conf);
1120 #endif /* CONFIG_SAE_PK */
1121 
1122 	if (wpa_key_mgmt_sae(hapd->conf->wpa_key_mgmt) &&
1123 	    (hapd->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
1124 	     hapd->conf->sae_pwe == SAE_PWE_BOTH ||
1125 	     hostapd_sae_pw_id_in_use(hapd->conf) || sae_pk ||
1126 	     wpa_key_mgmt_sae_ext_key(hapd->conf->wpa_key_mgmt)) &&
1127 	    hapd->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK) {
1128 		capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1129 #ifdef CONFIG_SAE_PK
1130 		if (sae_pk)
1131 			capab |= BIT(WLAN_RSNX_CAPAB_SAE_PK);
1132 #endif /* CONFIG_SAE_PK */
1133 	}
1134 
1135 	if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_LTF_AP)
1136 		capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1137 	if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SEC_RTT_AP)
1138 		capab |= BIT(WLAN_RSNX_CAPAB_SECURE_RTT);
1139 	if (hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_PROT_RANGE_NEG_AP)
1140 		capab |= BIT(WLAN_RSNX_CAPAB_URNM_MFPR);
1141 	if (hapd->conf->ssid_protection)
1142 		capab |= BIT(WLAN_RSNX_CAPAB_SSID_PROTECTION);
1143 	if ((hapd->iface->drv_flags2 & WPA_DRIVER_FLAGS2_SPP_AMSDU) &&
1144 	    hapd->conf->spp_amsdu)
1145 		capab |= BIT(WLAN_RSNX_CAPAB_SPP_A_MSDU);
1146 
1147 	if (!capab)
1148 		return eid; /* no supported extended RSN capabilities */
1149 	tmp = capab;
1150 	flen = 0;
1151 	while (tmp) {
1152 		flen++;
1153 		tmp >>= 8;
1154 	}
1155 
1156 	if (len < 2 + flen)
1157 		return eid; /* no supported extended RSN capabilities */
1158 	capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
1159 
1160 	*pos++ = WLAN_EID_RSNX;
1161 	*pos++ = flen;
1162 	while (capab) {
1163 		*pos++ = capab & 0xff;
1164 		capab >>= 8;
1165 	}
1166 
1167 	return pos;
1168 }
1169 
1170 
check_ext_capab(struct hostapd_data * hapd,struct sta_info * sta,const u8 * ext_capab_ie,size_t ext_capab_ie_len)1171 u16 check_ext_capab(struct hostapd_data *hapd, struct sta_info *sta,
1172 		    const u8 *ext_capab_ie, size_t ext_capab_ie_len)
1173 {
1174 	/* check for QoS Map support */
1175 	if (ext_capab_ie_len >= 5) {
1176 		if (ext_capab_ie[4] & 0x01)
1177 			sta->qos_map_enabled = 1;
1178 	}
1179 
1180 	if (ext_capab_ie_len > 0) {
1181 		sta->ecsa_supported = !!(ext_capab_ie[0] & BIT(2));
1182 		os_free(sta->ext_capability);
1183 		sta->ext_capability = os_malloc(1 + ext_capab_ie_len);
1184 		if (sta->ext_capability) {
1185 			sta->ext_capability[0] = ext_capab_ie_len;
1186 			os_memcpy(sta->ext_capability + 1, ext_capab_ie,
1187 				  ext_capab_ie_len);
1188 		}
1189 	}
1190 
1191 	return WLAN_STATUS_SUCCESS;
1192 }
1193 
1194 
hostapd_ml_get_assoc_sta(struct hostapd_data * hapd,struct sta_info * sta,struct hostapd_data ** assoc_hapd)1195 struct sta_info * hostapd_ml_get_assoc_sta(struct hostapd_data *hapd,
1196 					   struct sta_info *sta,
1197 					   struct hostapd_data **assoc_hapd)
1198 {
1199 #ifdef CONFIG_IEEE80211BE
1200 	struct hostapd_data *other_hapd = NULL;
1201 	struct sta_info *tmp_sta;
1202 
1203 	if (!ap_sta_is_mld(hapd, sta))
1204 		return NULL;
1205 
1206 	*assoc_hapd = hapd;
1207 
1208 	/* The station is the one on which the association was performed */
1209 	if (sta->mld_assoc_link_id == hapd->mld_link_id)
1210 		return sta;
1211 
1212 	other_hapd = hostapd_mld_get_link_bss(hapd, sta->mld_assoc_link_id);
1213 	if (!other_hapd) {
1214 		wpa_printf(MSG_DEBUG, "MLD: No link match for link_id=%u",
1215 			   sta->mld_assoc_link_id);
1216 		return sta;
1217 	}
1218 
1219 	/*
1220 	 * Iterate over the stations and find the one with the matching link ID
1221 	 * and association ID.
1222 	 */
1223 	for (tmp_sta = other_hapd->sta_list; tmp_sta; tmp_sta = tmp_sta->next) {
1224 		if (tmp_sta->mld_assoc_link_id == sta->mld_assoc_link_id &&
1225 		    tmp_sta->aid == sta->aid) {
1226 			*assoc_hapd = other_hapd;
1227 			return tmp_sta;
1228 		}
1229 	}
1230 #endif /* CONFIG_IEEE80211BE */
1231 
1232 	return sta;
1233 }
1234 
1235 
hostapd_get_ht_vht_twt_responder(struct hostapd_data * hapd)1236 bool hostapd_get_ht_vht_twt_responder(struct hostapd_data *hapd)
1237 {
1238 	return hapd->iconf->ht_vht_twt_responder &&
1239 		((hapd->iconf->ieee80211n && !hapd->conf->disable_11n) ||
1240 		 (hapd->iconf->ieee80211ac && !hapd->conf->disable_11ac)) &&
1241 		(hapd->iface->drv_flags2 &
1242 		 WPA_DRIVER_FLAGS2_HT_VHT_TWT_RESPONDER);
1243 }
1244 
1245 
hostapd_wfa_gen_capab(struct hostapd_data * hapd,struct sta_info * sta,const u8 * capab,size_t len)1246 static void hostapd_wfa_gen_capab(struct hostapd_data *hapd,
1247 				  struct sta_info *sta,
1248 				  const u8 *capab, size_t len)
1249 {
1250 	char *hex;
1251 	size_t buflen;
1252 
1253 	wpa_printf(MSG_DEBUG,
1254 		   "WFA: Received indication of generational capabilities from "
1255 		   MACSTR, MAC2STR(sta->addr));
1256 	wpa_hexdump(MSG_DEBUG, "WFA: Generational Capabilities", capab, len);
1257 
1258 	buflen = 2 * len + 1;
1259 	hex = os_zalloc(buflen);
1260 	if (!hex)
1261 		return;
1262 	wpa_snprintf_hex(hex, buflen, capab, len);
1263 	wpa_msg(hapd->msg_ctx, MSG_INFO, WFA_GEN_CAPAB_RX MACSTR " %s",
1264 		MAC2STR(sta->addr), hex);
1265 	os_free(hex);
1266 }
1267 
1268 
hostapd_wfa_capab(struct hostapd_data * hapd,struct sta_info * sta,const u8 * pos,const u8 * end)1269 void hostapd_wfa_capab(struct hostapd_data *hapd, struct sta_info *sta,
1270 		       const u8 *pos, const u8 *end)
1271 {
1272 	u8 capab_len;
1273 	const u8 *gen_capa;
1274 
1275 	if (end - pos < 1)
1276 		return;
1277 	capab_len = *pos++;
1278 	if (capab_len > end - pos)
1279 		return;
1280 	pos += capab_len; /* skip the Capabilities field */
1281 
1282 	/* Wi-Fi Alliance Capabilities attributes use a header that is similar
1283 	 * to the one used in Information Elements. */
1284 	gen_capa = get_ie(pos, end - pos, WFA_CAPA_ATTR_GENERATIONAL_CAPAB);
1285 	if (gen_capa)
1286 		hostapd_wfa_gen_capab(hapd, sta, gen_capa + 2, gen_capa[1]);
1287 }
1288