xref: /freebsd/contrib/wpa/src/drivers/driver_bsd.c (revision 1f4bcc459a76b7aa664f3fd557684cd0ba6da352)
1 /*
2  * WPA Supplicant - driver interaction with BSD net80211 layer
3  * Copyright (c) 2004, Sam Leffler <sam@errno.com>
4  * Copyright (c) 2004, 2Wire, Inc
5  *
6  * This software may be distributed under the terms of the BSD license.
7  * See README for more details.
8  */
9 
10 #include "includes.h"
11 #include <sys/ioctl.h>
12 #include <sys/sysctl.h>
13 
14 #include "common.h"
15 #include "driver.h"
16 #include "eloop.h"
17 #include "common/ieee802_11_defs.h"
18 #include "common/wpa_common.h"
19 
20 #include <net/if.h>
21 #include <net/if_media.h>
22 
23 #ifdef __NetBSD__
24 #include <net/if_ether.h>
25 #else
26 #include <net/ethernet.h>
27 #endif
28 #include <net/route.h>
29 
30 #ifdef __DragonFly__
31 #include <netproto/802_11/ieee80211_ioctl.h>
32 #include <netproto/802_11/ieee80211_dragonfly.h>
33 #else /* __DragonFly__ */
34 #ifdef __GLIBC__
35 #include <netinet/ether.h>
36 #endif /* __GLIBC__ */
37 #include <net80211/ieee80211.h>
38 #include <net80211/ieee80211_ioctl.h>
39 #include <net80211/ieee80211_crypto.h>
40 #endif /* __DragonFly__ || __GLIBC__ */
41 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
42 #include <net80211/ieee80211_freebsd.h>
43 #endif
44 #if __NetBSD__
45 #include <net80211/ieee80211_netbsd.h>
46 #endif
47 
48 #include "l2_packet/l2_packet.h"
49 
50 struct bsd_driver_data {
51 	struct hostapd_data *hapd;	/* back pointer */
52 
53 	int	sock;			/* open socket for 802.11 ioctls */
54 	struct l2_packet_data *sock_xmit;/* raw packet xmit socket */
55 	int	route;			/* routing socket for events */
56 	char	ifname[IFNAMSIZ+1];	/* interface name */
57 	unsigned int ifindex;		/* interface index */
58 	void	*ctx;
59 	struct wpa_driver_capa capa;	/* driver capability */
60 	int	is_ap;			/* Access point mode */
61 	int	prev_roaming;	/* roaming state to restore on deinit */
62 	int	prev_privacy;	/* privacy state to restore on deinit */
63 	int	prev_wpa;	/* wpa state to restore on deinit */
64 	enum ieee80211_opmode opmode;	/* operation mode */
65 	char	*event_buf;
66 	size_t	event_buf_len;
67 };
68 
69 /* Generic functions for hostapd and wpa_supplicant */
70 static int
71 bsd_set80211(void *priv, int op, int val, const void *arg, int arg_len)
72 {
73 	struct bsd_driver_data *drv = priv;
74 	struct ieee80211req ireq;
75 
76 	os_memset(&ireq, 0, sizeof(ireq));
77 	os_strlcpy(ireq.i_name, drv->ifname, sizeof(ireq.i_name));
78 	ireq.i_type = op;
79 	ireq.i_val = val;
80 	ireq.i_data = (void *) arg;
81 	ireq.i_len = arg_len;
82 
83 	if (ioctl(drv->sock, SIOCS80211, &ireq) < 0) {
84 		wpa_printf(MSG_ERROR, "ioctl[SIOCS80211, op=%u, val=%u, "
85 			   "arg_len=%u]: %s", op, val, arg_len,
86 			   strerror(errno));
87 		return -1;
88 	}
89 	return 0;
90 }
91 
92 static int
93 bsd_get80211(void *priv, struct ieee80211req *ireq, int op, void *arg,
94 	     int arg_len)
95 {
96 	struct bsd_driver_data *drv = priv;
97 
98 	os_memset(ireq, 0, sizeof(*ireq));
99 	os_strlcpy(ireq->i_name, drv->ifname, sizeof(ireq->i_name));
100 	ireq->i_type = op;
101 	ireq->i_len = arg_len;
102 	ireq->i_data = arg;
103 
104 	if (ioctl(drv->sock, SIOCG80211, ireq) < 0) {
105 		wpa_printf(MSG_ERROR, "ioctl[SIOCS80211, op=%u, "
106 			   "arg_len=%u]: %s", op, arg_len, strerror(errno));
107 		return -1;
108 	}
109 	return 0;
110 }
111 
112 static int
113 get80211var(struct bsd_driver_data *drv, int op, void *arg, int arg_len)
114 {
115 	struct ieee80211req ireq;
116 
117 	if (bsd_get80211(drv, &ireq, op, arg, arg_len) < 0)
118 		return -1;
119 	return ireq.i_len;
120 }
121 
122 static int
123 set80211var(struct bsd_driver_data *drv, int op, const void *arg, int arg_len)
124 {
125 	return bsd_set80211(drv, op, 0, arg, arg_len);
126 }
127 
128 static int
129 set80211param(struct bsd_driver_data *drv, int op, int arg)
130 {
131 	return bsd_set80211(drv, op, arg, NULL, 0);
132 }
133 
134 static int
135 bsd_get_ssid(void *priv, u8 *ssid, int len)
136 {
137 	struct bsd_driver_data *drv = priv;
138 #ifdef SIOCG80211NWID
139 	struct ieee80211_nwid nwid;
140 	struct ifreq ifr;
141 
142 	os_memset(&ifr, 0, sizeof(ifr));
143 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
144 	ifr.ifr_data = (void *)&nwid;
145 	if (ioctl(drv->sock, SIOCG80211NWID, &ifr) < 0 ||
146 	    nwid.i_len > IEEE80211_NWID_LEN)
147 		return -1;
148 	os_memcpy(ssid, nwid.i_nwid, nwid.i_len);
149 	return nwid.i_len;
150 #else
151 	return get80211var(drv, IEEE80211_IOC_SSID, ssid, IEEE80211_NWID_LEN);
152 #endif
153 }
154 
155 static int
156 bsd_set_ssid(void *priv, const u8 *ssid, int ssid_len)
157 {
158 	struct bsd_driver_data *drv = priv;
159 #ifdef SIOCS80211NWID
160 	struct ieee80211_nwid nwid;
161 	struct ifreq ifr;
162 
163 	os_memcpy(nwid.i_nwid, ssid, ssid_len);
164 	nwid.i_len = ssid_len;
165 	os_memset(&ifr, 0, sizeof(ifr));
166 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
167 	ifr.ifr_data = (void *)&nwid;
168 	return ioctl(drv->sock, SIOCS80211NWID, &ifr);
169 #else
170 	return set80211var(drv, IEEE80211_IOC_SSID, ssid, ssid_len);
171 #endif
172 }
173 
174 static int
175 bsd_get_if_media(void *priv)
176 {
177 	struct bsd_driver_data *drv = priv;
178 	struct ifmediareq ifmr;
179 
180 	os_memset(&ifmr, 0, sizeof(ifmr));
181 	os_strlcpy(ifmr.ifm_name, drv->ifname, sizeof(ifmr.ifm_name));
182 
183 	if (ioctl(drv->sock, SIOCGIFMEDIA, &ifmr) < 0) {
184 		wpa_printf(MSG_ERROR, "%s: SIOCGIFMEDIA %s", __func__,
185 			   strerror(errno));
186 		return -1;
187 	}
188 
189 	return ifmr.ifm_current;
190 }
191 
192 static int
193 bsd_set_if_media(void *priv, int media)
194 {
195 	struct bsd_driver_data *drv = priv;
196 	struct ifreq ifr;
197 
198 	os_memset(&ifr, 0, sizeof(ifr));
199 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
200 	ifr.ifr_media = media;
201 
202 	if (ioctl(drv->sock, SIOCSIFMEDIA, &ifr) < 0) {
203 		wpa_printf(MSG_ERROR, "%s: SIOCSIFMEDIA %s", __func__,
204 			   strerror(errno));
205 		return -1;
206 	}
207 
208 	return 0;
209 }
210 
211 static int
212 bsd_set_mediaopt(void *priv, uint32_t mask, uint32_t mode)
213 {
214 	int media = bsd_get_if_media(priv);
215 
216 	if (media < 0)
217 		return -1;
218 	media &= ~mask;
219 	media |= mode;
220 	if (bsd_set_if_media(priv, media) < 0)
221 		return -1;
222 	return 0;
223 }
224 
225 static int
226 bsd_del_key(void *priv, const u8 *addr, int key_idx)
227 {
228 	struct ieee80211req_del_key wk;
229 
230 	os_memset(&wk, 0, sizeof(wk));
231 	if (addr == NULL) {
232 		wpa_printf(MSG_DEBUG, "%s: key_idx=%d", __func__, key_idx);
233 		wk.idk_keyix = key_idx;
234 	} else {
235 		wpa_printf(MSG_DEBUG, "%s: addr=" MACSTR, __func__,
236 			   MAC2STR(addr));
237 		os_memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
238 		wk.idk_keyix = (u_int8_t) IEEE80211_KEYIX_NONE;	/* XXX */
239 	}
240 
241 	return set80211var(priv, IEEE80211_IOC_DELKEY, &wk, sizeof(wk));
242 }
243 
244 static int
245 bsd_send_mlme_param(void *priv, const u8 op, const u16 reason, const u8 *addr)
246 {
247 	struct ieee80211req_mlme mlme;
248 
249 	os_memset(&mlme, 0, sizeof(mlme));
250 	mlme.im_op = op;
251 	mlme.im_reason = reason;
252 	os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
253 	return set80211var(priv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme));
254 }
255 
256 static int
257 bsd_ctrl_iface(void *priv, int enable)
258 {
259 	struct bsd_driver_data *drv = priv;
260 	struct ifreq ifr;
261 
262 	os_memset(&ifr, 0, sizeof(ifr));
263 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
264 
265 	if (ioctl(drv->sock, SIOCGIFFLAGS, &ifr) < 0) {
266 		wpa_printf(MSG_ERROR, "ioctl[SIOCGIFFLAGS]: %s",
267 			   strerror(errno));
268 		return -1;
269 	}
270 
271 	if (enable) {
272 		if (ifr.ifr_flags & IFF_UP)
273 			return 0;
274 		ifr.ifr_flags |= IFF_UP;
275 	} else {
276 		if (!(ifr.ifr_flags & IFF_UP))
277 			return 0;
278 		ifr.ifr_flags &= ~IFF_UP;
279 	}
280 
281 	if (ioctl(drv->sock, SIOCSIFFLAGS, &ifr) < 0) {
282 		wpa_printf(MSG_ERROR, "ioctl[SIOCSIFFLAGS]: %s",
283 			   strerror(errno));
284 		return -1;
285 	}
286 
287 	return 0;
288 }
289 
290 static int
291 bsd_set_key(const char *ifname, void *priv, enum wpa_alg alg,
292 	    const unsigned char *addr, int key_idx, int set_tx, const u8 *seq,
293 	    size_t seq_len, const u8 *key, size_t key_len)
294 {
295 	struct ieee80211req_key wk;
296 #ifdef IEEE80211_KEY_NOREPLAY
297 	struct bsd_driver_data *drv = priv;
298 #endif /* IEEE80211_KEY_NOREPLAY */
299 
300 	wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
301 		   "seq_len=%zu key_len=%zu", __func__, alg, addr, key_idx,
302 		   set_tx, seq_len, key_len);
303 
304 	if (alg == WPA_ALG_NONE) {
305 #ifndef HOSTAPD
306 		if (addr == NULL || is_broadcast_ether_addr(addr))
307 			return bsd_del_key(priv, NULL, key_idx);
308 		else
309 #endif /* HOSTAPD */
310 			return bsd_del_key(priv, addr, key_idx);
311 	}
312 
313 	os_memset(&wk, 0, sizeof(wk));
314 	switch (alg) {
315 	case WPA_ALG_WEP:
316 		wk.ik_type = IEEE80211_CIPHER_WEP;
317 		break;
318 	case WPA_ALG_TKIP:
319 		wk.ik_type = IEEE80211_CIPHER_TKIP;
320 		break;
321 	case WPA_ALG_CCMP:
322 		wk.ik_type = IEEE80211_CIPHER_AES_CCM;
323 		break;
324 	default:
325 		wpa_printf(MSG_ERROR, "%s: unknown alg=%d", __func__, alg);
326 		return -1;
327 	}
328 
329 	wk.ik_flags = IEEE80211_KEY_RECV;
330 	if (set_tx)
331 		wk.ik_flags |= IEEE80211_KEY_XMIT;
332 
333 	if (addr == NULL) {
334 		os_memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
335 		wk.ik_keyix = key_idx;
336 	} else {
337 		os_memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
338 		/*
339 		 * Deduce whether group/global or unicast key by checking
340 		 * the address (yech).  Note also that we can only mark global
341 		 * keys default; doing this for a unicast key is an error.
342 		 */
343 		if (is_broadcast_ether_addr(addr)) {
344 			wk.ik_flags |= IEEE80211_KEY_GROUP;
345 			wk.ik_keyix = key_idx;
346 		} else {
347 			wk.ik_keyix = key_idx == 0 ? IEEE80211_KEYIX_NONE :
348 				key_idx;
349 		}
350 	}
351 	if (wk.ik_keyix != IEEE80211_KEYIX_NONE && set_tx)
352 		wk.ik_flags |= IEEE80211_KEY_DEFAULT;
353 #ifndef HOSTAPD
354 #ifdef IEEE80211_KEY_NOREPLAY
355 	/*
356 	 * Ignore replay failures in IBSS and AHDEMO mode.
357 	 */
358 	if (drv->opmode == IEEE80211_M_IBSS ||
359 	    drv->opmode == IEEE80211_M_AHDEMO)
360 		wk.ik_flags |= IEEE80211_KEY_NOREPLAY;
361 #endif /* IEEE80211_KEY_NOREPLAY */
362 #endif /* HOSTAPD */
363 	wk.ik_keylen = key_len;
364 	if (seq) {
365 #ifdef WORDS_BIGENDIAN
366 		/*
367 		 * wk.ik_keyrsc is in host byte order (big endian), need to
368 		 * swap it to match with the byte order used in WPA.
369 		 */
370 		int i;
371 		u8 *keyrsc = (u8 *) &wk.ik_keyrsc;
372 		for (i = 0; i < seq_len; i++)
373 			keyrsc[WPA_KEY_RSC_LEN - i - 1] = seq[i];
374 #else /* WORDS_BIGENDIAN */
375 		os_memcpy(&wk.ik_keyrsc, seq, seq_len);
376 #endif /* WORDS_BIGENDIAN */
377 	}
378 	os_memcpy(wk.ik_keydata, key, key_len);
379 
380 	return set80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk));
381 }
382 
383 static int
384 bsd_configure_wpa(void *priv, struct wpa_bss_params *params)
385 {
386 #ifndef IEEE80211_IOC_APPIE
387 	static const char *ciphernames[] =
388 		{ "WEP", "TKIP", "AES-OCB", "AES-CCM", "CKIP", "NONE" };
389 	int v;
390 
391 	switch (params->wpa_group) {
392 	case WPA_CIPHER_CCMP:
393 		v = IEEE80211_CIPHER_AES_CCM;
394 		break;
395 	case WPA_CIPHER_TKIP:
396 		v = IEEE80211_CIPHER_TKIP;
397 		break;
398 	case WPA_CIPHER_WEP104:
399 		v = IEEE80211_CIPHER_WEP;
400 		break;
401 	case WPA_CIPHER_WEP40:
402 		v = IEEE80211_CIPHER_WEP;
403 		break;
404 	case WPA_CIPHER_NONE:
405 		v = IEEE80211_CIPHER_NONE;
406 		break;
407 	default:
408 		wpa_printf(MSG_INFO, "Unknown group key cipher %u",
409 			   params->wpa_group);
410 		return -1;
411 	}
412 	wpa_printf(MSG_DEBUG, "%s: group key cipher=%s (%u)",
413 		   __func__, ciphernames[v], v);
414 	if (set80211param(priv, IEEE80211_IOC_MCASTCIPHER, v)) {
415 		wpa_printf(MSG_INFO,
416 			   "Unable to set group key cipher to %u (%s)",
417 			   v, ciphernames[v]);
418 		return -1;
419 	}
420 	if (v == IEEE80211_CIPHER_WEP) {
421 		/* key length is done only for specific ciphers */
422 		v = (params->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
423 		if (set80211param(priv, IEEE80211_IOC_MCASTKEYLEN, v)) {
424 			wpa_printf(MSG_INFO,
425 				   "Unable to set group key length to %u", v);
426 			return -1;
427 		}
428 	}
429 
430 	v = 0;
431 	if (params->wpa_pairwise & WPA_CIPHER_CCMP)
432 		v |= 1<<IEEE80211_CIPHER_AES_CCM;
433 	if (params->wpa_pairwise & WPA_CIPHER_TKIP)
434 		v |= 1<<IEEE80211_CIPHER_TKIP;
435 	if (params->wpa_pairwise & WPA_CIPHER_NONE)
436 		v |= 1<<IEEE80211_CIPHER_NONE;
437 	wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
438 	if (set80211param(priv, IEEE80211_IOC_UCASTCIPHERS, v)) {
439 		wpa_printf(MSG_INFO,
440 			   "Unable to set pairwise key ciphers to 0x%x", v);
441 		return -1;
442 	}
443 
444 	wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
445 		   __func__, params->wpa_key_mgmt);
446 	if (set80211param(priv, IEEE80211_IOC_KEYMGTALGS,
447 			  params->wpa_key_mgmt)) {
448 		wpa_printf(MSG_INFO,
449 			   "Unable to set key management algorithms to 0x%x",
450 			   params->wpa_key_mgmt);
451 		return -1;
452 	}
453 
454 	v = 0;
455 	if (params->rsn_preauth)
456 		v |= BIT(0);
457 	wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
458 		   __func__, params->rsn_preauth);
459 	if (set80211param(priv, IEEE80211_IOC_RSNCAPS, v)) {
460 		wpa_printf(MSG_INFO, "Unable to set RSN capabilities to 0x%x",
461 			   v);
462 		return -1;
463 	}
464 #endif /* IEEE80211_IOC_APPIE */
465 
466 	wpa_printf(MSG_DEBUG, "%s: enable WPA= 0x%x", __func__, params->wpa);
467 	if (set80211param(priv, IEEE80211_IOC_WPA, params->wpa)) {
468 		wpa_printf(MSG_INFO, "Unable to set WPA to %u", params->wpa);
469 		return -1;
470 	}
471 	return 0;
472 }
473 
474 static int
475 bsd_set_ieee8021x(void *priv, struct wpa_bss_params *params)
476 {
477 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, params->enabled);
478 
479 	if (!params->enabled) {
480 		/* XXX restore state */
481 		return set80211param(priv, IEEE80211_IOC_AUTHMODE,
482 				     IEEE80211_AUTH_AUTO);
483 	}
484 	if (!params->wpa && !params->ieee802_1x) {
485 		wpa_printf(MSG_ERROR, "%s: No 802.1X or WPA enabled",
486 			   __func__);
487 		return -1;
488 	}
489 	if (params->wpa && bsd_configure_wpa(priv, params) != 0) {
490 		wpa_printf(MSG_ERROR, "%s: Failed to configure WPA state",
491 			   __func__);
492 		return -1;
493 	}
494 	if (set80211param(priv, IEEE80211_IOC_AUTHMODE,
495 		(params->wpa ? IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
496 		wpa_printf(MSG_ERROR, "%s: Failed to enable WPA/802.1X",
497 			   __func__);
498 		return -1;
499 	}
500 	return bsd_ctrl_iface(priv, 1);
501 }
502 
503 static void
504 bsd_new_sta(void *priv, void *ctx, u8 addr[IEEE80211_ADDR_LEN])
505 {
506 	struct ieee80211req_wpaie ie;
507 	int ielen = 0;
508 	u8 *iebuf = NULL;
509 
510 	/*
511 	 * Fetch and validate any negotiated WPA/RSN parameters.
512 	 */
513 	memset(&ie, 0, sizeof(ie));
514 	memcpy(ie.wpa_macaddr, addr, IEEE80211_ADDR_LEN);
515 	if (get80211var(priv, IEEE80211_IOC_WPAIE, &ie, sizeof(ie)) < 0) {
516 		wpa_printf(MSG_INFO,
517 			   "Failed to get WPA/RSN information element");
518 		goto no_ie;
519 	}
520 	iebuf = ie.wpa_ie;
521 	ielen = ie.wpa_ie[1];
522 	if (ielen == 0)
523 		iebuf = NULL;
524 	else
525 		ielen += 2;
526 
527 no_ie:
528 	drv_event_assoc(ctx, addr, iebuf, ielen, 0);
529 }
530 
531 static int
532 bsd_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
533 	       int encrypt, const u8 *own_addr, u32 flags)
534 {
535 	struct bsd_driver_data *drv = priv;
536 
537 	wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", data, data_len);
538 
539 	return l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, data,
540 			      data_len);
541 }
542 
543 static int
544 bsd_set_freq(void *priv, struct hostapd_freq_params *freq)
545 {
546 	struct bsd_driver_data *drv = priv;
547 #ifdef SIOCS80211CHANNEL
548 	struct ieee80211chanreq creq;
549 #endif /* SIOCS80211CHANNEL */
550 	u32 mode;
551 	int channel = freq->channel;
552 
553 	if (channel < 14) {
554 		mode =
555 #ifdef CONFIG_IEEE80211N
556 			freq->ht_enabled ? IFM_IEEE80211_11NG :
557 #endif /* CONFIG_IEEE80211N */
558 		        IFM_IEEE80211_11G;
559 	} else if (channel == 14) {
560 		mode = IFM_IEEE80211_11B;
561 	} else {
562 		mode =
563 #ifdef CONFIG_IEEE80211N
564 			freq->ht_enabled ? IFM_IEEE80211_11NA :
565 #endif /* CONFIG_IEEE80211N */
566 			IFM_IEEE80211_11A;
567 	}
568 	if (bsd_set_mediaopt(drv, IFM_MMASK, mode) < 0) {
569 		wpa_printf(MSG_ERROR, "%s: failed to set modulation mode",
570 			   __func__);
571 		return -1;
572 	}
573 
574 #ifdef SIOCS80211CHANNEL
575 	os_memset(&creq, 0, sizeof(creq));
576 	os_strlcpy(creq.i_name, drv->ifname, sizeof(creq.i_name));
577 	creq.i_channel = (u_int16_t)channel;
578 	return ioctl(drv->sock, SIOCS80211CHANNEL, &creq);
579 #else /* SIOCS80211CHANNEL */
580 	return set80211param(priv, IEEE80211_IOC_CHANNEL, channel);
581 #endif /* SIOCS80211CHANNEL */
582 }
583 
584 static int
585 bsd_set_opt_ie(void *priv, const u8 *ie, size_t ie_len)
586 {
587 #ifdef IEEE80211_IOC_APPIE
588 	wpa_printf(MSG_DEBUG, "%s: set WPA+RSN ie (len %lu)", __func__,
589 		   (unsigned long)ie_len);
590 	return bsd_set80211(priv, IEEE80211_IOC_APPIE, IEEE80211_APPIE_WPA,
591 			    ie, ie_len);
592 #endif /* IEEE80211_IOC_APPIE */
593 	return 0;
594 }
595 
596 static size_t
597 rtbuf_len(void)
598 {
599 	size_t len;
600 
601 	int mib[6] = {CTL_NET, AF_ROUTE, 0, AF_INET, NET_RT_DUMP, 0};
602 
603 	if (sysctl(mib, 6, NULL, &len, NULL, 0) < 0) {
604 		wpa_printf(MSG_WARNING, "%s failed: %s", __func__,
605 			   strerror(errno));
606 		len = 2048;
607 	}
608 
609 	return len;
610 }
611 
612 #ifdef HOSTAPD
613 
614 /*
615  * Avoid conflicts with hostapd definitions by undefining couple of defines
616  * from net80211 header files.
617  */
618 #undef RSN_VERSION
619 #undef WPA_VERSION
620 #undef WPA_OUI_TYPE
621 
622 static int bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
623 			  int reason_code);
624 
625 static const char *
626 ether_sprintf(const u8 *addr)
627 {
628 	static char buf[sizeof(MACSTR)];
629 
630 	if (addr != NULL)
631 		snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
632 	else
633 		snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
634 	return buf;
635 }
636 
637 static int
638 bsd_set_privacy(void *priv, int enabled)
639 {
640 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
641 
642 	return set80211param(priv, IEEE80211_IOC_PRIVACY, enabled);
643 }
644 
645 static int
646 bsd_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
647 	       u8 *seq)
648 {
649 	struct ieee80211req_key wk;
650 
651 	wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
652 		   __func__, ether_sprintf(addr), idx);
653 
654 	memset(&wk, 0, sizeof(wk));
655 	if (addr == NULL)
656 		memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
657 	else
658 		memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
659 	wk.ik_keyix = idx;
660 
661 	if (get80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk)) < 0) {
662 		wpa_printf(MSG_INFO, "Failed to get encryption");
663 		return -1;
664 	}
665 
666 #ifdef WORDS_BIGENDIAN
667 	{
668 		/*
669 		 * wk.ik_keytsc is in host byte order (big endian), need to
670 		 * swap it to match with the byte order used in WPA.
671 		 */
672 		int i;
673 		u8 tmp[WPA_KEY_RSC_LEN];
674 		memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
675 		for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
676 			seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
677 		}
678 	}
679 #else /* WORDS_BIGENDIAN */
680 	memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
681 #endif /* WORDS_BIGENDIAN */
682 	return 0;
683 }
684 
685 
686 static int
687 bsd_flush(void *priv)
688 {
689 	u8 allsta[IEEE80211_ADDR_LEN];
690 
691 	memset(allsta, 0xff, IEEE80211_ADDR_LEN);
692 	return bsd_sta_deauth(priv, NULL, allsta, IEEE80211_REASON_AUTH_LEAVE);
693 }
694 
695 
696 static int
697 bsd_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
698 			 const u8 *addr)
699 {
700 	struct ieee80211req_sta_stats stats;
701 
702 	memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
703 	if (get80211var(priv, IEEE80211_IOC_STA_STATS, &stats, sizeof(stats))
704 	    > 0) {
705 		/* XXX? do packets counts include non-data frames? */
706 		data->rx_packets = stats.is_stats.ns_rx_data;
707 		data->rx_bytes = stats.is_stats.ns_rx_bytes;
708 		data->tx_packets = stats.is_stats.ns_tx_data;
709 		data->tx_bytes = stats.is_stats.ns_tx_bytes;
710 	}
711 	return 0;
712 }
713 
714 static int
715 bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr, int reason_code)
716 {
717 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
718 				   addr);
719 }
720 
721 static int
722 bsd_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
723 		 int reason_code)
724 {
725 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DISASSOC, reason_code,
726 				   addr);
727 }
728 
729 static void
730 bsd_wireless_event_receive(int sock, void *ctx, void *sock_ctx)
731 {
732 	struct bsd_driver_data *drv = ctx;
733 	struct if_announcemsghdr *ifan;
734 	struct rt_msghdr *rtm;
735 	struct ieee80211_michael_event *mic;
736 	struct ieee80211_join_event *join;
737 	struct ieee80211_leave_event *leave;
738 	int n;
739 	union wpa_event_data data;
740 
741 	n = read(sock, drv->event_buf, drv->event_buf_len);
742 	if (n < 0) {
743 		if (errno != EINTR && errno != EAGAIN)
744 			wpa_printf(MSG_ERROR, "%s read() failed: %s",
745 				   __func__, strerror(errno));
746 		return;
747 	}
748 
749 	rtm = (struct rt_msghdr *) drv->event_buf;
750 	if (rtm->rtm_version != RTM_VERSION) {
751 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
752 			   rtm->rtm_version);
753 		return;
754 	}
755 	ifan = (struct if_announcemsghdr *) rtm;
756 	switch (rtm->rtm_type) {
757 	case RTM_IEEE80211:
758 		switch (ifan->ifan_what) {
759 		case RTM_IEEE80211_ASSOC:
760 		case RTM_IEEE80211_REASSOC:
761 		case RTM_IEEE80211_DISASSOC:
762 		case RTM_IEEE80211_SCAN:
763 			break;
764 		case RTM_IEEE80211_LEAVE:
765 			leave = (struct ieee80211_leave_event *) &ifan[1];
766 			drv_event_disassoc(drv->hapd, leave->iev_addr);
767 			break;
768 		case RTM_IEEE80211_JOIN:
769 #ifdef RTM_IEEE80211_REJOIN
770 		case RTM_IEEE80211_REJOIN:
771 #endif
772 			join = (struct ieee80211_join_event *) &ifan[1];
773 			bsd_new_sta(drv, drv->hapd, join->iev_addr);
774 			break;
775 		case RTM_IEEE80211_REPLAY:
776 			/* ignore */
777 			break;
778 		case RTM_IEEE80211_MICHAEL:
779 			mic = (struct ieee80211_michael_event *) &ifan[1];
780 			wpa_printf(MSG_DEBUG,
781 				"Michael MIC failure wireless event: "
782 				"keyix=%u src_addr=" MACSTR, mic->iev_keyix,
783 				MAC2STR(mic->iev_src));
784 			os_memset(&data, 0, sizeof(data));
785 			data.michael_mic_failure.unicast = 1;
786 			data.michael_mic_failure.src = mic->iev_src;
787 			wpa_supplicant_event(drv->hapd,
788 					     EVENT_MICHAEL_MIC_FAILURE, &data);
789 			break;
790 		}
791 		break;
792 	}
793 }
794 
795 static void
796 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
797 {
798 	struct bsd_driver_data *drv = ctx;
799 	drv_event_eapol_rx(drv->hapd, src_addr, buf, len);
800 }
801 
802 static void *
803 bsd_init(struct hostapd_data *hapd, struct wpa_init_params *params)
804 {
805 	struct bsd_driver_data *drv;
806 
807 	drv = os_zalloc(sizeof(struct bsd_driver_data));
808 	if (drv == NULL) {
809 		wpa_printf(MSG_ERROR, "Could not allocate memory for bsd driver data");
810 		return NULL;
811 	}
812 
813 	drv->event_buf_len = rtbuf_len();
814 
815 	drv->event_buf = os_malloc(drv->event_buf_len);
816 	if (drv->event_buf == NULL) {
817 		wpa_printf(MSG_ERROR, "%s: os_malloc() failed", __func__);
818 		goto bad;
819 	}
820 
821 	drv->hapd = hapd;
822 	drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
823 	if (drv->sock < 0) {
824 		wpa_printf(MSG_ERROR, "socket[PF_INET,SOCK_DGRAM]: %s",
825 			   strerror(errno));
826 		goto bad;
827 	}
828 	os_strlcpy(drv->ifname, params->ifname, sizeof(drv->ifname));
829 
830 	drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
831 					handle_read, drv, 0);
832 	if (drv->sock_xmit == NULL)
833 		goto bad;
834 	if (l2_packet_get_own_addr(drv->sock_xmit, params->own_addr))
835 		goto bad;
836 
837 	/* mark down during setup */
838 	if (bsd_ctrl_iface(drv, 0) < 0)
839 		goto bad;
840 
841 	drv->route = socket(PF_ROUTE, SOCK_RAW, 0);
842 	if (drv->route < 0) {
843 		wpa_printf(MSG_ERROR, "socket(PF_ROUTE,SOCK_RAW): %s",
844 			   strerror(errno));
845 		goto bad;
846 	}
847 	eloop_register_read_sock(drv->route, bsd_wireless_event_receive, drv,
848 				 NULL);
849 
850 	if (bsd_set_mediaopt(drv, IFM_OMASK, IFM_IEEE80211_HOSTAP) < 0) {
851 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
852 			   __func__);
853 		goto bad;
854 	}
855 
856 	return drv;
857 bad:
858 	if (drv->sock_xmit != NULL)
859 		l2_packet_deinit(drv->sock_xmit);
860 	if (drv->sock >= 0)
861 		close(drv->sock);
862 	os_free(drv->event_buf);
863 	os_free(drv);
864 	return NULL;
865 }
866 
867 
868 static void
869 bsd_deinit(void *priv)
870 {
871 	struct bsd_driver_data *drv = priv;
872 
873 	if (drv->route >= 0) {
874 		eloop_unregister_read_sock(drv->route);
875 		close(drv->route);
876 	}
877 	bsd_ctrl_iface(drv, 0);
878 	if (drv->sock >= 0)
879 		close(drv->sock);
880 	if (drv->sock_xmit != NULL)
881 		l2_packet_deinit(drv->sock_xmit);
882 	os_free(drv->event_buf);
883 	os_free(drv);
884 }
885 
886 
887 static int
888 bsd_commit(void *priv)
889 {
890 	return bsd_ctrl_iface(priv, 1);
891 }
892 
893 
894 static int
895 bsd_set_sta_authorized(void *priv, const u8 *addr,
896 		       unsigned int total_flags, unsigned int flags_or,
897 		       unsigned int flags_and)
898 {
899 	int authorized = -1;
900 
901 	/* For now, only support setting Authorized flag */
902 	if (flags_or & WPA_STA_AUTHORIZED)
903 		authorized = 1;
904 	if (!(flags_and & WPA_STA_AUTHORIZED))
905 		authorized = 0;
906 
907 	if (authorized < 0)
908 		return 0;
909 
910 	return bsd_send_mlme_param(priv, authorized ?
911 				   IEEE80211_MLME_AUTHORIZE :
912 				   IEEE80211_MLME_UNAUTHORIZE, 0, addr);
913 }
914 #else /* HOSTAPD */
915 
916 static int
917 get80211param(struct bsd_driver_data *drv, int op)
918 {
919 	struct ieee80211req ireq;
920 
921 	if (bsd_get80211(drv, &ireq, op, NULL, 0) < 0)
922 		return -1;
923 	return ireq.i_val;
924 }
925 
926 static int
927 wpa_driver_bsd_get_bssid(void *priv, u8 *bssid)
928 {
929 	struct bsd_driver_data *drv = priv;
930 #ifdef SIOCG80211BSSID
931 	struct ieee80211_bssid bs;
932 
933 	os_strlcpy(bs.i_name, drv->ifname, sizeof(bs.i_name));
934 	if (ioctl(drv->sock, SIOCG80211BSSID, &bs) < 0)
935 		return -1;
936 	os_memcpy(bssid, bs.i_bssid, sizeof(bs.i_bssid));
937 	return 0;
938 #else
939 	return get80211var(drv, IEEE80211_IOC_BSSID,
940 		bssid, IEEE80211_ADDR_LEN) < 0 ? -1 : 0;
941 #endif
942 }
943 
944 static int
945 wpa_driver_bsd_get_ssid(void *priv, u8 *ssid)
946 {
947 	struct bsd_driver_data *drv = priv;
948 	return bsd_get_ssid(drv, ssid, 0);
949 }
950 
951 static int
952 wpa_driver_bsd_set_wpa_ie(struct bsd_driver_data *drv, const u8 *wpa_ie,
953 			  size_t wpa_ie_len)
954 {
955 #ifdef IEEE80211_IOC_APPIE
956 	return bsd_set_opt_ie(drv, wpa_ie, wpa_ie_len);
957 #else /* IEEE80211_IOC_APPIE */
958 	return set80211var(drv, IEEE80211_IOC_OPTIE, wpa_ie, wpa_ie_len);
959 #endif /* IEEE80211_IOC_APPIE */
960 }
961 
962 static int
963 wpa_driver_bsd_set_wpa_internal(void *priv, int wpa, int privacy)
964 {
965 	int ret = 0;
966 
967 	wpa_printf(MSG_DEBUG, "%s: wpa=%d privacy=%d",
968 		__FUNCTION__, wpa, privacy);
969 
970 	if (!wpa && wpa_driver_bsd_set_wpa_ie(priv, NULL, 0) < 0)
971 		ret = -1;
972 	if (set80211param(priv, IEEE80211_IOC_PRIVACY, privacy) < 0)
973 		ret = -1;
974 	if (set80211param(priv, IEEE80211_IOC_WPA, wpa) < 0)
975 		ret = -1;
976 
977 	return ret;
978 }
979 
980 static int
981 wpa_driver_bsd_set_wpa(void *priv, int enabled)
982 {
983 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __FUNCTION__, enabled);
984 
985 	return wpa_driver_bsd_set_wpa_internal(priv, enabled ? 3 : 0, enabled);
986 }
987 
988 static int
989 wpa_driver_bsd_set_countermeasures(void *priv, int enabled)
990 {
991 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
992 	return set80211param(priv, IEEE80211_IOC_COUNTERMEASURES, enabled);
993 }
994 
995 
996 static int
997 wpa_driver_bsd_set_drop_unencrypted(void *priv, int enabled)
998 {
999 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
1000 	return set80211param(priv, IEEE80211_IOC_DROPUNENCRYPTED, enabled);
1001 }
1002 
1003 static int
1004 wpa_driver_bsd_deauthenticate(void *priv, const u8 *addr, int reason_code)
1005 {
1006 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
1007 				   addr);
1008 }
1009 
1010 static int
1011 wpa_driver_bsd_set_auth_alg(void *priv, int auth_alg)
1012 {
1013 	int authmode;
1014 
1015 	if ((auth_alg & WPA_AUTH_ALG_OPEN) &&
1016 	    (auth_alg & WPA_AUTH_ALG_SHARED))
1017 		authmode = IEEE80211_AUTH_AUTO;
1018 	else if (auth_alg & WPA_AUTH_ALG_SHARED)
1019 		authmode = IEEE80211_AUTH_SHARED;
1020 	else
1021 		authmode = IEEE80211_AUTH_OPEN;
1022 
1023 	return set80211param(priv, IEEE80211_IOC_AUTHMODE, authmode);
1024 }
1025 
1026 static void
1027 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
1028 {
1029 	struct bsd_driver_data *drv = ctx;
1030 
1031 	drv_event_eapol_rx(drv->ctx, src_addr, buf, len);
1032 }
1033 
1034 static int
1035 wpa_driver_bsd_associate(void *priv, struct wpa_driver_associate_params *params)
1036 {
1037 	struct bsd_driver_data *drv = priv;
1038 	struct ieee80211req_mlme mlme;
1039 	u32 mode;
1040 	int privacy;
1041 	int ret = 0;
1042 
1043 	wpa_printf(MSG_DEBUG,
1044 		"%s: ssid '%.*s' wpa ie len %u pairwise %u group %u key mgmt %u"
1045 		, __func__
1046 		   , (unsigned int) params->ssid_len, params->ssid
1047 		, (unsigned int) params->wpa_ie_len
1048 		, params->pairwise_suite
1049 		, params->group_suite
1050 		, params->key_mgmt_suite
1051 	);
1052 
1053 	switch (params->mode) {
1054 	case IEEE80211_MODE_INFRA:
1055 		mode = 0 /* STA */;
1056 		break;
1057 	case IEEE80211_MODE_IBSS:
1058 		/*
1059 		 * Ref bin/203086 - FreeBSD's net80211 currently uses
1060 		 * IFM_IEEE80211_ADHOC.
1061 		 */
1062 #if 0
1063 		mode = IFM_IEEE80211_IBSS;
1064 #endif
1065 		mode = IFM_IEEE80211_ADHOC;
1066 		break;
1067 	case IEEE80211_MODE_AP:
1068 		mode = IFM_IEEE80211_HOSTAP;
1069 		break;
1070 	default:
1071 		wpa_printf(MSG_ERROR, "%s: unknown operation mode", __func__);
1072 		return -1;
1073 	}
1074 	if (bsd_set_mediaopt(drv, IFM_OMASK, mode) < 0) {
1075 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
1076 			   __func__);
1077 		return -1;
1078 	}
1079 
1080 	if (params->mode == IEEE80211_MODE_AP) {
1081 		drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
1082 						handle_read, drv, 0);
1083 		if (drv->sock_xmit == NULL)
1084 			return -1;
1085 		drv->is_ap = 1;
1086 		return 0;
1087 	}
1088 
1089 	if (wpa_driver_bsd_set_drop_unencrypted(drv, params->drop_unencrypted)
1090 	    < 0)
1091 		ret = -1;
1092 	if (wpa_driver_bsd_set_auth_alg(drv, params->auth_alg) < 0)
1093 		ret = -1;
1094 	/* XXX error handling is wrong but unclear what to do... */
1095 	if (wpa_driver_bsd_set_wpa_ie(drv, params->wpa_ie, params->wpa_ie_len) < 0)
1096 		return -1;
1097 
1098 	privacy = !(params->pairwise_suite == WPA_CIPHER_NONE &&
1099 	    params->group_suite == WPA_CIPHER_NONE &&
1100 	    params->key_mgmt_suite == WPA_KEY_MGMT_NONE &&
1101 	    params->wpa_ie_len == 0);
1102 	wpa_printf(MSG_DEBUG, "%s: set PRIVACY %u", __func__, privacy);
1103 
1104 	if (set80211param(drv, IEEE80211_IOC_PRIVACY, privacy) < 0)
1105 		return -1;
1106 
1107 	if (params->wpa_ie_len &&
1108 	    set80211param(drv, IEEE80211_IOC_WPA,
1109 			  params->wpa_ie[0] == WLAN_EID_RSN ? 2 : 1) < 0)
1110 		return -1;
1111 
1112 	/*
1113 	 * NB: interface must be marked UP for association
1114 	 * or scanning (ap_scan=2)
1115 	 */
1116 	if (bsd_ctrl_iface(drv, 1) < 0)
1117 		return -1;
1118 
1119 	os_memset(&mlme, 0, sizeof(mlme));
1120 	mlme.im_op = IEEE80211_MLME_ASSOC;
1121 	if (params->ssid != NULL)
1122 		os_memcpy(mlme.im_ssid, params->ssid, params->ssid_len);
1123 	mlme.im_ssid_len = params->ssid_len;
1124 	if (params->bssid != NULL)
1125 		os_memcpy(mlme.im_macaddr, params->bssid, IEEE80211_ADDR_LEN);
1126 	if (set80211var(drv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme)) < 0)
1127 		return -1;
1128 	return ret;
1129 }
1130 
1131 static int
1132 wpa_driver_bsd_scan(void *priv, struct wpa_driver_scan_params *params)
1133 {
1134 	struct bsd_driver_data *drv = priv;
1135 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1136 	struct ieee80211_scan_req sr;
1137 	int i;
1138 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1139 
1140 	if (bsd_set_mediaopt(drv, IFM_OMASK, 0 /* STA */) < 0) {
1141 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
1142 			   __func__);
1143 		return -1;
1144 	}
1145 
1146 	if (set80211param(drv, IEEE80211_IOC_ROAMING,
1147 			  IEEE80211_ROAMING_MANUAL) < 0) {
1148 		wpa_printf(MSG_ERROR, "%s: failed to set "
1149 			   "wpa_supplicant-based roaming: %s", __func__,
1150 			   strerror(errno));
1151 		return -1;
1152 	}
1153 
1154 	if (wpa_driver_bsd_set_wpa(drv, 1) < 0) {
1155 		wpa_printf(MSG_ERROR, "%s: failed to set wpa: %s", __func__,
1156 			   strerror(errno));
1157 		return -1;
1158 	}
1159 
1160 	/* NB: interface must be marked UP to do a scan */
1161 	if (bsd_ctrl_iface(drv, 1) < 0)
1162 		return -1;
1163 
1164 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1165 	os_memset(&sr, 0, sizeof(sr));
1166 	sr.sr_flags = IEEE80211_IOC_SCAN_ACTIVE | IEEE80211_IOC_SCAN_ONCE |
1167 		IEEE80211_IOC_SCAN_NOJOIN;
1168 	sr.sr_duration = IEEE80211_IOC_SCAN_FOREVER;
1169 	if (params->num_ssids > 0) {
1170 		sr.sr_nssid = params->num_ssids;
1171 #if 0
1172 		/* Boundary check is done by upper layer */
1173 		if (sr.sr_nssid > IEEE80211_IOC_SCAN_MAX_SSID)
1174 			sr.sr_nssid = IEEE80211_IOC_SCAN_MAX_SSID;
1175 #endif
1176 
1177 		/* NB: check scan cache first */
1178 		sr.sr_flags |= IEEE80211_IOC_SCAN_CHECK;
1179 	}
1180 	for (i = 0; i < sr.sr_nssid; i++) {
1181 		sr.sr_ssid[i].len = params->ssids[i].ssid_len;
1182 		os_memcpy(sr.sr_ssid[i].ssid, params->ssids[i].ssid,
1183 			  sr.sr_ssid[i].len);
1184 	}
1185 
1186 	/* NB: net80211 delivers a scan complete event so no need to poll */
1187 	return set80211var(drv, IEEE80211_IOC_SCAN_REQ, &sr, sizeof(sr));
1188 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
1189 	/* set desired ssid before scan */
1190 	if (bsd_set_ssid(drv, params->ssids[0].ssid,
1191 			 params->ssids[0].ssid_len) < 0)
1192 		return -1;
1193 
1194 	/* NB: net80211 delivers a scan complete event so no need to poll */
1195 	return set80211param(drv, IEEE80211_IOC_SCAN_REQ, 0);
1196 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1197 }
1198 
1199 static void
1200 wpa_driver_bsd_event_receive(int sock, void *ctx, void *sock_ctx)
1201 {
1202 	struct bsd_driver_data *drv = sock_ctx;
1203 	struct if_announcemsghdr *ifan;
1204 	struct if_msghdr *ifm;
1205 	struct rt_msghdr *rtm;
1206 	union wpa_event_data event;
1207 	struct ieee80211_michael_event *mic;
1208 	struct ieee80211_leave_event *leave;
1209 	struct ieee80211_join_event *join;
1210 	int n;
1211 
1212 	n = read(sock, drv->event_buf, drv->event_buf_len);
1213 	if (n < 0) {
1214 		if (errno != EINTR && errno != EAGAIN)
1215 			wpa_printf(MSG_ERROR, "%s read() failed: %s",
1216 				   __func__, strerror(errno));
1217 		return;
1218 	}
1219 
1220 	rtm = (struct rt_msghdr *) drv->event_buf;
1221 	if (rtm->rtm_version != RTM_VERSION) {
1222 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
1223 			   rtm->rtm_version);
1224 		return;
1225 	}
1226 	os_memset(&event, 0, sizeof(event));
1227 	switch (rtm->rtm_type) {
1228 	case RTM_IFANNOUNCE:
1229 		ifan = (struct if_announcemsghdr *) rtm;
1230 		if (ifan->ifan_index != drv->ifindex)
1231 			break;
1232 		os_strlcpy(event.interface_status.ifname, drv->ifname,
1233 			   sizeof(event.interface_status.ifname));
1234 		switch (ifan->ifan_what) {
1235 		case IFAN_DEPARTURE:
1236 			event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1237 		default:
1238 			return;
1239 		}
1240 		wpa_printf(MSG_DEBUG, "RTM_IFANNOUNCE: Interface '%s' %s",
1241 			   event.interface_status.ifname,
1242 			   ifan->ifan_what == IFAN_DEPARTURE ?
1243 				"removed" : "added");
1244 		wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
1245 		break;
1246 	case RTM_IEEE80211:
1247 		ifan = (struct if_announcemsghdr *) rtm;
1248 		if (ifan->ifan_index != drv->ifindex)
1249 			break;
1250 		switch (ifan->ifan_what) {
1251 		case RTM_IEEE80211_ASSOC:
1252 		case RTM_IEEE80211_REASSOC:
1253 			if (drv->is_ap)
1254 				break;
1255 			wpa_supplicant_event(ctx, EVENT_ASSOC, NULL);
1256 			break;
1257 		case RTM_IEEE80211_DISASSOC:
1258 			if (drv->is_ap)
1259 				break;
1260 			wpa_supplicant_event(ctx, EVENT_DISASSOC, NULL);
1261 			break;
1262 		case RTM_IEEE80211_SCAN:
1263 			if (drv->is_ap)
1264 				break;
1265 			wpa_supplicant_event(ctx, EVENT_SCAN_RESULTS, NULL);
1266 			break;
1267 		case RTM_IEEE80211_LEAVE:
1268 			leave = (struct ieee80211_leave_event *) &ifan[1];
1269 			drv_event_disassoc(ctx, leave->iev_addr);
1270 			break;
1271 		case RTM_IEEE80211_JOIN:
1272 #ifdef RTM_IEEE80211_REJOIN
1273 		case RTM_IEEE80211_REJOIN:
1274 #endif
1275 			join = (struct ieee80211_join_event *) &ifan[1];
1276 			bsd_new_sta(drv, ctx, join->iev_addr);
1277 			break;
1278 		case RTM_IEEE80211_REPLAY:
1279 			/* ignore */
1280 			break;
1281 		case RTM_IEEE80211_MICHAEL:
1282 			mic = (struct ieee80211_michael_event *) &ifan[1];
1283 			wpa_printf(MSG_DEBUG,
1284 				"Michael MIC failure wireless event: "
1285 				"keyix=%u src_addr=" MACSTR, mic->iev_keyix,
1286 				MAC2STR(mic->iev_src));
1287 
1288 			os_memset(&event, 0, sizeof(event));
1289 			event.michael_mic_failure.unicast =
1290 				!IEEE80211_IS_MULTICAST(mic->iev_dst);
1291 			wpa_supplicant_event(ctx, EVENT_MICHAEL_MIC_FAILURE,
1292 				&event);
1293 			break;
1294 		}
1295 		break;
1296 	case RTM_IFINFO:
1297 		ifm = (struct if_msghdr *) rtm;
1298 		if (ifm->ifm_index != drv->ifindex)
1299 			break;
1300 		if ((rtm->rtm_flags & RTF_UP) == 0) {
1301 			os_strlcpy(event.interface_status.ifname, drv->ifname,
1302 				   sizeof(event.interface_status.ifname));
1303 			event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
1304 			wpa_printf(MSG_DEBUG, "RTM_IFINFO: Interface '%s' DOWN",
1305 				   event.interface_status.ifname);
1306 			wpa_supplicant_event(ctx, EVENT_INTERFACE_STATUS, &event);
1307 		}
1308 		break;
1309 	}
1310 }
1311 
1312 static void
1313 wpa_driver_bsd_add_scan_entry(struct wpa_scan_results *res,
1314 			      struct ieee80211req_scan_result *sr)
1315 {
1316 	struct wpa_scan_res *result, **tmp;
1317 	size_t extra_len;
1318 	u8 *pos;
1319 
1320 	extra_len = 2 + sr->isr_ssid_len;
1321 	extra_len += 2 + sr->isr_nrates;
1322 	extra_len += 3; /* ERP IE */
1323 	extra_len += sr->isr_ie_len;
1324 
1325 	result = os_zalloc(sizeof(*result) + extra_len);
1326 	if (result == NULL)
1327 		return;
1328 	os_memcpy(result->bssid, sr->isr_bssid, ETH_ALEN);
1329 	result->freq = sr->isr_freq;
1330 	result->beacon_int = sr->isr_intval;
1331 	result->caps = sr->isr_capinfo;
1332 	result->qual = sr->isr_rssi;
1333 	result->noise = sr->isr_noise;
1334 	/*
1335 	 * the rssi value reported by the kernel is in 0.5dB steps relative to
1336 	 * the reported noise floor. see ieee80211_node.h for details.
1337 	 */
1338 	result->level = sr->isr_rssi / 2 + sr->isr_noise;
1339 
1340 	pos = (u8 *)(result + 1);
1341 
1342 	*pos++ = WLAN_EID_SSID;
1343 	*pos++ = sr->isr_ssid_len;
1344 	os_memcpy(pos, sr + 1, sr->isr_ssid_len);
1345 	pos += sr->isr_ssid_len;
1346 
1347 	/*
1348 	 * Deal all rates as supported rate.
1349 	 * Because net80211 doesn't report extended supported rate or not.
1350 	 */
1351 	*pos++ = WLAN_EID_SUPP_RATES;
1352 	*pos++ = sr->isr_nrates;
1353 	os_memcpy(pos, sr->isr_rates, sr->isr_nrates);
1354 	pos += sr->isr_nrates;
1355 
1356 	*pos++ = WLAN_EID_ERP_INFO;
1357 	*pos++ = 1;
1358 	*pos++ = sr->isr_erp;
1359 
1360 #if defined(__DragonFly__) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
1361 	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len + sr->isr_meshid_len,
1362 		  sr->isr_ie_len);
1363 #else
1364 	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len, sr->isr_ie_len);
1365 #endif
1366 	pos += sr->isr_ie_len;
1367 
1368 	result->ie_len = pos - (u8 *)(result + 1);
1369 
1370 	tmp = os_realloc_array(res->res, res->num + 1,
1371 			       sizeof(struct wpa_scan_res *));
1372 	if (tmp == NULL) {
1373 		os_free(result);
1374 		return;
1375 	}
1376 	tmp[res->num++] = result;
1377 	res->res = tmp;
1378 }
1379 
1380 struct wpa_scan_results *
1381 wpa_driver_bsd_get_scan_results2(void *priv)
1382 {
1383 	struct ieee80211req_scan_result *sr;
1384 	struct wpa_scan_results *res;
1385 	int len, rest;
1386 	uint8_t buf[24*1024], *pos;
1387 
1388 	len = get80211var(priv, IEEE80211_IOC_SCAN_RESULTS, buf, 24*1024);
1389 	if (len < 0)
1390 		return NULL;
1391 
1392 	res = os_zalloc(sizeof(*res));
1393 	if (res == NULL)
1394 		return NULL;
1395 
1396 	pos = buf;
1397 	rest = len;
1398 	while (rest >= sizeof(struct ieee80211req_scan_result)) {
1399 		sr = (struct ieee80211req_scan_result *)pos;
1400 		wpa_driver_bsd_add_scan_entry(res, sr);
1401 		pos += sr->isr_len;
1402 		rest -= sr->isr_len;
1403 	}
1404 
1405 	wpa_printf(MSG_DEBUG, "Received %d bytes of scan results (%lu BSSes)",
1406 		   len, (unsigned long)res->num);
1407 
1408 	return res;
1409 }
1410 
1411 static int wpa_driver_bsd_capa(struct bsd_driver_data *drv)
1412 {
1413 #ifdef IEEE80211_IOC_DEVCAPS
1414 /* kernel definitions copied from net80211/ieee80211_var.h */
1415 #define IEEE80211_CIPHER_WEP            0
1416 #define IEEE80211_CIPHER_TKIP           1
1417 #define IEEE80211_CIPHER_AES_CCM        3
1418 #define IEEE80211_CRYPTO_WEP            (1<<IEEE80211_CIPHER_WEP)
1419 #define IEEE80211_CRYPTO_TKIP           (1<<IEEE80211_CIPHER_TKIP)
1420 #define IEEE80211_CRYPTO_AES_CCM        (1<<IEEE80211_CIPHER_AES_CCM)
1421 #define IEEE80211_C_HOSTAP      0x00000400      /* CAPABILITY: HOSTAP avail */
1422 #define IEEE80211_C_WPA1        0x00800000      /* CAPABILITY: WPA1 avail */
1423 #define IEEE80211_C_WPA2        0x01000000      /* CAPABILITY: WPA2 avail */
1424 	struct ieee80211_devcaps_req devcaps;
1425 
1426 	if (get80211var(drv, IEEE80211_IOC_DEVCAPS, &devcaps,
1427 			sizeof(devcaps)) < 0) {
1428 		wpa_printf(MSG_ERROR, "failed to IEEE80211_IOC_DEVCAPS: %s",
1429 			   strerror(errno));
1430 		return -1;
1431 	}
1432 
1433 	wpa_printf(MSG_DEBUG, "%s: drivercaps=0x%08x,cryptocaps=0x%08x",
1434 		   __func__, devcaps.dc_drivercaps, devcaps.dc_cryptocaps);
1435 
1436 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA1)
1437 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1438 			WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1439 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA2)
1440 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1441 			WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1442 
1443 #ifdef __FreeBSD__
1444 	drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
1445 	    WPA_DRIVER_CAPA_ENC_WEP104 |
1446 	    WPA_DRIVER_CAPA_ENC_TKIP |
1447 	    WPA_DRIVER_CAPA_ENC_CCMP;
1448 #else
1449 	/*
1450 	 * XXX
1451 	 * FreeBSD exports hardware cryptocaps.  These have no meaning for wpa
1452 	 * since net80211 performs software crypto.
1453 	 */
1454 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_WEP)
1455 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
1456 			WPA_DRIVER_CAPA_ENC_WEP104;
1457 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_TKIP)
1458 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1459 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_AES_CCM)
1460 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1461 #endif
1462 
1463 	if (devcaps.dc_drivercaps & IEEE80211_C_HOSTAP)
1464 		drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1465 #undef IEEE80211_CIPHER_WEP
1466 #undef IEEE80211_CIPHER_TKIP
1467 #undef IEEE80211_CIPHER_AES_CCM
1468 #undef IEEE80211_CRYPTO_WEP
1469 #undef IEEE80211_CRYPTO_TKIP
1470 #undef IEEE80211_CRYPTO_AES_CCM
1471 #undef IEEE80211_C_HOSTAP
1472 #undef IEEE80211_C_WPA1
1473 #undef IEEE80211_C_WPA2
1474 #else /* IEEE80211_IOC_DEVCAPS */
1475 	/* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
1476 	drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1477 		WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
1478 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1479 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1480 	drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
1481 		WPA_DRIVER_CAPA_ENC_WEP104 |
1482 		WPA_DRIVER_CAPA_ENC_TKIP |
1483 		WPA_DRIVER_CAPA_ENC_CCMP;
1484 	drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1485 #endif /* IEEE80211_IOC_DEVCAPS */
1486 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1487 	drv->capa.max_scan_ssids = IEEE80211_IOC_SCAN_MAX_SSID;
1488 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
1489 	drv->capa.max_scan_ssids = 1;
1490 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1491 	drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
1492 		WPA_DRIVER_AUTH_SHARED |
1493 		WPA_DRIVER_AUTH_LEAP;
1494 	return 0;
1495 }
1496 
1497 static enum ieee80211_opmode
1498 get80211opmode(struct bsd_driver_data *drv)
1499 {
1500 	struct ifmediareq ifmr;
1501 
1502 	(void) memset(&ifmr, 0, sizeof(ifmr));
1503 	(void) os_strlcpy(ifmr.ifm_name, drv->ifname, sizeof(ifmr.ifm_name));
1504 
1505 	if (ioctl(drv->sock, SIOCGIFMEDIA, (caddr_t)&ifmr) >= 0) {
1506 		if (ifmr.ifm_current & IFM_IEEE80211_ADHOC) {
1507 			if (ifmr.ifm_current & IFM_FLAG0)
1508 				return IEEE80211_M_AHDEMO;
1509 			else
1510 				return IEEE80211_M_IBSS;
1511 		}
1512 		if (ifmr.ifm_current & IFM_IEEE80211_HOSTAP)
1513 			return IEEE80211_M_HOSTAP;
1514 		if (ifmr.ifm_current & IFM_IEEE80211_IBSS)
1515 			return IEEE80211_M_IBSS;
1516 		if (ifmr.ifm_current & IFM_IEEE80211_MONITOR)
1517 			return IEEE80211_M_MONITOR;
1518 #ifdef IEEE80211_M_MBSS
1519 		if (ifmr.ifm_current & IFM_IEEE80211_MBSS)
1520 			return IEEE80211_M_MBSS;
1521 #endif /* IEEE80211_M_MBSS */
1522 	}
1523 	return IEEE80211_M_STA;
1524 }
1525 
1526 static void *
1527 wpa_driver_bsd_init(void *ctx, const char *ifname)
1528 {
1529 #define	GETPARAM(drv, param, v) \
1530 	(((v) = get80211param(drv, param)) != -1)
1531 	struct bsd_driver_data *drv;
1532 
1533 	drv = os_zalloc(sizeof(*drv));
1534 	if (drv == NULL)
1535 		return NULL;
1536 
1537 	drv->event_buf_len = rtbuf_len();
1538 
1539 	drv->event_buf = os_malloc(drv->event_buf_len);
1540 	if (drv->event_buf == NULL) {
1541 		wpa_printf(MSG_ERROR, "%s: os_malloc() failed", __func__);
1542 		goto fail1;
1543 	}
1544 
1545 	/*
1546 	 * NB: We require the interface name be mappable to an index.
1547 	 *     This implies we do not support having wpa_supplicant
1548 	 *     wait for an interface to appear.  This seems ok; that
1549 	 *     doesn't belong here; it's really the job of devd.
1550 	 */
1551 	drv->ifindex = if_nametoindex(ifname);
1552 	if (drv->ifindex == 0) {
1553 		wpa_printf(MSG_DEBUG, "%s: interface %s does not exist",
1554 			   __func__, ifname);
1555 		goto fail1;
1556 	}
1557 	drv->sock = socket(PF_INET, SOCK_DGRAM, 0);
1558 	if (drv->sock < 0)
1559 		goto fail1;
1560 
1561 	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1562 	/* Down interface during setup. */
1563 	if (bsd_ctrl_iface(drv, 0) < 0)
1564 		goto fail;
1565 
1566 	drv->route = socket(PF_ROUTE, SOCK_RAW, 0);
1567 	if (drv->route < 0)
1568 		goto fail;
1569 	eloop_register_read_sock(drv->route,
1570 		wpa_driver_bsd_event_receive, ctx, drv);
1571 
1572 	drv->ctx = ctx;
1573 
1574 	if (!GETPARAM(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming)) {
1575 		wpa_printf(MSG_DEBUG, "%s: failed to get roaming state: %s",
1576 			__func__, strerror(errno));
1577 		goto fail;
1578 	}
1579 	if (!GETPARAM(drv, IEEE80211_IOC_PRIVACY, drv->prev_privacy)) {
1580 		wpa_printf(MSG_DEBUG, "%s: failed to get privacy state: %s",
1581 			__func__, strerror(errno));
1582 		goto fail;
1583 	}
1584 	if (!GETPARAM(drv, IEEE80211_IOC_WPA, drv->prev_wpa)) {
1585 		wpa_printf(MSG_DEBUG, "%s: failed to get wpa state: %s",
1586 			__func__, strerror(errno));
1587 		goto fail;
1588 	}
1589 
1590 	if (wpa_driver_bsd_capa(drv))
1591 		goto fail;
1592 
1593 	drv->opmode = get80211opmode(drv);
1594 
1595 	return drv;
1596 fail:
1597 	close(drv->sock);
1598 fail1:
1599 	os_free(drv->event_buf);
1600 	os_free(drv);
1601 	return NULL;
1602 #undef GETPARAM
1603 }
1604 
1605 static void
1606 wpa_driver_bsd_deinit(void *priv)
1607 {
1608 	struct bsd_driver_data *drv = priv;
1609 
1610 	wpa_driver_bsd_set_wpa(drv, 0);
1611 	eloop_unregister_read_sock(drv->route);
1612 
1613 	/* NB: mark interface down */
1614 	bsd_ctrl_iface(drv, 0);
1615 
1616 	wpa_driver_bsd_set_wpa_internal(drv, drv->prev_wpa, drv->prev_privacy);
1617 	if (set80211param(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming) < 0)
1618 		wpa_printf(MSG_DEBUG, "%s: failed to restore roaming state",
1619 			__func__);
1620 
1621 	if (drv->sock_xmit != NULL)
1622 		l2_packet_deinit(drv->sock_xmit);
1623 	(void) close(drv->route);		/* ioctl socket */
1624 	(void) close(drv->sock);		/* event socket */
1625 	os_free(drv->event_buf);
1626 	os_free(drv);
1627 }
1628 
1629 static int
1630 wpa_driver_bsd_get_capa(void *priv, struct wpa_driver_capa *capa)
1631 {
1632 	struct bsd_driver_data *drv = priv;
1633 
1634 	os_memcpy(capa, &drv->capa, sizeof(*capa));
1635 	return 0;
1636 }
1637 #endif /* HOSTAPD */
1638 
1639 
1640 const struct wpa_driver_ops wpa_driver_bsd_ops = {
1641 	.name			= "bsd",
1642 	.desc			= "BSD 802.11 support",
1643 #ifdef HOSTAPD
1644 	.hapd_init		= bsd_init,
1645 	.hapd_deinit		= bsd_deinit,
1646 	.set_privacy		= bsd_set_privacy,
1647 	.get_seqnum		= bsd_get_seqnum,
1648 	.flush			= bsd_flush,
1649 	.read_sta_data		= bsd_read_sta_driver_data,
1650 	.sta_disassoc		= bsd_sta_disassoc,
1651 	.sta_deauth		= bsd_sta_deauth,
1652 	.sta_set_flags		= bsd_set_sta_authorized,
1653 	.commit			= bsd_commit,
1654 #else /* HOSTAPD */
1655 	.init			= wpa_driver_bsd_init,
1656 	.deinit			= wpa_driver_bsd_deinit,
1657 	.get_bssid		= wpa_driver_bsd_get_bssid,
1658 	.get_ssid		= wpa_driver_bsd_get_ssid,
1659 	.set_countermeasures	= wpa_driver_bsd_set_countermeasures,
1660 	.scan2			= wpa_driver_bsd_scan,
1661 	.get_scan_results2	= wpa_driver_bsd_get_scan_results2,
1662 	.deauthenticate		= wpa_driver_bsd_deauthenticate,
1663 	.associate		= wpa_driver_bsd_associate,
1664 	.get_capa		= wpa_driver_bsd_get_capa,
1665 #endif /* HOSTAPD */
1666 	.set_freq		= bsd_set_freq,
1667 	.set_key		= bsd_set_key,
1668 	.set_ieee8021x		= bsd_set_ieee8021x,
1669 	.hapd_set_ssid		= bsd_set_ssid,
1670 	.hapd_get_ssid		= bsd_get_ssid,
1671 	.hapd_send_eapol	= bsd_send_eapol,
1672 	.set_generic_elem	= bsd_set_opt_ie,
1673 };
1674