mlme.c 26 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950951952953954955956957958959960961962963964965966967968
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * cfg80211 MLME SAP interface
  4. *
  5. * Copyright (c) 2009, Jouni Malinen <j@w1.fi>
  6. * Copyright (c) 2015 Intel Deutschland GmbH
  7. * Copyright (C) 2019 Intel Corporation
  8. */
  9. #include <linux/kernel.h>
  10. #include <linux/module.h>
  11. #include <linux/etherdevice.h>
  12. #include <linux/netdevice.h>
  13. #include <linux/nl80211.h>
  14. #include <linux/slab.h>
  15. #include <linux/wireless.h>
  16. #include <net/cfg80211.h>
  17. #include <net/iw_handler.h>
  18. #include "core.h"
  19. #include "nl80211.h"
  20. #include "rdev-ops.h"
  21. void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss,
  22. const u8 *buf, size_t len, int uapsd_queues,
  23. const u8 *req_ies, size_t req_ies_len)
  24. {
  25. struct wireless_dev *wdev = dev->ieee80211_ptr;
  26. struct wiphy *wiphy = wdev->wiphy;
  27. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  28. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  29. struct cfg80211_connect_resp_params cr;
  30. const u8 *resp_ie = mgmt->u.assoc_resp.variable;
  31. size_t resp_ie_len = len - offsetof(struct ieee80211_mgmt,
  32. u.assoc_resp.variable);
  33. if (bss->channel->band == NL80211_BAND_S1GHZ) {
  34. resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;
  35. resp_ie_len = len - offsetof(struct ieee80211_mgmt,
  36. u.s1g_assoc_resp.variable);
  37. }
  38. memset(&cr, 0, sizeof(cr));
  39. cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code);
  40. cr.bssid = mgmt->bssid;
  41. cr.bss = bss;
  42. cr.req_ie = req_ies;
  43. cr.req_ie_len = req_ies_len;
  44. cr.resp_ie = resp_ie;
  45. cr.resp_ie_len = resp_ie_len;
  46. cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED;
  47. trace_cfg80211_send_rx_assoc(dev, bss);
  48. /*
  49. * This is a bit of a hack, we don't notify userspace of
  50. * a (re-)association reply if we tried to send a reassoc
  51. * and got a reject -- we only try again with an assoc
  52. * frame instead of reassoc.
  53. */
  54. if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) {
  55. cfg80211_unhold_bss(bss_from_pub(bss));
  56. cfg80211_put_bss(wiphy, bss);
  57. return;
  58. }
  59. nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues,
  60. req_ies, req_ies_len);
  61. /* update current_bss etc., consumes the bss reference */
  62. __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);
  63. }
  64. EXPORT_SYMBOL(cfg80211_rx_assoc_resp);
  65. static void cfg80211_process_auth(struct wireless_dev *wdev,
  66. const u8 *buf, size_t len)
  67. {
  68. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  69. nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  70. cfg80211_sme_rx_auth(wdev, buf, len);
  71. }
  72. static void cfg80211_process_deauth(struct wireless_dev *wdev,
  73. const u8 *buf, size_t len)
  74. {
  75. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  76. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  77. const u8 *bssid = mgmt->bssid;
  78. u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
  79. bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
  80. nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  81. if (!wdev->current_bss ||
  82. !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
  83. return;
  84. __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
  85. cfg80211_sme_deauth(wdev);
  86. }
  87. static void cfg80211_process_disassoc(struct wireless_dev *wdev,
  88. const u8 *buf, size_t len)
  89. {
  90. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  91. struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
  92. const u8 *bssid = mgmt->bssid;
  93. u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
  94. bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr);
  95. nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL);
  96. if (WARN_ON(!wdev->current_bss ||
  97. !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
  98. return;
  99. __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);
  100. cfg80211_sme_disassoc(wdev);
  101. }
  102. void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
  103. {
  104. struct wireless_dev *wdev = dev->ieee80211_ptr;
  105. struct ieee80211_mgmt *mgmt = (void *)buf;
  106. ASSERT_WDEV_LOCK(wdev);
  107. trace_cfg80211_rx_mlme_mgmt(dev, buf, len);
  108. if (WARN_ON(len < 2))
  109. return;
  110. if (ieee80211_is_auth(mgmt->frame_control))
  111. cfg80211_process_auth(wdev, buf, len);
  112. else if (ieee80211_is_deauth(mgmt->frame_control))
  113. cfg80211_process_deauth(wdev, buf, len);
  114. else if (ieee80211_is_disassoc(mgmt->frame_control))
  115. cfg80211_process_disassoc(wdev, buf, len);
  116. }
  117. EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt);
  118. void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr)
  119. {
  120. struct wireless_dev *wdev = dev->ieee80211_ptr;
  121. struct wiphy *wiphy = wdev->wiphy;
  122. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  123. trace_cfg80211_send_auth_timeout(dev, addr);
  124. nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);
  125. cfg80211_sme_auth_timeout(wdev);
  126. }
  127. EXPORT_SYMBOL(cfg80211_auth_timeout);
  128. void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss)
  129. {
  130. struct wireless_dev *wdev = dev->ieee80211_ptr;
  131. struct wiphy *wiphy = wdev->wiphy;
  132. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  133. trace_cfg80211_send_assoc_timeout(dev, bss->bssid);
  134. nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL);
  135. cfg80211_sme_assoc_timeout(wdev);
  136. cfg80211_unhold_bss(bss_from_pub(bss));
  137. cfg80211_put_bss(wiphy, bss);
  138. }
  139. EXPORT_SYMBOL(cfg80211_assoc_timeout);
  140. void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss)
  141. {
  142. struct wireless_dev *wdev = dev->ieee80211_ptr;
  143. struct wiphy *wiphy = wdev->wiphy;
  144. cfg80211_sme_abandon_assoc(wdev);
  145. cfg80211_unhold_bss(bss_from_pub(bss));
  146. cfg80211_put_bss(wiphy, bss);
  147. }
  148. EXPORT_SYMBOL(cfg80211_abandon_assoc);
  149. void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len)
  150. {
  151. struct wireless_dev *wdev = dev->ieee80211_ptr;
  152. struct ieee80211_mgmt *mgmt = (void *)buf;
  153. ASSERT_WDEV_LOCK(wdev);
  154. trace_cfg80211_tx_mlme_mgmt(dev, buf, len);
  155. if (WARN_ON(len < 2))
  156. return;
  157. if (ieee80211_is_deauth(mgmt->frame_control))
  158. cfg80211_process_deauth(wdev, buf, len);
  159. else
  160. cfg80211_process_disassoc(wdev, buf, len);
  161. }
  162. EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt);
  163. void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,
  164. enum nl80211_key_type key_type, int key_id,
  165. const u8 *tsc, gfp_t gfp)
  166. {
  167. struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
  168. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  169. #ifdef CONFIG_CFG80211_WEXT
  170. union iwreq_data wrqu;
  171. char *buf = kmalloc(128, gfp);
  172. if (buf) {
  173. sprintf(buf, "MLME-MICHAELMICFAILURE.indication("
  174. "keyid=%d %scast addr=%pM)", key_id,
  175. key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni",
  176. addr);
  177. memset(&wrqu, 0, sizeof(wrqu));
  178. wrqu.data.length = strlen(buf);
  179. wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
  180. kfree(buf);
  181. }
  182. #endif
  183. trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);
  184. nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);
  185. }
  186. EXPORT_SYMBOL(cfg80211_michael_mic_failure);
  187. /* some MLME handling for userspace SME */
  188. int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,
  189. struct net_device *dev,
  190. struct ieee80211_channel *chan,
  191. enum nl80211_auth_type auth_type,
  192. const u8 *bssid,
  193. const u8 *ssid, int ssid_len,
  194. const u8 *ie, int ie_len,
  195. const u8 *key, int key_len, int key_idx,
  196. const u8 *auth_data, int auth_data_len)
  197. {
  198. struct wireless_dev *wdev = dev->ieee80211_ptr;
  199. struct cfg80211_auth_request req = {
  200. .ie = ie,
  201. .ie_len = ie_len,
  202. .auth_data = auth_data,
  203. .auth_data_len = auth_data_len,
  204. .auth_type = auth_type,
  205. .key = key,
  206. .key_len = key_len,
  207. .key_idx = key_idx,
  208. };
  209. int err;
  210. ASSERT_WDEV_LOCK(wdev);
  211. if (auth_type == NL80211_AUTHTYPE_SHARED_KEY)
  212. if (!key || !key_len || key_idx < 0 || key_idx > 3)
  213. return -EINVAL;
  214. if (wdev->current_bss &&
  215. ether_addr_equal(bssid, wdev->current_bss->pub.bssid))
  216. return -EALREADY;
  217. req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
  218. IEEE80211_BSS_TYPE_ESS,
  219. IEEE80211_PRIVACY_ANY);
  220. if (!req.bss)
  221. return -ENOENT;
  222. err = rdev_auth(rdev, dev, &req);
  223. cfg80211_put_bss(&rdev->wiphy, req.bss);
  224. return err;
  225. }
  226. /* Do a logical ht_capa &= ht_capa_mask. */
  227. void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,
  228. const struct ieee80211_ht_cap *ht_capa_mask)
  229. {
  230. int i;
  231. u8 *p1, *p2;
  232. if (!ht_capa_mask) {
  233. memset(ht_capa, 0, sizeof(*ht_capa));
  234. return;
  235. }
  236. p1 = (u8*)(ht_capa);
  237. p2 = (u8*)(ht_capa_mask);
  238. for (i = 0; i < sizeof(*ht_capa); i++)
  239. p1[i] &= p2[i];
  240. }
  241. /* Do a logical vht_capa &= vht_capa_mask. */
  242. void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,
  243. const struct ieee80211_vht_cap *vht_capa_mask)
  244. {
  245. int i;
  246. u8 *p1, *p2;
  247. if (!vht_capa_mask) {
  248. memset(vht_capa, 0, sizeof(*vht_capa));
  249. return;
  250. }
  251. p1 = (u8*)(vht_capa);
  252. p2 = (u8*)(vht_capa_mask);
  253. for (i = 0; i < sizeof(*vht_capa); i++)
  254. p1[i] &= p2[i];
  255. }
  256. int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev,
  257. struct net_device *dev,
  258. struct ieee80211_channel *chan,
  259. const u8 *bssid,
  260. const u8 *ssid, int ssid_len,
  261. struct cfg80211_assoc_request *req)
  262. {
  263. struct wireless_dev *wdev = dev->ieee80211_ptr;
  264. int err;
  265. ASSERT_WDEV_LOCK(wdev);
  266. if (wdev->current_bss &&
  267. (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid,
  268. req->prev_bssid)))
  269. return -EALREADY;
  270. cfg80211_oper_and_ht_capa(&req->ht_capa_mask,
  271. rdev->wiphy.ht_capa_mod_mask);
  272. cfg80211_oper_and_vht_capa(&req->vht_capa_mask,
  273. rdev->wiphy.vht_capa_mod_mask);
  274. req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
  275. IEEE80211_BSS_TYPE_ESS,
  276. IEEE80211_PRIVACY_ANY);
  277. if (!req->bss)
  278. return -ENOENT;
  279. err = rdev_assoc(rdev, dev, req);
  280. if (!err)
  281. cfg80211_hold_bss(bss_from_pub(req->bss));
  282. else
  283. cfg80211_put_bss(&rdev->wiphy, req->bss);
  284. return err;
  285. }
  286. int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev,
  287. struct net_device *dev, const u8 *bssid,
  288. const u8 *ie, int ie_len, u16 reason,
  289. bool local_state_change)
  290. {
  291. struct wireless_dev *wdev = dev->ieee80211_ptr;
  292. struct cfg80211_deauth_request req = {
  293. .bssid = bssid,
  294. .reason_code = reason,
  295. .ie = ie,
  296. .ie_len = ie_len,
  297. .local_state_change = local_state_change,
  298. };
  299. ASSERT_WDEV_LOCK(wdev);
  300. if (local_state_change &&
  301. (!wdev->current_bss ||
  302. !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
  303. return 0;
  304. if (ether_addr_equal(wdev->disconnect_bssid, bssid) ||
  305. (wdev->current_bss &&
  306. ether_addr_equal(wdev->current_bss->pub.bssid, bssid)))
  307. wdev->conn_owner_nlportid = 0;
  308. return rdev_deauth(rdev, dev, &req);
  309. }
  310. int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev,
  311. struct net_device *dev, const u8 *bssid,
  312. const u8 *ie, int ie_len, u16 reason,
  313. bool local_state_change)
  314. {
  315. struct wireless_dev *wdev = dev->ieee80211_ptr;
  316. struct cfg80211_disassoc_request req = {
  317. .reason_code = reason,
  318. .local_state_change = local_state_change,
  319. .ie = ie,
  320. .ie_len = ie_len,
  321. };
  322. int err;
  323. ASSERT_WDEV_LOCK(wdev);
  324. if (!wdev->current_bss)
  325. return -ENOTCONN;
  326. if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid))
  327. req.bss = &wdev->current_bss->pub;
  328. else
  329. return -ENOTCONN;
  330. err = rdev_disassoc(rdev, dev, &req);
  331. if (err)
  332. return err;
  333. /* driver should have reported the disassoc */
  334. WARN_ON(wdev->current_bss);
  335. return 0;
  336. }
  337. void cfg80211_mlme_down(struct cfg80211_registered_device *rdev,
  338. struct net_device *dev)
  339. {
  340. struct wireless_dev *wdev = dev->ieee80211_ptr;
  341. u8 bssid[ETH_ALEN];
  342. ASSERT_WDEV_LOCK(wdev);
  343. if (!rdev->ops->deauth)
  344. return;
  345. if (!wdev->current_bss)
  346. return;
  347. memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN);
  348. cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0,
  349. WLAN_REASON_DEAUTH_LEAVING, false);
  350. }
  351. struct cfg80211_mgmt_registration {
  352. struct list_head list;
  353. struct wireless_dev *wdev;
  354. u32 nlportid;
  355. int match_len;
  356. __le16 frame_type;
  357. bool multicast_rx;
  358. u8 match[];
  359. };
  360. static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
  361. {
  362. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  363. struct wireless_dev *tmp;
  364. struct cfg80211_mgmt_registration *reg;
  365. struct mgmt_frame_regs upd = {};
  366. ASSERT_RTNL();
  367. spin_lock_bh(&rdev->mgmt_registrations_lock);
  368. if (!wdev->mgmt_registrations_need_update) {
  369. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  370. return;
  371. }
  372. rcu_read_lock();
  373. list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) {
  374. list_for_each_entry(reg, &tmp->mgmt_registrations, list) {
  375. u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4);
  376. u32 mcast_mask = 0;
  377. if (reg->multicast_rx)
  378. mcast_mask = mask;
  379. upd.global_stypes |= mask;
  380. upd.global_mcast_stypes |= mcast_mask;
  381. if (tmp == wdev) {
  382. upd.interface_stypes |= mask;
  383. upd.interface_mcast_stypes |= mcast_mask;
  384. }
  385. }
  386. }
  387. rcu_read_unlock();
  388. wdev->mgmt_registrations_need_update = 0;
  389. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  390. rdev_update_mgmt_frame_registrations(rdev, wdev, &upd);
  391. }
  392. void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk)
  393. {
  394. struct cfg80211_registered_device *rdev;
  395. struct wireless_dev *wdev;
  396. rdev = container_of(wk, struct cfg80211_registered_device,
  397. mgmt_registrations_update_wk);
  398. rtnl_lock();
  399. list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list)
  400. cfg80211_mgmt_registrations_update(wdev);
  401. rtnl_unlock();
  402. }
  403. int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
  404. u16 frame_type, const u8 *match_data,
  405. int match_len, bool multicast_rx,
  406. struct netlink_ext_ack *extack)
  407. {
  408. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  409. struct cfg80211_mgmt_registration *reg, *nreg;
  410. int err = 0;
  411. u16 mgmt_type;
  412. bool update_multicast = false;
  413. if (!wdev->wiphy->mgmt_stypes)
  414. return -EOPNOTSUPP;
  415. if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) {
  416. NL_SET_ERR_MSG(extack, "frame type not management");
  417. return -EINVAL;
  418. }
  419. if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) {
  420. NL_SET_ERR_MSG(extack, "Invalid frame type");
  421. return -EINVAL;
  422. }
  423. mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4;
  424. if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) {
  425. NL_SET_ERR_MSG(extack,
  426. "Registration to specific type not supported");
  427. return -EINVAL;
  428. }
  429. /*
  430. * To support Pre Association Security Negotiation (PASN), registration
  431. * for authentication frames should be supported. However, as some
  432. * versions of the user space daemons wrongly register to all types of
  433. * authentication frames (which might result in unexpected behavior)
  434. * allow such registration if the request is for a specific
  435. * authentication algorithm number.
  436. */
  437. if (wdev->iftype == NL80211_IFTYPE_STATION &&
  438. (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH &&
  439. !(match_data && match_len >= 2)) {
  440. NL_SET_ERR_MSG(extack,
  441. "Authentication algorithm number required");
  442. return -EINVAL;
  443. }
  444. nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL);
  445. if (!nreg)
  446. return -ENOMEM;
  447. spin_lock_bh(&rdev->mgmt_registrations_lock);
  448. list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
  449. int mlen = min(match_len, reg->match_len);
  450. if (frame_type != le16_to_cpu(reg->frame_type))
  451. continue;
  452. if (memcmp(reg->match, match_data, mlen) == 0) {
  453. if (reg->multicast_rx != multicast_rx) {
  454. update_multicast = true;
  455. reg->multicast_rx = multicast_rx;
  456. break;
  457. }
  458. NL_SET_ERR_MSG(extack, "Match already configured");
  459. err = -EALREADY;
  460. break;
  461. }
  462. }
  463. if (err)
  464. goto out;
  465. if (update_multicast) {
  466. kfree(nreg);
  467. } else {
  468. memcpy(nreg->match, match_data, match_len);
  469. nreg->match_len = match_len;
  470. nreg->nlportid = snd_portid;
  471. nreg->frame_type = cpu_to_le16(frame_type);
  472. nreg->wdev = wdev;
  473. nreg->multicast_rx = multicast_rx;
  474. list_add(&nreg->list, &wdev->mgmt_registrations);
  475. }
  476. wdev->mgmt_registrations_need_update = 1;
  477. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  478. cfg80211_mgmt_registrations_update(wdev);
  479. return 0;
  480. out:
  481. kfree(nreg);
  482. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  483. return err;
  484. }
  485. void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid)
  486. {
  487. struct wiphy *wiphy = wdev->wiphy;
  488. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  489. struct cfg80211_mgmt_registration *reg, *tmp;
  490. spin_lock_bh(&rdev->mgmt_registrations_lock);
  491. list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
  492. if (reg->nlportid != nlportid)
  493. continue;
  494. list_del(&reg->list);
  495. kfree(reg);
  496. wdev->mgmt_registrations_need_update = 1;
  497. schedule_work(&rdev->mgmt_registrations_update_wk);
  498. }
  499. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  500. if (nlportid && rdev->crit_proto_nlportid == nlportid) {
  501. rdev->crit_proto_nlportid = 0;
  502. rdev_crit_proto_stop(rdev, wdev);
  503. }
  504. if (nlportid == wdev->ap_unexpected_nlportid)
  505. wdev->ap_unexpected_nlportid = 0;
  506. }
  507. void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev)
  508. {
  509. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
  510. struct cfg80211_mgmt_registration *reg, *tmp;
  511. spin_lock_bh(&rdev->mgmt_registrations_lock);
  512. list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) {
  513. list_del(&reg->list);
  514. kfree(reg);
  515. }
  516. wdev->mgmt_registrations_need_update = 1;
  517. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  518. cfg80211_mgmt_registrations_update(wdev);
  519. }
  520. int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev,
  521. struct wireless_dev *wdev,
  522. struct cfg80211_mgmt_tx_params *params, u64 *cookie)
  523. {
  524. const struct ieee80211_mgmt *mgmt;
  525. u16 stype;
  526. if (!wdev->wiphy->mgmt_stypes)
  527. return -EOPNOTSUPP;
  528. if (!rdev->ops->mgmt_tx)
  529. return -EOPNOTSUPP;
  530. if (params->len < 24 + 1)
  531. return -EINVAL;
  532. mgmt = (const struct ieee80211_mgmt *)params->buf;
  533. if (!ieee80211_is_mgmt(mgmt->frame_control))
  534. return -EINVAL;
  535. stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE;
  536. if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4)))
  537. return -EINVAL;
  538. if (ieee80211_is_action(mgmt->frame_control) &&
  539. mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) {
  540. int err = 0;
  541. wdev_lock(wdev);
  542. switch (wdev->iftype) {
  543. case NL80211_IFTYPE_ADHOC:
  544. case NL80211_IFTYPE_STATION:
  545. case NL80211_IFTYPE_P2P_CLIENT:
  546. if (!wdev->current_bss) {
  547. err = -ENOTCONN;
  548. break;
  549. }
  550. if (!ether_addr_equal(wdev->current_bss->pub.bssid,
  551. mgmt->bssid)) {
  552. err = -ENOTCONN;
  553. break;
  554. }
  555. /*
  556. * check for IBSS DA must be done by driver as
  557. * cfg80211 doesn't track the stations
  558. */
  559. if (wdev->iftype == NL80211_IFTYPE_ADHOC)
  560. break;
  561. /* for station, check that DA is the AP */
  562. if (!ether_addr_equal(wdev->current_bss->pub.bssid,
  563. mgmt->da)) {
  564. err = -ENOTCONN;
  565. break;
  566. }
  567. break;
  568. case NL80211_IFTYPE_AP:
  569. case NL80211_IFTYPE_P2P_GO:
  570. case NL80211_IFTYPE_AP_VLAN:
  571. if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev)))
  572. err = -EINVAL;
  573. break;
  574. case NL80211_IFTYPE_MESH_POINT:
  575. if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) {
  576. err = -EINVAL;
  577. break;
  578. }
  579. /*
  580. * check for mesh DA must be done by driver as
  581. * cfg80211 doesn't track the stations
  582. */
  583. break;
  584. case NL80211_IFTYPE_P2P_DEVICE:
  585. /*
  586. * fall through, P2P device only supports
  587. * public action frames
  588. */
  589. case NL80211_IFTYPE_NAN:
  590. default:
  591. err = -EOPNOTSUPP;
  592. break;
  593. }
  594. wdev_unlock(wdev);
  595. if (err)
  596. return err;
  597. }
  598. if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) {
  599. /* Allow random TA to be used with Public Action frames if the
  600. * driver has indicated support for this. Otherwise, only allow
  601. * the local address to be used.
  602. */
  603. if (!ieee80211_is_action(mgmt->frame_control) ||
  604. mgmt->u.action.category != WLAN_CATEGORY_PUBLIC)
  605. return -EINVAL;
  606. if (!wdev->current_bss &&
  607. !wiphy_ext_feature_isset(
  608. &rdev->wiphy,
  609. NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA))
  610. return -EINVAL;
  611. if (wdev->current_bss &&
  612. !wiphy_ext_feature_isset(
  613. &rdev->wiphy,
  614. NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED))
  615. return -EINVAL;
  616. }
  617. /* Transmit the Action frame as requested by user space */
  618. return rdev_mgmt_tx(rdev, wdev, params, cookie);
  619. }
  620. bool cfg80211_rx_mgmt_khz(struct wireless_dev *wdev, int freq, int sig_dbm,
  621. const u8 *buf, size_t len, u32 flags)
  622. {
  623. struct wiphy *wiphy = wdev->wiphy;
  624. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  625. struct cfg80211_mgmt_registration *reg;
  626. const struct ieee80211_txrx_stypes *stypes =
  627. &wiphy->mgmt_stypes[wdev->iftype];
  628. struct ieee80211_mgmt *mgmt = (void *)buf;
  629. const u8 *data;
  630. int data_len;
  631. bool result = false;
  632. __le16 ftype = mgmt->frame_control &
  633. cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE);
  634. u16 stype;
  635. trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm);
  636. stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4;
  637. if (!(stypes->rx & BIT(stype))) {
  638. trace_cfg80211_return_bool(false);
  639. return false;
  640. }
  641. data = buf + ieee80211_hdrlen(mgmt->frame_control);
  642. data_len = len - ieee80211_hdrlen(mgmt->frame_control);
  643. spin_lock_bh(&rdev->mgmt_registrations_lock);
  644. list_for_each_entry(reg, &wdev->mgmt_registrations, list) {
  645. if (reg->frame_type != ftype)
  646. continue;
  647. if (reg->match_len > data_len)
  648. continue;
  649. if (memcmp(reg->match, data, reg->match_len))
  650. continue;
  651. /* found match! */
  652. /* Indicate the received Action frame to user space */
  653. if (nl80211_send_mgmt(rdev, wdev, reg->nlportid,
  654. freq, sig_dbm,
  655. buf, len, flags, GFP_ATOMIC))
  656. continue;
  657. result = true;
  658. break;
  659. }
  660. spin_unlock_bh(&rdev->mgmt_registrations_lock);
  661. trace_cfg80211_return_bool(result);
  662. return result;
  663. }
  664. EXPORT_SYMBOL(cfg80211_rx_mgmt_khz);
  665. void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev)
  666. {
  667. cancel_delayed_work(&rdev->dfs_update_channels_wk);
  668. queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0);
  669. }
  670. void cfg80211_dfs_channels_update_work(struct work_struct *work)
  671. {
  672. struct delayed_work *delayed_work = to_delayed_work(work);
  673. struct cfg80211_registered_device *rdev;
  674. struct cfg80211_chan_def chandef;
  675. struct ieee80211_supported_band *sband;
  676. struct ieee80211_channel *c;
  677. struct wiphy *wiphy;
  678. bool check_again = false;
  679. unsigned long timeout, next_time = 0;
  680. unsigned long time_dfs_update;
  681. enum nl80211_radar_event radar_event;
  682. int bandid, i;
  683. rdev = container_of(delayed_work, struct cfg80211_registered_device,
  684. dfs_update_channels_wk);
  685. wiphy = &rdev->wiphy;
  686. rtnl_lock();
  687. for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) {
  688. sband = wiphy->bands[bandid];
  689. if (!sband)
  690. continue;
  691. for (i = 0; i < sband->n_channels; i++) {
  692. c = &sband->channels[i];
  693. if (!(c->flags & IEEE80211_CHAN_RADAR))
  694. continue;
  695. if (c->dfs_state != NL80211_DFS_UNAVAILABLE &&
  696. c->dfs_state != NL80211_DFS_AVAILABLE)
  697. continue;
  698. if (c->dfs_state == NL80211_DFS_UNAVAILABLE) {
  699. time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS;
  700. radar_event = NL80211_RADAR_NOP_FINISHED;
  701. } else {
  702. if (regulatory_pre_cac_allowed(wiphy) ||
  703. cfg80211_any_wiphy_oper_chan(wiphy, c))
  704. continue;
  705. time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS;
  706. radar_event = NL80211_RADAR_PRE_CAC_EXPIRED;
  707. }
  708. timeout = c->dfs_state_entered +
  709. msecs_to_jiffies(time_dfs_update);
  710. if (time_after_eq(jiffies, timeout)) {
  711. c->dfs_state = NL80211_DFS_USABLE;
  712. c->dfs_state_entered = jiffies;
  713. cfg80211_chandef_create(&chandef, c,
  714. NL80211_CHAN_NO_HT);
  715. nl80211_radar_notify(rdev, &chandef,
  716. radar_event, NULL,
  717. GFP_ATOMIC);
  718. regulatory_propagate_dfs_state(wiphy, &chandef,
  719. c->dfs_state,
  720. radar_event);
  721. continue;
  722. }
  723. if (!check_again)
  724. next_time = timeout - jiffies;
  725. else
  726. next_time = min(next_time, timeout - jiffies);
  727. check_again = true;
  728. }
  729. }
  730. rtnl_unlock();
  731. /* reschedule if there are other channels waiting to be cleared again */
  732. if (check_again)
  733. queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk,
  734. next_time);
  735. }
  736. void cfg80211_radar_event(struct wiphy *wiphy,
  737. struct cfg80211_chan_def *chandef,
  738. gfp_t gfp)
  739. {
  740. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  741. trace_cfg80211_radar_event(wiphy, chandef);
  742. /* only set the chandef supplied channel to unavailable, in
  743. * case the radar is detected on only one of multiple channels
  744. * spanned by the chandef.
  745. */
  746. cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE);
  747. cfg80211_sched_dfs_chan_update(rdev);
  748. nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp);
  749. memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def));
  750. queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
  751. }
  752. EXPORT_SYMBOL(cfg80211_radar_event);
  753. void cfg80211_cac_event(struct net_device *netdev,
  754. const struct cfg80211_chan_def *chandef,
  755. enum nl80211_radar_event event, gfp_t gfp)
  756. {
  757. struct wireless_dev *wdev = netdev->ieee80211_ptr;
  758. struct wiphy *wiphy = wdev->wiphy;
  759. struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
  760. unsigned long timeout;
  761. trace_cfg80211_cac_event(netdev, event);
  762. if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED))
  763. return;
  764. if (WARN_ON(!wdev->chandef.chan))
  765. return;
  766. switch (event) {
  767. case NL80211_RADAR_CAC_FINISHED:
  768. timeout = wdev->cac_start_time +
  769. msecs_to_jiffies(wdev->cac_time_ms);
  770. WARN_ON(!time_after_eq(jiffies, timeout));
  771. cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE);
  772. memcpy(&rdev->cac_done_chandef, chandef,
  773. sizeof(struct cfg80211_chan_def));
  774. queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk);
  775. cfg80211_sched_dfs_chan_update(rdev);
  776. fallthrough;
  777. case NL80211_RADAR_CAC_ABORTED:
  778. wdev->cac_started = false;
  779. break;
  780. case NL80211_RADAR_CAC_STARTED:
  781. wdev->cac_started = true;
  782. break;
  783. default:
  784. WARN_ON(1);
  785. return;
  786. }
  787. nl80211_radar_notify(rdev, chandef, event, netdev, gfp);
  788. }
  789. EXPORT_SYMBOL(cfg80211_cac_event);