1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * cfg80211 MLME SAP interface 4 * 5 * Copyright (c) 2009, Jouni Malinen <j@w1.fi> 6 * Copyright (c) 2015 Intel Deutschland GmbH 7 * Copyright (C) 2019 Intel Corporation 8 */ 9 10 #include <linux/kernel.h> 11 #include <linux/module.h> 12 #include <linux/etherdevice.h> 13 #include <linux/netdevice.h> 14 #include <linux/nl80211.h> 15 #include <linux/slab.h> 16 #include <linux/wireless.h> 17 #include <net/cfg80211.h> 18 #include <net/iw_handler.h> 19 #include "core.h" 20 #include "nl80211.h" 21 #include "rdev-ops.h" 22 23 24 void cfg80211_rx_assoc_resp(struct net_device *dev, struct cfg80211_bss *bss, 25 const u8 *buf, size_t len, int uapsd_queues, 26 const u8 *req_ies, size_t req_ies_len) 27 { 28 struct wireless_dev *wdev = dev->ieee80211_ptr; 29 struct wiphy *wiphy = wdev->wiphy; 30 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 31 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 32 struct cfg80211_connect_resp_params cr; 33 34 memset(&cr, 0, sizeof(cr)); 35 cr.status = (int)le16_to_cpu(mgmt->u.assoc_resp.status_code); 36 cr.bssid = mgmt->bssid; 37 cr.bss = bss; 38 cr.req_ie = req_ies; 39 cr.req_ie_len = req_ies_len; 40 cr.resp_ie = mgmt->u.assoc_resp.variable; 41 cr.resp_ie_len = 42 len - offsetof(struct ieee80211_mgmt, u.assoc_resp.variable); 43 cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED; 44 45 trace_cfg80211_send_rx_assoc(dev, bss); 46 47 /* 48 * This is a bit of a hack, we don't notify userspace of 49 * a (re-)association reply if we tried to send a reassoc 50 * and got a reject -- we only try again with an assoc 51 * frame instead of reassoc. 52 */ 53 if (cfg80211_sme_rx_assoc_resp(wdev, cr.status)) { 54 cfg80211_unhold_bss(bss_from_pub(bss)); 55 cfg80211_put_bss(wiphy, bss); 56 return; 57 } 58 59 nl80211_send_rx_assoc(rdev, dev, buf, len, GFP_KERNEL, uapsd_queues, 60 req_ies, req_ies_len); 61 /* update current_bss etc., consumes the bss reference */ 62 __cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS); 63 } 64 EXPORT_SYMBOL(cfg80211_rx_assoc_resp); 65 66 static void cfg80211_process_auth(struct wireless_dev *wdev, 67 const u8 *buf, size_t len) 68 { 69 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 70 71 nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL); 72 cfg80211_sme_rx_auth(wdev, buf, len); 73 } 74 75 static void cfg80211_process_deauth(struct wireless_dev *wdev, 76 const u8 *buf, size_t len) 77 { 78 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 79 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 80 const u8 *bssid = mgmt->bssid; 81 u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code); 82 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 83 84 nl80211_send_deauth(rdev, wdev->netdev, buf, len, GFP_KERNEL); 85 86 if (!wdev->current_bss || 87 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) 88 return; 89 90 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 91 cfg80211_sme_deauth(wdev); 92 } 93 94 static void cfg80211_process_disassoc(struct wireless_dev *wdev, 95 const u8 *buf, size_t len) 96 { 97 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 98 struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf; 99 const u8 *bssid = mgmt->bssid; 100 u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code); 101 bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 102 103 nl80211_send_disassoc(rdev, wdev->netdev, buf, len, GFP_KERNEL); 104 105 if (WARN_ON(!wdev->current_bss || 106 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 107 return; 108 109 __cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap); 110 cfg80211_sme_disassoc(wdev); 111 } 112 113 void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) 114 { 115 struct wireless_dev *wdev = dev->ieee80211_ptr; 116 struct ieee80211_mgmt *mgmt = (void *)buf; 117 118 ASSERT_WDEV_LOCK(wdev); 119 120 trace_cfg80211_rx_mlme_mgmt(dev, buf, len); 121 122 if (WARN_ON(len < 2)) 123 return; 124 125 if (ieee80211_is_auth(mgmt->frame_control)) 126 cfg80211_process_auth(wdev, buf, len); 127 else if (ieee80211_is_deauth(mgmt->frame_control)) 128 cfg80211_process_deauth(wdev, buf, len); 129 else if (ieee80211_is_disassoc(mgmt->frame_control)) 130 cfg80211_process_disassoc(wdev, buf, len); 131 } 132 EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt); 133 134 void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr) 135 { 136 struct wireless_dev *wdev = dev->ieee80211_ptr; 137 struct wiphy *wiphy = wdev->wiphy; 138 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 139 140 trace_cfg80211_send_auth_timeout(dev, addr); 141 142 nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL); 143 cfg80211_sme_auth_timeout(wdev); 144 } 145 EXPORT_SYMBOL(cfg80211_auth_timeout); 146 147 void cfg80211_assoc_timeout(struct net_device *dev, struct cfg80211_bss *bss) 148 { 149 struct wireless_dev *wdev = dev->ieee80211_ptr; 150 struct wiphy *wiphy = wdev->wiphy; 151 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 152 153 trace_cfg80211_send_assoc_timeout(dev, bss->bssid); 154 155 nl80211_send_assoc_timeout(rdev, dev, bss->bssid, GFP_KERNEL); 156 cfg80211_sme_assoc_timeout(wdev); 157 158 cfg80211_unhold_bss(bss_from_pub(bss)); 159 cfg80211_put_bss(wiphy, bss); 160 } 161 EXPORT_SYMBOL(cfg80211_assoc_timeout); 162 163 void cfg80211_abandon_assoc(struct net_device *dev, struct cfg80211_bss *bss) 164 { 165 struct wireless_dev *wdev = dev->ieee80211_ptr; 166 struct wiphy *wiphy = wdev->wiphy; 167 168 cfg80211_sme_abandon_assoc(wdev); 169 170 cfg80211_unhold_bss(bss_from_pub(bss)); 171 cfg80211_put_bss(wiphy, bss); 172 } 173 EXPORT_SYMBOL(cfg80211_abandon_assoc); 174 175 void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len) 176 { 177 struct wireless_dev *wdev = dev->ieee80211_ptr; 178 struct ieee80211_mgmt *mgmt = (void *)buf; 179 180 ASSERT_WDEV_LOCK(wdev); 181 182 trace_cfg80211_tx_mlme_mgmt(dev, buf, len); 183 184 if (WARN_ON(len < 2)) 185 return; 186 187 if (ieee80211_is_deauth(mgmt->frame_control)) 188 cfg80211_process_deauth(wdev, buf, len); 189 else 190 cfg80211_process_disassoc(wdev, buf, len); 191 } 192 EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt); 193 194 void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr, 195 enum nl80211_key_type key_type, int key_id, 196 const u8 *tsc, gfp_t gfp) 197 { 198 struct wiphy *wiphy = dev->ieee80211_ptr->wiphy; 199 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 200 #ifdef CONFIG_CFG80211_WEXT 201 union iwreq_data wrqu; 202 char *buf = kmalloc(128, gfp); 203 204 if (buf) { 205 sprintf(buf, "MLME-MICHAELMICFAILURE.indication(" 206 "keyid=%d %scast addr=%pM)", key_id, 207 key_type == NL80211_KEYTYPE_GROUP ? "broad" : "uni", 208 addr); 209 memset(&wrqu, 0, sizeof(wrqu)); 210 wrqu.data.length = strlen(buf); 211 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf); 212 kfree(buf); 213 } 214 #endif 215 216 trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc); 217 nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp); 218 } 219 EXPORT_SYMBOL(cfg80211_michael_mic_failure); 220 221 /* some MLME handling for userspace SME */ 222 int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev, 223 struct net_device *dev, 224 struct ieee80211_channel *chan, 225 enum nl80211_auth_type auth_type, 226 const u8 *bssid, 227 const u8 *ssid, int ssid_len, 228 const u8 *ie, int ie_len, 229 const u8 *key, int key_len, int key_idx, 230 const u8 *auth_data, int auth_data_len) 231 { 232 struct wireless_dev *wdev = dev->ieee80211_ptr; 233 struct cfg80211_auth_request req = { 234 .ie = ie, 235 .ie_len = ie_len, 236 .auth_data = auth_data, 237 .auth_data_len = auth_data_len, 238 .auth_type = auth_type, 239 .key = key, 240 .key_len = key_len, 241 .key_idx = key_idx, 242 }; 243 int err; 244 245 ASSERT_WDEV_LOCK(wdev); 246 247 if (auth_type == NL80211_AUTHTYPE_SHARED_KEY) 248 if (!key || !key_len || key_idx < 0 || key_idx > 3) 249 return -EINVAL; 250 251 if (wdev->current_bss && 252 ether_addr_equal(bssid, wdev->current_bss->pub.bssid)) 253 return -EALREADY; 254 255 req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 256 IEEE80211_BSS_TYPE_ESS, 257 IEEE80211_PRIVACY_ANY); 258 if (!req.bss) 259 return -ENOENT; 260 261 err = rdev_auth(rdev, dev, &req); 262 263 cfg80211_put_bss(&rdev->wiphy, req.bss); 264 return err; 265 } 266 267 /* Do a logical ht_capa &= ht_capa_mask. */ 268 void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa, 269 const struct ieee80211_ht_cap *ht_capa_mask) 270 { 271 int i; 272 u8 *p1, *p2; 273 if (!ht_capa_mask) { 274 memset(ht_capa, 0, sizeof(*ht_capa)); 275 return; 276 } 277 278 p1 = (u8*)(ht_capa); 279 p2 = (u8*)(ht_capa_mask); 280 for (i = 0; i < sizeof(*ht_capa); i++) 281 p1[i] &= p2[i]; 282 } 283 284 /* Do a logical vht_capa &= vht_capa_mask. */ 285 void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa, 286 const struct ieee80211_vht_cap *vht_capa_mask) 287 { 288 int i; 289 u8 *p1, *p2; 290 if (!vht_capa_mask) { 291 memset(vht_capa, 0, sizeof(*vht_capa)); 292 return; 293 } 294 295 p1 = (u8*)(vht_capa); 296 p2 = (u8*)(vht_capa_mask); 297 for (i = 0; i < sizeof(*vht_capa); i++) 298 p1[i] &= p2[i]; 299 } 300 301 int cfg80211_mlme_assoc(struct cfg80211_registered_device *rdev, 302 struct net_device *dev, 303 struct ieee80211_channel *chan, 304 const u8 *bssid, 305 const u8 *ssid, int ssid_len, 306 struct cfg80211_assoc_request *req) 307 { 308 struct wireless_dev *wdev = dev->ieee80211_ptr; 309 int err; 310 311 ASSERT_WDEV_LOCK(wdev); 312 313 if (wdev->current_bss && 314 (!req->prev_bssid || !ether_addr_equal(wdev->current_bss->pub.bssid, 315 req->prev_bssid))) 316 return -EALREADY; 317 318 cfg80211_oper_and_ht_capa(&req->ht_capa_mask, 319 rdev->wiphy.ht_capa_mod_mask); 320 cfg80211_oper_and_vht_capa(&req->vht_capa_mask, 321 rdev->wiphy.vht_capa_mod_mask); 322 323 req->bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len, 324 IEEE80211_BSS_TYPE_ESS, 325 IEEE80211_PRIVACY_ANY); 326 if (!req->bss) 327 return -ENOENT; 328 329 err = rdev_assoc(rdev, dev, req); 330 if (!err) 331 cfg80211_hold_bss(bss_from_pub(req->bss)); 332 else 333 cfg80211_put_bss(&rdev->wiphy, req->bss); 334 335 return err; 336 } 337 338 int cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev, 339 struct net_device *dev, const u8 *bssid, 340 const u8 *ie, int ie_len, u16 reason, 341 bool local_state_change) 342 { 343 struct wireless_dev *wdev = dev->ieee80211_ptr; 344 struct cfg80211_deauth_request req = { 345 .bssid = bssid, 346 .reason_code = reason, 347 .ie = ie, 348 .ie_len = ie_len, 349 .local_state_change = local_state_change, 350 }; 351 352 ASSERT_WDEV_LOCK(wdev); 353 354 if (local_state_change && 355 (!wdev->current_bss || 356 !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 357 return 0; 358 359 if (ether_addr_equal(wdev->disconnect_bssid, bssid) || 360 (wdev->current_bss && 361 ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) 362 wdev->conn_owner_nlportid = 0; 363 364 return rdev_deauth(rdev, dev, &req); 365 } 366 367 int cfg80211_mlme_disassoc(struct cfg80211_registered_device *rdev, 368 struct net_device *dev, const u8 *bssid, 369 const u8 *ie, int ie_len, u16 reason, 370 bool local_state_change) 371 { 372 struct wireless_dev *wdev = dev->ieee80211_ptr; 373 struct cfg80211_disassoc_request req = { 374 .reason_code = reason, 375 .local_state_change = local_state_change, 376 .ie = ie, 377 .ie_len = ie_len, 378 }; 379 int err; 380 381 ASSERT_WDEV_LOCK(wdev); 382 383 if (!wdev->current_bss) 384 return -ENOTCONN; 385 386 if (ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) 387 req.bss = &wdev->current_bss->pub; 388 else 389 return -ENOTCONN; 390 391 err = rdev_disassoc(rdev, dev, &req); 392 if (err) 393 return err; 394 395 /* driver should have reported the disassoc */ 396 WARN_ON(wdev->current_bss); 397 return 0; 398 } 399 400 void cfg80211_mlme_down(struct cfg80211_registered_device *rdev, 401 struct net_device *dev) 402 { 403 struct wireless_dev *wdev = dev->ieee80211_ptr; 404 u8 bssid[ETH_ALEN]; 405 406 ASSERT_WDEV_LOCK(wdev); 407 408 if (!rdev->ops->deauth) 409 return; 410 411 if (!wdev->current_bss) 412 return; 413 414 memcpy(bssid, wdev->current_bss->pub.bssid, ETH_ALEN); 415 cfg80211_mlme_deauth(rdev, dev, bssid, NULL, 0, 416 WLAN_REASON_DEAUTH_LEAVING, false); 417 } 418 419 struct cfg80211_mgmt_registration { 420 struct list_head list; 421 struct wireless_dev *wdev; 422 423 u32 nlportid; 424 425 int match_len; 426 427 __le16 frame_type; 428 429 bool multicast_rx; 430 431 u8 match[]; 432 }; 433 434 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev) 435 { 436 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 437 struct wireless_dev *tmp; 438 struct cfg80211_mgmt_registration *reg; 439 struct mgmt_frame_regs upd = {}; 440 441 ASSERT_RTNL(); 442 443 rcu_read_lock(); 444 list_for_each_entry_rcu(tmp, &rdev->wiphy.wdev_list, list) { 445 list_for_each_entry_rcu(reg, &tmp->mgmt_registrations, list) { 446 u32 mask = BIT(le16_to_cpu(reg->frame_type) >> 4); 447 u32 mcast_mask = 0; 448 449 if (reg->multicast_rx) 450 mcast_mask = mask; 451 452 upd.global_stypes |= mask; 453 upd.global_mcast_stypes |= mcast_mask; 454 455 if (tmp == wdev) { 456 upd.interface_stypes |= mask; 457 upd.interface_mcast_stypes |= mcast_mask; 458 } 459 } 460 } 461 rcu_read_unlock(); 462 463 rdev_update_mgmt_frame_registrations(rdev, wdev, &upd); 464 } 465 466 void cfg80211_mgmt_registrations_update_wk(struct work_struct *wk) 467 { 468 struct wireless_dev *wdev = container_of(wk, struct wireless_dev, 469 mgmt_registrations_update_wk); 470 471 rtnl_lock(); 472 cfg80211_mgmt_registrations_update(wdev); 473 rtnl_unlock(); 474 } 475 476 int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid, 477 u16 frame_type, const u8 *match_data, 478 int match_len, bool multicast_rx, 479 struct netlink_ext_ack *extack) 480 { 481 struct cfg80211_mgmt_registration *reg, *nreg; 482 int err = 0; 483 u16 mgmt_type; 484 bool update_multicast = false; 485 486 if (!wdev->wiphy->mgmt_stypes) 487 return -EOPNOTSUPP; 488 489 if ((frame_type & IEEE80211_FCTL_FTYPE) != IEEE80211_FTYPE_MGMT) { 490 NL_SET_ERR_MSG(extack, "frame type not management"); 491 return -EINVAL; 492 } 493 494 if (frame_type & ~(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE)) { 495 NL_SET_ERR_MSG(extack, "Invalid frame type"); 496 return -EINVAL; 497 } 498 499 mgmt_type = (frame_type & IEEE80211_FCTL_STYPE) >> 4; 500 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].rx & BIT(mgmt_type))) { 501 NL_SET_ERR_MSG(extack, 502 "Registration to specific type not supported"); 503 return -EINVAL; 504 } 505 506 /* 507 * To support Pre Association Security Negotiation (PASN), registration 508 * for authentication frames should be supported. However, as some 509 * versions of the user space daemons wrongly register to all types of 510 * authentication frames (which might result in unexpected behavior) 511 * allow such registration if the request is for a specific 512 * authentication algorithm number. 513 */ 514 if (wdev->iftype == NL80211_IFTYPE_STATION && 515 (frame_type & IEEE80211_FCTL_STYPE) == IEEE80211_STYPE_AUTH && 516 !(match_data && match_len >= 2)) { 517 NL_SET_ERR_MSG(extack, 518 "Authentication algorithm number required"); 519 return -EINVAL; 520 } 521 522 nreg = kzalloc(sizeof(*reg) + match_len, GFP_KERNEL); 523 if (!nreg) 524 return -ENOMEM; 525 526 spin_lock_bh(&wdev->mgmt_registrations_lock); 527 528 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 529 int mlen = min(match_len, reg->match_len); 530 531 if (frame_type != le16_to_cpu(reg->frame_type)) 532 continue; 533 534 if (memcmp(reg->match, match_data, mlen) == 0) { 535 if (reg->multicast_rx != multicast_rx) { 536 update_multicast = true; 537 reg->multicast_rx = multicast_rx; 538 break; 539 } 540 NL_SET_ERR_MSG(extack, "Match already configured"); 541 err = -EALREADY; 542 break; 543 } 544 } 545 546 if (err) 547 goto out; 548 549 if (update_multicast) { 550 kfree(nreg); 551 } else { 552 memcpy(nreg->match, match_data, match_len); 553 nreg->match_len = match_len; 554 nreg->nlportid = snd_portid; 555 nreg->frame_type = cpu_to_le16(frame_type); 556 nreg->wdev = wdev; 557 nreg->multicast_rx = multicast_rx; 558 list_add(&nreg->list, &wdev->mgmt_registrations); 559 } 560 spin_unlock_bh(&wdev->mgmt_registrations_lock); 561 562 cfg80211_mgmt_registrations_update(wdev); 563 564 return 0; 565 566 out: 567 kfree(nreg); 568 spin_unlock_bh(&wdev->mgmt_registrations_lock); 569 570 return err; 571 } 572 573 void cfg80211_mlme_unregister_socket(struct wireless_dev *wdev, u32 nlportid) 574 { 575 struct wiphy *wiphy = wdev->wiphy; 576 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 577 struct cfg80211_mgmt_registration *reg, *tmp; 578 579 spin_lock_bh(&wdev->mgmt_registrations_lock); 580 581 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 582 if (reg->nlportid != nlportid) 583 continue; 584 585 list_del(®->list); 586 kfree(reg); 587 588 schedule_work(&wdev->mgmt_registrations_update_wk); 589 } 590 591 spin_unlock_bh(&wdev->mgmt_registrations_lock); 592 593 if (nlportid && rdev->crit_proto_nlportid == nlportid) { 594 rdev->crit_proto_nlportid = 0; 595 rdev_crit_proto_stop(rdev, wdev); 596 } 597 598 if (nlportid == wdev->ap_unexpected_nlportid) 599 wdev->ap_unexpected_nlportid = 0; 600 } 601 602 void cfg80211_mlme_purge_registrations(struct wireless_dev *wdev) 603 { 604 struct cfg80211_mgmt_registration *reg, *tmp; 605 606 spin_lock_bh(&wdev->mgmt_registrations_lock); 607 list_for_each_entry_safe(reg, tmp, &wdev->mgmt_registrations, list) { 608 list_del(®->list); 609 kfree(reg); 610 } 611 spin_unlock_bh(&wdev->mgmt_registrations_lock); 612 613 cfg80211_mgmt_registrations_update(wdev); 614 } 615 616 int cfg80211_mlme_mgmt_tx(struct cfg80211_registered_device *rdev, 617 struct wireless_dev *wdev, 618 struct cfg80211_mgmt_tx_params *params, u64 *cookie) 619 { 620 const struct ieee80211_mgmt *mgmt; 621 u16 stype; 622 623 if (!wdev->wiphy->mgmt_stypes) 624 return -EOPNOTSUPP; 625 626 if (!rdev->ops->mgmt_tx) 627 return -EOPNOTSUPP; 628 629 if (params->len < 24 + 1) 630 return -EINVAL; 631 632 mgmt = (const struct ieee80211_mgmt *)params->buf; 633 634 if (!ieee80211_is_mgmt(mgmt->frame_control)) 635 return -EINVAL; 636 637 stype = le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE; 638 if (!(wdev->wiphy->mgmt_stypes[wdev->iftype].tx & BIT(stype >> 4))) 639 return -EINVAL; 640 641 if (ieee80211_is_action(mgmt->frame_control) && 642 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) { 643 int err = 0; 644 645 wdev_lock(wdev); 646 647 switch (wdev->iftype) { 648 case NL80211_IFTYPE_ADHOC: 649 case NL80211_IFTYPE_STATION: 650 case NL80211_IFTYPE_P2P_CLIENT: 651 if (!wdev->current_bss) { 652 err = -ENOTCONN; 653 break; 654 } 655 656 if (!ether_addr_equal(wdev->current_bss->pub.bssid, 657 mgmt->bssid)) { 658 err = -ENOTCONN; 659 break; 660 } 661 662 /* 663 * check for IBSS DA must be done by driver as 664 * cfg80211 doesn't track the stations 665 */ 666 if (wdev->iftype == NL80211_IFTYPE_ADHOC) 667 break; 668 669 /* for station, check that DA is the AP */ 670 if (!ether_addr_equal(wdev->current_bss->pub.bssid, 671 mgmt->da)) { 672 err = -ENOTCONN; 673 break; 674 } 675 break; 676 case NL80211_IFTYPE_AP: 677 case NL80211_IFTYPE_P2P_GO: 678 case NL80211_IFTYPE_AP_VLAN: 679 if (!ether_addr_equal(mgmt->bssid, wdev_address(wdev))) 680 err = -EINVAL; 681 break; 682 case NL80211_IFTYPE_MESH_POINT: 683 if (!ether_addr_equal(mgmt->sa, mgmt->bssid)) { 684 err = -EINVAL; 685 break; 686 } 687 /* 688 * check for mesh DA must be done by driver as 689 * cfg80211 doesn't track the stations 690 */ 691 break; 692 case NL80211_IFTYPE_P2P_DEVICE: 693 /* 694 * fall through, P2P device only supports 695 * public action frames 696 */ 697 case NL80211_IFTYPE_NAN: 698 default: 699 err = -EOPNOTSUPP; 700 break; 701 } 702 wdev_unlock(wdev); 703 704 if (err) 705 return err; 706 } 707 708 if (!ether_addr_equal(mgmt->sa, wdev_address(wdev))) { 709 /* Allow random TA to be used with Public Action frames if the 710 * driver has indicated support for this. Otherwise, only allow 711 * the local address to be used. 712 */ 713 if (!ieee80211_is_action(mgmt->frame_control) || 714 mgmt->u.action.category != WLAN_CATEGORY_PUBLIC) 715 return -EINVAL; 716 if (!wdev->current_bss && 717 !wiphy_ext_feature_isset( 718 &rdev->wiphy, 719 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA)) 720 return -EINVAL; 721 if (wdev->current_bss && 722 !wiphy_ext_feature_isset( 723 &rdev->wiphy, 724 NL80211_EXT_FEATURE_MGMT_TX_RANDOM_TA_CONNECTED)) 725 return -EINVAL; 726 } 727 728 /* Transmit the Action frame as requested by user space */ 729 return rdev_mgmt_tx(rdev, wdev, params, cookie); 730 } 731 732 bool cfg80211_rx_mgmt_khz(struct wireless_dev *wdev, int freq, int sig_dbm, 733 const u8 *buf, size_t len, u32 flags) 734 { 735 struct wiphy *wiphy = wdev->wiphy; 736 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 737 struct cfg80211_mgmt_registration *reg; 738 const struct ieee80211_txrx_stypes *stypes = 739 &wiphy->mgmt_stypes[wdev->iftype]; 740 struct ieee80211_mgmt *mgmt = (void *)buf; 741 const u8 *data; 742 int data_len; 743 bool result = false; 744 __le16 ftype = mgmt->frame_control & 745 cpu_to_le16(IEEE80211_FCTL_FTYPE | IEEE80211_FCTL_STYPE); 746 u16 stype; 747 748 trace_cfg80211_rx_mgmt(wdev, freq, sig_dbm); 749 stype = (le16_to_cpu(mgmt->frame_control) & IEEE80211_FCTL_STYPE) >> 4; 750 751 if (!(stypes->rx & BIT(stype))) { 752 trace_cfg80211_return_bool(false); 753 return false; 754 } 755 756 data = buf + ieee80211_hdrlen(mgmt->frame_control); 757 data_len = len - ieee80211_hdrlen(mgmt->frame_control); 758 759 spin_lock_bh(&wdev->mgmt_registrations_lock); 760 761 list_for_each_entry(reg, &wdev->mgmt_registrations, list) { 762 if (reg->frame_type != ftype) 763 continue; 764 765 if (reg->match_len > data_len) 766 continue; 767 768 if (memcmp(reg->match, data, reg->match_len)) 769 continue; 770 771 /* found match! */ 772 773 /* Indicate the received Action frame to user space */ 774 if (nl80211_send_mgmt(rdev, wdev, reg->nlportid, 775 freq, sig_dbm, 776 buf, len, flags, GFP_ATOMIC)) 777 continue; 778 779 result = true; 780 break; 781 } 782 783 spin_unlock_bh(&wdev->mgmt_registrations_lock); 784 785 trace_cfg80211_return_bool(result); 786 return result; 787 } 788 EXPORT_SYMBOL(cfg80211_rx_mgmt_khz); 789 790 void cfg80211_sched_dfs_chan_update(struct cfg80211_registered_device *rdev) 791 { 792 cancel_delayed_work(&rdev->dfs_update_channels_wk); 793 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 0); 794 } 795 796 void cfg80211_dfs_channels_update_work(struct work_struct *work) 797 { 798 struct delayed_work *delayed_work = to_delayed_work(work); 799 struct cfg80211_registered_device *rdev; 800 struct cfg80211_chan_def chandef; 801 struct ieee80211_supported_band *sband; 802 struct ieee80211_channel *c; 803 struct wiphy *wiphy; 804 bool check_again = false; 805 unsigned long timeout, next_time = 0; 806 unsigned long time_dfs_update; 807 enum nl80211_radar_event radar_event; 808 int bandid, i; 809 810 rdev = container_of(delayed_work, struct cfg80211_registered_device, 811 dfs_update_channels_wk); 812 wiphy = &rdev->wiphy; 813 814 rtnl_lock(); 815 for (bandid = 0; bandid < NUM_NL80211_BANDS; bandid++) { 816 sband = wiphy->bands[bandid]; 817 if (!sband) 818 continue; 819 820 for (i = 0; i < sband->n_channels; i++) { 821 c = &sband->channels[i]; 822 823 if (!(c->flags & IEEE80211_CHAN_RADAR)) 824 continue; 825 826 if (c->dfs_state != NL80211_DFS_UNAVAILABLE && 827 c->dfs_state != NL80211_DFS_AVAILABLE) 828 continue; 829 830 if (c->dfs_state == NL80211_DFS_UNAVAILABLE) { 831 time_dfs_update = IEEE80211_DFS_MIN_NOP_TIME_MS; 832 radar_event = NL80211_RADAR_NOP_FINISHED; 833 } else { 834 if (regulatory_pre_cac_allowed(wiphy) || 835 cfg80211_any_wiphy_oper_chan(wiphy, c)) 836 continue; 837 838 time_dfs_update = REG_PRE_CAC_EXPIRY_GRACE_MS; 839 radar_event = NL80211_RADAR_PRE_CAC_EXPIRED; 840 } 841 842 timeout = c->dfs_state_entered + 843 msecs_to_jiffies(time_dfs_update); 844 845 if (time_after_eq(jiffies, timeout)) { 846 c->dfs_state = NL80211_DFS_USABLE; 847 c->dfs_state_entered = jiffies; 848 849 cfg80211_chandef_create(&chandef, c, 850 NL80211_CHAN_NO_HT); 851 852 nl80211_radar_notify(rdev, &chandef, 853 radar_event, NULL, 854 GFP_ATOMIC); 855 856 regulatory_propagate_dfs_state(wiphy, &chandef, 857 c->dfs_state, 858 radar_event); 859 continue; 860 } 861 862 if (!check_again) 863 next_time = timeout - jiffies; 864 else 865 next_time = min(next_time, timeout - jiffies); 866 check_again = true; 867 } 868 } 869 rtnl_unlock(); 870 871 /* reschedule if there are other channels waiting to be cleared again */ 872 if (check_again) 873 queue_delayed_work(cfg80211_wq, &rdev->dfs_update_channels_wk, 874 next_time); 875 } 876 877 878 void cfg80211_radar_event(struct wiphy *wiphy, 879 struct cfg80211_chan_def *chandef, 880 gfp_t gfp) 881 { 882 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 883 884 trace_cfg80211_radar_event(wiphy, chandef); 885 886 /* only set the chandef supplied channel to unavailable, in 887 * case the radar is detected on only one of multiple channels 888 * spanned by the chandef. 889 */ 890 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_UNAVAILABLE); 891 892 cfg80211_sched_dfs_chan_update(rdev); 893 894 nl80211_radar_notify(rdev, chandef, NL80211_RADAR_DETECTED, NULL, gfp); 895 896 memcpy(&rdev->radar_chandef, chandef, sizeof(struct cfg80211_chan_def)); 897 queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk); 898 } 899 EXPORT_SYMBOL(cfg80211_radar_event); 900 901 void cfg80211_cac_event(struct net_device *netdev, 902 const struct cfg80211_chan_def *chandef, 903 enum nl80211_radar_event event, gfp_t gfp) 904 { 905 struct wireless_dev *wdev = netdev->ieee80211_ptr; 906 struct wiphy *wiphy = wdev->wiphy; 907 struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 908 unsigned long timeout; 909 910 trace_cfg80211_cac_event(netdev, event); 911 912 if (WARN_ON(!wdev->cac_started && event != NL80211_RADAR_CAC_STARTED)) 913 return; 914 915 if (WARN_ON(!wdev->chandef.chan)) 916 return; 917 918 switch (event) { 919 case NL80211_RADAR_CAC_FINISHED: 920 timeout = wdev->cac_start_time + 921 msecs_to_jiffies(wdev->cac_time_ms); 922 WARN_ON(!time_after_eq(jiffies, timeout)); 923 cfg80211_set_dfs_state(wiphy, chandef, NL80211_DFS_AVAILABLE); 924 memcpy(&rdev->cac_done_chandef, chandef, 925 sizeof(struct cfg80211_chan_def)); 926 queue_work(cfg80211_wq, &rdev->propagate_cac_done_wk); 927 cfg80211_sched_dfs_chan_update(rdev); 928 /* fall through */ 929 case NL80211_RADAR_CAC_ABORTED: 930 wdev->cac_started = false; 931 break; 932 case NL80211_RADAR_CAC_STARTED: 933 wdev->cac_started = true; 934 break; 935 default: 936 WARN_ON(1); 937 return; 938 } 939 940 nl80211_radar_notify(rdev, chandef, event, netdev, gfp); 941 } 942 EXPORT_SYMBOL(cfg80211_cac_event); 943