1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  * SME code for cfg80211
4  * both driver SME event handling and the SME implementation
5  * (for nl80211's connect() and wext)
6  *
7  * Copyright 2009	Johannes Berg <johannes@sipsolutions.net>
8  * Copyright (C) 2009, 2020, 2022 Intel Corporation. All rights reserved.
9  * Copyright 2017	Intel Deutschland GmbH
10  */
11 
12 #include <linux/etherdevice.h>
13 #include <linux/if_arp.h>
14 #include <linux/slab.h>
15 #include <linux/workqueue.h>
16 #include <linux/wireless.h>
17 #include <linux/export.h>
18 #include <net/iw_handler.h>
19 #include <net/cfg80211.h>
20 #include <net/rtnetlink.h>
21 #include "nl80211.h"
22 #include "reg.h"
23 #include "rdev-ops.h"
24 
25 /*
26  * Software SME in cfg80211, using auth/assoc/deauth calls to the
27  * driver. This is for implementing nl80211's connect/disconnect
28  * and wireless extensions (if configured.)
29  */
30 
31 struct cfg80211_conn {
32 	struct cfg80211_connect_params params;
33 	/* these are sub-states of the _CONNECTING sme_state */
34 	enum {
35 		CFG80211_CONN_SCANNING,
36 		CFG80211_CONN_SCAN_AGAIN,
37 		CFG80211_CONN_AUTHENTICATE_NEXT,
38 		CFG80211_CONN_AUTHENTICATING,
39 		CFG80211_CONN_AUTH_FAILED_TIMEOUT,
40 		CFG80211_CONN_ASSOCIATE_NEXT,
41 		CFG80211_CONN_ASSOCIATING,
42 		CFG80211_CONN_ASSOC_FAILED,
43 		CFG80211_CONN_ASSOC_FAILED_TIMEOUT,
44 		CFG80211_CONN_DEAUTH,
45 		CFG80211_CONN_ABANDON,
46 		CFG80211_CONN_CONNECTED,
47 	} state;
48 	u8 bssid[ETH_ALEN], prev_bssid[ETH_ALEN];
49 	const u8 *ie;
50 	size_t ie_len;
51 	bool auto_auth, prev_bssid_valid;
52 };
53 
cfg80211_sme_free(struct wireless_dev * wdev)54 static void cfg80211_sme_free(struct wireless_dev *wdev)
55 {
56 	if (!wdev->conn)
57 		return;
58 
59 	kfree(wdev->conn->ie);
60 	kfree(wdev->conn);
61 	wdev->conn = NULL;
62 }
63 
cfg80211_conn_scan(struct wireless_dev * wdev)64 static int cfg80211_conn_scan(struct wireless_dev *wdev)
65 {
66 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
67 	struct cfg80211_scan_request *request;
68 	int n_channels, err;
69 
70 	ASSERT_WDEV_LOCK(wdev);
71 
72 	if (rdev->scan_req || rdev->scan_msg)
73 		return -EBUSY;
74 
75 	if (wdev->conn->params.channel)
76 		n_channels = 1;
77 	else
78 		n_channels = ieee80211_get_num_supported_channels(wdev->wiphy);
79 
80 	request = kzalloc(sizeof(*request) + sizeof(request->ssids[0]) +
81 			  sizeof(request->channels[0]) * n_channels,
82 			  GFP_KERNEL);
83 	if (!request)
84 		return -ENOMEM;
85 
86 	if (wdev->conn->params.channel) {
87 		enum nl80211_band band = wdev->conn->params.channel->band;
88 		struct ieee80211_supported_band *sband =
89 			wdev->wiphy->bands[band];
90 
91 		if (!sband) {
92 			kfree(request);
93 			return -EINVAL;
94 		}
95 		request->channels[0] = wdev->conn->params.channel;
96 		request->rates[band] = (1 << sband->n_bitrates) - 1;
97 	} else {
98 		int i = 0, j;
99 		enum nl80211_band band;
100 		struct ieee80211_supported_band *bands;
101 		struct ieee80211_channel *channel;
102 
103 		for (band = 0; band < NUM_NL80211_BANDS; band++) {
104 			bands = wdev->wiphy->bands[band];
105 			if (!bands)
106 				continue;
107 			for (j = 0; j < bands->n_channels; j++) {
108 				channel = &bands->channels[j];
109 				if (channel->flags & IEEE80211_CHAN_DISABLED)
110 					continue;
111 				request->channels[i++] = channel;
112 			}
113 			request->rates[band] = (1 << bands->n_bitrates) - 1;
114 		}
115 		n_channels = i;
116 	}
117 	request->n_channels = n_channels;
118 	request->ssids = (void *)&request->channels[n_channels];
119 	request->n_ssids = 1;
120 
121 	memcpy(request->ssids[0].ssid, wdev->conn->params.ssid,
122 		wdev->conn->params.ssid_len);
123 	request->ssids[0].ssid_len = wdev->conn->params.ssid_len;
124 
125 	eth_broadcast_addr(request->bssid);
126 
127 	request->wdev = wdev;
128 	request->wiphy = &rdev->wiphy;
129 	request->scan_start = jiffies;
130 
131 	rdev->scan_req = request;
132 
133 	err = rdev_scan(rdev, request);
134 	if (!err) {
135 		wdev->conn->state = CFG80211_CONN_SCANNING;
136 		nl80211_send_scan_start(rdev, wdev);
137 		dev_hold(wdev->netdev);
138 	} else {
139 		rdev->scan_req = NULL;
140 		kfree(request);
141 	}
142 	return err;
143 }
144 
cfg80211_conn_do_work(struct wireless_dev * wdev,enum nl80211_timeout_reason * treason)145 static int cfg80211_conn_do_work(struct wireless_dev *wdev,
146 				 enum nl80211_timeout_reason *treason)
147 {
148 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
149 	struct cfg80211_connect_params *params;
150 	struct cfg80211_auth_request auth_req = {};
151 	struct cfg80211_assoc_request req = {};
152 	int err;
153 
154 	ASSERT_WDEV_LOCK(wdev);
155 
156 	if (!wdev->conn)
157 		return 0;
158 
159 	params = &wdev->conn->params;
160 
161 	switch (wdev->conn->state) {
162 	case CFG80211_CONN_SCANNING:
163 		/* didn't find it during scan ... */
164 		return -ENOENT;
165 	case CFG80211_CONN_SCAN_AGAIN:
166 		return cfg80211_conn_scan(wdev);
167 	case CFG80211_CONN_AUTHENTICATE_NEXT:
168 		if (WARN_ON(!rdev->ops->auth))
169 			return -EOPNOTSUPP;
170 		wdev->conn->state = CFG80211_CONN_AUTHENTICATING;
171 		auth_req.key = params->key;
172 		auth_req.key_len = params->key_len;
173 		auth_req.key_idx = params->key_idx;
174 		auth_req.auth_type = params->auth_type;
175 		auth_req.bss = cfg80211_get_bss(&rdev->wiphy, params->channel,
176 						params->bssid,
177 						params->ssid, params->ssid_len,
178 						IEEE80211_BSS_TYPE_ESS,
179 						IEEE80211_PRIVACY_ANY);
180 		auth_req.link_id = -1;
181 		err = cfg80211_mlme_auth(rdev, wdev->netdev, &auth_req);
182 		cfg80211_put_bss(&rdev->wiphy, auth_req.bss);
183 		return err;
184 	case CFG80211_CONN_AUTH_FAILED_TIMEOUT:
185 		*treason = NL80211_TIMEOUT_AUTH;
186 		return -ENOTCONN;
187 	case CFG80211_CONN_ASSOCIATE_NEXT:
188 		if (WARN_ON(!rdev->ops->assoc))
189 			return -EOPNOTSUPP;
190 		wdev->conn->state = CFG80211_CONN_ASSOCIATING;
191 		if (wdev->conn->prev_bssid_valid)
192 			req.prev_bssid = wdev->conn->prev_bssid;
193 		req.ie = params->ie;
194 		req.ie_len = params->ie_len;
195 		req.use_mfp = params->mfp != NL80211_MFP_NO;
196 		req.crypto = params->crypto;
197 		req.flags = params->flags;
198 		req.ht_capa = params->ht_capa;
199 		req.ht_capa_mask = params->ht_capa_mask;
200 		req.vht_capa = params->vht_capa;
201 		req.vht_capa_mask = params->vht_capa_mask;
202 		req.link_id = -1;
203 
204 		req.bss = cfg80211_get_bss(&rdev->wiphy, params->channel,
205 					   params->bssid,
206 					   params->ssid, params->ssid_len,
207 					   IEEE80211_BSS_TYPE_ESS,
208 					   IEEE80211_PRIVACY_ANY);
209 		if (!req.bss) {
210 			err = -ENOENT;
211 		} else {
212 			err = cfg80211_mlme_assoc(rdev, wdev->netdev, &req);
213 			cfg80211_put_bss(&rdev->wiphy, req.bss);
214 		}
215 
216 		if (err)
217 			cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
218 					     NULL, 0,
219 					     WLAN_REASON_DEAUTH_LEAVING,
220 					     false);
221 		return err;
222 	case CFG80211_CONN_ASSOC_FAILED_TIMEOUT:
223 		*treason = NL80211_TIMEOUT_ASSOC;
224 		fallthrough;
225 	case CFG80211_CONN_ASSOC_FAILED:
226 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
227 				     NULL, 0,
228 				     WLAN_REASON_DEAUTH_LEAVING, false);
229 		return -ENOTCONN;
230 	case CFG80211_CONN_DEAUTH:
231 		cfg80211_mlme_deauth(rdev, wdev->netdev, params->bssid,
232 				     NULL, 0,
233 				     WLAN_REASON_DEAUTH_LEAVING, false);
234 		fallthrough;
235 	case CFG80211_CONN_ABANDON:
236 		/* free directly, disconnected event already sent */
237 		cfg80211_sme_free(wdev);
238 		return 0;
239 	default:
240 		return 0;
241 	}
242 }
243 
cfg80211_conn_work(struct work_struct * work)244 void cfg80211_conn_work(struct work_struct *work)
245 {
246 	struct cfg80211_registered_device *rdev =
247 		container_of(work, struct cfg80211_registered_device, conn_work);
248 	struct wireless_dev *wdev;
249 	u8 bssid_buf[ETH_ALEN], *bssid = NULL;
250 	enum nl80211_timeout_reason treason;
251 
252 	wiphy_lock(&rdev->wiphy);
253 
254 	list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
255 		if (!wdev->netdev)
256 			continue;
257 
258 		wdev_lock(wdev);
259 		if (!netif_running(wdev->netdev)) {
260 			wdev_unlock(wdev);
261 			continue;
262 		}
263 		if (!wdev->conn ||
264 		    wdev->conn->state == CFG80211_CONN_CONNECTED) {
265 			wdev_unlock(wdev);
266 			continue;
267 		}
268 		if (wdev->conn->params.bssid) {
269 			memcpy(bssid_buf, wdev->conn->params.bssid, ETH_ALEN);
270 			bssid = bssid_buf;
271 		}
272 		treason = NL80211_TIMEOUT_UNSPECIFIED;
273 		if (cfg80211_conn_do_work(wdev, &treason)) {
274 			struct cfg80211_connect_resp_params cr;
275 
276 			memset(&cr, 0, sizeof(cr));
277 			cr.status = -1;
278 			cr.links[0].bssid = bssid;
279 			cr.timeout_reason = treason;
280 			__cfg80211_connect_result(wdev->netdev, &cr, false);
281 		}
282 		wdev_unlock(wdev);
283 	}
284 
285 	wiphy_unlock(&rdev->wiphy);
286 }
287 
288 /* Returned bss is reference counted and must be cleaned up appropriately. */
cfg80211_get_conn_bss(struct wireless_dev * wdev)289 static struct cfg80211_bss *cfg80211_get_conn_bss(struct wireless_dev *wdev)
290 {
291 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
292 	struct cfg80211_bss *bss;
293 
294 	ASSERT_WDEV_LOCK(wdev);
295 
296 	bss = cfg80211_get_bss(wdev->wiphy, wdev->conn->params.channel,
297 			       wdev->conn->params.bssid,
298 			       wdev->conn->params.ssid,
299 			       wdev->conn->params.ssid_len,
300 			       wdev->conn_bss_type,
301 			       IEEE80211_PRIVACY(wdev->conn->params.privacy));
302 	if (!bss)
303 		return NULL;
304 
305 	memcpy(wdev->conn->bssid, bss->bssid, ETH_ALEN);
306 	wdev->conn->params.bssid = wdev->conn->bssid;
307 	wdev->conn->params.channel = bss->channel;
308 	wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
309 	schedule_work(&rdev->conn_work);
310 
311 	return bss;
312 }
313 
__cfg80211_sme_scan_done(struct net_device * dev)314 static void __cfg80211_sme_scan_done(struct net_device *dev)
315 {
316 	struct wireless_dev *wdev = dev->ieee80211_ptr;
317 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
318 	struct cfg80211_bss *bss;
319 
320 	ASSERT_WDEV_LOCK(wdev);
321 
322 	if (!wdev->conn)
323 		return;
324 
325 	if (wdev->conn->state != CFG80211_CONN_SCANNING &&
326 	    wdev->conn->state != CFG80211_CONN_SCAN_AGAIN)
327 		return;
328 
329 	bss = cfg80211_get_conn_bss(wdev);
330 	if (bss)
331 		cfg80211_put_bss(&rdev->wiphy, bss);
332 	else
333 		schedule_work(&rdev->conn_work);
334 }
335 
cfg80211_sme_scan_done(struct net_device * dev)336 void cfg80211_sme_scan_done(struct net_device *dev)
337 {
338 	struct wireless_dev *wdev = dev->ieee80211_ptr;
339 
340 	wdev_lock(wdev);
341 	__cfg80211_sme_scan_done(dev);
342 	wdev_unlock(wdev);
343 }
344 
cfg80211_sme_rx_auth(struct wireless_dev * wdev,const u8 * buf,size_t len)345 void cfg80211_sme_rx_auth(struct wireless_dev *wdev, const u8 *buf, size_t len)
346 {
347 	struct wiphy *wiphy = wdev->wiphy;
348 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
349 	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;
350 	u16 status_code = le16_to_cpu(mgmt->u.auth.status_code);
351 
352 	ASSERT_WDEV_LOCK(wdev);
353 
354 	if (!wdev->conn || wdev->conn->state == CFG80211_CONN_CONNECTED)
355 		return;
356 
357 	if (status_code == WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG &&
358 	    wdev->conn->auto_auth &&
359 	    wdev->conn->params.auth_type != NL80211_AUTHTYPE_NETWORK_EAP) {
360 		/* select automatically between only open, shared, leap */
361 		switch (wdev->conn->params.auth_type) {
362 		case NL80211_AUTHTYPE_OPEN_SYSTEM:
363 			if (wdev->connect_keys)
364 				wdev->conn->params.auth_type =
365 					NL80211_AUTHTYPE_SHARED_KEY;
366 			else
367 				wdev->conn->params.auth_type =
368 					NL80211_AUTHTYPE_NETWORK_EAP;
369 			break;
370 		case NL80211_AUTHTYPE_SHARED_KEY:
371 			wdev->conn->params.auth_type =
372 				NL80211_AUTHTYPE_NETWORK_EAP;
373 			break;
374 		default:
375 			/* huh? */
376 			wdev->conn->params.auth_type =
377 				NL80211_AUTHTYPE_OPEN_SYSTEM;
378 			break;
379 		}
380 		wdev->conn->state = CFG80211_CONN_AUTHENTICATE_NEXT;
381 		schedule_work(&rdev->conn_work);
382 	} else if (status_code != WLAN_STATUS_SUCCESS) {
383 		struct cfg80211_connect_resp_params cr;
384 
385 		memset(&cr, 0, sizeof(cr));
386 		cr.status = status_code;
387 		cr.links[0].bssid = mgmt->bssid;
388 		cr.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED;
389 		__cfg80211_connect_result(wdev->netdev, &cr, false);
390 	} else if (wdev->conn->state == CFG80211_CONN_AUTHENTICATING) {
391 		wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
392 		schedule_work(&rdev->conn_work);
393 	}
394 }
395 
cfg80211_sme_rx_assoc_resp(struct wireless_dev * wdev,u16 status)396 bool cfg80211_sme_rx_assoc_resp(struct wireless_dev *wdev, u16 status)
397 {
398 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
399 
400 	if (!wdev->conn)
401 		return false;
402 
403 	if (status == WLAN_STATUS_SUCCESS) {
404 		wdev->conn->state = CFG80211_CONN_CONNECTED;
405 		return false;
406 	}
407 
408 	if (wdev->conn->prev_bssid_valid) {
409 		/*
410 		 * Some stupid APs don't accept reassoc, so we
411 		 * need to fall back to trying regular assoc;
412 		 * return true so no event is sent to userspace.
413 		 */
414 		wdev->conn->prev_bssid_valid = false;
415 		wdev->conn->state = CFG80211_CONN_ASSOCIATE_NEXT;
416 		schedule_work(&rdev->conn_work);
417 		return true;
418 	}
419 
420 	wdev->conn->state = CFG80211_CONN_ASSOC_FAILED;
421 	schedule_work(&rdev->conn_work);
422 	return false;
423 }
424 
cfg80211_sme_deauth(struct wireless_dev * wdev)425 void cfg80211_sme_deauth(struct wireless_dev *wdev)
426 {
427 	cfg80211_sme_free(wdev);
428 }
429 
cfg80211_sme_auth_timeout(struct wireless_dev * wdev)430 void cfg80211_sme_auth_timeout(struct wireless_dev *wdev)
431 {
432 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
433 
434 	if (!wdev->conn)
435 		return;
436 
437 	wdev->conn->state = CFG80211_CONN_AUTH_FAILED_TIMEOUT;
438 	schedule_work(&rdev->conn_work);
439 }
440 
cfg80211_sme_disassoc(struct wireless_dev * wdev)441 void cfg80211_sme_disassoc(struct wireless_dev *wdev)
442 {
443 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
444 
445 	if (!wdev->conn)
446 		return;
447 
448 	wdev->conn->state = CFG80211_CONN_DEAUTH;
449 	schedule_work(&rdev->conn_work);
450 }
451 
cfg80211_sme_assoc_timeout(struct wireless_dev * wdev)452 void cfg80211_sme_assoc_timeout(struct wireless_dev *wdev)
453 {
454 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
455 
456 	if (!wdev->conn)
457 		return;
458 
459 	wdev->conn->state = CFG80211_CONN_ASSOC_FAILED_TIMEOUT;
460 	schedule_work(&rdev->conn_work);
461 }
462 
cfg80211_sme_abandon_assoc(struct wireless_dev * wdev)463 void cfg80211_sme_abandon_assoc(struct wireless_dev *wdev)
464 {
465 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
466 
467 	if (!wdev->conn)
468 		return;
469 
470 	wdev->conn->state = CFG80211_CONN_ABANDON;
471 	schedule_work(&rdev->conn_work);
472 }
473 
cfg80211_wdev_release_bsses(struct wireless_dev * wdev)474 static void cfg80211_wdev_release_bsses(struct wireless_dev *wdev)
475 {
476 	unsigned int link;
477 
478 	for_each_valid_link(wdev, link) {
479 		if (!wdev->links[link].client.current_bss)
480 			continue;
481 		cfg80211_unhold_bss(wdev->links[link].client.current_bss);
482 		cfg80211_put_bss(wdev->wiphy,
483 				 &wdev->links[link].client.current_bss->pub);
484 		wdev->links[link].client.current_bss = NULL;
485 	}
486 }
487 
cfg80211_sme_get_conn_ies(struct wireless_dev * wdev,const u8 * ies,size_t ies_len,const u8 ** out_ies,size_t * out_ies_len)488 static int cfg80211_sme_get_conn_ies(struct wireless_dev *wdev,
489 				     const u8 *ies, size_t ies_len,
490 				     const u8 **out_ies, size_t *out_ies_len)
491 {
492 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
493 	u8 *buf;
494 	size_t offs;
495 
496 	if (!rdev->wiphy.extended_capabilities_len ||
497 	    (ies && cfg80211_find_ie(WLAN_EID_EXT_CAPABILITY, ies, ies_len))) {
498 		*out_ies = kmemdup(ies, ies_len, GFP_KERNEL);
499 		if (!*out_ies)
500 			return -ENOMEM;
501 		*out_ies_len = ies_len;
502 		return 0;
503 	}
504 
505 	buf = kmalloc(ies_len + rdev->wiphy.extended_capabilities_len + 2,
506 		      GFP_KERNEL);
507 	if (!buf)
508 		return -ENOMEM;
509 
510 	if (ies_len) {
511 		static const u8 before_extcapa[] = {
512 			/* not listing IEs expected to be created by driver */
513 			WLAN_EID_RSN,
514 			WLAN_EID_QOS_CAPA,
515 			WLAN_EID_RRM_ENABLED_CAPABILITIES,
516 			WLAN_EID_MOBILITY_DOMAIN,
517 			WLAN_EID_SUPPORTED_REGULATORY_CLASSES,
518 			WLAN_EID_BSS_COEX_2040,
519 		};
520 
521 		offs = ieee80211_ie_split(ies, ies_len, before_extcapa,
522 					  ARRAY_SIZE(before_extcapa), 0);
523 		memcpy(buf, ies, offs);
524 		/* leave a whole for extended capabilities IE */
525 		memcpy(buf + offs + rdev->wiphy.extended_capabilities_len + 2,
526 		       ies + offs, ies_len - offs);
527 	} else {
528 		offs = 0;
529 	}
530 
531 	/* place extended capabilities IE (with only driver capabilities) */
532 	buf[offs] = WLAN_EID_EXT_CAPABILITY;
533 	buf[offs + 1] = rdev->wiphy.extended_capabilities_len;
534 	memcpy(buf + offs + 2,
535 	       rdev->wiphy.extended_capabilities,
536 	       rdev->wiphy.extended_capabilities_len);
537 
538 	*out_ies = buf;
539 	*out_ies_len = ies_len + rdev->wiphy.extended_capabilities_len + 2;
540 
541 	return 0;
542 }
543 
cfg80211_sme_connect(struct wireless_dev * wdev,struct cfg80211_connect_params * connect,const u8 * prev_bssid)544 static int cfg80211_sme_connect(struct wireless_dev *wdev,
545 				struct cfg80211_connect_params *connect,
546 				const u8 *prev_bssid)
547 {
548 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
549 	struct cfg80211_bss *bss;
550 	int err;
551 
552 	if (!rdev->ops->auth || !rdev->ops->assoc)
553 		return -EOPNOTSUPP;
554 
555 	cfg80211_wdev_release_bsses(wdev);
556 
557 	if (wdev->connected) {
558 		cfg80211_sme_free(wdev);
559 		wdev->connected = false;
560 	}
561 
562 	if (wdev->conn)
563 		return -EINPROGRESS;
564 
565 	wdev->conn = kzalloc(sizeof(*wdev->conn), GFP_KERNEL);
566 	if (!wdev->conn)
567 		return -ENOMEM;
568 
569 	/*
570 	 * Copy all parameters, and treat explicitly IEs, BSSID, SSID.
571 	 */
572 	memcpy(&wdev->conn->params, connect, sizeof(*connect));
573 	if (connect->bssid) {
574 		wdev->conn->params.bssid = wdev->conn->bssid;
575 		memcpy(wdev->conn->bssid, connect->bssid, ETH_ALEN);
576 	}
577 
578 	if (cfg80211_sme_get_conn_ies(wdev, connect->ie, connect->ie_len,
579 				      &wdev->conn->ie,
580 				      &wdev->conn->params.ie_len)) {
581 		kfree(wdev->conn);
582 		wdev->conn = NULL;
583 		return -ENOMEM;
584 	}
585 	wdev->conn->params.ie = wdev->conn->ie;
586 
587 	if (connect->auth_type == NL80211_AUTHTYPE_AUTOMATIC) {
588 		wdev->conn->auto_auth = true;
589 		/* start with open system ... should mostly work */
590 		wdev->conn->params.auth_type =
591 			NL80211_AUTHTYPE_OPEN_SYSTEM;
592 	} else {
593 		wdev->conn->auto_auth = false;
594 	}
595 
596 	wdev->conn->params.ssid = wdev->u.client.ssid;
597 	wdev->conn->params.ssid_len = wdev->u.client.ssid_len;
598 
599 	/* see if we have the bss already */
600 	bss = cfg80211_get_conn_bss(wdev);
601 
602 	if (prev_bssid) {
603 		memcpy(wdev->conn->prev_bssid, prev_bssid, ETH_ALEN);
604 		wdev->conn->prev_bssid_valid = true;
605 	}
606 
607 	/* we're good if we have a matching bss struct */
608 	if (bss) {
609 		enum nl80211_timeout_reason treason;
610 
611 		err = cfg80211_conn_do_work(wdev, &treason);
612 		cfg80211_put_bss(wdev->wiphy, bss);
613 	} else {
614 		/* otherwise we'll need to scan for the AP first */
615 		err = cfg80211_conn_scan(wdev);
616 
617 		/*
618 		 * If we can't scan right now, then we need to scan again
619 		 * after the current scan finished, since the parameters
620 		 * changed (unless we find a good AP anyway).
621 		 */
622 		if (err == -EBUSY) {
623 			err = 0;
624 			wdev->conn->state = CFG80211_CONN_SCAN_AGAIN;
625 		}
626 	}
627 
628 	if (err)
629 		cfg80211_sme_free(wdev);
630 
631 	return err;
632 }
633 
cfg80211_sme_disconnect(struct wireless_dev * wdev,u16 reason)634 static int cfg80211_sme_disconnect(struct wireless_dev *wdev, u16 reason)
635 {
636 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
637 	int err;
638 
639 	if (!wdev->conn)
640 		return 0;
641 
642 	if (!rdev->ops->deauth)
643 		return -EOPNOTSUPP;
644 
645 	if (wdev->conn->state == CFG80211_CONN_SCANNING ||
646 	    wdev->conn->state == CFG80211_CONN_SCAN_AGAIN) {
647 		err = 0;
648 		goto out;
649 	}
650 
651 	/* wdev->conn->params.bssid must be set if > SCANNING */
652 	err = cfg80211_mlme_deauth(rdev, wdev->netdev,
653 				   wdev->conn->params.bssid,
654 				   NULL, 0, reason, false);
655  out:
656 	cfg80211_sme_free(wdev);
657 	return err;
658 }
659 
660 /*
661  * code shared for in-device and software SME
662  */
663 
cfg80211_is_all_idle(void)664 static bool cfg80211_is_all_idle(void)
665 {
666 	struct cfg80211_registered_device *rdev;
667 	struct wireless_dev *wdev;
668 	bool is_all_idle = true;
669 
670 	/*
671 	 * All devices must be idle as otherwise if you are actively
672 	 * scanning some new beacon hints could be learned and would
673 	 * count as new regulatory hints.
674 	 * Also if there is any other active beaconing interface we
675 	 * need not issue a disconnect hint and reset any info such
676 	 * as chan dfs state, etc.
677 	 */
678 	list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
679 		list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
680 			wdev_lock(wdev);
681 			if (wdev->conn || wdev->connected ||
682 			    cfg80211_beaconing_iface_active(wdev))
683 				is_all_idle = false;
684 			wdev_unlock(wdev);
685 		}
686 	}
687 
688 	return is_all_idle;
689 }
690 
disconnect_work(struct work_struct * work)691 static void disconnect_work(struct work_struct *work)
692 {
693 	rtnl_lock();
694 	if (cfg80211_is_all_idle())
695 		regulatory_hint_disconnect();
696 	rtnl_unlock();
697 }
698 
699 DECLARE_WORK(cfg80211_disconnect_work, disconnect_work);
700 
701 static void
cfg80211_connect_result_release_bsses(struct wireless_dev * wdev,struct cfg80211_connect_resp_params * cr)702 cfg80211_connect_result_release_bsses(struct wireless_dev *wdev,
703 				      struct cfg80211_connect_resp_params *cr)
704 {
705 	unsigned int link;
706 
707 	for_each_valid_link(cr, link) {
708 		if (!cr->links[link].bss)
709 			continue;
710 		cfg80211_unhold_bss(bss_from_pub(cr->links[link].bss));
711 		cfg80211_put_bss(wdev->wiphy, cr->links[link].bss);
712 	}
713 }
714 
715 /*
716  * API calls for drivers implementing connect/disconnect and
717  * SME event handling
718  */
719 
720 /* This method must consume bss one way or another */
__cfg80211_connect_result(struct net_device * dev,struct cfg80211_connect_resp_params * cr,bool wextev)721 void __cfg80211_connect_result(struct net_device *dev,
722 			       struct cfg80211_connect_resp_params *cr,
723 			       bool wextev)
724 {
725 	struct wireless_dev *wdev = dev->ieee80211_ptr;
726 	const struct element *country_elem = NULL;
727 	const u8 *country_data;
728 	u8 country_datalen;
729 #ifdef CONFIG_CFG80211_WEXT
730 	union iwreq_data wrqu;
731 #endif
732 	unsigned int link;
733 	const u8 *connected_addr;
734 	bool bss_not_found = false;
735 
736 	ASSERT_WDEV_LOCK(wdev);
737 
738 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
739 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
740 		goto out;
741 
742 	if (cr->valid_links) {
743 		if (WARN_ON(!cr->ap_mld_addr))
744 			goto out;
745 
746 		for_each_valid_link(cr, link) {
747 			if (WARN_ON(!cr->links[link].addr))
748 				goto out;
749 		}
750 
751 		if (WARN_ON(wdev->connect_keys))
752 			goto out;
753 	}
754 
755 	wdev->unprot_beacon_reported = 0;
756 	nl80211_send_connect_result(wiphy_to_rdev(wdev->wiphy), dev, cr,
757 				    GFP_KERNEL);
758 	connected_addr = cr->valid_links ? cr->ap_mld_addr : cr->links[0].bssid;
759 
760 #ifdef CONFIG_CFG80211_WEXT
761 	if (wextev && !cr->valid_links) {
762 		if (cr->req_ie && cr->status == WLAN_STATUS_SUCCESS) {
763 			memset(&wrqu, 0, sizeof(wrqu));
764 			wrqu.data.length = cr->req_ie_len;
765 			wireless_send_event(dev, IWEVASSOCREQIE, &wrqu,
766 					    cr->req_ie);
767 		}
768 
769 		if (cr->resp_ie && cr->status == WLAN_STATUS_SUCCESS) {
770 			memset(&wrqu, 0, sizeof(wrqu));
771 			wrqu.data.length = cr->resp_ie_len;
772 			wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu,
773 					    cr->resp_ie);
774 		}
775 
776 		memset(&wrqu, 0, sizeof(wrqu));
777 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
778 		if (connected_addr && cr->status == WLAN_STATUS_SUCCESS) {
779 			memcpy(wrqu.ap_addr.sa_data, connected_addr, ETH_ALEN);
780 			memcpy(wdev->wext.prev_bssid, connected_addr, ETH_ALEN);
781 			wdev->wext.prev_bssid_valid = true;
782 		}
783 		wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
784 	}
785 #endif
786 
787 	if (cr->status == WLAN_STATUS_SUCCESS) {
788 		if (!wiphy_to_rdev(wdev->wiphy)->ops->connect) {
789 			for_each_valid_link(cr, link) {
790 				if (WARN_ON_ONCE(!cr->links[link].bss))
791 					break;
792 			}
793 		}
794 
795 		for_each_valid_link(cr, link) {
796 			if (cr->links[link].bss)
797 				continue;
798 
799 			cr->links[link].bss =
800 				cfg80211_get_bss(wdev->wiphy, NULL,
801 						 cr->links[link].bssid,
802 						 wdev->u.client.ssid,
803 						 wdev->u.client.ssid_len,
804 						 wdev->conn_bss_type,
805 						 IEEE80211_PRIVACY_ANY);
806 			if (!cr->links[link].bss) {
807 				bss_not_found = true;
808 				break;
809 			}
810 			cfg80211_hold_bss(bss_from_pub(cr->links[link].bss));
811 		}
812 	}
813 
814 	cfg80211_wdev_release_bsses(wdev);
815 
816 	if (cr->status != WLAN_STATUS_SUCCESS) {
817 		kfree_sensitive(wdev->connect_keys);
818 		wdev->connect_keys = NULL;
819 		wdev->u.client.ssid_len = 0;
820 		wdev->conn_owner_nlportid = 0;
821 		cfg80211_connect_result_release_bsses(wdev, cr);
822 		cfg80211_sme_free(wdev);
823 		return;
824 	}
825 
826 	if (WARN_ON(bss_not_found)) {
827 		cfg80211_connect_result_release_bsses(wdev, cr);
828 		return;
829 	}
830 
831 	memset(wdev->links, 0, sizeof(wdev->links));
832 	wdev->valid_links = cr->valid_links;
833 	for_each_valid_link(cr, link)
834 		wdev->links[link].client.current_bss =
835 			bss_from_pub(cr->links[link].bss);
836 	wdev->connected = true;
837 	ether_addr_copy(wdev->u.client.connected_addr, connected_addr);
838 	if (cr->valid_links) {
839 		for_each_valid_link(cr, link)
840 			memcpy(wdev->links[link].addr, cr->links[link].addr,
841 			       ETH_ALEN);
842 	}
843 
844 	if (!(wdev->wiphy->flags & WIPHY_FLAG_HAS_STATIC_WEP))
845 		cfg80211_upload_connect_keys(wdev);
846 
847 	rcu_read_lock();
848 	for_each_valid_link(cr, link) {
849 		country_elem =
850 			ieee80211_bss_get_elem(cr->links[link].bss,
851 					       WLAN_EID_COUNTRY);
852 		if (country_elem)
853 			break;
854 	}
855 	if (!country_elem) {
856 		rcu_read_unlock();
857 		return;
858 	}
859 
860 	country_datalen = country_elem->datalen;
861 	country_data = kmemdup(country_elem->data, country_datalen, GFP_ATOMIC);
862 	rcu_read_unlock();
863 
864 	if (!country_data)
865 		return;
866 
867 	regulatory_hint_country_ie(wdev->wiphy,
868 				   cr->links[link].bss->channel->band,
869 				   country_data, country_datalen);
870 	kfree(country_data);
871 
872 	return;
873 out:
874 	for_each_valid_link(cr, link)
875 		cfg80211_put_bss(wdev->wiphy, cr->links[link].bss);
876 }
877 
cfg80211_update_link_bss(struct wireless_dev * wdev,struct cfg80211_bss ** bss)878 static void cfg80211_update_link_bss(struct wireless_dev *wdev,
879 				     struct cfg80211_bss **bss)
880 {
881 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
882 	struct cfg80211_internal_bss *ibss;
883 
884 	if (!*bss)
885 		return;
886 
887 	ibss = bss_from_pub(*bss);
888 	if (list_empty(&ibss->list)) {
889 		struct cfg80211_bss *found = NULL, *tmp = *bss;
890 
891 		found = cfg80211_get_bss(wdev->wiphy, NULL,
892 					 (*bss)->bssid,
893 					 wdev->u.client.ssid,
894 					 wdev->u.client.ssid_len,
895 					 wdev->conn_bss_type,
896 					 IEEE80211_PRIVACY_ANY);
897 		if (found) {
898 			/* The same BSS is already updated so use it
899 			 * instead, as it has latest info.
900 			 */
901 			*bss = found;
902 		} else {
903 			/* Update with BSS provided by driver, it will
904 			 * be freshly added and ref cnted, we can free
905 			 * the old one.
906 			 *
907 			 * signal_valid can be false, as we are not
908 			 * expecting the BSS to be found.
909 			 *
910 			 * keep the old timestamp to avoid confusion
911 			 */
912 			cfg80211_bss_update(rdev, ibss, false,
913 					    ibss->ts);
914 		}
915 
916 		cfg80211_put_bss(wdev->wiphy, tmp);
917 	}
918 }
919 
920 /* Consumes bss object(s) one way or another */
cfg80211_connect_done(struct net_device * dev,struct cfg80211_connect_resp_params * params,gfp_t gfp)921 void cfg80211_connect_done(struct net_device *dev,
922 			   struct cfg80211_connect_resp_params *params,
923 			   gfp_t gfp)
924 {
925 	struct wireless_dev *wdev = dev->ieee80211_ptr;
926 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
927 	struct cfg80211_event *ev;
928 	unsigned long flags;
929 	u8 *next;
930 	size_t link_info_size = 0;
931 	unsigned int link;
932 
933 	for_each_valid_link(params, link) {
934 		cfg80211_update_link_bss(wdev, &params->links[link].bss);
935 		link_info_size += params->links[link].bssid ? ETH_ALEN : 0;
936 		link_info_size += params->links[link].addr ? ETH_ALEN : 0;
937 	}
938 
939 	ev = kzalloc(sizeof(*ev) + (params->ap_mld_addr ? ETH_ALEN : 0) +
940 		     params->req_ie_len + params->resp_ie_len +
941 		     params->fils.kek_len + params->fils.pmk_len +
942 		     (params->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
943 		     gfp);
944 
945 	if (!ev) {
946 		for_each_valid_link(params, link)
947 			cfg80211_put_bss(wdev->wiphy,
948 					 params->links[link].bss);
949 		return;
950 	}
951 
952 	ev->type = EVENT_CONNECT_RESULT;
953 	next = ((u8 *)ev) + sizeof(*ev);
954 	if (params->ap_mld_addr) {
955 		ev->cr.ap_mld_addr = next;
956 		memcpy((void *)ev->cr.ap_mld_addr, params->ap_mld_addr,
957 		       ETH_ALEN);
958 		next += ETH_ALEN;
959 	}
960 	if (params->req_ie_len) {
961 		ev->cr.req_ie = next;
962 		ev->cr.req_ie_len = params->req_ie_len;
963 		memcpy((void *)ev->cr.req_ie, params->req_ie,
964 		       params->req_ie_len);
965 		next += params->req_ie_len;
966 	}
967 	if (params->resp_ie_len) {
968 		ev->cr.resp_ie = next;
969 		ev->cr.resp_ie_len = params->resp_ie_len;
970 		memcpy((void *)ev->cr.resp_ie, params->resp_ie,
971 		       params->resp_ie_len);
972 		next += params->resp_ie_len;
973 	}
974 	if (params->fils.kek_len) {
975 		ev->cr.fils.kek = next;
976 		ev->cr.fils.kek_len = params->fils.kek_len;
977 		memcpy((void *)ev->cr.fils.kek, params->fils.kek,
978 		       params->fils.kek_len);
979 		next += params->fils.kek_len;
980 	}
981 	if (params->fils.pmk_len) {
982 		ev->cr.fils.pmk = next;
983 		ev->cr.fils.pmk_len = params->fils.pmk_len;
984 		memcpy((void *)ev->cr.fils.pmk, params->fils.pmk,
985 		       params->fils.pmk_len);
986 		next += params->fils.pmk_len;
987 	}
988 	if (params->fils.pmkid) {
989 		ev->cr.fils.pmkid = next;
990 		memcpy((void *)ev->cr.fils.pmkid, params->fils.pmkid,
991 		       WLAN_PMKID_LEN);
992 		next += WLAN_PMKID_LEN;
993 	}
994 	ev->cr.fils.update_erp_next_seq_num = params->fils.update_erp_next_seq_num;
995 	if (params->fils.update_erp_next_seq_num)
996 		ev->cr.fils.erp_next_seq_num = params->fils.erp_next_seq_num;
997 	ev->cr.valid_links = params->valid_links;
998 	for_each_valid_link(params, link) {
999 		if (params->links[link].bss)
1000 			cfg80211_hold_bss(
1001 				bss_from_pub(params->links[link].bss));
1002 		ev->cr.links[link].bss = params->links[link].bss;
1003 
1004 		if (params->links[link].addr) {
1005 			ev->cr.links[link].addr = next;
1006 			memcpy((void *)ev->cr.links[link].addr,
1007 			       params->links[link].addr,
1008 			       ETH_ALEN);
1009 			next += ETH_ALEN;
1010 		}
1011 		if (params->links[link].bssid) {
1012 			ev->cr.links[link].bssid = next;
1013 			memcpy((void *)ev->cr.links[link].bssid,
1014 			       params->links[link].bssid,
1015 			       ETH_ALEN);
1016 			next += ETH_ALEN;
1017 		}
1018 	}
1019 	ev->cr.status = params->status;
1020 	ev->cr.timeout_reason = params->timeout_reason;
1021 
1022 	spin_lock_irqsave(&wdev->event_lock, flags);
1023 	list_add_tail(&ev->list, &wdev->event_list);
1024 	spin_unlock_irqrestore(&wdev->event_lock, flags);
1025 	queue_work(cfg80211_wq, &rdev->event_work);
1026 }
1027 EXPORT_SYMBOL(cfg80211_connect_done);
1028 
1029 /* Consumes bss object one way or another */
__cfg80211_roamed(struct wireless_dev * wdev,struct cfg80211_roam_info * info)1030 void __cfg80211_roamed(struct wireless_dev *wdev,
1031 		       struct cfg80211_roam_info *info)
1032 {
1033 #ifdef CONFIG_CFG80211_WEXT
1034 	union iwreq_data wrqu;
1035 #endif
1036 	unsigned int link;
1037 	const u8 *connected_addr;
1038 
1039 	ASSERT_WDEV_LOCK(wdev);
1040 
1041 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
1042 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
1043 		goto out;
1044 
1045 	if (WARN_ON(!wdev->connected))
1046 		goto out;
1047 
1048 	if (info->valid_links) {
1049 		if (WARN_ON(!info->ap_mld_addr))
1050 			goto out;
1051 
1052 		for_each_valid_link(info, link) {
1053 			if (WARN_ON(!info->links[link].addr))
1054 				goto out;
1055 		}
1056 	}
1057 
1058 	cfg80211_wdev_release_bsses(wdev);
1059 
1060 	for_each_valid_link(info, link) {
1061 		if (WARN_ON(!info->links[link].bss))
1062 			goto out;
1063 	}
1064 
1065 	memset(wdev->links, 0, sizeof(wdev->links));
1066 	wdev->valid_links = info->valid_links;
1067 	for_each_valid_link(info, link) {
1068 		cfg80211_hold_bss(bss_from_pub(info->links[link].bss));
1069 		wdev->links[link].client.current_bss =
1070 			bss_from_pub(info->links[link].bss);
1071 	}
1072 
1073 	connected_addr = info->valid_links ?
1074 			 info->ap_mld_addr :
1075 			 info->links[0].bss->bssid;
1076 	ether_addr_copy(wdev->u.client.connected_addr, connected_addr);
1077 	if (info->valid_links) {
1078 		for_each_valid_link(info, link)
1079 			memcpy(wdev->links[link].addr, info->links[link].addr,
1080 			       ETH_ALEN);
1081 	}
1082 	wdev->unprot_beacon_reported = 0;
1083 	nl80211_send_roamed(wiphy_to_rdev(wdev->wiphy),
1084 			    wdev->netdev, info, GFP_KERNEL);
1085 
1086 #ifdef CONFIG_CFG80211_WEXT
1087 	if (!info->valid_links) {
1088 		if (info->req_ie) {
1089 			memset(&wrqu, 0, sizeof(wrqu));
1090 			wrqu.data.length = info->req_ie_len;
1091 			wireless_send_event(wdev->netdev, IWEVASSOCREQIE,
1092 					    &wrqu, info->req_ie);
1093 		}
1094 
1095 		if (info->resp_ie) {
1096 			memset(&wrqu, 0, sizeof(wrqu));
1097 			wrqu.data.length = info->resp_ie_len;
1098 			wireless_send_event(wdev->netdev, IWEVASSOCRESPIE,
1099 					    &wrqu, info->resp_ie);
1100 		}
1101 
1102 		memset(&wrqu, 0, sizeof(wrqu));
1103 		wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1104 		memcpy(wrqu.ap_addr.sa_data, connected_addr, ETH_ALEN);
1105 		memcpy(wdev->wext.prev_bssid, connected_addr, ETH_ALEN);
1106 		wdev->wext.prev_bssid_valid = true;
1107 		wireless_send_event(wdev->netdev, SIOCGIWAP, &wrqu, NULL);
1108 	}
1109 #endif
1110 
1111 	return;
1112 out:
1113 	for_each_valid_link(info, link)
1114 		cfg80211_put_bss(wdev->wiphy, info->links[link].bss);
1115 }
1116 
1117 /* Consumes info->links.bss object(s) one way or another */
cfg80211_roamed(struct net_device * dev,struct cfg80211_roam_info * info,gfp_t gfp)1118 void cfg80211_roamed(struct net_device *dev, struct cfg80211_roam_info *info,
1119 		     gfp_t gfp)
1120 {
1121 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1122 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1123 	struct cfg80211_event *ev;
1124 	unsigned long flags;
1125 	u8 *next;
1126 	unsigned int link;
1127 	size_t link_info_size = 0;
1128 	bool bss_not_found = false;
1129 
1130 	for_each_valid_link(info, link) {
1131 		link_info_size += info->links[link].addr ? ETH_ALEN : 0;
1132 		link_info_size += info->links[link].bssid ? ETH_ALEN : 0;
1133 
1134 		if (info->links[link].bss)
1135 			continue;
1136 
1137 		info->links[link].bss =
1138 			cfg80211_get_bss(wdev->wiphy,
1139 					 info->links[link].channel,
1140 					 info->links[link].bssid,
1141 					 wdev->u.client.ssid,
1142 					 wdev->u.client.ssid_len,
1143 					 wdev->conn_bss_type,
1144 					 IEEE80211_PRIVACY_ANY);
1145 
1146 		if (!info->links[link].bss) {
1147 			bss_not_found = true;
1148 			break;
1149 		}
1150 	}
1151 
1152 	if (WARN_ON(bss_not_found))
1153 		goto out;
1154 
1155 	ev = kzalloc(sizeof(*ev) + info->req_ie_len + info->resp_ie_len +
1156 		     info->fils.kek_len + info->fils.pmk_len +
1157 		     (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
1158 		     (info->ap_mld_addr ? ETH_ALEN : 0) + link_info_size, gfp);
1159 	if (!ev)
1160 		goto out;
1161 
1162 	ev->type = EVENT_ROAMED;
1163 	next = ((u8 *)ev) + sizeof(*ev);
1164 	if (info->req_ie_len) {
1165 		ev->rm.req_ie = next;
1166 		ev->rm.req_ie_len = info->req_ie_len;
1167 		memcpy((void *)ev->rm.req_ie, info->req_ie, info->req_ie_len);
1168 		next += info->req_ie_len;
1169 	}
1170 	if (info->resp_ie_len) {
1171 		ev->rm.resp_ie = next;
1172 		ev->rm.resp_ie_len = info->resp_ie_len;
1173 		memcpy((void *)ev->rm.resp_ie, info->resp_ie,
1174 		       info->resp_ie_len);
1175 		next += info->resp_ie_len;
1176 	}
1177 	if (info->fils.kek_len) {
1178 		ev->rm.fils.kek = next;
1179 		ev->rm.fils.kek_len = info->fils.kek_len;
1180 		memcpy((void *)ev->rm.fils.kek, info->fils.kek,
1181 		       info->fils.kek_len);
1182 		next += info->fils.kek_len;
1183 	}
1184 	if (info->fils.pmk_len) {
1185 		ev->rm.fils.pmk = next;
1186 		ev->rm.fils.pmk_len = info->fils.pmk_len;
1187 		memcpy((void *)ev->rm.fils.pmk, info->fils.pmk,
1188 		       info->fils.pmk_len);
1189 		next += info->fils.pmk_len;
1190 	}
1191 	if (info->fils.pmkid) {
1192 		ev->rm.fils.pmkid = next;
1193 		memcpy((void *)ev->rm.fils.pmkid, info->fils.pmkid,
1194 		       WLAN_PMKID_LEN);
1195 		next += WLAN_PMKID_LEN;
1196 	}
1197 	ev->rm.fils.update_erp_next_seq_num = info->fils.update_erp_next_seq_num;
1198 	if (info->fils.update_erp_next_seq_num)
1199 		ev->rm.fils.erp_next_seq_num = info->fils.erp_next_seq_num;
1200 	if (info->ap_mld_addr) {
1201 		ev->rm.ap_mld_addr = next;
1202 		memcpy((void *)ev->rm.ap_mld_addr, info->ap_mld_addr,
1203 		       ETH_ALEN);
1204 		next += ETH_ALEN;
1205 	}
1206 	ev->rm.valid_links = info->valid_links;
1207 	for_each_valid_link(info, link) {
1208 		ev->rm.links[link].bss = info->links[link].bss;
1209 
1210 		if (info->links[link].addr) {
1211 			ev->rm.links[link].addr = next;
1212 			memcpy((void *)ev->rm.links[link].addr,
1213 			       info->links[link].addr,
1214 			       ETH_ALEN);
1215 			next += ETH_ALEN;
1216 		}
1217 
1218 		if (info->links[link].bssid) {
1219 			ev->rm.links[link].bssid = next;
1220 			memcpy((void *)ev->rm.links[link].bssid,
1221 			       info->links[link].bssid,
1222 			       ETH_ALEN);
1223 			next += ETH_ALEN;
1224 		}
1225 	}
1226 
1227 	spin_lock_irqsave(&wdev->event_lock, flags);
1228 	list_add_tail(&ev->list, &wdev->event_list);
1229 	spin_unlock_irqrestore(&wdev->event_lock, flags);
1230 	queue_work(cfg80211_wq, &rdev->event_work);
1231 
1232 	return;
1233 out:
1234 	for_each_valid_link(info, link)
1235 		cfg80211_put_bss(wdev->wiphy, info->links[link].bss);
1236 
1237 }
1238 EXPORT_SYMBOL(cfg80211_roamed);
1239 
__cfg80211_port_authorized(struct wireless_dev * wdev,const u8 * bssid)1240 void __cfg80211_port_authorized(struct wireless_dev *wdev, const u8 *bssid)
1241 {
1242 	ASSERT_WDEV_LOCK(wdev);
1243 
1244 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
1245 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
1246 		return;
1247 
1248 	if (WARN_ON(!wdev->connected) ||
1249 	    WARN_ON(!ether_addr_equal(wdev->u.client.connected_addr, bssid)))
1250 		return;
1251 
1252 	nl80211_send_port_authorized(wiphy_to_rdev(wdev->wiphy), wdev->netdev,
1253 				     bssid);
1254 }
1255 
cfg80211_port_authorized(struct net_device * dev,const u8 * bssid,gfp_t gfp)1256 void cfg80211_port_authorized(struct net_device *dev, const u8 *bssid,
1257 			      gfp_t gfp)
1258 {
1259 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1260 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1261 	struct cfg80211_event *ev;
1262 	unsigned long flags;
1263 
1264 	if (WARN_ON(!bssid))
1265 		return;
1266 
1267 	ev = kzalloc(sizeof(*ev), gfp);
1268 	if (!ev)
1269 		return;
1270 
1271 	ev->type = EVENT_PORT_AUTHORIZED;
1272 	memcpy(ev->pa.bssid, bssid, ETH_ALEN);
1273 
1274 	/*
1275 	 * Use the wdev event list so that if there are pending
1276 	 * connected/roamed events, they will be reported first.
1277 	 */
1278 	spin_lock_irqsave(&wdev->event_lock, flags);
1279 	list_add_tail(&ev->list, &wdev->event_list);
1280 	spin_unlock_irqrestore(&wdev->event_lock, flags);
1281 	queue_work(cfg80211_wq, &rdev->event_work);
1282 }
1283 EXPORT_SYMBOL(cfg80211_port_authorized);
1284 
__cfg80211_disconnected(struct net_device * dev,const u8 * ie,size_t ie_len,u16 reason,bool from_ap)1285 void __cfg80211_disconnected(struct net_device *dev, const u8 *ie,
1286 			     size_t ie_len, u16 reason, bool from_ap)
1287 {
1288 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1289 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1290 	int i;
1291 #ifdef CONFIG_CFG80211_WEXT
1292 	union iwreq_data wrqu;
1293 #endif
1294 
1295 	ASSERT_WDEV_LOCK(wdev);
1296 
1297 	if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
1298 		    wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
1299 		return;
1300 
1301 	cfg80211_wdev_release_bsses(wdev);
1302 	wdev->connected = false;
1303 	wdev->u.client.ssid_len = 0;
1304 	wdev->conn_owner_nlportid = 0;
1305 	kfree_sensitive(wdev->connect_keys);
1306 	wdev->connect_keys = NULL;
1307 
1308 	nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap);
1309 
1310 	/* stop critical protocol if supported */
1311 	if (rdev->ops->crit_proto_stop && rdev->crit_proto_nlportid) {
1312 		rdev->crit_proto_nlportid = 0;
1313 		rdev_crit_proto_stop(rdev, wdev);
1314 	}
1315 
1316 	/*
1317 	 * Delete all the keys ... pairwise keys can't really
1318 	 * exist any more anyway, but default keys might.
1319 	 */
1320 	if (rdev->ops->del_key) {
1321 		int max_key_idx = 5;
1322 
1323 		if (wiphy_ext_feature_isset(
1324 			    wdev->wiphy,
1325 			    NL80211_EXT_FEATURE_BEACON_PROTECTION) ||
1326 		    wiphy_ext_feature_isset(
1327 			    wdev->wiphy,
1328 			    NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
1329 			max_key_idx = 7;
1330 		for (i = 0; i <= max_key_idx; i++)
1331 			rdev_del_key(rdev, dev, -1, i, false, NULL);
1332 	}
1333 
1334 	rdev_set_qos_map(rdev, dev, NULL);
1335 
1336 #ifdef CONFIG_CFG80211_WEXT
1337 	memset(&wrqu, 0, sizeof(wrqu));
1338 	wrqu.ap_addr.sa_family = ARPHRD_ETHER;
1339 	wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
1340 	wdev->wext.connect.ssid_len = 0;
1341 #endif
1342 
1343 	schedule_work(&cfg80211_disconnect_work);
1344 }
1345 
cfg80211_disconnected(struct net_device * dev,u16 reason,const u8 * ie,size_t ie_len,bool locally_generated,gfp_t gfp)1346 void cfg80211_disconnected(struct net_device *dev, u16 reason,
1347 			   const u8 *ie, size_t ie_len,
1348 			   bool locally_generated, gfp_t gfp)
1349 {
1350 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1351 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1352 	struct cfg80211_event *ev;
1353 	unsigned long flags;
1354 
1355 	ev = kzalloc(sizeof(*ev) + ie_len, gfp);
1356 	if (!ev)
1357 		return;
1358 
1359 	ev->type = EVENT_DISCONNECTED;
1360 	ev->dc.ie = ((u8 *)ev) + sizeof(*ev);
1361 	ev->dc.ie_len = ie_len;
1362 	memcpy((void *)ev->dc.ie, ie, ie_len);
1363 	ev->dc.reason = reason;
1364 	ev->dc.locally_generated = locally_generated;
1365 
1366 	spin_lock_irqsave(&wdev->event_lock, flags);
1367 	list_add_tail(&ev->list, &wdev->event_list);
1368 	spin_unlock_irqrestore(&wdev->event_lock, flags);
1369 	queue_work(cfg80211_wq, &rdev->event_work);
1370 }
1371 EXPORT_SYMBOL(cfg80211_disconnected);
1372 
1373 /*
1374  * API calls for nl80211/wext compatibility code
1375  */
cfg80211_connect(struct cfg80211_registered_device * rdev,struct net_device * dev,struct cfg80211_connect_params * connect,struct cfg80211_cached_keys * connkeys,const u8 * prev_bssid)1376 int cfg80211_connect(struct cfg80211_registered_device *rdev,
1377 		     struct net_device *dev,
1378 		     struct cfg80211_connect_params *connect,
1379 		     struct cfg80211_cached_keys *connkeys,
1380 		     const u8 *prev_bssid)
1381 {
1382 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1383 	int err;
1384 
1385 	ASSERT_WDEV_LOCK(wdev);
1386 
1387 	/*
1388 	 * If we have an ssid_len, we're trying to connect or are
1389 	 * already connected, so reject a new SSID unless it's the
1390 	 * same (which is the case for re-association.)
1391 	 */
1392 	if (wdev->u.client.ssid_len &&
1393 	    (wdev->u.client.ssid_len != connect->ssid_len ||
1394 	     memcmp(wdev->u.client.ssid, connect->ssid, wdev->u.client.ssid_len)))
1395 		return -EALREADY;
1396 
1397 	/*
1398 	 * If connected, reject (re-)association unless prev_bssid
1399 	 * matches the current BSSID.
1400 	 */
1401 	if (wdev->connected) {
1402 		if (!prev_bssid)
1403 			return -EALREADY;
1404 		if (!ether_addr_equal(prev_bssid,
1405 				      wdev->u.client.connected_addr))
1406 			return -ENOTCONN;
1407 	}
1408 
1409 	/*
1410 	 * Reject if we're in the process of connecting with WEP,
1411 	 * this case isn't very interesting and trying to handle
1412 	 * it would make the code much more complex.
1413 	 */
1414 	if (wdev->connect_keys)
1415 		return -EINPROGRESS;
1416 
1417 	cfg80211_oper_and_ht_capa(&connect->ht_capa_mask,
1418 				  rdev->wiphy.ht_capa_mod_mask);
1419 	cfg80211_oper_and_vht_capa(&connect->vht_capa_mask,
1420 				   rdev->wiphy.vht_capa_mod_mask);
1421 
1422 	if (connkeys && connkeys->def >= 0) {
1423 		int idx;
1424 		u32 cipher;
1425 
1426 		idx = connkeys->def;
1427 		cipher = connkeys->params[idx].cipher;
1428 		/* If given a WEP key we may need it for shared key auth */
1429 		if (cipher == WLAN_CIPHER_SUITE_WEP40 ||
1430 		    cipher == WLAN_CIPHER_SUITE_WEP104) {
1431 			connect->key_idx = idx;
1432 			connect->key = connkeys->params[idx].key;
1433 			connect->key_len = connkeys->params[idx].key_len;
1434 
1435 			/*
1436 			 * If ciphers are not set (e.g. when going through
1437 			 * iwconfig), we have to set them appropriately here.
1438 			 */
1439 			if (connect->crypto.cipher_group == 0)
1440 				connect->crypto.cipher_group = cipher;
1441 
1442 			if (connect->crypto.n_ciphers_pairwise == 0) {
1443 				connect->crypto.n_ciphers_pairwise = 1;
1444 				connect->crypto.ciphers_pairwise[0] = cipher;
1445 			}
1446 		}
1447 
1448 		connect->crypto.wep_keys = connkeys->params;
1449 		connect->crypto.wep_tx_key = connkeys->def;
1450 	} else {
1451 		if (WARN_ON(connkeys))
1452 			return -EINVAL;
1453 	}
1454 
1455 	wdev->connect_keys = connkeys;
1456 	memcpy(wdev->u.client.ssid, connect->ssid, connect->ssid_len);
1457 	wdev->u.client.ssid_len = connect->ssid_len;
1458 
1459 	wdev->conn_bss_type = connect->pbss ? IEEE80211_BSS_TYPE_PBSS :
1460 					      IEEE80211_BSS_TYPE_ESS;
1461 
1462 	if (!rdev->ops->connect)
1463 		err = cfg80211_sme_connect(wdev, connect, prev_bssid);
1464 	else
1465 		err = rdev_connect(rdev, dev, connect);
1466 
1467 	if (err) {
1468 		wdev->connect_keys = NULL;
1469 		/*
1470 		 * This could be reassoc getting refused, don't clear
1471 		 * ssid_len in that case.
1472 		 */
1473 		if (!wdev->connected)
1474 			wdev->u.client.ssid_len = 0;
1475 		return err;
1476 	}
1477 
1478 	return 0;
1479 }
1480 
cfg80211_disconnect(struct cfg80211_registered_device * rdev,struct net_device * dev,u16 reason,bool wextev)1481 int cfg80211_disconnect(struct cfg80211_registered_device *rdev,
1482 			struct net_device *dev, u16 reason, bool wextev)
1483 {
1484 	struct wireless_dev *wdev = dev->ieee80211_ptr;
1485 	int err = 0;
1486 
1487 	ASSERT_WDEV_LOCK(wdev);
1488 
1489 	kfree_sensitive(wdev->connect_keys);
1490 	wdev->connect_keys = NULL;
1491 
1492 	wdev->conn_owner_nlportid = 0;
1493 
1494 	if (wdev->conn)
1495 		err = cfg80211_sme_disconnect(wdev, reason);
1496 	else if (!rdev->ops->disconnect)
1497 		cfg80211_mlme_down(rdev, dev);
1498 	else if (wdev->u.client.ssid_len)
1499 		err = rdev_disconnect(rdev, dev, reason);
1500 
1501 	/*
1502 	 * Clear ssid_len unless we actually were fully connected,
1503 	 * in which case cfg80211_disconnected() will take care of
1504 	 * this later.
1505 	 */
1506 	if (!wdev->connected)
1507 		wdev->u.client.ssid_len = 0;
1508 
1509 	return err;
1510 }
1511 
1512 /*
1513  * Used to clean up after the connection / connection attempt owner socket
1514  * disconnects
1515  */
cfg80211_autodisconnect_wk(struct work_struct * work)1516 void cfg80211_autodisconnect_wk(struct work_struct *work)
1517 {
1518 	struct wireless_dev *wdev =
1519 		container_of(work, struct wireless_dev, disconnect_wk);
1520 	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
1521 
1522 	wdev_lock(wdev);
1523 
1524 	if (wdev->conn_owner_nlportid) {
1525 		switch (wdev->iftype) {
1526 		case NL80211_IFTYPE_ADHOC:
1527 			__cfg80211_leave_ibss(rdev, wdev->netdev, false);
1528 			break;
1529 		case NL80211_IFTYPE_AP:
1530 		case NL80211_IFTYPE_P2P_GO:
1531 			__cfg80211_stop_ap(rdev, wdev->netdev, -1, false);
1532 			break;
1533 		case NL80211_IFTYPE_MESH_POINT:
1534 			__cfg80211_leave_mesh(rdev, wdev->netdev);
1535 			break;
1536 		case NL80211_IFTYPE_STATION:
1537 		case NL80211_IFTYPE_P2P_CLIENT:
1538 			/*
1539 			 * Use disconnect_bssid if still connecting and
1540 			 * ops->disconnect not implemented.  Otherwise we can
1541 			 * use cfg80211_disconnect.
1542 			 */
1543 			if (rdev->ops->disconnect || wdev->connected)
1544 				cfg80211_disconnect(rdev, wdev->netdev,
1545 						    WLAN_REASON_DEAUTH_LEAVING,
1546 						    true);
1547 			else
1548 				cfg80211_mlme_deauth(rdev, wdev->netdev,
1549 						     wdev->disconnect_bssid,
1550 						     NULL, 0,
1551 						     WLAN_REASON_DEAUTH_LEAVING,
1552 						     false);
1553 			break;
1554 		default:
1555 			break;
1556 		}
1557 	}
1558 
1559 	wdev_unlock(wdev);
1560 }
1561