xref: /netbsd-src/external/bsd/wpa/dist/src/drivers/driver_bsd.c (revision 181254a7b1bdde6873432bffef2d2decc4b5c22f)
1 /*
2  * WPA Supplicant - driver interaction with BSD net80211 layer
3  * Copyright (c) 2004, Sam Leffler <sam@errno.com>
4  * Copyright (c) 2004, 2Wire, Inc
5  *
6  * This software may be distributed under the terms of the BSD license.
7  * See README for more details.
8  */
9 
10 #include "includes.h"
11 #include <sys/ioctl.h>
12 
13 #include "common.h"
14 #include "driver.h"
15 #include "eloop.h"
16 #include "common/ieee802_11_defs.h"
17 #include "common/wpa_common.h"
18 
19 #include <net/if.h>
20 #include <net/if_media.h>
21 
22 #ifdef __NetBSD__
23 #include <net/if_ether.h>
24 #else
25 #include <net/ethernet.h>
26 #endif
27 #include <net/route.h>
28 
29 #ifdef __DragonFly__
30 #include <netproto/802_11/ieee80211_ioctl.h>
31 #include <netproto/802_11/ieee80211_dragonfly.h>
32 #else /* __DragonFly__ */
33 #ifdef __GLIBC__
34 #include <netinet/ether.h>
35 #endif /* __GLIBC__ */
36 #include <net80211/ieee80211.h>
37 #include <net80211/ieee80211_ioctl.h>
38 #include <net80211/ieee80211_crypto.h>
39 #endif /* __DragonFly__ || __GLIBC__ */
40 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
41 #include <net80211/ieee80211_freebsd.h>
42 #endif
43 #if __NetBSD__
44 #include <net80211/ieee80211_netbsd.h>
45 #endif
46 
47 #include "l2_packet/l2_packet.h"
48 
49 struct bsd_driver_global {
50 	void		*ctx;
51 	int		sock;			/* socket for 802.11 ioctls */
52 	int		route;			/* routing socket for events */
53 	struct dl_list	ifaces;			/* list of interfaces */
54 };
55 
56 struct bsd_driver_data {
57 	struct dl_list	list;
58 	struct bsd_driver_global *global;
59 	void	*ctx;
60 
61 	struct l2_packet_data *sock_xmit;/* raw packet xmit socket */
62 	char	ifname[IFNAMSIZ+1];	/* interface name */
63 	int	flags;
64 	unsigned int ifindex;		/* interface index */
65 	int	if_removed;		/* has the interface been removed? */
66 	struct wpa_driver_capa capa;	/* driver capability */
67 	int	is_ap;			/* Access point mode */
68 	int	prev_roaming;	/* roaming state to restore on deinit */
69 	int	prev_privacy;	/* privacy state to restore on deinit */
70 	int	prev_wpa;	/* wpa state to restore on deinit */
71 	enum ieee80211_opmode opmode;	/* operation mode */
72 };
73 
74 /* Generic functions for hostapd and wpa_supplicant */
75 
76 static struct bsd_driver_data *
77 bsd_get_drvindex(void *priv, unsigned int ifindex)
78 {
79 	struct bsd_driver_global *global = priv;
80 	struct bsd_driver_data *drv;
81 
82 	dl_list_for_each(drv, &global->ifaces, struct bsd_driver_data, list) {
83 		if (drv->ifindex == ifindex)
84 			return drv;
85 	}
86 	return NULL;
87 }
88 
89 static struct bsd_driver_data *
90 bsd_get_drvname(void *priv, const char *ifname)
91 {
92 	struct bsd_driver_global *global = priv;
93 	struct bsd_driver_data *drv;
94 
95 	dl_list_for_each(drv, &global->ifaces, struct bsd_driver_data, list) {
96 		if (os_strcmp(drv->ifname, ifname) == 0)
97 			return drv;
98 	}
99 	return NULL;
100 }
101 
102 static int
103 bsd_set80211(void *priv, int op, int val, const void *arg, int arg_len)
104 {
105 	struct bsd_driver_data *drv = priv;
106 	struct ieee80211req ireq;
107 
108 	if (drv->ifindex == 0 || drv->if_removed)
109 		return -1;
110 
111 	os_memset(&ireq, 0, sizeof(ireq));
112 	os_strlcpy(ireq.i_name, drv->ifname, sizeof(ireq.i_name));
113 	ireq.i_type = op;
114 	ireq.i_val = val;
115 	ireq.i_data = (void *) arg;
116 	ireq.i_len = arg_len;
117 
118 	if (ioctl(drv->global->sock, SIOCS80211, &ireq) < 0) {
119 		wpa_printf(MSG_ERROR, "ioctl[SIOCS80211, op=%u, val=%u, "
120 			   "arg_len=%u]: %s", op, val, arg_len,
121 			   strerror(errno));
122 		return -1;
123 	}
124 	return 0;
125 }
126 
127 static int
128 bsd_get80211(void *priv, struct ieee80211req *ireq, int op, void *arg,
129 	     int arg_len)
130 {
131 	struct bsd_driver_data *drv = priv;
132 
133 	os_memset(ireq, 0, sizeof(*ireq));
134 	os_strlcpy(ireq->i_name, drv->ifname, sizeof(ireq->i_name));
135 	ireq->i_type = op;
136 	ireq->i_len = arg_len;
137 	ireq->i_data = arg;
138 
139 	if (ioctl(drv->global->sock, SIOCG80211, ireq) < 0) {
140 		int level = drv->if_removed ? MSG_DEBUG : MSG_ERROR;
141 
142 		wpa_printf(level, "ioctl[SIOCG80211, op=%u, "
143 			   "arg_len=%u]: %s", op, arg_len, strerror(errno));
144 		return -1;
145 	}
146 	return 0;
147 }
148 
149 static int
150 get80211var(struct bsd_driver_data *drv, int op, void *arg, int arg_len)
151 {
152 	struct ieee80211req ireq;
153 
154 	if (bsd_get80211(drv, &ireq, op, arg, arg_len) < 0)
155 		return -1;
156 	return ireq.i_len;
157 }
158 
159 static int
160 set80211var(struct bsd_driver_data *drv, int op, const void *arg, int arg_len)
161 {
162 	return bsd_set80211(drv, op, 0, arg, arg_len);
163 }
164 
165 static int
166 set80211param(struct bsd_driver_data *drv, int op, int arg)
167 {
168 	return bsd_set80211(drv, op, arg, NULL, 0);
169 }
170 
171 static int
172 bsd_get_ssid(void *priv, u8 *ssid, int len)
173 {
174 	struct bsd_driver_data *drv = priv;
175 #ifdef SIOCG80211NWID
176 	struct ieee80211_nwid nwid;
177 	struct ifreq ifr;
178 
179 	os_memset(&ifr, 0, sizeof(ifr));
180 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
181 	ifr.ifr_data = (void *)&nwid;
182 	if (ioctl(drv->global->sock, SIOCG80211NWID, &ifr) < 0 ||
183 	    nwid.i_len > IEEE80211_NWID_LEN)
184 		return -1;
185 	os_memcpy(ssid, nwid.i_nwid, nwid.i_len);
186 	return nwid.i_len;
187 #else
188 	return get80211var(drv, IEEE80211_IOC_SSID, ssid, IEEE80211_NWID_LEN);
189 #endif
190 }
191 
192 static int
193 bsd_set_ssid(void *priv, const u8 *ssid, int ssid_len)
194 {
195 	struct bsd_driver_data *drv = priv;
196 #ifdef SIOCS80211NWID
197 	struct ieee80211_nwid nwid;
198 	struct ifreq ifr;
199 
200 	os_memcpy(nwid.i_nwid, ssid, ssid_len);
201 	nwid.i_len = ssid_len;
202 	os_memset(&ifr, 0, sizeof(ifr));
203 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
204 	ifr.ifr_data = (void *)&nwid;
205 	return ioctl(drv->global->sock, SIOCS80211NWID, &ifr);
206 #else
207 	return set80211var(drv, IEEE80211_IOC_SSID, ssid, ssid_len);
208 #endif
209 }
210 
211 static int
212 bsd_get_if_media(void *priv)
213 {
214 	struct bsd_driver_data *drv = priv;
215 	struct ifmediareq ifmr;
216 
217 	os_memset(&ifmr, 0, sizeof(ifmr));
218 	os_strlcpy(ifmr.ifm_name, drv->ifname, sizeof(ifmr.ifm_name));
219 
220 	if (ioctl(drv->global->sock, SIOCGIFMEDIA, &ifmr) < 0) {
221 		wpa_printf(MSG_ERROR, "%s: SIOCGIFMEDIA %s", __func__,
222 			   strerror(errno));
223 		return -1;
224 	}
225 
226 	return ifmr.ifm_current;
227 }
228 
229 static int
230 bsd_set_if_media(void *priv, int media)
231 {
232 	struct bsd_driver_data *drv = priv;
233 	struct ifreq ifr;
234 
235 	os_memset(&ifr, 0, sizeof(ifr));
236 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
237 	ifr.ifr_media = media;
238 
239 	if (ioctl(drv->global->sock, SIOCSIFMEDIA, &ifr) < 0) {
240 		wpa_printf(MSG_ERROR, "%s: SIOCSIFMEDIA %s", __func__,
241 			   strerror(errno));
242 		return -1;
243 	}
244 
245 	return 0;
246 }
247 
248 static int
249 bsd_set_mediaopt(void *priv, uint32_t mask, uint32_t mode)
250 {
251 	int media = bsd_get_if_media(priv);
252 
253 	if (media < 0)
254 		return -1;
255 	media &= ~mask;
256 	media |= mode;
257 	if (bsd_set_if_media(priv, media) < 0)
258 		return -1;
259 	return 0;
260 }
261 
262 static int
263 bsd_del_key(void *priv, const u8 *addr, int key_idx)
264 {
265 	struct ieee80211req_del_key wk;
266 
267 	os_memset(&wk, 0, sizeof(wk));
268 	if (addr == NULL) {
269 		wpa_printf(MSG_DEBUG, "%s: key_idx=%d", __func__, key_idx);
270 		wk.idk_keyix = key_idx;
271 	} else {
272 		wpa_printf(MSG_DEBUG, "%s: addr=" MACSTR, __func__,
273 			   MAC2STR(addr));
274 		os_memcpy(wk.idk_macaddr, addr, IEEE80211_ADDR_LEN);
275 		wk.idk_keyix = (u_int8_t) IEEE80211_KEYIX_NONE;	/* XXX */
276 	}
277 
278 	return set80211var(priv, IEEE80211_IOC_DELKEY, &wk, sizeof(wk));
279 }
280 
281 static int
282 bsd_send_mlme_param(void *priv, const u8 op, const u16 reason, const u8 *addr)
283 {
284 	struct ieee80211req_mlme mlme;
285 
286 	os_memset(&mlme, 0, sizeof(mlme));
287 	mlme.im_op = op;
288 	mlme.im_reason = reason;
289 	os_memcpy(mlme.im_macaddr, addr, IEEE80211_ADDR_LEN);
290 	wpa_printf(MSG_DEBUG, "%s: op=%d reason=%d addr=" MACSTR, __func__,
291 	    op, reason, MAC2STR(addr));
292 	return set80211var(priv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme));
293 }
294 
295 static int
296 bsd_get_iface_flags(struct bsd_driver_data *drv)
297 {
298 	struct ifreq ifr;
299 
300 	os_memset(&ifr, 0, sizeof(ifr));
301 	os_strlcpy(ifr.ifr_name, drv->ifname, sizeof(ifr.ifr_name));
302 
303 	if (ioctl(drv->global->sock, SIOCGIFFLAGS, &ifr) < 0) {
304 		wpa_printf(MSG_ERROR, "ioctl[SIOCGIFFLAGS]: %s",
305 			   strerror(errno));
306 		return -1;
307 	}
308 	drv->flags = ifr.ifr_flags;
309 	return 0;
310 }
311 
312 static int
313 bsd_set_key(const char *ifname, void *priv, enum wpa_alg alg,
314 	    const unsigned char *addr, int key_idx, int set_tx, const u8 *seq,
315 	    size_t seq_len, const u8 *key, size_t key_len)
316 {
317 	struct ieee80211req_key wk;
318 #ifdef IEEE80211_KEY_NOREPLAY
319 	struct bsd_driver_data *drv = priv;
320 #endif /* IEEE80211_KEY_NOREPLAY */
321 
322 	wpa_printf(MSG_DEBUG, "%s: alg=%d addr=%p key_idx=%d set_tx=%d "
323 		   "seq_len=%zu key_len=%zu", __func__, alg, addr, key_idx,
324 		   set_tx, seq_len, key_len);
325 
326 	if (alg == WPA_ALG_NONE) {
327 #ifndef HOSTAPD
328 		if (addr == NULL || is_broadcast_ether_addr(addr))
329 			return bsd_del_key(priv, NULL, key_idx);
330 		else
331 #endif /* HOSTAPD */
332 			return bsd_del_key(priv, addr, key_idx);
333 	}
334 
335 	os_memset(&wk, 0, sizeof(wk));
336 	switch (alg) {
337 	case WPA_ALG_WEP:
338 		wk.ik_type = IEEE80211_CIPHER_WEP;
339 		break;
340 	case WPA_ALG_TKIP:
341 		wk.ik_type = IEEE80211_CIPHER_TKIP;
342 		break;
343 	case WPA_ALG_CCMP:
344 		wk.ik_type = IEEE80211_CIPHER_AES_CCM;
345 		break;
346 	default:
347 		wpa_printf(MSG_ERROR, "%s: unknown alg=%d", __func__, alg);
348 		return -1;
349 	}
350 
351 	wk.ik_flags = IEEE80211_KEY_RECV;
352 	if (set_tx)
353 		wk.ik_flags |= IEEE80211_KEY_XMIT;
354 
355 	if (addr == NULL) {
356 		os_memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
357 		wk.ik_keyix = key_idx;
358 	} else {
359 		os_memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
360 		/*
361 		 * Deduce whether group/global or unicast key by checking
362 		 * the address (yech).  Note also that we can only mark global
363 		 * keys default; doing this for a unicast key is an error.
364 		 */
365 		if (is_broadcast_ether_addr(addr)) {
366 			wk.ik_flags |= IEEE80211_KEY_GROUP;
367 			wk.ik_keyix = key_idx;
368 		} else {
369 			wk.ik_keyix = key_idx == 0 ? IEEE80211_KEYIX_NONE :
370 				key_idx;
371 		}
372 	}
373 	if (wk.ik_keyix != IEEE80211_KEYIX_NONE && set_tx)
374 		wk.ik_flags |= IEEE80211_KEY_DEFAULT;
375 #ifndef HOSTAPD
376 #ifdef IEEE80211_KEY_NOREPLAY
377 	/*
378 	 * Ignore replay failures in IBSS and AHDEMO mode.
379 	 */
380 	if (drv->opmode == IEEE80211_M_IBSS ||
381 	    drv->opmode == IEEE80211_M_AHDEMO)
382 		wk.ik_flags |= IEEE80211_KEY_NOREPLAY;
383 #endif /* IEEE80211_KEY_NOREPLAY */
384 #endif /* HOSTAPD */
385 	wk.ik_keylen = key_len;
386 	if (seq) {
387 #ifdef WORDS_BIGENDIAN
388 		/*
389 		 * wk.ik_keyrsc is in host byte order (big endian), need to
390 		 * swap it to match with the byte order used in WPA.
391 		 */
392 		int i;
393 		u8 *keyrsc = (u8 *) &wk.ik_keyrsc;
394 		for (i = 0; i < seq_len; i++)
395 			keyrsc[WPA_KEY_RSC_LEN - i - 1] = seq[i];
396 #else /* WORDS_BIGENDIAN */
397 		os_memcpy(&wk.ik_keyrsc, seq, seq_len);
398 #endif /* WORDS_BIGENDIAN */
399 	}
400 	os_memcpy(wk.ik_keydata, key, key_len);
401 
402 	return set80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk));
403 }
404 
405 static int
406 bsd_configure_wpa(void *priv, struct wpa_bss_params *params)
407 {
408 #ifndef IEEE80211_IOC_APPIE
409 	static const char *ciphernames[] =
410 		{ "WEP", "TKIP", "AES-OCB", "AES-CCM", "CKIP", "NONE" };
411 	int v;
412 
413 	switch (params->wpa_group) {
414 	case WPA_CIPHER_CCMP:
415 		v = IEEE80211_CIPHER_AES_CCM;
416 		break;
417 	case WPA_CIPHER_TKIP:
418 		v = IEEE80211_CIPHER_TKIP;
419 		break;
420 	case WPA_CIPHER_WEP104:
421 		v = IEEE80211_CIPHER_WEP;
422 		break;
423 	case WPA_CIPHER_WEP40:
424 		v = IEEE80211_CIPHER_WEP;
425 		break;
426 	case WPA_CIPHER_NONE:
427 		v = IEEE80211_CIPHER_NONE;
428 		break;
429 	default:
430 		wpa_printf(MSG_INFO, "Unknown group key cipher %u",
431 			   params->wpa_group);
432 		return -1;
433 	}
434 	wpa_printf(MSG_DEBUG, "%s: group key cipher=%s (%u)",
435 		   __func__, ciphernames[v], v);
436 	if (set80211param(priv, IEEE80211_IOC_MCASTCIPHER, v)) {
437 		wpa_printf(MSG_INFO,
438 			   "Unable to set group key cipher to %u (%s)",
439 			   v, ciphernames[v]);
440 		return -1;
441 	}
442 	if (v == IEEE80211_CIPHER_WEP) {
443 		/* key length is done only for specific ciphers */
444 		v = (params->wpa_group == WPA_CIPHER_WEP104 ? 13 : 5);
445 		if (set80211param(priv, IEEE80211_IOC_MCASTKEYLEN, v)) {
446 			wpa_printf(MSG_INFO,
447 				   "Unable to set group key length to %u", v);
448 			return -1;
449 		}
450 	}
451 
452 	v = 0;
453 	if (params->wpa_pairwise & WPA_CIPHER_CCMP)
454 		v |= 1<<IEEE80211_CIPHER_AES_CCM;
455 	if (params->wpa_pairwise & WPA_CIPHER_TKIP)
456 		v |= 1<<IEEE80211_CIPHER_TKIP;
457 	if (params->wpa_pairwise & WPA_CIPHER_NONE)
458 		v |= 1<<IEEE80211_CIPHER_NONE;
459 	wpa_printf(MSG_DEBUG, "%s: pairwise key ciphers=0x%x", __func__, v);
460 	if (set80211param(priv, IEEE80211_IOC_UCASTCIPHERS, v)) {
461 		wpa_printf(MSG_INFO,
462 			   "Unable to set pairwise key ciphers to 0x%x", v);
463 		return -1;
464 	}
465 
466 	wpa_printf(MSG_DEBUG, "%s: key management algorithms=0x%x",
467 		   __func__, params->wpa_key_mgmt);
468 	if (set80211param(priv, IEEE80211_IOC_KEYMGTALGS,
469 			  params->wpa_key_mgmt)) {
470 		wpa_printf(MSG_INFO,
471 			   "Unable to set key management algorithms to 0x%x",
472 			   params->wpa_key_mgmt);
473 		return -1;
474 	}
475 
476 	v = 0;
477 	if (params->rsn_preauth)
478 		v |= BIT(0);
479 	wpa_printf(MSG_DEBUG, "%s: rsn capabilities=0x%x",
480 		   __func__, params->rsn_preauth);
481 	if (set80211param(priv, IEEE80211_IOC_RSNCAPS, v)) {
482 		wpa_printf(MSG_INFO, "Unable to set RSN capabilities to 0x%x",
483 			   v);
484 		return -1;
485 	}
486 #endif /* IEEE80211_IOC_APPIE */
487 
488 	wpa_printf(MSG_DEBUG, "%s: enable WPA= 0x%x", __func__, params->wpa);
489 	if (set80211param(priv, IEEE80211_IOC_WPA, params->wpa)) {
490 		wpa_printf(MSG_INFO, "Unable to set WPA to %u", params->wpa);
491 		return -1;
492 	}
493 	return 0;
494 }
495 
496 static int
497 bsd_set_ieee8021x(void *priv, struct wpa_bss_params *params)
498 {
499 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, params->enabled);
500 
501 	if (!params->enabled) {
502 		/* XXX restore state */
503 		return set80211param(priv, IEEE80211_IOC_AUTHMODE,
504 				     IEEE80211_AUTH_AUTO);
505 	}
506 	if (!params->wpa && !params->ieee802_1x) {
507 		wpa_printf(MSG_ERROR, "%s: No 802.1X or WPA enabled",
508 			   __func__);
509 		return -1;
510 	}
511 	if (params->wpa && bsd_configure_wpa(priv, params) != 0) {
512 		wpa_printf(MSG_ERROR, "%s: Failed to configure WPA state",
513 			   __func__);
514 		return -1;
515 	}
516 	if (set80211param(priv, IEEE80211_IOC_AUTHMODE,
517 		(params->wpa ? IEEE80211_AUTH_WPA : IEEE80211_AUTH_8021X))) {
518 		wpa_printf(MSG_ERROR, "%s: Failed to enable WPA/802.1X",
519 			   __func__);
520 		return -1;
521 	}
522 	return 0;
523 }
524 
525 static void
526 bsd_new_sta(void *priv, void *ctx, u8 addr[IEEE80211_ADDR_LEN])
527 {
528 	struct ieee80211req_wpaie ie;
529 	int ielen = 0;
530 	u8 *iebuf = NULL;
531 
532 	/*
533 	 * Fetch and validate any negotiated WPA/RSN parameters.
534 	 */
535 	memset(&ie, 0, sizeof(ie));
536 	memcpy(ie.wpa_macaddr, addr, IEEE80211_ADDR_LEN);
537 	if (get80211var(priv, IEEE80211_IOC_WPAIE, &ie, sizeof(ie)) < 0) {
538 		wpa_printf(MSG_INFO,
539 			   "Failed to get WPA/RSN information element");
540 		goto no_ie;
541 	}
542 	iebuf = ie.wpa_ie;
543 	ielen = ie.wpa_ie[1];
544 	if (ielen == 0)
545 		iebuf = NULL;
546 	else
547 		ielen += 2;
548 
549 no_ie:
550 	drv_event_assoc(ctx, addr, iebuf, ielen, 0);
551 }
552 
553 static int
554 bsd_send_eapol(void *priv, const u8 *addr, const u8 *data, size_t data_len,
555 	       int encrypt, const u8 *own_addr, u32 flags)
556 {
557 	struct bsd_driver_data *drv = priv;
558 
559 	wpa_hexdump(MSG_MSGDUMP, "TX EAPOL", data, data_len);
560 
561 	return l2_packet_send(drv->sock_xmit, addr, ETH_P_EAPOL, data,
562 			      data_len);
563 }
564 
565 static int
566 bsd_set_freq(void *priv, struct hostapd_freq_params *freq)
567 {
568 	struct bsd_driver_data *drv = priv;
569 #ifdef SIOCS80211CHANNEL
570 	struct ieee80211chanreq creq;
571 #endif /* SIOCS80211CHANNEL */
572 	u32 mode;
573 	int channel = freq->channel;
574 
575 	if (channel < 14) {
576 		mode =
577 #ifdef CONFIG_IEEE80211N
578 			freq->ht_enabled ? IFM_IEEE80211_11NG :
579 #endif /* CONFIG_IEEE80211N */
580 		        IFM_IEEE80211_11G;
581 	} else if (channel == 14) {
582 		mode = IFM_IEEE80211_11B;
583 	} else {
584 		mode =
585 #ifdef CONFIG_IEEE80211N
586 			freq->ht_enabled ? IFM_IEEE80211_11NA :
587 #endif /* CONFIG_IEEE80211N */
588 			IFM_IEEE80211_11A;
589 	}
590 	if (bsd_set_mediaopt(drv, IFM_MMASK, mode) < 0) {
591 		wpa_printf(MSG_ERROR, "%s: failed to set modulation mode",
592 			   __func__);
593 		return -1;
594 	}
595 
596 #ifdef SIOCS80211CHANNEL
597 	os_memset(&creq, 0, sizeof(creq));
598 	os_strlcpy(creq.i_name, drv->ifname, sizeof(creq.i_name));
599 	creq.i_channel = (u_int16_t)channel;
600 	return ioctl(drv->global->sock, SIOCS80211CHANNEL, &creq);
601 #else /* SIOCS80211CHANNEL */
602 	return set80211param(priv, IEEE80211_IOC_CHANNEL, channel);
603 #endif /* SIOCS80211CHANNEL */
604 }
605 
606 static int
607 bsd_set_opt_ie(void *priv, const u8 *ie, size_t ie_len)
608 {
609 #ifdef IEEE80211_IOC_APPIE
610 	wpa_printf(MSG_DEBUG, "%s: set WPA+RSN ie (len %lu)", __func__,
611 		   (unsigned long)ie_len);
612 	return bsd_set80211(priv, IEEE80211_IOC_APPIE, IEEE80211_APPIE_WPA,
613 			    ie, ie_len);
614 #endif /* IEEE80211_IOC_APPIE */
615 	return 0;
616 }
617 
618 static void
619 bsd_wireless_event_receive(int sock, void *ctx, void *sock_ctx)
620 {
621 	char event_buf[2048]; /* max size of a single route(4) msg */
622 	struct bsd_driver_global *global = sock_ctx;
623 	struct bsd_driver_data *drv;
624 	struct if_announcemsghdr *ifan;
625 	struct if_msghdr *ifm;
626 	struct rt_msghdr *rtm;
627 	union wpa_event_data event;
628 	struct ieee80211_michael_event *mic;
629 	struct ieee80211_leave_event *leave;
630 	struct ieee80211_join_event *join;
631 	int n;
632 
633 	n = read(sock, event_buf, sizeof(event_buf));
634 	if (n < 0) {
635 		if (errno != EINTR && errno != EAGAIN)
636 			wpa_printf(MSG_ERROR, "%s read() failed: %s",
637 				   __func__, strerror(errno));
638 		return;
639 	}
640 
641 	rtm = (struct rt_msghdr *) event_buf;
642 	if (rtm->rtm_version != RTM_VERSION) {
643 		wpa_printf(MSG_DEBUG, "Invalid routing message version=%d",
644 			   rtm->rtm_version);
645 		return;
646 	}
647 	os_memset(&event, 0, sizeof(event));
648 	switch (rtm->rtm_type) {
649 	case RTM_IEEE80211:
650 		ifan = (struct if_announcemsghdr *) rtm;
651 		drv = bsd_get_drvindex(global, ifan->ifan_index);
652 		if (drv == NULL)
653 			return;
654 		switch (ifan->ifan_what) {
655 		case RTM_IEEE80211_ASSOC:
656 		case RTM_IEEE80211_REASSOC:
657 			if (drv->is_ap)
658 				break;
659 			wpa_supplicant_event(drv->ctx, EVENT_ASSOC, NULL);
660 			break;
661 		case RTM_IEEE80211_DISASSOC:
662 			if (drv->is_ap)
663 				break;
664 			wpa_supplicant_event(drv->ctx, EVENT_DISASSOC, NULL);
665 			break;
666 		case RTM_IEEE80211_SCAN:
667 			if (drv->is_ap)
668 				break;
669 			wpa_supplicant_event(drv->ctx, EVENT_SCAN_RESULTS,
670 					     NULL);
671 			break;
672 		case RTM_IEEE80211_LEAVE:
673 			leave = (struct ieee80211_leave_event *) &ifan[1];
674 			drv_event_disassoc(drv->ctx, leave->iev_addr);
675 			break;
676 		case RTM_IEEE80211_JOIN:
677 #ifdef RTM_IEEE80211_REJOIN
678 		case RTM_IEEE80211_REJOIN:
679 #endif
680 			join = (struct ieee80211_join_event *) &ifan[1];
681 			bsd_new_sta(drv, drv->ctx, join->iev_addr);
682 			break;
683 		case RTM_IEEE80211_REPLAY:
684 			/* ignore */
685 			break;
686 		case RTM_IEEE80211_MICHAEL:
687 			mic = (struct ieee80211_michael_event *) &ifan[1];
688 			wpa_printf(MSG_DEBUG,
689 				"Michael MIC failure wireless event: "
690 				"keyix=%u src_addr=" MACSTR, mic->iev_keyix,
691 				MAC2STR(mic->iev_src));
692 			os_memset(&event, 0, sizeof(event));
693 			event.michael_mic_failure.unicast =
694 				!IEEE80211_IS_MULTICAST(mic->iev_dst);
695 			event.michael_mic_failure.src = mic->iev_src;
696 			wpa_supplicant_event(drv->ctx,
697 					     EVENT_MICHAEL_MIC_FAILURE, &event);
698 			break;
699 		}
700 		break;
701 	case RTM_IFANNOUNCE:
702 		ifan = (struct if_announcemsghdr *) rtm;
703 		switch (ifan->ifan_what) {
704 		case IFAN_DEPARTURE:
705 			drv = bsd_get_drvindex(global, ifan->ifan_index);
706 			if (drv)
707 				drv->if_removed = 1;
708 			event.interface_status.ievent = EVENT_INTERFACE_REMOVED;
709 			break;
710 		case IFAN_ARRIVAL:
711 			drv = bsd_get_drvname(global, ifan->ifan_name);
712 			if (drv) {
713 				drv->ifindex = ifan->ifan_index;
714 				drv->if_removed = 0;
715 			}
716 			event.interface_status.ievent = EVENT_INTERFACE_ADDED;
717 			break;
718 		default:
719 			wpa_printf(MSG_DEBUG, "RTM_IFANNOUNCE: unknown action");
720 			return;
721 		}
722 		wpa_printf(MSG_DEBUG, "RTM_IFANNOUNCE: Interface '%s' %s",
723 			   ifan->ifan_name,
724 			   ifan->ifan_what == IFAN_DEPARTURE ?
725 				"removed" : "added");
726 		os_strlcpy(event.interface_status.ifname, ifan->ifan_name,
727 			   sizeof(event.interface_status.ifname));
728 		if (drv) {
729 			wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_STATUS,
730 					     &event);
731 			/*
732 			 * Set ifindex to zero after sending the event as the
733 			 * event might query the driver to ensure a match.
734 			 */
735 			if (ifan->ifan_what == IFAN_DEPARTURE)
736 				drv->ifindex = 0;
737 		} else {
738 			wpa_supplicant_event_global(global->ctx,
739 						    EVENT_INTERFACE_STATUS,
740 						    &event);
741 		}
742 		break;
743 	case RTM_IFINFO:
744 		ifm = (struct if_msghdr *) rtm;
745 		drv = bsd_get_drvindex(global, ifm->ifm_index);
746 		if (drv == NULL)
747 			return;
748 		if ((ifm->ifm_flags & IFF_UP) == 0 &&
749 		    (drv->flags & IFF_UP) != 0) {
750 			wpa_printf(MSG_DEBUG, "RTM_IFINFO: Interface '%s' DOWN",
751 				   drv->ifname);
752 			wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_DISABLED,
753 					     NULL);
754 		} else if ((ifm->ifm_flags & IFF_UP) != 0 &&
755 		    (drv->flags & IFF_UP) == 0) {
756 			wpa_printf(MSG_DEBUG, "RTM_IFINFO: Interface '%s' UP",
757 				   drv->ifname);
758 			wpa_supplicant_event(drv->ctx, EVENT_INTERFACE_ENABLED,
759 					     NULL);
760 		}
761 		drv->flags = ifm->ifm_flags;
762 		break;
763 	}
764 }
765 
766 #ifdef HOSTAPD
767 
768 /*
769  * Avoid conflicts with hostapd definitions by undefining couple of defines
770  * from net80211 header files.
771  */
772 #undef RSN_VERSION
773 #undef WPA_VERSION
774 #undef WPA_OUI_TYPE
775 
776 static int bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr,
777 			  int reason_code);
778 
779 static const char *
780 ether_sprintf(const u8 *addr)
781 {
782 	static char buf[sizeof(MACSTR)];
783 
784 	if (addr != NULL)
785 		snprintf(buf, sizeof(buf), MACSTR, MAC2STR(addr));
786 	else
787 		snprintf(buf, sizeof(buf), MACSTR, 0,0,0,0,0,0);
788 	return buf;
789 }
790 
791 static int
792 bsd_set_privacy(void *priv, int enabled)
793 {
794 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
795 
796 	return set80211param(priv, IEEE80211_IOC_PRIVACY, enabled);
797 }
798 
799 static int
800 bsd_get_seqnum(const char *ifname, void *priv, const u8 *addr, int idx,
801 	       u8 *seq)
802 {
803 	struct ieee80211req_key wk;
804 
805 	wpa_printf(MSG_DEBUG, "%s: addr=%s idx=%d",
806 		   __func__, ether_sprintf(addr), idx);
807 
808 	memset(&wk, 0, sizeof(wk));
809 	if (addr == NULL)
810 		memset(wk.ik_macaddr, 0xff, IEEE80211_ADDR_LEN);
811 	else
812 		memcpy(wk.ik_macaddr, addr, IEEE80211_ADDR_LEN);
813 	wk.ik_keyix = idx;
814 
815 	if (get80211var(priv, IEEE80211_IOC_WPAKEY, &wk, sizeof(wk)) < 0) {
816 		wpa_printf(MSG_INFO, "Failed to get encryption");
817 		return -1;
818 	}
819 
820 #ifdef WORDS_BIGENDIAN
821 	{
822 		/*
823 		 * wk.ik_keytsc is in host byte order (big endian), need to
824 		 * swap it to match with the byte order used in WPA.
825 		 */
826 		int i;
827 		u8 tmp[WPA_KEY_RSC_LEN];
828 		memcpy(tmp, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
829 		for (i = 0; i < WPA_KEY_RSC_LEN; i++) {
830 			seq[i] = tmp[WPA_KEY_RSC_LEN - i - 1];
831 		}
832 	}
833 #else /* WORDS_BIGENDIAN */
834 	memcpy(seq, &wk.ik_keytsc, sizeof(wk.ik_keytsc));
835 #endif /* WORDS_BIGENDIAN */
836 	return 0;
837 }
838 
839 
840 static int
841 bsd_flush(void *priv)
842 {
843 	u8 allsta[IEEE80211_ADDR_LEN];
844 
845 	memset(allsta, 0xff, IEEE80211_ADDR_LEN);
846 	return bsd_sta_deauth(priv, NULL, allsta, IEEE80211_REASON_AUTH_LEAVE);
847 }
848 
849 
850 static int
851 bsd_read_sta_driver_data(void *priv, struct hostap_sta_driver_data *data,
852 			 const u8 *addr)
853 {
854 	struct ieee80211req_sta_stats stats;
855 
856 	memcpy(stats.is_u.macaddr, addr, IEEE80211_ADDR_LEN);
857 	if (get80211var(priv, IEEE80211_IOC_STA_STATS, &stats, sizeof(stats))
858 	    > 0) {
859 		/* XXX? do packets counts include non-data frames? */
860 		data->rx_packets = stats.is_stats.ns_rx_data;
861 		data->rx_bytes = stats.is_stats.ns_rx_bytes;
862 		data->tx_packets = stats.is_stats.ns_tx_data;
863 		data->tx_bytes = stats.is_stats.ns_tx_bytes;
864 	}
865 	return 0;
866 }
867 
868 static int
869 bsd_sta_deauth(void *priv, const u8 *own_addr, const u8 *addr, int reason_code)
870 {
871 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
872 				   addr);
873 }
874 
875 static int
876 bsd_sta_disassoc(void *priv, const u8 *own_addr, const u8 *addr,
877 		 int reason_code)
878 {
879 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DISASSOC, reason_code,
880 				   addr);
881 }
882 
883 static void
884 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
885 {
886 	struct bsd_driver_data *drv = ctx;
887 	drv_event_eapol_rx(drv->ctx, src_addr, buf, len);
888 }
889 
890 static void *
891 bsd_init(struct hostapd_data *hapd, struct wpa_init_params *params)
892 {
893 	struct bsd_driver_data *drv;
894 
895 	drv = os_zalloc(sizeof(struct bsd_driver_data));
896 	if (drv == NULL) {
897 		wpa_printf(MSG_ERROR, "Could not allocate memory for bsd driver data");
898 		return NULL;
899 	}
900 
901 	drv->ifindex = if_nametoindex(params->ifname);
902 	if (drv->ifindex == 0) {
903 		wpa_printf(MSG_DEBUG, "%s: interface %s does not exist",
904 			   __func__, params->ifname);
905 		goto bad;
906 	}
907 
908 	drv->ctx = hapd;
909 	drv->is_ap = 1;
910 	drv->global = params->global_priv;
911 	os_strlcpy(drv->ifname, params->ifname, sizeof(drv->ifname));
912 
913 	drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
914 					handle_read, drv, 0);
915 	if (drv->sock_xmit == NULL)
916 		goto bad;
917 	if (l2_packet_get_own_addr(drv->sock_xmit, params->own_addr))
918 		goto bad;
919 
920 	if (bsd_get_iface_flags(drv) < 0)
921 		goto bad;
922 
923 	if (bsd_set_mediaopt(drv, IFM_OMASK, IFM_IEEE80211_HOSTAP) < 0) {
924 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
925 			   __func__);
926 		goto bad;
927 	}
928 
929 	dl_list_add(&drv->global->ifaces, &drv->list);
930 
931 	return drv;
932 bad:
933 	if (drv->sock_xmit != NULL)
934 		l2_packet_deinit(drv->sock_xmit);
935 	os_free(drv);
936 	return NULL;
937 }
938 
939 
940 static void
941 bsd_deinit(void *priv)
942 {
943 	struct bsd_driver_data *drv = priv;
944 
945 	if (drv->sock_xmit != NULL)
946 		l2_packet_deinit(drv->sock_xmit);
947 	os_free(drv);
948 }
949 
950 
951 static int
952 bsd_set_sta_authorized(void *priv, const u8 *addr,
953 		       unsigned int total_flags, unsigned int flags_or,
954 		       unsigned int flags_and)
955 {
956 	int authorized = -1;
957 
958 	/* For now, only support setting Authorized flag */
959 	if (flags_or & WPA_STA_AUTHORIZED)
960 		authorized = 1;
961 	if (!(flags_and & WPA_STA_AUTHORIZED))
962 		authorized = 0;
963 
964 	if (authorized < 0)
965 		return 0;
966 
967 	return bsd_send_mlme_param(priv, authorized ?
968 				   IEEE80211_MLME_AUTHORIZE :
969 				   IEEE80211_MLME_UNAUTHORIZE, 0, addr);
970 }
971 #else /* HOSTAPD */
972 
973 static int
974 get80211param(struct bsd_driver_data *drv, int op)
975 {
976 	struct ieee80211req ireq;
977 
978 	if (bsd_get80211(drv, &ireq, op, NULL, 0) < 0)
979 		return -1;
980 	return ireq.i_val;
981 }
982 
983 static int
984 wpa_driver_bsd_get_bssid(void *priv, u8 *bssid)
985 {
986 	struct bsd_driver_data *drv = priv;
987 #ifdef SIOCG80211BSSID
988 	struct ieee80211_bssid bs;
989 
990 	os_strlcpy(bs.i_name, drv->ifname, sizeof(bs.i_name));
991 	if (ioctl(drv->global->sock, SIOCG80211BSSID, &bs) < 0)
992 		return -1;
993 	os_memcpy(bssid, bs.i_bssid, sizeof(bs.i_bssid));
994 	return 0;
995 #else
996 	return get80211var(drv, IEEE80211_IOC_BSSID,
997 		bssid, IEEE80211_ADDR_LEN) < 0 ? -1 : 0;
998 #endif
999 }
1000 
1001 static int
1002 wpa_driver_bsd_get_ssid(void *priv, u8 *ssid)
1003 {
1004 	struct bsd_driver_data *drv = priv;
1005 	return bsd_get_ssid(drv, ssid, 0);
1006 }
1007 
1008 static int
1009 wpa_driver_bsd_set_wpa_ie(struct bsd_driver_data *drv, const u8 *wpa_ie,
1010 			  size_t wpa_ie_len)
1011 {
1012 #ifdef IEEE80211_IOC_APPIE
1013 	return bsd_set_opt_ie(drv, wpa_ie, wpa_ie_len);
1014 #else /* IEEE80211_IOC_APPIE */
1015 	return set80211var(drv, IEEE80211_IOC_OPTIE, wpa_ie, wpa_ie_len);
1016 #endif /* IEEE80211_IOC_APPIE */
1017 }
1018 
1019 static int
1020 wpa_driver_bsd_set_wpa_internal(void *priv, int wpa, int privacy)
1021 {
1022 	int ret = 0;
1023 
1024 	wpa_printf(MSG_DEBUG, "%s: wpa=%d privacy=%d",
1025 		__func__, wpa, privacy);
1026 
1027 	if (!wpa && wpa_driver_bsd_set_wpa_ie(priv, NULL, 0) < 0)
1028 		ret = -1;
1029 	if (set80211param(priv, IEEE80211_IOC_PRIVACY, privacy) < 0)
1030 		ret = -1;
1031 	if (set80211param(priv, IEEE80211_IOC_WPA, wpa) < 0)
1032 		ret = -1;
1033 
1034 	return ret;
1035 }
1036 
1037 static int
1038 wpa_driver_bsd_set_wpa(void *priv, int enabled)
1039 {
1040 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
1041 
1042 	return wpa_driver_bsd_set_wpa_internal(priv, enabled ? 3 : 0, enabled);
1043 }
1044 
1045 static int
1046 wpa_driver_bsd_set_countermeasures(void *priv, int enabled)
1047 {
1048 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
1049 	return set80211param(priv, IEEE80211_IOC_COUNTERMEASURES, enabled);
1050 }
1051 
1052 
1053 static int
1054 wpa_driver_bsd_set_drop_unencrypted(void *priv, int enabled)
1055 {
1056 	wpa_printf(MSG_DEBUG, "%s: enabled=%d", __func__, enabled);
1057 	return set80211param(priv, IEEE80211_IOC_DROPUNENCRYPTED, enabled);
1058 }
1059 
1060 static int
1061 wpa_driver_bsd_deauthenticate(void *priv, const u8 *addr, int reason_code)
1062 {
1063 	return bsd_send_mlme_param(priv, IEEE80211_MLME_DEAUTH, reason_code,
1064 				   addr);
1065 }
1066 
1067 static int
1068 wpa_driver_bsd_set_auth_alg(void *priv, int auth_alg)
1069 {
1070 	int authmode;
1071 
1072 	if ((auth_alg & WPA_AUTH_ALG_OPEN) &&
1073 	    (auth_alg & WPA_AUTH_ALG_SHARED))
1074 		authmode = IEEE80211_AUTH_AUTO;
1075 	else if (auth_alg & WPA_AUTH_ALG_SHARED)
1076 		authmode = IEEE80211_AUTH_SHARED;
1077 	else
1078 		authmode = IEEE80211_AUTH_OPEN;
1079 
1080 	return set80211param(priv, IEEE80211_IOC_AUTHMODE, authmode);
1081 }
1082 
1083 static void
1084 handle_read(void *ctx, const u8 *src_addr, const u8 *buf, size_t len)
1085 {
1086 	struct bsd_driver_data *drv = ctx;
1087 
1088 	drv_event_eapol_rx(drv->ctx, src_addr, buf, len);
1089 }
1090 
1091 static int
1092 wpa_driver_bsd_associate(void *priv, struct wpa_driver_associate_params *params)
1093 {
1094 	struct bsd_driver_data *drv = priv;
1095 	struct ieee80211req_mlme mlme;
1096 	u32 mode;
1097 	int privacy;
1098 	int ret = 0;
1099 
1100 	wpa_printf(MSG_DEBUG,
1101 		"%s: ssid '%.*s' wpa ie len %u pairwise %u group %u key mgmt %u"
1102 		, __func__
1103 		   , (unsigned int) params->ssid_len, params->ssid
1104 		, (unsigned int) params->wpa_ie_len
1105 		, params->pairwise_suite
1106 		, params->group_suite
1107 		, params->key_mgmt_suite
1108 	);
1109 
1110 	switch (params->mode) {
1111 	case IEEE80211_MODE_INFRA:
1112 		mode = 0 /* STA */;
1113 		break;
1114 	case IEEE80211_MODE_IBSS:
1115 		mode = IFM_IEEE80211_IBSS;
1116 		break;
1117 	case IEEE80211_MODE_AP:
1118 		mode = IFM_IEEE80211_HOSTAP;
1119 		break;
1120 	default:
1121 		wpa_printf(MSG_ERROR, "%s: unknown operation mode", __func__);
1122 		return -1;
1123 	}
1124 	if (bsd_set_mediaopt(drv, IFM_OMASK, mode) < 0) {
1125 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
1126 			   __func__);
1127 		return -1;
1128 	}
1129 
1130 	if (params->mode == IEEE80211_MODE_AP) {
1131 		drv->sock_xmit = l2_packet_init(drv->ifname, NULL, ETH_P_EAPOL,
1132 						handle_read, drv, 0);
1133 		if (drv->sock_xmit == NULL)
1134 			return -1;
1135 		drv->is_ap = 1;
1136 		return 0;
1137 	}
1138 
1139 	if (wpa_driver_bsd_set_drop_unencrypted(drv, params->drop_unencrypted)
1140 	    < 0)
1141 		ret = -1;
1142 	if (wpa_driver_bsd_set_auth_alg(drv, params->auth_alg) < 0)
1143 		ret = -1;
1144 	/* XXX error handling is wrong but unclear what to do... */
1145 	if (wpa_driver_bsd_set_wpa_ie(drv, params->wpa_ie, params->wpa_ie_len) < 0)
1146 		return -1;
1147 
1148 	privacy = !(params->pairwise_suite == WPA_CIPHER_NONE &&
1149 	    params->group_suite == WPA_CIPHER_NONE &&
1150 	    params->key_mgmt_suite == WPA_KEY_MGMT_NONE &&
1151 	    params->wpa_ie_len == 0);
1152 	wpa_printf(MSG_DEBUG, "%s: set PRIVACY %u", __func__, privacy);
1153 
1154 	if (set80211param(drv, IEEE80211_IOC_PRIVACY, privacy) < 0)
1155 		return -1;
1156 
1157 	if (params->wpa_ie_len &&
1158 	    set80211param(drv, IEEE80211_IOC_WPA,
1159 			  params->wpa_ie[0] == WLAN_EID_RSN ? 2 : 1) < 0)
1160 		return -1;
1161 
1162 	os_memset(&mlme, 0, sizeof(mlme));
1163 	mlme.im_op = IEEE80211_MLME_ASSOC;
1164 	if (params->ssid != NULL)
1165 		os_memcpy(mlme.im_ssid, params->ssid, params->ssid_len);
1166 	mlme.im_ssid_len = params->ssid_len;
1167 	if (params->bssid != NULL)
1168 		os_memcpy(mlme.im_macaddr, params->bssid, IEEE80211_ADDR_LEN);
1169 	if (set80211var(drv, IEEE80211_IOC_MLME, &mlme, sizeof(mlme)) < 0)
1170 		return -1;
1171 	return ret;
1172 }
1173 
1174 static int
1175 wpa_driver_bsd_scan(void *priv, struct wpa_driver_scan_params *params)
1176 {
1177 	struct bsd_driver_data *drv = priv;
1178 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1179 	struct ieee80211_scan_req sr;
1180 	int i;
1181 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1182 
1183 	if (bsd_set_mediaopt(drv, IFM_OMASK, 0 /* STA */) < 0) {
1184 		wpa_printf(MSG_ERROR, "%s: failed to set operation mode",
1185 			   __func__);
1186 		return -1;
1187 	}
1188 
1189 	if (set80211param(drv, IEEE80211_IOC_ROAMING,
1190 			  IEEE80211_ROAMING_MANUAL) < 0) {
1191 		wpa_printf(MSG_ERROR, "%s: failed to set "
1192 			   "wpa_supplicant-based roaming: %s", __func__,
1193 			   strerror(errno));
1194 		return -1;
1195 	}
1196 
1197 	if (wpa_driver_bsd_set_wpa(drv, 1) < 0) {
1198 		wpa_printf(MSG_ERROR, "%s: failed to set wpa: %s", __func__,
1199 			   strerror(errno));
1200 		return -1;
1201 	}
1202 
1203 	/* NB: interface must be marked UP to do a scan */
1204 	if (!(drv->flags & IFF_UP)) {
1205 		wpa_printf(MSG_DEBUG, "%s: interface is not up, cannot scan",
1206 		           __func__);
1207 		return -1;
1208 	}
1209 
1210 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1211 	os_memset(&sr, 0, sizeof(sr));
1212 	sr.sr_flags = IEEE80211_IOC_SCAN_ACTIVE | IEEE80211_IOC_SCAN_ONCE |
1213 		IEEE80211_IOC_SCAN_NOJOIN;
1214 	sr.sr_duration = IEEE80211_IOC_SCAN_FOREVER;
1215 	if (params->num_ssids > 0) {
1216 		sr.sr_nssid = params->num_ssids;
1217 #if 0
1218 		/* Boundary check is done by upper layer */
1219 		if (sr.sr_nssid > IEEE80211_IOC_SCAN_MAX_SSID)
1220 			sr.sr_nssid = IEEE80211_IOC_SCAN_MAX_SSID;
1221 #endif
1222 
1223 		/* NB: check scan cache first */
1224 		sr.sr_flags |= IEEE80211_IOC_SCAN_CHECK;
1225 	}
1226 	for (i = 0; i < sr.sr_nssid; i++) {
1227 		sr.sr_ssid[i].len = params->ssids[i].ssid_len;
1228 		os_memcpy(sr.sr_ssid[i].ssid, params->ssids[i].ssid,
1229 			  sr.sr_ssid[i].len);
1230 	}
1231 
1232 	/* NB: net80211 delivers a scan complete event so no need to poll */
1233 	return set80211var(drv, IEEE80211_IOC_SCAN_REQ, &sr, sizeof(sr));
1234 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
1235 	/* set desired ssid before scan */
1236 	if (bsd_set_ssid(drv, params->ssids[0].ssid,
1237 			 params->ssids[0].ssid_len) < 0)
1238 		return -1;
1239 
1240 	/* NB: net80211 delivers a scan complete event so no need to poll */
1241 	return set80211param(drv, IEEE80211_IOC_SCAN_REQ, 0);
1242 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1243 }
1244 
1245 static void
1246 wpa_driver_bsd_add_scan_entry(struct wpa_scan_results *res,
1247 			      struct ieee80211req_scan_result *sr)
1248 {
1249 	struct wpa_scan_res *result, **tmp;
1250 	size_t extra_len;
1251 	u8 *pos;
1252 
1253 	extra_len = 2 + sr->isr_ssid_len;
1254 	extra_len += 2 + sr->isr_nrates;
1255 	extra_len += 3; /* ERP IE */
1256 	extra_len += sr->isr_ie_len;
1257 
1258 	result = os_zalloc(sizeof(*result) + extra_len);
1259 	if (result == NULL)
1260 		return;
1261 	os_memcpy(result->bssid, sr->isr_bssid, ETH_ALEN);
1262 	result->freq = sr->isr_freq;
1263 	result->beacon_int = sr->isr_intval;
1264 	result->caps = sr->isr_capinfo;
1265 	result->qual = sr->isr_rssi;
1266 	result->noise = sr->isr_noise;
1267 
1268 #ifdef __FreeBSD__
1269 	/*
1270 	 * the rssi value reported by the kernel is in 0.5dB steps relative to
1271 	 * the reported noise floor. see ieee80211_node.h for details.
1272 	 */
1273 	result->level = sr->isr_rssi / 2 + sr->isr_noise;
1274 #else
1275 	result->level = sr->isr_rssi;
1276 #endif
1277 
1278 	pos = (u8 *)(result + 1);
1279 
1280 	*pos++ = WLAN_EID_SSID;
1281 	*pos++ = sr->isr_ssid_len;
1282 	os_memcpy(pos, sr + 1, sr->isr_ssid_len);
1283 	pos += sr->isr_ssid_len;
1284 
1285 	/*
1286 	 * Deal all rates as supported rate.
1287 	 * Because net80211 doesn't report extended supported rate or not.
1288 	 */
1289 	*pos++ = WLAN_EID_SUPP_RATES;
1290 	*pos++ = sr->isr_nrates;
1291 	os_memcpy(pos, sr->isr_rates, sr->isr_nrates);
1292 	pos += sr->isr_nrates;
1293 
1294 	*pos++ = WLAN_EID_ERP_INFO;
1295 	*pos++ = 1;
1296 	*pos++ = sr->isr_erp;
1297 
1298 #if defined(__DragonFly__) || defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
1299 	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len + sr->isr_meshid_len,
1300 		  sr->isr_ie_len);
1301 #else
1302 	os_memcpy(pos, (u8 *)(sr + 1) + sr->isr_ssid_len, sr->isr_ie_len);
1303 #endif
1304 	pos += sr->isr_ie_len;
1305 
1306 	result->ie_len = pos - (u8 *)(result + 1);
1307 
1308 	tmp = os_realloc_array(res->res, res->num + 1,
1309 			       sizeof(struct wpa_scan_res *));
1310 	if (tmp == NULL) {
1311 		os_free(result);
1312 		return;
1313 	}
1314 	tmp[res->num++] = result;
1315 	res->res = tmp;
1316 }
1317 
1318 struct wpa_scan_results *
1319 wpa_driver_bsd_get_scan_results2(void *priv)
1320 {
1321 	struct ieee80211req_scan_result *sr;
1322 	struct wpa_scan_results *res;
1323 	int len, rest;
1324 	uint8_t buf[24*1024], *pos;
1325 
1326 	len = get80211var(priv, IEEE80211_IOC_SCAN_RESULTS, buf, 24*1024);
1327 	if (len < 0)
1328 		return NULL;
1329 
1330 	res = os_zalloc(sizeof(*res));
1331 	if (res == NULL)
1332 		return NULL;
1333 
1334 	pos = buf;
1335 	rest = len;
1336 	while (rest >= sizeof(struct ieee80211req_scan_result)) {
1337 		sr = (struct ieee80211req_scan_result *)pos;
1338 		wpa_driver_bsd_add_scan_entry(res, sr);
1339 		pos += sr->isr_len;
1340 		rest -= sr->isr_len;
1341 	}
1342 
1343 	wpa_printf(MSG_DEBUG, "Received %d bytes of scan results (%lu BSSes)",
1344 		   len, (unsigned long)res->num);
1345 
1346 	return res;
1347 }
1348 
1349 static int wpa_driver_bsd_capa(struct bsd_driver_data *drv)
1350 {
1351 #ifdef IEEE80211_IOC_DEVCAPS
1352 /* kernel definitions copied from net80211/ieee80211_var.h */
1353 #define IEEE80211_CIPHER_WEP            0
1354 #define IEEE80211_CIPHER_TKIP           1
1355 #define IEEE80211_CIPHER_AES_CCM        3
1356 #define IEEE80211_CRYPTO_WEP            (1<<IEEE80211_CIPHER_WEP)
1357 #define IEEE80211_CRYPTO_TKIP           (1<<IEEE80211_CIPHER_TKIP)
1358 #define IEEE80211_CRYPTO_AES_CCM        (1<<IEEE80211_CIPHER_AES_CCM)
1359 #define IEEE80211_C_HOSTAP      0x00000400      /* CAPABILITY: HOSTAP avail */
1360 #define IEEE80211_C_WPA1        0x00800000      /* CAPABILITY: WPA1 avail */
1361 #define IEEE80211_C_WPA2        0x01000000      /* CAPABILITY: WPA2 avail */
1362 	struct ieee80211_devcaps_req devcaps;
1363 
1364 	if (get80211var(drv, IEEE80211_IOC_DEVCAPS, &devcaps,
1365 			sizeof(devcaps)) < 0) {
1366 		wpa_printf(MSG_ERROR, "failed to IEEE80211_IOC_DEVCAPS: %s",
1367 			   strerror(errno));
1368 		return -1;
1369 	}
1370 
1371 	wpa_printf(MSG_DEBUG, "%s: drivercaps=0x%08x,cryptocaps=0x%08x",
1372 		   __func__, devcaps.dc_drivercaps, devcaps.dc_cryptocaps);
1373 
1374 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA1)
1375 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1376 			WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK;
1377 	if (devcaps.dc_drivercaps & IEEE80211_C_WPA2)
1378 		drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1379 			WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1380 
1381 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_WEP)
1382 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_WEP40 |
1383 			WPA_DRIVER_CAPA_ENC_WEP104;
1384 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_TKIP)
1385 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_TKIP;
1386 	if (devcaps.dc_cryptocaps & IEEE80211_CRYPTO_AES_CCM)
1387 		drv->capa.enc |= WPA_DRIVER_CAPA_ENC_CCMP;
1388 
1389 	if (devcaps.dc_drivercaps & IEEE80211_C_HOSTAP)
1390 		drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1391 #undef IEEE80211_CIPHER_WEP
1392 #undef IEEE80211_CIPHER_TKIP
1393 #undef IEEE80211_CIPHER_AES_CCM
1394 #undef IEEE80211_CRYPTO_WEP
1395 #undef IEEE80211_CRYPTO_TKIP
1396 #undef IEEE80211_CRYPTO_AES_CCM
1397 #undef IEEE80211_C_HOSTAP
1398 #undef IEEE80211_C_WPA1
1399 #undef IEEE80211_C_WPA2
1400 #else /* IEEE80211_IOC_DEVCAPS */
1401 	/* For now, assume TKIP, CCMP, WPA, WPA2 are supported */
1402 	drv->capa.key_mgmt = WPA_DRIVER_CAPA_KEY_MGMT_WPA |
1403 		WPA_DRIVER_CAPA_KEY_MGMT_WPA_PSK |
1404 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2 |
1405 		WPA_DRIVER_CAPA_KEY_MGMT_WPA2_PSK;
1406 	drv->capa.enc = WPA_DRIVER_CAPA_ENC_WEP40 |
1407 		WPA_DRIVER_CAPA_ENC_WEP104 |
1408 		WPA_DRIVER_CAPA_ENC_TKIP |
1409 		WPA_DRIVER_CAPA_ENC_CCMP;
1410 	drv->capa.flags |= WPA_DRIVER_FLAGS_AP;
1411 #endif /* IEEE80211_IOC_DEVCAPS */
1412 #ifdef IEEE80211_IOC_SCAN_MAX_SSID
1413 	drv->capa.max_scan_ssids = IEEE80211_IOC_SCAN_MAX_SSID;
1414 #else /* IEEE80211_IOC_SCAN_MAX_SSID */
1415 	drv->capa.max_scan_ssids = 1;
1416 #endif /* IEEE80211_IOC_SCAN_MAX_SSID */
1417 	drv->capa.auth = WPA_DRIVER_AUTH_OPEN |
1418 		WPA_DRIVER_AUTH_SHARED |
1419 		WPA_DRIVER_AUTH_LEAP;
1420 	return 0;
1421 }
1422 
1423 static enum ieee80211_opmode
1424 get80211opmode(struct bsd_driver_data *drv)
1425 {
1426 	struct ifmediareq ifmr;
1427 
1428 	(void) memset(&ifmr, 0, sizeof(ifmr));
1429 	(void) os_strlcpy(ifmr.ifm_name, drv->ifname, sizeof(ifmr.ifm_name));
1430 
1431 	if (ioctl(drv->global->sock, SIOCGIFMEDIA, (caddr_t)&ifmr) >= 0) {
1432 		if (ifmr.ifm_current & IFM_IEEE80211_ADHOC) {
1433 			if (ifmr.ifm_current & IFM_FLAG0)
1434 				return IEEE80211_M_AHDEMO;
1435 			else
1436 				return IEEE80211_M_IBSS;
1437 		}
1438 		if (ifmr.ifm_current & IFM_IEEE80211_HOSTAP)
1439 			return IEEE80211_M_HOSTAP;
1440 		if (ifmr.ifm_current & IFM_IEEE80211_MONITOR)
1441 			return IEEE80211_M_MONITOR;
1442 #ifdef IEEE80211_M_MBSS
1443 		if (ifmr.ifm_current & IFM_IEEE80211_MBSS)
1444 			return IEEE80211_M_MBSS;
1445 #endif /* IEEE80211_M_MBSS */
1446 	}
1447 	return IEEE80211_M_STA;
1448 }
1449 
1450 static void *
1451 wpa_driver_bsd_init(void *ctx, const char *ifname, void *priv)
1452 {
1453 #define	GETPARAM(drv, param, v) \
1454 	(((v) = get80211param(drv, param)) != -1)
1455 	struct bsd_driver_data *drv;
1456 
1457 	drv = os_zalloc(sizeof(*drv));
1458 	if (drv == NULL)
1459 		return NULL;
1460 
1461 	drv->ifindex = if_nametoindex(ifname);
1462 	if (drv->ifindex == 0) {
1463 		wpa_printf(MSG_DEBUG, "%s: interface %s does not exist",
1464 			   __func__, ifname);
1465 		goto fail;
1466 	}
1467 
1468 	drv->ctx = ctx;
1469 	drv->global = priv;
1470 	os_strlcpy(drv->ifname, ifname, sizeof(drv->ifname));
1471 
1472 	/* Set the interface as removed until proven to work. */
1473 	drv->if_removed = 1;
1474 
1475 	if (!GETPARAM(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming)) {
1476 		wpa_printf(MSG_DEBUG, "%s: failed to get roaming state: %s",
1477 			__func__, strerror(errno));
1478 		goto fail;
1479 	}
1480 	if (!GETPARAM(drv, IEEE80211_IOC_PRIVACY, drv->prev_privacy)) {
1481 		wpa_printf(MSG_DEBUG, "%s: failed to get privacy state: %s",
1482 			__func__, strerror(errno));
1483 		goto fail;
1484 	}
1485 	if (!GETPARAM(drv, IEEE80211_IOC_WPA, drv->prev_wpa)) {
1486 		wpa_printf(MSG_DEBUG, "%s: failed to get wpa state: %s",
1487 			__func__, strerror(errno));
1488 		goto fail;
1489 	}
1490 
1491 	if (wpa_driver_bsd_capa(drv))
1492 		goto fail;
1493 
1494 	/* Down interface during setup. */
1495 	if (bsd_get_iface_flags(drv) < 0)
1496 		goto fail;
1497 
1498 	/* Proven to work, lets go! */
1499 	drv->if_removed = 0;
1500 
1501 	drv->opmode = get80211opmode(drv);
1502 	dl_list_add(&drv->global->ifaces, &drv->list);
1503 
1504 	return drv;
1505 fail:
1506 	os_free(drv);
1507 	return NULL;
1508 #undef GETPARAM
1509 }
1510 
1511 static void
1512 wpa_driver_bsd_deinit(void *priv)
1513 {
1514 	struct bsd_driver_data *drv = priv;
1515 
1516 	if (drv->ifindex != 0 && !drv->if_removed) {
1517 		wpa_driver_bsd_set_wpa(drv, 0);
1518 
1519 		wpa_driver_bsd_set_wpa_internal(drv, drv->prev_wpa,
1520 						drv->prev_privacy);
1521 
1522 		if (set80211param(drv, IEEE80211_IOC_ROAMING, drv->prev_roaming)
1523 		    < 0)
1524 			wpa_printf(MSG_DEBUG,
1525 				   "%s: failed to restore roaming state",
1526 				   __func__);
1527 	}
1528 
1529 	if (drv->sock_xmit != NULL)
1530 		l2_packet_deinit(drv->sock_xmit);
1531 	dl_list_del(&drv->list);
1532 	os_free(drv);
1533 }
1534 
1535 static int
1536 wpa_driver_bsd_get_capa(void *priv, struct wpa_driver_capa *capa)
1537 {
1538 	struct bsd_driver_data *drv = priv;
1539 
1540 	os_memcpy(capa, &drv->capa, sizeof(*capa));
1541 	return 0;
1542 }
1543 #endif /* HOSTAPD */
1544 
1545 static void *
1546 bsd_global_init(void *ctx)
1547 {
1548 	struct bsd_driver_global *global;
1549 #ifdef RO_MSGFILTER
1550 	unsigned char msgfilter[] = {
1551 		RTM_IEEE80211,
1552 		RTM_IFINFO, RTM_IFANNOUNCE,
1553 	};
1554 #endif
1555 
1556 	global = os_zalloc(sizeof(*global));
1557 	if (global == NULL)
1558 		return NULL;
1559 
1560 	global->ctx = ctx;
1561 	dl_list_init(&global->ifaces);
1562 
1563 	global->sock = socket(PF_INET, SOCK_DGRAM, 0);
1564 	if (global->sock < 0) {
1565 		wpa_printf(MSG_ERROR, "socket[PF_INET,SOCK_DGRAM]: %s",
1566 			   strerror(errno));
1567 		goto fail1;
1568 	}
1569 
1570 	global->route = socket(PF_ROUTE, SOCK_RAW, 0);
1571 	if (global->route < 0) {
1572 		wpa_printf(MSG_ERROR, "socket[PF_ROUTE,SOCK_RAW]: %s",
1573 			   strerror(errno));
1574 		goto fail;
1575 	}
1576 
1577 #ifdef RO_MSGFILTER
1578 	if (setsockopt(global->route, PF_ROUTE, RO_MSGFILTER,
1579 	    &msgfilter, sizeof(msgfilter)) < 0)
1580 		wpa_printf(MSG_ERROR, "socket[PF_ROUTE,RO_MSGFILTER]: %s",
1581 			   strerror(errno));
1582 #endif
1583 
1584 	eloop_register_read_sock(global->route, bsd_wireless_event_receive,
1585 				 NULL, global);
1586 
1587 	return global;
1588 
1589 fail:
1590 	close(global->sock);
1591 fail1:
1592 	os_free(global);
1593 	return NULL;
1594 }
1595 
1596 static void
1597 bsd_global_deinit(void *priv)
1598 {
1599 	struct bsd_driver_global *global = priv;
1600 
1601 	eloop_unregister_read_sock(global->route);
1602 	(void) close(global->route);
1603 	(void) close(global->sock);
1604 	os_free(global);
1605 }
1606 
1607 
1608 const struct wpa_driver_ops wpa_driver_bsd_ops = {
1609 	.name			= "bsd",
1610 	.desc			= "BSD 802.11 support",
1611 	.global_init		= bsd_global_init,
1612 	.global_deinit		= bsd_global_deinit,
1613 #ifdef HOSTAPD
1614 	.hapd_init		= bsd_init,
1615 	.hapd_deinit		= bsd_deinit,
1616 	.set_privacy		= bsd_set_privacy,
1617 	.get_seqnum		= bsd_get_seqnum,
1618 	.flush			= bsd_flush,
1619 	.read_sta_data		= bsd_read_sta_driver_data,
1620 	.sta_disassoc		= bsd_sta_disassoc,
1621 	.sta_deauth		= bsd_sta_deauth,
1622 	.sta_set_flags		= bsd_set_sta_authorized,
1623 #else /* HOSTAPD */
1624 	.init2			= wpa_driver_bsd_init,
1625 	.deinit			= wpa_driver_bsd_deinit,
1626 	.get_bssid		= wpa_driver_bsd_get_bssid,
1627 	.get_ssid		= wpa_driver_bsd_get_ssid,
1628 	.set_countermeasures	= wpa_driver_bsd_set_countermeasures,
1629 	.scan2			= wpa_driver_bsd_scan,
1630 	.get_scan_results2	= wpa_driver_bsd_get_scan_results2,
1631 	.deauthenticate		= wpa_driver_bsd_deauthenticate,
1632 	.associate		= wpa_driver_bsd_associate,
1633 	.get_capa		= wpa_driver_bsd_get_capa,
1634 #endif /* HOSTAPD */
1635 	.set_freq		= bsd_set_freq,
1636 	.set_key		= bsd_set_key,
1637 	.set_ieee8021x		= bsd_set_ieee8021x,
1638 	.hapd_set_ssid		= bsd_set_ssid,
1639 	.hapd_get_ssid		= bsd_get_ssid,
1640 	.hapd_send_eapol	= bsd_send_eapol,
1641 	.set_generic_elem	= bsd_set_opt_ie,
1642 };
1643