// SPDX-License-Identifier: GPL-2.0/* * cfg80211 MLME SAP interface * * Copyright (c) 2009, Jouni Malinen <j@w1.fi> * Copyright (c) 2015		Intel Deutschland GmbH * Copyright (C) 2019-2020, 2022-2026 Intel Corporation */ #include <linux/kernel.h>#include <linux/module.h>#include <linux/etherdevice.h>#include <linux/netdevice.h>#include <linux/nl80211.h>#include <linux/slab.h>#include <linux/wireless.h>#include <net/cfg80211.h>#include <net/iw_handler.h>#include "core.h"#include "nl80211.h"#include "rdev-ops.h"  void cfg80211_rx_assoc_resp(struct net_device *dev,			    const struct cfg80211_rx_assoc_resp_data *data){	struct wireless_dev *wdev = dev->ieee80211_ptr;	struct wiphy *wiphy = wdev->wiphy;	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)data->buf;	struct cfg80211_connect_resp_params cr = {		.timeout_reason = NL80211_TIMEOUT_UNSPECIFIED,		.req_ie = data->req_ies,		.req_ie_len = data->req_ies_len,		.ap_mld_addr = data->ap_mld_addr,		.assoc_encrypted = data->assoc_encrypted,	};	unsigned int link_id;	bool is_s1g = false; 	for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {		cr.links[link_id].status = data->links[link_id].status;		cr.links[link_id].bss = data->links[link_id].bss; 		WARN_ON_ONCE(cr.links[link_id].status != WLAN_STATUS_SUCCESS &&			     (!cr.ap_mld_addr || !cr.links[link_id].bss)); 		if (!cr.links[link_id].bss)			continue;		cr.links[link_id].bssid = data->links[link_id].bss->bssid;		cr.links[link_id].addr = data->links[link_id].addr;		/* need to have local link addresses for MLO connections */		WARN_ON(cr.ap_mld_addr &&			!is_valid_ether_addr(cr.links[link_id].addr)); 		BUG_ON(!cr.links[link_id].bss->channel); 		if (cr.links[link_id].bss->channel->band == NL80211_BAND_S1GHZ) {			WARN_ON(link_id);			is_s1g = true;		} 		if (cr.ap_mld_addr)			cr.valid_links |= BIT(link_id);	} 	if (is_s1g) {		if (data->len < offsetof(struct ieee80211_mgmt,					 u.s1g_assoc_resp.variable))			goto free_bss;		cr.resp_ie = (u8 *)&mgmt->u.s1g_assoc_resp.variable;		cr.resp_ie_len = data->len -				 offsetof(struct ieee80211_mgmt,					  u.s1g_assoc_resp.variable);	} else {		if (data->len < offsetof(struct ieee80211_mgmt,					 u.assoc_resp.variable))			goto free_bss;		cr.resp_ie = mgmt->u.assoc_resp.variable;		cr.resp_ie_len = data->len -				 offsetof(struct ieee80211_mgmt,					  u.assoc_resp.variable);	}	cr.status = le16_to_cpu(mgmt->u.assoc_resp.status_code); 	trace_cfg80211_send_rx_assoc(dev, data); 	/*	 * This is a bit of a hack, we don't notify userspace of	 * a (re-)association reply if we tried to send a reassoc	 * and got a reject -- we only try again with an assoc	 * frame instead of reassoc.	 */	if (cfg80211_sme_rx_assoc_resp(wdev, cr.status))		goto free_bss; 	nl80211_send_rx_assoc(rdev, dev, data);	/* update current_bss etc., consumes the bss reference */	__cfg80211_connect_result(dev, &cr, cr.status == WLAN_STATUS_SUCCESS);	return; free_bss:	for (link_id = 0; link_id < ARRAY_SIZE(data->links); link_id++) {		struct cfg80211_bss *bss = data->links[link_id].bss; 		if (!bss)			continue; 		cfg80211_unhold_bss(bss_from_pub(bss));		cfg80211_put_bss(wiphy, bss);	}}EXPORT_SYMBOL(cfg80211_rx_assoc_resp); static void cfg80211_process_auth(struct wireless_dev *wdev,				  const u8 *buf, size_t len){	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy); 	nl80211_send_rx_auth(rdev, wdev->netdev, buf, len, GFP_KERNEL);	cfg80211_sme_rx_auth(wdev, buf, len);} static void cfg80211_process_deauth(struct wireless_dev *wdev,				    const u8 *buf, size_t len,				    bool reconnect){	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;	const u8 *bssid = mgmt->bssid;	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 	nl80211_send_deauth(rdev, wdev->netdev, buf, len, reconnect, GFP_KERNEL); 	if (!wdev->connected || !ether_addr_equal(wdev->u.client.connected_addr, bssid))		return; 	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);	cfg80211_sme_deauth(wdev);} static void cfg80211_process_disassoc(struct wireless_dev *wdev,				      const u8 *buf, size_t len,				      bool reconnect){	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);	struct ieee80211_mgmt *mgmt = (struct ieee80211_mgmt *)buf;	const u8 *bssid = mgmt->bssid;	u16 reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);	bool from_ap = !ether_addr_equal(mgmt->sa, wdev->netdev->dev_addr); 	nl80211_send_disassoc(rdev, wdev->netdev, buf, len, reconnect,			      GFP_KERNEL); 	if (WARN_ON(!wdev->connected ||		    !ether_addr_equal(wdev->u.client.connected_addr, bssid)))		return; 	__cfg80211_disconnected(wdev->netdev, NULL, 0, reason_code, from_ap);	cfg80211_sme_disassoc(wdev);} void cfg80211_rx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len){	struct wireless_dev *wdev = dev->ieee80211_ptr;	struct ieee80211_mgmt *mgmt = (void *)buf;	__le16 fc; 	lockdep_assert_wiphy(wdev->wiphy); 	if (len < sizeof(fc))		return; 	fc = mgmt->frame_control; 	if (ieee80211_is_auth(fc)) {		if (len < offsetofend(struct ieee80211_mgmt, u.auth.status_code))			return;	} else if (ieee80211_is_deauth(fc)) {		if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))			return;	} else if (ieee80211_is_disassoc(fc)) {		if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code))			return;	} else {		return;	} 	trace_cfg80211_rx_mlme_mgmt(dev, buf, len); 	if (ieee80211_is_auth(fc))		cfg80211_process_auth(wdev, buf, len);	else if (ieee80211_is_deauth(fc))		cfg80211_process_deauth(wdev, buf, len, false);	else		cfg80211_process_disassoc(wdev, buf, len, false);}EXPORT_SYMBOL(cfg80211_rx_mlme_mgmt); void cfg80211_auth_timeout(struct net_device *dev, const u8 *addr){	struct wireless_dev *wdev = dev->ieee80211_ptr;	struct wiphy *wiphy = wdev->wiphy;	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy); 	trace_cfg80211_send_auth_timeout(dev, addr); 	nl80211_send_auth_timeout(rdev, dev, addr, GFP_KERNEL);	cfg80211_sme_auth_timeout(wdev);}EXPORT_SYMBOL(cfg80211_auth_timeout); void cfg80211_assoc_failure(struct net_device *dev,			    struct cfg80211_assoc_failure *data){	struct wireless_dev *wdev = dev->ieee80211_ptr;	struct wiphy *wiphy = wdev->wiphy;	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);	const u8 *addr = data->ap_mld_addr ?: data->bss[0]->bssid;	int i; 	trace_cfg80211_send_assoc_failure(dev, data); 	if (data->timeout) {		nl80211_send_assoc_timeout(rdev, dev, addr, GFP_KERNEL);		cfg80211_sme_assoc_timeout(wdev);	} else {		cfg80211_sme_abandon_assoc(wdev);	} 	for (i = 0; i < ARRAY_SIZE(data->bss); i++) {		struct cfg80211_bss *bss = data->bss[i]; 		if (!bss)			continue; 		cfg80211_unhold_bss(bss_from_pub(bss));		cfg80211_put_bss(wiphy, bss);	}}EXPORT_SYMBOL(cfg80211_assoc_failure); void cfg80211_tx_mlme_mgmt(struct net_device *dev, const u8 *buf, size_t len,			   bool reconnect){	struct wireless_dev *wdev = dev->ieee80211_ptr;	struct ieee80211_mgmt *mgmt = (void *)buf;	__le16 fc; 	lockdep_assert_wiphy(wdev->wiphy); 	if (len < sizeof(fc))		return; 	fc = mgmt->frame_control; 	if (ieee80211_is_deauth(fc)) {		if (len < offsetofend(struct ieee80211_mgmt, u.deauth.reason_code))			return;	} else if (ieee80211_is_disassoc(fc)) {		if (len < offsetofend(struct ieee80211_mgmt, u.disassoc.reason_code))			return;	} else {		return;	} 	trace_cfg80211_tx_mlme_mgmt(dev, buf, len, reconnect); 	if (ieee80211_is_deauth(fc))		cfg80211_process_deauth(wdev, buf, len, reconnect);	else		cfg80211_process_disassoc(wdev, buf, len, reconnect);}EXPORT_SYMBOL(cfg80211_tx_mlme_mgmt); void cfg80211_michael_mic_failure(struct net_device *dev, const u8 *addr,				  enum nl80211_key_type key_type, int key_id,				  const u8 *tsc, gfp_t gfp){	struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;	struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);#ifdef CONFIG_CFG80211_WEXT	union iwreq_data wrqu;	char *buf = kmalloc(128, gfp); 	if (buf) {		memset(&wrqu, 0, sizeof(wrqu));		wrqu.data.length =			sprintf(buf, "MLME-MICHAELMICFAILURE."				"indication(keyid=%d %scast addr=%pM)",				key_id, key_type == NL80211_KEYTYPE_GROUP				? "broad" : "uni", addr);		wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);		kfree(buf);	}#endif 	trace_cfg80211_michael_mic_failure(dev, addr, key_type, key_id, tsc);	nl80211_michael_mic_failure(rdev, dev, addr, key_type, key_id, tsc, gfp);}EXPORT_SYMBOL(cfg80211_michael_mic_failure); /* some MLME handling for userspace SME */int cfg80211_mlme_auth(struct cfg80211_registered_device *rdev,		       struct net_device *dev,		       struct cfg80211_auth_request *req){	struct wireless_dev *wdev = dev->ieee80211_ptr; 	lockdep_assert_wiphy(wdev->wiphy); 	if (!req->bss)		return -ENOENT; 	if (req->link_id >= 0 &&	    !(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))		return -EINVAL; 	if (req->auth_type == NL80211_AUTHTYPE_SHARED_KEY) {		if (!req->key || !req->key_len ||		    req->key_idx < 0 || req->key_idx > 3)			return -EINVAL;	} 	if (wdev->connected &&	    ether_addr_equal(req->bss->bssid, wdev->u.client.connected_addr))		return -EALREADY; 	if (ether_addr_equal(req->bss->bssid, dev->dev_addr) ||	    (req->link_id >= 0 &&	     ether_addr_equal(req->ap_mld_addr, dev->dev_addr)))		return -EINVAL; 	return rdev_auth(rdev, dev, req);} /*  Do a logical ht_capa &= ht_capa_mask.  */void cfg80211_oper_and_ht_capa(struct ieee80211_ht_cap *ht_capa,			       const struct ieee80211_ht_cap *ht_capa_mask){	int i;	u8 *p1, *p2;	if (!ht_capa_mask) {		memset(ht_capa, 0, sizeof(*ht_capa));		return;	} 	p1 = (u8*)(ht_capa);	p2 = (u8*)(ht_capa_mask);	for (i = 0; i < sizeof(*ht_capa); i++)		p1[i] &= p2[i];} /*  Do a logical vht_capa &= vht_capa_mask.  */void cfg80211_oper_and_vht_capa(struct ieee80211_vht_cap *vht_capa,				const struct ieee80211_vht_cap *vht_capa_mask){	int i;	u8 *p1, *p2;	if (!vht_capa_mask) {		memset(vht_capa, 0, sizeof(*vht_capa));		return;	} 	p1 = (u8*)(vht_capa);	p2 = (u8*)(vht_capa_mask);	for (i = 0; i < sizeof(*vht_capa); i++)		p1[i] &= p2[i];} static intcfg80211_mlme_check_mlo_compat(const struct ieee80211_multi_link_elem *mle_a,			       const struct ieee80211_multi_link_elem *mle_b,			       struct netlink_ext_ack *extack){	const struct ieee80211_mle_basic_common_info *common_a, *common_b; 	common_a = (const void *)mle_a->variable;	common_b = (const void *)mle_b->variable; 	if (memcmp(common_a->mld_mac_addr, common_b->mld_mac_addr, ETH_ALEN)) {		NL_SET_ERR_MSG(extack, "AP MLD address mismatch");		return -EINVAL;	} 	if (ieee80211_mle_get_eml_cap((const u8 *)mle_a) !=	    ieee80211_mle_get_eml_cap((const u8 *)mle_b)) {		NL_SET_ERR_MSG(extack, "link EML capabilities mismatch");		return -EINVAL;	} 	if (ieee80211_mle_get_mld_capa_op((const u8 *)mle_a) !=	    ieee80211_mle_get_mld_capa_op((const u8 *)mle_b)) {		NL_SET_ERR_MSG(extack, "link MLD capabilities/ops mismatch");		return -EINVAL;	} 	/*	 * Only verify the values in Extended MLD Capabilities that are	 * not reserved when transmitted by an AP (and expected to remain the	 * same over time).	 * The Recommended Max Simultaneous Links subfield in particular is	 * reserved when included in a unicast Probe Response frame and may	 * also change when the AP adds/removes links. The BTM MLD	 * Recommendation For Multiple APs Support subfield is reserved when	 * transmitted by an AP.	 */	if ((ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_a) &	     (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE |	      IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE |	      IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK |	      IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM)) !=	    (ieee80211_mle_get_ext_mld_capa_op((const u8 *)mle_b) &	     (IEEE80211_EHT_ML_EXT_MLD_CAPA_OP_PARAM_UPDATE |	      IEEE80211_EHT_ML_EXT_MLD_CAPA_NSTR_UPDATE |	      IEEE80211_EHT_ML_EXT_MLD_CAPA_EMLSR_ENA_ON_ONE_LINK |	      IEEE80211_UHR_ML_EXT_MLD_CAPA_ML_PM))) {		NL_SET_ERR_MSG(extack,			       "extended link MLD capabilities/ops mismatch");		return -EINVAL;	} 	return 0;} static int cfg80211_mlme_check_mlo(struct net_device *dev,				   struct cfg80211_assoc_request *req,				   struct netlink_ext_ack *extack){	const struct ieee80211_multi_link_elem *mles[ARRAY_SIZE(req->links)] = {};	int i; 	if (req->link_id < 0)		return 0; 	if (!req->links[req->link_id].bss) {		NL_SET_ERR_MSG(extack, "no BSS for assoc link");		return -EINVAL;	} 	rcu_read_lock();	for (i = 0; i < ARRAY_SIZE(req->links); i++) {		const struct cfg80211_bss_ies *ies;		const struct element *ml; 		if (!req->links[i].bss)			continue; 		if (ether_addr_equal(req->links[i].bss->bssid, dev->dev_addr)) {			NL_SET_ERR_MSG(extack, "BSSID must not be our address");			req->links[i].error = -EINVAL;			goto error;		} 		ies = rcu_dereference(req->links[i].bss->ies);		ml = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_MULTI_LINK,					    ies->data, ies->len);		if (!ml) {			NL_SET_ERR_MSG(extack, "MLO BSS w/o ML element");			req->links[i].error = -EINVAL;			goto error;		} 		if (!ieee80211_mle_type_ok(ml->data + 1,					   IEEE80211_ML_CONTROL_TYPE_BASIC,					   ml->datalen - 1)) {			NL_SET_ERR_MSG(extack, "BSS with invalid ML element");			req->links[i].error = -EINVAL;			goto error;		} 		mles[i] = (const void *)(ml->data + 1); 		if (ieee80211_mle_get_link_id((const u8 *)mles[i]) != i) {			NL_SET_ERR_MSG(extack, "link ID mismatch");			req->links[i].error = -EINVAL;			goto error;		}	} 	if (WARN_ON(!mles[req->link_id]))		goto error; 	for (i = 0; i < ARRAY_SIZE(req->links); i++) {		if (i == req->link_id || !req->links[i].bss)			continue; 		if (WARN_ON(!mles[i]))			goto error; 		if (cfg80211_mlme_check_mlo_compat(mles[req->link_id], mles[i],						   extack)) {			req->links[i].error = -EINVAL;			goto error;		}	} 	rcu_read_unlock();	return 0;

Lines 1–500 of 1477. Load more