2 * hostapd / IEEE 802.11F-2003 Inter-Access Point Protocol (IAPP)
3 * Copyright (c) 2002-2007, Jouni Malinen <j@w1.fi>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License version 2 as
7 * published by the Free Software Foundation.
9 * Alternatively, this software may be distributed under the terms of BSD
12 * See README and COPYING for more details.
14 * Note: IEEE 802.11F-2003 was a experimental use specification. It has expired
15 * and IEEE has withdrawn it. In other words, it is likely better to look at
16 * using some other mechanism for AP-to-AP communication than extending the
17 * implementation here.
21 * Level 1: no administrative or security support
22 * (e.g., static BSSID to IP address mapping in each AP)
23 * Level 2: support for dynamic mapping of BSSID to IP address
24 * Level 3: support for encryption and authentication of IAPP messages
25 * - add support for MOVE-notify and MOVE-response (this requires support for
26 * finding out IP address for previous AP using RADIUS)
27 * - add support for Send- and ACK-Security-Block to speedup IEEE 802.1X during
28 * reassociation to another AP
29 * - implement counters etc. for IAPP MIB
30 * - verify endianness of fields in IAPP messages; are they big-endian as
32 * - RADIUS connection for AP registration and BSSID to IP address mapping
33 * - TCP connection for IAPP MOVE, CACHE
34 * - broadcast ESP for IAPP ADD-notify
35 * - ESP for IAPP MOVE messages
36 * - security block sending/processing
37 * - IEEE 802.11 context transfer
42 #include <sys/ioctl.h>
43 #ifdef USE_KERNEL_HEADERS
44 #include <linux/if_packet.h>
45 #else /* USE_KERNEL_HEADERS */
46 #include <netpacket/packet.h>
47 #endif /* USE_KERNEL_HEADERS */
50 #include "ieee802_11.h"
56 #define IAPP_MULTICAST "224.0.1.178"
57 #define IAPP_UDP_PORT 3517
58 #define IAPP_TCP_PORT 3517
65 /* followed by length-6 octets of data */
66 } __attribute__ ((packed
));
68 #define IAPP_VERSION 0
71 IAPP_CMD_ADD_notify
= 0,
72 IAPP_CMD_MOVE_notify
= 1,
73 IAPP_CMD_MOVE_response
= 2,
74 IAPP_CMD_Send_Security_Block
= 3,
75 IAPP_CMD_ACK_Security_Block
= 4,
76 IAPP_CMD_CACHE_notify
= 5,
77 IAPP_CMD_CACHE_response
= 6,
81 /* ADD-notify - multicast UDP on the local LAN */
82 struct iapp_add_notify
{
83 u8 addr_len
; /* ETH_ALEN */
85 u8 mac_addr
[ETH_ALEN
];
87 } __attribute__ ((packed
));
90 /* Layer 2 Update frame (802.2 Type 1 LLC XID Update response) */
91 struct iapp_layer2_update
{
92 u8 da
[ETH_ALEN
]; /* broadcast */
93 u8 sa
[ETH_ALEN
]; /* STA addr */
95 u8 dsap
; /* null DSAP address */
96 u8 ssap
; /* null SSAP address, CR=Response */
99 } __attribute__ ((packed
));
102 /* MOVE-notify - unicast TCP */
103 struct iapp_move_notify
{
104 u8 addr_len
; /* ETH_ALEN */
106 u8 mac_addr
[ETH_ALEN
];
109 /* followed by ctx_block_len bytes */
110 } __attribute__ ((packed
));
113 /* MOVE-response - unicast TCP */
114 struct iapp_move_response
{
115 u8 addr_len
; /* ETH_ALEN */
117 u8 mac_addr
[ETH_ALEN
];
120 /* followed by ctx_block_len bytes */
121 } __attribute__ ((packed
));
124 IAPP_MOVE_SUCCESSFUL
= 0,
125 IAPP_MOVE_DENIED
= 1,
126 IAPP_MOVE_STALE_MOVE
= 2,
131 struct iapp_cache_notify
{
132 u8 addr_len
; /* ETH_ALEN */
134 u8 mac_addr
[ETH_ALEN
];
136 u8 current_ap
[ETH_ALEN
];
138 /* ctx_block_len bytes of context block followed by 16-bit context
140 } __attribute__ ((packed
));
143 /* CACHE-response - unicast TCP */
144 struct iapp_cache_response
{
145 u8 addr_len
; /* ETH_ALEN */
147 u8 mac_addr
[ETH_ALEN
];
149 } __attribute__ ((packed
));
152 IAPP_CACHE_SUCCESSFUL
= 0,
153 IAPP_CACHE_STALE_CACHE
= 1,
157 /* Send-Security-Block - unicast TCP */
158 struct iapp_send_security_block
{
161 /* followed by sec_block_len bytes of security block */
162 } __attribute__ ((packed
));
165 /* ACK-Security-Block - unicast TCP */
166 struct iapp_ack_security_block
{
168 u8 new_ap_ack_authenticator
[48];
169 } __attribute__ ((packed
));
173 struct hostapd_data
*hapd
;
174 u16 identifier
; /* next IAPP identifier */
175 struct in_addr own
, multicast
;
181 static void iapp_send_add(struct iapp_data
*iapp
, u8
*mac_addr
, u16 seq_num
)
184 struct iapp_hdr
*hdr
;
185 struct iapp_add_notify
*add
;
186 struct sockaddr_in addr
;
188 /* Send IAPP ADD-notify to remove possible association from other APs
191 hdr
= (struct iapp_hdr
*) buf
;
192 hdr
->version
= IAPP_VERSION
;
193 hdr
->command
= IAPP_CMD_ADD_notify
;
194 hdr
->identifier
= host_to_be16(iapp
->identifier
++);
195 hdr
->length
= host_to_be16(sizeof(*hdr
) + sizeof(*add
));
197 add
= (struct iapp_add_notify
*) (hdr
+ 1);
198 add
->addr_len
= ETH_ALEN
;
200 os_memcpy(add
->mac_addr
, mac_addr
, ETH_ALEN
);
202 add
->seq_num
= host_to_be16(seq_num
);
204 os_memset(&addr
, 0, sizeof(addr
));
205 addr
.sin_family
= AF_INET
;
206 addr
.sin_addr
.s_addr
= iapp
->multicast
.s_addr
;
207 addr
.sin_port
= htons(IAPP_UDP_PORT
);
208 if (sendto(iapp
->udp_sock
, buf
, (char *) (add
+ 1) - buf
, 0,
209 (struct sockaddr
*) &addr
, sizeof(addr
)) < 0)
210 perror("sendto[IAPP-ADD]");
214 static void iapp_send_layer2_update(struct iapp_data
*iapp
, u8
*addr
)
216 struct iapp_layer2_update msg
;
218 /* Send Level 2 Update Frame to update forwarding tables in layer 2
221 /* 802.2 Type 1 Logical Link Control (LLC) Exchange Identifier (XID)
222 * Update response frame; IEEE Std 802.2-1998, 5.4.1.2.1 */
224 os_memset(msg
.da
, 0xff, ETH_ALEN
);
225 os_memcpy(msg
.sa
, addr
, ETH_ALEN
);
226 msg
.len
= host_to_be16(6);
227 msg
.dsap
= 0; /* NULL DSAP address */
228 msg
.ssap
= 0x01; /* NULL SSAP address, CR Bit: Response */
229 msg
.control
= 0xaf; /* XID response lsb.1111F101.
230 * F=0 (no poll command; unsolicited frame) */
231 msg
.xid_info
[0] = 0x81; /* XID format identifier */
232 msg
.xid_info
[1] = 1; /* LLC types/classes: Type 1 LLC */
233 msg
.xid_info
[2] = 1 << 1; /* XID sender's receive window size (RW)
234 * FIX: what is correct RW with 802.11? */
236 if (send(iapp
->packet_sock
, &msg
, sizeof(msg
), 0) < 0)
237 perror("send[L2 Update]");
242 * iapp_new_station - IAPP processing for a new STA
244 * @sta: The associated station
246 void iapp_new_station(struct iapp_data
*iapp
, struct sta_info
*sta
)
248 struct ieee80211_mgmt
*assoc
;
254 assoc
= sta
->last_assoc_req
;
255 seq
= assoc
? WLAN_GET_SEQ_SEQ(le_to_host16(assoc
->seq_ctrl
)) : 0;
257 /* IAPP-ADD.request(MAC Address, Sequence Number, Timeout) */
258 hostapd_logger(iapp
->hapd
, sta
->addr
, HOSTAPD_MODULE_IAPP
,
259 HOSTAPD_LEVEL_DEBUG
, "IAPP-ADD.request(seq=%d)", seq
);
260 iapp_send_layer2_update(iapp
, sta
->addr
);
261 iapp_send_add(iapp
, sta
->addr
, seq
);
263 if (assoc
&& WLAN_FC_GET_STYPE(le_to_host16(assoc
->frame_control
)) ==
264 WLAN_FC_STYPE_REASSOC_REQ
) {
265 /* IAPP-MOVE.request(MAC Address, Sequence Number, Old AP,
266 * Context Block, Timeout)
268 /* TODO: Send IAPP-MOVE to the old AP; Map Old AP BSSID to
274 static void iapp_process_add_notify(struct iapp_data
*iapp
,
275 struct sockaddr_in
*from
,
276 struct iapp_hdr
*hdr
, int len
)
278 struct iapp_add_notify
*add
= (struct iapp_add_notify
*) (hdr
+ 1);
279 struct sta_info
*sta
;
281 if (len
!= sizeof(*add
)) {
282 printf("Invalid IAPP-ADD packet length %d (expected %lu)\n",
283 len
, (unsigned long) sizeof(*add
));
287 sta
= ap_get_sta(iapp
->hapd
, add
->mac_addr
);
289 /* IAPP-ADD.indication(MAC Address, Sequence Number) */
290 hostapd_logger(iapp
->hapd
, add
->mac_addr
, HOSTAPD_MODULE_IAPP
,
292 "Received IAPP ADD-notify (seq# %d) from %s:%d%s",
293 be_to_host16(add
->seq_num
),
294 inet_ntoa(from
->sin_addr
), ntohs(from
->sin_port
),
295 sta
? "" : " (STA not found)");
300 /* TODO: could use seq_num to try to determine whether last association
301 * to this AP is newer than the one advertised in IAPP-ADD. Although,
302 * this is not really a reliable verification. */
304 hostapd_logger(iapp
->hapd
, add
->mac_addr
, HOSTAPD_MODULE_IAPP
,
306 "Removing STA due to IAPP ADD-notify");
307 sta
->flags
&= ~(WLAN_STA_AUTH
| WLAN_STA_ASSOC
| WLAN_STA_AUTHORIZED
);
308 eloop_cancel_timeout(ap_handle_timer
, iapp
->hapd
, sta
);
309 eloop_register_timeout(0, 0, ap_handle_timer
, iapp
->hapd
, sta
);
310 sta
->timeout_next
= STA_REMOVE
;
315 * iapp_receive_udp - Process IAPP UDP frames
316 * @sock: File descriptor for the socket
317 * @eloop_ctx: IAPP data (struct iapp_data *)
318 * @sock_ctx: Not used
320 static void iapp_receive_udp(int sock
, void *eloop_ctx
, void *sock_ctx
)
322 struct iapp_data
*iapp
= eloop_ctx
;
324 unsigned char buf
[128];
325 struct sockaddr_in from
;
327 struct iapp_hdr
*hdr
;
329 /* Handle incoming IAPP frames (over UDP/IP) */
331 fromlen
= sizeof(from
);
332 len
= recvfrom(iapp
->udp_sock
, buf
, sizeof(buf
), 0,
333 (struct sockaddr
*) &from
, &fromlen
);
339 if (from
.sin_addr
.s_addr
== iapp
->own
.s_addr
)
340 return; /* ignore own IAPP messages */
342 hostapd_logger(iapp
->hapd
, NULL
, HOSTAPD_MODULE_IAPP
,
344 "Received %d byte IAPP frame from %s%s\n",
345 len
, inet_ntoa(from
.sin_addr
),
346 len
< (int) sizeof(*hdr
) ? " (too short)" : "");
348 if (len
< (int) sizeof(*hdr
))
351 hdr
= (struct iapp_hdr
*) buf
;
352 hlen
= be_to_host16(hdr
->length
);
353 hostapd_logger(iapp
->hapd
, NULL
, HOSTAPD_MODULE_IAPP
,
355 "RX: version=%d command=%d id=%d len=%d\n",
356 hdr
->version
, hdr
->command
,
357 be_to_host16(hdr
->identifier
), hlen
);
358 if (hdr
->version
!= IAPP_VERSION
) {
359 printf("Dropping IAPP frame with unknown version %d\n",
364 printf("Underflow IAPP frame (hlen=%d len=%d)\n", hlen
, len
);
368 printf("Ignoring %d extra bytes from IAPP frame\n",
373 switch (hdr
->command
) {
374 case IAPP_CMD_ADD_notify
:
375 iapp_process_add_notify(iapp
, &from
, hdr
, hlen
- sizeof(*hdr
));
377 case IAPP_CMD_MOVE_notify
:
378 /* TODO: MOVE is using TCP; so move this to TCP handler once it
379 * is implemented.. */
380 /* IAPP-MOVE.indication(MAC Address, New BSSID,
381 * Sequence Number, AP Address, Context Block) */
385 printf("Unknown IAPP command %d\n", hdr
->command
);
391 struct iapp_data
* iapp_init(struct hostapd_data
*hapd
, const char *iface
)
394 struct sockaddr_ll addr
;
396 struct sockaddr_in
*paddr
, uaddr
;
397 struct iapp_data
*iapp
;
398 struct ip_mreqn mreq
;
400 iapp
= os_zalloc(sizeof(*iapp
));
404 iapp
->udp_sock
= iapp
->packet_sock
= -1;
407 * open socket for sending and receiving IAPP frames over TCP
410 iapp
->udp_sock
= socket(PF_INET
, SOCK_DGRAM
, 0);
411 if (iapp
->udp_sock
< 0) {
412 perror("socket[PF_INET,SOCK_DGRAM]");
417 os_memset(&ifr
, 0, sizeof(ifr
));
418 os_strlcpy(ifr
.ifr_name
, iface
, sizeof(ifr
.ifr_name
));
419 if (ioctl(iapp
->udp_sock
, SIOCGIFINDEX
, &ifr
) != 0) {
420 perror("ioctl(SIOCGIFINDEX)");
424 ifindex
= ifr
.ifr_ifindex
;
426 if (ioctl(iapp
->udp_sock
, SIOCGIFADDR
, &ifr
) != 0) {
427 perror("ioctl(SIOCGIFADDR)");
431 paddr
= (struct sockaddr_in
*) &ifr
.ifr_addr
;
432 if (paddr
->sin_family
!= AF_INET
) {
433 printf("Invalid address family %i (SIOCGIFADDR)\n",
438 iapp
->own
.s_addr
= paddr
->sin_addr
.s_addr
;
440 if (ioctl(iapp
->udp_sock
, SIOCGIFBRDADDR
, &ifr
) != 0) {
441 perror("ioctl(SIOCGIFBRDADDR)");
445 paddr
= (struct sockaddr_in
*) &ifr
.ifr_addr
;
446 if (paddr
->sin_family
!= AF_INET
) {
447 printf("Invalid address family %i (SIOCGIFBRDADDR)\n",
452 inet_aton(IAPP_MULTICAST
, &iapp
->multicast
);
454 os_memset(&uaddr
, 0, sizeof(uaddr
));
455 uaddr
.sin_family
= AF_INET
;
456 uaddr
.sin_port
= htons(IAPP_UDP_PORT
);
457 if (bind(iapp
->udp_sock
, (struct sockaddr
*) &uaddr
,
458 sizeof(uaddr
)) < 0) {
464 os_memset(&mreq
, 0, sizeof(mreq
));
465 mreq
.imr_multiaddr
= iapp
->multicast
;
466 mreq
.imr_address
.s_addr
= INADDR_ANY
;
467 mreq
.imr_ifindex
= 0;
468 if (setsockopt(iapp
->udp_sock
, SOL_IP
, IP_ADD_MEMBERSHIP
, &mreq
,
470 perror("setsockopt[UDP,IP_ADD_MEMBERSHIP]");
475 iapp
->packet_sock
= socket(PF_PACKET
, SOCK_RAW
, htons(ETH_P_ALL
));
476 if (iapp
->packet_sock
< 0) {
477 perror("socket[PF_PACKET,SOCK_RAW]");
482 os_memset(&addr
, 0, sizeof(addr
));
483 addr
.sll_family
= AF_PACKET
;
484 addr
.sll_ifindex
= ifindex
;
485 if (bind(iapp
->packet_sock
, (struct sockaddr
*) &addr
,
487 perror("bind[PACKET]");
492 if (eloop_register_read_sock(iapp
->udp_sock
, iapp_receive_udp
,
494 printf("Could not register read socket for IAPP.\n");
499 printf("IEEE 802.11F (IAPP) using interface %s\n", iface
);
501 /* TODO: For levels 2 and 3: send RADIUS Initiate-Request, receive
502 * RADIUS Initiate-Accept or Initiate-Reject. IAPP port should actually
503 * be openned only after receiving Initiate-Accept. If Initiate-Reject
504 * is received, IAPP is not started. */
510 void iapp_deinit(struct iapp_data
*iapp
)
512 struct ip_mreqn mreq
;
517 if (iapp
->udp_sock
>= 0) {
518 os_memset(&mreq
, 0, sizeof(mreq
));
519 mreq
.imr_multiaddr
= iapp
->multicast
;
520 mreq
.imr_address
.s_addr
= INADDR_ANY
;
521 mreq
.imr_ifindex
= 0;
522 if (setsockopt(iapp
->udp_sock
, SOL_IP
, IP_DROP_MEMBERSHIP
,
523 &mreq
, sizeof(mreq
)) < 0) {
524 perror("setsockopt[UDP,IP_DEL_MEMBERSHIP]");
527 eloop_unregister_read_sock(iapp
->udp_sock
);
528 close(iapp
->udp_sock
);
530 if (iapp
->packet_sock
>= 0) {
531 eloop_unregister_read_sock(iapp
->packet_sock
);
532 close(iapp
->packet_sock
);
537 int iapp_reconfig(struct hostapd_data
*hapd
, struct hostapd_config
*oldconf
,
538 struct hostapd_bss_config
*oldbss
)
540 if (hapd
->conf
->ieee802_11f
!= oldbss
->ieee802_11f
||
541 os_strcmp(hapd
->conf
->iapp_iface
, oldbss
->iapp_iface
) != 0) {
542 iapp_deinit(hapd
->iapp
);
545 if (hapd
->conf
->ieee802_11f
) {
546 hapd
->iapp
= iapp_init(hapd
, hapd
->conf
->iapp_iface
);
547 if (hapd
->iapp
== NULL
)