Head

GCC Code Coverage Report

Directory:	./		Exec	Total	Coverage
File:	usr.sbin/hostapd/handle.c	Lines:	0	224	0.0 %
Date:	2017-11-07	Branches:	0	287	0.0 %


/*	$OpenBSD: handle.c,v 1.12 2015/01/16 06:40:17 deraadt Exp $	*/

/*
 * Copyright (c) 2005, 2006 Reyk Floeter <reyk@openbsd.org>
 *
 * Permission to use, copy, modify, and distribute this software for any
 * purpose with or without fee is hereby granted, provided that the above
 * copyright notice and this permission notice appear in all copies.
 *
 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 */

#include <sys/ioctl.h>
#include <sys/types.h>
#include <sys/socket.h>
#include <sys/time.h>

#include <net/if.h>
#include <net/if_dl.h>
#include <net/if_media.h>
#include <net/if_arp.h>
#include <net/if_llc.h>
#include <net/bpf.h>

#include <netinet/in.h>
#include <netinet/if_ether.h>
#include <arpa/inet.h>

#include <net80211/ieee80211.h>
#include <net80211/ieee80211_radiotap.h>

#include <fcntl.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <limits.h>

#include "hostapd.h"

int	 hostapd_handle_frame(struct hostapd_apme *, struct hostapd_frame *,
	    u_int8_t *, const u_int);
int	 hostapd_handle_action(struct hostapd_apme *, struct hostapd_frame *,
	    u_int8_t *, u_int8_t *, u_int8_t *, u_int8_t *, const u_int);
void	 hostapd_handle_addr(const u_int32_t, u_int32_t *, u_int8_t *,
	    u_int8_t *, struct hostapd_table *);
void	 hostapd_handle_ref(u_int, u_int, u_int8_t *, u_int8_t *, u_int8_t *,
	    u_int8_t *);
int	 hostapd_handle_radiotap(struct hostapd_radiotap *, u_int8_t *,
	    const u_int);
int	 hostapd_cmp(enum hostapd_op, int, int);

int
hostapd_handle_input(struct hostapd_apme *apme, u_int8_t *buf, u_int len)
{
	struct hostapd_config *cfg = (struct hostapd_config *)apme->a_cfg;
	struct hostapd_frame *frame;
	int ret;

	TAILQ_FOREACH(frame, &cfg->c_frames, f_entries) {
		if ((ret = hostapd_handle_frame(apme, frame, buf, len)) != 0)
			return (ret);
	}

	return (0);
}

void
hostapd_handle_addr(const u_int32_t mask, u_int32_t *flags, u_int8_t *addr,
    u_int8_t *maddr, struct hostapd_table *table)
{
	int ret = 0;

	if ((*flags & mask) & HOSTAPD_FRAME_TABLE) {
		if (hostapd_entry_lookup(table, addr) == NULL)
			ret = 1;
	} else if (bcmp(addr, maddr, IEEE80211_ADDR_LEN) != 0)
			ret = 1;

	if ((ret == 1 && (*flags & mask) & HOSTAPD_FRAME_N) ||
	    (ret == 0 && ((*flags & mask) & HOSTAPD_FRAME_N) == 0))
		*flags &= ~mask;
}

void
hostapd_handle_ref(u_int flags, u_int shift, u_int8_t *wfrom, u_int8_t *wto,
    u_int8_t *wbssid, u_int8_t *addr)
{
	if (flags & (HOSTAPD_ACTION_F_REF_FROM << shift))
		bcopy(wfrom, addr, IEEE80211_ADDR_LEN);
	else if (flags & (HOSTAPD_ACTION_F_REF_TO << shift))
		bcopy(wto, addr, IEEE80211_ADDR_LEN);
	else if (flags & (HOSTAPD_ACTION_F_REF_BSSID << shift))
		bcopy(wbssid, addr, IEEE80211_ADDR_LEN);
	else if (flags & (HOSTAPD_ACTION_F_REF_RANDOM << shift)) {
		hostapd_randval(addr, IEEE80211_ADDR_LEN);
		/* Avoid multicast/broadcast addresses */
		addr[0] &= ~0x1;
	}
}

int
hostapd_handle_frame(struct hostapd_apme *apme, struct hostapd_frame *frame,
    u_int8_t *buf, const u_int len)
{
	struct hostapd_config *cfg = (struct hostapd_config *)apme->a_cfg;
	struct ieee80211_frame *wh;
	struct hostapd_ieee80211_frame *mh;
	struct hostapd_radiotap rtap;
	u_int8_t *wfrom, *wto, *wbssid;
	struct timeval t_now;
	u_int32_t flags;
	int offset, min_rate = 0, val;

	if ((offset = hostapd_apme_offset(apme, buf, len)) < 0)
		return (0);
	wh = (struct ieee80211_frame *)(buf + offset);

	mh = &frame->f_frame;
	flags = frame->f_flags;

	/* Get timestamp */
	if (gettimeofday(&t_now, NULL) == -1)
		hostapd_fatal("gettimeofday");

	/* Handle optional limit */
	if (frame->f_limit.tv_sec || frame->f_limit.tv_usec) {
		if (timercmp(&t_now, &frame->f_then, <))
			return (0);
		timeradd(&t_now, &frame->f_limit, &frame->f_then);
	}

	switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
	case IEEE80211_FC1_DIR_NODS:
		wfrom = wh->i_addr2;
		wto = wh->i_addr1;
		wbssid = wh->i_addr3;
		break;
	case IEEE80211_FC1_DIR_TODS:
		wfrom = wh->i_addr2;
		wto = wh->i_addr3;
		wbssid = wh->i_addr1;
		break;
	case IEEE80211_FC1_DIR_FROMDS:
		wfrom = wh->i_addr3;
		wto = wh->i_addr1;
		wbssid = wh->i_addr2;
		break;
	default:
	case IEEE80211_FC1_DIR_DSTODS:
		return (0);
	}

	if (flags & HOSTAPD_FRAME_F_APME_M) {
		if (frame->f_apme == NULL)
			return (0);
		/* Match hostap interface */
		if ((flags & HOSTAPD_FRAME_F_APME &&
		    apme == frame->f_apme) ||
		    (flags & HOSTAPD_FRAME_F_APME_N &&
		    apme != frame->f_apme))
			flags &= ~HOSTAPD_FRAME_F_APME_M;
	}

	if (flags & HOSTAPD_FRAME_F_TYPE) {
		/* type $type */
		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
		    (mh->i_fc[0] & IEEE80211_FC0_TYPE_MASK))
			flags &= ~HOSTAPD_FRAME_F_TYPE;
	} else if (flags & HOSTAPD_FRAME_F_TYPE_N) {
		/* type !$type */
		if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
		    (mh->i_fc[0] & IEEE80211_FC0_TYPE_MASK))
			flags &= ~HOSTAPD_FRAME_F_TYPE_N;
	}

	if (flags & HOSTAPD_FRAME_F_SUBTYPE) {
		/* subtype $subtype */
		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
		    (mh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK))
			flags &= ~HOSTAPD_FRAME_F_SUBTYPE;
	} else if (flags & HOSTAPD_FRAME_F_SUBTYPE_N) {
		/* subtype !$subtype */
		if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) !=
		    (mh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK))
			flags &= ~HOSTAPD_FRAME_F_SUBTYPE_N;
	}

	if (flags & HOSTAPD_FRAME_F_DIR) {
		/* dir $dir */
		if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) ==
		    (mh->i_fc[1] & IEEE80211_FC1_DIR_MASK))
			flags &= ~HOSTAPD_FRAME_F_DIR;
	} else if (flags & HOSTAPD_FRAME_F_DIR_N) {
		/* dir !$dir */
		if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
		    (mh->i_fc[1] & IEEE80211_FC1_DIR_MASK))
			flags &= ~HOSTAPD_FRAME_F_DIR_N;
	}

	/* from/to/bssid [!]$addr/<table> */
	hostapd_handle_addr(HOSTAPD_FRAME_F_FROM_M, &flags, wfrom,
	    mh->i_from, frame->f_from);
	hostapd_handle_addr(HOSTAPD_FRAME_F_TO_M, &flags, wto,
	    mh->i_to, frame->f_to);
	hostapd_handle_addr(HOSTAPD_FRAME_F_BSSID_M, &flags, wbssid,
	    mh->i_bssid, frame->f_bssid);

	/* parse the optional radiotap header if required */
	if (frame->f_radiotap) {
		if (hostapd_handle_radiotap(&rtap, buf, len) != 0)
			return (0);
		else if ((rtap.r_present & frame->f_radiotap) !=
		    frame->f_radiotap) {
			cfg->c_stats.cn_rtap_miss++;
			return (0);
		}
		if (flags & HOSTAPD_FRAME_F_RSSI && rtap.r_max_rssi) {
			val = ((float)rtap.r_rssi / rtap.r_max_rssi) * 100;
			if (hostapd_cmp(frame->f_rssi_op,
			    val, frame->f_rssi))
				flags &= ~HOSTAPD_FRAME_F_RSSI;
		}
		if (flags & HOSTAPD_FRAME_F_RATE) {
			val = rtap.r_txrate;
			if (hostapd_cmp(frame->f_txrate_op,
			    val, frame->f_txrate))
				flags &= ~HOSTAPD_FRAME_F_RATE;
		}
		if (flags & HOSTAPD_FRAME_F_CHANNEL) {
			val = rtap.r_chan;
			if (hostapd_cmp(frame->f_chan_op,
			    val, frame->f_chan))
				flags &= ~HOSTAPD_FRAME_F_CHANNEL;
		}
	}

	/* Handle if frame matches */
	if ((flags & HOSTAPD_FRAME_F_M) != 0)
		return (0);

	/* Handle optional minimal rate */
	if (frame->f_rate && frame->f_rate_intval) {
		frame->f_rate_delay = t_now.tv_sec - frame->f_last.tv_sec;
		if (frame->f_rate_delay < frame->f_rate_intval) {
			frame->f_rate_cnt++;
			if (frame->f_rate_cnt < frame->f_rate)
				min_rate = 1;
		} else {
			min_rate = 1;
			frame->f_rate_cnt = 0;
		}
	}

	/* Update timestamp for the last match of this event */
	if (frame->f_rate_cnt == 0 || min_rate == 0)
		bcopy(&t_now, &frame->f_last, sizeof(struct timeval));

	/* Return if the minimal rate is not reached, yet */
	if (min_rate)
		return (0);

	if (hostapd_handle_action(apme, frame, wfrom, wto, wbssid, buf,
	    len) != 0)
		return (0);

	/* Reset minimal rate counter after successfully handled the frame */
	frame->f_rate_cnt = 0;

	return ((frame->f_flags & HOSTAPD_FRAME_F_RET_M) >>
	    HOSTAPD_FRAME_F_RET_S);
}

int
hostapd_handle_action(struct hostapd_apme *apme, struct hostapd_frame *frame,
    u_int8_t *wfrom, u_int8_t *wto, u_int8_t *wbssid, u_int8_t *buf,
    const u_int len)
{
	struct hostapd_config *cfg = (struct hostapd_config *)apme->a_cfg;
	struct hostapd_iapp *iapp = &cfg->c_iapp;
	struct hostapd_action_data *action = &frame->f_action_data;
	struct hostapd_node node;
	u_int8_t *lladdr = NULL;
	int ret = 0, offset;

	switch (frame->f_action) {
	case HOSTAPD_ACTION_RADIOTAP:
		/* Send IAPP frame with radiotap/pcap payload */
		if ((ret = hostapd_iapp_radiotap(apme, buf, len)) != 0)
			return (ret);

		if ((frame->f_action_flags & HOSTAPD_ACTION_VERBOSE) == 0)
			return (0);

		hostapd_log(HOSTAPD_LOG,
		    "%s: sent IAPP frame HOSTAPD_%s (%u bytes)",
		    iapp->i_iface, cfg->c_apme_dlt ==
		    DLT_IEEE802_11_RADIO ? "RADIOTAP" : "PCAP", len);
		break;

	case HOSTAPD_ACTION_LOG:
		/* Log frame to syslog/stderr */
		if (frame->f_rate && frame->f_rate_intval) {
			hostapd_printf("%s: (rate: %ld/%ld sec) ",
			    apme->a_iface, frame->f_rate_cnt,
			    frame->f_rate_delay + 1);
		} else
			hostapd_printf("%s: ", apme->a_iface);

		hostapd_print_ieee80211(cfg->c_apme_dlt, frame->f_action_flags &
		    HOSTAPD_ACTION_VERBOSE, buf, len);

		/* Flush output buffer */
		hostapd_printf(NULL);
		break;

	case HOSTAPD_ACTION_DELNODE:
	case HOSTAPD_ACTION_ADDNODE:
		bzero(&node, sizeof(node));

		if (action->a_flags & HOSTAPD_ACTION_F_REF_FROM)
			lladdr = wfrom;
		else if (action->a_flags & HOSTAPD_ACTION_F_REF_TO)
			lladdr = wto;
		else if (action->a_flags & HOSTAPD_ACTION_F_REF_BSSID)
			lladdr = wbssid;
		else
			lladdr = action->a_lladdr;

		bcopy(lladdr, &node.ni_macaddr, IEEE80211_ADDR_LEN);

		if (frame->f_action == HOSTAPD_ACTION_DELNODE)
			ret = hostapd_apme_delnode(apme, &node);
		else
			ret = hostapd_apme_addnode(apme, &node);

		if (ret != 0)  {
			hostapd_log(HOSTAPD_LOG_DEBUG,
			    "%s: node add/delete %s failed: %s",
			    apme->a_iface, etheraddr_string(lladdr),
			    strerror(ret));
		}
		break;

	case HOSTAPD_ACTION_NONE:
		/* Nothing */
		break;

	case HOSTAPD_ACTION_RESEND:
		/* Resend received raw IEEE 802.11 frame */
		if ((offset = hostapd_apme_offset(apme, buf, len)) < 0)
			return (EINVAL);
		if (write(apme->a_raw, buf + offset, len - offset) == -1)
			ret = errno;
		break;

	case HOSTAPD_ACTION_FRAME:
		if (action->a_flags & HOSTAPD_ACTION_F_REF_M) {
			hostapd_handle_ref(action->a_flags &
			    HOSTAPD_ACTION_F_REF_FROM_M,
			    HOSTAPD_ACTION_F_REF_FROM_S, wfrom, wto, wbssid,
			    action->a_frame.i_from);
			hostapd_handle_ref(action->a_flags &
			    HOSTAPD_ACTION_F_REF_TO_M,
			    HOSTAPD_ACTION_F_REF_TO_S, wfrom, wto, wbssid,
			    action->a_frame.i_to);
			hostapd_handle_ref(action->a_flags &
			    HOSTAPD_ACTION_F_REF_BSSID_M,
			    HOSTAPD_ACTION_F_REF_BSSID_S, wfrom, wto, wbssid,
			    action->a_frame.i_bssid);
		}

		/* Send a raw IEEE 802.11 frame */
		return (hostapd_apme_output(apme, &action->a_frame));

	default:
		return (0);
	}

	return (ret);
}

int
hostapd_handle_radiotap(struct hostapd_radiotap *rtap,
    u_int8_t *buf, const u_int len)
{
	struct ieee80211_radiotap_header *rh =
	    (struct ieee80211_radiotap_header*)buf;
	u_int8_t *t, *ptr = NULL;
	u_int rh_len;
	const u_int8_t *snapend = buf + len;

	TCHECK(*rh);

	rh_len = letoh16(rh->it_len);
	if (rh->it_version != 0)
		return (EINVAL);
	if (len <= rh_len)
		goto trunc;

	bzero(rtap, sizeof(struct hostapd_radiotap));

	t = (u_int8_t*)buf + sizeof(struct ieee80211_radiotap_header);
	if ((rtap->r_present = letoh32(rh->it_present)) == 0)
		return (0);

#define RADIOTAP(_x, _len)						\
	if (rtap->r_present & HOSTAPD_RADIOTAP_F(_x)) {			\
		TCHECK2(*t, _len);					\
		ptr = t;						\
		t += _len;						\
	} else								\
		ptr = NULL;

	/* radiotap doesn't use TLV header fields, ugh */
	RADIOTAP(TSFT, 8);
	RADIOTAP(FLAGS, 1);

	RADIOTAP(RATE, 1);
	if (ptr != NULL) {
		rtap->r_txrate = *(u_int8_t *)ptr;
	}

	RADIOTAP(CHANNEL, 4);
	if (ptr != NULL) {
		rtap->r_chan = letoh16(*(u_int16_t*)ptr);
		rtap->r_chan_flags = letoh16(*(u_int16_t*)ptr + 1);
	}

	RADIOTAP(FHSS, 2);
	RADIOTAP(DBM_ANTSIGNAL, 1);
	RADIOTAP(DBM_ANTNOISE, 1);
	RADIOTAP(LOCK_QUALITY, 2);
	RADIOTAP(TX_ATTENUATION, 2);
	RADIOTAP(DB_TX_ATTENUATION, 2);
	RADIOTAP(DBM_TX_POWER, 1);
	RADIOTAP(ANTENNA, 1);
	RADIOTAP(DB_ANTSIGNAL, 1);
	RADIOTAP(DB_ANTNOISE, 1);
	RADIOTAP(FCS, 4);

	RADIOTAP(RSSI, 2);
	if (ptr != NULL) {
		rtap->r_rssi = *(u_int8_t *)ptr;
		rtap->r_max_rssi = *(u_int8_t *)ptr + 1;
	}

	return (0);

 trunc:
	return (EINVAL);
}

int
hostapd_cmp(enum hostapd_op op, int val1, int val2)
{
	if ((op == HOSTAPD_OP_EQ && val1 == val2) ||
	    (op == HOSTAPD_OP_NE && val1 != val2) ||
	    (op == HOSTAPD_OP_LE && val1 <= val2) ||
	    (op == HOSTAPD_OP_LT && val1 <  val2) ||
	    (op == HOSTAPD_OP_GE && val1 >= val2) ||
	    (op == HOSTAPD_OP_GT && val1 >  val2))
		return (1);
	return (0);
}


Generated by: GCOVR (Version 3.3)

Line	Branch	Exec	Source
1			/* $OpenBSD: handle.c,v 1.12 2015/01/16 06:40:17 deraadt Exp $ */
2
3			/*
4			* Copyright (c) 2005, 2006 Reyk Floeter <reyk@openbsd.org>
5			*
6			* Permission to use, copy, modify, and distribute this software for any
7			* purpose with or without fee is hereby granted, provided that the above
8			* copyright notice and this permission notice appear in all copies.
9			*
10			* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11			* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12			* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13			* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14			* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15			* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16			* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17			*/
18
19			#include <sys/ioctl.h>
20			#include <sys/types.h>
21			#include <sys/socket.h>
22			#include <sys/time.h>
23
24			#include <net/if.h>
25			#include <net/if_dl.h>
26			#include <net/if_media.h>
27			#include <net/if_arp.h>
28			#include <net/if_llc.h>
29			#include <net/bpf.h>
30
31			#include <netinet/in.h>
32			#include <netinet/if_ether.h>
33			#include <arpa/inet.h>
34
35			#include <net80211/ieee80211.h>
36			#include <net80211/ieee80211_radiotap.h>
37
38			#include <fcntl.h>
39			#include <stdlib.h>
40			#include <stdio.h>
41			#include <string.h>
42			#include <unistd.h>
43			#include <limits.h>
44
45			#include "hostapd.h"
46
47			int hostapd_handle_frame(struct hostapd_apme , struct hostapd_frame ,
48			u_int8_t *, const u_int);
49			int hostapd_handle_action(struct hostapd_apme , struct hostapd_frame ,
50			u_int8_t , u_int8_t , u_int8_t , u_int8_t , const u_int);
51			void hostapd_handle_addr(const u_int32_t, u_int32_t , u_int8_t ,
52			u_int8_t , struct hostapd_table );
53			void hostapd_handle_ref(u_int, u_int, u_int8_t , u_int8_t , u_int8_t *,
54			u_int8_t *);
55			int hostapd_handle_radiotap(struct hostapd_radiotap , u_int8_t ,
56			const u_int);
57			int hostapd_cmp(enum hostapd_op, int, int);
58
59			int
60			hostapd_handle_input(struct hostapd_apme apme, u_int8_t buf, u_int len)
61			{
62			struct hostapd_config cfg = (struct hostapd_config )apme->a_cfg;
63			struct hostapd_frame *frame;
64			int ret;
65
66			TAILQ_FOREACH(frame, &cfg->c_frames, f_entries) {
67			if ((ret = hostapd_handle_frame(apme, frame, buf, len)) != 0)
68			return (ret);
69			}
70
71			return (0);
72			}
73
74			void
75			hostapd_handle_addr(const u_int32_t mask, u_int32_t flags, u_int8_t addr,
76			u_int8_t maddr, struct hostapd_table table)
77			{
78			int ret = 0;
79
80			if ((*flags & mask) & HOSTAPD_FRAME_TABLE) {
81			if (hostapd_entry_lookup(table, addr) == NULL)
82			ret = 1;
83			} else if (bcmp(addr, maddr, IEEE80211_ADDR_LEN) != 0)
84			ret = 1;
85
86			if ((ret == 1 && (*flags & mask) & HOSTAPD_FRAME_N) \|\|
87			(ret == 0 && ((*flags & mask) & HOSTAPD_FRAME_N) == 0))
88			*flags &= ~mask;
89			}
90
91			void
92			hostapd_handle_ref(u_int flags, u_int shift, u_int8_t wfrom, u_int8_t wto,
93			u_int8_t wbssid, u_int8_t addr)
94			{
95			if (flags & (HOSTAPD_ACTION_F_REF_FROM << shift))
96			bcopy(wfrom, addr, IEEE80211_ADDR_LEN);
97			else if (flags & (HOSTAPD_ACTION_F_REF_TO << shift))
98			bcopy(wto, addr, IEEE80211_ADDR_LEN);
99			else if (flags & (HOSTAPD_ACTION_F_REF_BSSID << shift))
100			bcopy(wbssid, addr, IEEE80211_ADDR_LEN);
101			else if (flags & (HOSTAPD_ACTION_F_REF_RANDOM << shift)) {
102			hostapd_randval(addr, IEEE80211_ADDR_LEN);
103			/* Avoid multicast/broadcast addresses */
104			addr[0] &= ~0x1;
105			}
106			}
107
108			int
109			hostapd_handle_frame(struct hostapd_apme apme, struct hostapd_frame frame,
110			u_int8_t *buf, const u_int len)
111			{
112			struct hostapd_config cfg = (struct hostapd_config )apme->a_cfg;
113			struct ieee80211_frame *wh;
114			struct hostapd_ieee80211_frame *mh;
115			struct hostapd_radiotap rtap;
116			u_int8_t wfrom, wto, *wbssid;
117			struct timeval t_now;
118			u_int32_t flags;
119			int offset, min_rate = 0, val;
120
121			if ((offset = hostapd_apme_offset(apme, buf, len)) < 0)
122			return (0);
123			wh = (struct ieee80211_frame *)(buf + offset);
124
125			mh = &frame->f_frame;
126			flags = frame->f_flags;
127
128			/* Get timestamp */
129			if (gettimeofday(&t_now, NULL) == -1)
130			hostapd_fatal("gettimeofday");
131
132			/* Handle optional limit */
133			if (frame->f_limit.tv_sec \|\| frame->f_limit.tv_usec) {
134			if (timercmp(&t_now, &frame->f_then, <))
135			return (0);
136			timeradd(&t_now, &frame->f_limit, &frame->f_then);
137			}
138
139			switch (wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) {
140			case IEEE80211_FC1_DIR_NODS:
141			wfrom = wh->i_addr2;
142			wto = wh->i_addr1;
143			wbssid = wh->i_addr3;
144			break;
145			case IEEE80211_FC1_DIR_TODS:
146			wfrom = wh->i_addr2;
147			wto = wh->i_addr3;
148			wbssid = wh->i_addr1;
149			break;
150			case IEEE80211_FC1_DIR_FROMDS:
151			wfrom = wh->i_addr3;
152			wto = wh->i_addr1;
153			wbssid = wh->i_addr2;
154			break;
155			default:
156			case IEEE80211_FC1_DIR_DSTODS:
157			return (0);
158			}
159
160			if (flags & HOSTAPD_FRAME_F_APME_M) {
161			if (frame->f_apme == NULL)
162			return (0);
163			/* Match hostap interface */
164			if ((flags & HOSTAPD_FRAME_F_APME &&
165			apme == frame->f_apme) \|\|
166			(flags & HOSTAPD_FRAME_F_APME_N &&
167			apme != frame->f_apme))
168			flags &= ~HOSTAPD_FRAME_F_APME_M;
169			}
170
171			if (flags & HOSTAPD_FRAME_F_TYPE) {
172			/* type $type */
173			if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) ==
174			(mh->i_fc[0] & IEEE80211_FC0_TYPE_MASK))
175			flags &= ~HOSTAPD_FRAME_F_TYPE;
176			} else if (flags & HOSTAPD_FRAME_F_TYPE_N) {
177			/* type !$type */
178			if ((wh->i_fc[0] & IEEE80211_FC0_TYPE_MASK) !=
179			(mh->i_fc[0] & IEEE80211_FC0_TYPE_MASK))
180			flags &= ~HOSTAPD_FRAME_F_TYPE_N;
181			}
182
183			if (flags & HOSTAPD_FRAME_F_SUBTYPE) {
184			/* subtype $subtype */
185			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) ==
186			(mh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK))
187			flags &= ~HOSTAPD_FRAME_F_SUBTYPE;
188			} else if (flags & HOSTAPD_FRAME_F_SUBTYPE_N) {
189			/* subtype !$subtype */
190			if ((wh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK) !=
191			(mh->i_fc[0] & IEEE80211_FC0_SUBTYPE_MASK))
192			flags &= ~HOSTAPD_FRAME_F_SUBTYPE_N;
193			}
194
195			if (flags & HOSTAPD_FRAME_F_DIR) {
196			/* dir $dir */
197			if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) ==
198			(mh->i_fc[1] & IEEE80211_FC1_DIR_MASK))
199			flags &= ~HOSTAPD_FRAME_F_DIR;
200			} else if (flags & HOSTAPD_FRAME_F_DIR_N) {
201			/* dir !$dir */
202			if ((wh->i_fc[1] & IEEE80211_FC1_DIR_MASK) !=
203			(mh->i_fc[1] & IEEE80211_FC1_DIR_MASK))
204			flags &= ~HOSTAPD_FRAME_F_DIR_N;
205			}
206
207			/* from/to/bssid [!]$addr/<table> */
208			hostapd_handle_addr(HOSTAPD_FRAME_F_FROM_M, &flags, wfrom,
209			mh->i_from, frame->f_from);
210			hostapd_handle_addr(HOSTAPD_FRAME_F_TO_M, &flags, wto,
211			mh->i_to, frame->f_to);
212			hostapd_handle_addr(HOSTAPD_FRAME_F_BSSID_M, &flags, wbssid,
213			mh->i_bssid, frame->f_bssid);
214
215			/* parse the optional radiotap header if required */
216			if (frame->f_radiotap) {
217			if (hostapd_handle_radiotap(&rtap, buf, len) != 0)
218			return (0);
219			else if ((rtap.r_present & frame->f_radiotap) !=
220			frame->f_radiotap) {
221			cfg->c_stats.cn_rtap_miss++;
222			return (0);
223			}
224			if (flags & HOSTAPD_FRAME_F_RSSI && rtap.r_max_rssi) {
225			val = ((float)rtap.r_rssi / rtap.r_max_rssi) * 100;
226			if (hostapd_cmp(frame->f_rssi_op,
227			val, frame->f_rssi))
228			flags &= ~HOSTAPD_FRAME_F_RSSI;
229			}
230			if (flags & HOSTAPD_FRAME_F_RATE) {
231			val = rtap.r_txrate;
232			if (hostapd_cmp(frame->f_txrate_op,
233			val, frame->f_txrate))
234			flags &= ~HOSTAPD_FRAME_F_RATE;
235			}
236			if (flags & HOSTAPD_FRAME_F_CHANNEL) {
237			val = rtap.r_chan;
238			if (hostapd_cmp(frame->f_chan_op,
239			val, frame->f_chan))
240			flags &= ~HOSTAPD_FRAME_F_CHANNEL;
241			}
242			}
243
244			/* Handle if frame matches */
245			if ((flags & HOSTAPD_FRAME_F_M) != 0)
246			return (0);
247
248			/* Handle optional minimal rate */
249			if (frame->f_rate && frame->f_rate_intval) {
250			frame->f_rate_delay = t_now.tv_sec - frame->f_last.tv_sec;
251			if (frame->f_rate_delay < frame->f_rate_intval) {
252			frame->f_rate_cnt++;
253			if (frame->f_rate_cnt < frame->f_rate)
254			min_rate = 1;
255			} else {
256			min_rate = 1;
257			frame->f_rate_cnt = 0;
258			}
259			}
260
261			/* Update timestamp for the last match of this event */
262			if (frame->f_rate_cnt == 0 \|\| min_rate == 0)
263			bcopy(&t_now, &frame->f_last, sizeof(struct timeval));
264
265			/* Return if the minimal rate is not reached, yet */
266			if (min_rate)
267			return (0);
268
269			if (hostapd_handle_action(apme, frame, wfrom, wto, wbssid, buf,
270			len) != 0)
271			return (0);
272
273			/* Reset minimal rate counter after successfully handled the frame */
274			frame->f_rate_cnt = 0;
275
276			return ((frame->f_flags & HOSTAPD_FRAME_F_RET_M) >>
277			HOSTAPD_FRAME_F_RET_S);
278			}
279
280			int
281			hostapd_handle_action(struct hostapd_apme apme, struct hostapd_frame frame,
282			u_int8_t wfrom, u_int8_t wto, u_int8_t wbssid, u_int8_t buf,
283			const u_int len)
284			{
285			struct hostapd_config cfg = (struct hostapd_config )apme->a_cfg;
286			struct hostapd_iapp *iapp = &cfg->c_iapp;
287			struct hostapd_action_data *action = &frame->f_action_data;
288			struct hostapd_node node;
289			u_int8_t *lladdr = NULL;
290			int ret = 0, offset;
291
292			switch (frame->f_action) {
293			case HOSTAPD_ACTION_RADIOTAP:
294			/* Send IAPP frame with radiotap/pcap payload */
295			if ((ret = hostapd_iapp_radiotap(apme, buf, len)) != 0)
296			return (ret);
297
298			if ((frame->f_action_flags & HOSTAPD_ACTION_VERBOSE) == 0)
299			return (0);
300
301			hostapd_log(HOSTAPD_LOG,
302			"%s: sent IAPP frame HOSTAPD_%s (%u bytes)",
303			iapp->i_iface, cfg->c_apme_dlt ==
304			DLT_IEEE802_11_RADIO ? "RADIOTAP" : "PCAP", len);
305			break;
306
307			case HOSTAPD_ACTION_LOG:
308			/* Log frame to syslog/stderr */
309			if (frame->f_rate && frame->f_rate_intval) {
310			hostapd_printf("%s: (rate: %ld/%ld sec) ",
311			apme->a_iface, frame->f_rate_cnt,
312			frame->f_rate_delay + 1);
313			} else
314			hostapd_printf("%s: ", apme->a_iface);
315
316			hostapd_print_ieee80211(cfg->c_apme_dlt, frame->f_action_flags &
317			HOSTAPD_ACTION_VERBOSE, buf, len);
318
319			/* Flush output buffer */
320			hostapd_printf(NULL);
321			break;
322
323			case HOSTAPD_ACTION_DELNODE:
324			case HOSTAPD_ACTION_ADDNODE:
325			bzero(&node, sizeof(node));
326
327			if (action->a_flags & HOSTAPD_ACTION_F_REF_FROM)
328			lladdr = wfrom;
329			else if (action->a_flags & HOSTAPD_ACTION_F_REF_TO)
330			lladdr = wto;
331			else if (action->a_flags & HOSTAPD_ACTION_F_REF_BSSID)
332			lladdr = wbssid;
333			else
334			lladdr = action->a_lladdr;
335
336			bcopy(lladdr, &node.ni_macaddr, IEEE80211_ADDR_LEN);
337
338			if (frame->f_action == HOSTAPD_ACTION_DELNODE)
339			ret = hostapd_apme_delnode(apme, &node);
340			else
341			ret = hostapd_apme_addnode(apme, &node);
342
343			if (ret != 0) {
344			hostapd_log(HOSTAPD_LOG_DEBUG,
345			"%s: node add/delete %s failed: %s",
346			apme->a_iface, etheraddr_string(lladdr),
347			strerror(ret));
348			}
349			break;
350
351			case HOSTAPD_ACTION_NONE:
352			/* Nothing */
353			break;
354
355			case HOSTAPD_ACTION_RESEND:
356			/* Resend received raw IEEE 802.11 frame */
357			if ((offset = hostapd_apme_offset(apme, buf, len)) < 0)
358			return (EINVAL);
359			if (write(apme->a_raw, buf + offset, len - offset) == -1)
360			ret = errno;
361			break;
362
363			case HOSTAPD_ACTION_FRAME:
364			if (action->a_flags & HOSTAPD_ACTION_F_REF_M) {
365			hostapd_handle_ref(action->a_flags &
366			HOSTAPD_ACTION_F_REF_FROM_M,
367			HOSTAPD_ACTION_F_REF_FROM_S, wfrom, wto, wbssid,
368			action->a_frame.i_from);
369			hostapd_handle_ref(action->a_flags &
370			HOSTAPD_ACTION_F_REF_TO_M,
371			HOSTAPD_ACTION_F_REF_TO_S, wfrom, wto, wbssid,
372			action->a_frame.i_to);
373			hostapd_handle_ref(action->a_flags &
374			HOSTAPD_ACTION_F_REF_BSSID_M,
375			HOSTAPD_ACTION_F_REF_BSSID_S, wfrom, wto, wbssid,
376			action->a_frame.i_bssid);
377			}
378
379			/* Send a raw IEEE 802.11 frame */
380			return (hostapd_apme_output(apme, &action->a_frame));
381
382			default:
383			return (0);
384			}
385
386			return (ret);
387			}
388
389			int
390			hostapd_handle_radiotap(struct hostapd_radiotap *rtap,
391			u_int8_t *buf, const u_int len)
392			{
393			struct ieee80211_radiotap_header *rh =
394			(struct ieee80211_radiotap_header*)buf;
395			u_int8_t t, ptr = NULL;
396			u_int rh_len;
397			const u_int8_t *snapend = buf + len;
398
399			TCHECK(*rh);
400
401			rh_len = letoh16(rh->it_len);
402			if (rh->it_version != 0)
403			return (EINVAL);
404			if (len <= rh_len)
405			goto trunc;
406
407			bzero(rtap, sizeof(struct hostapd_radiotap));
408
409			t = (u_int8_t*)buf + sizeof(struct ieee80211_radiotap_header);
410			if ((rtap->r_present = letoh32(rh->it_present)) == 0)
411			return (0);
412
413			#define RADIOTAP(_x, _len) \
414			if (rtap->r_present & HOSTAPD_RADIOTAP_F(_x)) { \
415			TCHECK2(*t, _len); \
416			ptr = t; \
417			t += _len; \
418			} else \
419			ptr = NULL;
420
421			/* radiotap doesn't use TLV header fields, ugh */
422			RADIOTAP(TSFT, 8);
423			RADIOTAP(FLAGS, 1);
424
425			RADIOTAP(RATE, 1);
426			if (ptr != NULL) {
427			rtap->r_txrate = (u_int8_t )ptr;
428			}
429
430			RADIOTAP(CHANNEL, 4);
431			if (ptr != NULL) {
432			rtap->r_chan = letoh16((u_int16_t)ptr);
433			rtap->r_chan_flags = letoh16((u_int16_t)ptr + 1);
434			}
435
436			RADIOTAP(FHSS, 2);
437			RADIOTAP(DBM_ANTSIGNAL, 1);
438			RADIOTAP(DBM_ANTNOISE, 1);
439			RADIOTAP(LOCK_QUALITY, 2);
440			RADIOTAP(TX_ATTENUATION, 2);
441			RADIOTAP(DB_TX_ATTENUATION, 2);
442			RADIOTAP(DBM_TX_POWER, 1);
443			RADIOTAP(ANTENNA, 1);
444			RADIOTAP(DB_ANTSIGNAL, 1);
445			RADIOTAP(DB_ANTNOISE, 1);
446			RADIOTAP(FCS, 4);
447
448			RADIOTAP(RSSI, 2);
449			if (ptr != NULL) {
450			rtap->r_rssi = (u_int8_t )ptr;
451			rtap->r_max_rssi = (u_int8_t )ptr + 1;
452			}
453
454			return (0);
455
456			trunc:
457			return (EINVAL);
458			}
459
460			int
461			hostapd_cmp(enum hostapd_op op, int val1, int val2)
462			{
463			if ((op == HOSTAPD_OP_EQ && val1 == val2) \|\|
464			(op == HOSTAPD_OP_NE && val1 != val2) \|\|
465			(op == HOSTAPD_OP_LE && val1 <= val2) \|\|
466			(op == HOSTAPD_OP_LT && val1 < val2) \|\|
467			(op == HOSTAPD_OP_GE && val1 >= val2) \|\|
468			(op == HOSTAPD_OP_GT && val1 > val2))
469			return (1);
470			return (0);
471			}