86 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
88 				       struct wpa_tdls_peer *peer);
178 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)  in wpa_tdls_del_key()  argument
180 	if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,  in wpa_tdls_del_key()
191 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)  in wpa_tdls_set_key()  argument
197 	if (peer->tk_set) {  in wpa_tdls_set_key()
207 			   MAC2STR(peer->addr));  in wpa_tdls_set_key()
213 	switch (peer->cipher) {  in wpa_tdls_set_key()
229 		   MAC2STR(peer->addr));  in wpa_tdls_set_key()
230 	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,  in wpa_tdls_set_key()
231 			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {  in wpa_tdls_set_key()
236 	peer->tk_set = 1;  in wpa_tdls_set_key()
256 	struct wpa_tdls_peer *peer;  in wpa_tdls_tpk_send()  local
278 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_tpk_send()
279 		if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)  in wpa_tdls_tpk_send()
283 	if (peer == NULL) {  in wpa_tdls_tpk_send()
289 	eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_send()
292 		peer->sm_tmr.count = TPK_M2_RETRY_COUNT;  in wpa_tdls_tpk_send()
293 		peer->sm_tmr.timer = TPK_M2_TIMEOUT;  in wpa_tdls_tpk_send()
295 		peer->sm_tmr.count = TPK_M1_RETRY_COUNT;  in wpa_tdls_tpk_send()
296 		peer->sm_tmr.timer = TPK_M1_TIMEOUT;  in wpa_tdls_tpk_send()
300 	os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);  in wpa_tdls_tpk_send()
301 	peer->sm_tmr.action_code = action_code;  in wpa_tdls_tpk_send()
302 	peer->sm_tmr.dialog_token = dialog_token;  in wpa_tdls_tpk_send()
303 	peer->sm_tmr.status_code = status_code;  in wpa_tdls_tpk_send()
304 	peer->sm_tmr.peer_capab = peer_capab;  in wpa_tdls_tpk_send()
305 	peer->sm_tmr.buf_len = msg_len;  in wpa_tdls_tpk_send()
306 	os_free(peer->sm_tmr.buf);  in wpa_tdls_tpk_send()
307 	peer->sm_tmr.buf = os_memdup(msg, msg_len);  in wpa_tdls_tpk_send()
308 	if (peer->sm_tmr.buf == NULL)  in wpa_tdls_tpk_send()
313 	eloop_register_timeout(peer->sm_tmr.timer / 1000,  in wpa_tdls_tpk_send()
314 			       (peer->sm_tmr.timer % 1000) * 1000,  in wpa_tdls_tpk_send()
315 			       wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_send()
320 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,  in wpa_tdls_do_teardown()  argument
325 	ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);  in wpa_tdls_do_teardown()
327 	wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_do_teardown()
337 	struct wpa_tdls_peer *peer = timeout_ctx;  in wpa_tdls_tpk_retry_timeout()  local
339 	if (peer->sm_tmr.count) {  in wpa_tdls_tpk_retry_timeout()
340 		peer->sm_tmr.count--;  in wpa_tdls_tpk_retry_timeout()
344 			   peer->sm_tmr.action_code);  in wpa_tdls_tpk_retry_timeout()
346 		if (peer->sm_tmr.buf == NULL) {  in wpa_tdls_tpk_retry_timeout()
349 				   peer->sm_tmr.action_code);  in wpa_tdls_tpk_retry_timeout()
351 					     peer);  in wpa_tdls_tpk_retry_timeout()
356 		if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,  in wpa_tdls_tpk_retry_timeout()
357 					  peer->sm_tmr.action_code,  in wpa_tdls_tpk_retry_timeout()
358 					  peer->sm_tmr.dialog_token,  in wpa_tdls_tpk_retry_timeout()
359 					  peer->sm_tmr.status_code,  in wpa_tdls_tpk_retry_timeout()
360 					  peer->sm_tmr.peer_capab,  in wpa_tdls_tpk_retry_timeout()
361 					  peer->initiator,  in wpa_tdls_tpk_retry_timeout()
362 					  peer->sm_tmr.buf,  in wpa_tdls_tpk_retry_timeout()
363 					  peer->sm_tmr.buf_len)) {  in wpa_tdls_tpk_retry_timeout()
368 		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_retry_timeout()
369 		eloop_register_timeout(peer->sm_tmr.timer / 1000,  in wpa_tdls_tpk_retry_timeout()
370 				       (peer->sm_tmr.timer % 1000) * 1000,  in wpa_tdls_tpk_retry_timeout()
371 				       wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_retry_timeout()
373 		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_retry_timeout()
376 		wpa_tdls_do_teardown(sm, peer,  in wpa_tdls_tpk_retry_timeout()
383 					      struct wpa_tdls_peer *peer,  in wpa_tdls_tpk_retry_timeout_cancel()  argument
386 	if (action_code == peer->sm_tmr.action_code) {  in wpa_tdls_tpk_retry_timeout_cancel()
391 		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_tpk_retry_timeout_cancel()
394 		os_free(peer->sm_tmr.buf);  in wpa_tdls_tpk_retry_timeout_cancel()
395 		peer->sm_tmr.buf = NULL;  in wpa_tdls_tpk_retry_timeout_cancel()
397 		peer->sm_tmr.count = 0;  in wpa_tdls_tpk_retry_timeout_cancel()
398 		peer->sm_tmr.timer = 0;  in wpa_tdls_tpk_retry_timeout_cancel()
399 		peer->sm_tmr.buf_len = 0;  in wpa_tdls_tpk_retry_timeout_cancel()
400 		peer->sm_tmr.action_code = 0xff;  in wpa_tdls_tpk_retry_timeout_cancel()
408 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,  in wpa_tdls_generate_tpk()  argument
422 	if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {  in wpa_tdls_generate_tpk()
423 		nonce[0] = peer->inonce;  in wpa_tdls_generate_tpk()
424 		nonce[1] = peer->rnonce;  in wpa_tdls_generate_tpk()
426 		nonce[0] = peer->rnonce;  in wpa_tdls_generate_tpk()
427 		nonce[1] = peer->inonce;  in wpa_tdls_generate_tpk()
440 	if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {  in wpa_tdls_generate_tpk()
442 		os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);  in wpa_tdls_generate_tpk()
444 		os_memcpy(data, peer->addr, ETH_ALEN);  in wpa_tdls_generate_tpk()
451 		   (u8 *) &peer->tpk, sizeof(peer->tpk));  in wpa_tdls_generate_tpk()
453 			peer->tpk.kck, sizeof(peer->tpk.kck));  in wpa_tdls_generate_tpk()
455 			peer->tpk.tk, sizeof(peer->tpk.tk));  in wpa_tdls_generate_tpk()
456 	peer->tpk_set = 1;  in wpa_tdls_generate_tpk()
581 					  struct wpa_tdls_peer *peer,  in wpa_supplicant_verify_tdls_mic()  argument
587 	if (peer->tpk_set) {  in wpa_supplicant_verify_tdls_mic()
588 		wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,  in wpa_supplicant_verify_tdls_mic()
589 				  peer->rsnie_p, timeoutie, (u8 *) ftie,  in wpa_supplicant_verify_tdls_mic()
610 	u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,  in wpa_supplicant_verify_tdls_mic_teardown()  argument
615 	if (peer->tpk_set) {  in wpa_supplicant_verify_tdls_mic_teardown()
616 		wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,  in wpa_supplicant_verify_tdls_mic_teardown()
635 	struct wpa_tdls_peer *peer = timeout_ctx;  in wpa_tdls_tpk_timeout()  local
645 	if (peer->initiator) {  in wpa_tdls_tpk_timeout()
649 			   " - try to renew", MAC2STR(peer->addr));  in wpa_tdls_tpk_timeout()
651 		os_memcpy(addr, peer->addr, ETH_ALEN);  in wpa_tdls_tpk_timeout()
652 		wpa_tdls_do_teardown(sm, peer,  in wpa_tdls_tpk_timeout()
657 			   " - tear down", MAC2STR(peer->addr));  in wpa_tdls_tpk_timeout()
658 		wpa_tdls_do_teardown(sm, peer,  in wpa_tdls_tpk_timeout()
665 					   struct wpa_tdls_peer *peer)  in wpa_tdls_peer_remove_from_list()  argument
671 	while (cur && cur != peer) {  in wpa_tdls_peer_remove_from_list()
676 	if (cur != peer) {  in wpa_tdls_peer_remove_from_list()
679 			   MAC2STR(peer->addr));  in wpa_tdls_peer_remove_from_list()
684 		prev->next = peer->next;  in wpa_tdls_peer_remove_from_list()
686 		sm->tdls = peer->next;  in wpa_tdls_peer_remove_from_list()
690 static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)  in wpa_tdls_peer_clear()  argument
693 		   MAC2STR(peer->addr));  in wpa_tdls_peer_clear()
694 	eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);  in wpa_tdls_peer_clear()
695 	eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);  in wpa_tdls_peer_clear()
696 	peer->reconfig_key = 0;  in wpa_tdls_peer_clear()
697 	peer->initiator = 0;  in wpa_tdls_peer_clear()
698 	peer->tpk_in_progress = 0;  in wpa_tdls_peer_clear()
699 	os_free(peer->sm_tmr.buf);  in wpa_tdls_peer_clear()
700 	peer->sm_tmr.buf = NULL;  in wpa_tdls_peer_clear()
701 	os_free(peer->ht_capabilities);  in wpa_tdls_peer_clear()
702 	peer->ht_capabilities = NULL;  in wpa_tdls_peer_clear()
703 	os_free(peer->vht_capabilities);  in wpa_tdls_peer_clear()
704 	peer->vht_capabilities = NULL;  in wpa_tdls_peer_clear()
705 	os_free(peer->ext_capab);  in wpa_tdls_peer_clear()
706 	peer->ext_capab = NULL;  in wpa_tdls_peer_clear()
707 	os_free(peer->supp_channels);  in wpa_tdls_peer_clear()
708 	peer->supp_channels = NULL;  in wpa_tdls_peer_clear()
709 	os_free(peer->supp_oper_classes);  in wpa_tdls_peer_clear()
710 	peer->supp_oper_classes = NULL;  in wpa_tdls_peer_clear()
711 	peer->rsnie_i_len = peer->rsnie_p_len = 0;  in wpa_tdls_peer_clear()
712 	peer->cipher = 0;  in wpa_tdls_peer_clear()
713 	peer->qos_info = 0;  in wpa_tdls_peer_clear()
714 	peer->wmm_capable = 0;  in wpa_tdls_peer_clear()
715 	peer->tk_set = peer->tpk_set = peer->tpk_success = 0;  in wpa_tdls_peer_clear()
716 	peer->chan_switch_enabled = 0;  in wpa_tdls_peer_clear()
717 	os_memset(&peer->tpk, 0, sizeof(peer->tpk));  in wpa_tdls_peer_clear()
718 	os_memset(peer->inonce, 0, WPA_NONCE_LEN);  in wpa_tdls_peer_clear()
719 	os_memset(peer->rnonce, 0, WPA_NONCE_LEN);  in wpa_tdls_peer_clear()
723 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)  in wpa_tdls_peer_free()  argument
725 	wpa_tdls_peer_clear(sm, peer);  in wpa_tdls_peer_free()
726 	wpa_tdls_peer_remove_from_list(sm, peer);  in wpa_tdls_peer_free()
727 	os_free(peer);  in wpa_tdls_peer_free()
731 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,  in wpa_tdls_linkid()  argument
737 	if (peer->initiator) {  in wpa_tdls_linkid()
739 		os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);  in wpa_tdls_linkid()
741 		os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);  in wpa_tdls_linkid()
750 	struct wpa_tdls_peer *peer;  in wpa_tdls_send_teardown()  local
761 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_send_teardown()
762 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_send_teardown()
766 	if (peer == NULL) {  in wpa_tdls_send_teardown()
773 	if (peer->chan_switch_enabled) {  in wpa_tdls_send_teardown()
776 		wpa_sm_tdls_disable_channel_switch(sm, peer->addr);  in wpa_tdls_send_teardown()
779 	dialog_token = peer->dtoken;  in wpa_tdls_send_teardown()
785 	if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {  in wpa_tdls_send_teardown()
799 	if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)  in wpa_tdls_send_teardown()
805 	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);  in wpa_tdls_send_teardown()
806 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);  in wpa_tdls_send_teardown()
823 	wpa_tdls_linkid(sm, peer, &lnkid);  in wpa_tdls_send_teardown()
824 	wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,  in wpa_tdls_send_teardown()
834 			  reason_code, 0, peer->initiator, rbuf, pos - rbuf);  in wpa_tdls_send_teardown()
843 	struct wpa_tdls_peer *peer;  in wpa_tdls_teardown_link()  local
848 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_teardown_link()
849 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_teardown_link()
853 	if (peer == NULL) {  in wpa_tdls_teardown_link()
859 	if (!peer->tpk_success) {  in wpa_tdls_teardown_link()
865 	return wpa_tdls_do_teardown(sm, peer, reason_code);  in wpa_tdls_teardown_link()
870 				       struct wpa_tdls_peer *peer)  in wpa_tdls_disable_peer_link()  argument
872 	wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);  in wpa_tdls_disable_peer_link()
873 	wpa_tdls_peer_free(sm, peer);  in wpa_tdls_disable_peer_link()
879 	struct wpa_tdls_peer *peer;  in wpa_tdls_disable_unreachable_link()  local
881 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_disable_unreachable_link()
882 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_disable_unreachable_link()
886 	if (!peer || !peer->tpk_success) {  in wpa_tdls_disable_unreachable_link()
898 		if (peer->chan_switch_enabled)  in wpa_tdls_disable_unreachable_link()
899 			wpa_sm_tdls_disable_channel_switch(sm, peer->addr);  in wpa_tdls_disable_unreachable_link()
903 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_disable_unreachable_link()
905 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_disable_unreachable_link()
912 	struct wpa_tdls_peer *peer;  in wpa_tdls_get_link_status()  local
917 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_get_link_status()
918 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_get_link_status()
922 	if (peer == NULL)  in wpa_tdls_get_link_status()
925 	if (!peer->tpk_success)  in wpa_tdls_get_link_status()
935 	struct wpa_tdls_peer *peer = NULL;  in wpa_tdls_recv_teardown()  local
944 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_recv_teardown()
945 		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)  in wpa_tdls_recv_teardown()
949 	if (peer == NULL) {  in wpa_tdls_recv_teardown()
982 	if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)  in wpa_tdls_recv_teardown()
994 						    peer->dtoken, peer,  in wpa_tdls_recv_teardown()
1006 	wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_recv_teardown()
1035 	struct wpa_tdls_peer *peer;  in wpa_tdls_add_peer()  local
1039 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_add_peer()
1040 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) {  in wpa_tdls_add_peer()
1043 			return peer; /* re-use existing entry */  in wpa_tdls_add_peer()
1050 	peer = os_zalloc(sizeof(*peer));  in wpa_tdls_add_peer()
1051 	if (peer == NULL)  in wpa_tdls_add_peer()
1054 	os_memcpy(peer->addr, addr, ETH_ALEN);  in wpa_tdls_add_peer()
1055 	peer->next = sm->tdls;  in wpa_tdls_add_peer()
1056 	sm->tdls = peer;  in wpa_tdls_add_peer()
1058 	return peer;  in wpa_tdls_add_peer()
1063 				struct wpa_tdls_peer *peer)  in wpa_tdls_send_tpk_m1()  argument
1076 		peer->rsnie_i_len = 0;  in wpa_tdls_send_tpk_m1()
1087 	hdr = (struct rsn_ie_hdr *) peer->rsnie_i;  in wpa_tdls_send_tpk_m1()
1137 	hdr->len = (pos - peer->rsnie_i) - 2;  in wpa_tdls_send_tpk_m1()
1138 	peer->rsnie_i_len = pos - peer->rsnie_i;  in wpa_tdls_send_tpk_m1()
1140 		    peer->rsnie_i, peer->rsnie_i_len);  in wpa_tdls_send_tpk_m1()
1145 		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +  in wpa_tdls_send_tpk_m1()
1156 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_send_tpk_m1()
1165 	pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);  in wpa_tdls_send_tpk_m1()
1171 	if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {  in wpa_tdls_send_tpk_m1()
1175 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_send_tpk_m1()
1178 	peer->tk_set = 0; /* A new nonce results in a new TK */  in wpa_tdls_send_tpk_m1()
1180 		    peer->inonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m1()
1181 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m1()
1200 	peer->lifetime = TPK_LIFETIME;  in wpa_tdls_send_tpk_m1()
1205 		peer->lifetime = 301;  in wpa_tdls_send_tpk_m1()
1210 		peer->lifetime = 0xffffffff;  in wpa_tdls_send_tpk_m1()
1214 				     sizeof(timeoutie), peer->lifetime);  in wpa_tdls_send_tpk_m1()
1215 	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);  in wpa_tdls_send_tpk_m1()
1225 		wpa_tdls_linkid(sm, peer, l);  in wpa_tdls_send_tpk_m1()
1233 		   MAC2STR(peer->addr));  in wpa_tdls_send_tpk_m1()
1235 	status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST,  in wpa_tdls_send_tpk_m1()
1236 				   1, 0, 0, peer->initiator, rbuf, pos - rbuf);  in wpa_tdls_send_tpk_m1()
1246 				const struct wpa_tdls_peer *peer)  in wpa_tdls_send_tpk_m2()  argument
1259 		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +  in wpa_tdls_send_tpk_m2()
1276 	pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);  in wpa_tdls_send_tpk_m2()
1281 	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m2()
1282 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m2()
1301 	lifetime = peer->lifetime;  in wpa_tdls_send_tpk_m2()
1315 	wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,  in wpa_tdls_send_tpk_m2()
1326 				   dtoken, 0, 0, peer->initiator, rbuf,  in wpa_tdls_send_tpk_m2()
1337 				const struct wpa_tdls_peer *peer)  in wpa_tdls_send_tpk_m3()  argument
1351 		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +  in wpa_tdls_send_tpk_m3()
1368 	pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);  in wpa_tdls_send_tpk_m3()
1373 	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m3()
1374 	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);  in wpa_tdls_send_tpk_m3()
1391 	lifetime = peer->lifetime;  in wpa_tdls_send_tpk_m3()
1405 	wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,  in wpa_tdls_send_tpk_m3()
1416 	if (peer->vht_capabilities)  in wpa_tdls_send_tpk_m3()
1418 	if (peer->ht_capabilities)  in wpa_tdls_send_tpk_m3()
1420 	if (peer->wmm_capable)  in wpa_tdls_send_tpk_m3()
1424 				   dtoken, 0, peer_capab, peer->initiator,  in wpa_tdls_send_tpk_m3()
1433 					    struct wpa_tdls_peer *peer,  in wpa_tdls_send_discovery_response()  argument
1445 		   "(peer " MACSTR ")", MAC2STR(peer->addr));  in wpa_tdls_send_discovery_response()
1450 	hdr = (struct rsn_ie_hdr *) peer->rsnie_i;  in wpa_tdls_send_discovery_response()
1482 	peer->rsnie_i_len = pos - peer->rsnie_i;  in wpa_tdls_send_discovery_response()
1490 		buf_len += peer->rsnie_i_len +  in wpa_tdls_send_discovery_response()
1495 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_send_discovery_response()
1503 	pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);  in wpa_tdls_send_discovery_response()
1505 	peer->lifetime = TPK_LIFETIME;  in wpa_tdls_send_discovery_response()
1507 				     sizeof(timeoutie), peer->lifetime);  in wpa_tdls_send_discovery_response()
1508 	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);  in wpa_tdls_send_discovery_response()
1510 	status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,  in wpa_tdls_send_discovery_response()
1524 	struct wpa_tdls_peer *peer;  in wpa_tdls_process_discovery_request()  local
1566 	peer = wpa_tdls_add_peer(sm, addr, NULL);  in wpa_tdls_process_discovery_request()
1567 	if (peer == NULL)  in wpa_tdls_process_discovery_request()
1570 	return wpa_tdls_send_discovery_response(sm, peer, dialog_token);  in wpa_tdls_process_discovery_request()
1587 			   struct wpa_tdls_peer *peer)  in copy_supp_rates()  argument
1593 	peer->supp_rates_len = merge_byte_arrays(  in copy_supp_rates()
1594 		peer->supp_rates, sizeof(peer->supp_rates),  in copy_supp_rates()
1603 			      struct wpa_tdls_peer *peer)  in copy_peer_ht_capab()  argument
1611 	if (!peer->ht_capabilities) {  in copy_peer_ht_capab()
1612 		peer->ht_capabilities =  in copy_peer_ht_capab()
1614 		if (peer->ht_capabilities == NULL)  in copy_peer_ht_capab()
1618 	os_memcpy(peer->ht_capabilities, kde->ht_capabilities,  in copy_peer_ht_capab()
1621 		    (u8 *) peer->ht_capabilities,  in copy_peer_ht_capab()
1629 			      struct wpa_tdls_peer *peer)  in copy_peer_vht_capab()  argument
1637 	if (!peer->vht_capabilities) {  in copy_peer_vht_capab()
1638 		peer->vht_capabilities =  in copy_peer_vht_capab()
1640 		if (peer->vht_capabilities == NULL)  in copy_peer_vht_capab()
1644 	os_memcpy(peer->vht_capabilities, kde->vht_capabilities,  in copy_peer_vht_capab()
1647 		    (u8 *) peer->vht_capabilities,  in copy_peer_vht_capab()
1655 			       struct wpa_tdls_peer *peer)  in copy_peer_ext_capab()  argument
1663 	if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {  in copy_peer_ext_capab()
1665 		os_free(peer->ext_capab);  in copy_peer_ext_capab()
1666 		peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);  in copy_peer_ext_capab()
1667 		if (peer->ext_capab == NULL)  in copy_peer_ext_capab()
1671 	peer->ext_capab_len = kde->ext_capab_len - 2;  in copy_peer_ext_capab()
1672 	os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);  in copy_peer_ext_capab()
1679 			       struct wpa_tdls_peer *peer)  in copy_peer_wmm_capab()  argument
1694 	peer->qos_info = wmm->qos_info;  in copy_peer_wmm_capab()
1696 	peer->wmm_capable = 1;  in copy_peer_wmm_capab()
1698 	wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info);  in copy_peer_wmm_capab()
1704 				   struct wpa_tdls_peer *peer)  in copy_peer_supp_channels()  argument
1711 	if (!peer->supp_channels ||  in copy_peer_supp_channels()
1712 	    peer->supp_channels_len < kde->supp_channels_len) {  in copy_peer_supp_channels()
1713 		os_free(peer->supp_channels);  in copy_peer_supp_channels()
1714 		peer->supp_channels = os_zalloc(kde->supp_channels_len);  in copy_peer_supp_channels()
1715 		if (peer->supp_channels == NULL)  in copy_peer_supp_channels()
1719 	peer->supp_channels_len = kde->supp_channels_len;  in copy_peer_supp_channels()
1721 	os_memcpy(peer->supp_channels, kde->supp_channels,  in copy_peer_supp_channels()
1722 		  peer->supp_channels_len);  in copy_peer_supp_channels()
1724 		    (u8 *) peer->supp_channels, peer->supp_channels_len);  in copy_peer_supp_channels()
1730 				       struct wpa_tdls_peer *peer)  in copy_peer_supp_oper_classes()  argument
1737 	if (!peer->supp_oper_classes ||  in copy_peer_supp_oper_classes()
1738 	    peer->supp_oper_classes_len < kde->supp_oper_classes_len) {  in copy_peer_supp_oper_classes()
1739 		os_free(peer->supp_oper_classes);  in copy_peer_supp_oper_classes()
1740 		peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len);  in copy_peer_supp_oper_classes()
1741 		if (peer->supp_oper_classes == NULL)  in copy_peer_supp_oper_classes()
1745 	peer->supp_oper_classes_len = kde->supp_oper_classes_len;  in copy_peer_supp_oper_classes()
1746 	os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes,  in copy_peer_supp_oper_classes()
1747 		  peer->supp_oper_classes_len);  in copy_peer_supp_oper_classes()
1749 		    (u8 *) peer->supp_oper_classes,  in copy_peer_supp_oper_classes()
1750 		    peer->supp_oper_classes_len);  in copy_peer_supp_oper_classes()
1755 static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,  in wpa_tdls_addset_peer()  argument
1758 	return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid,  in wpa_tdls_addset_peer()
1759 				       peer->capability,  in wpa_tdls_addset_peer()
1760 				       peer->supp_rates, peer->supp_rates_len,  in wpa_tdls_addset_peer()
1761 				       peer->ht_capabilities,  in wpa_tdls_addset_peer()
1762 				       peer->vht_capabilities,  in wpa_tdls_addset_peer()
1763 				       peer->qos_info, peer->wmm_capable,  in wpa_tdls_addset_peer()
1764 				       peer->ext_capab, peer->ext_capab_len,  in wpa_tdls_addset_peer()
1765 				       peer->supp_channels,  in wpa_tdls_addset_peer()
1766 				       peer->supp_channels_len,  in wpa_tdls_addset_peer()
1767 				       peer->supp_oper_classes,  in wpa_tdls_addset_peer()
1768 				       peer->supp_oper_classes_len);  in wpa_tdls_addset_peer()
1788 	struct wpa_tdls_peer *peer;  in wpa_tdls_process_tpk_m1()  local
1820 	peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);  in wpa_tdls_process_tpk_m1()
1821 	if (peer == NULL)  in wpa_tdls_process_tpk_m1()
1828 		if (peer->tpk_success) {  in wpa_tdls_process_tpk_m1()
1832 			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);  in wpa_tdls_process_tpk_m1()
1833 			wpa_tdls_peer_clear(sm, peer);  in wpa_tdls_process_tpk_m1()
1834 		} else if (peer->initiator) {  in wpa_tdls_process_tpk_m1()
1854 						 peer->addr);  in wpa_tdls_process_tpk_m1()
1855 				wpa_tdls_peer_clear(sm, peer);  in wpa_tdls_process_tpk_m1()
1861 	peer->capability = WPA_GET_LE16(cpos);  in wpa_tdls_process_tpk_m1()
1892 	if (copy_supp_rates(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1895 	if (copy_peer_ht_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1898 	if (copy_peer_vht_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1901 	if (copy_peer_ext_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1904 	if (copy_peer_supp_channels(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1907 	if (copy_peer_supp_oper_classes(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1910 	peer->qos_info = kde.qosinfo;  in wpa_tdls_process_tpk_m1()
1913 	if (copy_peer_wmm_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m1()
1916 	peer->aid = kde.aid;  in wpa_tdls_process_tpk_m1()
1920 		peer = wpa_tdls_add_peer(sm, src_addr, NULL);  in wpa_tdls_process_tpk_m1()
1921 		if (peer == NULL)  in wpa_tdls_process_tpk_m1()
1925 		peer->initiator = 1;  in wpa_tdls_process_tpk_m1()
1926 		wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,  in wpa_tdls_process_tpk_m1()
1928 		wpa_tdls_send_tpk_m1(sm, peer);  in wpa_tdls_process_tpk_m1()
2012 		if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {  in wpa_tdls_process_tpk_m1()
2023 	peer->initiator = 0; /* Need to check */  in wpa_tdls_process_tpk_m1()
2024 	peer->dtoken = dtoken;  in wpa_tdls_process_tpk_m1()
2027 		peer->rsnie_i_len = 0;  in wpa_tdls_process_tpk_m1()
2028 		peer->rsnie_p_len = 0;  in wpa_tdls_process_tpk_m1()
2029 		peer->cipher = WPA_CIPHER_NONE;  in wpa_tdls_process_tpk_m1()
2034 	os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);  in wpa_tdls_process_tpk_m1()
2035 	peer->rsnie_i_len = kde.rsn_ie_len;  in wpa_tdls_process_tpk_m1()
2036 	peer->cipher = cipher;  in wpa_tdls_process_tpk_m1()
2038 	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||  in wpa_tdls_process_tpk_m1()
2039 	    !tdls_nonce_set(peer->inonce)) {  in wpa_tdls_process_tpk_m1()
2049 		os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);  in wpa_tdls_process_tpk_m1()
2050 		if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {  in wpa_tdls_process_tpk_m1()
2055 		peer->tk_set = 0; /* A new nonce results in a new TK */  in wpa_tdls_process_tpk_m1()
2067 	hdr = (struct rsn_ie_hdr *) peer->rsnie_p;  in wpa_tdls_process_tpk_m1()
2092 	hdr->len = (pos - peer->rsnie_p) - 2;  in wpa_tdls_process_tpk_m1()
2093 	peer->rsnie_p_len = pos - peer->rsnie_p;  in wpa_tdls_process_tpk_m1()
2097 	os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);  in wpa_tdls_process_tpk_m1()
2098 	peer->rsnie_p_len = peer->rsnie_i_len;  in wpa_tdls_process_tpk_m1()
2101 		    peer->rsnie_p, peer->rsnie_p_len);  in wpa_tdls_process_tpk_m1()
2103 	peer->lifetime = lifetime;  in wpa_tdls_process_tpk_m1()
2105 	wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);  in wpa_tdls_process_tpk_m1()
2114 	if (wpa_tdls_addset_peer(sm, peer, 1) < 0)  in wpa_tdls_process_tpk_m1()
2120 	peer->tpk_in_progress = 1;  in wpa_tdls_process_tpk_m1()
2123 	if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {  in wpa_tdls_process_tpk_m1()
2124 		wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);  in wpa_tdls_process_tpk_m1()
2131 		wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer);  in wpa_tdls_process_tpk_m1()
2140 	if (peer)  in wpa_tdls_process_tpk_m1()
2141 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_process_tpk_m1()
2146 static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)  in wpa_tdls_enable_link()  argument
2148 	peer->tpk_success = 1;  in wpa_tdls_enable_link()
2149 	peer->tpk_in_progress = 0;  in wpa_tdls_enable_link()
2150 	eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);  in wpa_tdls_enable_link()
2152 		u32 lifetime = peer->lifetime;  in wpa_tdls_enable_link()
2157 		if (lifetime > 3 && peer->initiator)  in wpa_tdls_enable_link()
2160 				       sm, peer);  in wpa_tdls_enable_link()
2165 			eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);  in wpa_tdls_enable_link()
2170 	if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {  in wpa_tdls_enable_link()
2175 	peer->reconfig_key = 0;  in wpa_tdls_enable_link()
2177 	return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);  in wpa_tdls_enable_link()
2184 	struct wpa_tdls_peer *peer;  in wpa_tdls_process_tpk_m2()  local
2200 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_process_tpk_m2()
2201 		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)  in wpa_tdls_process_tpk_m2()
2204 	if (peer == NULL) {  in wpa_tdls_process_tpk_m2()
2209 	if (!peer->initiator) {  in wpa_tdls_process_tpk_m2()
2220 	if (peer->tpk_success) {  in wpa_tdls_process_tpk_m2()
2227 	wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);  in wpa_tdls_process_tpk_m2()
2230 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2242 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2254 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2259 	peer->capability = WPA_GET_LE16(pos);  in wpa_tdls_process_tpk_m2()
2296 	if (copy_supp_rates(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2299 	if (copy_peer_ht_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2302 	if (copy_peer_vht_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2305 	if (copy_peer_ext_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2308 	if (copy_peer_supp_channels(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2311 	if (copy_peer_supp_oper_classes(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2314 	peer->qos_info = kde.qosinfo;  in wpa_tdls_process_tpk_m2()
2317 	if (copy_peer_wmm_capab(&kde, peer) < 0)  in wpa_tdls_process_tpk_m2()
2320 	peer->aid = kde.aid;  in wpa_tdls_process_tpk_m2()
2323 		peer->rsnie_p_len = 0;  in wpa_tdls_process_tpk_m2()
2324 		peer->cipher = WPA_CIPHER_NONE;  in wpa_tdls_process_tpk_m2()
2350 	if (kde.rsn_ie_len != peer->rsnie_i_len ||  in wpa_tdls_process_tpk_m2()
2351 	    os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {  in wpa_tdls_process_tpk_m2()
2355 			    peer->rsnie_i, peer->rsnie_i_len);  in wpa_tdls_process_tpk_m2()
2382 	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {  in wpa_tdls_process_tpk_m2()
2390 	os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);  in wpa_tdls_process_tpk_m2()
2391 	os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);  in wpa_tdls_process_tpk_m2()
2392 	peer->rsnie_p_len = kde.rsn_ie_len;  in wpa_tdls_process_tpk_m2()
2393 	peer->cipher = cipher;  in wpa_tdls_process_tpk_m2()
2405 	if (lifetime != peer->lifetime) {  in wpa_tdls_process_tpk_m2()
2407 			   "TPK M2 (expected %u)", lifetime, peer->lifetime);  in wpa_tdls_process_tpk_m2()
2412 	wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);  in wpa_tdls_process_tpk_m2()
2415 	if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,  in wpa_tdls_process_tpk_m2()
2418 		wpa_tdls_del_key(sm, peer);  in wpa_tdls_process_tpk_m2()
2419 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2423 	if (wpa_tdls_set_key(sm, peer) < 0) {  in wpa_tdls_process_tpk_m2()
2430 		peer->reconfig_key = 1;  in wpa_tdls_process_tpk_m2()
2434 	peer->dtoken = dtoken;  in wpa_tdls_process_tpk_m2()
2437 	if (wpa_tdls_addset_peer(sm, peer, 0) < 0)  in wpa_tdls_process_tpk_m2()
2442 	if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0)  in wpa_tdls_process_tpk_m2()
2445 	if (!peer->tpk_success) {  in wpa_tdls_process_tpk_m2()
2451 		ret = wpa_tdls_enable_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2455 				sm, peer,  in wpa_tdls_process_tpk_m2()
2465 	wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_process_tpk_m2()
2473 	struct wpa_tdls_peer *peer;  in wpa_tdls_process_tpk_m3()  local
2486 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_process_tpk_m3()
2487 		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)  in wpa_tdls_process_tpk_m3()
2490 	if (peer == NULL) {  in wpa_tdls_process_tpk_m3()
2495 	wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);  in wpa_tdls_process_tpk_m3()
2554 	if (kde.rsn_ie_len != peer->rsnie_p_len ||  in wpa_tdls_process_tpk_m3()
2555 	    os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {  in wpa_tdls_process_tpk_m3()
2561 	if (os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) != 0) {  in wpa_tdls_process_tpk_m3()
2567 	if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {  in wpa_tdls_process_tpk_m3()
2583 	if (lifetime != peer->lifetime) {  in wpa_tdls_process_tpk_m3()
2585 			   "TPK M3 (expected %u)", lifetime, peer->lifetime);  in wpa_tdls_process_tpk_m3()
2589 	if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,  in wpa_tdls_process_tpk_m3()
2591 		wpa_tdls_del_key(sm, peer);  in wpa_tdls_process_tpk_m3()
2595 	if (wpa_tdls_set_key(sm, peer) < 0) {  in wpa_tdls_process_tpk_m3()
2602 		peer->reconfig_key = 1;  in wpa_tdls_process_tpk_m3()
2607 	if (wpa_tdls_addset_peer(sm, peer, 0) < 0)  in wpa_tdls_process_tpk_m3()
2610 	if (!peer->tpk_success) {  in wpa_tdls_process_tpk_m3()
2616 		ret = wpa_tdls_enable_link(sm, peer);  in wpa_tdls_process_tpk_m3()
2624 	wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);  in wpa_tdls_process_tpk_m3()
2654 	struct wpa_tdls_peer *peer;  in wpa_tdls_start()  local
2675 	peer = wpa_tdls_add_peer(sm, addr, NULL);  in wpa_tdls_start()
2676 	if (peer == NULL)  in wpa_tdls_start()
2679 	if (peer->tpk_in_progress) {  in wpa_tdls_start()
2684 	peer->initiator = 1;  in wpa_tdls_start()
2687 	if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,  in wpa_tdls_start()
2689 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_start()
2693 	peer->tpk_in_progress = 1;  in wpa_tdls_start()
2695 	if (wpa_tdls_send_tpk_m1(sm, peer) < 0) {  in wpa_tdls_start()
2696 		wpa_tdls_disable_peer_link(sm, peer);  in wpa_tdls_start()
2706 	struct wpa_tdls_peer *peer;  in wpa_tdls_remove()  local
2711 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_remove()
2712 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_remove()
2716 	if (peer == NULL || !peer->tpk_success)  in wpa_tdls_remove()
2724 		wpa_tdls_do_teardown(sm, peer,  in wpa_tdls_remove()
2844 	struct wpa_tdls_peer *peer, *tmp;  in wpa_tdls_teardown_peers()  local
2848 	peer = sm->tdls;  in wpa_tdls_teardown_peers()
2852 	while (peer) {  in wpa_tdls_teardown_peers()
2853 		tmp = peer->next;  in wpa_tdls_teardown_peers()
2855 			   MAC2STR(peer->addr));  in wpa_tdls_teardown_peers()
2857 			wpa_tdls_do_teardown(sm, peer,  in wpa_tdls_teardown_peers()
2860 			wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);  in wpa_tdls_teardown_peers()
2862 		peer = tmp;  in wpa_tdls_teardown_peers()
2869 	struct wpa_tdls_peer *peer, *tmp;  in wpa_tdls_remove_peers()  local
2871 	peer = sm->tdls;  in wpa_tdls_remove_peers()
2873 	while (peer) {  in wpa_tdls_remove_peers()
2875 		tmp = peer->next;  in wpa_tdls_remove_peers()
2876 		res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);  in wpa_tdls_remove_peers()
2878 			   MAC2STR(peer->addr), res);  in wpa_tdls_remove_peers()
2879 		wpa_tdls_peer_free(sm, peer);  in wpa_tdls_remove_peers()
2880 		peer = tmp;  in wpa_tdls_remove_peers()
2995 	struct wpa_tdls_peer *peer;  in wpa_tdls_enable_chan_switch()  local
3013 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_enable_chan_switch()
3014 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_enable_chan_switch()
3018 	if (peer == NULL || !peer->tpk_success) {  in wpa_tdls_enable_chan_switch()
3024 	if (peer->chan_switch_enabled) {  in wpa_tdls_enable_chan_switch()
3031 	ret = wpa_sm_tdls_enable_channel_switch(sm, peer->addr,  in wpa_tdls_enable_chan_switch()
3034 		peer->chan_switch_enabled = 1;  in wpa_tdls_enable_chan_switch()
3042 	struct wpa_tdls_peer *peer;  in wpa_tdls_disable_chan_switch()  local
3047 	for (peer = sm->tdls; peer; peer = peer->next) {  in wpa_tdls_disable_chan_switch()
3048 		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)  in wpa_tdls_disable_chan_switch()
3052 	if (!peer || !peer->chan_switch_enabled) {  in wpa_tdls_disable_chan_switch()
3059 	wpa_sm_tdls_disable_channel_switch(sm, peer->addr);  in wpa_tdls_disable_chan_switch()
3061 	peer->chan_switch_enabled = 0;  in wpa_tdls_disable_chan_switch()