1 /*
2  * wpa_supplicant - Off-channel Action frame TX/RX
3  * Copyright (c) 2009-2010, Atheros Communications
4  * Copyright (c) 2011, Qualcomm Atheros
5  *
6  * This software may be distributed under the terms of the BSD license.
7  * See README for more details.
8  */
9 
10 #include "includes.h"
11 
12 #include "common.h"
13 #include "utils/eloop.h"
14 #include "wpa_supplicant_i.h"
15 #include "p2p_supplicant.h"
16 #include "driver_i.h"
17 #include "offchannel.h"
18 
19 
20 
21 static struct wpa_supplicant *
wpas_get_tx_interface(struct wpa_supplicant * wpa_s,const u8 * src)22 wpas_get_tx_interface(struct wpa_supplicant *wpa_s, const u8 *src)
23 {
24 	struct wpa_supplicant *iface;
25 
26 	if (os_memcmp(src, wpa_s->own_addr, ETH_ALEN) == 0) {
27 #ifdef CONFIG_P2P
28 		if (wpa_s->p2p_mgmt && wpa_s != wpa_s->parent &&
29 		    wpa_s->parent->ap_iface &&
30 		    os_memcmp(wpa_s->parent->own_addr,
31 			      wpa_s->own_addr, ETH_ALEN) == 0 &&
32 		    wpabuf_len(wpa_s->pending_action_tx) >= 2 &&
33 		    *wpabuf_head_u8(wpa_s->pending_action_tx) !=
34 		    WLAN_ACTION_PUBLIC) {
35 			/*
36 			 * When P2P Device interface has same MAC address as
37 			 * the GO interface, make sure non-Public Action frames
38 			 * are sent through the GO interface. The P2P Device
39 			 * interface can only send Public Action frames.
40 			 */
41 			wpa_printf(MSG_DEBUG,
42 				   "P2P: Use GO interface %s instead of interface %s for Action TX",
43 				   wpa_s->parent->ifname, wpa_s->ifname);
44 			return wpa_s->parent;
45 		}
46 #endif /* CONFIG_P2P */
47 		return wpa_s;
48 	}
49 
50 	/*
51 	 * Try to find a group interface that matches with the source address.
52 	 */
53 	iface = wpa_s->global->ifaces;
54 	while (iface) {
55 		if (os_memcmp(src, iface->own_addr, ETH_ALEN) == 0)
56 			break;
57 		iface = iface->next;
58 	}
59 	if (iface) {
60 		wpa_printf(MSG_DEBUG, "P2P: Use group interface %s "
61 			   "instead of interface %s for Action TX",
62 			   iface->ifname, wpa_s->ifname);
63 		return iface;
64 	}
65 
66 	return wpa_s;
67 }
68 
69 
wpas_send_action_cb(void * eloop_ctx,void * timeout_ctx)70 static void wpas_send_action_cb(void *eloop_ctx, void *timeout_ctx)
71 {
72 	struct wpa_supplicant *wpa_s = eloop_ctx;
73 	struct wpa_supplicant *iface;
74 	int res;
75 	int without_roc;
76 
77 	without_roc = wpa_s->pending_action_without_roc;
78 	wpa_s->pending_action_without_roc = 0;
79 	wpa_printf(MSG_DEBUG,
80 		   "Off-channel: Send Action callback (without_roc=%d pending_action_tx=%p pending_action_tx_done=%d)",
81 		   without_roc, wpa_s->pending_action_tx,
82 		   !!wpa_s->pending_action_tx_done);
83 
84 	if (wpa_s->pending_action_tx == NULL || wpa_s->pending_action_tx_done)
85 		return;
86 
87 	/*
88 	 * This call is likely going to be on the P2P device instance if the
89 	 * driver uses a separate interface for that purpose. However, some
90 	 * Action frames are actually sent within a P2P Group and when that is
91 	 * the case, we need to follow power saving (e.g., GO buffering the
92 	 * frame for a client in PS mode or a client following the advertised
93 	 * NoA from its GO). To make that easier for the driver, select the
94 	 * correct group interface here.
95 	 */
96 	iface = wpas_get_tx_interface(wpa_s, wpa_s->pending_action_src);
97 
98 	if (wpa_s->off_channel_freq != wpa_s->pending_action_freq &&
99 	    wpa_s->pending_action_freq != 0 &&
100 	    wpa_s->pending_action_freq != iface->assoc_freq) {
101 		wpa_printf(MSG_DEBUG, "Off-channel: Pending Action frame TX "
102 			   "waiting for another freq=%u (off_channel_freq=%u "
103 			   "assoc_freq=%u)",
104 			   wpa_s->pending_action_freq,
105 			   wpa_s->off_channel_freq,
106 			   iface->assoc_freq);
107 		if (without_roc && wpa_s->off_channel_freq == 0) {
108 			unsigned int duration = 200;
109 			/*
110 			 * We may get here if wpas_send_action() found us to be
111 			 * on the correct channel, but remain-on-channel cancel
112 			 * event was received before getting here.
113 			 */
114 			wpa_printf(MSG_DEBUG, "Off-channel: Schedule "
115 				   "remain-on-channel to send Action frame");
116 #ifdef CONFIG_TESTING_OPTIONS
117 			if (wpa_s->extra_roc_dur) {
118 				wpa_printf(MSG_DEBUG,
119 					   "TESTING: Increase ROC duration %u -> %u",
120 					   duration,
121 					   duration + wpa_s->extra_roc_dur);
122 				duration += wpa_s->extra_roc_dur;
123 	}
124 #endif /* CONFIG_TESTING_OPTIONS */
125 			if (wpa_drv_remain_on_channel(
126 				    wpa_s, wpa_s->pending_action_freq,
127 				    duration) < 0) {
128 				wpa_printf(MSG_DEBUG, "Off-channel: Failed to "
129 					   "request driver to remain on "
130 					   "channel (%u MHz) for Action Frame "
131 					   "TX", wpa_s->pending_action_freq);
132 			} else {
133 				wpa_s->off_channel_freq = 0;
134 				wpa_s->roc_waiting_drv_freq =
135 					wpa_s->pending_action_freq;
136 			}
137 		}
138 		return;
139 	}
140 
141 	wpa_printf(MSG_DEBUG, "Off-channel: Sending pending Action frame to "
142 		   MACSTR " using interface %s (pending_action_tx=%p)",
143 		   MAC2STR(wpa_s->pending_action_dst), iface->ifname,
144 		   wpa_s->pending_action_tx);
145 	res = wpa_drv_send_action(iface, wpa_s->pending_action_freq, 0,
146 				  wpa_s->pending_action_dst,
147 				  wpa_s->pending_action_src,
148 				  wpa_s->pending_action_bssid,
149 				  wpabuf_head(wpa_s->pending_action_tx),
150 				  wpabuf_len(wpa_s->pending_action_tx),
151 				  wpa_s->pending_action_no_cck);
152 	if (res) {
153 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to send the "
154 			   "pending Action frame");
155 		/*
156 		 * Use fake TX status event to allow state machines to
157 		 * continue.
158 		 */
159 		offchannel_send_action_tx_status(
160 			wpa_s, wpa_s->pending_action_dst,
161 			wpabuf_head(wpa_s->pending_action_tx),
162 			wpabuf_len(wpa_s->pending_action_tx),
163 			OFFCHANNEL_SEND_ACTION_FAILED);
164 	}
165 }
166 
167 
168 /**
169  * offchannel_send_action_tx_status - TX status callback
170  * @wpa_s: Pointer to wpa_supplicant data
171  * @dst: Destination MAC address of the transmitted Action frame
172  * @data: Transmitted frame payload
173  * @data_len: Length of @data in bytes
174  * @result: TX status
175  *
176  * This function is called whenever the driver indicates a TX status event for
177  * a frame sent by offchannel_send_action() using wpa_drv_send_action().
178  */
offchannel_send_action_tx_status(struct wpa_supplicant * wpa_s,const u8 * dst,const u8 * data,size_t data_len,enum offchannel_send_action_result result)179 void offchannel_send_action_tx_status(
180 	struct wpa_supplicant *wpa_s, const u8 *dst, const u8 *data,
181 	size_t data_len, enum offchannel_send_action_result result)
182 {
183 	if (wpa_s->pending_action_tx == NULL) {
184 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
185 			   "no pending operation");
186 		return;
187 	}
188 
189 	if (os_memcmp(dst, wpa_s->pending_action_dst, ETH_ALEN) != 0) {
190 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
191 			   "unknown destination address");
192 		return;
193 	}
194 
195 	/* Accept report only if the contents of the frame matches */
196 	if (data_len - wpabuf_len(wpa_s->pending_action_tx) != 24 ||
197 	    os_memcmp(data + 24, wpabuf_head(wpa_s->pending_action_tx),
198 		      wpabuf_len(wpa_s->pending_action_tx)) != 0) {
199 		wpa_printf(MSG_DEBUG, "Off-channel: Ignore Action TX status - "
200 				   "mismatching contents with pending frame");
201 		wpa_hexdump(MSG_MSGDUMP, "TX status frame data",
202 			    data, data_len);
203 		wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
204 				wpa_s->pending_action_tx);
205 		return;
206 	}
207 
208 	wpa_printf(MSG_DEBUG,
209 		   "Off-channel: Delete matching pending action frame (dst="
210 		   MACSTR " pending_action_tx=%p)", MAC2STR(dst),
211 		   wpa_s->pending_action_tx);
212 	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
213 			wpa_s->pending_action_tx);
214 	wpabuf_free(wpa_s->pending_action_tx);
215 	wpa_s->pending_action_tx = NULL;
216 
217 	wpa_printf(MSG_DEBUG, "Off-channel: TX status result=%d cb=%p",
218 		   result, wpa_s->pending_action_tx_status_cb);
219 
220 	if (wpa_s->pending_action_tx_status_cb) {
221 		wpa_s->pending_action_tx_status_cb(
222 			wpa_s, wpa_s->pending_action_freq,
223 			wpa_s->pending_action_dst, wpa_s->pending_action_src,
224 			wpa_s->pending_action_bssid,
225 			data, data_len, result);
226 	}
227 
228 #ifdef CONFIG_P2P
229 	if (wpa_s->global->p2p_long_listen > 0) {
230 		/* Continue the listen */
231 		wpa_printf(MSG_DEBUG, "P2P: Continuing long Listen state");
232 		wpas_p2p_listen_start(wpa_s, wpa_s->global->p2p_long_listen);
233 	}
234 #endif /* CONFIG_P2P */
235 }
236 
237 
238 /**
239  * offchannel_send_action - Request off-channel Action frame TX
240  * @wpa_s: Pointer to wpa_supplicant data
241  * @freq: The frequency in MHz indicating the channel on which the frame is to
242  *	transmitted or 0 for the current channel (only if associated)
243  * @dst: Action frame destination MAC address
244  * @src: Action frame source MAC address
245  * @bssid: Action frame BSSID
246  * @buf: Frame to transmit starting from the Category field
247  * @len: Length of @buf in bytes
248  * @wait_time: Wait time for response in milliseconds
249  * @tx_cb: Callback function for indicating TX status or %NULL for no callback
250  * @no_cck: Whether CCK rates are to be disallowed for TX rate selection
251  * Returns: 0 on success or -1 on failure
252  *
253  * This function is used to request an Action frame to be transmitted on the
254  * current operating channel or on another channel (off-channel). The actual
255  * frame transmission will be delayed until the driver is ready on the specified
256  * channel. The @wait_time parameter can be used to request the driver to remain
257  * awake on the channel to wait for a response.
258  */
offchannel_send_action(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * buf,size_t len,unsigned int wait_time,void (* tx_cb)(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,enum offchannel_send_action_result result),int no_cck)259 int offchannel_send_action(struct wpa_supplicant *wpa_s, unsigned int freq,
260 			   const u8 *dst, const u8 *src, const u8 *bssid,
261 			   const u8 *buf, size_t len, unsigned int wait_time,
262 			   void (*tx_cb)(struct wpa_supplicant *wpa_s,
263 					 unsigned int freq, const u8 *dst,
264 					 const u8 *src, const u8 *bssid,
265 					 const u8 *data, size_t data_len,
266 					 enum offchannel_send_action_result
267 					 result),
268 			   int no_cck)
269 {
270 	wpa_printf(MSG_DEBUG, "Off-channel: Send action frame: freq=%d dst="
271 		   MACSTR " src=" MACSTR " bssid=" MACSTR " len=%d",
272 		   freq, MAC2STR(dst), MAC2STR(src), MAC2STR(bssid),
273 		   (int) len);
274 
275 	wpa_s->pending_action_tx_status_cb = tx_cb;
276 
277 	if (wpa_s->pending_action_tx) {
278 		wpa_printf(MSG_DEBUG, "Off-channel: Dropped pending Action "
279 			   "frame TX to " MACSTR " (pending_action_tx=%p)",
280 			   MAC2STR(wpa_s->pending_action_dst),
281 			   wpa_s->pending_action_tx);
282 		wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
283 				wpa_s->pending_action_tx);
284 		wpabuf_free(wpa_s->pending_action_tx);
285 	}
286 	wpa_s->pending_action_tx_done = 0;
287 	wpa_s->pending_action_tx = wpabuf_alloc(len);
288 	if (wpa_s->pending_action_tx == NULL) {
289 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to allocate Action "
290 			   "frame TX buffer (len=%llu)",
291 			   (unsigned long long) len);
292 		return -1;
293 	}
294 	wpabuf_put_data(wpa_s->pending_action_tx, buf, len);
295 	os_memcpy(wpa_s->pending_action_src, src, ETH_ALEN);
296 	os_memcpy(wpa_s->pending_action_dst, dst, ETH_ALEN);
297 	os_memcpy(wpa_s->pending_action_bssid, bssid, ETH_ALEN);
298 	wpa_s->pending_action_freq = freq;
299 	wpa_s->pending_action_no_cck = no_cck;
300 	wpa_printf(MSG_DEBUG,
301 		   "Off-channel: Stored pending action frame (dst=" MACSTR
302 		   " pending_action_tx=%p)",
303 		   MAC2STR(dst), wpa_s->pending_action_tx);
304 	wpa_hexdump_buf(MSG_MSGDUMP, "Pending TX frame",
305 			wpa_s->pending_action_tx);
306 
307 	if (freq != 0 && wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX) {
308 		struct wpa_supplicant *iface;
309 		int ret;
310 
311 		iface = wpas_get_tx_interface(wpa_s, src);
312 		wpa_s->action_tx_wait_time = wait_time;
313 		if (wait_time)
314 			wpa_s->action_tx_wait_time_used = 1;
315 
316 		ret = wpa_drv_send_action(
317 			iface, wpa_s->pending_action_freq,
318 			wait_time, wpa_s->pending_action_dst,
319 			wpa_s->pending_action_src, wpa_s->pending_action_bssid,
320 			wpabuf_head(wpa_s->pending_action_tx),
321 			wpabuf_len(wpa_s->pending_action_tx),
322 			wpa_s->pending_action_no_cck);
323 		if (ret == 0)
324 			wpa_s->pending_action_tx_done = 1;
325 		return ret;
326 	}
327 
328 	if (freq) {
329 		struct wpa_supplicant *tx_iface;
330 		tx_iface = wpas_get_tx_interface(wpa_s, src);
331 		if (tx_iface->assoc_freq == freq) {
332 			wpa_printf(MSG_DEBUG, "Off-channel: Already on "
333 				   "requested channel (TX interface operating "
334 				   "channel)");
335 			freq = 0;
336 		}
337 	}
338 
339 	if (wpa_s->off_channel_freq == freq || freq == 0) {
340 		wpa_printf(MSG_DEBUG, "Off-channel: Already on requested "
341 			   "channel; send Action frame immediately");
342 		/* TODO: Would there ever be need to extend the current
343 		 * duration on the channel? */
344 		wpa_s->pending_action_without_roc = 1;
345 		eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
346 		eloop_register_timeout(0, 0, wpas_send_action_cb, wpa_s, NULL);
347 		return 0;
348 	}
349 	wpa_s->pending_action_without_roc = 0;
350 
351 	if (wpa_s->roc_waiting_drv_freq == freq) {
352 		wpa_printf(MSG_DEBUG, "Off-channel: Already waiting for "
353 			   "driver to get to frequency %u MHz; continue "
354 			   "waiting to send the Action frame", freq);
355 		return 0;
356 	}
357 
358 	wpa_printf(MSG_DEBUG, "Off-channel: Schedule Action frame to be "
359 		   "transmitted once the driver gets to the requested "
360 		   "channel");
361 	if (wait_time > wpa_s->max_remain_on_chan)
362 		wait_time = wpa_s->max_remain_on_chan;
363 	else if (wait_time == 0)
364 		wait_time = 20;
365 #ifdef CONFIG_TESTING_OPTIONS
366 	if (wpa_s->extra_roc_dur) {
367 		wpa_printf(MSG_DEBUG, "TESTING: Increase ROC duration %u -> %u",
368 			   wait_time, wait_time + wpa_s->extra_roc_dur);
369 		wait_time += wpa_s->extra_roc_dur;
370 	}
371 #endif /* CONFIG_TESTING_OPTIONS */
372 	if (wpa_drv_remain_on_channel(wpa_s, freq, wait_time) < 0) {
373 		wpa_printf(MSG_DEBUG, "Off-channel: Failed to request driver "
374 			   "to remain on channel (%u MHz) for Action "
375 			   "Frame TX", freq);
376 		return -1;
377 	}
378 	wpa_s->off_channel_freq = 0;
379 	wpa_s->roc_waiting_drv_freq = freq;
380 
381 	return 0;
382 }
383 
384 
385 /**
386  * offchannel_send_send_action_done - Notify completion of Action frame sequence
387  * @wpa_s: Pointer to wpa_supplicant data
388  *
389  * This function can be used to cancel a wait for additional response frames on
390  * the channel that was used with offchannel_send_action().
391  */
offchannel_send_action_done(struct wpa_supplicant * wpa_s)392 void offchannel_send_action_done(struct wpa_supplicant *wpa_s)
393 {
394 	wpa_printf(MSG_DEBUG,
395 		   "Off-channel: Action frame sequence done notification: pending_action_tx=%p drv_offchan_tx=%d action_tx_wait_time=%d off_channel_freq=%d roc_waiting_drv_freq=%d",
396 		   wpa_s->pending_action_tx,
397 		   !!(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX),
398 		   wpa_s->action_tx_wait_time, wpa_s->off_channel_freq,
399 		   wpa_s->roc_waiting_drv_freq);
400 	wpabuf_free(wpa_s->pending_action_tx);
401 	wpa_s->pending_action_tx = NULL;
402 	if (wpa_s->drv_flags & WPA_DRIVER_FLAGS_OFFCHANNEL_TX &&
403 	    (wpa_s->action_tx_wait_time || wpa_s->action_tx_wait_time_used))
404 		wpa_drv_send_action_cancel_wait(wpa_s);
405 	else if (wpa_s->off_channel_freq || wpa_s->roc_waiting_drv_freq) {
406 		wpa_drv_cancel_remain_on_channel(wpa_s);
407 		wpa_s->off_channel_freq = 0;
408 		wpa_s->roc_waiting_drv_freq = 0;
409 	}
410 	wpa_s->action_tx_wait_time_used = 0;
411 }
412 
413 
414 /**
415  * offchannel_remain_on_channel_cb - Remain-on-channel callback function
416  * @wpa_s: Pointer to wpa_supplicant data
417  * @freq: Frequency (in MHz) of the selected channel
418  * @duration: Duration of the remain-on-channel operation in milliseconds
419  *
420  * This function is called whenever the driver notifies beginning of a
421  * remain-on-channel operation.
422  */
offchannel_remain_on_channel_cb(struct wpa_supplicant * wpa_s,unsigned int freq,unsigned int duration)423 void offchannel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
424 				     unsigned int freq, unsigned int duration)
425 {
426 	wpa_s->roc_waiting_drv_freq = 0;
427 	wpa_s->off_channel_freq = freq;
428 	wpas_send_action_cb(wpa_s, NULL);
429 }
430 
431 
432 /**
433  * offchannel_cancel_remain_on_channel_cb - Remain-on-channel stopped callback
434  * @wpa_s: Pointer to wpa_supplicant data
435  * @freq: Frequency (in MHz) of the selected channel
436  *
437  * This function is called whenever the driver notifies termination of a
438  * remain-on-channel operation.
439  */
offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant * wpa_s,unsigned int freq)440 void offchannel_cancel_remain_on_channel_cb(struct wpa_supplicant *wpa_s,
441 					    unsigned int freq)
442 {
443 	wpa_s->off_channel_freq = 0;
444 }
445 
446 
447 /**
448  * offchannel_pending_action_tx - Check whether there is a pending Action TX
449  * @wpa_s: Pointer to wpa_supplicant data
450  * Returns: Pointer to pending frame or %NULL if no pending operation
451  *
452  * This function can be used to check whether there is a pending Action frame TX
453  * operation. The returned pointer should be used only for checking whether it
454  * is %NULL (no pending frame) or to print the pointer value in debug
455  * information (i.e., the pointer should not be dereferenced).
456  */
offchannel_pending_action_tx(struct wpa_supplicant * wpa_s)457 const void * offchannel_pending_action_tx(struct wpa_supplicant *wpa_s)
458 {
459 	return wpa_s->pending_action_tx;
460 }
461 
462 
463 /**
464  * offchannel_clear_pending_action_tx - Clear pending Action frame TX
465  * @wpa_s: Pointer to wpa_supplicant data
466  */
offchannel_clear_pending_action_tx(struct wpa_supplicant * wpa_s)467 void offchannel_clear_pending_action_tx(struct wpa_supplicant *wpa_s)
468 {
469 	wpa_printf(MSG_DEBUG,
470 		   "Off-channel: Clear pending Action frame TX (pending_action_tx=%p",
471 		   wpa_s->pending_action_tx);
472 	wpabuf_free(wpa_s->pending_action_tx);
473 	wpa_s->pending_action_tx = NULL;
474 }
475 
476 
477 /**
478  * offchannel_deinit - Deinit off-channel operations
479  * @wpa_s: Pointer to wpa_supplicant data
480  *
481  * This function is used to free up any allocated resources for off-channel
482  * operations.
483  */
offchannel_deinit(struct wpa_supplicant * wpa_s)484 void offchannel_deinit(struct wpa_supplicant *wpa_s)
485 {
486 	offchannel_clear_pending_action_tx(wpa_s);
487 	eloop_cancel_timeout(wpas_send_action_cb, wpa_s, NULL);
488 }
489