1 /*
2 * wpa_supplicant - TDLS
3 * Copyright (c) 2010-2011, Atheros Communications
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "utils/os.h"
14 #include "common/ieee802_11_defs.h"
15 #include "crypto/sha256.h"
16 #include "crypto/crypto.h"
17 #include "crypto/aes_wrap.h"
18 #include "rsn_supp/wpa.h"
19 #include "rsn_supp/wpa_ie.h"
20 #include "rsn_supp/wpa_i.h"
21 #include "drivers/driver.h"
22 #include "l2_packet/l2_packet.h"
23
24 #ifdef CONFIG_TDLS_TESTING
25 #define TDLS_TESTING_LONG_FRAME BIT(0)
26 #define TDLS_TESTING_ALT_RSN_IE BIT(1)
27 #define TDLS_TESTING_DIFF_BSSID BIT(2)
28 #define TDLS_TESTING_SHORT_LIFETIME BIT(3)
29 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
30 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
31 #define TDLS_TESTING_LONG_LIFETIME BIT(6)
32 #define TDLS_TESTING_CONCURRENT_INIT BIT(7)
33 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
34 #define TDLS_TESTING_DECLINE_RESP BIT(9)
35 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
36 #define TDLS_TESTING_WRONG_MIC BIT(11)
37 unsigned int tdls_testing = 0;
38 #endif /* CONFIG_TDLS_TESTING */
39
40 #define TPK_LIFETIME 43200 /* 12 hours */
41 #define TPK_M1_RETRY_COUNT 3
42 #define TPK_M1_TIMEOUT 5000 /* in milliseconds */
43 #define TPK_M2_RETRY_COUNT 10
44 #define TPK_M2_TIMEOUT 500 /* in milliseconds */
45
46 #define TDLS_MIC_LEN 16
47
48 #define TDLS_TIMEOUT_LEN 4
49
50 struct wpa_tdls_ftie {
51 u8 ie_type; /* FTIE */
52 u8 ie_len;
53 u8 mic_ctrl[2];
54 u8 mic[TDLS_MIC_LEN];
55 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
56 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
57 /* followed by optional elements */
58 } STRUCT_PACKED;
59
60 struct wpa_tdls_timeoutie {
61 u8 ie_type; /* Timeout IE */
62 u8 ie_len;
63 u8 interval_type;
64 u8 value[TDLS_TIMEOUT_LEN];
65 } STRUCT_PACKED;
66
67 struct wpa_tdls_lnkid {
68 u8 ie_type; /* Link Identifier IE */
69 u8 ie_len;
70 u8 bssid[ETH_ALEN];
71 u8 init_sta[ETH_ALEN];
72 u8 resp_sta[ETH_ALEN];
73 } STRUCT_PACKED;
74
75 /* TDLS frame headers as per IEEE Std 802.11z-2010 */
76 struct wpa_tdls_frame {
77 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
78 u8 category; /* Category */
79 u8 action; /* Action (enum tdls_frame_type) */
80 } STRUCT_PACKED;
81
82 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
83 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
84 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
85 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
86 struct wpa_tdls_peer *peer);
87 static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
88 u16 reason_code);
89
90
91 #define TDLS_MAX_IE_LEN 80
92 #define IEEE80211_MAX_SUPP_RATES 32
93
94 struct wpa_tdls_peer {
95 struct wpa_tdls_peer *next;
96 unsigned int reconfig_key:1;
97 int initiator; /* whether this end was initiator for TDLS setup */
98 u8 addr[ETH_ALEN]; /* other end MAC address */
99 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
100 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
101 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
102 size_t rsnie_i_len;
103 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
104 size_t rsnie_p_len;
105 u32 lifetime;
106 int cipher; /* Selected cipher (WPA_CIPHER_*) */
107 u8 dtoken;
108
109 struct tpk {
110 u8 kck[16]; /* TPK-KCK */
111 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
112 } tpk;
113 int tpk_set;
114 int tpk_success;
115 int tpk_in_progress;
116
117 struct tpk_timer {
118 u8 dest[ETH_ALEN];
119 int count; /* Retry Count */
120 int timer; /* Timeout in milliseconds */
121 u8 action_code; /* TDLS frame type */
122 u8 dialog_token;
123 u16 status_code;
124 u32 peer_capab;
125 int buf_len; /* length of TPK message for retransmission */
126 u8 *buf; /* buffer for TPK message */
127 } sm_tmr;
128
129 u16 capability;
130
131 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
132 size_t supp_rates_len;
133
134 struct ieee80211_ht_capabilities *ht_capabilities;
135 struct ieee80211_vht_capabilities *vht_capabilities;
136
137 u8 qos_info;
138
139 u16 aid;
140
141 u8 *ext_capab;
142 size_t ext_capab_len;
143
144 u8 *supp_channels;
145 size_t supp_channels_len;
146
147 u8 *supp_oper_classes;
148 size_t supp_oper_classes_len;
149
150 u8 wmm_capable;
151
152 /* channel switch currently enabled */
153 int chan_switch_enabled;
154 };
155
156
wpa_tdls_get_privacy(struct wpa_sm * sm)157 static int wpa_tdls_get_privacy(struct wpa_sm *sm)
158 {
159 /*
160 * Get info needed from supplicant to check if the current BSS supports
161 * security. Other than OPEN mode, rest are considered secured
162 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
163 */
164 return sm->pairwise_cipher != WPA_CIPHER_NONE;
165 }
166
167
wpa_add_ie(u8 * pos,const u8 * ie,size_t ie_len)168 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
169 {
170 os_memcpy(pos, ie, ie_len);
171 return pos + ie_len;
172 }
173
174
wpa_tdls_del_key(struct wpa_sm * sm,struct wpa_tdls_peer * peer)175 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
176 {
177 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,
178 0, 0, NULL, 0, NULL, 0) < 0) {
179 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
180 "the driver");
181 return -1;
182 }
183
184 return 0;
185 }
186
187
wpa_tdls_set_key(struct wpa_sm * sm,struct wpa_tdls_peer * peer)188 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
189 {
190 u8 key_len;
191 u8 rsc[6];
192 enum wpa_alg alg;
193
194 os_memset(rsc, 0, 6);
195
196 switch (peer->cipher) {
197 case WPA_CIPHER_CCMP:
198 alg = WPA_ALG_CCMP;
199 key_len = 16;
200 break;
201 case WPA_CIPHER_NONE:
202 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
203 "NONE - do not use pairwise keys");
204 return -1;
205 default:
206 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
207 sm->pairwise_cipher);
208 return -1;
209 }
210
211 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
212 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
213 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
214 "driver");
215 return -1;
216 }
217 return 0;
218 }
219
220
wpa_tdls_send_tpk_msg(struct wpa_sm * sm,const u8 * dst,u8 action_code,u8 dialog_token,u16 status_code,u32 peer_capab,int initiator,const u8 * buf,size_t len)221 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
222 u8 action_code, u8 dialog_token,
223 u16 status_code, u32 peer_capab,
224 int initiator, const u8 *buf, size_t len)
225 {
226 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
227 status_code, peer_capab, initiator, buf,
228 len);
229 }
230
231
wpa_tdls_tpk_send(struct wpa_sm * sm,const u8 * dest,u8 action_code,u8 dialog_token,u16 status_code,u32 peer_capab,int initiator,const u8 * msg,size_t msg_len)232 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
233 u8 dialog_token, u16 status_code, u32 peer_capab,
234 int initiator, const u8 *msg, size_t msg_len)
235 {
236 struct wpa_tdls_peer *peer;
237
238 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
239 "dialog_token=%u status_code=%u peer_capab=%u initiator=%d "
240 "msg_len=%u",
241 MAC2STR(dest), action_code, dialog_token, status_code,
242 peer_capab, initiator, (unsigned int) msg_len);
243
244 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
245 status_code, peer_capab, initiator, msg,
246 msg_len)) {
247 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
248 "(action_code=%u)", action_code);
249 return -1;
250 }
251
252 if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
253 action_code == WLAN_TDLS_TEARDOWN ||
254 action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
255 action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
256 return 0; /* No retries */
257
258 for (peer = sm->tdls; peer; peer = peer->next) {
259 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)
260 break;
261 }
262
263 if (peer == NULL) {
264 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
265 "retry " MACSTR, MAC2STR(dest));
266 return 0;
267 }
268
269 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
270
271 if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
272 peer->sm_tmr.count = TPK_M2_RETRY_COUNT;
273 peer->sm_tmr.timer = TPK_M2_TIMEOUT;
274 } else {
275 peer->sm_tmr.count = TPK_M1_RETRY_COUNT;
276 peer->sm_tmr.timer = TPK_M1_TIMEOUT;
277 }
278
279 /* Copy message to resend on timeout */
280 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
281 peer->sm_tmr.action_code = action_code;
282 peer->sm_tmr.dialog_token = dialog_token;
283 peer->sm_tmr.status_code = status_code;
284 peer->sm_tmr.peer_capab = peer_capab;
285 peer->sm_tmr.buf_len = msg_len;
286 os_free(peer->sm_tmr.buf);
287 peer->sm_tmr.buf = os_malloc(msg_len);
288 if (peer->sm_tmr.buf == NULL)
289 return -1;
290 os_memcpy(peer->sm_tmr.buf, msg, msg_len);
291
292 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
293 "(action_code=%u)", action_code);
294 eloop_register_timeout(peer->sm_tmr.timer / 1000,
295 (peer->sm_tmr.timer % 1000) * 1000,
296 wpa_tdls_tpk_retry_timeout, sm, peer);
297 return 0;
298 }
299
300
wpa_tdls_do_teardown(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u16 reason_code)301 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
302 u16 reason_code)
303 {
304 int ret;
305
306 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
307 /* disable the link after teardown was sent */
308 wpa_tdls_disable_peer_link(sm, peer);
309
310 return ret;
311 }
312
313
wpa_tdls_tpk_retry_timeout(void * eloop_ctx,void * timeout_ctx)314 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
315 {
316
317 struct wpa_sm *sm = eloop_ctx;
318 struct wpa_tdls_peer *peer = timeout_ctx;
319
320 if (peer->sm_tmr.count) {
321 peer->sm_tmr.count--;
322
323 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
324 "(action_code=%u)",
325 peer->sm_tmr.action_code);
326
327 if (peer->sm_tmr.buf == NULL) {
328 wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
329 "for action_code=%u",
330 peer->sm_tmr.action_code);
331 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
332 peer);
333 return;
334 }
335
336 /* resend TPK Handshake Message to Peer */
337 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
338 peer->sm_tmr.action_code,
339 peer->sm_tmr.dialog_token,
340 peer->sm_tmr.status_code,
341 peer->sm_tmr.peer_capab,
342 peer->initiator,
343 peer->sm_tmr.buf,
344 peer->sm_tmr.buf_len)) {
345 wpa_printf(MSG_INFO, "TDLS: Failed to retry "
346 "transmission");
347 }
348
349 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
350 eloop_register_timeout(peer->sm_tmr.timer / 1000,
351 (peer->sm_tmr.timer % 1000) * 1000,
352 wpa_tdls_tpk_retry_timeout, sm, peer);
353 } else {
354 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
355
356 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
357 wpa_tdls_do_teardown(sm, peer,
358 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
359 }
360 }
361
362
wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u8 action_code)363 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
364 struct wpa_tdls_peer *peer,
365 u8 action_code)
366 {
367 if (action_code == peer->sm_tmr.action_code) {
368 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
369 "action_code=%u", action_code);
370
371 /* Cancel Timeout registered */
372 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
373
374 /* free all resources meant for retry */
375 os_free(peer->sm_tmr.buf);
376 peer->sm_tmr.buf = NULL;
377
378 peer->sm_tmr.count = 0;
379 peer->sm_tmr.timer = 0;
380 peer->sm_tmr.buf_len = 0;
381 peer->sm_tmr.action_code = 0xff;
382 } else {
383 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
384 "(Unknown action_code=%u)", action_code);
385 }
386 }
387
388
wpa_tdls_generate_tpk(struct wpa_tdls_peer * peer,const u8 * own_addr,const u8 * bssid)389 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
390 const u8 *own_addr, const u8 *bssid)
391 {
392 u8 key_input[SHA256_MAC_LEN];
393 const u8 *nonce[2];
394 size_t len[2];
395 u8 data[3 * ETH_ALEN];
396
397 /* IEEE Std 802.11z-2010 8.5.9.1:
398 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
399 */
400 len[0] = WPA_NONCE_LEN;
401 len[1] = WPA_NONCE_LEN;
402 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
403 nonce[0] = peer->inonce;
404 nonce[1] = peer->rnonce;
405 } else {
406 nonce[0] = peer->rnonce;
407 nonce[1] = peer->inonce;
408 }
409 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
410 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
411 sha256_vector(2, nonce, len, key_input);
412 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
413 key_input, SHA256_MAC_LEN);
414
415 /*
416 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
417 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
418 * TODO: is N_KEY really included in KDF Context and if so, in which
419 * presentation format (little endian 16-bit?) is it used? It gets
420 * added by the KDF anyway..
421 */
422
423 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
424 os_memcpy(data, own_addr, ETH_ALEN);
425 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
426 } else {
427 os_memcpy(data, peer->addr, ETH_ALEN);
428 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
429 }
430 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
431 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
432
433 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
434 (u8 *) &peer->tpk, sizeof(peer->tpk));
435 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
436 peer->tpk.kck, sizeof(peer->tpk.kck));
437 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
438 peer->tpk.tk, sizeof(peer->tpk.tk));
439 peer->tpk_set = 1;
440 }
441
442
443 /**
444 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
445 * @kck: TPK-KCK
446 * @lnkid: Pointer to the beginning of Link Identifier IE
447 * @rsnie: Pointer to the beginning of RSN IE used for handshake
448 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
449 * @ftie: Pointer to the beginning of FT IE
450 * @mic: Pointer for writing MIC
451 *
452 * Calculate MIC for TDLS frame.
453 */
wpa_tdls_ftie_mic(const u8 * kck,u8 trans_seq,const u8 * lnkid,const u8 * rsnie,const u8 * timeoutie,const u8 * ftie,u8 * mic)454 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
455 const u8 *rsnie, const u8 *timeoutie,
456 const u8 *ftie, u8 *mic)
457 {
458 u8 *buf, *pos;
459 struct wpa_tdls_ftie *_ftie;
460 const struct wpa_tdls_lnkid *_lnkid;
461 int ret;
462 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
463 2 + timeoutie[1] + 2 + ftie[1];
464 buf = os_zalloc(len);
465 if (!buf) {
466 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
467 return -1;
468 }
469
470 pos = buf;
471 _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
472 /* 1) TDLS initiator STA MAC address */
473 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
474 pos += ETH_ALEN;
475 /* 2) TDLS responder STA MAC address */
476 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
477 pos += ETH_ALEN;
478 /* 3) Transaction Sequence number */
479 *pos++ = trans_seq;
480 /* 4) Link Identifier IE */
481 os_memcpy(pos, lnkid, 2 + lnkid[1]);
482 pos += 2 + lnkid[1];
483 /* 5) RSN IE */
484 os_memcpy(pos, rsnie, 2 + rsnie[1]);
485 pos += 2 + rsnie[1];
486 /* 6) Timeout Interval IE */
487 os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
488 pos += 2 + timeoutie[1];
489 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
490 os_memcpy(pos, ftie, 2 + ftie[1]);
491 _ftie = (struct wpa_tdls_ftie *) pos;
492 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
493 pos += 2 + ftie[1];
494
495 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
496 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
497 ret = omac1_aes_128(kck, buf, pos - buf, mic);
498 os_free(buf);
499 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
500 return ret;
501 }
502
503
504 /**
505 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
506 * @kck: TPK-KCK
507 * @trans_seq: Transaction Sequence Number (4 - Teardown)
508 * @rcode: Reason code for Teardown
509 * @dtoken: Dialog Token used for that particular link
510 * @lnkid: Pointer to the beginning of Link Identifier IE
511 * @ftie: Pointer to the beginning of FT IE
512 * @mic: Pointer for writing MIC
513 *
514 * Calculate MIC for TDLS frame.
515 */
wpa_tdls_key_mic_teardown(const u8 * kck,u8 trans_seq,u16 rcode,u8 dtoken,const u8 * lnkid,const u8 * ftie,u8 * mic)516 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
517 u8 dtoken, const u8 *lnkid,
518 const u8 *ftie, u8 *mic)
519 {
520 u8 *buf, *pos;
521 struct wpa_tdls_ftie *_ftie;
522 int ret;
523 int len;
524
525 if (lnkid == NULL)
526 return -1;
527
528 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
529 sizeof(trans_seq) + 2 + ftie[1];
530
531 buf = os_zalloc(len);
532 if (!buf) {
533 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
534 return -1;
535 }
536
537 pos = buf;
538 /* 1) Link Identifier IE */
539 os_memcpy(pos, lnkid, 2 + lnkid[1]);
540 pos += 2 + lnkid[1];
541 /* 2) Reason Code */
542 WPA_PUT_LE16(pos, rcode);
543 pos += sizeof(rcode);
544 /* 3) Dialog token */
545 *pos++ = dtoken;
546 /* 4) Transaction Sequence number */
547 *pos++ = trans_seq;
548 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
549 os_memcpy(pos, ftie, 2 + ftie[1]);
550 _ftie = (struct wpa_tdls_ftie *) pos;
551 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
552 pos += 2 + ftie[1];
553
554 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
555 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
556 ret = omac1_aes_128(kck, buf, pos - buf, mic);
557 os_free(buf);
558 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
559 return ret;
560 }
561
562
wpa_supplicant_verify_tdls_mic(u8 trans_seq,struct wpa_tdls_peer * peer,const u8 * lnkid,const u8 * timeoutie,const struct wpa_tdls_ftie * ftie)563 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
564 struct wpa_tdls_peer *peer,
565 const u8 *lnkid, const u8 *timeoutie,
566 const struct wpa_tdls_ftie *ftie)
567 {
568 u8 mic[16];
569
570 if (peer->tpk_set) {
571 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
572 peer->rsnie_p, timeoutie, (u8 *) ftie,
573 mic);
574 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
575 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
576 "dropping packet");
577 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
578 ftie->mic, 16);
579 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
580 mic, 16);
581 return -1;
582 }
583 } else {
584 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
585 "TPK not set - dropping packet");
586 return -1;
587 }
588 return 0;
589 }
590
591
wpa_supplicant_verify_tdls_mic_teardown(u8 trans_seq,u16 rcode,u8 dtoken,struct wpa_tdls_peer * peer,const u8 * lnkid,const struct wpa_tdls_ftie * ftie)592 static int wpa_supplicant_verify_tdls_mic_teardown(
593 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
594 const u8 *lnkid, const struct wpa_tdls_ftie *ftie)
595 {
596 u8 mic[16];
597
598 if (peer->tpk_set) {
599 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
600 dtoken, lnkid, (u8 *) ftie, mic);
601 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
602 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
603 "dropping packet");
604 return -1;
605 }
606 } else {
607 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
608 "MIC, TPK not set - dropping packet");
609 return -1;
610 }
611 return 0;
612 }
613
614
wpa_tdls_tpk_timeout(void * eloop_ctx,void * timeout_ctx)615 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
616 {
617 struct wpa_sm *sm = eloop_ctx;
618 struct wpa_tdls_peer *peer = timeout_ctx;
619
620 /*
621 * On TPK lifetime expiration, we have an option of either tearing down
622 * the direct link or trying to re-initiate it. The selection of what
623 * to do is not strictly speaking controlled by our role in the expired
624 * link, but for now, use that to select whether to renew or tear down
625 * the link.
626 */
627
628 if (peer->initiator) {
629 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
630 " - try to renew", MAC2STR(peer->addr));
631 wpa_tdls_start(sm, peer->addr);
632 } else {
633 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
634 " - tear down", MAC2STR(peer->addr));
635 wpa_tdls_do_teardown(sm, peer,
636 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
637 }
638 }
639
640
wpa_tdls_peer_remove_from_list(struct wpa_sm * sm,struct wpa_tdls_peer * peer)641 static void wpa_tdls_peer_remove_from_list(struct wpa_sm *sm,
642 struct wpa_tdls_peer *peer)
643 {
644 struct wpa_tdls_peer *cur, *prev;
645
646 cur = sm->tdls;
647 prev = NULL;
648 while (cur && cur != peer) {
649 prev = cur;
650 cur = cur->next;
651 }
652
653 if (cur != peer) {
654 wpa_printf(MSG_ERROR, "TDLS: Could not find peer " MACSTR
655 " to remove it from the list",
656 MAC2STR(peer->addr));
657 return;
658 }
659
660 if (prev)
661 prev->next = peer->next;
662 else
663 sm->tdls = peer->next;
664 }
665
666
wpa_tdls_peer_clear(struct wpa_sm * sm,struct wpa_tdls_peer * peer)667 static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
668 {
669 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
670 MAC2STR(peer->addr));
671 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
672 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
673 peer->reconfig_key = 0;
674 peer->initiator = 0;
675 peer->tpk_in_progress = 0;
676 os_free(peer->sm_tmr.buf);
677 peer->sm_tmr.buf = NULL;
678 os_free(peer->ht_capabilities);
679 peer->ht_capabilities = NULL;
680 os_free(peer->vht_capabilities);
681 peer->vht_capabilities = NULL;
682 os_free(peer->ext_capab);
683 peer->ext_capab = NULL;
684 os_free(peer->supp_channels);
685 peer->supp_channels = NULL;
686 os_free(peer->supp_oper_classes);
687 peer->supp_oper_classes = NULL;
688 peer->rsnie_i_len = peer->rsnie_p_len = 0;
689 peer->cipher = 0;
690 peer->qos_info = 0;
691 peer->wmm_capable = 0;
692 peer->tpk_set = peer->tpk_success = 0;
693 peer->chan_switch_enabled = 0;
694 os_memset(&peer->tpk, 0, sizeof(peer->tpk));
695 os_memset(peer->inonce, 0, WPA_NONCE_LEN);
696 os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
697 }
698
699
wpa_tdls_peer_free(struct wpa_sm * sm,struct wpa_tdls_peer * peer)700 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
701 {
702 wpa_tdls_peer_clear(sm, peer);
703 wpa_tdls_peer_remove_from_list(sm, peer);
704 os_free(peer);
705 }
706
707
wpa_tdls_linkid(struct wpa_sm * sm,struct wpa_tdls_peer * peer,struct wpa_tdls_lnkid * lnkid)708 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
709 struct wpa_tdls_lnkid *lnkid)
710 {
711 lnkid->ie_type = WLAN_EID_LINK_ID;
712 lnkid->ie_len = 3 * ETH_ALEN;
713 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN);
714 if (peer->initiator) {
715 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
716 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
717 } else {
718 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
719 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
720 }
721 }
722
723
wpa_tdls_send_teardown(struct wpa_sm * sm,const u8 * addr,u16 reason_code)724 static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
725 u16 reason_code)
726 {
727 struct wpa_tdls_peer *peer;
728 struct wpa_tdls_ftie *ftie;
729 struct wpa_tdls_lnkid lnkid;
730 u8 dialog_token;
731 u8 *rbuf, *pos;
732 int ielen;
733
734 if (sm->tdls_disabled || !sm->tdls_supported)
735 return -1;
736
737 /* Find the node and free from the list */
738 for (peer = sm->tdls; peer; peer = peer->next) {
739 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
740 break;
741 }
742
743 if (peer == NULL) {
744 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
745 "Teardown " MACSTR, MAC2STR(addr));
746 return 0;
747 }
748
749 /* Cancel active channel switch before teardown */
750 if (peer->chan_switch_enabled) {
751 wpa_printf(MSG_DEBUG, "TDLS: First returning link with " MACSTR
752 " to base channel", MAC2STR(addr));
753 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
754 }
755
756 dialog_token = peer->dtoken;
757
758 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
759 MAC2STR(addr));
760
761 ielen = 0;
762 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
763 /* To add FTIE for Teardown request and compute MIC */
764 ielen += sizeof(*ftie);
765 #ifdef CONFIG_TDLS_TESTING
766 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
767 ielen += 170;
768 #endif /* CONFIG_TDLS_TESTING */
769 }
770
771 rbuf = os_zalloc(ielen + 1);
772 if (rbuf == NULL)
773 return -1;
774 pos = rbuf;
775
776 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
777 goto skip_ies;
778
779 ftie = (struct wpa_tdls_ftie *) pos;
780 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
781 /* Using the recent nonce which should be for CONFIRM frame */
782 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
783 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
784 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
785 pos = (u8 *) (ftie + 1);
786 #ifdef CONFIG_TDLS_TESTING
787 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
788 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
789 "FTIE");
790 ftie->ie_len += 170;
791 *pos++ = 255; /* FTIE subelem */
792 *pos++ = 168; /* FTIE subelem length */
793 pos += 168;
794 }
795 #endif /* CONFIG_TDLS_TESTING */
796 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
797 (u8 *) ftie, pos - (u8 *) ftie);
798
799 /* compute MIC before sending */
800 wpa_tdls_linkid(sm, peer, &lnkid);
801 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
802 dialog_token, (u8 *) &lnkid, (u8 *) ftie,
803 ftie->mic);
804
805 skip_ies:
806 /* TODO: register for a Timeout handler, if Teardown is not received at
807 * the other end, then try again another time */
808
809 /* request driver to send Teardown using this FTIE */
810 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
811 reason_code, 0, peer->initiator, rbuf, pos - rbuf);
812 os_free(rbuf);
813
814 return 0;
815 }
816
817
wpa_tdls_teardown_link(struct wpa_sm * sm,const u8 * addr,u16 reason_code)818 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
819 {
820 struct wpa_tdls_peer *peer;
821
822 if (sm->tdls_disabled || !sm->tdls_supported)
823 return -1;
824
825 for (peer = sm->tdls; peer; peer = peer->next) {
826 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
827 break;
828 }
829
830 if (peer == NULL) {
831 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
832 " for link Teardown", MAC2STR(addr));
833 return -1;
834 }
835
836 if (!peer->tpk_success) {
837 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
838 " not connected - cannot Teardown link", MAC2STR(addr));
839 return -1;
840 }
841
842 return wpa_tdls_do_teardown(sm, peer, reason_code);
843 }
844
845
wpa_tdls_disable_peer_link(struct wpa_sm * sm,struct wpa_tdls_peer * peer)846 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
847 struct wpa_tdls_peer *peer)
848 {
849 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
850 wpa_tdls_peer_free(sm, peer);
851 }
852
853
wpa_tdls_disable_unreachable_link(struct wpa_sm * sm,const u8 * addr)854 void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr)
855 {
856 struct wpa_tdls_peer *peer;
857
858 for (peer = sm->tdls; peer; peer = peer->next) {
859 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
860 break;
861 }
862
863 if (!peer || !peer->tpk_success) {
864 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
865 " not connected - cannot teardown unreachable link",
866 MAC2STR(addr));
867 return;
868 }
869
870 if (wpa_tdls_is_external_setup(sm)) {
871 /*
872 * Get us on the base channel, disable the link, send a
873 * teardown packet through the AP, and then reset link data.
874 */
875 if (peer->chan_switch_enabled)
876 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
877 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
878 wpa_tdls_send_teardown(sm, addr,
879 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE);
880 wpa_tdls_peer_free(sm, peer);
881 } else {
882 wpa_tdls_disable_peer_link(sm, peer);
883 }
884 }
885
886
wpa_tdls_get_link_status(struct wpa_sm * sm,const u8 * addr)887 const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr)
888 {
889 struct wpa_tdls_peer *peer;
890
891 if (sm->tdls_disabled || !sm->tdls_supported)
892 return "disabled";
893
894 for (peer = sm->tdls; peer; peer = peer->next) {
895 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
896 break;
897 }
898
899 if (peer == NULL)
900 return "peer does not exist";
901
902 if (!peer->tpk_success)
903 return "peer not connected";
904
905 return "connected";
906 }
907
908
wpa_tdls_recv_teardown(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)909 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
910 const u8 *buf, size_t len)
911 {
912 struct wpa_tdls_peer *peer = NULL;
913 struct wpa_tdls_ftie *ftie;
914 struct wpa_tdls_lnkid *lnkid;
915 struct wpa_eapol_ie_parse kde;
916 u16 reason_code;
917 const u8 *pos;
918 int ielen;
919
920 /* Find the node and free from the list */
921 for (peer = sm->tdls; peer; peer = peer->next) {
922 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
923 break;
924 }
925
926 if (peer == NULL) {
927 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
928 "Teardown " MACSTR, MAC2STR(src_addr));
929 return 0;
930 }
931
932 pos = buf;
933 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
934
935 reason_code = WPA_GET_LE16(pos);
936 pos += 2;
937
938 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
939 " (reason code %u)", MAC2STR(src_addr), reason_code);
940
941 ielen = len - (pos - buf); /* start of IE in buf */
942
943 /*
944 * Don't reject the message if failing to parse IEs. The IEs we need are
945 * explicitly checked below. Some APs may add arbitrary padding to the
946 * end of short TDLS frames and that would look like invalid IEs.
947 */
948 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0)
949 wpa_printf(MSG_DEBUG,
950 "TDLS: Failed to parse IEs in Teardown - ignore as an interop workaround");
951
952 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
953 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
954 "Teardown");
955 return -1;
956 }
957 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
958
959 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
960 goto skip_ftie;
961
962 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
963 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
964 return -1;
965 }
966
967 ftie = (struct wpa_tdls_ftie *) kde.ftie;
968
969 /* Process MIC check to see if TDLS Teardown is right */
970 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
971 peer->dtoken, peer,
972 (u8 *) lnkid, ftie) < 0) {
973 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
974 "Teardown Request from " MACSTR, MAC2STR(src_addr));
975 return -1;
976 }
977
978 skip_ftie:
979 /*
980 * Request the driver to disable the direct link and clear associated
981 * keys.
982 */
983 wpa_tdls_disable_peer_link(sm, peer);
984 return 0;
985 }
986
987
988 /**
989 * wpa_tdls_send_error - To send suitable TDLS status response with
990 * appropriate status code mentioning reason for error/failure.
991 * @dst - MAC addr of Peer station
992 * @tdls_action - TDLS frame type for which error code is sent
993 * @initiator - was this end the initiator of the connection
994 * @status - status code mentioning reason
995 */
996
wpa_tdls_send_error(struct wpa_sm * sm,const u8 * dst,u8 tdls_action,u8 dialog_token,int initiator,u16 status)997 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
998 u8 tdls_action, u8 dialog_token, int initiator,
999 u16 status)
1000 {
1001 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
1002 " (action=%u status=%u)",
1003 MAC2STR(dst), tdls_action, status);
1004 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
1005 0, initiator, NULL, 0);
1006 }
1007
1008
1009 static struct wpa_tdls_peer *
wpa_tdls_add_peer(struct wpa_sm * sm,const u8 * addr,int * existing)1010 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing)
1011 {
1012 struct wpa_tdls_peer *peer;
1013
1014 if (existing)
1015 *existing = 0;
1016 for (peer = sm->tdls; peer; peer = peer->next) {
1017 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) {
1018 if (existing)
1019 *existing = 1;
1020 return peer; /* re-use existing entry */
1021 }
1022 }
1023
1024 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
1025 MAC2STR(addr));
1026
1027 peer = os_zalloc(sizeof(*peer));
1028 if (peer == NULL)
1029 return NULL;
1030
1031 os_memcpy(peer->addr, addr, ETH_ALEN);
1032 peer->next = sm->tdls;
1033 sm->tdls = peer;
1034
1035 return peer;
1036 }
1037
1038
wpa_tdls_send_tpk_m1(struct wpa_sm * sm,struct wpa_tdls_peer * peer)1039 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
1040 struct wpa_tdls_peer *peer)
1041 {
1042 size_t buf_len;
1043 struct wpa_tdls_timeoutie timeoutie;
1044 u16 rsn_capab;
1045 struct wpa_tdls_ftie *ftie;
1046 u8 *rbuf, *pos, *count_pos;
1047 u16 count;
1048 struct rsn_ie_hdr *hdr;
1049 int status;
1050
1051 if (!wpa_tdls_get_privacy(sm)) {
1052 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
1053 peer->rsnie_i_len = 0;
1054 goto skip_rsnie;
1055 }
1056
1057 /*
1058 * TPK Handshake Message 1:
1059 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
1060 * Timeout Interval IE))
1061 */
1062
1063 /* Filling RSN IE */
1064 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1065 hdr->elem_id = WLAN_EID_RSN;
1066 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1067
1068 pos = (u8 *) (hdr + 1);
1069 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1070 pos += RSN_SELECTOR_LEN;
1071 count_pos = pos;
1072 pos += 2;
1073
1074 count = 0;
1075
1076 /*
1077 * AES-CCMP is the default Encryption preferred for TDLS, so
1078 * RSN IE is filled only with CCMP CIPHER
1079 * Note: TKIP is not used to encrypt TDLS link.
1080 *
1081 * Regardless of the cipher used on the AP connection, select CCMP
1082 * here.
1083 */
1084 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1085 pos += RSN_SELECTOR_LEN;
1086 count++;
1087
1088 WPA_PUT_LE16(count_pos, count);
1089
1090 WPA_PUT_LE16(pos, 1);
1091 pos += 2;
1092 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1093 pos += RSN_SELECTOR_LEN;
1094
1095 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1096 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1097 #ifdef CONFIG_TDLS_TESTING
1098 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1099 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
1100 "testing");
1101 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1102 }
1103 #endif /* CONFIG_TDLS_TESTING */
1104 WPA_PUT_LE16(pos, rsn_capab);
1105 pos += 2;
1106 #ifdef CONFIG_TDLS_TESTING
1107 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1108 /* Number of PMKIDs */
1109 *pos++ = 0x00;
1110 *pos++ = 0x00;
1111 }
1112 #endif /* CONFIG_TDLS_TESTING */
1113
1114 hdr->len = (pos - peer->rsnie_i) - 2;
1115 peer->rsnie_i_len = pos - peer->rsnie_i;
1116 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1117 peer->rsnie_i, peer->rsnie_i_len);
1118
1119 skip_rsnie:
1120 buf_len = 0;
1121 if (wpa_tdls_get_privacy(sm))
1122 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1123 sizeof(struct wpa_tdls_timeoutie);
1124 #ifdef CONFIG_TDLS_TESTING
1125 if (wpa_tdls_get_privacy(sm) &&
1126 (tdls_testing & TDLS_TESTING_LONG_FRAME))
1127 buf_len += 170;
1128 if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
1129 buf_len += sizeof(struct wpa_tdls_lnkid);
1130 #endif /* CONFIG_TDLS_TESTING */
1131 rbuf = os_zalloc(buf_len + 1);
1132 if (rbuf == NULL) {
1133 wpa_tdls_peer_free(sm, peer);
1134 return -1;
1135 }
1136 pos = rbuf;
1137
1138 if (!wpa_tdls_get_privacy(sm))
1139 goto skip_ies;
1140
1141 /* Initiator RSN IE */
1142 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1143
1144 ftie = (struct wpa_tdls_ftie *) pos;
1145 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1146 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1147
1148 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1149 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1150 "TDLS: Failed to get random data for initiator Nonce");
1151 os_free(rbuf);
1152 wpa_tdls_peer_free(sm, peer);
1153 return -1;
1154 }
1155 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1156 peer->inonce, WPA_NONCE_LEN);
1157 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1158
1159 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1160 (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1161
1162 pos = (u8 *) (ftie + 1);
1163
1164 #ifdef CONFIG_TDLS_TESTING
1165 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1166 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1167 "FTIE");
1168 ftie->ie_len += 170;
1169 *pos++ = 255; /* FTIE subelem */
1170 *pos++ = 168; /* FTIE subelem length */
1171 pos += 168;
1172 }
1173 #endif /* CONFIG_TDLS_TESTING */
1174
1175 /* Lifetime */
1176 peer->lifetime = TPK_LIFETIME;
1177 #ifdef CONFIG_TDLS_TESTING
1178 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1179 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1180 "lifetime");
1181 peer->lifetime = 301;
1182 }
1183 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1184 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1185 "lifetime");
1186 peer->lifetime = 0xffffffff;
1187 }
1188 #endif /* CONFIG_TDLS_TESTING */
1189 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1190 sizeof(timeoutie), peer->lifetime);
1191 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1192
1193 skip_ies:
1194
1195 #ifdef CONFIG_TDLS_TESTING
1196 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
1197 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1198 "Link Identifier");
1199 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1200 wpa_tdls_linkid(sm, peer, l);
1201 l->bssid[5] ^= 0x01;
1202 pos += sizeof(*l);
1203 }
1204 #endif /* CONFIG_TDLS_TESTING */
1205
1206 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1207 "Handshake Message 1 (peer " MACSTR ")",
1208 MAC2STR(peer->addr));
1209
1210 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST,
1211 1, 0, 0, peer->initiator, rbuf, pos - rbuf);
1212 os_free(rbuf);
1213
1214 return status;
1215 }
1216
1217
wpa_tdls_send_tpk_m2(struct wpa_sm * sm,const unsigned char * src_addr,u8 dtoken,struct wpa_tdls_lnkid * lnkid,const struct wpa_tdls_peer * peer)1218 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1219 const unsigned char *src_addr, u8 dtoken,
1220 struct wpa_tdls_lnkid *lnkid,
1221 const struct wpa_tdls_peer *peer)
1222 {
1223 u8 *rbuf, *pos;
1224 size_t buf_len;
1225 u32 lifetime;
1226 struct wpa_tdls_timeoutie timeoutie;
1227 struct wpa_tdls_ftie *ftie;
1228 int status;
1229
1230 buf_len = 0;
1231 if (wpa_tdls_get_privacy(sm)) {
1232 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1233 * Lifetime */
1234 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1235 sizeof(struct wpa_tdls_timeoutie);
1236 #ifdef CONFIG_TDLS_TESTING
1237 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1238 buf_len += 170;
1239 #endif /* CONFIG_TDLS_TESTING */
1240 }
1241
1242 rbuf = os_zalloc(buf_len + 1);
1243 if (rbuf == NULL)
1244 return -1;
1245 pos = rbuf;
1246
1247 if (!wpa_tdls_get_privacy(sm))
1248 goto skip_ies;
1249
1250 /* Peer RSN IE */
1251 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1252
1253 ftie = (struct wpa_tdls_ftie *) pos;
1254 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1255 /* TODO: ftie->mic_control to set 2-RESPONSE */
1256 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1257 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1258 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1259 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1260 (u8 *) ftie, sizeof(*ftie));
1261
1262 pos = (u8 *) (ftie + 1);
1263
1264 #ifdef CONFIG_TDLS_TESTING
1265 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1266 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1267 "FTIE");
1268 ftie->ie_len += 170;
1269 *pos++ = 255; /* FTIE subelem */
1270 *pos++ = 168; /* FTIE subelem length */
1271 pos += 168;
1272 }
1273 #endif /* CONFIG_TDLS_TESTING */
1274
1275 /* Lifetime */
1276 lifetime = peer->lifetime;
1277 #ifdef CONFIG_TDLS_TESTING
1278 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1279 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1280 "lifetime in response");
1281 lifetime++;
1282 }
1283 #endif /* CONFIG_TDLS_TESTING */
1284 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1285 sizeof(timeoutie), lifetime);
1286 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1287 lifetime);
1288
1289 /* compute MIC before sending */
1290 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,
1291 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1292 #ifdef CONFIG_TDLS_TESTING
1293 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1294 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1295 ftie->mic[0] ^= 0x01;
1296 }
1297 #endif /* CONFIG_TDLS_TESTING */
1298
1299 skip_ies:
1300 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE,
1301 dtoken, 0, 0, peer->initiator, rbuf,
1302 pos - rbuf);
1303 os_free(rbuf);
1304
1305 return status;
1306 }
1307
1308
wpa_tdls_send_tpk_m3(struct wpa_sm * sm,const unsigned char * src_addr,u8 dtoken,struct wpa_tdls_lnkid * lnkid,const struct wpa_tdls_peer * peer)1309 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1310 const unsigned char *src_addr, u8 dtoken,
1311 struct wpa_tdls_lnkid *lnkid,
1312 const struct wpa_tdls_peer *peer)
1313 {
1314 u8 *rbuf, *pos;
1315 size_t buf_len;
1316 struct wpa_tdls_ftie *ftie;
1317 struct wpa_tdls_timeoutie timeoutie;
1318 u32 lifetime;
1319 int status;
1320 u32 peer_capab = 0;
1321
1322 buf_len = 0;
1323 if (wpa_tdls_get_privacy(sm)) {
1324 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1325 * Lifetime */
1326 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1327 sizeof(struct wpa_tdls_timeoutie);
1328 #ifdef CONFIG_TDLS_TESTING
1329 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1330 buf_len += 170;
1331 #endif /* CONFIG_TDLS_TESTING */
1332 }
1333
1334 rbuf = os_zalloc(buf_len + 1);
1335 if (rbuf == NULL)
1336 return -1;
1337 pos = rbuf;
1338
1339 if (!wpa_tdls_get_privacy(sm))
1340 goto skip_ies;
1341
1342 /* Peer RSN IE */
1343 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1344
1345 ftie = (struct wpa_tdls_ftie *) pos;
1346 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1347 /*TODO: ftie->mic_control to set 3-CONFIRM */
1348 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1349 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1350 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1351
1352 pos = (u8 *) (ftie + 1);
1353
1354 #ifdef CONFIG_TDLS_TESTING
1355 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1356 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1357 "FTIE");
1358 ftie->ie_len += 170;
1359 *pos++ = 255; /* FTIE subelem */
1360 *pos++ = 168; /* FTIE subelem length */
1361 pos += 168;
1362 }
1363 #endif /* CONFIG_TDLS_TESTING */
1364
1365 /* Lifetime */
1366 lifetime = peer->lifetime;
1367 #ifdef CONFIG_TDLS_TESTING
1368 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1369 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1370 "lifetime in confirm");
1371 lifetime++;
1372 }
1373 #endif /* CONFIG_TDLS_TESTING */
1374 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1375 sizeof(timeoutie), lifetime);
1376 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1377 lifetime);
1378
1379 /* compute MIC before sending */
1380 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,
1381 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1382 #ifdef CONFIG_TDLS_TESTING
1383 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1384 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1385 ftie->mic[0] ^= 0x01;
1386 }
1387 #endif /* CONFIG_TDLS_TESTING */
1388
1389 skip_ies:
1390
1391 if (peer->vht_capabilities)
1392 peer_capab |= TDLS_PEER_VHT;
1393 if (peer->ht_capabilities)
1394 peer_capab |= TDLS_PEER_HT;
1395 if (peer->wmm_capable)
1396 peer_capab |= TDLS_PEER_WMM;
1397
1398 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM,
1399 dtoken, 0, peer_capab, peer->initiator,
1400 rbuf, pos - rbuf);
1401 os_free(rbuf);
1402
1403 return status;
1404 }
1405
1406
wpa_tdls_send_discovery_response(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u8 dialog_token)1407 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1408 struct wpa_tdls_peer *peer,
1409 u8 dialog_token)
1410 {
1411 size_t buf_len = 0;
1412 struct wpa_tdls_timeoutie timeoutie;
1413 u16 rsn_capab;
1414 u8 *rbuf, *pos, *count_pos;
1415 u16 count;
1416 struct rsn_ie_hdr *hdr;
1417 int status;
1418
1419 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1420 "(peer " MACSTR ")", MAC2STR(peer->addr));
1421 if (!wpa_tdls_get_privacy(sm))
1422 goto skip_rsn_ies;
1423
1424 /* Filling RSN IE */
1425 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1426 hdr->elem_id = WLAN_EID_RSN;
1427 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1428 pos = (u8 *) (hdr + 1);
1429 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1430 pos += RSN_SELECTOR_LEN;
1431 count_pos = pos;
1432 pos += 2;
1433 count = 0;
1434
1435 /*
1436 * AES-CCMP is the default encryption preferred for TDLS, so
1437 * RSN IE is filled only with CCMP cipher suite.
1438 * Note: TKIP is not used to encrypt TDLS link.
1439 *
1440 * Regardless of the cipher used on the AP connection, select CCMP
1441 * here.
1442 */
1443 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1444 pos += RSN_SELECTOR_LEN;
1445 count++;
1446 WPA_PUT_LE16(count_pos, count);
1447 WPA_PUT_LE16(pos, 1);
1448 pos += 2;
1449 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1450 pos += RSN_SELECTOR_LEN;
1451
1452 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1453 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1454 WPA_PUT_LE16(pos, rsn_capab);
1455 pos += 2;
1456 hdr->len = (pos - (u8 *) hdr) - 2;
1457 peer->rsnie_i_len = pos - peer->rsnie_i;
1458
1459 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for Discovery Response",
1460 (u8 *) hdr, hdr->len + 2);
1461 skip_rsn_ies:
1462 buf_len = 0;
1463 if (wpa_tdls_get_privacy(sm)) {
1464 /* Peer RSN IE, Lifetime */
1465 buf_len += peer->rsnie_i_len +
1466 sizeof(struct wpa_tdls_timeoutie);
1467 }
1468 rbuf = os_zalloc(buf_len + 1);
1469 if (rbuf == NULL) {
1470 wpa_tdls_peer_free(sm, peer);
1471 return -1;
1472 }
1473 pos = rbuf;
1474
1475 if (!wpa_tdls_get_privacy(sm))
1476 goto skip_ies;
1477 /* Initiator RSN IE */
1478 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1479 /* Lifetime */
1480 peer->lifetime = TPK_LIFETIME;
1481 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1482 sizeof(timeoutie), peer->lifetime);
1483 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1484 skip_ies:
1485 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
1486 dialog_token, 0, 0, 0, rbuf, pos - rbuf);
1487 os_free(rbuf);
1488
1489 return status;
1490 }
1491
1492
1493 static int
wpa_tdls_process_discovery_request(struct wpa_sm * sm,const u8 * addr,const u8 * buf,size_t len)1494 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1495 const u8 *buf, size_t len)
1496 {
1497 struct wpa_eapol_ie_parse kde;
1498 const struct wpa_tdls_lnkid *lnkid;
1499 struct wpa_tdls_peer *peer;
1500 size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1501 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1502 u8 dialog_token;
1503
1504 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1505 MAC2STR(addr));
1506
1507 if (len < min_req_len) {
1508 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1509 "%d", (int) len);
1510 return -1;
1511 }
1512
1513 dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1514
1515 /*
1516 * Some APs will tack on a weird IE to the end of a TDLS
1517 * discovery request packet. This needn't fail the response,
1518 * since the required IE are verified separately.
1519 */
1520 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1521 len - (sizeof(struct wpa_tdls_frame) + 1),
1522 &kde) < 0) {
1523 wpa_printf(MSG_DEBUG,
1524 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround");
1525 }
1526
1527 if (!kde.lnkid) {
1528 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1529 "Request");
1530 return -1;
1531 }
1532
1533 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1534
1535 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1536 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different "
1537 " BSS " MACSTR, MAC2STR(lnkid->bssid));
1538 return -1;
1539 }
1540
1541 peer = wpa_tdls_add_peer(sm, addr, NULL);
1542 if (peer == NULL)
1543 return -1;
1544
1545 return wpa_tdls_send_discovery_response(sm, peer, dialog_token);
1546 }
1547
1548
wpa_tdls_send_discovery_request(struct wpa_sm * sm,const u8 * addr)1549 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1550 {
1551 if (sm->tdls_disabled || !sm->tdls_supported)
1552 return -1;
1553
1554 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1555 MACSTR, MAC2STR(addr));
1556 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
1557 1, 0, 0, 1, NULL, 0);
1558 }
1559
1560
copy_supp_rates(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1561 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1562 struct wpa_tdls_peer *peer)
1563 {
1564 if (!kde->supp_rates) {
1565 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1566 return -1;
1567 }
1568 peer->supp_rates_len = merge_byte_arrays(
1569 peer->supp_rates, sizeof(peer->supp_rates),
1570 kde->supp_rates + 2, kde->supp_rates_len - 2,
1571 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
1572 kde->ext_supp_rates_len - 2);
1573 return 0;
1574 }
1575
1576
copy_peer_ht_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1577 static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde,
1578 struct wpa_tdls_peer *peer)
1579 {
1580 if (!kde->ht_capabilities) {
1581 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities "
1582 "received");
1583 return 0;
1584 }
1585
1586 if (!peer->ht_capabilities) {
1587 peer->ht_capabilities =
1588 os_zalloc(sizeof(struct ieee80211_ht_capabilities));
1589 if (peer->ht_capabilities == NULL)
1590 return -1;
1591 }
1592
1593 os_memcpy(peer->ht_capabilities, kde->ht_capabilities,
1594 sizeof(struct ieee80211_ht_capabilities));
1595 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities",
1596 (u8 *) peer->ht_capabilities,
1597 sizeof(struct ieee80211_ht_capabilities));
1598
1599 return 0;
1600 }
1601
1602
copy_peer_vht_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1603 static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde,
1604 struct wpa_tdls_peer *peer)
1605 {
1606 if (!kde->vht_capabilities) {
1607 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities "
1608 "received");
1609 return 0;
1610 }
1611
1612 if (!peer->vht_capabilities) {
1613 peer->vht_capabilities =
1614 os_zalloc(sizeof(struct ieee80211_vht_capabilities));
1615 if (peer->vht_capabilities == NULL)
1616 return -1;
1617 }
1618
1619 os_memcpy(peer->vht_capabilities, kde->vht_capabilities,
1620 sizeof(struct ieee80211_vht_capabilities));
1621 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities",
1622 (u8 *) peer->vht_capabilities,
1623 sizeof(struct ieee80211_vht_capabilities));
1624
1625 return 0;
1626 }
1627
1628
copy_peer_ext_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1629 static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde,
1630 struct wpa_tdls_peer *peer)
1631 {
1632 if (!kde->ext_capab) {
1633 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities "
1634 "received");
1635 return 0;
1636 }
1637
1638 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {
1639 /* Need to allocate buffer to fit the new information */
1640 os_free(peer->ext_capab);
1641 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);
1642 if (peer->ext_capab == NULL)
1643 return -1;
1644 }
1645
1646 peer->ext_capab_len = kde->ext_capab_len - 2;
1647 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);
1648
1649 return 0;
1650 }
1651
1652
copy_peer_wmm_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1653 static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde,
1654 struct wpa_tdls_peer *peer)
1655 {
1656 struct wmm_information_element *wmm;
1657
1658 if (!kde->wmm) {
1659 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received");
1660 return 0;
1661 }
1662
1663 if (kde->wmm_len < sizeof(struct wmm_information_element)) {
1664 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received");
1665 return -1;
1666 }
1667
1668 wmm = (struct wmm_information_element *) kde->wmm;
1669 peer->qos_info = wmm->qos_info;
1670
1671 peer->wmm_capable = 1;
1672
1673 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info);
1674 return 0;
1675 }
1676
1677
copy_peer_supp_channels(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1678 static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde,
1679 struct wpa_tdls_peer *peer)
1680 {
1681 if (!kde->supp_channels) {
1682 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received");
1683 return 0;
1684 }
1685
1686 if (!peer->supp_channels ||
1687 peer->supp_channels_len < kde->supp_channels_len) {
1688 os_free(peer->supp_channels);
1689 peer->supp_channels = os_zalloc(kde->supp_channels_len);
1690 if (peer->supp_channels == NULL)
1691 return -1;
1692 }
1693
1694 peer->supp_channels_len = kde->supp_channels_len;
1695
1696 os_memcpy(peer->supp_channels, kde->supp_channels,
1697 peer->supp_channels_len);
1698 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels",
1699 (u8 *) peer->supp_channels, peer->supp_channels_len);
1700 return 0;
1701 }
1702
1703
copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1704 static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde,
1705 struct wpa_tdls_peer *peer)
1706 {
1707 if (!kde->supp_oper_classes) {
1708 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received");
1709 return 0;
1710 }
1711
1712 if (!peer->supp_oper_classes ||
1713 peer->supp_oper_classes_len < kde->supp_oper_classes_len) {
1714 os_free(peer->supp_oper_classes);
1715 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len);
1716 if (peer->supp_oper_classes == NULL)
1717 return -1;
1718 }
1719
1720 peer->supp_oper_classes_len = kde->supp_oper_classes_len;
1721 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes,
1722 peer->supp_oper_classes_len);
1723 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes",
1724 (u8 *) peer->supp_oper_classes,
1725 peer->supp_oper_classes_len);
1726 return 0;
1727 }
1728
1729
wpa_tdls_addset_peer(struct wpa_sm * sm,struct wpa_tdls_peer * peer,int add)1730 static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
1731 int add)
1732 {
1733 return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid,
1734 peer->capability,
1735 peer->supp_rates, peer->supp_rates_len,
1736 peer->ht_capabilities,
1737 peer->vht_capabilities,
1738 peer->qos_info, peer->wmm_capable,
1739 peer->ext_capab, peer->ext_capab_len,
1740 peer->supp_channels,
1741 peer->supp_channels_len,
1742 peer->supp_oper_classes,
1743 peer->supp_oper_classes_len);
1744 }
1745
1746
wpa_tdls_process_tpk_m1(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)1747 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1748 const u8 *buf, size_t len)
1749 {
1750 struct wpa_tdls_peer *peer;
1751 struct wpa_eapol_ie_parse kde;
1752 struct wpa_ie_data ie;
1753 int cipher;
1754 const u8 *cpos;
1755 struct wpa_tdls_ftie *ftie = NULL;
1756 struct wpa_tdls_timeoutie *timeoutie;
1757 struct wpa_tdls_lnkid *lnkid;
1758 u32 lifetime = 0;
1759 #if 0
1760 struct rsn_ie_hdr *hdr;
1761 u8 *pos;
1762 u16 rsn_capab;
1763 u16 rsn_ver;
1764 #endif
1765 u8 dtoken;
1766 u16 ielen;
1767 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1768 int tdls_prohibited = sm->tdls_prohibited;
1769 int existing_peer = 0;
1770
1771 if (len < 3 + 3)
1772 return -1;
1773
1774 cpos = buf;
1775 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1776
1777 /* driver had already verified the frame format */
1778 dtoken = *cpos++; /* dialog token */
1779
1780 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1781
1782 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);
1783 if (peer == NULL)
1784 goto error;
1785
1786 /* If found, use existing entry instead of adding a new one;
1787 * how to handle the case where both ends initiate at the
1788 * same time? */
1789 if (existing_peer) {
1790 if (peer->tpk_success) {
1791 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1792 "direct link is enabled - tear down the "
1793 "old link first");
1794 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
1795 wpa_tdls_peer_clear(sm, peer);
1796 } else if (peer->initiator) {
1797 /*
1798 * An entry is already present, so check if we already
1799 * sent a TDLS Setup Request. If so, compare MAC
1800 * addresses and let the STA with the lower MAC address
1801 * continue as the initiator. The other negotiation is
1802 * terminated.
1803 */
1804 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
1805 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
1806 "from peer with higher address "
1807 MACSTR, MAC2STR(src_addr));
1808 return -1;
1809 } else {
1810 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
1811 "from peer with lower address "
1812 MACSTR " (terminate previously "
1813 "initiated negotiation",
1814 MAC2STR(src_addr));
1815 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
1816 peer->addr);
1817 wpa_tdls_peer_clear(sm, peer);
1818 }
1819 }
1820 }
1821
1822 /* capability information */
1823 peer->capability = WPA_GET_LE16(cpos);
1824 cpos += 2;
1825
1826 ielen = len - (cpos - buf); /* start of IE in buf */
1827
1828 /*
1829 * Don't reject the message if failing to parse IEs. The IEs we need are
1830 * explicitly checked below. Some APs may add arbitrary padding to the
1831 * end of short TDLS frames and that would look like invalid IEs.
1832 */
1833 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0)
1834 wpa_printf(MSG_DEBUG,
1835 "TDLS: Failed to parse IEs in TPK M1 - ignore as an interop workaround");
1836
1837 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1838 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1839 "TPK M1");
1840 goto error;
1841 }
1842 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
1843 kde.lnkid, kde.lnkid_len);
1844 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1845 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1846 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS");
1847 status = WLAN_STATUS_REQUEST_DECLINED;
1848 goto error;
1849 }
1850
1851 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
1852 MAC2STR(src_addr));
1853
1854 if (copy_supp_rates(&kde, peer) < 0)
1855 goto error;
1856
1857 if (copy_peer_ht_capab(&kde, peer) < 0)
1858 goto error;
1859
1860 if (copy_peer_vht_capab(&kde, peer) < 0)
1861 goto error;
1862
1863 if (copy_peer_ext_capab(&kde, peer) < 0)
1864 goto error;
1865
1866 if (copy_peer_supp_channels(&kde, peer) < 0)
1867 goto error;
1868
1869 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
1870 goto error;
1871
1872 peer->qos_info = kde.qosinfo;
1873
1874 /* Overwrite with the qos_info obtained in WMM IE */
1875 if (copy_peer_wmm_capab(&kde, peer) < 0)
1876 goto error;
1877
1878 peer->aid = kde.aid;
1879
1880 #ifdef CONFIG_TDLS_TESTING
1881 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
1882 peer = wpa_tdls_add_peer(sm, src_addr, NULL);
1883 if (peer == NULL)
1884 goto error;
1885 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
1886 "TDLS setup - send own request");
1887 peer->initiator = 1;
1888 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
1889 NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0);
1890 wpa_tdls_send_tpk_m1(sm, peer);
1891 }
1892
1893 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
1894 tdls_prohibited) {
1895 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
1896 "on TDLS");
1897 tdls_prohibited = 0;
1898 }
1899 #endif /* CONFIG_TDLS_TESTING */
1900
1901 if (tdls_prohibited) {
1902 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
1903 status = WLAN_STATUS_REQUEST_DECLINED;
1904 goto error;
1905 }
1906
1907 if (!wpa_tdls_get_privacy(sm)) {
1908 if (kde.rsn_ie) {
1909 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
1910 "security is disabled");
1911 status = WLAN_STATUS_SECURITY_DISABLED;
1912 goto error;
1913 }
1914 goto skip_rsn;
1915 }
1916
1917 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1918 kde.rsn_ie == NULL) {
1919 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
1920 status = WLAN_STATUS_INVALID_PARAMETERS;
1921 goto error;
1922 }
1923
1924 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
1925 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
1926 "TPK M1");
1927 status = WLAN_STATUS_INVALID_RSNIE;
1928 goto error;
1929 }
1930
1931 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1932 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
1933 status = WLAN_STATUS_INVALID_RSNIE;
1934 goto error;
1935 }
1936
1937 cipher = ie.pairwise_cipher;
1938 if (cipher & WPA_CIPHER_CCMP) {
1939 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1940 cipher = WPA_CIPHER_CCMP;
1941 } else {
1942 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
1943 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1944 goto error;
1945 }
1946
1947 if ((ie.capabilities &
1948 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
1949 WPA_CAPABILITY_PEERKEY_ENABLED) {
1950 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
1951 "TPK M1");
1952 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
1953 goto error;
1954 }
1955
1956 /* Lifetime */
1957 if (kde.key_lifetime == NULL) {
1958 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
1959 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1960 goto error;
1961 }
1962 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1963 lifetime = WPA_GET_LE32(timeoutie->value);
1964 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
1965 if (lifetime < 300) {
1966 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
1967 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1968 goto error;
1969 }
1970
1971 skip_rsn:
1972 #ifdef CONFIG_TDLS_TESTING
1973 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
1974 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {
1975 /*
1976 * The request frame from us is going to win, so do not
1977 * replace information based on this request frame from
1978 * the peer.
1979 */
1980 goto skip_rsn_check;
1981 }
1982 }
1983 #endif /* CONFIG_TDLS_TESTING */
1984
1985 peer->initiator = 0; /* Need to check */
1986 peer->dtoken = dtoken;
1987
1988 if (!wpa_tdls_get_privacy(sm)) {
1989 peer->rsnie_i_len = 0;
1990 peer->rsnie_p_len = 0;
1991 peer->cipher = WPA_CIPHER_NONE;
1992 goto skip_rsn_check;
1993 }
1994
1995 ftie = (struct wpa_tdls_ftie *) kde.ftie;
1996 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
1997 peer->rsnie_i_len = kde.rsn_ie_len;
1998 peer->cipher = cipher;
1999
2000 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
2001 /*
2002 * There is no point in updating the RNonce for every obtained
2003 * TPK M1 frame (e.g., retransmission due to timeout) with the
2004 * same INonce (SNonce in FTIE). However, if the TPK M1 is
2005 * retransmitted with a different INonce, update the RNonce
2006 * since this is for a new TDLS session.
2007 */
2008 wpa_printf(MSG_DEBUG,
2009 "TDLS: New TPK M1 INonce - generate new RNonce");
2010 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
2011 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
2012 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2013 "TDLS: Failed to get random data for responder nonce");
2014 goto error;
2015 }
2016 }
2017
2018 #if 0
2019 /* get version info from RSNIE received from Peer */
2020 hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
2021 rsn_ver = WPA_GET_LE16(hdr->version);
2022
2023 /* use min(peer's version, out version) */
2024 if (rsn_ver > RSN_VERSION)
2025 rsn_ver = RSN_VERSION;
2026
2027 hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
2028
2029 hdr->elem_id = WLAN_EID_RSN;
2030 WPA_PUT_LE16(hdr->version, rsn_ver);
2031 pos = (u8 *) (hdr + 1);
2032
2033 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
2034 pos += RSN_SELECTOR_LEN;
2035 /* Include only the selected cipher in pairwise cipher suite */
2036 WPA_PUT_LE16(pos, 1);
2037 pos += 2;
2038 if (cipher == WPA_CIPHER_CCMP)
2039 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2040 pos += RSN_SELECTOR_LEN;
2041
2042 WPA_PUT_LE16(pos, 1);
2043 pos += 2;
2044 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
2045 pos += RSN_SELECTOR_LEN;
2046
2047 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
2048 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
2049 WPA_PUT_LE16(pos, rsn_capab);
2050 pos += 2;
2051
2052 hdr->len = (pos - peer->rsnie_p) - 2;
2053 peer->rsnie_p_len = pos - peer->rsnie_p;
2054 #endif
2055
2056 /* temp fix: validation of RSNIE later */
2057 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
2058 peer->rsnie_p_len = peer->rsnie_i_len;
2059
2060 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
2061 peer->rsnie_p, peer->rsnie_p_len);
2062
2063 peer->lifetime = lifetime;
2064
2065 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
2066
2067 skip_rsn_check:
2068 #ifdef CONFIG_TDLS_TESTING
2069 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT)
2070 goto skip_add_peer;
2071 #endif /* CONFIG_TDLS_TESTING */
2072
2073 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2074 if (wpa_tdls_addset_peer(sm, peer, 1) < 0)
2075 goto error;
2076
2077 #ifdef CONFIG_TDLS_TESTING
2078 skip_add_peer:
2079 #endif /* CONFIG_TDLS_TESTING */
2080 peer->tpk_in_progress = 1;
2081
2082 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
2083 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
2084 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2085 goto error;
2086 }
2087
2088 return 0;
2089
2090 error:
2091 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
2092 status);
2093 if (peer)
2094 wpa_tdls_peer_free(sm, peer);
2095 return -1;
2096 }
2097
2098
wpa_tdls_enable_link(struct wpa_sm * sm,struct wpa_tdls_peer * peer)2099 static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
2100 {
2101 peer->tpk_success = 1;
2102 peer->tpk_in_progress = 0;
2103 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2104 if (wpa_tdls_get_privacy(sm)) {
2105 u32 lifetime = peer->lifetime;
2106 /*
2107 * Start the initiator process a bit earlier to avoid race
2108 * condition with the responder sending teardown request.
2109 */
2110 if (lifetime > 3 && peer->initiator)
2111 lifetime -= 3;
2112 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
2113 sm, peer);
2114 #ifdef CONFIG_TDLS_TESTING
2115 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
2116 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK "
2117 "expiration");
2118 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2119 }
2120 #endif /* CONFIG_TDLS_TESTING */
2121 }
2122
2123 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {
2124 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the "
2125 "driver");
2126 return -1;
2127 }
2128 peer->reconfig_key = 0;
2129
2130 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
2131 }
2132
2133
wpa_tdls_process_tpk_m2(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)2134 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
2135 const u8 *buf, size_t len)
2136 {
2137 struct wpa_tdls_peer *peer;
2138 struct wpa_eapol_ie_parse kde;
2139 struct wpa_ie_data ie;
2140 int cipher;
2141 struct wpa_tdls_ftie *ftie;
2142 struct wpa_tdls_timeoutie *timeoutie;
2143 struct wpa_tdls_lnkid *lnkid;
2144 u32 lifetime;
2145 u8 dtoken;
2146 int ielen;
2147 u16 status;
2148 const u8 *pos;
2149 int ret = 0;
2150
2151 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
2152 "(Peer " MACSTR ")", MAC2STR(src_addr));
2153 for (peer = sm->tdls; peer; peer = peer->next) {
2154 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
2155 break;
2156 }
2157 if (peer == NULL) {
2158 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2159 "TPK M2: " MACSTR, MAC2STR(src_addr));
2160 return -1;
2161 }
2162 if (!peer->initiator) {
2163 /*
2164 * This may happen if both devices try to initiate TDLS at the
2165 * same time and we accept the TPK M1 from the peer in
2166 * wpa_tdls_process_tpk_m1() and clear our previous state.
2167 */
2168 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so "
2169 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr));
2170 return -1;
2171 }
2172 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
2173
2174 if (len < 3 + 2 + 1) {
2175 wpa_tdls_disable_peer_link(sm, peer);
2176 return -1;
2177 }
2178
2179 pos = buf;
2180 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2181 status = WPA_GET_LE16(pos);
2182 pos += 2 /* status code */;
2183
2184 if (status != WLAN_STATUS_SUCCESS) {
2185 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
2186 status);
2187 wpa_tdls_disable_peer_link(sm, peer);
2188 return -1;
2189 }
2190
2191 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
2192
2193 /* TODO: need to verify dialog token matches here or in kernel */
2194 dtoken = *pos++; /* dialog token */
2195
2196 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
2197
2198 if (len < 3 + 2 + 1 + 2) {
2199 wpa_tdls_disable_peer_link(sm, peer);
2200 return -1;
2201 }
2202
2203 /* capability information */
2204 peer->capability = WPA_GET_LE16(pos);
2205 pos += 2;
2206
2207 ielen = len - (pos - buf); /* start of IE in buf */
2208
2209 /*
2210 * Don't reject the message if failing to parse IEs. The IEs we need are
2211 * explicitly checked below. Some APs may add arbitrary padding to the
2212 * end of short TDLS frames and that would look like invalid IEs.
2213 */
2214 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0)
2215 wpa_printf(MSG_DEBUG,
2216 "TDLS: Failed to parse IEs in TPK M2 - ignore as an interop workaround");
2217
2218 #ifdef CONFIG_TDLS_TESTING
2219 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
2220 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
2221 status = WLAN_STATUS_REQUEST_DECLINED;
2222 goto error;
2223 }
2224 #endif /* CONFIG_TDLS_TESTING */
2225
2226 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2227 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2228 "TPK M2");
2229 goto error;
2230 }
2231 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
2232 kde.lnkid, kde.lnkid_len);
2233 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2234
2235 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
2236 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
2237 status = WLAN_STATUS_NOT_IN_SAME_BSS;
2238 goto error;
2239 }
2240
2241 if (copy_supp_rates(&kde, peer) < 0)
2242 goto error;
2243
2244 if (copy_peer_ht_capab(&kde, peer) < 0)
2245 goto error;
2246
2247 if (copy_peer_vht_capab(&kde, peer) < 0)
2248 goto error;
2249
2250 if (copy_peer_ext_capab(&kde, peer) < 0)
2251 goto error;
2252
2253 if (copy_peer_supp_channels(&kde, peer) < 0)
2254 goto error;
2255
2256 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2257 goto error;
2258
2259 peer->qos_info = kde.qosinfo;
2260
2261 /* Overwrite with the qos_info obtained in WMM IE */
2262 if (copy_peer_wmm_capab(&kde, peer) < 0)
2263 goto error;
2264
2265 peer->aid = kde.aid;
2266
2267 if (!wpa_tdls_get_privacy(sm)) {
2268 peer->rsnie_p_len = 0;
2269 peer->cipher = WPA_CIPHER_NONE;
2270 goto skip_rsn;
2271 }
2272
2273 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2274 kde.rsn_ie == NULL) {
2275 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
2276 status = WLAN_STATUS_INVALID_PARAMETERS;
2277 goto error;
2278 }
2279 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2280 kde.rsn_ie, kde.rsn_ie_len);
2281
2282 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2283 wpa_printf(MSG_INFO,
2284 "TDLS: Too long Responder RSN IE in TPK M2");
2285 status = WLAN_STATUS_INVALID_RSNIE;
2286 goto error;
2287 }
2288
2289 /*
2290 * FIX: bitwise comparison of RSN IE is not the correct way of
2291 * validation this. It can be different, but certain fields must
2292 * match. Since we list only a single pairwise cipher in TPK M1, the
2293 * memcmp is likely to work in most cases, though.
2294 */
2295 if (kde.rsn_ie_len != peer->rsnie_i_len ||
2296 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
2297 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
2298 "not match with RSN IE used in TPK M1");
2299 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
2300 peer->rsnie_i, peer->rsnie_i_len);
2301 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2302 kde.rsn_ie, kde.rsn_ie_len);
2303 status = WLAN_STATUS_INVALID_RSNIE;
2304 goto error;
2305 }
2306
2307 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2308 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
2309 status = WLAN_STATUS_INVALID_RSNIE;
2310 goto error;
2311 }
2312
2313 cipher = ie.pairwise_cipher;
2314 if (cipher == WPA_CIPHER_CCMP) {
2315 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2316 cipher = WPA_CIPHER_CCMP;
2317 } else {
2318 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
2319 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
2320 goto error;
2321 }
2322
2323 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
2324 kde.ftie, sizeof(*ftie));
2325 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2326
2327 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
2328 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
2329 "not match with FTIE SNonce used in TPK M1");
2330 /* Silently discard the frame */
2331 return -1;
2332 }
2333
2334 /* Responder Nonce and RSN IE */
2335 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
2336 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
2337 peer->rsnie_p_len = kde.rsn_ie_len;
2338 peer->cipher = cipher;
2339
2340 /* Lifetime */
2341 if (kde.key_lifetime == NULL) {
2342 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
2343 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2344 goto error;
2345 }
2346 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2347 lifetime = WPA_GET_LE32(timeoutie->value);
2348 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
2349 lifetime);
2350 if (lifetime != peer->lifetime) {
2351 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2352 "TPK M2 (expected %u)", lifetime, peer->lifetime);
2353 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2354 goto error;
2355 }
2356
2357 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
2358
2359 /* Process MIC check to see if TPK M2 is right */
2360 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,
2361 (u8 *) timeoutie, ftie) < 0) {
2362 /* Discard the frame */
2363 wpa_tdls_del_key(sm, peer);
2364 wpa_tdls_disable_peer_link(sm, peer);
2365 return -1;
2366 }
2367
2368 if (wpa_tdls_set_key(sm, peer) < 0) {
2369 /*
2370 * Some drivers may not be able to config the key prior to full
2371 * STA entry having been configured.
2372 */
2373 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2374 "STA entry is complete");
2375 peer->reconfig_key = 1;
2376 }
2377
2378 skip_rsn:
2379 peer->dtoken = dtoken;
2380
2381 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2382 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2383 goto error;
2384
2385 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
2386 "TPK Handshake Message 3");
2387 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0)
2388 goto error;
2389
2390 if (!peer->tpk_success) {
2391 /*
2392 * Enable Link only when tpk_success is 0, signifying that this
2393 * processing of TPK M2 frame is not because of a retransmission
2394 * during TDLS setup handshake.
2395 */
2396 ret = wpa_tdls_enable_link(sm, peer);
2397 if (ret < 0) {
2398 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2399 wpa_tdls_do_teardown(
2400 sm, peer,
2401 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2402 }
2403 }
2404 return ret;
2405
2406 error:
2407 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 1,
2408 status);
2409 wpa_tdls_disable_peer_link(sm, peer);
2410 return -1;
2411 }
2412
2413
wpa_tdls_process_tpk_m3(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)2414 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
2415 const u8 *buf, size_t len)
2416 {
2417 struct wpa_tdls_peer *peer;
2418 struct wpa_eapol_ie_parse kde;
2419 struct wpa_tdls_ftie *ftie;
2420 struct wpa_tdls_timeoutie *timeoutie;
2421 struct wpa_tdls_lnkid *lnkid;
2422 int ielen;
2423 u16 status;
2424 const u8 *pos;
2425 u32 lifetime;
2426 int ret = 0;
2427
2428 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
2429 "(Peer " MACSTR ")", MAC2STR(src_addr));
2430 for (peer = sm->tdls; peer; peer = peer->next) {
2431 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
2432 break;
2433 }
2434 if (peer == NULL) {
2435 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2436 "TPK M3: " MACSTR, MAC2STR(src_addr));
2437 return -1;
2438 }
2439 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
2440
2441 if (len < 3 + 3)
2442 goto error;
2443 pos = buf;
2444 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2445
2446 status = WPA_GET_LE16(pos);
2447
2448 if (status != 0) {
2449 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
2450 status);
2451 goto error;
2452 }
2453 pos += 2 /* status code */ + 1 /* dialog token */;
2454
2455 ielen = len - (pos - buf); /* start of IE in buf */
2456
2457 /*
2458 * Don't reject the message if failing to parse IEs. The IEs we need are
2459 * explicitly checked below. Some APs piggy-back broken IEs to the end
2460 * of a TDLS Confirm packet, which will fail the link if we don't ignore
2461 * this error.
2462 */
2463 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
2464 wpa_printf(MSG_DEBUG,
2465 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround");
2466 }
2467
2468 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2469 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
2470 goto error;
2471 }
2472 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
2473 (u8 *) kde.lnkid, kde.lnkid_len);
2474 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2475
2476 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
2477 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
2478 goto error;
2479 }
2480
2481 if (!wpa_tdls_get_privacy(sm))
2482 goto skip_rsn;
2483
2484 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
2485 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
2486 goto error;
2487 }
2488 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
2489 kde.ftie, sizeof(*ftie));
2490 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2491
2492 if (kde.rsn_ie == NULL) {
2493 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
2494 goto error;
2495 }
2496 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
2497 kde.rsn_ie, kde.rsn_ie_len);
2498 if (kde.rsn_ie_len != peer->rsnie_p_len ||
2499 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
2500 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
2501 "with the one sent in TPK M2");
2502 goto error;
2503 }
2504
2505 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) {
2506 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
2507 "not match with FTIE ANonce used in TPK M2");
2508 goto error;
2509 }
2510
2511 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
2512 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
2513 "match with FTIE SNonce used in TPK M1");
2514 goto error;
2515 }
2516
2517 if (kde.key_lifetime == NULL) {
2518 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
2519 goto error;
2520 }
2521 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2522 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
2523 (u8 *) timeoutie, sizeof(*timeoutie));
2524 lifetime = WPA_GET_LE32(timeoutie->value);
2525 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
2526 lifetime);
2527 if (lifetime != peer->lifetime) {
2528 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2529 "TPK M3 (expected %u)", lifetime, peer->lifetime);
2530 goto error;
2531 }
2532
2533 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,
2534 (u8 *) timeoutie, ftie) < 0) {
2535 wpa_tdls_del_key(sm, peer);
2536 goto error;
2537 }
2538
2539 if (wpa_tdls_set_key(sm, peer) < 0) {
2540 /*
2541 * Some drivers may not be able to config the key prior to full
2542 * STA entry having been configured.
2543 */
2544 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2545 "STA entry is complete");
2546 peer->reconfig_key = 1;
2547 }
2548
2549 skip_rsn:
2550 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2551 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2552 goto error;
2553
2554 if (!peer->tpk_success) {
2555 /*
2556 * Enable Link only when tpk_success is 0, signifying that this
2557 * processing of TPK M3 frame is not because of a retransmission
2558 * during TDLS setup handshake.
2559 */
2560 ret = wpa_tdls_enable_link(sm, peer);
2561 if (ret < 0) {
2562 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2563 goto error;
2564 }
2565 }
2566 return ret;
2567 error:
2568 wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2569 return -1;
2570 }
2571
2572
wpa_add_tdls_timeoutie(u8 * pos,u8 * ie,size_t ie_len,u32 tsecs)2573 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
2574 {
2575 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
2576
2577 os_memset(lifetime, 0, ie_len);
2578 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2579 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2580 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2581 WPA_PUT_LE32(lifetime->value, tsecs);
2582 os_memcpy(pos, ie, ie_len);
2583 return pos + ie_len;
2584 }
2585
2586
2587 /**
2588 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2589 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2590 * @peer: MAC address of the peer STA
2591 * Returns: 0 on success, or -1 on failure
2592 *
2593 * Send TPK Handshake Message 1 info to driver to start TDLS
2594 * handshake with the peer.
2595 */
wpa_tdls_start(struct wpa_sm * sm,const u8 * addr)2596 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2597 {
2598 struct wpa_tdls_peer *peer;
2599 int tdls_prohibited = sm->tdls_prohibited;
2600
2601 if (sm->tdls_disabled || !sm->tdls_supported)
2602 return -1;
2603
2604 #ifdef CONFIG_TDLS_TESTING
2605 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2606 tdls_prohibited) {
2607 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2608 "on TDLS");
2609 tdls_prohibited = 0;
2610 }
2611 #endif /* CONFIG_TDLS_TESTING */
2612
2613 if (tdls_prohibited) {
2614 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2615 "reject request to start setup");
2616 return -1;
2617 }
2618
2619 peer = wpa_tdls_add_peer(sm, addr, NULL);
2620 if (peer == NULL)
2621 return -1;
2622
2623 if (peer->tpk_in_progress) {
2624 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer");
2625 return 0;
2626 }
2627
2628 peer->initiator = 1;
2629
2630 /* add the peer to the driver as a "setup in progress" peer */
2631 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
2632 NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0)) {
2633 wpa_tdls_disable_peer_link(sm, peer);
2634 return -1;
2635 }
2636
2637 peer->tpk_in_progress = 1;
2638
2639 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) {
2640 wpa_tdls_disable_peer_link(sm, peer);
2641 return -1;
2642 }
2643
2644 return 0;
2645 }
2646
2647
wpa_tdls_remove(struct wpa_sm * sm,const u8 * addr)2648 void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr)
2649 {
2650 struct wpa_tdls_peer *peer;
2651
2652 if (sm->tdls_disabled || !sm->tdls_supported)
2653 return;
2654
2655 for (peer = sm->tdls; peer; peer = peer->next) {
2656 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2657 break;
2658 }
2659
2660 if (peer == NULL || !peer->tpk_success)
2661 return;
2662
2663 if (sm->tdls_external_setup) {
2664 /*
2665 * Disable previous link to allow renegotiation to be completed
2666 * on AP path.
2667 */
2668 wpa_tdls_do_teardown(sm, peer,
2669 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2670 }
2671 }
2672
2673
2674 /**
2675 * wpa_supplicant_rx_tdls - Receive TDLS data frame
2676 *
2677 * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2678 */
wpa_supplicant_rx_tdls(void * ctx,const u8 * src_addr,const u8 * buf,size_t len)2679 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2680 const u8 *buf, size_t len)
2681 {
2682 struct wpa_sm *sm = ctx;
2683 struct wpa_tdls_frame *tf;
2684
2685 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2686 buf, len);
2687
2688 if (sm->tdls_disabled || !sm->tdls_supported) {
2689 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2690 "or unsupported by driver");
2691 return;
2692 }
2693
2694 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) {
2695 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2696 return;
2697 }
2698
2699 if (len < sizeof(*tf)) {
2700 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2701 return;
2702 }
2703
2704 /* Check to make sure its a valid encapsulated TDLS frame */
2705 tf = (struct wpa_tdls_frame *) buf;
2706 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2707 tf->category != WLAN_ACTION_TDLS) {
2708 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2709 "category=%u action=%u",
2710 tf->payloadtype, tf->category, tf->action);
2711 return;
2712 }
2713
2714 switch (tf->action) {
2715 case WLAN_TDLS_SETUP_REQUEST:
2716 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2717 break;
2718 case WLAN_TDLS_SETUP_RESPONSE:
2719 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2720 break;
2721 case WLAN_TDLS_SETUP_CONFIRM:
2722 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2723 break;
2724 case WLAN_TDLS_TEARDOWN:
2725 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2726 break;
2727 case WLAN_TDLS_DISCOVERY_REQUEST:
2728 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2729 break;
2730 default:
2731 /* Kernel code will process remaining frames */
2732 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2733 tf->action);
2734 break;
2735 }
2736 }
2737
2738
2739 /**
2740 * wpa_tdls_init - Initialize driver interface parameters for TDLS
2741 * @wpa_s: Pointer to wpa_supplicant data
2742 * Returns: 0 on success, -1 on failure
2743 *
2744 * This function is called to initialize driver interface parameters for TDLS.
2745 * wpa_drv_init() must have been called before this function to initialize the
2746 * driver interface.
2747 */
wpa_tdls_init(struct wpa_sm * sm)2748 int wpa_tdls_init(struct wpa_sm *sm)
2749 {
2750 if (sm == NULL)
2751 return -1;
2752
2753 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname :
2754 sm->ifname,
2755 sm->own_addr,
2756 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
2757 sm, 0);
2758 if (sm->l2_tdls == NULL) {
2759 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
2760 "connection");
2761 return -1;
2762 }
2763
2764 /*
2765 * Drivers that support TDLS but don't implement the get_capa callback
2766 * are assumed to perform everything internally
2767 */
2768 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
2769 &sm->tdls_external_setup,
2770 &sm->tdls_chan_switch) < 0) {
2771 sm->tdls_supported = 1;
2772 sm->tdls_external_setup = 0;
2773 }
2774
2775 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
2776 "driver", sm->tdls_supported ? "" : " not");
2777 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
2778 sm->tdls_external_setup ? "external" : "internal");
2779 wpa_printf(MSG_DEBUG, "TDLS: Driver %s TDLS channel switching",
2780 sm->tdls_chan_switch ? "supports" : "does not support");
2781
2782 return 0;
2783 }
2784
2785
wpa_tdls_teardown_peers(struct wpa_sm * sm)2786 void wpa_tdls_teardown_peers(struct wpa_sm *sm)
2787 {
2788 struct wpa_tdls_peer *peer, *tmp;
2789
2790 if (!sm)
2791 return;
2792 peer = sm->tdls;
2793
2794 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers");
2795
2796 while (peer) {
2797 tmp = peer->next;
2798 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR,
2799 MAC2STR(peer->addr));
2800 if (sm->tdls_external_setup)
2801 wpa_tdls_do_teardown(sm, peer,
2802 WLAN_REASON_DEAUTH_LEAVING);
2803 else
2804 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
2805
2806 peer = tmp;
2807 }
2808 }
2809
2810
wpa_tdls_remove_peers(struct wpa_sm * sm)2811 static void wpa_tdls_remove_peers(struct wpa_sm *sm)
2812 {
2813 struct wpa_tdls_peer *peer, *tmp;
2814
2815 peer = sm->tdls;
2816
2817 while (peer) {
2818 int res;
2819 tmp = peer->next;
2820 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2821 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
2822 MAC2STR(peer->addr), res);
2823 wpa_tdls_peer_free(sm, peer);
2824 peer = tmp;
2825 }
2826 }
2827
2828
2829 /**
2830 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
2831 *
2832 * This function is called to recover driver interface parameters for TDLS
2833 * and frees resources allocated for it.
2834 */
wpa_tdls_deinit(struct wpa_sm * sm)2835 void wpa_tdls_deinit(struct wpa_sm *sm)
2836 {
2837 if (sm == NULL)
2838 return;
2839
2840 if (sm->l2_tdls)
2841 l2_packet_deinit(sm->l2_tdls);
2842 sm->l2_tdls = NULL;
2843
2844 wpa_tdls_remove_peers(sm);
2845 }
2846
2847
wpa_tdls_assoc(struct wpa_sm * sm)2848 void wpa_tdls_assoc(struct wpa_sm *sm)
2849 {
2850 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
2851 wpa_tdls_remove_peers(sm);
2852 }
2853
2854
wpa_tdls_disassoc(struct wpa_sm * sm)2855 void wpa_tdls_disassoc(struct wpa_sm *sm)
2856 {
2857 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
2858 wpa_tdls_remove_peers(sm);
2859 }
2860
2861
wpa_tdls_prohibited(struct wpa_eapol_ie_parse * elems)2862 static int wpa_tdls_prohibited(struct wpa_eapol_ie_parse *elems)
2863 {
2864 /* bit 38 - TDLS Prohibited */
2865 return !!(elems->ext_capab[2 + 4] & 0x40);
2866 }
2867
2868
wpa_tdls_chan_switch_prohibited(struct wpa_eapol_ie_parse * elems)2869 static int wpa_tdls_chan_switch_prohibited(struct wpa_eapol_ie_parse *elems)
2870 {
2871 /* bit 39 - TDLS Channel Switch Prohibited */
2872 return !!(elems->ext_capab[2 + 4] & 0x80);
2873 }
2874
2875
wpa_tdls_ap_ies(struct wpa_sm * sm,const u8 * ies,size_t len)2876 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2877 {
2878 struct wpa_eapol_ie_parse elems;
2879
2880 sm->tdls_prohibited = 0;
2881 sm->tdls_chan_switch_prohibited = 0;
2882
2883 if (ies == NULL || wpa_supplicant_parse_ies(ies, len, &elems) < 0 ||
2884 elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5)
2885 return;
2886
2887 sm->tdls_prohibited = wpa_tdls_prohibited(&elems);
2888 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
2889 sm->tdls_prohibited ? "prohibited" : "allowed");
2890 sm->tdls_chan_switch_prohibited =
2891 wpa_tdls_chan_switch_prohibited(&elems);
2892 wpa_printf(MSG_DEBUG, "TDLS: TDLS channel switch %s in the target BSS",
2893 sm->tdls_chan_switch_prohibited ? "prohibited" : "allowed");
2894 }
2895
2896
wpa_tdls_assoc_resp_ies(struct wpa_sm * sm,const u8 * ies,size_t len)2897 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2898 {
2899 struct wpa_eapol_ie_parse elems;
2900
2901 if (ies == NULL || wpa_supplicant_parse_ies(ies, len, &elems) < 0 ||
2902 elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5)
2903 return;
2904
2905 if (!sm->tdls_prohibited && wpa_tdls_prohibited(&elems)) {
2906 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
2907 "(Re)Association Response IEs");
2908 sm->tdls_prohibited = 1;
2909 }
2910
2911 if (!sm->tdls_chan_switch_prohibited &&
2912 wpa_tdls_chan_switch_prohibited(&elems)) {
2913 wpa_printf(MSG_DEBUG,
2914 "TDLS: TDLS channel switch prohibited based on (Re)Association Response IEs");
2915 sm->tdls_chan_switch_prohibited = 1;
2916 }
2917 }
2918
2919
wpa_tdls_enable(struct wpa_sm * sm,int enabled)2920 void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
2921 {
2922 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
2923 sm->tdls_disabled = !enabled;
2924 }
2925
2926
wpa_tdls_is_external_setup(struct wpa_sm * sm)2927 int wpa_tdls_is_external_setup(struct wpa_sm *sm)
2928 {
2929 return sm->tdls_external_setup;
2930 }
2931
2932
wpa_tdls_enable_chan_switch(struct wpa_sm * sm,const u8 * addr,u8 oper_class,struct hostapd_freq_params * freq_params)2933 int wpa_tdls_enable_chan_switch(struct wpa_sm *sm, const u8 *addr,
2934 u8 oper_class,
2935 struct hostapd_freq_params *freq_params)
2936 {
2937 struct wpa_tdls_peer *peer;
2938 int ret;
2939
2940 if (sm->tdls_disabled || !sm->tdls_supported)
2941 return -1;
2942
2943 if (!sm->tdls_chan_switch) {
2944 wpa_printf(MSG_DEBUG,
2945 "TDLS: Channel switching not supported by the driver");
2946 return -1;
2947 }
2948
2949 if (sm->tdls_chan_switch_prohibited) {
2950 wpa_printf(MSG_DEBUG,
2951 "TDLS: Channel switching is prohibited in this BSS - reject request to switch channel");
2952 return -1;
2953 }
2954
2955 for (peer = sm->tdls; peer; peer = peer->next) {
2956 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2957 break;
2958 }
2959
2960 if (peer == NULL || !peer->tpk_success) {
2961 wpa_printf(MSG_ERROR, "TDLS: Peer " MACSTR
2962 " not found for channel switching", MAC2STR(addr));
2963 return -1;
2964 }
2965
2966 if (peer->chan_switch_enabled) {
2967 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
2968 " already has channel switching enabled",
2969 MAC2STR(addr));
2970 return 0;
2971 }
2972
2973 ret = wpa_sm_tdls_enable_channel_switch(sm, peer->addr,
2974 oper_class, freq_params);
2975 if (!ret)
2976 peer->chan_switch_enabled = 1;
2977
2978 return ret;
2979 }
2980
2981
wpa_tdls_disable_chan_switch(struct wpa_sm * sm,const u8 * addr)2982 int wpa_tdls_disable_chan_switch(struct wpa_sm *sm, const u8 *addr)
2983 {
2984 struct wpa_tdls_peer *peer;
2985
2986 if (sm->tdls_disabled || !sm->tdls_supported)
2987 return -1;
2988
2989 for (peer = sm->tdls; peer; peer = peer->next) {
2990 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2991 break;
2992 }
2993
2994 if (!peer || !peer->chan_switch_enabled) {
2995 wpa_printf(MSG_ERROR, "TDLS: Channel switching not enabled for "
2996 MACSTR, MAC2STR(addr));
2997 return -1;
2998 }
2999
3000 /* ignore the return value */
3001 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
3002
3003 peer->chan_switch_enabled = 0;
3004 return 0;
3005 }
3006