tdls.c revision 8da800a193fb6f8832218715f82a7b4e2d2ad338
18d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/*
28d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_supplicant - TDLS
38d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Copyright (c) 2010-2011, Atheros Communications
48d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
5c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * This software may be distributed under the terms of the BSD license.
6c5ec7f57ead87efa365800228aa0b09a12d9e6c4Dmitry Shmidt * See README for more details.
78d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
88d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
98d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "utils/includes.h"
108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "utils/common.h"
128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "utils/eloop.h"
138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "utils/os.h"
148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "common/ieee802_11_defs.h"
158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/sha256.h"
168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/crypto.h"
178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "crypto/aes_wrap.h"
188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "rsn_supp/wpa.h"
198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "rsn_supp/wpa_ie.h"
208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "rsn_supp/wpa_i.h"
218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "drivers/driver.h"
228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#include "l2_packet/l2_packet.h"
238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_LONG_FRAME BIT(0)
268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_ALT_RSN_IE BIT(1)
278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_DIFF_BSSID BIT(2)
288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_SHORT_LIFETIME BIT(3)
298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_LONG_LIFETIME BIT(6)
328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_CONCURRENT_INIT BIT(7)
338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_DECLINE_RESP BIT(9)
358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtunsigned int tdls_testing = 0;
378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TPK_LIFETIME 43200 /* 12 hours */
408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TPK_RETRY_COUNT 3
418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TPK_TIMEOUT 5000 /* in milliseconds */
428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_MIC_LEN		16
448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_TIMEOUT_LEN	4
468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct wpa_tdls_ftie {
488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_type; /* FTIE */
498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_len;
508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 mic_ctrl[2];
518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 mic[TDLS_MIC_LEN];
528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* followed by optional elements */
558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} STRUCT_PACKED;
568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct wpa_tdls_timeoutie {
588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_type; /* Timeout IE */
598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_len;
608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 interval_type;
618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 value[TDLS_TIMEOUT_LEN];
628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} STRUCT_PACKED;
638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct wpa_tdls_lnkid {
658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_type; /* Link Identifier IE */
668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 ie_len;
678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 bssid[ETH_ALEN];
688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 init_sta[ETH_ALEN];
698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 resp_sta[ETH_ALEN];
708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} STRUCT_PACKED;
718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/* TDLS frame headers as per IEEE Std 802.11z-2010 */
738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct wpa_tdls_frame {
748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 category; /* Category */
768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 action; /* Action (enum tdls_frame_type) */
778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt} STRUCT_PACKED;
788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#define TDLS_MAX_IE_LEN 80
851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#define IEEE80211_MAX_SUPP_RATES 32
861f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstruct wpa_tdls_peer {
888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *next;
898da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	unsigned int reconfig_key:1;
908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int initiator; /* whether this end was initiator for TDLS setup */
918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 addr[ETH_ALEN]; /* other end MAC address */
928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t rsnie_i_len;
968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t rsnie_p_len;
988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime;
998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int cipher; /* Selected cipher (WPA_CIPHER_*) */
1008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 dtoken;
1018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct tpk {
1038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 kck[16]; /* TPK-KCK */
1048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
1058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} tpk;
1068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int tpk_set;
1078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int tpk_success;
1088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct tpk_timer {
1108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 dest[ETH_ALEN];
1118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		int count;      /* Retry Count */
1128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		int timer;      /* Timeout in milliseconds */
1138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 action_code; /* TDLS frame type */
1148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 dialog_token;
1158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u16 status_code;
1168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		int buf_len;    /* length of TPK message for retransmission */
1178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u8 *buf;        /* buffer for TPK message */
1188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} sm_tmr;
1191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	u16 capability;
1211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1221f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
1231f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	size_t supp_rates_len;
124f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
125f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	struct ieee80211_ht_capabilities *ht_capabilities;
12633e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	struct ieee80211_vht_capabilities *vht_capabilities;
127f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
128f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	u8 qos_info;
129f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
130f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	u8 *ext_capab;
131f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	size_t ext_capab_len;
1328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt};
1338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_get_privacy(struct wpa_sm *sm)
1368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
1378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
1388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * Get info needed from supplicant to check if the current BSS supports
1398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * security. Other than OPEN mode, rest are considered secured
1408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
1418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
1428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return sm->pairwise_cipher != WPA_CIPHER_NONE;
1438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
1448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
1478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
1488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, ie, ie_len);
1498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return pos + ie_len;
1508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
1518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
1548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
1558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,
1568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   0, 0, NULL, 0, NULL, 0) < 0) {
1578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
1588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "the driver");
1598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
1608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
1618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
1638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
1648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
1678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
1688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 key_len;
1698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 rsc[6];
1708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	enum wpa_alg alg;
1718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(rsc, 0, 6);
1738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	switch (peer->cipher) {
1758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WPA_CIPHER_CCMP:
1768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		alg = WPA_ALG_CCMP;
1778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		key_len = 16;
1788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
1798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WPA_CIPHER_NONE:
1808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
1818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "NONE - do not use pairwise keys");
1828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
1838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	default:
1848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
1858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   sm->pairwise_cipher);
1868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
1878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
1888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
1908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
1918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
1928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "driver");
1938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
1948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
1958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
1968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
1978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
1998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
2008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				 u8 action_code, u8 dialog_token,
2018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				 u16 status_code, const u8 *buf, size_t len)
2028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
2038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
2048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     status_code, buf, len);
2058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
2068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
2098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			     u8 dialog_token, u16 status_code,
2108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			     const u8 *msg, size_t msg_len)
2118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
2128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
2138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
2158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "dialog_token=%u status_code=%u msg_len=%u",
2168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(dest), action_code, dialog_token, status_code,
2178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   (unsigned int) msg_len);
2188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
2208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  status_code, msg, msg_len)) {
2218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to send message "
2228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "(action_code=%u)", action_code);
2238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
2248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
2258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
2271f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	    action_code == WLAN_TDLS_TEARDOWN ||
2281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	    action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
2291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	    action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
2308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0; /* No retries */
2318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
2338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)
2348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
2358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
2368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL) {
2388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
2398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "retry " MACSTR, MAC2STR(dest));
2408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
2418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
2428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
2448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.count = TPK_RETRY_COUNT;
2468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.timer = TPK_TIMEOUT;
2478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Copy message to resend on timeout */
2498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
2508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.action_code = action_code;
2518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.dialog_token = dialog_token;
2528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.status_code = status_code;
2538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.buf_len = msg_len;
2548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(peer->sm_tmr.buf);
2558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.buf = os_malloc(msg_len);
2568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->sm_tmr.buf == NULL)
2578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
2588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->sm_tmr.buf, msg, msg_len);
2598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
2618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "(action_code=%u)", action_code);
2628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
2638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			       wpa_tdls_tpk_retry_timeout, sm, peer);
2648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
2658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
2668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtstatic int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
2691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				u16 reason_code, int free_peer)
2701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
2711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	int ret;
2721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2731f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_external_setup) {
2741f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
2751f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		/* disable the link after teardown was sent */
2771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	} else {
2791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		ret = wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
2801f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
2811f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2821f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_external_setup || free_peer)
2831f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_peer_free(sm, peer);
2841f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return ret;
2861f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
2871f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2881f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
2898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
2908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
2918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_sm *sm = eloop_ctx;
2938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer = timeout_ctx;
2948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->sm_tmr.count) {
2968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.count--;
2978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.timer = TPK_TIMEOUT;
2988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
3008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "(action_code=%u)",
3018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   peer->sm_tmr.action_code);
3028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (peer->sm_tmr.buf == NULL) {
3048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
3058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   "for action_code=%u",
3068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   peer->sm_tmr.action_code);
3078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
3088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					     peer);
3098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			return;
3108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		}
3118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* resend TPK Handshake Message to Peer */
3138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
3148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  peer->sm_tmr.action_code,
3158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  peer->sm_tmr.dialog_token,
3168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  peer->sm_tmr.status_code,
3178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  peer->sm_tmr.buf,
3188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  peer->sm_tmr.buf_len)) {
3198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_printf(MSG_INFO, "TDLS: Failed to retry "
3208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   "transmission");
3218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		}
3228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
3248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
3258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				       wpa_tdls_tpk_retry_timeout, sm, peer);
3268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
3278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
3288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
3301f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_do_teardown(sm, peer,
3311f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				     WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1);
3328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
3338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
3348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
3378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					      struct wpa_tdls_peer *peer,
3388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					      u8 action_code)
3398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
3408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (action_code == peer->sm_tmr.action_code) {
3418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
3428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "action_code=%u", action_code);
3438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Cancel Timeout registered */
3458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
3468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* free all resources meant for retry */
3488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_free(peer->sm_tmr.buf);
3498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.buf = NULL;
3508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.count = 0;
3528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.timer = 0;
3538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.buf_len = 0;
3548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->sm_tmr.action_code = 0xff;
3558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
3568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
3578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "(Unknown action_code=%u)", action_code);
3588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
3598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
3608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
3638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  const u8 *own_addr, const u8 *bssid)
3648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
3658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 key_input[SHA256_MAC_LEN];
3668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *nonce[2];
3678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t len[2];
3688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 data[3 * ETH_ALEN];
3698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* IEEE Std 802.11z-2010 8.5.9.1:
3718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
3728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
3738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	len[0] = WPA_NONCE_LEN;
3748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	len[1] = WPA_NONCE_LEN;
3758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
3768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		nonce[0] = peer->inonce;
3778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		nonce[1] = peer->rnonce;
3788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
3798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		nonce[0] = peer->rnonce;
3808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		nonce[1] = peer->inonce;
3818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
3828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
3838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
3848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sha256_vector(2, nonce, len, key_input);
3858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
3868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			key_input, SHA256_MAC_LEN);
3878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
3898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
3908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 *	min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
3918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * TODO: is N_KEY really included in KDF Context and if so, in which
3928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * presentation format (little endian 16-bit?) is it used? It gets
3938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * added by the KDF anyway..
3948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
3958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
3968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
3978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(data, own_addr, ETH_ALEN);
3988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
3998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
4008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(data, peer->addr, ETH_ALEN);
4018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
4028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
4038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
4048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
4058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
4078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   (u8 *) &peer->tpk, sizeof(peer->tpk));
4088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
4098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			peer->tpk.kck, sizeof(peer->tpk.kck));
4108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
4118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			peer->tpk.tk, sizeof(peer->tpk.tk));
4128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->tpk_set = 1;
4138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
4148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
4178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
4188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @kck: TPK-KCK
4198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @lnkid: Pointer to the beginning of Link Identifier IE
4208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rsnie: Pointer to the beginning of RSN IE used for handshake
4218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
4228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @ftie: Pointer to the beginning of FT IE
4238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @mic: Pointer for writing MIC
4248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
4258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Calculate MIC for TDLS frame.
4268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
4278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
4288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			     const u8 *rsnie, const u8 *timeoutie,
4298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			     const u8 *ftie, u8 *mic)
4308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
4318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *buf, *pos;
4328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *_ftie;
4338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const struct wpa_tdls_lnkid *_lnkid;
4348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ret;
4358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
4368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		2 + timeoutie[1] + 2 + ftie[1];
4378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	buf = os_zalloc(len);
4388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!buf) {
4398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
4408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
4418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
4428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = buf;
4448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	_lnkid = (const struct wpa_tdls_lnkid *) lnkid;
4458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 1) TDLS initiator STA MAC address */
4468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
4478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += ETH_ALEN;
4488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 2) TDLS responder STA MAC address */
4498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
4508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += ETH_ALEN;
4518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 3) Transaction Sequence number */
4528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	*pos++ = trans_seq;
4538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 4) Link Identifier IE */
4548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, lnkid, 2 + lnkid[1]);
4558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + lnkid[1];
4568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 5) RSN IE */
4578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, rsnie, 2 + rsnie[1]);
4588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + rsnie[1];
4598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 6) Timeout Interval IE */
4608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
4618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + timeoutie[1];
4628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
4638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, ftie, 2 + ftie[1]);
4648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	_ftie = (struct wpa_tdls_ftie *) pos;
4658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
4668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + ftie[1];
4678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
4698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
4708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ret = omac1_aes_128(kck, buf, pos - buf, mic);
4718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(buf);
4728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
4738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return ret;
4748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
4758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
4788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
4798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @kck: TPK-KCK
4808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @trans_seq: Transaction Sequence Number (4 - Teardown)
4818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @rcode: Reason code for Teardown
4828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @dtoken: Dialog Token used for that particular link
4838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @lnkid: Pointer to the beginning of Link Identifier IE
4848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @ftie: Pointer to the beginning of FT IE
4858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @mic: Pointer for writing MIC
4868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
4878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Calculate MIC for TDLS frame.
4888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
4898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
4908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     u8 dtoken, const u8 *lnkid,
4918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     const u8 *ftie, u8 *mic)
4928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
4938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *buf, *pos;
4948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *_ftie;
4958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ret;
4968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int len;
4978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
4988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (lnkid == NULL)
4998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
5008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
5028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		sizeof(trans_seq) + 2 + ftie[1];
5038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	buf = os_zalloc(len);
5058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!buf) {
5068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
5078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
5088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
5098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = buf;
5118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 1) Link Identifier IE */
5128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, lnkid, 2 + lnkid[1]);
5138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + lnkid[1];
5148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 2) Reason Code */
5158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, rcode);
5168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += sizeof(rcode);
5178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 3) Dialog token */
5188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	*pos++ = dtoken;
5198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 4) Transaction Sequence number */
5208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	*pos++ = trans_seq;
5218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* 7) FTIE, with the MIC field of the FTIE set to 0 */
5228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, ftie, 2 + ftie[1]);
5238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	_ftie = (struct wpa_tdls_ftie *) pos;
5248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
5258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 + ftie[1];
5268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
5288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
5298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ret = omac1_aes_128(kck, buf, pos - buf, mic);
5308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(buf);
5318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
5328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return ret;
5338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
5348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
5378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  struct wpa_tdls_peer *peer,
5388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  const u8 *lnkid, const u8 *timeoutie,
5398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  const struct wpa_tdls_ftie *ftie)
5408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
5418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 mic[16];
5428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->tpk_set) {
5448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
5458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  peer->rsnie_p, timeoutie, (u8 *) ftie,
5468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  mic);
5478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(mic, ftie->mic, 16) != 0) {
5488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
5498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   "dropping packet");
5508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
5518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				    ftie->mic, 16);
5528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
5538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				    mic, 16);
5548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			return -1;
5558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		}
5568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
5578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
5588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK not set - dropping packet");
5598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
5608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
5618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
5628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
5638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_supplicant_verify_tdls_mic_teardown(
5668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
5678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *lnkid, const struct wpa_tdls_ftie *ftie)
5688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
5698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 mic[16];
5708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->tpk_set) {
5728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
5738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					  dtoken, lnkid, (u8 *) ftie, mic);
5748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(mic, ftie->mic, 16) != 0) {
5758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
5768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   "dropping packet");
5778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			return -1;
5788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		}
5798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
5808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
5818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "MIC, TPK not set - dropping packet");
5828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
5838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
5848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
5858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
5868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
5898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
5908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_sm *sm = eloop_ctx;
5918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer = timeout_ctx;
5928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
5938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
5948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * On TPK lifetime expiration, we have an option of either tearing down
5958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * the direct link or trying to re-initiate it. The selection of what
5968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * to do is not strictly speaking controlled by our role in the expired
5978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * link, but for now, use that to select whether to renew or tear down
5988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * the link.
5998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
6008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->initiator) {
6028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
6038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   " - try to renew", MAC2STR(peer->addr));
6048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_start(sm, peer->addr);
6058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
6068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
6078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   " - tear down", MAC2STR(peer->addr));
6081f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_do_teardown(sm, peer,
6091f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				     WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1);
6108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
6118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
6128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
6158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
6168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
6178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(peer->addr));
6188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
6198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
6208da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	peer->reconfig_key = 0;
6218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->initiator = 0;
6228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(peer->sm_tmr.buf);
6238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->sm_tmr.buf = NULL;
624f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	os_free(peer->ht_capabilities);
625f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer->ht_capabilities = NULL;
62633e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	os_free(peer->vht_capabilities);
62733e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	peer->vht_capabilities = NULL;
628f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	os_free(peer->ext_capab);
629f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer->ext_capab = NULL;
6308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_i_len = peer->rsnie_p_len = 0;
6318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->cipher = 0;
6328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->tpk_set = peer->tpk_success = 0;
6338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(&peer->tpk, 0, sizeof(peer->tpk));
6348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(peer->inonce, 0, WPA_NONCE_LEN);
6358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
6368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
6378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
6408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			    struct wpa_tdls_lnkid *lnkid)
6418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
6428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid->ie_type = WLAN_EID_LINK_ID;
6438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid->ie_len = 3 * ETH_ALEN;
6448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN);
6458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer->initiator) {
6468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
6478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
6488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
6498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
6508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
6518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
6528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
6538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtint wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
6568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
6578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
6588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
6598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_lnkid lnkid;
6608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 dialog_token;
6618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *rbuf, *pos;
6628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ielen;
6638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported)
6658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
6668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Find the node and free from the list */
6688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
6698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
6708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
6718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
6728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL) {
6748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
6758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "Teardown " MACSTR, MAC2STR(addr));
6768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
6778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
6788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	dialog_token = peer->dtoken;
6808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
6828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(addr));
6838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ielen = 0;
6858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
6868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* To add FTIE for Teardown request and compute MIC */
6878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		ielen += sizeof(*ftie);
6888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
6898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (tdls_testing & TDLS_TESTING_LONG_FRAME)
6908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			ielen += 170;
6918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
6928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
6938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rbuf = os_zalloc(ielen + 1);
6958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (rbuf == NULL)
6968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
6978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = rbuf;
6988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
6994b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) {
700f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		if (reason_code != WLAN_REASON_DEAUTH_LEAVING) {
701f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			/* Overwrite the reason code */
702f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			reason_code = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED;
703f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		}
7048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_ies;
7054b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	}
7068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) pos;
7088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
7098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Using the recent nonce which should be for CONFIRM frame */
7108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
7118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
7128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
7138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (ftie + 1);
7148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
7158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
7168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
7178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "FTIE");
7188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		ftie->ie_len += 170;
7198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 255; /* FTIE subelem */
7208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 168; /* FTIE subelem length */
7211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		pos += 168;
7228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
7238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
7248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
7251f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		    (u8 *) ftie, pos - (u8 *) ftie);
7268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* compute MIC before sending */
7288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_linkid(sm, peer, &lnkid);
7298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
7308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  dialog_token, (u8 *) &lnkid, (u8 *) ftie,
7318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  ftie->mic);
7328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_ies:
7348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* TODO: register for a Timeout handler, if Teardown is not received at
7358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * the other end, then try again another time */
7368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* request driver to send Teardown using this FTIE */
7388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
7394b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt			  reason_code, rbuf, pos - rbuf);
7408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(rbuf);
7418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* clear the Peerkey statemachine */
7438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_peer_free(sm, peer);
7448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
7468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
7478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
7491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtint wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
7501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
7511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	struct wpa_tdls_peer *peer;
7521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7531f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported)
7541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
7551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
7571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
7581f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			break;
7591f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
7601f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7611f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (peer == NULL) {
7621f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
7631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   " for link Teardown", MAC2STR(addr));
7641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
7651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
7661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (!peer->tpk_success) {
7681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
7691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   " not connected - cannot Teardown link", MAC2STR(addr));
7701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
7711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
7721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7731f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return wpa_tdls_do_teardown(sm, peer, reason_code, 0);
7741f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
7751f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtvoid wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr)
7781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
7791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	struct wpa_tdls_peer *peer;
7801f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7811f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
7821f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
7831f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			break;
7841f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
7851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7861f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (peer) {
7871f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
7881f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_peer_free(sm, peer);
7891f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
7901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
7911f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7921f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
7938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
7948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				  const u8 *buf, size_t len)
7958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
7968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer = NULL;
7978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
7988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_lnkid *lnkid;
7998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_eapol_ie_parse kde;
8008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 reason_code;
8018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *pos;
8028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ielen;
8038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Find the node and free from the list */
8058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
8068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
8078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
8088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL) {
8118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
8128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "Teardown " MACSTR, MAC2STR(src_addr));
8138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
8148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = buf;
8178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
8188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	reason_code = WPA_GET_LE16(pos);
8208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
8218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
8238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   " (reason code %u)", MAC2STR(src_addr), reason_code);
8248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ielen = len - (pos - buf); /* start of IE in buf */
8268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
8278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown");
8288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
8298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
8328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
8338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "Teardown");
8348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
8358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
8378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
8398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_ftie;
8408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
8428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
8438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
8448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) kde.ftie;
8478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Process MIC check to see if TDLS Teardown is right */
8498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
8508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt						    peer->dtoken, peer,
8518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt						    (u8 *) lnkid, ftie) < 0) {
8528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
8538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "Teardown Request from " MACSTR, MAC2STR(src_addr));
8548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
8558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
8568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_ftie:
8588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
8598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * Request the driver to disable the direct link and clear associated
8608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * keys.
8618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
8628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
8638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* clear the Peerkey statemachine */
8658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_peer_free(sm, peer);
8668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
8688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
8698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
8728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_send_error - To send suitable TDLS status response with
8738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *	appropriate status code mentioning reason for error/failure.
8748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @dst 	- MAC addr of Peer station
8758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @tdls_action - TDLS frame type for which error code is sent
8768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @status 	- status code mentioning reason
8778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
8788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
8808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			       u8 tdls_action, u8 dialog_token, u16 status)
8818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
8828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
8838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   " (action=%u status=%u)",
8848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(dst), tdls_action, status);
8858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
8868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				 NULL, 0);
8878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
8888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
8901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtstatic struct wpa_tdls_peer *
8914b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidtwpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing)
8921f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
8931f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	struct wpa_tdls_peer *peer;
8941f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
8954b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	if (existing)
8964b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		*existing = 0;
8974b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
8984b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) {
8994b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt			if (existing)
9004b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt				*existing = 1;
9014b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt			return peer; /* re-use existing entry */
9024b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		}
9034b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	}
9044b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt
9051f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
9061f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   MAC2STR(addr));
9071f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
9081f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	peer = os_zalloc(sizeof(*peer));
9091f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (peer == NULL)
9101f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return NULL;
9111f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
9121f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	os_memcpy(peer->addr, addr, ETH_ALEN);
9131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	peer->next = sm->tdls;
9141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	sm->tdls = peer;
9151f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
9161f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return peer;
9171f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
9181f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
9191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
9208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
9218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				struct wpa_tdls_peer *peer)
9228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
9238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t buf_len;
9248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie timeoutie;
9258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 rsn_capab;
9268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
9278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *rbuf, *pos, *count_pos;
9288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 count;
9298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct rsn_ie_hdr *hdr;
9308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm)) {
9328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
9338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->rsnie_i_len = 0;
9348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_rsnie;
9358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
9368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
9388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * TPK Handshake Message 1:
9398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
9408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * Timeout Interval IE))
9418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
9428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Filling RSN IE */
9448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
9458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr->elem_id = WLAN_EID_RSN;
9468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(hdr->version, RSN_VERSION);
9478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (hdr + 1);
9498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
9508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
9518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	count_pos = pos;
9528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
9538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	count = 0;
9558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
9578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * AES-CCMP is the default Encryption preferred for TDLS, so
9588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * RSN IE is filled only with CCMP CIPHER
9598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * Note: TKIP is not used to encrypt TDLS link.
9608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 *
9618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * Regardless of the cipher used on the AP connection, select CCMP
9628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * here.
9638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
9648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
9658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
9668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	count++;
9678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(count_pos, count);
9698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, 1);
9718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
9728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
9738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
9748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
9768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
9778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
9788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
9798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
9808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "testing");
9818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
9828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
9838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
9848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, rsn_capab);
9858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
9868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
9878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
9888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Number of PMKIDs */
9898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 0x00;
9908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 0x00;
9918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
9928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
9938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr->len = (pos - peer->rsnie_i) - 2;
9958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_i_len = pos - peer->rsnie_i;
9968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
9978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    peer->rsnie_i, peer->rsnie_i_len);
9988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
9998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_rsnie:
10008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	buf_len = 0;
10018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm))
10028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
10038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			sizeof(struct wpa_tdls_timeoutie);
10048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
10058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm) &&
10068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    (tdls_testing & TDLS_TESTING_LONG_FRAME))
10078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		buf_len += 170;
10088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
10098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		buf_len += sizeof(struct wpa_tdls_lnkid);
10108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
10118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rbuf = os_zalloc(buf_len + 1);
10128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (rbuf == NULL) {
10138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
10148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
10158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = rbuf;
10178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm))
10198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_ies;
10208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Initiator RSN IE */
10228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
10238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) pos;
10258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
10268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
10278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
10298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
10308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			"TDLS: Failed to get random data for initiator Nonce");
10318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_free(rbuf);
10328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
10338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
10348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
10368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    peer->inonce, WPA_NONCE_LEN);
10378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
10388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
10408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
10418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (ftie + 1);
10438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
10458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
10468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
10478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "FTIE");
10488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		ftie->ie_len += 170;
10498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 255; /* FTIE subelem */
10508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 168; /* FTIE subelem length */
10518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		pos += 168;
10528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
10548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Lifetime */
10568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->lifetime = TPK_LIFETIME;
10578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
10588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
10598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
10608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "lifetime");
10618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->lifetime = 301;
10628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
10648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
10658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "lifetime");
10668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->lifetime = 0xffffffff;
10678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
10698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
10708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     sizeof(timeoutie), peer->lifetime);
10718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
10728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_ies:
10748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
10768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
10778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
10788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "Link Identifier");
10798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
10808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_linkid(sm, peer, l);
10818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		l->bssid[5] ^= 0x01;
10828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		pos += sizeof(*l);
10838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
10848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
10858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
10878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "Handshake Message 1 (peer " MACSTR ")",
10888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(peer->addr));
10898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1, 0,
10918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			  rbuf, pos - rbuf);
10928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(rbuf);
10938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
10958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
10968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
10988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
10998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				const unsigned char *src_addr, u8 dtoken,
11008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				struct wpa_tdls_lnkid *lnkid,
11018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				const struct wpa_tdls_peer *peer)
11028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
11038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *rbuf, *pos;
11048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t buf_len;
11058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime;
11068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie timeoutie;
11078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
11088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	buf_len = 0;
11108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm)) {
11118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
11128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		 * Lifetime */
11138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
11148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			sizeof(struct wpa_tdls_timeoutie);
11158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
11168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (tdls_testing & TDLS_TESTING_LONG_FRAME)
11178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			buf_len += 170;
11188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
11198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
11208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rbuf = os_zalloc(buf_len + 1);
11228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (rbuf == NULL)
11238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
11248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = rbuf;
11258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm))
11278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_ies;
11288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Peer RSN IE */
11308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
11318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) pos;
11338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
11348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* TODO: ftie->mic_control to set 2-RESPONSE */
11358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
11368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
11378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
11388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
11398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    (u8 *) ftie, sizeof(*ftie));
11408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (ftie + 1);
11428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
11448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
11458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
11468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "FTIE");
11478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		ftie->ie_len += 170;
11488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 255; /* FTIE subelem */
11498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 168; /* FTIE subelem length */
11508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		pos += 168;
11518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
11528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
11538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Lifetime */
11558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime = peer->lifetime;
11568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
11578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
11588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
11598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "lifetime in response");
11608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		lifetime++;
11618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
11628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
11638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
11648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     sizeof(timeoutie), lifetime);
11658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
11668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   lifetime);
11678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* compute MIC before sending */
11698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,
11708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			  (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
11718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_ies:
11738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
11748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			  rbuf, pos - rbuf);
11758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(rbuf);
11768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
11788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
11798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
11828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				const unsigned char *src_addr, u8 dtoken,
11838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				struct wpa_tdls_lnkid *lnkid,
11848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				const struct wpa_tdls_peer *peer)
11858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
11868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *rbuf, *pos;
11878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	size_t buf_len;
11888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
11898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie timeoutie;
11908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime;
11918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
11928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	buf_len = 0;
11938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm)) {
11948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
11958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		 * Lifetime */
11968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
11978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			sizeof(struct wpa_tdls_timeoutie);
11988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
11998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (tdls_testing & TDLS_TESTING_LONG_FRAME)
12008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			buf_len += 170;
12018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
12028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
12038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rbuf = os_zalloc(buf_len + 1);
12058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (rbuf == NULL)
12068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
12078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = rbuf;
12088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm))
12108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_ies;
12118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Peer RSN IE */
12138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
12148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) pos;
12168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
12178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*TODO: ftie->mic_control to set 3-CONFIRM */
12188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
12198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
12208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
12218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (ftie + 1);
12238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
12258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
12268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
12278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "FTIE");
12288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		ftie->ie_len += 170;
12298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 255; /* FTIE subelem */
12308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		*pos++ = 168; /* FTIE subelem length */
12318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		pos += 168;
12328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
12338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
12348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Lifetime */
12368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime = peer->lifetime;
12378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
12388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
12398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
12408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "lifetime in confirm");
12418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		lifetime++;
12428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
12438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
12448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
12458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     sizeof(timeoutie), lifetime);
12468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
12478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   lifetime);
12488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* compute MIC before sending */
12508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,
12518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			  (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
12528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_ies:
12548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 0,
12558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			  rbuf, pos - rbuf);
12568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_free(rbuf);
12578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
12598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
12608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
12621f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtstatic int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
12631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt					    struct wpa_tdls_peer *peer,
12641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt					    u8 dialog_token)
12651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
12661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
12671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   "(peer " MACSTR ")", MAC2STR(peer->addr));
12681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
12701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				 dialog_token, 0, NULL, 0);
12711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
12721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12731f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12741f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtstatic int
12751f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtwpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
12761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				   const u8 *buf, size_t len)
12771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
12781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	struct wpa_eapol_ie_parse kde;
12791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	const struct wpa_tdls_lnkid *lnkid;
12801f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	struct wpa_tdls_peer *peer;
12811f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	size_t min_req_len = sizeof(struct wpa_tdls_frame) +
12821f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
12831f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	u8 dialog_token;
12841f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12851f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
12861f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   MAC2STR(addr));
12871f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12881f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (len < min_req_len) {
12891f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
12901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			   "%d", (int) len);
12911f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
12921f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
12931f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12941f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	dialog_token = buf[sizeof(struct wpa_tdls_frame)];
12951f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
12961f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
12971f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				     len - (sizeof(struct wpa_tdls_frame) + 1),
12981f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				     &kde) < 0)
12991f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13001f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13011f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (!kde.lnkid) {
13021f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
13031f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			   "Request");
13041f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13051f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
13061f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13071f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
13081f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13091f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
13101f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different "
13111f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			   " BSS " MACSTR, MAC2STR(lnkid->bssid));
13121f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
13141f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13154b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	peer = wpa_tdls_add_peer(sm, addr, NULL);
13161f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (peer == NULL)
13171f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13181f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13191f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return wpa_tdls_send_discovery_response(sm, peer, dialog_token);
13201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
13211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13221f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13231f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtint wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
13241f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
13251f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported)
13261f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13271f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
13291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   MACSTR, MAC2STR(addr));
13301f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
13311f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				 1, 0, NULL, 0);
13321f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
13331f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13341f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13351f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtstatic int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
13361f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			   struct wpa_tdls_peer *peer)
13371f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
13381f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (!kde->supp_rates) {
13391f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
13401f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
13411f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
1342a54fa5fb807eaeff45464139b5a7759f060cec68Dmitry Shmidt	peer->supp_rates_len = merge_byte_arrays(
1343a54fa5fb807eaeff45464139b5a7759f060cec68Dmitry Shmidt		peer->supp_rates, sizeof(peer->supp_rates),
1344a54fa5fb807eaeff45464139b5a7759f060cec68Dmitry Shmidt		kde->supp_rates + 2, kde->supp_rates_len - 2,
1345a54fa5fb807eaeff45464139b5a7759f060cec68Dmitry Shmidt		kde->ext_supp_rates + 2, kde->ext_supp_rates_len - 2);
13461f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return 0;
13471f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
13481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
13491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1350f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidtstatic int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde,
1351f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			      struct wpa_tdls_peer *peer)
1352f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt{
1353f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (!kde->ht_capabilities ||
1354f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	    kde->ht_capabilities_len <
1355f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	    sizeof(struct ieee80211_ht_capabilities) ) {
1356f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities "
1357f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			   "received");
1358f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		return 0;
1359f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	}
1360f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1361f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (!peer->ht_capabilities) {
1362f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		peer->ht_capabilities =
1363f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt                        os_zalloc(sizeof(struct ieee80211_ht_capabilities));
1364f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		if (peer->ht_capabilities == NULL)
1365f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt                        return -1;
1366f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	}
1367f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1368f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	os_memcpy(peer->ht_capabilities, kde->ht_capabilities,
1369f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt                  sizeof(struct ieee80211_ht_capabilities));
1370f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities",
1371f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		    (u8 *) peer->ht_capabilities,
1372f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		    sizeof(struct ieee80211_ht_capabilities));
1373f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1374f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	return 0;
1375f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt}
1376f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1377f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
137833e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidtstatic int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde,
137933e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt			      struct wpa_tdls_peer *peer)
138033e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt{
138133e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	if (!kde->vht_capabilities ||
138233e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	    kde->vht_capabilities_len <
138333e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	    sizeof(struct ieee80211_vht_capabilities) ) {
138433e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities "
138533e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt			   "received");
138633e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		return 0;
138733e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	}
138833e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
138933e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	if (!peer->vht_capabilities) {
139033e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		peer->vht_capabilities =
139133e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt                        os_zalloc(sizeof(struct ieee80211_vht_capabilities));
139233e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		if (peer->vht_capabilities == NULL)
139333e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt                        return -1;
139433e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	}
139533e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
139633e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	os_memcpy(peer->vht_capabilities, kde->vht_capabilities,
139733e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt                  sizeof(struct ieee80211_vht_capabilities));
139833e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities",
139933e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		    (u8 *) peer->vht_capabilities,
140033e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		    sizeof(struct ieee80211_vht_capabilities));
140133e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
140233e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	return 0;
140333e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt}
140433e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
140533e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
1406f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidtstatic int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde,
1407f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			       struct wpa_tdls_peer *peer)
1408f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt{
1409f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (!kde->ext_capab) {
1410f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities "
1411f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			   "received");
1412f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		return 0;
1413f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	}
1414f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1415f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {
1416f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		/* Need to allocate buffer to fit the new information */
1417f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		os_free(peer->ext_capab);
1418f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);
1419f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		if (peer->ext_capab == NULL)
1420f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			return -1;
1421f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	}
1422f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1423f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer->ext_capab_len = kde->ext_capab_len - 2;
1424f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);
1425f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1426f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	return 0;
1427f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt}
1428f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1429f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
14308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
14318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   const u8 *buf, size_t len)
14328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
14338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
14348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_eapol_ie_parse kde;
14358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_ie_data ie;
14368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int cipher;
14378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *cpos;
14388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie = NULL;
14398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie *timeoutie;
14408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_lnkid *lnkid;
14418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime = 0;
14428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#if 0
14438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct rsn_ie_hdr *hdr;
14448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 *pos;
14458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 rsn_capab;
14468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 rsn_ver;
14478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif
14488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 dtoken;
14498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 ielen;
14508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
14518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int tdls_prohibited = sm->tdls_prohibited;
14521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	int existing_peer = 0;
14538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
14548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (len < 3 + 3)
14558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
14568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
14578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	cpos = buf;
14588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
14598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
14608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* driver had already verified the frame format */
14618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	dtoken = *cpos++; /* dialog token */
14628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
14638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
14648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
14654b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);
14664b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	if (peer == NULL)
14674b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		goto error;
14681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
14690ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	/* If found, use existing entry instead of adding a new one;
14700ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	 * how to handle the case where both ends initiate at the
14710ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	 * same time? */
14720ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	if (existing_peer) {
14730ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		if (peer->tpk_success) {
14740ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
14750ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				   "direct link is enabled - tear down the "
14760ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				   "old link first");
14770ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt#if 0
14780ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			/* TODO: Disabling the link would be more proper
14790ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			 * operation here, but it seems to trigger a race with
14800ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			 * some drivers handling the new request frame. */
14810ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
14820ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt#else
14830ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			if (sm->tdls_external_setup)
14840ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
14850ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt						 src_addr);
14860ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			else
14870ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				wpa_tdls_del_key(sm, peer);
14880ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt#endif
14890ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			wpa_tdls_peer_free(sm, peer);
14900ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		}
14910ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt
14920ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		/*
14930ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * An entry is already present, so check if we already sent a
14940ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * TDLS Setup Request. If so, compare MAC addresses and let the
14950ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * STA with the lower MAC address continue as the initiator.
14960ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * The other negotiation is terminated.
14970ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 */
14980ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		if (peer->initiator) {
14990ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
15000ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				wpa_printf(MSG_DEBUG, "TDLS: Discard request "
15010ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   "from peer with higher address "
15020ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   MACSTR, MAC2STR(src_addr));
15030ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				return -1;
15040ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			} else {
15050ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				wpa_printf(MSG_DEBUG, "TDLS: Accept request "
15060ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   "from peer with lower address "
15070ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   MACSTR " (terminate previously "
15080ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   "initiated negotiation",
15090ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					   MAC2STR(src_addr));
15100ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				if (sm->tdls_external_setup)
15110ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
15120ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt							 src_addr);
15130ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				else
15140ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt					wpa_tdls_del_key(sm, peer);
15150ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt				wpa_tdls_peer_free(sm, peer);
15160ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			}
15170ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		}
15180ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	}
15190ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt
15201f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	/* capability information */
15211f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	peer->capability = WPA_GET_LE16(cpos);
15221f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	cpos += 2;
15238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ielen = len - (cpos - buf); /* start of IE in buf */
15258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) {
15268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1");
15278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
15288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
15318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
15328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M1");
15338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
15348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
15368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.lnkid, kde.lnkid_len);
15378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
15388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
15398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS");
15408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_NOT_IN_SAME_BSS;
15418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
15428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
15458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   MAC2STR(src_addr));
15468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15471f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (copy_supp_rates(&kde, peer) < 0)
15481f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		goto error;
15491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1550f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (copy_peer_ht_capab(&kde, peer) < 0)
1551f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		goto error;
1552f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
155333e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	if (copy_peer_vht_capab(&kde, peer) < 0)
155433e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		goto error;
155533e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
1556f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (copy_peer_ext_capab(&kde, peer) < 0)
1557f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		goto error;
1558f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1559f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer->qos_info = kde.qosinfo;
1560f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
15618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
15628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
15634b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		peer = wpa_tdls_add_peer(sm, src_addr, NULL);
15644b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		if (peer == NULL)
15654b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt			goto error;
15668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
15678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TDLS setup - send own request");
15688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->initiator = 1;
15698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_send_tpk_m1(sm, peer);
15708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
15738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    tdls_prohibited) {
15748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
15758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "on TDLS");
15768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		tdls_prohibited = 0;
15778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
15798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_prohibited) {
15818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
15828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_REQUEST_DECLINED;
15838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
15848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm)) {
15878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (kde.rsn_ie) {
15888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
15898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   "security is disabled");
15908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			status = WLAN_STATUS_SECURITY_DISABLED;
15918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			goto error;
15928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		}
15938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_rsn;
15948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
15958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
15968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
15978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    kde.rsn_ie == NULL) {
15988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
15998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_PARAMETERS;
16008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
16048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
16058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M1");
16068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_RSNIE;
16078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
16118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
16128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_RSNIE;
16138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	cipher = ie.pairwise_cipher;
16178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (cipher & WPA_CIPHER_CCMP) {
16188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
16198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		cipher = WPA_CIPHER_CCMP;
16208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
16218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
16228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
16238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if ((ie.capabilities &
16278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	     (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
16288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    WPA_CAPABILITY_PEERKEY_ENABLED) {
16298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
16308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M1");
16318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
16328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Lifetime */
16368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.key_lifetime == NULL) {
16378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
16388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
16398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
16428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime = WPA_GET_LE32(timeoutie->value);
16438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
16448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (lifetime < 300) {
16458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
16468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
16478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_rsn:
16511f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#ifdef CONFIG_TDLS_TESTING
16521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
16531f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {
16541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			/*
16551f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			 * The request frame from us is going to win, so do not
16561f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			 * replace information based on this request frame from
16571f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			 * the peer.
16581f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			 */
16591f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			goto skip_rsn_check;
16601f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		}
16611f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
16621f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
16631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
16648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->initiator = 0; /* Need to check */
16658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->dtoken = dtoken;
16668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm)) {
16688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->rsnie_i_len = 0;
16698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->rsnie_p_len = 0;
16708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->cipher = WPA_CIPHER_NONE;
16718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_rsn_check;
16728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) kde.ftie;
16758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
16768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
16778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_i_len = kde.rsn_ie_len;
16788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->cipher = cipher;
16798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
16818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_msg(sm->ctx->ctx, MSG_WARNING,
16828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			"TDLS: Failed to get random data for responder nonce");
16838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
16848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
16858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
16868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#if 0
16888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* get version info from RSNIE received from Peer */
16898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
16908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rsn_ver = WPA_GET_LE16(hdr->version);
16918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* use min(peer's version, out version) */
16938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (rsn_ver > RSN_VERSION)
16948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		rsn_ver = RSN_VERSION;
16958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
16978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
16988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr->elem_id = WLAN_EID_RSN;
16998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(hdr->version, rsn_ver);
17008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = (u8 *) (hdr + 1);
17018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
17038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
17048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Include only the selected cipher in pairwise cipher suite */
17058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, 1);
17068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
17078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (cipher == WPA_CIPHER_CCMP)
17088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
17098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
17108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, 1);
17128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
17138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
17148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += RSN_SELECTOR_LEN;
17158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
17178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
17188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE16(pos, rsn_capab);
17198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2;
17208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	hdr->len = (pos - peer->rsnie_p) - 2;
17228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_p_len = pos - peer->rsnie_p;
17238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif
17248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* temp fix: validation of RSNIE later */
17268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
17278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_p_len = peer->rsnie_i_len;
17288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
17308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    peer->rsnie_p, peer->rsnie_p_len);
17318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->lifetime = lifetime;
17338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
17358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_rsn_check:
17371f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	/* add the peer to the driver as a "setup in progress" peer */
173833e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0, NULL, NULL, 0,
1739f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt				NULL, 0);
17401f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
17418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
17421f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
17431f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_disable_link(sm, peer->addr);
17441f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		goto error;
17451f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
17468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
17488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidterror:
17508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken,
17518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			    status);
17528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return -1;
17538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
17548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17568da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidtstatic int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
17578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
17588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->tpk_success = 1;
17598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
17608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_tdls_get_privacy(sm)) {
17618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		u32 lifetime = peer->lifetime;
17628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/*
17638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		 * Start the initiator process a bit earlier to avoid race
17648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		 * condition with the responder sending teardown request.
17658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		 */
17668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (lifetime > 3 && peer->initiator)
17678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			lifetime -= 3;
17688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
17698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				       sm, peer);
17708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
17718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
17728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK "
17738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "expiration");
17748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
17758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
17768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
17778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
17781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1779f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	/* add supported rates, capabilities, and qos_info to the TDLS peer */
17808da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->capability,
17818da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				    peer->supp_rates, peer->supp_rates_len,
17828da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				    peer->ht_capabilities,
17838da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				    peer->vht_capabilities,
17848da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				    peer->qos_info, peer->ext_capab,
17858da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				    peer->ext_capab_len) < 0)
17868da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		return -1;
17871f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
17888da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {
17898da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Could not configure key to the "
17908da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt			   "driver");
17918da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		return -1;
17928da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	}
17938da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	peer->reconfig_key = 0;
17948da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt
17958da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
17968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
17978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
17998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
18008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   const u8 *buf, size_t len)
18018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
18028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
18038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_eapol_ie_parse kde;
18048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_ie_data ie;
18058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int cipher;
18068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
18078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie *timeoutie;
18088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_lnkid *lnkid;
18098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime;
18108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u8 dtoken;
18118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ielen;
18128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 status;
18138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *pos;
18148da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	int ret;
18158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
18178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "(Peer " MACSTR ")", MAC2STR(src_addr));
18188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
18198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
18208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
18218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL) {
18238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
18248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M2: " MACSTR, MAC2STR(src_addr));
18258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
18268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18270ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	if (!peer->initiator) {
18280ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		/*
18290ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * This may happen if both devices try to initiate TDLS at the
18300ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * same time and we accept the TPK M1 from the peer in
18310ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 * wpa_tdls_process_tpk_m1() and clear our previous state.
18320ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		 */
18330ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so "
18340ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt			   "ignore TPK M2 from " MACSTR, MAC2STR(src_addr));
18350ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt		return -1;
18360ccb66edb8d2a0a397320ace3ec2a03fb0d00d5fDmitry Shmidt	}
18378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
18388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (len < 3 + 2 + 1)
18408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
18418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = buf;
18428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
18438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	status = WPA_GET_LE16(pos);
18448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 /* status code */;
18458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (status != WLAN_STATUS_SUCCESS) {
18478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
18488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   status);
18491f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (sm->tdls_external_setup)
18501f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
18518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
18528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	status = WLAN_STATUS_UNSPECIFIED_FAILURE;
18558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* TODO: need to verify dialog token matches here or in kernel */
18578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	dtoken = *pos++; /* dialog token */
18588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
18608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (len < 3 + 2 + 1 + 2)
18628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
18631f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
18641f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	/* capability information */
18651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	peer->capability = WPA_GET_LE16(pos);
18661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	pos += 2;
18678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ielen = len - (pos - buf); /* start of IE in buf */
18698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) {
18708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2");
18718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
18728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
18758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
18768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
18778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_REQUEST_DECLINED;
18788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
18798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
18818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
18838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
18848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M2");
18858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
18868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
18888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.lnkid, kde.lnkid_len);
18898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
18908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
18928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
18938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_NOT_IN_SAME_BSS;
18948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
18958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
18968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
18971f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (copy_supp_rates(&kde, peer) < 0)
18981f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		goto error;
18991f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
1900f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (copy_peer_ht_capab(&kde, peer) < 0)
1901f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		goto error;
1902f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
190333e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	if (copy_peer_vht_capab(&kde, peer) < 0)
190433e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt		goto error;
190533e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt
1906f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	if (copy_peer_ext_capab(&kde, peer) < 0)
1907f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		goto error;
1908f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
1909f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer->qos_info = kde.qosinfo;
1910f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
19118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm)) {
19128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->rsnie_p_len = 0;
19138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer->cipher = WPA_CIPHER_NONE;
19148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_rsn;
19158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
19188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    kde.rsn_ie == NULL) {
19198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
19208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_PARAMETERS;
19218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
19248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.rsn_ie, kde.rsn_ie_len);
19258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/*
19278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * FIX: bitwise comparison of RSN IE is not the correct way of
19288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * validation this. It can be different, but certain fields must
19298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * match. Since we list only a single pairwise cipher in TPK M1, the
19308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 * memcmp is likely to work in most cases, though.
19318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 */
19328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.rsn_ie_len != peer->rsnie_i_len ||
19338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
19348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
19358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "not match with RSN IE used in TPK M1");
19368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
19378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			    peer->rsnie_i, peer->rsnie_i_len);
19388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
19398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			    kde.rsn_ie, kde.rsn_ie_len);
19408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_RSNIE;
19418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
19458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
19468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_INVALID_RSNIE;
19478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	cipher = ie.pairwise_cipher;
19518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (cipher == WPA_CIPHER_CCMP) {
19528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
19538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		cipher = WPA_CIPHER_CCMP;
19548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	} else {
19558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
19568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
19578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
19618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.ftie, sizeof(*ftie));
19628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) kde.ftie;
19638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
19658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
19668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "not match with FTIE SNonce used in TPK M1");
19678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Silently discard the frame */
19688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
19698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Responder Nonce and RSN IE */
19728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
19738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
19748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->rsnie_p_len = kde.rsn_ie_len;
19758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->cipher = cipher;
19768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Lifetime */
19788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.key_lifetime == NULL) {
19798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
19808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
19818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
19848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime = WPA_GET_LE32(timeoutie->value);
19858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
19868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   lifetime);
19878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (lifetime != peer->lifetime) {
19888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
19898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M2 (expected %u)", lifetime, peer->lifetime);
19908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
19918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto error;
19928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
19938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
19958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
19968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Process MIC check to see if TPK M2 is right */
19978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,
19988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					   (u8 *) timeoutie, ftie) < 0) {
19998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Discard the frame */
20008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_del_key(sm, peer);
20018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
20021f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (sm->tdls_external_setup)
20031f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
20048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20078da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (wpa_tdls_set_key(sm, peer) < 0) {
20088da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		/*
20098da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 * Some drivers may not be able to config the key prior to full
20108da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 * STA entry having been configured.
20118da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 */
20128da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
20138da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt			   "STA entry is complete");
20148da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		peer->reconfig_key = 1;
20158da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	}
20168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_rsn:
20188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->dtoken = dtoken;
20198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
20218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "TPK Handshake Message 3");
20228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer);
20238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20248da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	ret = wpa_tdls_enable_link(sm, peer);
20258da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (ret < 0) {
20268da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
20278da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_tdls_do_teardown(sm, peer,
20288da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				     WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1);
20298da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	}
20308da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	return ret;
20318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidterror:
20338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken,
20348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			    status);
20351f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_external_setup)
20361f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
20378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return -1;
20388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
20398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
20428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   const u8 *buf, size_t len)
20438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
20448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
20458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_eapol_ie_parse kde;
20468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_ftie *ftie;
20478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie *timeoutie;
20488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_lnkid *lnkid;
20498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int ielen;
20508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u16 status;
20518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	const u8 *pos;
20528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	u32 lifetime;
20538da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	int ret;
20548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
20568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   "(Peer " MACSTR ")", MAC2STR(src_addr));
20578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
20588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
20598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
20608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL) {
20628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
20638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M3: " MACSTR, MAC2STR(src_addr));
20648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
20678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (len < 3 + 3)
20698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos = buf;
20718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
20728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	status = WPA_GET_LE16(pos);
20748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (status != 0) {
20768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
20778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   status);
20781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (sm->tdls_external_setup)
20791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
20808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	pos += 2 /* status code */ + 1 /* dialog token */;
20838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ielen = len - (pos - buf); /* start of IE in buf */
20858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
20868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3");
20878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
20918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
20928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
20938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
20948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
20958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    (u8 *) kde.lnkid, kde.lnkid_len);
20968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
20978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
20988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
20998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
21008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!wpa_tdls_get_privacy(sm))
21048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		goto skip_rsn;
21058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
21078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
21088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
21118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.ftie, sizeof(*ftie));
21128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	ftie = (struct wpa_tdls_ftie *) kde.ftie;
21138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.rsn_ie == NULL) {
21158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
21168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
21198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    kde.rsn_ie, kde.rsn_ie_len);
21208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.rsn_ie_len != peer->rsnie_p_len ||
21218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
21228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
21238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "with the one sent in TPK M2");
21248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) {
21288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
21298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "not match with FTIE ANonce used in TPK M2");
21308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
21348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
21358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "match with FTIE SNonce used in TPK M1");
21368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (kde.key_lifetime == NULL) {
21408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
21418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
21448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
21458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    (u8 *) timeoutie, sizeof(*timeoutie));
21468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime = WPA_GET_LE32(timeoutie->value);
21478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
21488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   lifetime);
21498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (lifetime != peer->lifetime) {
21508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
21518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "TPK M3 (expected %u)", lifetime, peer->lifetime);
21521f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		if (sm->tdls_external_setup)
21531f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
21548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,
21588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt					   (u8 *) timeoutie, ftie) < 0) {
21598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_del_key(sm, peer);
21608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
21618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
21628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
21638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21648da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (wpa_tdls_set_key(sm, peer) < 0) {
21658da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		/*
21668da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 * Some drivers may not be able to config the key prior to full
21678da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 * STA entry having been configured.
21688da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		 */
21698da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
21708da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt			   "STA entry is complete");
21718da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		peer->reconfig_key = 1;
21728da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	}
21738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtskip_rsn:
21758da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	ret = wpa_tdls_enable_link(sm, peer);
21768da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	if (ret < 0) {
21778da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
21788da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt		wpa_tdls_do_teardown(sm, peer,
21798da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt				     WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1);
21808da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	}
21818da800a193fb6f8832218715f82a7b4e2d2ad338Dmitry Shmidt	return ret;
21828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
21838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
21868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
21878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
21888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memset(lifetime, 0, ie_len);
21908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
21918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
21928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
21938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	WPA_PUT_LE32(lifetime->value, tsecs);
21948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	os_memcpy(pos, ie, ie_len);
21958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return pos + ie_len;
21968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
21978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
21998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
22008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
22018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @sm: Pointer to WPA state machine data from wpa_sm_init()
22028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @peer: MAC address of the peer STA
22038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: 0 on success, or -1 on failure
22048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
22058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Send TPK Handshake Message 1 info to driver to start TDLS
22068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * handshake with the peer.
22078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
22088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
22098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
22108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
22118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	int tdls_prohibited = sm->tdls_prohibited;
22128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22131f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported)
22148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
22158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#ifdef CONFIG_TDLS_TESTING
22178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
22188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    tdls_prohibited) {
22198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
22208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "on TDLS");
22218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		tdls_prohibited = 0;
22228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
22238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt#endif /* CONFIG_TDLS_TESTING */
22248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tdls_prohibited) {
22268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
22278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "reject request to start setup");
22288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
22298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
22308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22314b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	peer = wpa_tdls_add_peer(sm, addr, NULL);
22324b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt	if (peer == NULL)
22334b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		return -1;
22348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer->initiator = 1;
22368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22371f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	/* add the peer to the driver as a "setup in progress" peer */
223833e38bfa7159cef089d6ee0d904778e184c72c47Dmitry Shmidt	wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0, NULL, NULL, 0,
2239f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt				NULL, 0);
22401f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
22411f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (wpa_tdls_send_tpk_m1(sm, peer) < 0) {
22421f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_disable_link(sm, peer->addr);
22431f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		return -1;
22441f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
22451f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
22461f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return 0;
22478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
22488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22504b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidtvoid wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr)
22518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
22528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer;
22538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22541f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported)
22554b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		return;
22568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	for (peer = sm->tdls; peer; peer = peer->next) {
22588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
22598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			break;
22608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
22618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (peer == NULL || !peer->tpk_success)
22634b9d52f502481b258fec743c03a5e957e5605afcDmitry Shmidt		return;
22648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_external_setup) {
22661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		/*
22671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		 * Disable previous link to allow renegotiation to be completed
22681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		 * on AP path.
22691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		 */
22701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
22711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
22728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
22738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
22768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_supplicant_rx_tdls - Receive TDLS data frame
22778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
22788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function is called to receive TDLS (ethertype = 0x890d) data frames.
22798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
22808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
22818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				   const u8 *buf, size_t len)
22828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
22838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_sm *sm = ctx;
22848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_frame *tf;
22858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
22878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		    buf, len);
22888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22891f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (sm->tdls_disabled || !sm->tdls_supported) {
22901f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
22911f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt			   "or unsupported by driver");
22928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return;
22938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
22948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
22958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) {
22968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
22978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return;
22988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
22998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23008d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (len < sizeof(*tf)) {
23018d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
23028d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return;
23038d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
23048d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23058d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	/* Check to make sure its a valid encapsulated TDLS frame */
23068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	tf = (struct wpa_tdls_frame *) buf;
23078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
23088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	    tf->category != WLAN_ACTION_TDLS) {
23098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
23108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "category=%u action=%u",
23118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   tf->payloadtype, tf->category, tf->action);
23128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return;
23138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
23148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	switch (tf->action) {
23168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WLAN_TDLS_SETUP_REQUEST:
23178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
23188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
23198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WLAN_TDLS_SETUP_RESPONSE:
23208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
23218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
23228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WLAN_TDLS_SETUP_CONFIRM:
23238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
23248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
23258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	case WLAN_TDLS_TEARDOWN:
23268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_recv_teardown(sm, src_addr, buf, len);
23278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
23281f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	case WLAN_TDLS_DISCOVERY_REQUEST:
23291f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
23301f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		break;
23318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	default:
23328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		/* Kernel code will process remaining frames */
23338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
23348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   tf->action);
23358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		break;
23368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
23378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
23388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
23418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_init - Initialize driver interface parameters for TDLS
23428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * @wpa_s: Pointer to wpa_supplicant data
23438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * Returns: 0 on success, -1 on failure
23448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
23458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function is called to initialize driver interface parameters for TDLS.
23468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_drv_init() must have been called before this function to initialize the
23478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * driver interface.
23488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
23498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtint wpa_tdls_init(struct wpa_sm *sm)
23508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
23518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (sm == NULL)
23528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
23538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
235404949598a23f501be6eec21697465fd46a28840aDmitry Shmidt	sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname :
235504949598a23f501be6eec21697465fd46a28840aDmitry Shmidt				     sm->ifname,
235604949598a23f501be6eec21697465fd46a28840aDmitry Shmidt				     sm->own_addr,
23578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
23588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt				     sm, 0);
23598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (sm->l2_tdls == NULL) {
23608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
23618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "connection");
23628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return -1;
23638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
23648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23651f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	/*
23661f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	 * Drivers that support TDLS but don't implement the get_capa callback
23671f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	 * are assumed to perform everything internally
23681f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	 */
23691f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
23701f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt				 &sm->tdls_external_setup) < 0) {
23711f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		sm->tdls_supported = 1;
23721f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		sm->tdls_external_setup = 0;
23731f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	}
23741f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
23751f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
23761f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   "driver", sm->tdls_supported ? "" : " not");
23771f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
23781f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt		   sm->tdls_external_setup ? "external" : "internal");
23791f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
23808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return 0;
23818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
23828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
23838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
2384f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidtvoid wpa_tdls_teardown_peers(struct wpa_sm *sm)
2385f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt{
2386f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	struct wpa_tdls_peer *peer;
2387f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
2388f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	peer = sm->tdls;
2389f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
2390f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Tear down peers");
2391f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
2392f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	while (peer) {
2393f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR,
2394f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			   MAC2STR(peer->addr));
2395f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		if (sm->tdls_external_setup)
2396f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			wpa_tdls_send_teardown(sm, peer->addr,
2397f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt					       WLAN_REASON_DEAUTH_LEAVING);
2398f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		else
2399f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt			wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
2400f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
2401f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt		peer = peer->next;
2402f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt	}
2403f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt}
2404f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
2405f86232838cf712377867cb42417c1613ab5dc425Dmitry Shmidt
24068d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic void wpa_tdls_remove_peers(struct wpa_sm *sm)
24078d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24088d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_tdls_peer *peer, *tmp;
24098d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24108d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	peer = sm->tdls;
24118d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sm->tdls = NULL;
24128d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24138d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	while (peer) {
24148d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		int res;
24158d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		tmp = peer->next;
24168d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
24178d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
24188d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   MAC2STR(peer->addr), res);
24198d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_tdls_peer_free(sm, peer);
24208d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		os_free(peer);
24218d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		peer = tmp;
24228d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
24238d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24248d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24258d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24268d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt/**
24278d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
24288d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt *
24298d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * This function is called to recover driver interface parameters for TDLS
24308d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt * and frees resources allocated for it.
24318d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt */
24328d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_deinit(struct wpa_sm *sm)
24338d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24348d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (sm == NULL)
24358d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return;
24368d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24378d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (sm->l2_tdls)
24388d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		l2_packet_deinit(sm->l2_tdls);
24398d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sm->l2_tdls = NULL;
24408d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24418d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_remove_peers(sm);
24428d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24438d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24448d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24458d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_assoc(struct wpa_sm *sm)
24468d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24478d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
24488d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_remove_peers(sm);
24498d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24508d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24518d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24528d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_disassoc(struct wpa_sm *sm)
24538d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24548d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
24558d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_tdls_remove_peers(sm);
24568d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24578d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24588d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24598d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtstatic int wpa_tdls_prohibited(const u8 *ies, size_t len)
24608d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24618d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	struct wpa_eapol_ie_parse elems;
24628d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24638d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (ies == NULL)
24648d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
24658d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24668d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (wpa_supplicant_parse_ies(ies, len, &elems) < 0)
24678d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
24688d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24698d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5)
24708d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		return 0;
24718d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24728d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	 /* bit 38 - TDLS Prohibited */
24738d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	return !!(elems.ext_capab[2 + 4] & 0x40);
24748d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24758d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24768d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24778d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
24788d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24798d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sm->tdls_prohibited = wpa_tdls_prohibited(ies, len);
24808d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
24818d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		   sm->tdls_prohibited ? "prohibited" : "allowed");
24828d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24838d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24848d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24858d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
24868d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24878d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) {
24888d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
24898d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt			   "(Re)Association Response IEs");
24908d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt		sm->tdls_prohibited = 1;
24918d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	}
24928d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
24938d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24948d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt
24958d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidtvoid wpa_tdls_enable(struct wpa_sm *sm, int enabled)
24968d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt{
24978d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
24988d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt	sm->tdls_disabled = !enabled;
24998d520ff1dc2da35cdca849e982051b86468016d8Dmitry Shmidt}
25001f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
25011f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt
25021f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidtint wpa_tdls_is_external_setup(struct wpa_sm *sm)
25031f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt{
25041f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt	return sm->tdls_external_setup;
25051f69aa52ea2e0a73ac502565df8c666ee49cab6aDmitry Shmidt}
2506