tdls.c revision 09f57babfc1e4473db20ced4f58a4c9f082c8ed8
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36#define TDLS_TESTING_WRONG_MIC BIT(11) 37unsigned int tdls_testing = 0; 38#endif /* CONFIG_TDLS_TESTING */ 39 40#define TPK_LIFETIME 43200 /* 12 hours */ 41#define TPK_M1_RETRY_COUNT 3 42#define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 43#define TPK_M2_RETRY_COUNT 10 44#define TPK_M2_TIMEOUT 500 /* in milliseconds */ 45 46#define TDLS_MIC_LEN 16 47 48#define TDLS_TIMEOUT_LEN 4 49 50struct wpa_tdls_ftie { 51 u8 ie_type; /* FTIE */ 52 u8 ie_len; 53 u8 mic_ctrl[2]; 54 u8 mic[TDLS_MIC_LEN]; 55 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 56 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 57 /* followed by optional elements */ 58} STRUCT_PACKED; 59 60struct wpa_tdls_timeoutie { 61 u8 ie_type; /* Timeout IE */ 62 u8 ie_len; 63 u8 interval_type; 64 u8 value[TDLS_TIMEOUT_LEN]; 65} STRUCT_PACKED; 66 67struct wpa_tdls_lnkid { 68 u8 ie_type; /* Link Identifier IE */ 69 u8 ie_len; 70 u8 bssid[ETH_ALEN]; 71 u8 init_sta[ETH_ALEN]; 72 u8 resp_sta[ETH_ALEN]; 73} STRUCT_PACKED; 74 75/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 76struct wpa_tdls_frame { 77 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 78 u8 category; /* Category */ 79 u8 action; /* Action (enum tdls_frame_type) */ 80} STRUCT_PACKED; 81 82static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 83static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 84static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 85static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 86 struct wpa_tdls_peer *peer); 87static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 88 u16 reason_code); 89 90 91#define TDLS_MAX_IE_LEN 80 92#define IEEE80211_MAX_SUPP_RATES 32 93 94struct wpa_tdls_peer { 95 struct wpa_tdls_peer *next; 96 unsigned int reconfig_key:1; 97 int initiator; /* whether this end was initiator for TDLS setup */ 98 u8 addr[ETH_ALEN]; /* other end MAC address */ 99 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 100 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 101 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 102 size_t rsnie_i_len; 103 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 104 size_t rsnie_p_len; 105 u32 lifetime; 106 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 107 u8 dtoken; 108 109 struct tpk { 110 u8 kck[16]; /* TPK-KCK */ 111 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 112 } tpk; 113 int tpk_set; 114 int tpk_success; 115 int tpk_in_progress; 116 117 struct tpk_timer { 118 u8 dest[ETH_ALEN]; 119 int count; /* Retry Count */ 120 int timer; /* Timeout in milliseconds */ 121 u8 action_code; /* TDLS frame type */ 122 u8 dialog_token; 123 u16 status_code; 124 u32 peer_capab; 125 int buf_len; /* length of TPK message for retransmission */ 126 u8 *buf; /* buffer for TPK message */ 127 } sm_tmr; 128 129 u16 capability; 130 131 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 132 size_t supp_rates_len; 133 134 struct ieee80211_ht_capabilities *ht_capabilities; 135 struct ieee80211_vht_capabilities *vht_capabilities; 136 137 u8 qos_info; 138 139 u16 aid; 140 141 u8 *ext_capab; 142 size_t ext_capab_len; 143 144 u8 *supp_channels; 145 size_t supp_channels_len; 146 147 u8 *supp_oper_classes; 148 size_t supp_oper_classes_len; 149 150 u8 wmm_capable; 151}; 152 153 154static int wpa_tdls_get_privacy(struct wpa_sm *sm) 155{ 156 /* 157 * Get info needed from supplicant to check if the current BSS supports 158 * security. Other than OPEN mode, rest are considered secured 159 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 160 */ 161 return sm->pairwise_cipher != WPA_CIPHER_NONE; 162} 163 164 165static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 166{ 167 os_memcpy(pos, ie, ie_len); 168 return pos + ie_len; 169} 170 171 172static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 173{ 174 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 175 0, 0, NULL, 0, NULL, 0) < 0) { 176 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 177 "the driver"); 178 return -1; 179 } 180 181 return 0; 182} 183 184 185static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 186{ 187 u8 key_len; 188 u8 rsc[6]; 189 enum wpa_alg alg; 190 191 os_memset(rsc, 0, 6); 192 193 switch (peer->cipher) { 194 case WPA_CIPHER_CCMP: 195 alg = WPA_ALG_CCMP; 196 key_len = 16; 197 break; 198 case WPA_CIPHER_NONE: 199 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 200 "NONE - do not use pairwise keys"); 201 return -1; 202 default: 203 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 204 sm->pairwise_cipher); 205 return -1; 206 } 207 208 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 209 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 210 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 211 "driver"); 212 return -1; 213 } 214 return 0; 215} 216 217 218static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 219 u8 action_code, u8 dialog_token, 220 u16 status_code, u32 peer_capab, 221 const u8 *buf, size_t len) 222{ 223 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 224 status_code, peer_capab, buf, len); 225} 226 227 228static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 229 u8 dialog_token, u16 status_code, u32 peer_capab, 230 const u8 *msg, size_t msg_len) 231{ 232 struct wpa_tdls_peer *peer; 233 234 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 235 "dialog_token=%u status_code=%u peer_capab=%u msg_len=%u", 236 MAC2STR(dest), action_code, dialog_token, status_code, 237 peer_capab, (unsigned int) msg_len); 238 239 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 240 status_code, peer_capab, msg, msg_len)) { 241 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 242 "(action_code=%u)", action_code); 243 return -1; 244 } 245 246 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 247 action_code == WLAN_TDLS_TEARDOWN || 248 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 249 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 250 return 0; /* No retries */ 251 252 for (peer = sm->tdls; peer; peer = peer->next) { 253 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 254 break; 255 } 256 257 if (peer == NULL) { 258 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 259 "retry " MACSTR, MAC2STR(dest)); 260 return 0; 261 } 262 263 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 264 265 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 266 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 267 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 268 } else { 269 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 270 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 271 } 272 273 /* Copy message to resend on timeout */ 274 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 275 peer->sm_tmr.action_code = action_code; 276 peer->sm_tmr.dialog_token = dialog_token; 277 peer->sm_tmr.status_code = status_code; 278 peer->sm_tmr.peer_capab = peer_capab; 279 peer->sm_tmr.buf_len = msg_len; 280 os_free(peer->sm_tmr.buf); 281 peer->sm_tmr.buf = os_malloc(msg_len); 282 if (peer->sm_tmr.buf == NULL) 283 return -1; 284 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 285 286 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 287 "(action_code=%u)", action_code); 288 eloop_register_timeout(peer->sm_tmr.timer / 1000, 289 (peer->sm_tmr.timer % 1000) * 1000, 290 wpa_tdls_tpk_retry_timeout, sm, peer); 291 return 0; 292} 293 294 295static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 296 u16 reason_code) 297{ 298 int ret; 299 300 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 301 /* disable the link after teardown was sent */ 302 wpa_tdls_disable_peer_link(sm, peer); 303 304 return ret; 305} 306 307 308static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 309{ 310 311 struct wpa_sm *sm = eloop_ctx; 312 struct wpa_tdls_peer *peer = timeout_ctx; 313 314 if (peer->sm_tmr.count) { 315 peer->sm_tmr.count--; 316 317 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 318 "(action_code=%u)", 319 peer->sm_tmr.action_code); 320 321 if (peer->sm_tmr.buf == NULL) { 322 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 323 "for action_code=%u", 324 peer->sm_tmr.action_code); 325 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 326 peer); 327 return; 328 } 329 330 /* resend TPK Handshake Message to Peer */ 331 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 332 peer->sm_tmr.action_code, 333 peer->sm_tmr.dialog_token, 334 peer->sm_tmr.status_code, 335 peer->sm_tmr.peer_capab, 336 peer->sm_tmr.buf, 337 peer->sm_tmr.buf_len)) { 338 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 339 "transmission"); 340 } 341 342 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 343 eloop_register_timeout(peer->sm_tmr.timer / 1000, 344 (peer->sm_tmr.timer % 1000) * 1000, 345 wpa_tdls_tpk_retry_timeout, sm, peer); 346 } else { 347 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 348 349 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 350 wpa_tdls_do_teardown(sm, peer, 351 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 352 } 353} 354 355 356static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 357 struct wpa_tdls_peer *peer, 358 u8 action_code) 359{ 360 if (action_code == peer->sm_tmr.action_code) { 361 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 362 "action_code=%u", action_code); 363 364 /* Cancel Timeout registered */ 365 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 366 367 /* free all resources meant for retry */ 368 os_free(peer->sm_tmr.buf); 369 peer->sm_tmr.buf = NULL; 370 371 peer->sm_tmr.count = 0; 372 peer->sm_tmr.timer = 0; 373 peer->sm_tmr.buf_len = 0; 374 peer->sm_tmr.action_code = 0xff; 375 } else { 376 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 377 "(Unknown action_code=%u)", action_code); 378 } 379} 380 381 382static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 383 const u8 *own_addr, const u8 *bssid) 384{ 385 u8 key_input[SHA256_MAC_LEN]; 386 const u8 *nonce[2]; 387 size_t len[2]; 388 u8 data[3 * ETH_ALEN]; 389 390 /* IEEE Std 802.11z-2010 8.5.9.1: 391 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 392 */ 393 len[0] = WPA_NONCE_LEN; 394 len[1] = WPA_NONCE_LEN; 395 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 396 nonce[0] = peer->inonce; 397 nonce[1] = peer->rnonce; 398 } else { 399 nonce[0] = peer->rnonce; 400 nonce[1] = peer->inonce; 401 } 402 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 403 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 404 sha256_vector(2, nonce, len, key_input); 405 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 406 key_input, SHA256_MAC_LEN); 407 408 /* 409 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 410 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 411 * TODO: is N_KEY really included in KDF Context and if so, in which 412 * presentation format (little endian 16-bit?) is it used? It gets 413 * added by the KDF anyway.. 414 */ 415 416 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 417 os_memcpy(data, own_addr, ETH_ALEN); 418 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 419 } else { 420 os_memcpy(data, peer->addr, ETH_ALEN); 421 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 422 } 423 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 424 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 425 426 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 427 (u8 *) &peer->tpk, sizeof(peer->tpk)); 428 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 429 peer->tpk.kck, sizeof(peer->tpk.kck)); 430 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 431 peer->tpk.tk, sizeof(peer->tpk.tk)); 432 peer->tpk_set = 1; 433} 434 435 436/** 437 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 438 * @kck: TPK-KCK 439 * @lnkid: Pointer to the beginning of Link Identifier IE 440 * @rsnie: Pointer to the beginning of RSN IE used for handshake 441 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 442 * @ftie: Pointer to the beginning of FT IE 443 * @mic: Pointer for writing MIC 444 * 445 * Calculate MIC for TDLS frame. 446 */ 447static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 448 const u8 *rsnie, const u8 *timeoutie, 449 const u8 *ftie, u8 *mic) 450{ 451 u8 *buf, *pos; 452 struct wpa_tdls_ftie *_ftie; 453 const struct wpa_tdls_lnkid *_lnkid; 454 int ret; 455 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 456 2 + timeoutie[1] + 2 + ftie[1]; 457 buf = os_zalloc(len); 458 if (!buf) { 459 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 460 return -1; 461 } 462 463 pos = buf; 464 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 465 /* 1) TDLS initiator STA MAC address */ 466 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 467 pos += ETH_ALEN; 468 /* 2) TDLS responder STA MAC address */ 469 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 470 pos += ETH_ALEN; 471 /* 3) Transaction Sequence number */ 472 *pos++ = trans_seq; 473 /* 4) Link Identifier IE */ 474 os_memcpy(pos, lnkid, 2 + lnkid[1]); 475 pos += 2 + lnkid[1]; 476 /* 5) RSN IE */ 477 os_memcpy(pos, rsnie, 2 + rsnie[1]); 478 pos += 2 + rsnie[1]; 479 /* 6) Timeout Interval IE */ 480 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 481 pos += 2 + timeoutie[1]; 482 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 483 os_memcpy(pos, ftie, 2 + ftie[1]); 484 _ftie = (struct wpa_tdls_ftie *) pos; 485 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 486 pos += 2 + ftie[1]; 487 488 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 489 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 490 ret = omac1_aes_128(kck, buf, pos - buf, mic); 491 os_free(buf); 492 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 493 return ret; 494} 495 496 497/** 498 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 499 * @kck: TPK-KCK 500 * @trans_seq: Transaction Sequence Number (4 - Teardown) 501 * @rcode: Reason code for Teardown 502 * @dtoken: Dialog Token used for that particular link 503 * @lnkid: Pointer to the beginning of Link Identifier IE 504 * @ftie: Pointer to the beginning of FT IE 505 * @mic: Pointer for writing MIC 506 * 507 * Calculate MIC for TDLS frame. 508 */ 509static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 510 u8 dtoken, const u8 *lnkid, 511 const u8 *ftie, u8 *mic) 512{ 513 u8 *buf, *pos; 514 struct wpa_tdls_ftie *_ftie; 515 int ret; 516 int len; 517 518 if (lnkid == NULL) 519 return -1; 520 521 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 522 sizeof(trans_seq) + 2 + ftie[1]; 523 524 buf = os_zalloc(len); 525 if (!buf) { 526 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 527 return -1; 528 } 529 530 pos = buf; 531 /* 1) Link Identifier IE */ 532 os_memcpy(pos, lnkid, 2 + lnkid[1]); 533 pos += 2 + lnkid[1]; 534 /* 2) Reason Code */ 535 WPA_PUT_LE16(pos, rcode); 536 pos += sizeof(rcode); 537 /* 3) Dialog token */ 538 *pos++ = dtoken; 539 /* 4) Transaction Sequence number */ 540 *pos++ = trans_seq; 541 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 542 os_memcpy(pos, ftie, 2 + ftie[1]); 543 _ftie = (struct wpa_tdls_ftie *) pos; 544 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 545 pos += 2 + ftie[1]; 546 547 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 548 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 549 ret = omac1_aes_128(kck, buf, pos - buf, mic); 550 os_free(buf); 551 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 552 return ret; 553} 554 555 556static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 557 struct wpa_tdls_peer *peer, 558 const u8 *lnkid, const u8 *timeoutie, 559 const struct wpa_tdls_ftie *ftie) 560{ 561 u8 mic[16]; 562 563 if (peer->tpk_set) { 564 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 565 peer->rsnie_p, timeoutie, (u8 *) ftie, 566 mic); 567 if (os_memcmp(mic, ftie->mic, 16) != 0) { 568 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 569 "dropping packet"); 570 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 571 ftie->mic, 16); 572 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 573 mic, 16); 574 return -1; 575 } 576 } else { 577 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 578 "TPK not set - dropping packet"); 579 return -1; 580 } 581 return 0; 582} 583 584 585static int wpa_supplicant_verify_tdls_mic_teardown( 586 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 587 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 588{ 589 u8 mic[16]; 590 591 if (peer->tpk_set) { 592 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 593 dtoken, lnkid, (u8 *) ftie, mic); 594 if (os_memcmp(mic, ftie->mic, 16) != 0) { 595 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 596 "dropping packet"); 597 return -1; 598 } 599 } else { 600 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 601 "MIC, TPK not set - dropping packet"); 602 return -1; 603 } 604 return 0; 605} 606 607 608static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 609{ 610 struct wpa_sm *sm = eloop_ctx; 611 struct wpa_tdls_peer *peer = timeout_ctx; 612 613 /* 614 * On TPK lifetime expiration, we have an option of either tearing down 615 * the direct link or trying to re-initiate it. The selection of what 616 * to do is not strictly speaking controlled by our role in the expired 617 * link, but for now, use that to select whether to renew or tear down 618 * the link. 619 */ 620 621 if (peer->initiator) { 622 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 623 " - try to renew", MAC2STR(peer->addr)); 624 wpa_tdls_start(sm, peer->addr); 625 } else { 626 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 627 " - tear down", MAC2STR(peer->addr)); 628 wpa_tdls_do_teardown(sm, peer, 629 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 630 } 631} 632 633 634static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 635{ 636 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 637 MAC2STR(peer->addr)); 638 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 639 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 640 peer->reconfig_key = 0; 641 peer->initiator = 0; 642 peer->tpk_in_progress = 0; 643 os_free(peer->sm_tmr.buf); 644 peer->sm_tmr.buf = NULL; 645 os_free(peer->ht_capabilities); 646 peer->ht_capabilities = NULL; 647 os_free(peer->vht_capabilities); 648 peer->vht_capabilities = NULL; 649 os_free(peer->ext_capab); 650 peer->ext_capab = NULL; 651 os_free(peer->supp_channels); 652 peer->supp_channels = NULL; 653 os_free(peer->supp_oper_classes); 654 peer->supp_oper_classes = NULL; 655 peer->rsnie_i_len = peer->rsnie_p_len = 0; 656 peer->cipher = 0; 657 peer->qos_info = 0; 658 peer->wmm_capable = 0; 659 peer->tpk_set = peer->tpk_success = 0; 660 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 661 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 662 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 663} 664 665 666static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 667 struct wpa_tdls_lnkid *lnkid) 668{ 669 lnkid->ie_type = WLAN_EID_LINK_ID; 670 lnkid->ie_len = 3 * ETH_ALEN; 671 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 672 if (peer->initiator) { 673 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 674 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 675 } else { 676 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 677 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 678 } 679} 680 681 682static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 683 u16 reason_code) 684{ 685 struct wpa_tdls_peer *peer; 686 struct wpa_tdls_ftie *ftie; 687 struct wpa_tdls_lnkid lnkid; 688 u8 dialog_token; 689 u8 *rbuf, *pos; 690 int ielen; 691 692 if (sm->tdls_disabled || !sm->tdls_supported) 693 return -1; 694 695 /* Find the node and free from the list */ 696 for (peer = sm->tdls; peer; peer = peer->next) { 697 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 698 break; 699 } 700 701 if (peer == NULL) { 702 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 703 "Teardown " MACSTR, MAC2STR(addr)); 704 return 0; 705 } 706 707 dialog_token = peer->dtoken; 708 709 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 710 MAC2STR(addr)); 711 712 ielen = 0; 713 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 714 /* To add FTIE for Teardown request and compute MIC */ 715 ielen += sizeof(*ftie); 716#ifdef CONFIG_TDLS_TESTING 717 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 718 ielen += 170; 719#endif /* CONFIG_TDLS_TESTING */ 720 } 721 722 rbuf = os_zalloc(ielen + 1); 723 if (rbuf == NULL) 724 return -1; 725 pos = rbuf; 726 727 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 728 goto skip_ies; 729 730 ftie = (struct wpa_tdls_ftie *) pos; 731 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 732 /* Using the recent nonce which should be for CONFIRM frame */ 733 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 734 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 735 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 736 pos = (u8 *) (ftie + 1); 737#ifdef CONFIG_TDLS_TESTING 738 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 739 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 740 "FTIE"); 741 ftie->ie_len += 170; 742 *pos++ = 255; /* FTIE subelem */ 743 *pos++ = 168; /* FTIE subelem length */ 744 pos += 168; 745 } 746#endif /* CONFIG_TDLS_TESTING */ 747 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 748 (u8 *) ftie, pos - (u8 *) ftie); 749 750 /* compute MIC before sending */ 751 wpa_tdls_linkid(sm, peer, &lnkid); 752 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 753 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 754 ftie->mic); 755 756skip_ies: 757 /* TODO: register for a Timeout handler, if Teardown is not received at 758 * the other end, then try again another time */ 759 760 /* request driver to send Teardown using this FTIE */ 761 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 762 reason_code, 0, rbuf, pos - rbuf); 763 os_free(rbuf); 764 765 return 0; 766} 767 768 769int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 770{ 771 struct wpa_tdls_peer *peer; 772 773 if (sm->tdls_disabled || !sm->tdls_supported) 774 return -1; 775 776 for (peer = sm->tdls; peer; peer = peer->next) { 777 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 778 break; 779 } 780 781 if (peer == NULL) { 782 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 783 " for link Teardown", MAC2STR(addr)); 784 return -1; 785 } 786 787 if (!peer->tpk_success) { 788 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 789 " not connected - cannot Teardown link", MAC2STR(addr)); 790 return -1; 791 } 792 793 return wpa_tdls_do_teardown(sm, peer, reason_code); 794} 795 796 797static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 798 struct wpa_tdls_peer *peer) 799{ 800 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 801 wpa_tdls_peer_free(sm, peer); 802} 803 804 805void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 806{ 807 struct wpa_tdls_peer *peer; 808 809 for (peer = sm->tdls; peer; peer = peer->next) { 810 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 811 break; 812 } 813 814 if (peer) 815 wpa_tdls_disable_peer_link(sm, peer); 816} 817 818 819const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr) 820{ 821 struct wpa_tdls_peer *peer; 822 823 if (sm->tdls_disabled || !sm->tdls_supported) 824 return "disabled"; 825 826 for (peer = sm->tdls; peer; peer = peer->next) { 827 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 828 break; 829 } 830 831 if (peer == NULL) 832 return "peer does not exist"; 833 834 if (!peer->tpk_success) 835 return "peer not connected"; 836 837 return "connected"; 838} 839 840 841static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 842 const u8 *buf, size_t len) 843{ 844 struct wpa_tdls_peer *peer = NULL; 845 struct wpa_tdls_ftie *ftie; 846 struct wpa_tdls_lnkid *lnkid; 847 struct wpa_eapol_ie_parse kde; 848 u16 reason_code; 849 const u8 *pos; 850 int ielen; 851 852 /* Find the node and free from the list */ 853 for (peer = sm->tdls; peer; peer = peer->next) { 854 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 855 break; 856 } 857 858 if (peer == NULL) { 859 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 860 "Teardown " MACSTR, MAC2STR(src_addr)); 861 return 0; 862 } 863 864 pos = buf; 865 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 866 867 reason_code = WPA_GET_LE16(pos); 868 pos += 2; 869 870 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 871 " (reason code %u)", MAC2STR(src_addr), reason_code); 872 873 ielen = len - (pos - buf); /* start of IE in buf */ 874 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 875 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 876 return -1; 877 } 878 879 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 880 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 881 "Teardown"); 882 return -1; 883 } 884 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 885 886 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 887 goto skip_ftie; 888 889 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 890 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 891 return -1; 892 } 893 894 ftie = (struct wpa_tdls_ftie *) kde.ftie; 895 896 /* Process MIC check to see if TDLS Teardown is right */ 897 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 898 peer->dtoken, peer, 899 (u8 *) lnkid, ftie) < 0) { 900 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 901 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 902 return -1; 903 } 904 905skip_ftie: 906 /* 907 * Request the driver to disable the direct link and clear associated 908 * keys. 909 */ 910 wpa_tdls_disable_peer_link(sm, peer); 911 return 0; 912} 913 914 915/** 916 * wpa_tdls_send_error - To send suitable TDLS status response with 917 * appropriate status code mentioning reason for error/failure. 918 * @dst - MAC addr of Peer station 919 * @tdls_action - TDLS frame type for which error code is sent 920 * @status - status code mentioning reason 921 */ 922 923static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 924 u8 tdls_action, u8 dialog_token, u16 status) 925{ 926 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 927 " (action=%u status=%u)", 928 MAC2STR(dst), tdls_action, status); 929 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 930 0, NULL, 0); 931} 932 933 934static struct wpa_tdls_peer * 935wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 936{ 937 struct wpa_tdls_peer *peer; 938 939 if (existing) 940 *existing = 0; 941 for (peer = sm->tdls; peer; peer = peer->next) { 942 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 943 if (existing) 944 *existing = 1; 945 return peer; /* re-use existing entry */ 946 } 947 } 948 949 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 950 MAC2STR(addr)); 951 952 peer = os_zalloc(sizeof(*peer)); 953 if (peer == NULL) 954 return NULL; 955 956 os_memcpy(peer->addr, addr, ETH_ALEN); 957 peer->next = sm->tdls; 958 sm->tdls = peer; 959 960 return peer; 961} 962 963 964static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 965 struct wpa_tdls_peer *peer) 966{ 967 size_t buf_len; 968 struct wpa_tdls_timeoutie timeoutie; 969 u16 rsn_capab; 970 struct wpa_tdls_ftie *ftie; 971 u8 *rbuf, *pos, *count_pos; 972 u16 count; 973 struct rsn_ie_hdr *hdr; 974 int status; 975 976 if (!wpa_tdls_get_privacy(sm)) { 977 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 978 peer->rsnie_i_len = 0; 979 goto skip_rsnie; 980 } 981 982 /* 983 * TPK Handshake Message 1: 984 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 985 * Timeout Interval IE)) 986 */ 987 988 /* Filling RSN IE */ 989 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 990 hdr->elem_id = WLAN_EID_RSN; 991 WPA_PUT_LE16(hdr->version, RSN_VERSION); 992 993 pos = (u8 *) (hdr + 1); 994 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 995 pos += RSN_SELECTOR_LEN; 996 count_pos = pos; 997 pos += 2; 998 999 count = 0; 1000 1001 /* 1002 * AES-CCMP is the default Encryption preferred for TDLS, so 1003 * RSN IE is filled only with CCMP CIPHER 1004 * Note: TKIP is not used to encrypt TDLS link. 1005 * 1006 * Regardless of the cipher used on the AP connection, select CCMP 1007 * here. 1008 */ 1009 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1010 pos += RSN_SELECTOR_LEN; 1011 count++; 1012 1013 WPA_PUT_LE16(count_pos, count); 1014 1015 WPA_PUT_LE16(pos, 1); 1016 pos += 2; 1017 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1018 pos += RSN_SELECTOR_LEN; 1019 1020 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1021 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1022#ifdef CONFIG_TDLS_TESTING 1023 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1024 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 1025 "testing"); 1026 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1027 } 1028#endif /* CONFIG_TDLS_TESTING */ 1029 WPA_PUT_LE16(pos, rsn_capab); 1030 pos += 2; 1031#ifdef CONFIG_TDLS_TESTING 1032 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1033 /* Number of PMKIDs */ 1034 *pos++ = 0x00; 1035 *pos++ = 0x00; 1036 } 1037#endif /* CONFIG_TDLS_TESTING */ 1038 1039 hdr->len = (pos - peer->rsnie_i) - 2; 1040 peer->rsnie_i_len = pos - peer->rsnie_i; 1041 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1042 peer->rsnie_i, peer->rsnie_i_len); 1043 1044skip_rsnie: 1045 buf_len = 0; 1046 if (wpa_tdls_get_privacy(sm)) 1047 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1048 sizeof(struct wpa_tdls_timeoutie); 1049#ifdef CONFIG_TDLS_TESTING 1050 if (wpa_tdls_get_privacy(sm) && 1051 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1052 buf_len += 170; 1053 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1054 buf_len += sizeof(struct wpa_tdls_lnkid); 1055#endif /* CONFIG_TDLS_TESTING */ 1056 rbuf = os_zalloc(buf_len + 1); 1057 if (rbuf == NULL) { 1058 wpa_tdls_peer_free(sm, peer); 1059 return -1; 1060 } 1061 pos = rbuf; 1062 1063 if (!wpa_tdls_get_privacy(sm)) 1064 goto skip_ies; 1065 1066 /* Initiator RSN IE */ 1067 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1068 1069 ftie = (struct wpa_tdls_ftie *) pos; 1070 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1071 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1072 1073 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1074 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1075 "TDLS: Failed to get random data for initiator Nonce"); 1076 os_free(rbuf); 1077 wpa_tdls_peer_free(sm, peer); 1078 return -1; 1079 } 1080 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1081 peer->inonce, WPA_NONCE_LEN); 1082 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1083 1084 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1085 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1086 1087 pos = (u8 *) (ftie + 1); 1088 1089#ifdef CONFIG_TDLS_TESTING 1090 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1091 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1092 "FTIE"); 1093 ftie->ie_len += 170; 1094 *pos++ = 255; /* FTIE subelem */ 1095 *pos++ = 168; /* FTIE subelem length */ 1096 pos += 168; 1097 } 1098#endif /* CONFIG_TDLS_TESTING */ 1099 1100 /* Lifetime */ 1101 peer->lifetime = TPK_LIFETIME; 1102#ifdef CONFIG_TDLS_TESTING 1103 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1104 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1105 "lifetime"); 1106 peer->lifetime = 301; 1107 } 1108 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1109 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1110 "lifetime"); 1111 peer->lifetime = 0xffffffff; 1112 } 1113#endif /* CONFIG_TDLS_TESTING */ 1114 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1115 sizeof(timeoutie), peer->lifetime); 1116 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1117 1118skip_ies: 1119 1120#ifdef CONFIG_TDLS_TESTING 1121 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1122 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1123 "Link Identifier"); 1124 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1125 wpa_tdls_linkid(sm, peer, l); 1126 l->bssid[5] ^= 0x01; 1127 pos += sizeof(*l); 1128 } 1129#endif /* CONFIG_TDLS_TESTING */ 1130 1131 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1132 "Handshake Message 1 (peer " MACSTR ")", 1133 MAC2STR(peer->addr)); 1134 1135 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1136 1, 0, 0, rbuf, pos - rbuf); 1137 os_free(rbuf); 1138 1139 return status; 1140} 1141 1142 1143static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1144 const unsigned char *src_addr, u8 dtoken, 1145 struct wpa_tdls_lnkid *lnkid, 1146 const struct wpa_tdls_peer *peer) 1147{ 1148 u8 *rbuf, *pos; 1149 size_t buf_len; 1150 u32 lifetime; 1151 struct wpa_tdls_timeoutie timeoutie; 1152 struct wpa_tdls_ftie *ftie; 1153 int status; 1154 1155 buf_len = 0; 1156 if (wpa_tdls_get_privacy(sm)) { 1157 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1158 * Lifetime */ 1159 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1160 sizeof(struct wpa_tdls_timeoutie); 1161#ifdef CONFIG_TDLS_TESTING 1162 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1163 buf_len += 170; 1164#endif /* CONFIG_TDLS_TESTING */ 1165 } 1166 1167 rbuf = os_zalloc(buf_len + 1); 1168 if (rbuf == NULL) 1169 return -1; 1170 pos = rbuf; 1171 1172 if (!wpa_tdls_get_privacy(sm)) 1173 goto skip_ies; 1174 1175 /* Peer RSN IE */ 1176 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1177 1178 ftie = (struct wpa_tdls_ftie *) pos; 1179 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1180 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1181 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1182 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1183 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1184 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1185 (u8 *) ftie, sizeof(*ftie)); 1186 1187 pos = (u8 *) (ftie + 1); 1188 1189#ifdef CONFIG_TDLS_TESTING 1190 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1191 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1192 "FTIE"); 1193 ftie->ie_len += 170; 1194 *pos++ = 255; /* FTIE subelem */ 1195 *pos++ = 168; /* FTIE subelem length */ 1196 pos += 168; 1197 } 1198#endif /* CONFIG_TDLS_TESTING */ 1199 1200 /* Lifetime */ 1201 lifetime = peer->lifetime; 1202#ifdef CONFIG_TDLS_TESTING 1203 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1204 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1205 "lifetime in response"); 1206 lifetime++; 1207 } 1208#endif /* CONFIG_TDLS_TESTING */ 1209 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1210 sizeof(timeoutie), lifetime); 1211 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1212 lifetime); 1213 1214 /* compute MIC before sending */ 1215 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1216 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1217#ifdef CONFIG_TDLS_TESTING 1218 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1219 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1220 ftie->mic[0] ^= 0x01; 1221 } 1222#endif /* CONFIG_TDLS_TESTING */ 1223 1224skip_ies: 1225 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1226 dtoken, 0, 0, rbuf, pos - rbuf); 1227 os_free(rbuf); 1228 1229 return status; 1230} 1231 1232 1233static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1234 const unsigned char *src_addr, u8 dtoken, 1235 struct wpa_tdls_lnkid *lnkid, 1236 const struct wpa_tdls_peer *peer) 1237{ 1238 u8 *rbuf, *pos; 1239 size_t buf_len; 1240 struct wpa_tdls_ftie *ftie; 1241 struct wpa_tdls_timeoutie timeoutie; 1242 u32 lifetime; 1243 int status; 1244 u32 peer_capab = 0; 1245 1246 buf_len = 0; 1247 if (wpa_tdls_get_privacy(sm)) { 1248 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1249 * Lifetime */ 1250 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1251 sizeof(struct wpa_tdls_timeoutie); 1252#ifdef CONFIG_TDLS_TESTING 1253 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1254 buf_len += 170; 1255#endif /* CONFIG_TDLS_TESTING */ 1256 } 1257 1258 rbuf = os_zalloc(buf_len + 1); 1259 if (rbuf == NULL) 1260 return -1; 1261 pos = rbuf; 1262 1263 if (!wpa_tdls_get_privacy(sm)) 1264 goto skip_ies; 1265 1266 /* Peer RSN IE */ 1267 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1268 1269 ftie = (struct wpa_tdls_ftie *) pos; 1270 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1271 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1272 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1273 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1274 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1275 1276 pos = (u8 *) (ftie + 1); 1277 1278#ifdef CONFIG_TDLS_TESTING 1279 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1280 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1281 "FTIE"); 1282 ftie->ie_len += 170; 1283 *pos++ = 255; /* FTIE subelem */ 1284 *pos++ = 168; /* FTIE subelem length */ 1285 pos += 168; 1286 } 1287#endif /* CONFIG_TDLS_TESTING */ 1288 1289 /* Lifetime */ 1290 lifetime = peer->lifetime; 1291#ifdef CONFIG_TDLS_TESTING 1292 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1293 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1294 "lifetime in confirm"); 1295 lifetime++; 1296 } 1297#endif /* CONFIG_TDLS_TESTING */ 1298 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1299 sizeof(timeoutie), lifetime); 1300 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1301 lifetime); 1302 1303 /* compute MIC before sending */ 1304 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1305 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1306#ifdef CONFIG_TDLS_TESTING 1307 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1308 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1309 ftie->mic[0] ^= 0x01; 1310 } 1311#endif /* CONFIG_TDLS_TESTING */ 1312 1313skip_ies: 1314 1315 if (peer->vht_capabilities) 1316 peer_capab |= TDLS_PEER_VHT; 1317 if (peer->ht_capabilities) 1318 peer_capab |= TDLS_PEER_HT; 1319 if (peer->wmm_capable) 1320 peer_capab |= TDLS_PEER_WMM; 1321 1322 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1323 dtoken, 0, peer_capab, rbuf, pos - rbuf); 1324 os_free(rbuf); 1325 1326 return status; 1327} 1328 1329 1330static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1331 struct wpa_tdls_peer *peer, 1332 u8 dialog_token) 1333{ 1334 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1335 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1336 1337 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1338 dialog_token, 0, 0, NULL, 0); 1339} 1340 1341 1342static int 1343wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1344 const u8 *buf, size_t len) 1345{ 1346 struct wpa_eapol_ie_parse kde; 1347 const struct wpa_tdls_lnkid *lnkid; 1348 struct wpa_tdls_peer *peer; 1349 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1350 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1351 u8 dialog_token; 1352 1353 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1354 MAC2STR(addr)); 1355 1356 if (len < min_req_len) { 1357 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1358 "%d", (int) len); 1359 return -1; 1360 } 1361 1362 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1363 1364 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1365 len - (sizeof(struct wpa_tdls_frame) + 1), 1366 &kde) < 0) 1367 return -1; 1368 1369 if (!kde.lnkid) { 1370 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1371 "Request"); 1372 return -1; 1373 } 1374 1375 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1376 1377 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1378 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1379 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1380 return -1; 1381 } 1382 1383 peer = wpa_tdls_add_peer(sm, addr, NULL); 1384 if (peer == NULL) 1385 return -1; 1386 1387 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1388} 1389 1390 1391int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1392{ 1393 if (sm->tdls_disabled || !sm->tdls_supported) 1394 return -1; 1395 1396 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1397 MACSTR, MAC2STR(addr)); 1398 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1399 1, 0, 0, NULL, 0); 1400} 1401 1402 1403static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1404 struct wpa_tdls_peer *peer) 1405{ 1406 if (!kde->supp_rates) { 1407 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1408 return -1; 1409 } 1410 peer->supp_rates_len = merge_byte_arrays( 1411 peer->supp_rates, sizeof(peer->supp_rates), 1412 kde->supp_rates + 2, kde->supp_rates_len - 2, 1413 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1414 kde->ext_supp_rates_len - 2); 1415 return 0; 1416} 1417 1418 1419static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1420 struct wpa_tdls_peer *peer) 1421{ 1422 if (!kde->ht_capabilities || 1423 kde->ht_capabilities_len < 1424 sizeof(struct ieee80211_ht_capabilities) ) { 1425 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1426 "received"); 1427 return 0; 1428 } 1429 1430 if (!peer->ht_capabilities) { 1431 peer->ht_capabilities = 1432 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1433 if (peer->ht_capabilities == NULL) 1434 return -1; 1435 } 1436 1437 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1438 sizeof(struct ieee80211_ht_capabilities)); 1439 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1440 (u8 *) peer->ht_capabilities, 1441 sizeof(struct ieee80211_ht_capabilities)); 1442 1443 return 0; 1444} 1445 1446 1447static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1448 struct wpa_tdls_peer *peer) 1449{ 1450 if (!kde->vht_capabilities || 1451 kde->vht_capabilities_len < 1452 sizeof(struct ieee80211_vht_capabilities) ) { 1453 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1454 "received"); 1455 return 0; 1456 } 1457 1458 if (!peer->vht_capabilities) { 1459 peer->vht_capabilities = 1460 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1461 if (peer->vht_capabilities == NULL) 1462 return -1; 1463 } 1464 1465 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1466 sizeof(struct ieee80211_vht_capabilities)); 1467 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1468 (u8 *) peer->vht_capabilities, 1469 sizeof(struct ieee80211_vht_capabilities)); 1470 1471 return 0; 1472} 1473 1474 1475static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1476 struct wpa_tdls_peer *peer) 1477{ 1478 if (!kde->ext_capab) { 1479 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1480 "received"); 1481 return 0; 1482 } 1483 1484 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1485 /* Need to allocate buffer to fit the new information */ 1486 os_free(peer->ext_capab); 1487 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1488 if (peer->ext_capab == NULL) 1489 return -1; 1490 } 1491 1492 peer->ext_capab_len = kde->ext_capab_len - 2; 1493 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1494 1495 return 0; 1496} 1497 1498 1499static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde, 1500 struct wpa_tdls_peer *peer) 1501{ 1502 struct wmm_information_element *wmm; 1503 1504 if (!kde->wmm) { 1505 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received"); 1506 return 0; 1507 } 1508 1509 if (kde->wmm_len < sizeof(struct wmm_information_element)) { 1510 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received"); 1511 return -1; 1512 } 1513 1514 wmm = (struct wmm_information_element *) kde->wmm; 1515 peer->qos_info = wmm->qos_info; 1516 1517 peer->wmm_capable = 1; 1518 1519 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info); 1520 return 0; 1521} 1522 1523 1524static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde, 1525 struct wpa_tdls_peer *peer) 1526{ 1527 if (!kde->supp_channels) { 1528 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received"); 1529 return 0; 1530 } 1531 1532 if (!peer->supp_channels || 1533 peer->supp_channels_len < kde->supp_channels_len) { 1534 os_free(peer->supp_channels); 1535 peer->supp_channels = os_zalloc(kde->supp_channels_len); 1536 if (peer->supp_channels == NULL) 1537 return -1; 1538 } 1539 1540 peer->supp_channels_len = kde->supp_channels_len; 1541 1542 os_memcpy(peer->supp_channels, kde->supp_channels, 1543 peer->supp_channels_len); 1544 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels", 1545 (u8 *) peer->supp_channels, peer->supp_channels_len); 1546 return 0; 1547} 1548 1549 1550static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde, 1551 struct wpa_tdls_peer *peer) 1552{ 1553 if (!kde->supp_oper_classes) { 1554 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received"); 1555 return 0; 1556 } 1557 1558 if (!peer->supp_oper_classes || 1559 peer->supp_oper_classes_len < kde->supp_oper_classes_len) { 1560 os_free(peer->supp_oper_classes); 1561 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len); 1562 if (peer->supp_oper_classes == NULL) 1563 return -1; 1564 } 1565 1566 peer->supp_oper_classes_len = kde->supp_oper_classes_len; 1567 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes, 1568 peer->supp_oper_classes_len); 1569 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes", 1570 (u8 *) peer->supp_oper_classes, 1571 peer->supp_oper_classes_len); 1572 return 0; 1573} 1574 1575 1576static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1577 const u8 *buf, size_t len) 1578{ 1579 struct wpa_tdls_peer *peer; 1580 struct wpa_eapol_ie_parse kde; 1581 struct wpa_ie_data ie; 1582 int cipher; 1583 const u8 *cpos; 1584 struct wpa_tdls_ftie *ftie = NULL; 1585 struct wpa_tdls_timeoutie *timeoutie; 1586 struct wpa_tdls_lnkid *lnkid; 1587 u32 lifetime = 0; 1588#if 0 1589 struct rsn_ie_hdr *hdr; 1590 u8 *pos; 1591 u16 rsn_capab; 1592 u16 rsn_ver; 1593#endif 1594 u8 dtoken; 1595 u16 ielen; 1596 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1597 int tdls_prohibited = sm->tdls_prohibited; 1598 int existing_peer = 0; 1599 1600 if (len < 3 + 3) 1601 return -1; 1602 1603 cpos = buf; 1604 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1605 1606 /* driver had already verified the frame format */ 1607 dtoken = *cpos++; /* dialog token */ 1608 1609 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1610 1611 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1612 if (peer == NULL) 1613 goto error; 1614 1615 /* If found, use existing entry instead of adding a new one; 1616 * how to handle the case where both ends initiate at the 1617 * same time? */ 1618 if (existing_peer) { 1619 if (peer->tpk_success) { 1620 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1621 "direct link is enabled - tear down the " 1622 "old link first"); 1623 wpa_tdls_disable_peer_link(sm, peer); 1624 } 1625 1626 /* 1627 * An entry is already present, so check if we already sent a 1628 * TDLS Setup Request. If so, compare MAC addresses and let the 1629 * STA with the lower MAC address continue as the initiator. 1630 * The other negotiation is terminated. 1631 */ 1632 if (peer->initiator) { 1633 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1634 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1635 "from peer with higher address " 1636 MACSTR, MAC2STR(src_addr)); 1637 return -1; 1638 } else { 1639 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1640 "from peer with lower address " 1641 MACSTR " (terminate previously " 1642 "initiated negotiation", 1643 MAC2STR(src_addr)); 1644 wpa_tdls_disable_peer_link(sm, peer); 1645 } 1646 } 1647 } 1648 1649 /* capability information */ 1650 peer->capability = WPA_GET_LE16(cpos); 1651 cpos += 2; 1652 1653 ielen = len - (cpos - buf); /* start of IE in buf */ 1654 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1655 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1656 goto error; 1657 } 1658 1659 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1660 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1661 "TPK M1"); 1662 goto error; 1663 } 1664 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1665 kde.lnkid, kde.lnkid_len); 1666 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1667 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1668 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1669 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1670 goto error; 1671 } 1672 1673 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1674 MAC2STR(src_addr)); 1675 1676 if (copy_supp_rates(&kde, peer) < 0) 1677 goto error; 1678 1679 if (copy_peer_ht_capab(&kde, peer) < 0) 1680 goto error; 1681 1682 if (copy_peer_vht_capab(&kde, peer) < 0) 1683 goto error; 1684 1685 if (copy_peer_ext_capab(&kde, peer) < 0) 1686 goto error; 1687 1688 if (copy_peer_supp_channels(&kde, peer) < 0) 1689 goto error; 1690 1691 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 1692 goto error; 1693 1694 peer->qos_info = kde.qosinfo; 1695 1696 /* Overwrite with the qos_info obtained in WMM IE */ 1697 if (copy_peer_wmm_capab(&kde, peer) < 0) 1698 goto error; 1699 1700 peer->aid = kde.aid; 1701 1702#ifdef CONFIG_TDLS_TESTING 1703 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1704 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1705 if (peer == NULL) 1706 goto error; 1707 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1708 "TDLS setup - send own request"); 1709 peer->initiator = 1; 1710 wpa_tdls_send_tpk_m1(sm, peer); 1711 } 1712 1713 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1714 tdls_prohibited) { 1715 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1716 "on TDLS"); 1717 tdls_prohibited = 0; 1718 } 1719#endif /* CONFIG_TDLS_TESTING */ 1720 1721 if (tdls_prohibited) { 1722 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1723 status = WLAN_STATUS_REQUEST_DECLINED; 1724 goto error; 1725 } 1726 1727 if (!wpa_tdls_get_privacy(sm)) { 1728 if (kde.rsn_ie) { 1729 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1730 "security is disabled"); 1731 status = WLAN_STATUS_SECURITY_DISABLED; 1732 goto error; 1733 } 1734 goto skip_rsn; 1735 } 1736 1737 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1738 kde.rsn_ie == NULL) { 1739 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1740 status = WLAN_STATUS_INVALID_PARAMETERS; 1741 goto error; 1742 } 1743 1744 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1745 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1746 "TPK M1"); 1747 status = WLAN_STATUS_INVALID_RSNIE; 1748 goto error; 1749 } 1750 1751 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1752 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1753 status = WLAN_STATUS_INVALID_RSNIE; 1754 goto error; 1755 } 1756 1757 cipher = ie.pairwise_cipher; 1758 if (cipher & WPA_CIPHER_CCMP) { 1759 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1760 cipher = WPA_CIPHER_CCMP; 1761 } else { 1762 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1763 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1764 goto error; 1765 } 1766 1767 if ((ie.capabilities & 1768 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1769 WPA_CAPABILITY_PEERKEY_ENABLED) { 1770 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1771 "TPK M1"); 1772 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1773 goto error; 1774 } 1775 1776 /* Lifetime */ 1777 if (kde.key_lifetime == NULL) { 1778 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1779 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1780 goto error; 1781 } 1782 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1783 lifetime = WPA_GET_LE32(timeoutie->value); 1784 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1785 if (lifetime < 300) { 1786 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1787 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1788 goto error; 1789 } 1790 1791skip_rsn: 1792#ifdef CONFIG_TDLS_TESTING 1793 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1794 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1795 /* 1796 * The request frame from us is going to win, so do not 1797 * replace information based on this request frame from 1798 * the peer. 1799 */ 1800 goto skip_rsn_check; 1801 } 1802 } 1803#endif /* CONFIG_TDLS_TESTING */ 1804 1805 peer->initiator = 0; /* Need to check */ 1806 peer->dtoken = dtoken; 1807 1808 if (!wpa_tdls_get_privacy(sm)) { 1809 peer->rsnie_i_len = 0; 1810 peer->rsnie_p_len = 0; 1811 peer->cipher = WPA_CIPHER_NONE; 1812 goto skip_rsn_check; 1813 } 1814 1815 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1816 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1817 peer->rsnie_i_len = kde.rsn_ie_len; 1818 peer->cipher = cipher; 1819 1820 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1821 /* 1822 * There is no point in updating the RNonce for every obtained 1823 * TPK M1 frame (e.g., retransmission due to timeout) with the 1824 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1825 * retransmitted with a different INonce, update the RNonce 1826 * since this is for a new TDLS session. 1827 */ 1828 wpa_printf(MSG_DEBUG, 1829 "TDLS: New TPK M1 INonce - generate new RNonce"); 1830 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1831 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1832 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1833 "TDLS: Failed to get random data for responder nonce"); 1834 wpa_tdls_peer_free(sm, peer); 1835 goto error; 1836 } 1837 } 1838 1839#if 0 1840 /* get version info from RSNIE received from Peer */ 1841 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1842 rsn_ver = WPA_GET_LE16(hdr->version); 1843 1844 /* use min(peer's version, out version) */ 1845 if (rsn_ver > RSN_VERSION) 1846 rsn_ver = RSN_VERSION; 1847 1848 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1849 1850 hdr->elem_id = WLAN_EID_RSN; 1851 WPA_PUT_LE16(hdr->version, rsn_ver); 1852 pos = (u8 *) (hdr + 1); 1853 1854 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1855 pos += RSN_SELECTOR_LEN; 1856 /* Include only the selected cipher in pairwise cipher suite */ 1857 WPA_PUT_LE16(pos, 1); 1858 pos += 2; 1859 if (cipher == WPA_CIPHER_CCMP) 1860 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1861 pos += RSN_SELECTOR_LEN; 1862 1863 WPA_PUT_LE16(pos, 1); 1864 pos += 2; 1865 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1866 pos += RSN_SELECTOR_LEN; 1867 1868 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1869 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1870 WPA_PUT_LE16(pos, rsn_capab); 1871 pos += 2; 1872 1873 hdr->len = (pos - peer->rsnie_p) - 2; 1874 peer->rsnie_p_len = pos - peer->rsnie_p; 1875#endif 1876 1877 /* temp fix: validation of RSNIE later */ 1878 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1879 peer->rsnie_p_len = peer->rsnie_i_len; 1880 1881 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1882 peer->rsnie_p, peer->rsnie_p_len); 1883 1884 peer->lifetime = lifetime; 1885 1886 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1887 1888skip_rsn_check: 1889 /* add the peer to the driver as a "setup in progress" peer */ 1890 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 1891 NULL, 0, NULL, 0, NULL, 0); 1892 peer->tpk_in_progress = 1; 1893 1894 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1895 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1896 wpa_tdls_disable_peer_link(sm, peer); 1897 goto error; 1898 } 1899 1900 return 0; 1901 1902error: 1903 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1904 status); 1905 return -1; 1906} 1907 1908 1909static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1910{ 1911 peer->tpk_success = 1; 1912 peer->tpk_in_progress = 0; 1913 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1914 if (wpa_tdls_get_privacy(sm)) { 1915 u32 lifetime = peer->lifetime; 1916 /* 1917 * Start the initiator process a bit earlier to avoid race 1918 * condition with the responder sending teardown request. 1919 */ 1920 if (lifetime > 3 && peer->initiator) 1921 lifetime -= 3; 1922 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1923 sm, peer); 1924#ifdef CONFIG_TDLS_TESTING 1925 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1926 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1927 "expiration"); 1928 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1929 } 1930#endif /* CONFIG_TDLS_TESTING */ 1931 } 1932 1933 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1934 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1935 peer->capability, 1936 peer->supp_rates, peer->supp_rates_len, 1937 peer->ht_capabilities, 1938 peer->vht_capabilities, 1939 peer->qos_info, peer->ext_capab, 1940 peer->ext_capab_len, 1941 peer->supp_channels, 1942 peer->supp_channels_len, 1943 peer->supp_oper_classes, 1944 peer->supp_oper_classes_len) < 0) 1945 return -1; 1946 1947 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1948 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1949 "driver"); 1950 return -1; 1951 } 1952 peer->reconfig_key = 0; 1953 1954 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1955} 1956 1957 1958static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1959 const u8 *buf, size_t len) 1960{ 1961 struct wpa_tdls_peer *peer; 1962 struct wpa_eapol_ie_parse kde; 1963 struct wpa_ie_data ie; 1964 int cipher; 1965 struct wpa_tdls_ftie *ftie; 1966 struct wpa_tdls_timeoutie *timeoutie; 1967 struct wpa_tdls_lnkid *lnkid; 1968 u32 lifetime; 1969 u8 dtoken; 1970 int ielen; 1971 u16 status; 1972 const u8 *pos; 1973 int ret = 0; 1974 1975 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1976 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1977 for (peer = sm->tdls; peer; peer = peer->next) { 1978 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1979 break; 1980 } 1981 if (peer == NULL) { 1982 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1983 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1984 return -1; 1985 } 1986 if (!peer->initiator) { 1987 /* 1988 * This may happen if both devices try to initiate TDLS at the 1989 * same time and we accept the TPK M1 from the peer in 1990 * wpa_tdls_process_tpk_m1() and clear our previous state. 1991 */ 1992 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1993 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1994 return -1; 1995 } 1996 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1997 1998 if (len < 3 + 2 + 1) { 1999 wpa_tdls_disable_peer_link(sm, peer); 2000 return -1; 2001 } 2002 2003 pos = buf; 2004 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2005 status = WPA_GET_LE16(pos); 2006 pos += 2 /* status code */; 2007 2008 if (status != WLAN_STATUS_SUCCESS) { 2009 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 2010 status); 2011 wpa_tdls_disable_peer_link(sm, peer); 2012 return -1; 2013 } 2014 2015 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 2016 2017 /* TODO: need to verify dialog token matches here or in kernel */ 2018 dtoken = *pos++; /* dialog token */ 2019 2020 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 2021 2022 if (len < 3 + 2 + 1 + 2) { 2023 wpa_tdls_disable_peer_link(sm, peer); 2024 return -1; 2025 } 2026 2027 /* capability information */ 2028 peer->capability = WPA_GET_LE16(pos); 2029 pos += 2; 2030 2031 ielen = len - (pos - buf); /* start of IE in buf */ 2032 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 2033 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 2034 goto error; 2035 } 2036 2037#ifdef CONFIG_TDLS_TESTING 2038 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 2039 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 2040 status = WLAN_STATUS_REQUEST_DECLINED; 2041 goto error; 2042 } 2043#endif /* CONFIG_TDLS_TESTING */ 2044 2045 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2046 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 2047 "TPK M2"); 2048 goto error; 2049 } 2050 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 2051 kde.lnkid, kde.lnkid_len); 2052 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2053 2054 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2055 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 2056 status = WLAN_STATUS_NOT_IN_SAME_BSS; 2057 goto error; 2058 } 2059 2060 if (copy_supp_rates(&kde, peer) < 0) 2061 goto error; 2062 2063 if (copy_peer_ht_capab(&kde, peer) < 0) 2064 goto error; 2065 2066 if (copy_peer_vht_capab(&kde, peer) < 0) 2067 goto error; 2068 2069 if (copy_peer_ext_capab(&kde, peer) < 0) 2070 goto error; 2071 2072 if (copy_peer_supp_channels(&kde, peer) < 0) 2073 goto error; 2074 2075 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 2076 goto error; 2077 2078 peer->qos_info = kde.qosinfo; 2079 2080 /* Overwrite with the qos_info obtained in WMM IE */ 2081 if (copy_peer_wmm_capab(&kde, peer) < 0) 2082 goto error; 2083 2084 peer->aid = kde.aid; 2085 2086 if (!wpa_tdls_get_privacy(sm)) { 2087 peer->rsnie_p_len = 0; 2088 peer->cipher = WPA_CIPHER_NONE; 2089 goto skip_rsn; 2090 } 2091 2092 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 2093 kde.rsn_ie == NULL) { 2094 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 2095 status = WLAN_STATUS_INVALID_PARAMETERS; 2096 goto error; 2097 } 2098 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2099 kde.rsn_ie, kde.rsn_ie_len); 2100 2101 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 2102 wpa_printf(MSG_INFO, 2103 "TDLS: Too long Responder RSN IE in TPK M2"); 2104 status = WLAN_STATUS_INVALID_RSNIE; 2105 goto error; 2106 } 2107 2108 /* 2109 * FIX: bitwise comparison of RSN IE is not the correct way of 2110 * validation this. It can be different, but certain fields must 2111 * match. Since we list only a single pairwise cipher in TPK M1, the 2112 * memcmp is likely to work in most cases, though. 2113 */ 2114 if (kde.rsn_ie_len != peer->rsnie_i_len || 2115 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 2116 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 2117 "not match with RSN IE used in TPK M1"); 2118 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 2119 peer->rsnie_i, peer->rsnie_i_len); 2120 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2121 kde.rsn_ie, kde.rsn_ie_len); 2122 status = WLAN_STATUS_INVALID_RSNIE; 2123 goto error; 2124 } 2125 2126 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 2127 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 2128 status = WLAN_STATUS_INVALID_RSNIE; 2129 goto error; 2130 } 2131 2132 cipher = ie.pairwise_cipher; 2133 if (cipher == WPA_CIPHER_CCMP) { 2134 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 2135 cipher = WPA_CIPHER_CCMP; 2136 } else { 2137 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 2138 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 2139 goto error; 2140 } 2141 2142 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 2143 kde.ftie, sizeof(*ftie)); 2144 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2145 2146 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2147 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 2148 "not match with FTIE SNonce used in TPK M1"); 2149 /* Silently discard the frame */ 2150 return -1; 2151 } 2152 2153 /* Responder Nonce and RSN IE */ 2154 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 2155 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 2156 peer->rsnie_p_len = kde.rsn_ie_len; 2157 peer->cipher = cipher; 2158 2159 /* Lifetime */ 2160 if (kde.key_lifetime == NULL) { 2161 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 2162 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2163 goto error; 2164 } 2165 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2166 lifetime = WPA_GET_LE32(timeoutie->value); 2167 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 2168 lifetime); 2169 if (lifetime != peer->lifetime) { 2170 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2171 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2172 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2173 goto error; 2174 } 2175 2176 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2177 2178 /* Process MIC check to see if TPK M2 is right */ 2179 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2180 (u8 *) timeoutie, ftie) < 0) { 2181 /* Discard the frame */ 2182 wpa_tdls_del_key(sm, peer); 2183 wpa_tdls_disable_peer_link(sm, peer); 2184 return -1; 2185 } 2186 2187 if (wpa_tdls_set_key(sm, peer) < 0) { 2188 /* 2189 * Some drivers may not be able to config the key prior to full 2190 * STA entry having been configured. 2191 */ 2192 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2193 "STA entry is complete"); 2194 peer->reconfig_key = 1; 2195 } 2196 2197skip_rsn: 2198 peer->dtoken = dtoken; 2199 2200 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2201 "TPK Handshake Message 3"); 2202 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) { 2203 wpa_tdls_disable_peer_link(sm, peer); 2204 return -1; 2205 } 2206 2207 if (!peer->tpk_success) { 2208 /* 2209 * Enable Link only when tpk_success is 0, signifying that this 2210 * processing of TPK M2 frame is not because of a retransmission 2211 * during TDLS setup handshake. 2212 */ 2213 ret = wpa_tdls_enable_link(sm, peer); 2214 if (ret < 0) { 2215 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2216 wpa_tdls_do_teardown( 2217 sm, peer, 2218 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2219 } 2220 } 2221 return ret; 2222 2223error: 2224 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2225 status); 2226 wpa_tdls_disable_peer_link(sm, peer); 2227 return -1; 2228} 2229 2230 2231static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2232 const u8 *buf, size_t len) 2233{ 2234 struct wpa_tdls_peer *peer; 2235 struct wpa_eapol_ie_parse kde; 2236 struct wpa_tdls_ftie *ftie; 2237 struct wpa_tdls_timeoutie *timeoutie; 2238 struct wpa_tdls_lnkid *lnkid; 2239 int ielen; 2240 u16 status; 2241 const u8 *pos; 2242 u32 lifetime; 2243 int ret = 0; 2244 2245 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2246 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2247 for (peer = sm->tdls; peer; peer = peer->next) { 2248 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2249 break; 2250 } 2251 if (peer == NULL) { 2252 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2253 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2254 return -1; 2255 } 2256 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2257 2258 if (len < 3 + 3) 2259 goto error; 2260 pos = buf; 2261 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2262 2263 status = WPA_GET_LE16(pos); 2264 2265 if (status != 0) { 2266 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2267 status); 2268 goto error; 2269 } 2270 pos += 2 /* status code */ + 1 /* dialog token */; 2271 2272 ielen = len - (pos - buf); /* start of IE in buf */ 2273 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2274 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2275 goto error; 2276 } 2277 2278 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2279 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2280 goto error; 2281 } 2282 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2283 (u8 *) kde.lnkid, kde.lnkid_len); 2284 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2285 2286 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2287 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2288 goto error; 2289 } 2290 2291 if (!wpa_tdls_get_privacy(sm)) 2292 goto skip_rsn; 2293 2294 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2295 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2296 goto error; 2297 } 2298 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2299 kde.ftie, sizeof(*ftie)); 2300 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2301 2302 if (kde.rsn_ie == NULL) { 2303 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2304 goto error; 2305 } 2306 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2307 kde.rsn_ie, kde.rsn_ie_len); 2308 if (kde.rsn_ie_len != peer->rsnie_p_len || 2309 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2310 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2311 "with the one sent in TPK M2"); 2312 goto error; 2313 } 2314 2315 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2316 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2317 "not match with FTIE ANonce used in TPK M2"); 2318 goto error; 2319 } 2320 2321 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2322 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2323 "match with FTIE SNonce used in TPK M1"); 2324 goto error; 2325 } 2326 2327 if (kde.key_lifetime == NULL) { 2328 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2329 goto error; 2330 } 2331 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2332 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2333 (u8 *) timeoutie, sizeof(*timeoutie)); 2334 lifetime = WPA_GET_LE32(timeoutie->value); 2335 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2336 lifetime); 2337 if (lifetime != peer->lifetime) { 2338 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2339 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2340 goto error; 2341 } 2342 2343 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2344 (u8 *) timeoutie, ftie) < 0) { 2345 wpa_tdls_del_key(sm, peer); 2346 goto error; 2347 } 2348 2349 if (wpa_tdls_set_key(sm, peer) < 0) { 2350 /* 2351 * Some drivers may not be able to config the key prior to full 2352 * STA entry having been configured. 2353 */ 2354 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2355 "STA entry is complete"); 2356 peer->reconfig_key = 1; 2357 } 2358 2359skip_rsn: 2360 if (!peer->tpk_success) { 2361 /* 2362 * Enable Link only when tpk_success is 0, signifying that this 2363 * processing of TPK M3 frame is not because of a retransmission 2364 * during TDLS setup handshake. 2365 */ 2366 ret = wpa_tdls_enable_link(sm, peer); 2367 if (ret < 0) { 2368 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2369 wpa_tdls_do_teardown( 2370 sm, peer, 2371 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2372 } 2373 } 2374 return ret; 2375error: 2376 wpa_tdls_disable_peer_link(sm, peer); 2377 return -1; 2378} 2379 2380 2381static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2382{ 2383 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2384 2385 os_memset(lifetime, 0, ie_len); 2386 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2387 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2388 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2389 WPA_PUT_LE32(lifetime->value, tsecs); 2390 os_memcpy(pos, ie, ie_len); 2391 return pos + ie_len; 2392} 2393 2394 2395/** 2396 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2397 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2398 * @peer: MAC address of the peer STA 2399 * Returns: 0 on success, or -1 on failure 2400 * 2401 * Send TPK Handshake Message 1 info to driver to start TDLS 2402 * handshake with the peer. 2403 */ 2404int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2405{ 2406 struct wpa_tdls_peer *peer; 2407 int tdls_prohibited = sm->tdls_prohibited; 2408 2409 if (sm->tdls_disabled || !sm->tdls_supported) 2410 return -1; 2411 2412#ifdef CONFIG_TDLS_TESTING 2413 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2414 tdls_prohibited) { 2415 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2416 "on TDLS"); 2417 tdls_prohibited = 0; 2418 } 2419#endif /* CONFIG_TDLS_TESTING */ 2420 2421 if (tdls_prohibited) { 2422 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2423 "reject request to start setup"); 2424 return -1; 2425 } 2426 2427 peer = wpa_tdls_add_peer(sm, addr, NULL); 2428 if (peer == NULL) 2429 return -1; 2430 2431 if (peer->tpk_in_progress) { 2432 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer"); 2433 return 0; 2434 } 2435 2436 peer->initiator = 1; 2437 2438 /* add the peer to the driver as a "setup in progress" peer */ 2439 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2440 NULL, 0, NULL, 0, NULL, 0); 2441 2442 peer->tpk_in_progress = 1; 2443 2444 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2445 wpa_tdls_disable_peer_link(sm, peer); 2446 return -1; 2447 } 2448 2449 return 0; 2450} 2451 2452 2453void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2454{ 2455 struct wpa_tdls_peer *peer; 2456 2457 if (sm->tdls_disabled || !sm->tdls_supported) 2458 return; 2459 2460 for (peer = sm->tdls; peer; peer = peer->next) { 2461 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2462 break; 2463 } 2464 2465 if (peer == NULL || !peer->tpk_success) 2466 return; 2467 2468 if (sm->tdls_external_setup) { 2469 /* 2470 * Disable previous link to allow renegotiation to be completed 2471 * on AP path. 2472 */ 2473 wpa_tdls_do_teardown(sm, peer, 2474 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2475 } 2476} 2477 2478 2479/** 2480 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2481 * 2482 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2483 */ 2484static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2485 const u8 *buf, size_t len) 2486{ 2487 struct wpa_sm *sm = ctx; 2488 struct wpa_tdls_frame *tf; 2489 2490 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2491 buf, len); 2492 2493 if (sm->tdls_disabled || !sm->tdls_supported) { 2494 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2495 "or unsupported by driver"); 2496 return; 2497 } 2498 2499 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2500 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2501 return; 2502 } 2503 2504 if (len < sizeof(*tf)) { 2505 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2506 return; 2507 } 2508 2509 /* Check to make sure its a valid encapsulated TDLS frame */ 2510 tf = (struct wpa_tdls_frame *) buf; 2511 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2512 tf->category != WLAN_ACTION_TDLS) { 2513 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2514 "category=%u action=%u", 2515 tf->payloadtype, tf->category, tf->action); 2516 return; 2517 } 2518 2519 switch (tf->action) { 2520 case WLAN_TDLS_SETUP_REQUEST: 2521 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2522 break; 2523 case WLAN_TDLS_SETUP_RESPONSE: 2524 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2525 break; 2526 case WLAN_TDLS_SETUP_CONFIRM: 2527 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2528 break; 2529 case WLAN_TDLS_TEARDOWN: 2530 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2531 break; 2532 case WLAN_TDLS_DISCOVERY_REQUEST: 2533 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2534 break; 2535 default: 2536 /* Kernel code will process remaining frames */ 2537 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2538 tf->action); 2539 break; 2540 } 2541} 2542 2543 2544/** 2545 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2546 * @wpa_s: Pointer to wpa_supplicant data 2547 * Returns: 0 on success, -1 on failure 2548 * 2549 * This function is called to initialize driver interface parameters for TDLS. 2550 * wpa_drv_init() must have been called before this function to initialize the 2551 * driver interface. 2552 */ 2553int wpa_tdls_init(struct wpa_sm *sm) 2554{ 2555 if (sm == NULL) 2556 return -1; 2557 2558 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2559 sm->ifname, 2560 sm->own_addr, 2561 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2562 sm, 0); 2563 if (sm->l2_tdls == NULL) { 2564 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2565 "connection"); 2566 return -1; 2567 } 2568 2569 /* 2570 * Drivers that support TDLS but don't implement the get_capa callback 2571 * are assumed to perform everything internally 2572 */ 2573 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2574 &sm->tdls_external_setup) < 0) { 2575 sm->tdls_supported = 1; 2576 sm->tdls_external_setup = 0; 2577 } 2578 2579 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2580 "driver", sm->tdls_supported ? "" : " not"); 2581 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2582 sm->tdls_external_setup ? "external" : "internal"); 2583 2584 return 0; 2585} 2586 2587 2588void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2589{ 2590 struct wpa_tdls_peer *peer; 2591 2592 peer = sm->tdls; 2593 2594 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2595 2596 while (peer) { 2597 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2598 MAC2STR(peer->addr)); 2599 if (sm->tdls_external_setup) 2600 wpa_tdls_do_teardown(sm, peer, 2601 WLAN_REASON_DEAUTH_LEAVING); 2602 else 2603 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2604 2605 peer = peer->next; 2606 } 2607} 2608 2609 2610static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2611{ 2612 struct wpa_tdls_peer *peer, *tmp; 2613 2614 peer = sm->tdls; 2615 sm->tdls = NULL; 2616 2617 while (peer) { 2618 int res; 2619 tmp = peer->next; 2620 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2621 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2622 MAC2STR(peer->addr), res); 2623 wpa_tdls_peer_free(sm, peer); 2624 os_free(peer); 2625 peer = tmp; 2626 } 2627} 2628 2629 2630/** 2631 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2632 * 2633 * This function is called to recover driver interface parameters for TDLS 2634 * and frees resources allocated for it. 2635 */ 2636void wpa_tdls_deinit(struct wpa_sm *sm) 2637{ 2638 if (sm == NULL) 2639 return; 2640 2641 if (sm->l2_tdls) 2642 l2_packet_deinit(sm->l2_tdls); 2643 sm->l2_tdls = NULL; 2644 2645 wpa_tdls_remove_peers(sm); 2646} 2647 2648 2649void wpa_tdls_assoc(struct wpa_sm *sm) 2650{ 2651 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2652 wpa_tdls_remove_peers(sm); 2653} 2654 2655 2656void wpa_tdls_disassoc(struct wpa_sm *sm) 2657{ 2658 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2659 wpa_tdls_remove_peers(sm); 2660} 2661 2662 2663static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2664{ 2665 struct wpa_eapol_ie_parse elems; 2666 2667 if (ies == NULL) 2668 return 0; 2669 2670 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2671 return 0; 2672 2673 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2674 return 0; 2675 2676 /* bit 38 - TDLS Prohibited */ 2677 return !!(elems.ext_capab[2 + 4] & 0x40); 2678} 2679 2680 2681void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2682{ 2683 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2684 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2685 sm->tdls_prohibited ? "prohibited" : "allowed"); 2686} 2687 2688 2689void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2690{ 2691 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2692 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2693 "(Re)Association Response IEs"); 2694 sm->tdls_prohibited = 1; 2695 } 2696} 2697 2698 2699void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2700{ 2701 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2702 sm->tdls_disabled = !enabled; 2703} 2704 2705 2706int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2707{ 2708 return sm->tdls_external_setup; 2709} 2710