tdls.c revision 0c08fdcf5231617f2340cb18e45769a8ed3a1dc4
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36#define TDLS_TESTING_WRONG_MIC BIT(11) 37unsigned int tdls_testing = 0; 38#endif /* CONFIG_TDLS_TESTING */ 39 40#define TPK_LIFETIME 43200 /* 12 hours */ 41#define TPK_M1_RETRY_COUNT 3 42#define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 43#define TPK_M2_RETRY_COUNT 10 44#define TPK_M2_TIMEOUT 500 /* in milliseconds */ 45 46#define TDLS_MIC_LEN 16 47 48#define TDLS_TIMEOUT_LEN 4 49 50struct wpa_tdls_ftie { 51 u8 ie_type; /* FTIE */ 52 u8 ie_len; 53 u8 mic_ctrl[2]; 54 u8 mic[TDLS_MIC_LEN]; 55 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 56 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 57 /* followed by optional elements */ 58} STRUCT_PACKED; 59 60struct wpa_tdls_timeoutie { 61 u8 ie_type; /* Timeout IE */ 62 u8 ie_len; 63 u8 interval_type; 64 u8 value[TDLS_TIMEOUT_LEN]; 65} STRUCT_PACKED; 66 67struct wpa_tdls_lnkid { 68 u8 ie_type; /* Link Identifier IE */ 69 u8 ie_len; 70 u8 bssid[ETH_ALEN]; 71 u8 init_sta[ETH_ALEN]; 72 u8 resp_sta[ETH_ALEN]; 73} STRUCT_PACKED; 74 75/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 76struct wpa_tdls_frame { 77 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 78 u8 category; /* Category */ 79 u8 action; /* Action (enum tdls_frame_type) */ 80} STRUCT_PACKED; 81 82static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 83static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 84static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 85static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 86 struct wpa_tdls_peer *peer); 87static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 88 u16 reason_code); 89 90 91#define TDLS_MAX_IE_LEN 80 92#define IEEE80211_MAX_SUPP_RATES 32 93 94struct wpa_tdls_peer { 95 struct wpa_tdls_peer *next; 96 unsigned int reconfig_key:1; 97 int initiator; /* whether this end was initiator for TDLS setup */ 98 u8 addr[ETH_ALEN]; /* other end MAC address */ 99 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 100 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 101 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 102 size_t rsnie_i_len; 103 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 104 size_t rsnie_p_len; 105 u32 lifetime; 106 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 107 u8 dtoken; 108 109 struct tpk { 110 u8 kck[16]; /* TPK-KCK */ 111 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 112 } tpk; 113 int tpk_set; 114 int tpk_success; 115 int tpk_in_progress; 116 117 struct tpk_timer { 118 u8 dest[ETH_ALEN]; 119 int count; /* Retry Count */ 120 int timer; /* Timeout in milliseconds */ 121 u8 action_code; /* TDLS frame type */ 122 u8 dialog_token; 123 u16 status_code; 124 u32 peer_capab; 125 int buf_len; /* length of TPK message for retransmission */ 126 u8 *buf; /* buffer for TPK message */ 127 } sm_tmr; 128 129 u16 capability; 130 131 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 132 size_t supp_rates_len; 133 134 struct ieee80211_ht_capabilities *ht_capabilities; 135 struct ieee80211_vht_capabilities *vht_capabilities; 136 137 u8 qos_info; 138 139 u16 aid; 140 141 u8 *ext_capab; 142 size_t ext_capab_len; 143 144 u8 *supp_channels; 145 size_t supp_channels_len; 146 147 u8 *supp_oper_classes; 148 size_t supp_oper_classes_len; 149 150 u8 wmm_capable; 151}; 152 153 154static int wpa_tdls_get_privacy(struct wpa_sm *sm) 155{ 156 /* 157 * Get info needed from supplicant to check if the current BSS supports 158 * security. Other than OPEN mode, rest are considered secured 159 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 160 */ 161 return sm->pairwise_cipher != WPA_CIPHER_NONE; 162} 163 164 165static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 166{ 167 os_memcpy(pos, ie, ie_len); 168 return pos + ie_len; 169} 170 171 172static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 173{ 174 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 175 0, 0, NULL, 0, NULL, 0) < 0) { 176 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 177 "the driver"); 178 return -1; 179 } 180 181 return 0; 182} 183 184 185static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 186{ 187 u8 key_len; 188 u8 rsc[6]; 189 enum wpa_alg alg; 190 191 os_memset(rsc, 0, 6); 192 193 switch (peer->cipher) { 194 case WPA_CIPHER_CCMP: 195 alg = WPA_ALG_CCMP; 196 key_len = 16; 197 break; 198 case WPA_CIPHER_NONE: 199 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 200 "NONE - do not use pairwise keys"); 201 return -1; 202 default: 203 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 204 sm->pairwise_cipher); 205 return -1; 206 } 207 208 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 209 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 210 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 211 "driver"); 212 return -1; 213 } 214 return 0; 215} 216 217 218static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 219 u8 action_code, u8 dialog_token, 220 u16 status_code, u32 peer_capab, 221 const u8 *buf, size_t len) 222{ 223 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 224 status_code, peer_capab, buf, len); 225} 226 227 228static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 229 u8 dialog_token, u16 status_code, u32 peer_capab, 230 const u8 *msg, size_t msg_len) 231{ 232 struct wpa_tdls_peer *peer; 233 234 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 235 "dialog_token=%u status_code=%u peer_capab=%u msg_len=%u", 236 MAC2STR(dest), action_code, dialog_token, status_code, 237 peer_capab, (unsigned int) msg_len); 238 239 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 240 status_code, peer_capab, msg, msg_len)) { 241 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 242 "(action_code=%u)", action_code); 243 return -1; 244 } 245 246 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 247 action_code == WLAN_TDLS_TEARDOWN || 248 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 249 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 250 return 0; /* No retries */ 251 252 for (peer = sm->tdls; peer; peer = peer->next) { 253 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 254 break; 255 } 256 257 if (peer == NULL) { 258 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 259 "retry " MACSTR, MAC2STR(dest)); 260 return 0; 261 } 262 263 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 264 265 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 266 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 267 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 268 } else { 269 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 270 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 271 } 272 273 /* Copy message to resend on timeout */ 274 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 275 peer->sm_tmr.action_code = action_code; 276 peer->sm_tmr.dialog_token = dialog_token; 277 peer->sm_tmr.status_code = status_code; 278 peer->sm_tmr.peer_capab = peer_capab; 279 peer->sm_tmr.buf_len = msg_len; 280 os_free(peer->sm_tmr.buf); 281 peer->sm_tmr.buf = os_malloc(msg_len); 282 if (peer->sm_tmr.buf == NULL) 283 return -1; 284 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 285 286 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 287 "(action_code=%u)", action_code); 288 eloop_register_timeout(peer->sm_tmr.timer / 1000, 289 (peer->sm_tmr.timer % 1000) * 1000, 290 wpa_tdls_tpk_retry_timeout, sm, peer); 291 return 0; 292} 293 294 295static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 296 u16 reason_code) 297{ 298 int ret; 299 300 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 301 /* disable the link after teardown was sent */ 302 wpa_tdls_disable_peer_link(sm, peer); 303 304 return ret; 305} 306 307 308static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 309{ 310 311 struct wpa_sm *sm = eloop_ctx; 312 struct wpa_tdls_peer *peer = timeout_ctx; 313 314 if (peer->sm_tmr.count) { 315 peer->sm_tmr.count--; 316 317 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 318 "(action_code=%u)", 319 peer->sm_tmr.action_code); 320 321 if (peer->sm_tmr.buf == NULL) { 322 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 323 "for action_code=%u", 324 peer->sm_tmr.action_code); 325 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 326 peer); 327 return; 328 } 329 330 /* resend TPK Handshake Message to Peer */ 331 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 332 peer->sm_tmr.action_code, 333 peer->sm_tmr.dialog_token, 334 peer->sm_tmr.status_code, 335 peer->sm_tmr.peer_capab, 336 peer->sm_tmr.buf, 337 peer->sm_tmr.buf_len)) { 338 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 339 "transmission"); 340 } 341 342 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 343 eloop_register_timeout(peer->sm_tmr.timer / 1000, 344 (peer->sm_tmr.timer % 1000) * 1000, 345 wpa_tdls_tpk_retry_timeout, sm, peer); 346 } else { 347 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 348 349 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 350 wpa_tdls_do_teardown(sm, peer, 351 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 352 } 353} 354 355 356static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 357 struct wpa_tdls_peer *peer, 358 u8 action_code) 359{ 360 if (action_code == peer->sm_tmr.action_code) { 361 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 362 "action_code=%u", action_code); 363 364 /* Cancel Timeout registered */ 365 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 366 367 /* free all resources meant for retry */ 368 os_free(peer->sm_tmr.buf); 369 peer->sm_tmr.buf = NULL; 370 371 peer->sm_tmr.count = 0; 372 peer->sm_tmr.timer = 0; 373 peer->sm_tmr.buf_len = 0; 374 peer->sm_tmr.action_code = 0xff; 375 } else { 376 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 377 "(Unknown action_code=%u)", action_code); 378 } 379} 380 381 382static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 383 const u8 *own_addr, const u8 *bssid) 384{ 385 u8 key_input[SHA256_MAC_LEN]; 386 const u8 *nonce[2]; 387 size_t len[2]; 388 u8 data[3 * ETH_ALEN]; 389 390 /* IEEE Std 802.11z-2010 8.5.9.1: 391 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 392 */ 393 len[0] = WPA_NONCE_LEN; 394 len[1] = WPA_NONCE_LEN; 395 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 396 nonce[0] = peer->inonce; 397 nonce[1] = peer->rnonce; 398 } else { 399 nonce[0] = peer->rnonce; 400 nonce[1] = peer->inonce; 401 } 402 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 403 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 404 sha256_vector(2, nonce, len, key_input); 405 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 406 key_input, SHA256_MAC_LEN); 407 408 /* 409 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 410 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 411 * TODO: is N_KEY really included in KDF Context and if so, in which 412 * presentation format (little endian 16-bit?) is it used? It gets 413 * added by the KDF anyway.. 414 */ 415 416 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 417 os_memcpy(data, own_addr, ETH_ALEN); 418 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 419 } else { 420 os_memcpy(data, peer->addr, ETH_ALEN); 421 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 422 } 423 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 424 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 425 426 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 427 (u8 *) &peer->tpk, sizeof(peer->tpk)); 428 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 429 peer->tpk.kck, sizeof(peer->tpk.kck)); 430 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 431 peer->tpk.tk, sizeof(peer->tpk.tk)); 432 peer->tpk_set = 1; 433} 434 435 436/** 437 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 438 * @kck: TPK-KCK 439 * @lnkid: Pointer to the beginning of Link Identifier IE 440 * @rsnie: Pointer to the beginning of RSN IE used for handshake 441 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 442 * @ftie: Pointer to the beginning of FT IE 443 * @mic: Pointer for writing MIC 444 * 445 * Calculate MIC for TDLS frame. 446 */ 447static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 448 const u8 *rsnie, const u8 *timeoutie, 449 const u8 *ftie, u8 *mic) 450{ 451 u8 *buf, *pos; 452 struct wpa_tdls_ftie *_ftie; 453 const struct wpa_tdls_lnkid *_lnkid; 454 int ret; 455 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 456 2 + timeoutie[1] + 2 + ftie[1]; 457 buf = os_zalloc(len); 458 if (!buf) { 459 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 460 return -1; 461 } 462 463 pos = buf; 464 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 465 /* 1) TDLS initiator STA MAC address */ 466 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 467 pos += ETH_ALEN; 468 /* 2) TDLS responder STA MAC address */ 469 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 470 pos += ETH_ALEN; 471 /* 3) Transaction Sequence number */ 472 *pos++ = trans_seq; 473 /* 4) Link Identifier IE */ 474 os_memcpy(pos, lnkid, 2 + lnkid[1]); 475 pos += 2 + lnkid[1]; 476 /* 5) RSN IE */ 477 os_memcpy(pos, rsnie, 2 + rsnie[1]); 478 pos += 2 + rsnie[1]; 479 /* 6) Timeout Interval IE */ 480 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 481 pos += 2 + timeoutie[1]; 482 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 483 os_memcpy(pos, ftie, 2 + ftie[1]); 484 _ftie = (struct wpa_tdls_ftie *) pos; 485 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 486 pos += 2 + ftie[1]; 487 488 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 489 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 490 ret = omac1_aes_128(kck, buf, pos - buf, mic); 491 os_free(buf); 492 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 493 return ret; 494} 495 496 497/** 498 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 499 * @kck: TPK-KCK 500 * @trans_seq: Transaction Sequence Number (4 - Teardown) 501 * @rcode: Reason code for Teardown 502 * @dtoken: Dialog Token used for that particular link 503 * @lnkid: Pointer to the beginning of Link Identifier IE 504 * @ftie: Pointer to the beginning of FT IE 505 * @mic: Pointer for writing MIC 506 * 507 * Calculate MIC for TDLS frame. 508 */ 509static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 510 u8 dtoken, const u8 *lnkid, 511 const u8 *ftie, u8 *mic) 512{ 513 u8 *buf, *pos; 514 struct wpa_tdls_ftie *_ftie; 515 int ret; 516 int len; 517 518 if (lnkid == NULL) 519 return -1; 520 521 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 522 sizeof(trans_seq) + 2 + ftie[1]; 523 524 buf = os_zalloc(len); 525 if (!buf) { 526 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 527 return -1; 528 } 529 530 pos = buf; 531 /* 1) Link Identifier IE */ 532 os_memcpy(pos, lnkid, 2 + lnkid[1]); 533 pos += 2 + lnkid[1]; 534 /* 2) Reason Code */ 535 WPA_PUT_LE16(pos, rcode); 536 pos += sizeof(rcode); 537 /* 3) Dialog token */ 538 *pos++ = dtoken; 539 /* 4) Transaction Sequence number */ 540 *pos++ = trans_seq; 541 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 542 os_memcpy(pos, ftie, 2 + ftie[1]); 543 _ftie = (struct wpa_tdls_ftie *) pos; 544 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 545 pos += 2 + ftie[1]; 546 547 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 548 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 549 ret = omac1_aes_128(kck, buf, pos - buf, mic); 550 os_free(buf); 551 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 552 return ret; 553} 554 555 556static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 557 struct wpa_tdls_peer *peer, 558 const u8 *lnkid, const u8 *timeoutie, 559 const struct wpa_tdls_ftie *ftie) 560{ 561 u8 mic[16]; 562 563 if (peer->tpk_set) { 564 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 565 peer->rsnie_p, timeoutie, (u8 *) ftie, 566 mic); 567 if (os_memcmp(mic, ftie->mic, 16) != 0) { 568 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 569 "dropping packet"); 570 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 571 ftie->mic, 16); 572 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 573 mic, 16); 574 return -1; 575 } 576 } else { 577 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 578 "TPK not set - dropping packet"); 579 return -1; 580 } 581 return 0; 582} 583 584 585static int wpa_supplicant_verify_tdls_mic_teardown( 586 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 587 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 588{ 589 u8 mic[16]; 590 591 if (peer->tpk_set) { 592 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 593 dtoken, lnkid, (u8 *) ftie, mic); 594 if (os_memcmp(mic, ftie->mic, 16) != 0) { 595 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 596 "dropping packet"); 597 return -1; 598 } 599 } else { 600 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 601 "MIC, TPK not set - dropping packet"); 602 return -1; 603 } 604 return 0; 605} 606 607 608static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 609{ 610 struct wpa_sm *sm = eloop_ctx; 611 struct wpa_tdls_peer *peer = timeout_ctx; 612 613 /* 614 * On TPK lifetime expiration, we have an option of either tearing down 615 * the direct link or trying to re-initiate it. The selection of what 616 * to do is not strictly speaking controlled by our role in the expired 617 * link, but for now, use that to select whether to renew or tear down 618 * the link. 619 */ 620 621 if (peer->initiator) { 622 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 623 " - try to renew", MAC2STR(peer->addr)); 624 wpa_tdls_start(sm, peer->addr); 625 } else { 626 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 627 " - tear down", MAC2STR(peer->addr)); 628 wpa_tdls_do_teardown(sm, peer, 629 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 630 } 631} 632 633 634static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 635{ 636 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 637 MAC2STR(peer->addr)); 638 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 639 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 640 peer->reconfig_key = 0; 641 peer->initiator = 0; 642 peer->tpk_in_progress = 0; 643 os_free(peer->sm_tmr.buf); 644 peer->sm_tmr.buf = NULL; 645 os_free(peer->ht_capabilities); 646 peer->ht_capabilities = NULL; 647 os_free(peer->vht_capabilities); 648 peer->vht_capabilities = NULL; 649 os_free(peer->ext_capab); 650 peer->ext_capab = NULL; 651 os_free(peer->supp_channels); 652 peer->supp_channels = NULL; 653 os_free(peer->supp_oper_classes); 654 peer->supp_oper_classes = NULL; 655 peer->rsnie_i_len = peer->rsnie_p_len = 0; 656 peer->cipher = 0; 657 peer->qos_info = 0; 658 peer->wmm_capable = 0; 659 peer->tpk_set = peer->tpk_success = 0; 660 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 661 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 662 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 663} 664 665 666static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 667 struct wpa_tdls_lnkid *lnkid) 668{ 669 lnkid->ie_type = WLAN_EID_LINK_ID; 670 lnkid->ie_len = 3 * ETH_ALEN; 671 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 672 if (peer->initiator) { 673 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 674 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 675 } else { 676 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 677 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 678 } 679} 680 681 682static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 683 u16 reason_code) 684{ 685 struct wpa_tdls_peer *peer; 686 struct wpa_tdls_ftie *ftie; 687 struct wpa_tdls_lnkid lnkid; 688 u8 dialog_token; 689 u8 *rbuf, *pos; 690 int ielen; 691 692 if (sm->tdls_disabled || !sm->tdls_supported) 693 return -1; 694 695 /* Find the node and free from the list */ 696 for (peer = sm->tdls; peer; peer = peer->next) { 697 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 698 break; 699 } 700 701 if (peer == NULL) { 702 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 703 "Teardown " MACSTR, MAC2STR(addr)); 704 return 0; 705 } 706 707 dialog_token = peer->dtoken; 708 709 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 710 MAC2STR(addr)); 711 712 ielen = 0; 713 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 714 /* To add FTIE for Teardown request and compute MIC */ 715 ielen += sizeof(*ftie); 716#ifdef CONFIG_TDLS_TESTING 717 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 718 ielen += 170; 719#endif /* CONFIG_TDLS_TESTING */ 720 } 721 722 rbuf = os_zalloc(ielen + 1); 723 if (rbuf == NULL) 724 return -1; 725 pos = rbuf; 726 727 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 728 goto skip_ies; 729 730 ftie = (struct wpa_tdls_ftie *) pos; 731 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 732 /* Using the recent nonce which should be for CONFIRM frame */ 733 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 734 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 735 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 736 pos = (u8 *) (ftie + 1); 737#ifdef CONFIG_TDLS_TESTING 738 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 739 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 740 "FTIE"); 741 ftie->ie_len += 170; 742 *pos++ = 255; /* FTIE subelem */ 743 *pos++ = 168; /* FTIE subelem length */ 744 pos += 168; 745 } 746#endif /* CONFIG_TDLS_TESTING */ 747 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 748 (u8 *) ftie, pos - (u8 *) ftie); 749 750 /* compute MIC before sending */ 751 wpa_tdls_linkid(sm, peer, &lnkid); 752 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 753 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 754 ftie->mic); 755 756skip_ies: 757 /* TODO: register for a Timeout handler, if Teardown is not received at 758 * the other end, then try again another time */ 759 760 /* request driver to send Teardown using this FTIE */ 761 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 762 reason_code, 0, rbuf, pos - rbuf); 763 os_free(rbuf); 764 765 return 0; 766} 767 768 769int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 770{ 771 struct wpa_tdls_peer *peer; 772 773 if (sm->tdls_disabled || !sm->tdls_supported) 774 return -1; 775 776 for (peer = sm->tdls; peer; peer = peer->next) { 777 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 778 break; 779 } 780 781 if (peer == NULL) { 782 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 783 " for link Teardown", MAC2STR(addr)); 784 return -1; 785 } 786 787 if (!peer->tpk_success) { 788 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 789 " not connected - cannot Teardown link", MAC2STR(addr)); 790 return -1; 791 } 792 793 return wpa_tdls_do_teardown(sm, peer, reason_code); 794} 795 796 797static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 798 struct wpa_tdls_peer *peer) 799{ 800 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 801 wpa_tdls_peer_free(sm, peer); 802} 803 804 805void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr) 806{ 807 struct wpa_tdls_peer *peer; 808 809 for (peer = sm->tdls; peer; peer = peer->next) { 810 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 811 break; 812 } 813 814 if (!peer || !peer->tpk_success) { 815 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 816 " not connected - cannot teardown unreachable link", 817 MAC2STR(addr)); 818 return; 819 } 820 821 if (wpa_tdls_is_external_setup(sm)) { 822 /* 823 * Disable the link, send a teardown packet through the 824 * AP, and then reset link data. 825 */ 826 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr); 827 wpa_tdls_send_teardown(sm, addr, 828 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE); 829 wpa_tdls_peer_free(sm, peer); 830 } else { 831 wpa_tdls_disable_peer_link(sm, peer); 832 } 833} 834 835 836const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr) 837{ 838 struct wpa_tdls_peer *peer; 839 840 if (sm->tdls_disabled || !sm->tdls_supported) 841 return "disabled"; 842 843 for (peer = sm->tdls; peer; peer = peer->next) { 844 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 845 break; 846 } 847 848 if (peer == NULL) 849 return "peer does not exist"; 850 851 if (!peer->tpk_success) 852 return "peer not connected"; 853 854 return "connected"; 855} 856 857 858static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 859 const u8 *buf, size_t len) 860{ 861 struct wpa_tdls_peer *peer = NULL; 862 struct wpa_tdls_ftie *ftie; 863 struct wpa_tdls_lnkid *lnkid; 864 struct wpa_eapol_ie_parse kde; 865 u16 reason_code; 866 const u8 *pos; 867 int ielen; 868 869 /* Find the node and free from the list */ 870 for (peer = sm->tdls; peer; peer = peer->next) { 871 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 872 break; 873 } 874 875 if (peer == NULL) { 876 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 877 "Teardown " MACSTR, MAC2STR(src_addr)); 878 return 0; 879 } 880 881 pos = buf; 882 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 883 884 reason_code = WPA_GET_LE16(pos); 885 pos += 2; 886 887 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 888 " (reason code %u)", MAC2STR(src_addr), reason_code); 889 890 ielen = len - (pos - buf); /* start of IE in buf */ 891 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 892 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 893 return -1; 894 } 895 896 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 897 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 898 "Teardown"); 899 return -1; 900 } 901 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 902 903 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 904 goto skip_ftie; 905 906 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 907 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 908 return -1; 909 } 910 911 ftie = (struct wpa_tdls_ftie *) kde.ftie; 912 913 /* Process MIC check to see if TDLS Teardown is right */ 914 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 915 peer->dtoken, peer, 916 (u8 *) lnkid, ftie) < 0) { 917 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 918 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 919 return -1; 920 } 921 922skip_ftie: 923 /* 924 * Request the driver to disable the direct link and clear associated 925 * keys. 926 */ 927 wpa_tdls_disable_peer_link(sm, peer); 928 return 0; 929} 930 931 932/** 933 * wpa_tdls_send_error - To send suitable TDLS status response with 934 * appropriate status code mentioning reason for error/failure. 935 * @dst - MAC addr of Peer station 936 * @tdls_action - TDLS frame type for which error code is sent 937 * @status - status code mentioning reason 938 */ 939 940static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 941 u8 tdls_action, u8 dialog_token, u16 status) 942{ 943 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 944 " (action=%u status=%u)", 945 MAC2STR(dst), tdls_action, status); 946 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 947 0, NULL, 0); 948} 949 950 951static struct wpa_tdls_peer * 952wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 953{ 954 struct wpa_tdls_peer *peer; 955 956 if (existing) 957 *existing = 0; 958 for (peer = sm->tdls; peer; peer = peer->next) { 959 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 960 if (existing) 961 *existing = 1; 962 return peer; /* re-use existing entry */ 963 } 964 } 965 966 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 967 MAC2STR(addr)); 968 969 peer = os_zalloc(sizeof(*peer)); 970 if (peer == NULL) 971 return NULL; 972 973 os_memcpy(peer->addr, addr, ETH_ALEN); 974 peer->next = sm->tdls; 975 sm->tdls = peer; 976 977 return peer; 978} 979 980 981static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 982 struct wpa_tdls_peer *peer) 983{ 984 size_t buf_len; 985 struct wpa_tdls_timeoutie timeoutie; 986 u16 rsn_capab; 987 struct wpa_tdls_ftie *ftie; 988 u8 *rbuf, *pos, *count_pos; 989 u16 count; 990 struct rsn_ie_hdr *hdr; 991 int status; 992 993 if (!wpa_tdls_get_privacy(sm)) { 994 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 995 peer->rsnie_i_len = 0; 996 goto skip_rsnie; 997 } 998 999 /* 1000 * TPK Handshake Message 1: 1001 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 1002 * Timeout Interval IE)) 1003 */ 1004 1005 /* Filling RSN IE */ 1006 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 1007 hdr->elem_id = WLAN_EID_RSN; 1008 WPA_PUT_LE16(hdr->version, RSN_VERSION); 1009 1010 pos = (u8 *) (hdr + 1); 1011 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1012 pos += RSN_SELECTOR_LEN; 1013 count_pos = pos; 1014 pos += 2; 1015 1016 count = 0; 1017 1018 /* 1019 * AES-CCMP is the default Encryption preferred for TDLS, so 1020 * RSN IE is filled only with CCMP CIPHER 1021 * Note: TKIP is not used to encrypt TDLS link. 1022 * 1023 * Regardless of the cipher used on the AP connection, select CCMP 1024 * here. 1025 */ 1026 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1027 pos += RSN_SELECTOR_LEN; 1028 count++; 1029 1030 WPA_PUT_LE16(count_pos, count); 1031 1032 WPA_PUT_LE16(pos, 1); 1033 pos += 2; 1034 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1035 pos += RSN_SELECTOR_LEN; 1036 1037 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1038 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1039#ifdef CONFIG_TDLS_TESTING 1040 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1041 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 1042 "testing"); 1043 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1044 } 1045#endif /* CONFIG_TDLS_TESTING */ 1046 WPA_PUT_LE16(pos, rsn_capab); 1047 pos += 2; 1048#ifdef CONFIG_TDLS_TESTING 1049 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1050 /* Number of PMKIDs */ 1051 *pos++ = 0x00; 1052 *pos++ = 0x00; 1053 } 1054#endif /* CONFIG_TDLS_TESTING */ 1055 1056 hdr->len = (pos - peer->rsnie_i) - 2; 1057 peer->rsnie_i_len = pos - peer->rsnie_i; 1058 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1059 peer->rsnie_i, peer->rsnie_i_len); 1060 1061skip_rsnie: 1062 buf_len = 0; 1063 if (wpa_tdls_get_privacy(sm)) 1064 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1065 sizeof(struct wpa_tdls_timeoutie); 1066#ifdef CONFIG_TDLS_TESTING 1067 if (wpa_tdls_get_privacy(sm) && 1068 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1069 buf_len += 170; 1070 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1071 buf_len += sizeof(struct wpa_tdls_lnkid); 1072#endif /* CONFIG_TDLS_TESTING */ 1073 rbuf = os_zalloc(buf_len + 1); 1074 if (rbuf == NULL) { 1075 wpa_tdls_peer_free(sm, peer); 1076 return -1; 1077 } 1078 pos = rbuf; 1079 1080 if (!wpa_tdls_get_privacy(sm)) 1081 goto skip_ies; 1082 1083 /* Initiator RSN IE */ 1084 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1085 1086 ftie = (struct wpa_tdls_ftie *) pos; 1087 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1088 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1089 1090 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1091 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1092 "TDLS: Failed to get random data for initiator Nonce"); 1093 os_free(rbuf); 1094 wpa_tdls_peer_free(sm, peer); 1095 return -1; 1096 } 1097 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1098 peer->inonce, WPA_NONCE_LEN); 1099 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1100 1101 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1102 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1103 1104 pos = (u8 *) (ftie + 1); 1105 1106#ifdef CONFIG_TDLS_TESTING 1107 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1108 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1109 "FTIE"); 1110 ftie->ie_len += 170; 1111 *pos++ = 255; /* FTIE subelem */ 1112 *pos++ = 168; /* FTIE subelem length */ 1113 pos += 168; 1114 } 1115#endif /* CONFIG_TDLS_TESTING */ 1116 1117 /* Lifetime */ 1118 peer->lifetime = TPK_LIFETIME; 1119#ifdef CONFIG_TDLS_TESTING 1120 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1121 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1122 "lifetime"); 1123 peer->lifetime = 301; 1124 } 1125 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1126 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1127 "lifetime"); 1128 peer->lifetime = 0xffffffff; 1129 } 1130#endif /* CONFIG_TDLS_TESTING */ 1131 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1132 sizeof(timeoutie), peer->lifetime); 1133 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1134 1135skip_ies: 1136 1137#ifdef CONFIG_TDLS_TESTING 1138 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1139 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1140 "Link Identifier"); 1141 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1142 wpa_tdls_linkid(sm, peer, l); 1143 l->bssid[5] ^= 0x01; 1144 pos += sizeof(*l); 1145 } 1146#endif /* CONFIG_TDLS_TESTING */ 1147 1148 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1149 "Handshake Message 1 (peer " MACSTR ")", 1150 MAC2STR(peer->addr)); 1151 1152 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1153 1, 0, 0, rbuf, pos - rbuf); 1154 os_free(rbuf); 1155 1156 return status; 1157} 1158 1159 1160static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1161 const unsigned char *src_addr, u8 dtoken, 1162 struct wpa_tdls_lnkid *lnkid, 1163 const struct wpa_tdls_peer *peer) 1164{ 1165 u8 *rbuf, *pos; 1166 size_t buf_len; 1167 u32 lifetime; 1168 struct wpa_tdls_timeoutie timeoutie; 1169 struct wpa_tdls_ftie *ftie; 1170 int status; 1171 1172 buf_len = 0; 1173 if (wpa_tdls_get_privacy(sm)) { 1174 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1175 * Lifetime */ 1176 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1177 sizeof(struct wpa_tdls_timeoutie); 1178#ifdef CONFIG_TDLS_TESTING 1179 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1180 buf_len += 170; 1181#endif /* CONFIG_TDLS_TESTING */ 1182 } 1183 1184 rbuf = os_zalloc(buf_len + 1); 1185 if (rbuf == NULL) 1186 return -1; 1187 pos = rbuf; 1188 1189 if (!wpa_tdls_get_privacy(sm)) 1190 goto skip_ies; 1191 1192 /* Peer RSN IE */ 1193 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1194 1195 ftie = (struct wpa_tdls_ftie *) pos; 1196 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1197 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1198 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1199 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1200 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1201 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1202 (u8 *) ftie, sizeof(*ftie)); 1203 1204 pos = (u8 *) (ftie + 1); 1205 1206#ifdef CONFIG_TDLS_TESTING 1207 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1208 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1209 "FTIE"); 1210 ftie->ie_len += 170; 1211 *pos++ = 255; /* FTIE subelem */ 1212 *pos++ = 168; /* FTIE subelem length */ 1213 pos += 168; 1214 } 1215#endif /* CONFIG_TDLS_TESTING */ 1216 1217 /* Lifetime */ 1218 lifetime = peer->lifetime; 1219#ifdef CONFIG_TDLS_TESTING 1220 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1221 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1222 "lifetime in response"); 1223 lifetime++; 1224 } 1225#endif /* CONFIG_TDLS_TESTING */ 1226 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1227 sizeof(timeoutie), lifetime); 1228 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1229 lifetime); 1230 1231 /* compute MIC before sending */ 1232 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1233 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1234#ifdef CONFIG_TDLS_TESTING 1235 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1236 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1237 ftie->mic[0] ^= 0x01; 1238 } 1239#endif /* CONFIG_TDLS_TESTING */ 1240 1241skip_ies: 1242 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1243 dtoken, 0, 0, rbuf, pos - rbuf); 1244 os_free(rbuf); 1245 1246 return status; 1247} 1248 1249 1250static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1251 const unsigned char *src_addr, u8 dtoken, 1252 struct wpa_tdls_lnkid *lnkid, 1253 const struct wpa_tdls_peer *peer) 1254{ 1255 u8 *rbuf, *pos; 1256 size_t buf_len; 1257 struct wpa_tdls_ftie *ftie; 1258 struct wpa_tdls_timeoutie timeoutie; 1259 u32 lifetime; 1260 int status; 1261 u32 peer_capab = 0; 1262 1263 buf_len = 0; 1264 if (wpa_tdls_get_privacy(sm)) { 1265 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1266 * Lifetime */ 1267 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1268 sizeof(struct wpa_tdls_timeoutie); 1269#ifdef CONFIG_TDLS_TESTING 1270 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1271 buf_len += 170; 1272#endif /* CONFIG_TDLS_TESTING */ 1273 } 1274 1275 rbuf = os_zalloc(buf_len + 1); 1276 if (rbuf == NULL) 1277 return -1; 1278 pos = rbuf; 1279 1280 if (!wpa_tdls_get_privacy(sm)) 1281 goto skip_ies; 1282 1283 /* Peer RSN IE */ 1284 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1285 1286 ftie = (struct wpa_tdls_ftie *) pos; 1287 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1288 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1289 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1290 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1291 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1292 1293 pos = (u8 *) (ftie + 1); 1294 1295#ifdef CONFIG_TDLS_TESTING 1296 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1297 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1298 "FTIE"); 1299 ftie->ie_len += 170; 1300 *pos++ = 255; /* FTIE subelem */ 1301 *pos++ = 168; /* FTIE subelem length */ 1302 pos += 168; 1303 } 1304#endif /* CONFIG_TDLS_TESTING */ 1305 1306 /* Lifetime */ 1307 lifetime = peer->lifetime; 1308#ifdef CONFIG_TDLS_TESTING 1309 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1310 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1311 "lifetime in confirm"); 1312 lifetime++; 1313 } 1314#endif /* CONFIG_TDLS_TESTING */ 1315 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1316 sizeof(timeoutie), lifetime); 1317 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1318 lifetime); 1319 1320 /* compute MIC before sending */ 1321 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1322 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1323#ifdef CONFIG_TDLS_TESTING 1324 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1325 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1326 ftie->mic[0] ^= 0x01; 1327 } 1328#endif /* CONFIG_TDLS_TESTING */ 1329 1330skip_ies: 1331 1332 if (peer->vht_capabilities) 1333 peer_capab |= TDLS_PEER_VHT; 1334 if (peer->ht_capabilities) 1335 peer_capab |= TDLS_PEER_HT; 1336 if (peer->wmm_capable) 1337 peer_capab |= TDLS_PEER_WMM; 1338 1339 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1340 dtoken, 0, peer_capab, rbuf, pos - rbuf); 1341 os_free(rbuf); 1342 1343 return status; 1344} 1345 1346 1347static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1348 struct wpa_tdls_peer *peer, 1349 u8 dialog_token) 1350{ 1351 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1352 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1353 1354 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1355 dialog_token, 0, 0, NULL, 0); 1356} 1357 1358 1359static int 1360wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1361 const u8 *buf, size_t len) 1362{ 1363 struct wpa_eapol_ie_parse kde; 1364 const struct wpa_tdls_lnkid *lnkid; 1365 struct wpa_tdls_peer *peer; 1366 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1367 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1368 u8 dialog_token; 1369 1370 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1371 MAC2STR(addr)); 1372 1373 if (len < min_req_len) { 1374 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1375 "%d", (int) len); 1376 return -1; 1377 } 1378 1379 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1380 1381 /* 1382 * Some APs will tack on a weird IE to the end of a TDLS 1383 * discovery request packet. This needn't fail the response, 1384 * since the required IE are verified separately. 1385 */ 1386 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1387 len - (sizeof(struct wpa_tdls_frame) + 1), 1388 &kde) < 0) { 1389 wpa_printf(MSG_DEBUG, 1390 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround"); 1391 } 1392 1393 if (!kde.lnkid) { 1394 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1395 "Request"); 1396 return -1; 1397 } 1398 1399 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1400 1401 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1402 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1403 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1404 return -1; 1405 } 1406 1407 peer = wpa_tdls_add_peer(sm, addr, NULL); 1408 if (peer == NULL) 1409 return -1; 1410 1411 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1412} 1413 1414 1415int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1416{ 1417 if (sm->tdls_disabled || !sm->tdls_supported) 1418 return -1; 1419 1420 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1421 MACSTR, MAC2STR(addr)); 1422 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1423 1, 0, 0, NULL, 0); 1424} 1425 1426 1427static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1428 struct wpa_tdls_peer *peer) 1429{ 1430 if (!kde->supp_rates) { 1431 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1432 return -1; 1433 } 1434 peer->supp_rates_len = merge_byte_arrays( 1435 peer->supp_rates, sizeof(peer->supp_rates), 1436 kde->supp_rates + 2, kde->supp_rates_len - 2, 1437 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1438 kde->ext_supp_rates_len - 2); 1439 return 0; 1440} 1441 1442 1443static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1444 struct wpa_tdls_peer *peer) 1445{ 1446 if (!kde->ht_capabilities || 1447 kde->ht_capabilities_len < 1448 sizeof(struct ieee80211_ht_capabilities) ) { 1449 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1450 "received"); 1451 return 0; 1452 } 1453 1454 if (!peer->ht_capabilities) { 1455 peer->ht_capabilities = 1456 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1457 if (peer->ht_capabilities == NULL) 1458 return -1; 1459 } 1460 1461 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1462 sizeof(struct ieee80211_ht_capabilities)); 1463 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1464 (u8 *) peer->ht_capabilities, 1465 sizeof(struct ieee80211_ht_capabilities)); 1466 1467 return 0; 1468} 1469 1470 1471static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1472 struct wpa_tdls_peer *peer) 1473{ 1474 if (!kde->vht_capabilities || 1475 kde->vht_capabilities_len < 1476 sizeof(struct ieee80211_vht_capabilities) ) { 1477 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1478 "received"); 1479 return 0; 1480 } 1481 1482 if (!peer->vht_capabilities) { 1483 peer->vht_capabilities = 1484 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1485 if (peer->vht_capabilities == NULL) 1486 return -1; 1487 } 1488 1489 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1490 sizeof(struct ieee80211_vht_capabilities)); 1491 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1492 (u8 *) peer->vht_capabilities, 1493 sizeof(struct ieee80211_vht_capabilities)); 1494 1495 return 0; 1496} 1497 1498 1499static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1500 struct wpa_tdls_peer *peer) 1501{ 1502 if (!kde->ext_capab) { 1503 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1504 "received"); 1505 return 0; 1506 } 1507 1508 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1509 /* Need to allocate buffer to fit the new information */ 1510 os_free(peer->ext_capab); 1511 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1512 if (peer->ext_capab == NULL) 1513 return -1; 1514 } 1515 1516 peer->ext_capab_len = kde->ext_capab_len - 2; 1517 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1518 1519 return 0; 1520} 1521 1522 1523static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde, 1524 struct wpa_tdls_peer *peer) 1525{ 1526 struct wmm_information_element *wmm; 1527 1528 if (!kde->wmm) { 1529 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received"); 1530 return 0; 1531 } 1532 1533 if (kde->wmm_len < sizeof(struct wmm_information_element)) { 1534 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received"); 1535 return -1; 1536 } 1537 1538 wmm = (struct wmm_information_element *) kde->wmm; 1539 peer->qos_info = wmm->qos_info; 1540 1541 peer->wmm_capable = 1; 1542 1543 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info); 1544 return 0; 1545} 1546 1547 1548static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde, 1549 struct wpa_tdls_peer *peer) 1550{ 1551 if (!kde->supp_channels) { 1552 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received"); 1553 return 0; 1554 } 1555 1556 if (!peer->supp_channels || 1557 peer->supp_channels_len < kde->supp_channels_len) { 1558 os_free(peer->supp_channels); 1559 peer->supp_channels = os_zalloc(kde->supp_channels_len); 1560 if (peer->supp_channels == NULL) 1561 return -1; 1562 } 1563 1564 peer->supp_channels_len = kde->supp_channels_len; 1565 1566 os_memcpy(peer->supp_channels, kde->supp_channels, 1567 peer->supp_channels_len); 1568 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels", 1569 (u8 *) peer->supp_channels, peer->supp_channels_len); 1570 return 0; 1571} 1572 1573 1574static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde, 1575 struct wpa_tdls_peer *peer) 1576{ 1577 if (!kde->supp_oper_classes) { 1578 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received"); 1579 return 0; 1580 } 1581 1582 if (!peer->supp_oper_classes || 1583 peer->supp_oper_classes_len < kde->supp_oper_classes_len) { 1584 os_free(peer->supp_oper_classes); 1585 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len); 1586 if (peer->supp_oper_classes == NULL) 1587 return -1; 1588 } 1589 1590 peer->supp_oper_classes_len = kde->supp_oper_classes_len; 1591 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes, 1592 peer->supp_oper_classes_len); 1593 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes", 1594 (u8 *) peer->supp_oper_classes, 1595 peer->supp_oper_classes_len); 1596 return 0; 1597} 1598 1599 1600static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1601 const u8 *buf, size_t len) 1602{ 1603 struct wpa_tdls_peer *peer; 1604 struct wpa_eapol_ie_parse kde; 1605 struct wpa_ie_data ie; 1606 int cipher; 1607 const u8 *cpos; 1608 struct wpa_tdls_ftie *ftie = NULL; 1609 struct wpa_tdls_timeoutie *timeoutie; 1610 struct wpa_tdls_lnkid *lnkid; 1611 u32 lifetime = 0; 1612#if 0 1613 struct rsn_ie_hdr *hdr; 1614 u8 *pos; 1615 u16 rsn_capab; 1616 u16 rsn_ver; 1617#endif 1618 u8 dtoken; 1619 u16 ielen; 1620 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1621 int tdls_prohibited = sm->tdls_prohibited; 1622 int existing_peer = 0; 1623 1624 if (len < 3 + 3) 1625 return -1; 1626 1627 cpos = buf; 1628 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1629 1630 /* driver had already verified the frame format */ 1631 dtoken = *cpos++; /* dialog token */ 1632 1633 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1634 1635 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1636 if (peer == NULL) 1637 goto error; 1638 1639 /* If found, use existing entry instead of adding a new one; 1640 * how to handle the case where both ends initiate at the 1641 * same time? */ 1642 if (existing_peer) { 1643 if (peer->tpk_success) { 1644 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1645 "direct link is enabled - tear down the " 1646 "old link first"); 1647 wpa_tdls_disable_peer_link(sm, peer); 1648 } 1649 1650 /* 1651 * An entry is already present, so check if we already sent a 1652 * TDLS Setup Request. If so, compare MAC addresses and let the 1653 * STA with the lower MAC address continue as the initiator. 1654 * The other negotiation is terminated. 1655 */ 1656 if (peer->initiator) { 1657 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1658 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1659 "from peer with higher address " 1660 MACSTR, MAC2STR(src_addr)); 1661 return -1; 1662 } else { 1663 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1664 "from peer with lower address " 1665 MACSTR " (terminate previously " 1666 "initiated negotiation", 1667 MAC2STR(src_addr)); 1668 wpa_tdls_disable_peer_link(sm, peer); 1669 } 1670 } 1671 } 1672 1673 /* capability information */ 1674 peer->capability = WPA_GET_LE16(cpos); 1675 cpos += 2; 1676 1677 ielen = len - (cpos - buf); /* start of IE in buf */ 1678 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1679 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1680 goto error; 1681 } 1682 1683 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1684 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1685 "TPK M1"); 1686 goto error; 1687 } 1688 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1689 kde.lnkid, kde.lnkid_len); 1690 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1691 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1692 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1693 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1694 goto error; 1695 } 1696 1697 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1698 MAC2STR(src_addr)); 1699 1700 if (copy_supp_rates(&kde, peer) < 0) 1701 goto error; 1702 1703 if (copy_peer_ht_capab(&kde, peer) < 0) 1704 goto error; 1705 1706 if (copy_peer_vht_capab(&kde, peer) < 0) 1707 goto error; 1708 1709 if (copy_peer_ext_capab(&kde, peer) < 0) 1710 goto error; 1711 1712 if (copy_peer_supp_channels(&kde, peer) < 0) 1713 goto error; 1714 1715 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 1716 goto error; 1717 1718 peer->qos_info = kde.qosinfo; 1719 1720 /* Overwrite with the qos_info obtained in WMM IE */ 1721 if (copy_peer_wmm_capab(&kde, peer) < 0) 1722 goto error; 1723 1724 peer->aid = kde.aid; 1725 1726#ifdef CONFIG_TDLS_TESTING 1727 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1728 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1729 if (peer == NULL) 1730 goto error; 1731 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1732 "TDLS setup - send own request"); 1733 peer->initiator = 1; 1734 wpa_tdls_send_tpk_m1(sm, peer); 1735 } 1736 1737 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1738 tdls_prohibited) { 1739 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1740 "on TDLS"); 1741 tdls_prohibited = 0; 1742 } 1743#endif /* CONFIG_TDLS_TESTING */ 1744 1745 if (tdls_prohibited) { 1746 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1747 status = WLAN_STATUS_REQUEST_DECLINED; 1748 goto error; 1749 } 1750 1751 if (!wpa_tdls_get_privacy(sm)) { 1752 if (kde.rsn_ie) { 1753 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1754 "security is disabled"); 1755 status = WLAN_STATUS_SECURITY_DISABLED; 1756 goto error; 1757 } 1758 goto skip_rsn; 1759 } 1760 1761 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1762 kde.rsn_ie == NULL) { 1763 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1764 status = WLAN_STATUS_INVALID_PARAMETERS; 1765 goto error; 1766 } 1767 1768 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1769 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1770 "TPK M1"); 1771 status = WLAN_STATUS_INVALID_RSNIE; 1772 goto error; 1773 } 1774 1775 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1776 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1777 status = WLAN_STATUS_INVALID_RSNIE; 1778 goto error; 1779 } 1780 1781 cipher = ie.pairwise_cipher; 1782 if (cipher & WPA_CIPHER_CCMP) { 1783 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1784 cipher = WPA_CIPHER_CCMP; 1785 } else { 1786 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1787 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1788 goto error; 1789 } 1790 1791 if ((ie.capabilities & 1792 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1793 WPA_CAPABILITY_PEERKEY_ENABLED) { 1794 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1795 "TPK M1"); 1796 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1797 goto error; 1798 } 1799 1800 /* Lifetime */ 1801 if (kde.key_lifetime == NULL) { 1802 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1803 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1804 goto error; 1805 } 1806 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1807 lifetime = WPA_GET_LE32(timeoutie->value); 1808 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1809 if (lifetime < 300) { 1810 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1811 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1812 goto error; 1813 } 1814 1815skip_rsn: 1816#ifdef CONFIG_TDLS_TESTING 1817 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1818 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1819 /* 1820 * The request frame from us is going to win, so do not 1821 * replace information based on this request frame from 1822 * the peer. 1823 */ 1824 goto skip_rsn_check; 1825 } 1826 } 1827#endif /* CONFIG_TDLS_TESTING */ 1828 1829 peer->initiator = 0; /* Need to check */ 1830 peer->dtoken = dtoken; 1831 1832 if (!wpa_tdls_get_privacy(sm)) { 1833 peer->rsnie_i_len = 0; 1834 peer->rsnie_p_len = 0; 1835 peer->cipher = WPA_CIPHER_NONE; 1836 goto skip_rsn_check; 1837 } 1838 1839 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1840 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1841 peer->rsnie_i_len = kde.rsn_ie_len; 1842 peer->cipher = cipher; 1843 1844 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1845 /* 1846 * There is no point in updating the RNonce for every obtained 1847 * TPK M1 frame (e.g., retransmission due to timeout) with the 1848 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1849 * retransmitted with a different INonce, update the RNonce 1850 * since this is for a new TDLS session. 1851 */ 1852 wpa_printf(MSG_DEBUG, 1853 "TDLS: New TPK M1 INonce - generate new RNonce"); 1854 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1855 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1856 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1857 "TDLS: Failed to get random data for responder nonce"); 1858 goto error; 1859 } 1860 } 1861 1862#if 0 1863 /* get version info from RSNIE received from Peer */ 1864 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1865 rsn_ver = WPA_GET_LE16(hdr->version); 1866 1867 /* use min(peer's version, out version) */ 1868 if (rsn_ver > RSN_VERSION) 1869 rsn_ver = RSN_VERSION; 1870 1871 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1872 1873 hdr->elem_id = WLAN_EID_RSN; 1874 WPA_PUT_LE16(hdr->version, rsn_ver); 1875 pos = (u8 *) (hdr + 1); 1876 1877 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1878 pos += RSN_SELECTOR_LEN; 1879 /* Include only the selected cipher in pairwise cipher suite */ 1880 WPA_PUT_LE16(pos, 1); 1881 pos += 2; 1882 if (cipher == WPA_CIPHER_CCMP) 1883 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1884 pos += RSN_SELECTOR_LEN; 1885 1886 WPA_PUT_LE16(pos, 1); 1887 pos += 2; 1888 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1889 pos += RSN_SELECTOR_LEN; 1890 1891 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1892 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1893 WPA_PUT_LE16(pos, rsn_capab); 1894 pos += 2; 1895 1896 hdr->len = (pos - peer->rsnie_p) - 2; 1897 peer->rsnie_p_len = pos - peer->rsnie_p; 1898#endif 1899 1900 /* temp fix: validation of RSNIE later */ 1901 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1902 peer->rsnie_p_len = peer->rsnie_i_len; 1903 1904 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1905 peer->rsnie_p, peer->rsnie_p_len); 1906 1907 peer->lifetime = lifetime; 1908 1909 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1910 1911skip_rsn_check: 1912 /* add the peer to the driver as a "setup in progress" peer */ 1913 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, 1914 NULL, 0, NULL, 0, NULL, 0, NULL, 0)) 1915 goto error; 1916 1917 peer->tpk_in_progress = 1; 1918 1919 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1920 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1921 wpa_tdls_disable_peer_link(sm, peer); 1922 goto error; 1923 } 1924 1925 return 0; 1926 1927error: 1928 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1929 status); 1930 if (peer) 1931 wpa_tdls_peer_free(sm, peer); 1932 return -1; 1933} 1934 1935 1936static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1937{ 1938 peer->tpk_success = 1; 1939 peer->tpk_in_progress = 0; 1940 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1941 if (wpa_tdls_get_privacy(sm)) { 1942 u32 lifetime = peer->lifetime; 1943 /* 1944 * Start the initiator process a bit earlier to avoid race 1945 * condition with the responder sending teardown request. 1946 */ 1947 if (lifetime > 3 && peer->initiator) 1948 lifetime -= 3; 1949 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1950 sm, peer); 1951#ifdef CONFIG_TDLS_TESTING 1952 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1953 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1954 "expiration"); 1955 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1956 } 1957#endif /* CONFIG_TDLS_TESTING */ 1958 } 1959 1960 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1961 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1962 peer->capability, 1963 peer->supp_rates, peer->supp_rates_len, 1964 peer->ht_capabilities, 1965 peer->vht_capabilities, 1966 peer->qos_info, peer->ext_capab, 1967 peer->ext_capab_len, 1968 peer->supp_channels, 1969 peer->supp_channels_len, 1970 peer->supp_oper_classes, 1971 peer->supp_oper_classes_len) < 0) 1972 return -1; 1973 1974 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1975 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1976 "driver"); 1977 return -1; 1978 } 1979 peer->reconfig_key = 0; 1980 1981 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1982} 1983 1984 1985static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1986 const u8 *buf, size_t len) 1987{ 1988 struct wpa_tdls_peer *peer; 1989 struct wpa_eapol_ie_parse kde; 1990 struct wpa_ie_data ie; 1991 int cipher; 1992 struct wpa_tdls_ftie *ftie; 1993 struct wpa_tdls_timeoutie *timeoutie; 1994 struct wpa_tdls_lnkid *lnkid; 1995 u32 lifetime; 1996 u8 dtoken; 1997 int ielen; 1998 u16 status; 1999 const u8 *pos; 2000 int ret = 0; 2001 2002 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 2003 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2004 for (peer = sm->tdls; peer; peer = peer->next) { 2005 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2006 break; 2007 } 2008 if (peer == NULL) { 2009 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2010 "TPK M2: " MACSTR, MAC2STR(src_addr)); 2011 return -1; 2012 } 2013 if (!peer->initiator) { 2014 /* 2015 * This may happen if both devices try to initiate TDLS at the 2016 * same time and we accept the TPK M1 from the peer in 2017 * wpa_tdls_process_tpk_m1() and clear our previous state. 2018 */ 2019 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 2020 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 2021 return -1; 2022 } 2023 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 2024 2025 if (len < 3 + 2 + 1) { 2026 wpa_tdls_disable_peer_link(sm, peer); 2027 return -1; 2028 } 2029 2030 pos = buf; 2031 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2032 status = WPA_GET_LE16(pos); 2033 pos += 2 /* status code */; 2034 2035 if (status != WLAN_STATUS_SUCCESS) { 2036 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 2037 status); 2038 wpa_tdls_disable_peer_link(sm, peer); 2039 return -1; 2040 } 2041 2042 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 2043 2044 /* TODO: need to verify dialog token matches here or in kernel */ 2045 dtoken = *pos++; /* dialog token */ 2046 2047 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 2048 2049 if (len < 3 + 2 + 1 + 2) { 2050 wpa_tdls_disable_peer_link(sm, peer); 2051 return -1; 2052 } 2053 2054 /* capability information */ 2055 peer->capability = WPA_GET_LE16(pos); 2056 pos += 2; 2057 2058 ielen = len - (pos - buf); /* start of IE in buf */ 2059 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 2060 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 2061 goto error; 2062 } 2063 2064#ifdef CONFIG_TDLS_TESTING 2065 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 2066 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 2067 status = WLAN_STATUS_REQUEST_DECLINED; 2068 goto error; 2069 } 2070#endif /* CONFIG_TDLS_TESTING */ 2071 2072 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2073 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 2074 "TPK M2"); 2075 goto error; 2076 } 2077 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 2078 kde.lnkid, kde.lnkid_len); 2079 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2080 2081 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2082 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 2083 status = WLAN_STATUS_NOT_IN_SAME_BSS; 2084 goto error; 2085 } 2086 2087 if (copy_supp_rates(&kde, peer) < 0) 2088 goto error; 2089 2090 if (copy_peer_ht_capab(&kde, peer) < 0) 2091 goto error; 2092 2093 if (copy_peer_vht_capab(&kde, peer) < 0) 2094 goto error; 2095 2096 if (copy_peer_ext_capab(&kde, peer) < 0) 2097 goto error; 2098 2099 if (copy_peer_supp_channels(&kde, peer) < 0) 2100 goto error; 2101 2102 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 2103 goto error; 2104 2105 peer->qos_info = kde.qosinfo; 2106 2107 /* Overwrite with the qos_info obtained in WMM IE */ 2108 if (copy_peer_wmm_capab(&kde, peer) < 0) 2109 goto error; 2110 2111 peer->aid = kde.aid; 2112 2113 if (!wpa_tdls_get_privacy(sm)) { 2114 peer->rsnie_p_len = 0; 2115 peer->cipher = WPA_CIPHER_NONE; 2116 goto skip_rsn; 2117 } 2118 2119 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 2120 kde.rsn_ie == NULL) { 2121 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 2122 status = WLAN_STATUS_INVALID_PARAMETERS; 2123 goto error; 2124 } 2125 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2126 kde.rsn_ie, kde.rsn_ie_len); 2127 2128 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 2129 wpa_printf(MSG_INFO, 2130 "TDLS: Too long Responder RSN IE in TPK M2"); 2131 status = WLAN_STATUS_INVALID_RSNIE; 2132 goto error; 2133 } 2134 2135 /* 2136 * FIX: bitwise comparison of RSN IE is not the correct way of 2137 * validation this. It can be different, but certain fields must 2138 * match. Since we list only a single pairwise cipher in TPK M1, the 2139 * memcmp is likely to work in most cases, though. 2140 */ 2141 if (kde.rsn_ie_len != peer->rsnie_i_len || 2142 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 2143 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 2144 "not match with RSN IE used in TPK M1"); 2145 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 2146 peer->rsnie_i, peer->rsnie_i_len); 2147 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2148 kde.rsn_ie, kde.rsn_ie_len); 2149 status = WLAN_STATUS_INVALID_RSNIE; 2150 goto error; 2151 } 2152 2153 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 2154 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 2155 status = WLAN_STATUS_INVALID_RSNIE; 2156 goto error; 2157 } 2158 2159 cipher = ie.pairwise_cipher; 2160 if (cipher == WPA_CIPHER_CCMP) { 2161 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 2162 cipher = WPA_CIPHER_CCMP; 2163 } else { 2164 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 2165 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 2166 goto error; 2167 } 2168 2169 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 2170 kde.ftie, sizeof(*ftie)); 2171 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2172 2173 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2174 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 2175 "not match with FTIE SNonce used in TPK M1"); 2176 /* Silently discard the frame */ 2177 return -1; 2178 } 2179 2180 /* Responder Nonce and RSN IE */ 2181 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 2182 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 2183 peer->rsnie_p_len = kde.rsn_ie_len; 2184 peer->cipher = cipher; 2185 2186 /* Lifetime */ 2187 if (kde.key_lifetime == NULL) { 2188 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 2189 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2190 goto error; 2191 } 2192 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2193 lifetime = WPA_GET_LE32(timeoutie->value); 2194 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 2195 lifetime); 2196 if (lifetime != peer->lifetime) { 2197 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2198 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2199 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2200 goto error; 2201 } 2202 2203 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2204 2205 /* Process MIC check to see if TPK M2 is right */ 2206 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2207 (u8 *) timeoutie, ftie) < 0) { 2208 /* Discard the frame */ 2209 wpa_tdls_del_key(sm, peer); 2210 wpa_tdls_disable_peer_link(sm, peer); 2211 return -1; 2212 } 2213 2214 if (wpa_tdls_set_key(sm, peer) < 0) { 2215 /* 2216 * Some drivers may not be able to config the key prior to full 2217 * STA entry having been configured. 2218 */ 2219 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2220 "STA entry is complete"); 2221 peer->reconfig_key = 1; 2222 } 2223 2224skip_rsn: 2225 peer->dtoken = dtoken; 2226 2227 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2228 "TPK Handshake Message 3"); 2229 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) { 2230 wpa_tdls_disable_peer_link(sm, peer); 2231 return -1; 2232 } 2233 2234 if (!peer->tpk_success) { 2235 /* 2236 * Enable Link only when tpk_success is 0, signifying that this 2237 * processing of TPK M2 frame is not because of a retransmission 2238 * during TDLS setup handshake. 2239 */ 2240 ret = wpa_tdls_enable_link(sm, peer); 2241 if (ret < 0) { 2242 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2243 wpa_tdls_do_teardown( 2244 sm, peer, 2245 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2246 } 2247 } 2248 return ret; 2249 2250error: 2251 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2252 status); 2253 wpa_tdls_disable_peer_link(sm, peer); 2254 return -1; 2255} 2256 2257 2258static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2259 const u8 *buf, size_t len) 2260{ 2261 struct wpa_tdls_peer *peer; 2262 struct wpa_eapol_ie_parse kde; 2263 struct wpa_tdls_ftie *ftie; 2264 struct wpa_tdls_timeoutie *timeoutie; 2265 struct wpa_tdls_lnkid *lnkid; 2266 int ielen; 2267 u16 status; 2268 const u8 *pos; 2269 u32 lifetime; 2270 int ret = 0; 2271 2272 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2273 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2274 for (peer = sm->tdls; peer; peer = peer->next) { 2275 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2276 break; 2277 } 2278 if (peer == NULL) { 2279 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2280 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2281 return -1; 2282 } 2283 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2284 2285 if (len < 3 + 3) 2286 goto error; 2287 pos = buf; 2288 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2289 2290 status = WPA_GET_LE16(pos); 2291 2292 if (status != 0) { 2293 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2294 status); 2295 goto error; 2296 } 2297 pos += 2 /* status code */ + 1 /* dialog token */; 2298 2299 ielen = len - (pos - buf); /* start of IE in buf */ 2300 2301 /* 2302 * Don't reject the message if failing to parse IEs. The IEs we need are 2303 * explicitly checked below. Some APs piggy-back broken IEs to the end 2304 * of a TDLS Confirm packet, which will fail the link if we don't ignore 2305 * this error. 2306 */ 2307 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2308 wpa_printf(MSG_DEBUG, 2309 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround"); 2310 } 2311 2312 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2313 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2314 goto error; 2315 } 2316 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2317 (u8 *) kde.lnkid, kde.lnkid_len); 2318 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2319 2320 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2321 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2322 goto error; 2323 } 2324 2325 if (!wpa_tdls_get_privacy(sm)) 2326 goto skip_rsn; 2327 2328 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2329 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2330 goto error; 2331 } 2332 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2333 kde.ftie, sizeof(*ftie)); 2334 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2335 2336 if (kde.rsn_ie == NULL) { 2337 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2338 goto error; 2339 } 2340 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2341 kde.rsn_ie, kde.rsn_ie_len); 2342 if (kde.rsn_ie_len != peer->rsnie_p_len || 2343 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2344 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2345 "with the one sent in TPK M2"); 2346 goto error; 2347 } 2348 2349 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2350 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2351 "not match with FTIE ANonce used in TPK M2"); 2352 goto error; 2353 } 2354 2355 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2356 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2357 "match with FTIE SNonce used in TPK M1"); 2358 goto error; 2359 } 2360 2361 if (kde.key_lifetime == NULL) { 2362 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2363 goto error; 2364 } 2365 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2366 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2367 (u8 *) timeoutie, sizeof(*timeoutie)); 2368 lifetime = WPA_GET_LE32(timeoutie->value); 2369 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2370 lifetime); 2371 if (lifetime != peer->lifetime) { 2372 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2373 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2374 goto error; 2375 } 2376 2377 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2378 (u8 *) timeoutie, ftie) < 0) { 2379 wpa_tdls_del_key(sm, peer); 2380 goto error; 2381 } 2382 2383 if (wpa_tdls_set_key(sm, peer) < 0) { 2384 /* 2385 * Some drivers may not be able to config the key prior to full 2386 * STA entry having been configured. 2387 */ 2388 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2389 "STA entry is complete"); 2390 peer->reconfig_key = 1; 2391 } 2392 2393skip_rsn: 2394 if (!peer->tpk_success) { 2395 /* 2396 * Enable Link only when tpk_success is 0, signifying that this 2397 * processing of TPK M3 frame is not because of a retransmission 2398 * during TDLS setup handshake. 2399 */ 2400 ret = wpa_tdls_enable_link(sm, peer); 2401 if (ret < 0) { 2402 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2403 wpa_tdls_do_teardown( 2404 sm, peer, 2405 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2406 } 2407 } 2408 return ret; 2409error: 2410 wpa_tdls_disable_peer_link(sm, peer); 2411 return -1; 2412} 2413 2414 2415static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2416{ 2417 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2418 2419 os_memset(lifetime, 0, ie_len); 2420 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2421 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2422 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2423 WPA_PUT_LE32(lifetime->value, tsecs); 2424 os_memcpy(pos, ie, ie_len); 2425 return pos + ie_len; 2426} 2427 2428 2429/** 2430 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2431 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2432 * @peer: MAC address of the peer STA 2433 * Returns: 0 on success, or -1 on failure 2434 * 2435 * Send TPK Handshake Message 1 info to driver to start TDLS 2436 * handshake with the peer. 2437 */ 2438int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2439{ 2440 struct wpa_tdls_peer *peer; 2441 int tdls_prohibited = sm->tdls_prohibited; 2442 2443 if (sm->tdls_disabled || !sm->tdls_supported) 2444 return -1; 2445 2446#ifdef CONFIG_TDLS_TESTING 2447 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2448 tdls_prohibited) { 2449 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2450 "on TDLS"); 2451 tdls_prohibited = 0; 2452 } 2453#endif /* CONFIG_TDLS_TESTING */ 2454 2455 if (tdls_prohibited) { 2456 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2457 "reject request to start setup"); 2458 return -1; 2459 } 2460 2461 peer = wpa_tdls_add_peer(sm, addr, NULL); 2462 if (peer == NULL) 2463 return -1; 2464 2465 if (peer->tpk_in_progress) { 2466 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer"); 2467 return 0; 2468 } 2469 2470 peer->initiator = 1; 2471 2472 /* add the peer to the driver as a "setup in progress" peer */ 2473 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2474 NULL, 0, NULL, 0, NULL, 0); 2475 2476 peer->tpk_in_progress = 1; 2477 2478 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2479 wpa_tdls_disable_peer_link(sm, peer); 2480 return -1; 2481 } 2482 2483 return 0; 2484} 2485 2486 2487void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2488{ 2489 struct wpa_tdls_peer *peer; 2490 2491 if (sm->tdls_disabled || !sm->tdls_supported) 2492 return; 2493 2494 for (peer = sm->tdls; peer; peer = peer->next) { 2495 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2496 break; 2497 } 2498 2499 if (peer == NULL || !peer->tpk_success) 2500 return; 2501 2502 if (sm->tdls_external_setup) { 2503 /* 2504 * Disable previous link to allow renegotiation to be completed 2505 * on AP path. 2506 */ 2507 wpa_tdls_do_teardown(sm, peer, 2508 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2509 } 2510} 2511 2512 2513/** 2514 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2515 * 2516 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2517 */ 2518static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2519 const u8 *buf, size_t len) 2520{ 2521 struct wpa_sm *sm = ctx; 2522 struct wpa_tdls_frame *tf; 2523 2524 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2525 buf, len); 2526 2527 if (sm->tdls_disabled || !sm->tdls_supported) { 2528 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2529 "or unsupported by driver"); 2530 return; 2531 } 2532 2533 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2534 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2535 return; 2536 } 2537 2538 if (len < sizeof(*tf)) { 2539 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2540 return; 2541 } 2542 2543 /* Check to make sure its a valid encapsulated TDLS frame */ 2544 tf = (struct wpa_tdls_frame *) buf; 2545 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2546 tf->category != WLAN_ACTION_TDLS) { 2547 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2548 "category=%u action=%u", 2549 tf->payloadtype, tf->category, tf->action); 2550 return; 2551 } 2552 2553 switch (tf->action) { 2554 case WLAN_TDLS_SETUP_REQUEST: 2555 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2556 break; 2557 case WLAN_TDLS_SETUP_RESPONSE: 2558 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2559 break; 2560 case WLAN_TDLS_SETUP_CONFIRM: 2561 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2562 break; 2563 case WLAN_TDLS_TEARDOWN: 2564 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2565 break; 2566 case WLAN_TDLS_DISCOVERY_REQUEST: 2567 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2568 break; 2569 default: 2570 /* Kernel code will process remaining frames */ 2571 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2572 tf->action); 2573 break; 2574 } 2575} 2576 2577 2578/** 2579 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2580 * @wpa_s: Pointer to wpa_supplicant data 2581 * Returns: 0 on success, -1 on failure 2582 * 2583 * This function is called to initialize driver interface parameters for TDLS. 2584 * wpa_drv_init() must have been called before this function to initialize the 2585 * driver interface. 2586 */ 2587int wpa_tdls_init(struct wpa_sm *sm) 2588{ 2589 if (sm == NULL) 2590 return -1; 2591 2592 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2593 sm->ifname, 2594 sm->own_addr, 2595 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2596 sm, 0); 2597 if (sm->l2_tdls == NULL) { 2598 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2599 "connection"); 2600 return -1; 2601 } 2602 2603 /* 2604 * Drivers that support TDLS but don't implement the get_capa callback 2605 * are assumed to perform everything internally 2606 */ 2607 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2608 &sm->tdls_external_setup) < 0) { 2609 sm->tdls_supported = 1; 2610 sm->tdls_external_setup = 0; 2611 } 2612 2613 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2614 "driver", sm->tdls_supported ? "" : " not"); 2615 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2616 sm->tdls_external_setup ? "external" : "internal"); 2617 2618 return 0; 2619} 2620 2621 2622void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2623{ 2624 struct wpa_tdls_peer *peer; 2625 2626 peer = sm->tdls; 2627 2628 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2629 2630 while (peer) { 2631 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2632 MAC2STR(peer->addr)); 2633 if (sm->tdls_external_setup) 2634 wpa_tdls_do_teardown(sm, peer, 2635 WLAN_REASON_DEAUTH_LEAVING); 2636 else 2637 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2638 2639 peer = peer->next; 2640 } 2641} 2642 2643 2644static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2645{ 2646 struct wpa_tdls_peer *peer, *tmp; 2647 2648 peer = sm->tdls; 2649 sm->tdls = NULL; 2650 2651 while (peer) { 2652 int res; 2653 tmp = peer->next; 2654 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2655 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2656 MAC2STR(peer->addr), res); 2657 wpa_tdls_peer_free(sm, peer); 2658 os_free(peer); 2659 peer = tmp; 2660 } 2661} 2662 2663 2664/** 2665 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2666 * 2667 * This function is called to recover driver interface parameters for TDLS 2668 * and frees resources allocated for it. 2669 */ 2670void wpa_tdls_deinit(struct wpa_sm *sm) 2671{ 2672 if (sm == NULL) 2673 return; 2674 2675 if (sm->l2_tdls) 2676 l2_packet_deinit(sm->l2_tdls); 2677 sm->l2_tdls = NULL; 2678 2679 wpa_tdls_remove_peers(sm); 2680} 2681 2682 2683void wpa_tdls_assoc(struct wpa_sm *sm) 2684{ 2685 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2686 wpa_tdls_remove_peers(sm); 2687} 2688 2689 2690void wpa_tdls_disassoc(struct wpa_sm *sm) 2691{ 2692 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2693 wpa_tdls_remove_peers(sm); 2694} 2695 2696 2697static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2698{ 2699 struct wpa_eapol_ie_parse elems; 2700 2701 if (ies == NULL) 2702 return 0; 2703 2704 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2705 return 0; 2706 2707 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2708 return 0; 2709 2710 /* bit 38 - TDLS Prohibited */ 2711 return !!(elems.ext_capab[2 + 4] & 0x40); 2712} 2713 2714 2715void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2716{ 2717 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2718 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2719 sm->tdls_prohibited ? "prohibited" : "allowed"); 2720} 2721 2722 2723void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2724{ 2725 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2726 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2727 "(Re)Association Response IEs"); 2728 sm->tdls_prohibited = 1; 2729 } 2730} 2731 2732 2733void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2734{ 2735 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2736 sm->tdls_disabled = !enabled; 2737} 2738 2739 2740int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2741{ 2742 return sm->tdls_external_setup; 2743} 2744