tdls.c revision 21de214b4ba4271ca20843f3b8fba9f1501b2a89
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36#define TDLS_TESTING_WRONG_MIC BIT(11) 37unsigned int tdls_testing = 0; 38#endif /* CONFIG_TDLS_TESTING */ 39 40#define TPK_LIFETIME 43200 /* 12 hours */ 41#define TPK_M1_RETRY_COUNT 3 42#define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 43#define TPK_M2_RETRY_COUNT 10 44#define TPK_M2_TIMEOUT 500 /* in milliseconds */ 45 46#define TDLS_MIC_LEN 16 47 48#define TDLS_TIMEOUT_LEN 4 49 50struct wpa_tdls_ftie { 51 u8 ie_type; /* FTIE */ 52 u8 ie_len; 53 u8 mic_ctrl[2]; 54 u8 mic[TDLS_MIC_LEN]; 55 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 56 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 57 /* followed by optional elements */ 58} STRUCT_PACKED; 59 60struct wpa_tdls_timeoutie { 61 u8 ie_type; /* Timeout IE */ 62 u8 ie_len; 63 u8 interval_type; 64 u8 value[TDLS_TIMEOUT_LEN]; 65} STRUCT_PACKED; 66 67struct wpa_tdls_lnkid { 68 u8 ie_type; /* Link Identifier IE */ 69 u8 ie_len; 70 u8 bssid[ETH_ALEN]; 71 u8 init_sta[ETH_ALEN]; 72 u8 resp_sta[ETH_ALEN]; 73} STRUCT_PACKED; 74 75/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 76struct wpa_tdls_frame { 77 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 78 u8 category; /* Category */ 79 u8 action; /* Action (enum tdls_frame_type) */ 80} STRUCT_PACKED; 81 82static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 83static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 84static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 85static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 86 struct wpa_tdls_peer *peer); 87 88 89#define TDLS_MAX_IE_LEN 80 90#define IEEE80211_MAX_SUPP_RATES 32 91 92struct wpa_tdls_peer { 93 struct wpa_tdls_peer *next; 94 unsigned int reconfig_key:1; 95 int initiator; /* whether this end was initiator for TDLS setup */ 96 u8 addr[ETH_ALEN]; /* other end MAC address */ 97 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 98 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 99 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 100 size_t rsnie_i_len; 101 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 102 size_t rsnie_p_len; 103 u32 lifetime; 104 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 105 u8 dtoken; 106 107 struct tpk { 108 u8 kck[16]; /* TPK-KCK */ 109 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 110 } tpk; 111 int tpk_set; 112 int tpk_success; 113 int tpk_in_progress; 114 115 struct tpk_timer { 116 u8 dest[ETH_ALEN]; 117 int count; /* Retry Count */ 118 int timer; /* Timeout in milliseconds */ 119 u8 action_code; /* TDLS frame type */ 120 u8 dialog_token; 121 u16 status_code; 122 u32 peer_capab; 123 int buf_len; /* length of TPK message for retransmission */ 124 u8 *buf; /* buffer for TPK message */ 125 } sm_tmr; 126 127 u16 capability; 128 129 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 130 size_t supp_rates_len; 131 132 struct ieee80211_ht_capabilities *ht_capabilities; 133 struct ieee80211_vht_capabilities *vht_capabilities; 134 135 u8 qos_info; 136 137 u16 aid; 138 139 u8 *ext_capab; 140 size_t ext_capab_len; 141 142 u8 *supp_channels; 143 size_t supp_channels_len; 144 145 u8 *supp_oper_classes; 146 size_t supp_oper_classes_len; 147 148 u8 wmm_capable; 149}; 150 151 152static int wpa_tdls_get_privacy(struct wpa_sm *sm) 153{ 154 /* 155 * Get info needed from supplicant to check if the current BSS supports 156 * security. Other than OPEN mode, rest are considered secured 157 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 158 */ 159 return sm->pairwise_cipher != WPA_CIPHER_NONE; 160} 161 162 163static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 164{ 165 os_memcpy(pos, ie, ie_len); 166 return pos + ie_len; 167} 168 169 170static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 171{ 172 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 173 0, 0, NULL, 0, NULL, 0) < 0) { 174 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 175 "the driver"); 176 return -1; 177 } 178 179 return 0; 180} 181 182 183static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 184{ 185 u8 key_len; 186 u8 rsc[6]; 187 enum wpa_alg alg; 188 189 os_memset(rsc, 0, 6); 190 191 switch (peer->cipher) { 192 case WPA_CIPHER_CCMP: 193 alg = WPA_ALG_CCMP; 194 key_len = 16; 195 break; 196 case WPA_CIPHER_NONE: 197 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 198 "NONE - do not use pairwise keys"); 199 return -1; 200 default: 201 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 202 sm->pairwise_cipher); 203 return -1; 204 } 205 206 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 207 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 208 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 209 "driver"); 210 return -1; 211 } 212 return 0; 213} 214 215 216static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 217 u8 action_code, u8 dialog_token, 218 u16 status_code, u32 peer_capab, 219 const u8 *buf, size_t len) 220{ 221 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 222 status_code, peer_capab, buf, len); 223} 224 225 226static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 227 u8 dialog_token, u16 status_code, u32 peer_capab, 228 const u8 *msg, size_t msg_len) 229{ 230 struct wpa_tdls_peer *peer; 231 232 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 233 "dialog_token=%u status_code=%u msg_len=%u", 234 MAC2STR(dest), action_code, dialog_token, status_code, 235 (unsigned int) msg_len); 236 237 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 238 status_code, peer_capab, msg, msg_len)) { 239 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 240 "(action_code=%u)", action_code); 241 return -1; 242 } 243 244 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 245 action_code == WLAN_TDLS_TEARDOWN || 246 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 247 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 248 return 0; /* No retries */ 249 250 for (peer = sm->tdls; peer; peer = peer->next) { 251 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 252 break; 253 } 254 255 if (peer == NULL) { 256 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 257 "retry " MACSTR, MAC2STR(dest)); 258 return 0; 259 } 260 261 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 262 263 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 264 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 265 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 266 } else { 267 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 268 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 269 } 270 271 /* Copy message to resend on timeout */ 272 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 273 peer->sm_tmr.action_code = action_code; 274 peer->sm_tmr.dialog_token = dialog_token; 275 peer->sm_tmr.status_code = status_code; 276 peer->sm_tmr.peer_capab = peer_capab; 277 peer->sm_tmr.buf_len = msg_len; 278 os_free(peer->sm_tmr.buf); 279 peer->sm_tmr.buf = os_malloc(msg_len); 280 if (peer->sm_tmr.buf == NULL) 281 return -1; 282 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 283 284 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 285 "(action_code=%u)", action_code); 286 eloop_register_timeout(peer->sm_tmr.timer / 1000, 287 (peer->sm_tmr.timer % 1000) * 1000, 288 wpa_tdls_tpk_retry_timeout, sm, peer); 289 return 0; 290} 291 292 293static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 294 u16 reason_code) 295{ 296 int ret; 297 298 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 299 /* disable the link after teardown was sent */ 300 wpa_tdls_disable_peer_link(sm, peer); 301 302 return ret; 303} 304 305 306static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 307{ 308 309 struct wpa_sm *sm = eloop_ctx; 310 struct wpa_tdls_peer *peer = timeout_ctx; 311 312 if (peer->sm_tmr.count) { 313 peer->sm_tmr.count--; 314 315 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 316 "(action_code=%u)", 317 peer->sm_tmr.action_code); 318 319 if (peer->sm_tmr.buf == NULL) { 320 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 321 "for action_code=%u", 322 peer->sm_tmr.action_code); 323 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 324 peer); 325 return; 326 } 327 328 /* resend TPK Handshake Message to Peer */ 329 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 330 peer->sm_tmr.action_code, 331 peer->sm_tmr.dialog_token, 332 peer->sm_tmr.status_code, 333 peer->sm_tmr.peer_capab, 334 peer->sm_tmr.buf, 335 peer->sm_tmr.buf_len)) { 336 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 337 "transmission"); 338 } 339 340 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 341 eloop_register_timeout(peer->sm_tmr.timer / 1000, 342 (peer->sm_tmr.timer % 1000) * 1000, 343 wpa_tdls_tpk_retry_timeout, sm, peer); 344 } else { 345 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 346 347 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 348 wpa_tdls_do_teardown(sm, peer, 349 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 350 } 351} 352 353 354static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 355 struct wpa_tdls_peer *peer, 356 u8 action_code) 357{ 358 if (action_code == peer->sm_tmr.action_code) { 359 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 360 "action_code=%u", action_code); 361 362 /* Cancel Timeout registered */ 363 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 364 365 /* free all resources meant for retry */ 366 os_free(peer->sm_tmr.buf); 367 peer->sm_tmr.buf = NULL; 368 369 peer->sm_tmr.count = 0; 370 peer->sm_tmr.timer = 0; 371 peer->sm_tmr.buf_len = 0; 372 peer->sm_tmr.action_code = 0xff; 373 } else { 374 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 375 "(Unknown action_code=%u)", action_code); 376 } 377} 378 379 380static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 381 const u8 *own_addr, const u8 *bssid) 382{ 383 u8 key_input[SHA256_MAC_LEN]; 384 const u8 *nonce[2]; 385 size_t len[2]; 386 u8 data[3 * ETH_ALEN]; 387 388 /* IEEE Std 802.11z-2010 8.5.9.1: 389 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 390 */ 391 len[0] = WPA_NONCE_LEN; 392 len[1] = WPA_NONCE_LEN; 393 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 394 nonce[0] = peer->inonce; 395 nonce[1] = peer->rnonce; 396 } else { 397 nonce[0] = peer->rnonce; 398 nonce[1] = peer->inonce; 399 } 400 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 401 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 402 sha256_vector(2, nonce, len, key_input); 403 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 404 key_input, SHA256_MAC_LEN); 405 406 /* 407 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 408 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 409 * TODO: is N_KEY really included in KDF Context and if so, in which 410 * presentation format (little endian 16-bit?) is it used? It gets 411 * added by the KDF anyway.. 412 */ 413 414 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 415 os_memcpy(data, own_addr, ETH_ALEN); 416 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 417 } else { 418 os_memcpy(data, peer->addr, ETH_ALEN); 419 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 420 } 421 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 422 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 423 424 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 425 (u8 *) &peer->tpk, sizeof(peer->tpk)); 426 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 427 peer->tpk.kck, sizeof(peer->tpk.kck)); 428 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 429 peer->tpk.tk, sizeof(peer->tpk.tk)); 430 peer->tpk_set = 1; 431} 432 433 434/** 435 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 436 * @kck: TPK-KCK 437 * @lnkid: Pointer to the beginning of Link Identifier IE 438 * @rsnie: Pointer to the beginning of RSN IE used for handshake 439 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 440 * @ftie: Pointer to the beginning of FT IE 441 * @mic: Pointer for writing MIC 442 * 443 * Calculate MIC for TDLS frame. 444 */ 445static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 446 const u8 *rsnie, const u8 *timeoutie, 447 const u8 *ftie, u8 *mic) 448{ 449 u8 *buf, *pos; 450 struct wpa_tdls_ftie *_ftie; 451 const struct wpa_tdls_lnkid *_lnkid; 452 int ret; 453 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 454 2 + timeoutie[1] + 2 + ftie[1]; 455 buf = os_zalloc(len); 456 if (!buf) { 457 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 458 return -1; 459 } 460 461 pos = buf; 462 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 463 /* 1) TDLS initiator STA MAC address */ 464 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 465 pos += ETH_ALEN; 466 /* 2) TDLS responder STA MAC address */ 467 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 468 pos += ETH_ALEN; 469 /* 3) Transaction Sequence number */ 470 *pos++ = trans_seq; 471 /* 4) Link Identifier IE */ 472 os_memcpy(pos, lnkid, 2 + lnkid[1]); 473 pos += 2 + lnkid[1]; 474 /* 5) RSN IE */ 475 os_memcpy(pos, rsnie, 2 + rsnie[1]); 476 pos += 2 + rsnie[1]; 477 /* 6) Timeout Interval IE */ 478 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 479 pos += 2 + timeoutie[1]; 480 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 481 os_memcpy(pos, ftie, 2 + ftie[1]); 482 _ftie = (struct wpa_tdls_ftie *) pos; 483 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 484 pos += 2 + ftie[1]; 485 486 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 487 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 488 ret = omac1_aes_128(kck, buf, pos - buf, mic); 489 os_free(buf); 490 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 491 return ret; 492} 493 494 495/** 496 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 497 * @kck: TPK-KCK 498 * @trans_seq: Transaction Sequence Number (4 - Teardown) 499 * @rcode: Reason code for Teardown 500 * @dtoken: Dialog Token used for that particular link 501 * @lnkid: Pointer to the beginning of Link Identifier IE 502 * @ftie: Pointer to the beginning of FT IE 503 * @mic: Pointer for writing MIC 504 * 505 * Calculate MIC for TDLS frame. 506 */ 507static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 508 u8 dtoken, const u8 *lnkid, 509 const u8 *ftie, u8 *mic) 510{ 511 u8 *buf, *pos; 512 struct wpa_tdls_ftie *_ftie; 513 int ret; 514 int len; 515 516 if (lnkid == NULL) 517 return -1; 518 519 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 520 sizeof(trans_seq) + 2 + ftie[1]; 521 522 buf = os_zalloc(len); 523 if (!buf) { 524 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 525 return -1; 526 } 527 528 pos = buf; 529 /* 1) Link Identifier IE */ 530 os_memcpy(pos, lnkid, 2 + lnkid[1]); 531 pos += 2 + lnkid[1]; 532 /* 2) Reason Code */ 533 WPA_PUT_LE16(pos, rcode); 534 pos += sizeof(rcode); 535 /* 3) Dialog token */ 536 *pos++ = dtoken; 537 /* 4) Transaction Sequence number */ 538 *pos++ = trans_seq; 539 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 540 os_memcpy(pos, ftie, 2 + ftie[1]); 541 _ftie = (struct wpa_tdls_ftie *) pos; 542 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 543 pos += 2 + ftie[1]; 544 545 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 546 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 547 ret = omac1_aes_128(kck, buf, pos - buf, mic); 548 os_free(buf); 549 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 550 return ret; 551} 552 553 554static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 555 struct wpa_tdls_peer *peer, 556 const u8 *lnkid, const u8 *timeoutie, 557 const struct wpa_tdls_ftie *ftie) 558{ 559 u8 mic[16]; 560 561 if (peer->tpk_set) { 562 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 563 peer->rsnie_p, timeoutie, (u8 *) ftie, 564 mic); 565 if (os_memcmp(mic, ftie->mic, 16) != 0) { 566 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 567 "dropping packet"); 568 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 569 ftie->mic, 16); 570 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 571 mic, 16); 572 return -1; 573 } 574 } else { 575 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 576 "TPK not set - dropping packet"); 577 return -1; 578 } 579 return 0; 580} 581 582 583static int wpa_supplicant_verify_tdls_mic_teardown( 584 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 585 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 586{ 587 u8 mic[16]; 588 589 if (peer->tpk_set) { 590 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 591 dtoken, lnkid, (u8 *) ftie, mic); 592 if (os_memcmp(mic, ftie->mic, 16) != 0) { 593 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 594 "dropping packet"); 595 return -1; 596 } 597 } else { 598 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 599 "MIC, TPK not set - dropping packet"); 600 return -1; 601 } 602 return 0; 603} 604 605 606static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 607{ 608 struct wpa_sm *sm = eloop_ctx; 609 struct wpa_tdls_peer *peer = timeout_ctx; 610 611 /* 612 * On TPK lifetime expiration, we have an option of either tearing down 613 * the direct link or trying to re-initiate it. The selection of what 614 * to do is not strictly speaking controlled by our role in the expired 615 * link, but for now, use that to select whether to renew or tear down 616 * the link. 617 */ 618 619 if (peer->initiator) { 620 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 621 " - try to renew", MAC2STR(peer->addr)); 622 wpa_tdls_start(sm, peer->addr); 623 } else { 624 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 625 " - tear down", MAC2STR(peer->addr)); 626 wpa_tdls_do_teardown(sm, peer, 627 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 628 } 629} 630 631 632static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 633{ 634 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 635 MAC2STR(peer->addr)); 636 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 637 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 638 peer->reconfig_key = 0; 639 peer->initiator = 0; 640 peer->tpk_in_progress = 0; 641 os_free(peer->sm_tmr.buf); 642 peer->sm_tmr.buf = NULL; 643 os_free(peer->ht_capabilities); 644 peer->ht_capabilities = NULL; 645 os_free(peer->vht_capabilities); 646 peer->vht_capabilities = NULL; 647 os_free(peer->ext_capab); 648 peer->ext_capab = NULL; 649 os_free(peer->supp_channels); 650 peer->supp_channels = NULL; 651 os_free(peer->supp_oper_classes); 652 peer->supp_oper_classes = NULL; 653 peer->rsnie_i_len = peer->rsnie_p_len = 0; 654 peer->cipher = 0; 655 peer->qos_info = 0; 656 peer->wmm_capable = 0; 657 peer->tpk_set = peer->tpk_success = 0; 658 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 659 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 660 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 661} 662 663 664static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 665 struct wpa_tdls_lnkid *lnkid) 666{ 667 lnkid->ie_type = WLAN_EID_LINK_ID; 668 lnkid->ie_len = 3 * ETH_ALEN; 669 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 670 if (peer->initiator) { 671 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 672 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 673 } else { 674 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 675 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 676 } 677} 678 679 680int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 681{ 682 struct wpa_tdls_peer *peer; 683 struct wpa_tdls_ftie *ftie; 684 struct wpa_tdls_lnkid lnkid; 685 u8 dialog_token; 686 u8 *rbuf, *pos; 687 int ielen; 688 689 if (sm->tdls_disabled || !sm->tdls_supported) 690 return -1; 691 692 /* Find the node and free from the list */ 693 for (peer = sm->tdls; peer; peer = peer->next) { 694 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 695 break; 696 } 697 698 if (peer == NULL) { 699 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 700 "Teardown " MACSTR, MAC2STR(addr)); 701 return 0; 702 } 703 704 dialog_token = peer->dtoken; 705 706 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 707 MAC2STR(addr)); 708 709 ielen = 0; 710 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 711 /* To add FTIE for Teardown request and compute MIC */ 712 ielen += sizeof(*ftie); 713#ifdef CONFIG_TDLS_TESTING 714 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 715 ielen += 170; 716#endif /* CONFIG_TDLS_TESTING */ 717 } 718 719 rbuf = os_zalloc(ielen + 1); 720 if (rbuf == NULL) 721 return -1; 722 pos = rbuf; 723 724 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 725 goto skip_ies; 726 727 ftie = (struct wpa_tdls_ftie *) pos; 728 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 729 /* Using the recent nonce which should be for CONFIRM frame */ 730 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 731 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 732 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 733 pos = (u8 *) (ftie + 1); 734#ifdef CONFIG_TDLS_TESTING 735 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 736 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 737 "FTIE"); 738 ftie->ie_len += 170; 739 *pos++ = 255; /* FTIE subelem */ 740 *pos++ = 168; /* FTIE subelem length */ 741 pos += 168; 742 } 743#endif /* CONFIG_TDLS_TESTING */ 744 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 745 (u8 *) ftie, pos - (u8 *) ftie); 746 747 /* compute MIC before sending */ 748 wpa_tdls_linkid(sm, peer, &lnkid); 749 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 750 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 751 ftie->mic); 752 753skip_ies: 754 /* TODO: register for a Timeout handler, if Teardown is not received at 755 * the other end, then try again another time */ 756 757 /* request driver to send Teardown using this FTIE */ 758 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 759 reason_code, 0, rbuf, pos - rbuf); 760 os_free(rbuf); 761 762 /* clear the Peerkey statemachine */ 763 wpa_tdls_peer_free(sm, peer); 764 765 return 0; 766} 767 768 769int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 770{ 771 struct wpa_tdls_peer *peer; 772 773 if (sm->tdls_disabled || !sm->tdls_supported) 774 return -1; 775 776 for (peer = sm->tdls; peer; peer = peer->next) { 777 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 778 break; 779 } 780 781 if (peer == NULL) { 782 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 783 " for link Teardown", MAC2STR(addr)); 784 return -1; 785 } 786 787 if (!peer->tpk_success) { 788 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 789 " not connected - cannot Teardown link", MAC2STR(addr)); 790 return -1; 791 } 792 793 return wpa_tdls_do_teardown(sm, peer, reason_code); 794} 795 796 797static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 798 struct wpa_tdls_peer *peer) 799{ 800 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 801 wpa_tdls_peer_free(sm, peer); 802} 803 804 805void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 806{ 807 struct wpa_tdls_peer *peer; 808 809 for (peer = sm->tdls; peer; peer = peer->next) { 810 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 811 break; 812 } 813 814 if (peer) 815 wpa_tdls_disable_peer_link(sm, peer); 816} 817 818 819const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr) 820{ 821 struct wpa_tdls_peer *peer; 822 823 if (sm->tdls_disabled || !sm->tdls_supported) 824 return "disabled"; 825 826 for (peer = sm->tdls; peer; peer = peer->next) { 827 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 828 break; 829 } 830 831 if (peer == NULL) 832 return "peer does not exist"; 833 834 if (!peer->tpk_success) 835 return "peer not connected"; 836 837 return "connected"; 838} 839 840 841static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 842 const u8 *buf, size_t len) 843{ 844 struct wpa_tdls_peer *peer = NULL; 845 struct wpa_tdls_ftie *ftie; 846 struct wpa_tdls_lnkid *lnkid; 847 struct wpa_eapol_ie_parse kde; 848 u16 reason_code; 849 const u8 *pos; 850 int ielen; 851 852 /* Find the node and free from the list */ 853 for (peer = sm->tdls; peer; peer = peer->next) { 854 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 855 break; 856 } 857 858 if (peer == NULL) { 859 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 860 "Teardown " MACSTR, MAC2STR(src_addr)); 861 return 0; 862 } 863 864 pos = buf; 865 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 866 867 reason_code = WPA_GET_LE16(pos); 868 pos += 2; 869 870 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 871 " (reason code %u)", MAC2STR(src_addr), reason_code); 872 873 ielen = len - (pos - buf); /* start of IE in buf */ 874 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 875 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 876 return -1; 877 } 878 879 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 880 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 881 "Teardown"); 882 return -1; 883 } 884 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 885 886 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 887 goto skip_ftie; 888 889 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 890 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 891 return -1; 892 } 893 894 ftie = (struct wpa_tdls_ftie *) kde.ftie; 895 896 /* Process MIC check to see if TDLS Teardown is right */ 897 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 898 peer->dtoken, peer, 899 (u8 *) lnkid, ftie) < 0) { 900 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 901 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 902 return -1; 903 } 904 905skip_ftie: 906 /* 907 * Request the driver to disable the direct link and clear associated 908 * keys. 909 */ 910 wpa_tdls_disable_peer_link(sm, peer); 911 return 0; 912} 913 914 915/** 916 * wpa_tdls_send_error - To send suitable TDLS status response with 917 * appropriate status code mentioning reason for error/failure. 918 * @dst - MAC addr of Peer station 919 * @tdls_action - TDLS frame type for which error code is sent 920 * @status - status code mentioning reason 921 */ 922 923static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 924 u8 tdls_action, u8 dialog_token, u16 status) 925{ 926 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 927 " (action=%u status=%u)", 928 MAC2STR(dst), tdls_action, status); 929 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 930 0, NULL, 0); 931} 932 933 934static struct wpa_tdls_peer * 935wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 936{ 937 struct wpa_tdls_peer *peer; 938 939 if (existing) 940 *existing = 0; 941 for (peer = sm->tdls; peer; peer = peer->next) { 942 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 943 if (existing) 944 *existing = 1; 945 return peer; /* re-use existing entry */ 946 } 947 } 948 949 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 950 MAC2STR(addr)); 951 952 peer = os_zalloc(sizeof(*peer)); 953 if (peer == NULL) 954 return NULL; 955 956 os_memcpy(peer->addr, addr, ETH_ALEN); 957 peer->next = sm->tdls; 958 sm->tdls = peer; 959 960 return peer; 961} 962 963 964static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 965 struct wpa_tdls_peer *peer) 966{ 967 size_t buf_len; 968 struct wpa_tdls_timeoutie timeoutie; 969 u16 rsn_capab; 970 struct wpa_tdls_ftie *ftie; 971 u8 *rbuf, *pos, *count_pos; 972 u16 count; 973 struct rsn_ie_hdr *hdr; 974 int status; 975 976 if (!wpa_tdls_get_privacy(sm)) { 977 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 978 peer->rsnie_i_len = 0; 979 goto skip_rsnie; 980 } 981 982 /* 983 * TPK Handshake Message 1: 984 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 985 * Timeout Interval IE)) 986 */ 987 988 /* Filling RSN IE */ 989 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 990 hdr->elem_id = WLAN_EID_RSN; 991 WPA_PUT_LE16(hdr->version, RSN_VERSION); 992 993 pos = (u8 *) (hdr + 1); 994 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 995 pos += RSN_SELECTOR_LEN; 996 count_pos = pos; 997 pos += 2; 998 999 count = 0; 1000 1001 /* 1002 * AES-CCMP is the default Encryption preferred for TDLS, so 1003 * RSN IE is filled only with CCMP CIPHER 1004 * Note: TKIP is not used to encrypt TDLS link. 1005 * 1006 * Regardless of the cipher used on the AP connection, select CCMP 1007 * here. 1008 */ 1009 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1010 pos += RSN_SELECTOR_LEN; 1011 count++; 1012 1013 WPA_PUT_LE16(count_pos, count); 1014 1015 WPA_PUT_LE16(pos, 1); 1016 pos += 2; 1017 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1018 pos += RSN_SELECTOR_LEN; 1019 1020 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1021 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1022#ifdef CONFIG_TDLS_TESTING 1023 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1024 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 1025 "testing"); 1026 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1027 } 1028#endif /* CONFIG_TDLS_TESTING */ 1029 WPA_PUT_LE16(pos, rsn_capab); 1030 pos += 2; 1031#ifdef CONFIG_TDLS_TESTING 1032 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1033 /* Number of PMKIDs */ 1034 *pos++ = 0x00; 1035 *pos++ = 0x00; 1036 } 1037#endif /* CONFIG_TDLS_TESTING */ 1038 1039 hdr->len = (pos - peer->rsnie_i) - 2; 1040 peer->rsnie_i_len = pos - peer->rsnie_i; 1041 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1042 peer->rsnie_i, peer->rsnie_i_len); 1043 1044skip_rsnie: 1045 buf_len = 0; 1046 if (wpa_tdls_get_privacy(sm)) 1047 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1048 sizeof(struct wpa_tdls_timeoutie); 1049#ifdef CONFIG_TDLS_TESTING 1050 if (wpa_tdls_get_privacy(sm) && 1051 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1052 buf_len += 170; 1053 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1054 buf_len += sizeof(struct wpa_tdls_lnkid); 1055#endif /* CONFIG_TDLS_TESTING */ 1056 rbuf = os_zalloc(buf_len + 1); 1057 if (rbuf == NULL) { 1058 wpa_tdls_peer_free(sm, peer); 1059 return -1; 1060 } 1061 pos = rbuf; 1062 1063 if (!wpa_tdls_get_privacy(sm)) 1064 goto skip_ies; 1065 1066 /* Initiator RSN IE */ 1067 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1068 1069 ftie = (struct wpa_tdls_ftie *) pos; 1070 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1071 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1072 1073 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1074 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1075 "TDLS: Failed to get random data for initiator Nonce"); 1076 os_free(rbuf); 1077 wpa_tdls_peer_free(sm, peer); 1078 return -1; 1079 } 1080 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1081 peer->inonce, WPA_NONCE_LEN); 1082 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1083 1084 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1085 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1086 1087 pos = (u8 *) (ftie + 1); 1088 1089#ifdef CONFIG_TDLS_TESTING 1090 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1091 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1092 "FTIE"); 1093 ftie->ie_len += 170; 1094 *pos++ = 255; /* FTIE subelem */ 1095 *pos++ = 168; /* FTIE subelem length */ 1096 pos += 168; 1097 } 1098#endif /* CONFIG_TDLS_TESTING */ 1099 1100 /* Lifetime */ 1101 peer->lifetime = TPK_LIFETIME; 1102#ifdef CONFIG_TDLS_TESTING 1103 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1104 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1105 "lifetime"); 1106 peer->lifetime = 301; 1107 } 1108 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1109 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1110 "lifetime"); 1111 peer->lifetime = 0xffffffff; 1112 } 1113#endif /* CONFIG_TDLS_TESTING */ 1114 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1115 sizeof(timeoutie), peer->lifetime); 1116 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1117 1118skip_ies: 1119 1120#ifdef CONFIG_TDLS_TESTING 1121 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1122 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1123 "Link Identifier"); 1124 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1125 wpa_tdls_linkid(sm, peer, l); 1126 l->bssid[5] ^= 0x01; 1127 pos += sizeof(*l); 1128 } 1129#endif /* CONFIG_TDLS_TESTING */ 1130 1131 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1132 "Handshake Message 1 (peer " MACSTR ")", 1133 MAC2STR(peer->addr)); 1134 1135 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1136 1, 0, 0, rbuf, pos - rbuf); 1137 os_free(rbuf); 1138 1139 return status; 1140} 1141 1142 1143static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1144 const unsigned char *src_addr, u8 dtoken, 1145 struct wpa_tdls_lnkid *lnkid, 1146 const struct wpa_tdls_peer *peer) 1147{ 1148 u8 *rbuf, *pos; 1149 size_t buf_len; 1150 u32 lifetime; 1151 struct wpa_tdls_timeoutie timeoutie; 1152 struct wpa_tdls_ftie *ftie; 1153 int status; 1154 1155 buf_len = 0; 1156 if (wpa_tdls_get_privacy(sm)) { 1157 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1158 * Lifetime */ 1159 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1160 sizeof(struct wpa_tdls_timeoutie); 1161#ifdef CONFIG_TDLS_TESTING 1162 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1163 buf_len += 170; 1164#endif /* CONFIG_TDLS_TESTING */ 1165 } 1166 1167 rbuf = os_zalloc(buf_len + 1); 1168 if (rbuf == NULL) 1169 return -1; 1170 pos = rbuf; 1171 1172 if (!wpa_tdls_get_privacy(sm)) 1173 goto skip_ies; 1174 1175 /* Peer RSN IE */ 1176 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1177 1178 ftie = (struct wpa_tdls_ftie *) pos; 1179 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1180 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1181 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1182 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1183 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1184 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1185 (u8 *) ftie, sizeof(*ftie)); 1186 1187 pos = (u8 *) (ftie + 1); 1188 1189#ifdef CONFIG_TDLS_TESTING 1190 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1191 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1192 "FTIE"); 1193 ftie->ie_len += 170; 1194 *pos++ = 255; /* FTIE subelem */ 1195 *pos++ = 168; /* FTIE subelem length */ 1196 pos += 168; 1197 } 1198#endif /* CONFIG_TDLS_TESTING */ 1199 1200 /* Lifetime */ 1201 lifetime = peer->lifetime; 1202#ifdef CONFIG_TDLS_TESTING 1203 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1204 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1205 "lifetime in response"); 1206 lifetime++; 1207 } 1208#endif /* CONFIG_TDLS_TESTING */ 1209 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1210 sizeof(timeoutie), lifetime); 1211 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1212 lifetime); 1213 1214 /* compute MIC before sending */ 1215 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1216 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1217#ifdef CONFIG_TDLS_TESTING 1218 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1219 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1220 ftie->mic[0] ^= 0x01; 1221 } 1222#endif /* CONFIG_TDLS_TESTING */ 1223 1224skip_ies: 1225 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1226 dtoken, 0, 0, rbuf, pos - rbuf); 1227 os_free(rbuf); 1228 1229 return status; 1230} 1231 1232 1233static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1234 const unsigned char *src_addr, u8 dtoken, 1235 struct wpa_tdls_lnkid *lnkid, 1236 const struct wpa_tdls_peer *peer) 1237{ 1238 u8 *rbuf, *pos; 1239 size_t buf_len; 1240 struct wpa_tdls_ftie *ftie; 1241 struct wpa_tdls_timeoutie timeoutie; 1242 u32 lifetime; 1243 int status; 1244 u32 peer_capab = 0; 1245 1246 buf_len = 0; 1247 if (wpa_tdls_get_privacy(sm)) { 1248 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1249 * Lifetime */ 1250 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1251 sizeof(struct wpa_tdls_timeoutie); 1252#ifdef CONFIG_TDLS_TESTING 1253 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1254 buf_len += 170; 1255#endif /* CONFIG_TDLS_TESTING */ 1256 } 1257 1258 rbuf = os_zalloc(buf_len + 1); 1259 if (rbuf == NULL) 1260 return -1; 1261 pos = rbuf; 1262 1263 if (!wpa_tdls_get_privacy(sm)) 1264 goto skip_ies; 1265 1266 /* Peer RSN IE */ 1267 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1268 1269 ftie = (struct wpa_tdls_ftie *) pos; 1270 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1271 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1272 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1273 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1274 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1275 1276 pos = (u8 *) (ftie + 1); 1277 1278#ifdef CONFIG_TDLS_TESTING 1279 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1280 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1281 "FTIE"); 1282 ftie->ie_len += 170; 1283 *pos++ = 255; /* FTIE subelem */ 1284 *pos++ = 168; /* FTIE subelem length */ 1285 pos += 168; 1286 } 1287#endif /* CONFIG_TDLS_TESTING */ 1288 1289 /* Lifetime */ 1290 lifetime = peer->lifetime; 1291#ifdef CONFIG_TDLS_TESTING 1292 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1293 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1294 "lifetime in confirm"); 1295 lifetime++; 1296 } 1297#endif /* CONFIG_TDLS_TESTING */ 1298 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1299 sizeof(timeoutie), lifetime); 1300 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1301 lifetime); 1302 1303 /* compute MIC before sending */ 1304 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1305 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1306#ifdef CONFIG_TDLS_TESTING 1307 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1308 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1309 ftie->mic[0] ^= 0x01; 1310 } 1311#endif /* CONFIG_TDLS_TESTING */ 1312 1313 if (peer->vht_capabilities) 1314 peer_capab |= TDLS_PEER_VHT; 1315 else if (peer->ht_capabilities) 1316 peer_capab |= TDLS_PEER_HT; 1317 else if (peer->wmm_capable) 1318 peer_capab |= TDLS_PEER_WMM; 1319 1320skip_ies: 1321 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1322 dtoken, 0, peer_capab, rbuf, pos - rbuf); 1323 os_free(rbuf); 1324 1325 return status; 1326} 1327 1328 1329static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1330 struct wpa_tdls_peer *peer, 1331 u8 dialog_token) 1332{ 1333 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1334 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1335 1336 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1337 dialog_token, 0, 0, NULL, 0); 1338} 1339 1340 1341static int 1342wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1343 const u8 *buf, size_t len) 1344{ 1345 struct wpa_eapol_ie_parse kde; 1346 const struct wpa_tdls_lnkid *lnkid; 1347 struct wpa_tdls_peer *peer; 1348 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1349 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1350 u8 dialog_token; 1351 1352 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1353 MAC2STR(addr)); 1354 1355 if (len < min_req_len) { 1356 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1357 "%d", (int) len); 1358 return -1; 1359 } 1360 1361 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1362 1363 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1364 len - (sizeof(struct wpa_tdls_frame) + 1), 1365 &kde) < 0) 1366 return -1; 1367 1368 if (!kde.lnkid) { 1369 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1370 "Request"); 1371 return -1; 1372 } 1373 1374 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1375 1376 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1377 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1378 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1379 return -1; 1380 } 1381 1382 peer = wpa_tdls_add_peer(sm, addr, NULL); 1383 if (peer == NULL) 1384 return -1; 1385 1386 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1387} 1388 1389 1390int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1391{ 1392 if (sm->tdls_disabled || !sm->tdls_supported) 1393 return -1; 1394 1395 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1396 MACSTR, MAC2STR(addr)); 1397 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1398 1, 0, 0, NULL, 0); 1399} 1400 1401 1402static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1403 struct wpa_tdls_peer *peer) 1404{ 1405 if (!kde->supp_rates) { 1406 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1407 return -1; 1408 } 1409 peer->supp_rates_len = merge_byte_arrays( 1410 peer->supp_rates, sizeof(peer->supp_rates), 1411 kde->supp_rates + 2, kde->supp_rates_len - 2, 1412 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1413 kde->ext_supp_rates_len - 2); 1414 return 0; 1415} 1416 1417 1418static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1419 struct wpa_tdls_peer *peer) 1420{ 1421 if (!kde->ht_capabilities || 1422 kde->ht_capabilities_len < 1423 sizeof(struct ieee80211_ht_capabilities) ) { 1424 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1425 "received"); 1426 return 0; 1427 } 1428 1429 if (!peer->ht_capabilities) { 1430 peer->ht_capabilities = 1431 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1432 if (peer->ht_capabilities == NULL) 1433 return -1; 1434 } 1435 1436 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1437 sizeof(struct ieee80211_ht_capabilities)); 1438 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1439 (u8 *) peer->ht_capabilities, 1440 sizeof(struct ieee80211_ht_capabilities)); 1441 1442 return 0; 1443} 1444 1445 1446static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1447 struct wpa_tdls_peer *peer) 1448{ 1449 if (!kde->vht_capabilities || 1450 kde->vht_capabilities_len < 1451 sizeof(struct ieee80211_vht_capabilities) ) { 1452 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1453 "received"); 1454 return 0; 1455 } 1456 1457 if (!peer->vht_capabilities) { 1458 peer->vht_capabilities = 1459 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1460 if (peer->vht_capabilities == NULL) 1461 return -1; 1462 } 1463 1464 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1465 sizeof(struct ieee80211_vht_capabilities)); 1466 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1467 (u8 *) peer->vht_capabilities, 1468 sizeof(struct ieee80211_vht_capabilities)); 1469 1470 return 0; 1471} 1472 1473 1474static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1475 struct wpa_tdls_peer *peer) 1476{ 1477 if (!kde->ext_capab) { 1478 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1479 "received"); 1480 return 0; 1481 } 1482 1483 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1484 /* Need to allocate buffer to fit the new information */ 1485 os_free(peer->ext_capab); 1486 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1487 if (peer->ext_capab == NULL) 1488 return -1; 1489 } 1490 1491 peer->ext_capab_len = kde->ext_capab_len - 2; 1492 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1493 1494 return 0; 1495} 1496 1497 1498static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde, 1499 struct wpa_tdls_peer *peer) 1500{ 1501 struct wmm_information_element *wmm; 1502 1503 if (!kde->wmm) { 1504 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received"); 1505 return 0; 1506 } 1507 1508 if (kde->wmm_len < sizeof(struct wmm_information_element)) { 1509 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received"); 1510 return -1; 1511 } 1512 1513 wmm = (struct wmm_information_element *) kde->wmm; 1514 peer->qos_info = wmm->qos_info; 1515 1516 peer->wmm_capable = 1; 1517 1518 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info); 1519 return 0; 1520} 1521 1522 1523static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde, 1524 struct wpa_tdls_peer *peer) 1525{ 1526 if (!kde->supp_channels) { 1527 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received"); 1528 return 0; 1529 } 1530 1531 if (!peer->supp_channels || 1532 peer->supp_channels_len < kde->supp_channels_len) { 1533 os_free(peer->supp_channels); 1534 peer->supp_channels = os_zalloc(kde->supp_channels_len); 1535 if (peer->supp_channels == NULL) 1536 return -1; 1537 } 1538 1539 peer->supp_channels_len = kde->supp_channels_len; 1540 1541 os_memcpy(peer->supp_channels, kde->supp_channels, 1542 peer->supp_channels_len); 1543 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels", 1544 (u8 *) peer->supp_channels, peer->supp_channels_len); 1545 return 0; 1546} 1547 1548 1549static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde, 1550 struct wpa_tdls_peer *peer) 1551{ 1552 if (!kde->supp_oper_classes) { 1553 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received"); 1554 return 0; 1555 } 1556 1557 if (!peer->supp_oper_classes || 1558 peer->supp_oper_classes_len < kde->supp_oper_classes_len) { 1559 os_free(peer->supp_oper_classes); 1560 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len); 1561 if (peer->supp_oper_classes == NULL) 1562 return -1; 1563 } 1564 1565 peer->supp_oper_classes_len = kde->supp_oper_classes_len; 1566 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes, 1567 peer->supp_oper_classes_len); 1568 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes", 1569 (u8 *) peer->supp_oper_classes, 1570 peer->supp_oper_classes_len); 1571 return 0; 1572} 1573 1574 1575static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1576 const u8 *buf, size_t len) 1577{ 1578 struct wpa_tdls_peer *peer; 1579 struct wpa_eapol_ie_parse kde; 1580 struct wpa_ie_data ie; 1581 int cipher; 1582 const u8 *cpos; 1583 struct wpa_tdls_ftie *ftie = NULL; 1584 struct wpa_tdls_timeoutie *timeoutie; 1585 struct wpa_tdls_lnkid *lnkid; 1586 u32 lifetime = 0; 1587#if 0 1588 struct rsn_ie_hdr *hdr; 1589 u8 *pos; 1590 u16 rsn_capab; 1591 u16 rsn_ver; 1592#endif 1593 u8 dtoken; 1594 u16 ielen; 1595 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1596 int tdls_prohibited = sm->tdls_prohibited; 1597 int existing_peer = 0; 1598 1599 if (len < 3 + 3) 1600 return -1; 1601 1602 cpos = buf; 1603 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1604 1605 /* driver had already verified the frame format */ 1606 dtoken = *cpos++; /* dialog token */ 1607 1608 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1609 1610 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1611 if (peer == NULL) 1612 goto error; 1613 1614 /* If found, use existing entry instead of adding a new one; 1615 * how to handle the case where both ends initiate at the 1616 * same time? */ 1617 if (existing_peer) { 1618 if (peer->tpk_success) { 1619 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1620 "direct link is enabled - tear down the " 1621 "old link first"); 1622 wpa_tdls_disable_peer_link(sm, peer); 1623 } 1624 1625 /* 1626 * An entry is already present, so check if we already sent a 1627 * TDLS Setup Request. If so, compare MAC addresses and let the 1628 * STA with the lower MAC address continue as the initiator. 1629 * The other negotiation is terminated. 1630 */ 1631 if (peer->initiator) { 1632 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1633 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1634 "from peer with higher address " 1635 MACSTR, MAC2STR(src_addr)); 1636 return -1; 1637 } else { 1638 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1639 "from peer with lower address " 1640 MACSTR " (terminate previously " 1641 "initiated negotiation", 1642 MAC2STR(src_addr)); 1643 wpa_tdls_disable_peer_link(sm, peer); 1644 } 1645 } 1646 } 1647 1648 /* capability information */ 1649 peer->capability = WPA_GET_LE16(cpos); 1650 cpos += 2; 1651 1652 ielen = len - (cpos - buf); /* start of IE in buf */ 1653 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1654 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1655 goto error; 1656 } 1657 1658 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1659 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1660 "TPK M1"); 1661 goto error; 1662 } 1663 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1664 kde.lnkid, kde.lnkid_len); 1665 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1666 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1667 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1668 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1669 goto error; 1670 } 1671 1672 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1673 MAC2STR(src_addr)); 1674 1675 if (copy_supp_rates(&kde, peer) < 0) 1676 goto error; 1677 1678 if (copy_peer_ht_capab(&kde, peer) < 0) 1679 goto error; 1680 1681 if (copy_peer_vht_capab(&kde, peer) < 0) 1682 goto error; 1683 1684 if (copy_peer_ext_capab(&kde, peer) < 0) 1685 goto error; 1686 1687 if (copy_peer_supp_channels(&kde, peer) < 0) 1688 goto error; 1689 1690 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 1691 goto error; 1692 1693 peer->qos_info = kde.qosinfo; 1694 1695 /* Overwrite with the qos_info obtained in WMM IE */ 1696 if (copy_peer_wmm_capab(&kde, peer) < 0) 1697 goto error; 1698 1699 peer->aid = kde.aid; 1700 1701#ifdef CONFIG_TDLS_TESTING 1702 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1703 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1704 if (peer == NULL) 1705 goto error; 1706 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1707 "TDLS setup - send own request"); 1708 peer->initiator = 1; 1709 wpa_tdls_send_tpk_m1(sm, peer); 1710 } 1711 1712 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1713 tdls_prohibited) { 1714 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1715 "on TDLS"); 1716 tdls_prohibited = 0; 1717 } 1718#endif /* CONFIG_TDLS_TESTING */ 1719 1720 if (tdls_prohibited) { 1721 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1722 status = WLAN_STATUS_REQUEST_DECLINED; 1723 goto error; 1724 } 1725 1726 if (!wpa_tdls_get_privacy(sm)) { 1727 if (kde.rsn_ie) { 1728 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1729 "security is disabled"); 1730 status = WLAN_STATUS_SECURITY_DISABLED; 1731 goto error; 1732 } 1733 goto skip_rsn; 1734 } 1735 1736 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1737 kde.rsn_ie == NULL) { 1738 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1739 status = WLAN_STATUS_INVALID_PARAMETERS; 1740 goto error; 1741 } 1742 1743 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1744 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1745 "TPK M1"); 1746 status = WLAN_STATUS_INVALID_RSNIE; 1747 goto error; 1748 } 1749 1750 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1751 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1752 status = WLAN_STATUS_INVALID_RSNIE; 1753 goto error; 1754 } 1755 1756 cipher = ie.pairwise_cipher; 1757 if (cipher & WPA_CIPHER_CCMP) { 1758 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1759 cipher = WPA_CIPHER_CCMP; 1760 } else { 1761 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1762 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1763 goto error; 1764 } 1765 1766 if ((ie.capabilities & 1767 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1768 WPA_CAPABILITY_PEERKEY_ENABLED) { 1769 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1770 "TPK M1"); 1771 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1772 goto error; 1773 } 1774 1775 /* Lifetime */ 1776 if (kde.key_lifetime == NULL) { 1777 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1778 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1779 goto error; 1780 } 1781 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1782 lifetime = WPA_GET_LE32(timeoutie->value); 1783 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1784 if (lifetime < 300) { 1785 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1786 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1787 goto error; 1788 } 1789 1790skip_rsn: 1791#ifdef CONFIG_TDLS_TESTING 1792 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1793 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1794 /* 1795 * The request frame from us is going to win, so do not 1796 * replace information based on this request frame from 1797 * the peer. 1798 */ 1799 goto skip_rsn_check; 1800 } 1801 } 1802#endif /* CONFIG_TDLS_TESTING */ 1803 1804 peer->initiator = 0; /* Need to check */ 1805 peer->dtoken = dtoken; 1806 1807 if (!wpa_tdls_get_privacy(sm)) { 1808 peer->rsnie_i_len = 0; 1809 peer->rsnie_p_len = 0; 1810 peer->cipher = WPA_CIPHER_NONE; 1811 goto skip_rsn_check; 1812 } 1813 1814 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1815 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1816 peer->rsnie_i_len = kde.rsn_ie_len; 1817 peer->cipher = cipher; 1818 1819 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1820 /* 1821 * There is no point in updating the RNonce for every obtained 1822 * TPK M1 frame (e.g., retransmission due to timeout) with the 1823 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1824 * retransmitted with a different INonce, update the RNonce 1825 * since this is for a new TDLS session. 1826 */ 1827 wpa_printf(MSG_DEBUG, 1828 "TDLS: New TPK M1 INonce - generate new RNonce"); 1829 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1830 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1831 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1832 "TDLS: Failed to get random data for responder nonce"); 1833 wpa_tdls_peer_free(sm, peer); 1834 goto error; 1835 } 1836 } 1837 1838#if 0 1839 /* get version info from RSNIE received from Peer */ 1840 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1841 rsn_ver = WPA_GET_LE16(hdr->version); 1842 1843 /* use min(peer's version, out version) */ 1844 if (rsn_ver > RSN_VERSION) 1845 rsn_ver = RSN_VERSION; 1846 1847 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1848 1849 hdr->elem_id = WLAN_EID_RSN; 1850 WPA_PUT_LE16(hdr->version, rsn_ver); 1851 pos = (u8 *) (hdr + 1); 1852 1853 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1854 pos += RSN_SELECTOR_LEN; 1855 /* Include only the selected cipher in pairwise cipher suite */ 1856 WPA_PUT_LE16(pos, 1); 1857 pos += 2; 1858 if (cipher == WPA_CIPHER_CCMP) 1859 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1860 pos += RSN_SELECTOR_LEN; 1861 1862 WPA_PUT_LE16(pos, 1); 1863 pos += 2; 1864 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1865 pos += RSN_SELECTOR_LEN; 1866 1867 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1868 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1869 WPA_PUT_LE16(pos, rsn_capab); 1870 pos += 2; 1871 1872 hdr->len = (pos - peer->rsnie_p) - 2; 1873 peer->rsnie_p_len = pos - peer->rsnie_p; 1874#endif 1875 1876 /* temp fix: validation of RSNIE later */ 1877 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1878 peer->rsnie_p_len = peer->rsnie_i_len; 1879 1880 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1881 peer->rsnie_p, peer->rsnie_p_len); 1882 1883 peer->lifetime = lifetime; 1884 1885 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1886 1887skip_rsn_check: 1888 /* add the peer to the driver as a "setup in progress" peer */ 1889 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 1890 NULL, 0, NULL, 0, NULL, 0); 1891 peer->tpk_in_progress = 1; 1892 1893 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1894 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1895 wpa_tdls_disable_peer_link(sm, peer); 1896 goto error; 1897 } 1898 1899 return 0; 1900 1901error: 1902 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1903 status); 1904 return -1; 1905} 1906 1907 1908static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1909{ 1910 peer->tpk_success = 1; 1911 peer->tpk_in_progress = 0; 1912 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1913 if (wpa_tdls_get_privacy(sm)) { 1914 u32 lifetime = peer->lifetime; 1915 /* 1916 * Start the initiator process a bit earlier to avoid race 1917 * condition with the responder sending teardown request. 1918 */ 1919 if (lifetime > 3 && peer->initiator) 1920 lifetime -= 3; 1921 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1922 sm, peer); 1923#ifdef CONFIG_TDLS_TESTING 1924 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1925 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1926 "expiration"); 1927 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1928 } 1929#endif /* CONFIG_TDLS_TESTING */ 1930 } 1931 1932 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1933 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1934 peer->capability, 1935 peer->supp_rates, peer->supp_rates_len, 1936 peer->ht_capabilities, 1937 peer->vht_capabilities, 1938 peer->qos_info, peer->ext_capab, 1939 peer->ext_capab_len, 1940 peer->supp_channels, 1941 peer->supp_channels_len, 1942 peer->supp_oper_classes, 1943 peer->supp_oper_classes_len) < 0) 1944 return -1; 1945 1946 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1947 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1948 "driver"); 1949 return -1; 1950 } 1951 peer->reconfig_key = 0; 1952 1953 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1954} 1955 1956 1957static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1958 const u8 *buf, size_t len) 1959{ 1960 struct wpa_tdls_peer *peer; 1961 struct wpa_eapol_ie_parse kde; 1962 struct wpa_ie_data ie; 1963 int cipher; 1964 struct wpa_tdls_ftie *ftie; 1965 struct wpa_tdls_timeoutie *timeoutie; 1966 struct wpa_tdls_lnkid *lnkid; 1967 u32 lifetime; 1968 u8 dtoken; 1969 int ielen; 1970 u16 status; 1971 const u8 *pos; 1972 int ret = 0; 1973 1974 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1975 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1976 for (peer = sm->tdls; peer; peer = peer->next) { 1977 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1978 break; 1979 } 1980 if (peer == NULL) { 1981 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1982 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1983 return -1; 1984 } 1985 if (!peer->initiator) { 1986 /* 1987 * This may happen if both devices try to initiate TDLS at the 1988 * same time and we accept the TPK M1 from the peer in 1989 * wpa_tdls_process_tpk_m1() and clear our previous state. 1990 */ 1991 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1992 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1993 return -1; 1994 } 1995 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1996 1997 if (len < 3 + 2 + 1) { 1998 wpa_tdls_disable_peer_link(sm, peer); 1999 return -1; 2000 } 2001 2002 pos = buf; 2003 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2004 status = WPA_GET_LE16(pos); 2005 pos += 2 /* status code */; 2006 2007 if (status != WLAN_STATUS_SUCCESS) { 2008 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 2009 status); 2010 wpa_tdls_disable_peer_link(sm, peer); 2011 return -1; 2012 } 2013 2014 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 2015 2016 /* TODO: need to verify dialog token matches here or in kernel */ 2017 dtoken = *pos++; /* dialog token */ 2018 2019 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 2020 2021 if (len < 3 + 2 + 1 + 2) { 2022 wpa_tdls_disable_peer_link(sm, peer); 2023 return -1; 2024 } 2025 2026 /* capability information */ 2027 peer->capability = WPA_GET_LE16(pos); 2028 pos += 2; 2029 2030 ielen = len - (pos - buf); /* start of IE in buf */ 2031 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 2032 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 2033 goto error; 2034 } 2035 2036#ifdef CONFIG_TDLS_TESTING 2037 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 2038 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 2039 status = WLAN_STATUS_REQUEST_DECLINED; 2040 goto error; 2041 } 2042#endif /* CONFIG_TDLS_TESTING */ 2043 2044 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2045 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 2046 "TPK M2"); 2047 goto error; 2048 } 2049 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 2050 kde.lnkid, kde.lnkid_len); 2051 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2052 2053 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2054 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 2055 status = WLAN_STATUS_NOT_IN_SAME_BSS; 2056 goto error; 2057 } 2058 2059 if (copy_supp_rates(&kde, peer) < 0) 2060 goto error; 2061 2062 if (copy_peer_ht_capab(&kde, peer) < 0) 2063 goto error; 2064 2065 if (copy_peer_vht_capab(&kde, peer) < 0) 2066 goto error; 2067 2068 if (copy_peer_ext_capab(&kde, peer) < 0) 2069 goto error; 2070 2071 if (copy_peer_supp_channels(&kde, peer) < 0) 2072 goto error; 2073 2074 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 2075 goto error; 2076 2077 peer->qos_info = kde.qosinfo; 2078 2079 /* Overwrite with the qos_info obtained in WMM IE */ 2080 if (copy_peer_wmm_capab(&kde, peer) < 0) 2081 goto error; 2082 2083 peer->aid = kde.aid; 2084 2085 if (!wpa_tdls_get_privacy(sm)) { 2086 peer->rsnie_p_len = 0; 2087 peer->cipher = WPA_CIPHER_NONE; 2088 goto skip_rsn; 2089 } 2090 2091 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 2092 kde.rsn_ie == NULL) { 2093 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 2094 status = WLAN_STATUS_INVALID_PARAMETERS; 2095 goto error; 2096 } 2097 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2098 kde.rsn_ie, kde.rsn_ie_len); 2099 2100 /* 2101 * FIX: bitwise comparison of RSN IE is not the correct way of 2102 * validation this. It can be different, but certain fields must 2103 * match. Since we list only a single pairwise cipher in TPK M1, the 2104 * memcmp is likely to work in most cases, though. 2105 */ 2106 if (kde.rsn_ie_len != peer->rsnie_i_len || 2107 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 2108 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 2109 "not match with RSN IE used in TPK M1"); 2110 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 2111 peer->rsnie_i, peer->rsnie_i_len); 2112 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2113 kde.rsn_ie, kde.rsn_ie_len); 2114 status = WLAN_STATUS_INVALID_RSNIE; 2115 goto error; 2116 } 2117 2118 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 2119 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 2120 status = WLAN_STATUS_INVALID_RSNIE; 2121 goto error; 2122 } 2123 2124 cipher = ie.pairwise_cipher; 2125 if (cipher == WPA_CIPHER_CCMP) { 2126 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 2127 cipher = WPA_CIPHER_CCMP; 2128 } else { 2129 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 2130 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 2131 goto error; 2132 } 2133 2134 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 2135 kde.ftie, sizeof(*ftie)); 2136 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2137 2138 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2139 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 2140 "not match with FTIE SNonce used in TPK M1"); 2141 /* Silently discard the frame */ 2142 return -1; 2143 } 2144 2145 /* Responder Nonce and RSN IE */ 2146 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 2147 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 2148 peer->rsnie_p_len = kde.rsn_ie_len; 2149 peer->cipher = cipher; 2150 2151 /* Lifetime */ 2152 if (kde.key_lifetime == NULL) { 2153 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 2154 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2155 goto error; 2156 } 2157 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2158 lifetime = WPA_GET_LE32(timeoutie->value); 2159 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 2160 lifetime); 2161 if (lifetime != peer->lifetime) { 2162 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2163 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2164 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2165 goto error; 2166 } 2167 2168 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2169 2170 /* Process MIC check to see if TPK M2 is right */ 2171 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2172 (u8 *) timeoutie, ftie) < 0) { 2173 /* Discard the frame */ 2174 wpa_tdls_del_key(sm, peer); 2175 wpa_tdls_disable_peer_link(sm, peer); 2176 return -1; 2177 } 2178 2179 if (wpa_tdls_set_key(sm, peer) < 0) { 2180 /* 2181 * Some drivers may not be able to config the key prior to full 2182 * STA entry having been configured. 2183 */ 2184 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2185 "STA entry is complete"); 2186 peer->reconfig_key = 1; 2187 } 2188 2189skip_rsn: 2190 peer->dtoken = dtoken; 2191 2192 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2193 "TPK Handshake Message 3"); 2194 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) { 2195 wpa_tdls_disable_peer_link(sm, peer); 2196 return -1; 2197 } 2198 2199 if (!peer->tpk_success) { 2200 /* 2201 * Enable Link only when tpk_success is 0, signifying that this 2202 * processing of TPK M2 frame is not because of a retransmission 2203 * during TDLS setup handshake. 2204 */ 2205 ret = wpa_tdls_enable_link(sm, peer); 2206 if (ret < 0) { 2207 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2208 wpa_tdls_do_teardown( 2209 sm, peer, 2210 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2211 } 2212 } 2213 return ret; 2214 2215error: 2216 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2217 status); 2218 wpa_tdls_disable_peer_link(sm, peer); 2219 return -1; 2220} 2221 2222 2223static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2224 const u8 *buf, size_t len) 2225{ 2226 struct wpa_tdls_peer *peer; 2227 struct wpa_eapol_ie_parse kde; 2228 struct wpa_tdls_ftie *ftie; 2229 struct wpa_tdls_timeoutie *timeoutie; 2230 struct wpa_tdls_lnkid *lnkid; 2231 int ielen; 2232 u16 status; 2233 const u8 *pos; 2234 u32 lifetime; 2235 int ret = 0; 2236 2237 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2238 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2239 for (peer = sm->tdls; peer; peer = peer->next) { 2240 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2241 break; 2242 } 2243 if (peer == NULL) { 2244 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2245 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2246 return -1; 2247 } 2248 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2249 2250 if (len < 3 + 3) 2251 goto error; 2252 pos = buf; 2253 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2254 2255 status = WPA_GET_LE16(pos); 2256 2257 if (status != 0) { 2258 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2259 status); 2260 goto error; 2261 } 2262 pos += 2 /* status code */ + 1 /* dialog token */; 2263 2264 ielen = len - (pos - buf); /* start of IE in buf */ 2265 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2266 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2267 goto error; 2268 } 2269 2270 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2271 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2272 goto error; 2273 } 2274 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2275 (u8 *) kde.lnkid, kde.lnkid_len); 2276 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2277 2278 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2279 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2280 goto error; 2281 } 2282 2283 if (!wpa_tdls_get_privacy(sm)) 2284 goto skip_rsn; 2285 2286 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2287 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2288 goto error; 2289 } 2290 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2291 kde.ftie, sizeof(*ftie)); 2292 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2293 2294 if (kde.rsn_ie == NULL) { 2295 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2296 goto error; 2297 } 2298 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2299 kde.rsn_ie, kde.rsn_ie_len); 2300 if (kde.rsn_ie_len != peer->rsnie_p_len || 2301 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2302 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2303 "with the one sent in TPK M2"); 2304 goto error; 2305 } 2306 2307 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2308 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2309 "not match with FTIE ANonce used in TPK M2"); 2310 goto error; 2311 } 2312 2313 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2314 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2315 "match with FTIE SNonce used in TPK M1"); 2316 goto error; 2317 } 2318 2319 if (kde.key_lifetime == NULL) { 2320 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2321 goto error; 2322 } 2323 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2324 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2325 (u8 *) timeoutie, sizeof(*timeoutie)); 2326 lifetime = WPA_GET_LE32(timeoutie->value); 2327 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2328 lifetime); 2329 if (lifetime != peer->lifetime) { 2330 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2331 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2332 goto error; 2333 } 2334 2335 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2336 (u8 *) timeoutie, ftie) < 0) { 2337 wpa_tdls_del_key(sm, peer); 2338 goto error; 2339 } 2340 2341 if (wpa_tdls_set_key(sm, peer) < 0) { 2342 /* 2343 * Some drivers may not be able to config the key prior to full 2344 * STA entry having been configured. 2345 */ 2346 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2347 "STA entry is complete"); 2348 peer->reconfig_key = 1; 2349 } 2350 2351skip_rsn: 2352 if (!peer->tpk_success) { 2353 /* 2354 * Enable Link only when tpk_success is 0, signifying that this 2355 * processing of TPK M3 frame is not because of a retransmission 2356 * during TDLS setup handshake. 2357 */ 2358 ret = wpa_tdls_enable_link(sm, peer); 2359 if (ret < 0) { 2360 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2361 wpa_tdls_do_teardown( 2362 sm, peer, 2363 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2364 } 2365 } 2366 return ret; 2367error: 2368 wpa_tdls_disable_peer_link(sm, peer); 2369 return -1; 2370} 2371 2372 2373static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2374{ 2375 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2376 2377 os_memset(lifetime, 0, ie_len); 2378 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2379 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2380 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2381 WPA_PUT_LE32(lifetime->value, tsecs); 2382 os_memcpy(pos, ie, ie_len); 2383 return pos + ie_len; 2384} 2385 2386 2387/** 2388 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2389 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2390 * @peer: MAC address of the peer STA 2391 * Returns: 0 on success, or -1 on failure 2392 * 2393 * Send TPK Handshake Message 1 info to driver to start TDLS 2394 * handshake with the peer. 2395 */ 2396int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2397{ 2398 struct wpa_tdls_peer *peer; 2399 int tdls_prohibited = sm->tdls_prohibited; 2400 2401 if (sm->tdls_disabled || !sm->tdls_supported) 2402 return -1; 2403 2404#ifdef CONFIG_TDLS_TESTING 2405 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2406 tdls_prohibited) { 2407 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2408 "on TDLS"); 2409 tdls_prohibited = 0; 2410 } 2411#endif /* CONFIG_TDLS_TESTING */ 2412 2413 if (tdls_prohibited) { 2414 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2415 "reject request to start setup"); 2416 return -1; 2417 } 2418 2419 peer = wpa_tdls_add_peer(sm, addr, NULL); 2420 if (peer == NULL) 2421 return -1; 2422 2423 if (peer->tpk_in_progress) { 2424 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer"); 2425 return 0; 2426 } 2427 2428 peer->initiator = 1; 2429 2430 /* add the peer to the driver as a "setup in progress" peer */ 2431 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2432 NULL, 0, NULL, 0, NULL, 0); 2433 2434 peer->tpk_in_progress = 1; 2435 2436 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2437 wpa_tdls_disable_peer_link(sm, peer); 2438 return -1; 2439 } 2440 2441 return 0; 2442} 2443 2444 2445void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2446{ 2447 struct wpa_tdls_peer *peer; 2448 2449 if (sm->tdls_disabled || !sm->tdls_supported) 2450 return; 2451 2452 for (peer = sm->tdls; peer; peer = peer->next) { 2453 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2454 break; 2455 } 2456 2457 if (peer == NULL || !peer->tpk_success) 2458 return; 2459 2460 if (sm->tdls_external_setup) { 2461 /* 2462 * Disable previous link to allow renegotiation to be completed 2463 * on AP path. 2464 */ 2465 wpa_tdls_disable_peer_link(sm, peer); 2466 } 2467} 2468 2469 2470/** 2471 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2472 * 2473 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2474 */ 2475static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2476 const u8 *buf, size_t len) 2477{ 2478 struct wpa_sm *sm = ctx; 2479 struct wpa_tdls_frame *tf; 2480 2481 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2482 buf, len); 2483 2484 if (sm->tdls_disabled || !sm->tdls_supported) { 2485 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2486 "or unsupported by driver"); 2487 return; 2488 } 2489 2490 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2491 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2492 return; 2493 } 2494 2495 if (len < sizeof(*tf)) { 2496 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2497 return; 2498 } 2499 2500 /* Check to make sure its a valid encapsulated TDLS frame */ 2501 tf = (struct wpa_tdls_frame *) buf; 2502 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2503 tf->category != WLAN_ACTION_TDLS) { 2504 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2505 "category=%u action=%u", 2506 tf->payloadtype, tf->category, tf->action); 2507 return; 2508 } 2509 2510 switch (tf->action) { 2511 case WLAN_TDLS_SETUP_REQUEST: 2512 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2513 break; 2514 case WLAN_TDLS_SETUP_RESPONSE: 2515 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2516 break; 2517 case WLAN_TDLS_SETUP_CONFIRM: 2518 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2519 break; 2520 case WLAN_TDLS_TEARDOWN: 2521 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2522 break; 2523 case WLAN_TDLS_DISCOVERY_REQUEST: 2524 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2525 break; 2526 default: 2527 /* Kernel code will process remaining frames */ 2528 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2529 tf->action); 2530 break; 2531 } 2532} 2533 2534 2535/** 2536 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2537 * @wpa_s: Pointer to wpa_supplicant data 2538 * Returns: 0 on success, -1 on failure 2539 * 2540 * This function is called to initialize driver interface parameters for TDLS. 2541 * wpa_drv_init() must have been called before this function to initialize the 2542 * driver interface. 2543 */ 2544int wpa_tdls_init(struct wpa_sm *sm) 2545{ 2546 if (sm == NULL) 2547 return -1; 2548 2549 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2550 sm->ifname, 2551 sm->own_addr, 2552 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2553 sm, 0); 2554 if (sm->l2_tdls == NULL) { 2555 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2556 "connection"); 2557 return -1; 2558 } 2559 2560 /* 2561 * Drivers that support TDLS but don't implement the get_capa callback 2562 * are assumed to perform everything internally 2563 */ 2564 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2565 &sm->tdls_external_setup) < 0) { 2566 sm->tdls_supported = 1; 2567 sm->tdls_external_setup = 0; 2568 } 2569 2570 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2571 "driver", sm->tdls_supported ? "" : " not"); 2572 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2573 sm->tdls_external_setup ? "external" : "internal"); 2574 2575 return 0; 2576} 2577 2578 2579void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2580{ 2581 struct wpa_tdls_peer *peer; 2582 2583 peer = sm->tdls; 2584 2585 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2586 2587 while (peer) { 2588 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2589 MAC2STR(peer->addr)); 2590 if (sm->tdls_external_setup) 2591 wpa_tdls_send_teardown(sm, peer->addr, 2592 WLAN_REASON_DEAUTH_LEAVING); 2593 else 2594 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2595 2596 peer = peer->next; 2597 } 2598} 2599 2600 2601static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2602{ 2603 struct wpa_tdls_peer *peer, *tmp; 2604 2605 peer = sm->tdls; 2606 sm->tdls = NULL; 2607 2608 while (peer) { 2609 int res; 2610 tmp = peer->next; 2611 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2612 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2613 MAC2STR(peer->addr), res); 2614 wpa_tdls_peer_free(sm, peer); 2615 os_free(peer); 2616 peer = tmp; 2617 } 2618} 2619 2620 2621/** 2622 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2623 * 2624 * This function is called to recover driver interface parameters for TDLS 2625 * and frees resources allocated for it. 2626 */ 2627void wpa_tdls_deinit(struct wpa_sm *sm) 2628{ 2629 if (sm == NULL) 2630 return; 2631 2632 if (sm->l2_tdls) 2633 l2_packet_deinit(sm->l2_tdls); 2634 sm->l2_tdls = NULL; 2635 2636 wpa_tdls_remove_peers(sm); 2637} 2638 2639 2640void wpa_tdls_assoc(struct wpa_sm *sm) 2641{ 2642 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2643 wpa_tdls_remove_peers(sm); 2644} 2645 2646 2647void wpa_tdls_disassoc(struct wpa_sm *sm) 2648{ 2649 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2650 wpa_tdls_remove_peers(sm); 2651} 2652 2653 2654static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2655{ 2656 struct wpa_eapol_ie_parse elems; 2657 2658 if (ies == NULL) 2659 return 0; 2660 2661 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2662 return 0; 2663 2664 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2665 return 0; 2666 2667 /* bit 38 - TDLS Prohibited */ 2668 return !!(elems.ext_capab[2 + 4] & 0x40); 2669} 2670 2671 2672void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2673{ 2674 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2675 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2676 sm->tdls_prohibited ? "prohibited" : "allowed"); 2677} 2678 2679 2680void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2681{ 2682 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2683 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2684 "(Re)Association Response IEs"); 2685 sm->tdls_prohibited = 1; 2686 } 2687} 2688 2689 2690void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2691{ 2692 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2693 sm->tdls_disabled = !enabled; 2694} 2695 2696 2697int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2698{ 2699 return sm->tdls_external_setup; 2700} 2701