tdls.c revision 51b6ea882f234c14cd1fe1332a3840cf61fafcca
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36unsigned int tdls_testing = 0; 37#endif /* CONFIG_TDLS_TESTING */ 38 39#define TPK_LIFETIME 43200 /* 12 hours */ 40#define TPK_RETRY_COUNT 3 41#define TPK_TIMEOUT 5000 /* in milliseconds */ 42 43#define TDLS_MIC_LEN 16 44 45#define TDLS_TIMEOUT_LEN 4 46 47struct wpa_tdls_ftie { 48 u8 ie_type; /* FTIE */ 49 u8 ie_len; 50 u8 mic_ctrl[2]; 51 u8 mic[TDLS_MIC_LEN]; 52 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 53 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 54 /* followed by optional elements */ 55} STRUCT_PACKED; 56 57struct wpa_tdls_timeoutie { 58 u8 ie_type; /* Timeout IE */ 59 u8 ie_len; 60 u8 interval_type; 61 u8 value[TDLS_TIMEOUT_LEN]; 62} STRUCT_PACKED; 63 64struct wpa_tdls_lnkid { 65 u8 ie_type; /* Link Identifier IE */ 66 u8 ie_len; 67 u8 bssid[ETH_ALEN]; 68 u8 init_sta[ETH_ALEN]; 69 u8 resp_sta[ETH_ALEN]; 70} STRUCT_PACKED; 71 72/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 73struct wpa_tdls_frame { 74 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 75 u8 category; /* Category */ 76 u8 action; /* Action (enum tdls_frame_type) */ 77} STRUCT_PACKED; 78 79static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 80static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 81static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 82 83 84#define TDLS_MAX_IE_LEN 80 85#define IEEE80211_MAX_SUPP_RATES 32 86 87struct wpa_tdls_peer { 88 struct wpa_tdls_peer *next; 89 unsigned int reconfig_key:1; 90 int initiator; /* whether this end was initiator for TDLS setup */ 91 u8 addr[ETH_ALEN]; /* other end MAC address */ 92 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 93 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 94 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 95 size_t rsnie_i_len; 96 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 97 size_t rsnie_p_len; 98 u32 lifetime; 99 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 100 u8 dtoken; 101 102 struct tpk { 103 u8 kck[16]; /* TPK-KCK */ 104 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 105 } tpk; 106 int tpk_set; 107 int tpk_success; 108 109 struct tpk_timer { 110 u8 dest[ETH_ALEN]; 111 int count; /* Retry Count */ 112 int timer; /* Timeout in milliseconds */ 113 u8 action_code; /* TDLS frame type */ 114 u8 dialog_token; 115 u16 status_code; 116 int buf_len; /* length of TPK message for retransmission */ 117 u8 *buf; /* buffer for TPK message */ 118 } sm_tmr; 119 120 u16 capability; 121 122 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 123 size_t supp_rates_len; 124 125 struct ieee80211_ht_capabilities *ht_capabilities; 126 struct ieee80211_vht_capabilities *vht_capabilities; 127 128 u8 qos_info; 129 130 u16 aid; 131 132 u8 *ext_capab; 133 size_t ext_capab_len; 134}; 135 136 137static int wpa_tdls_get_privacy(struct wpa_sm *sm) 138{ 139 /* 140 * Get info needed from supplicant to check if the current BSS supports 141 * security. Other than OPEN mode, rest are considered secured 142 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 143 */ 144 return sm->pairwise_cipher != WPA_CIPHER_NONE; 145} 146 147 148static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 149{ 150 os_memcpy(pos, ie, ie_len); 151 return pos + ie_len; 152} 153 154 155static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 156{ 157 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 158 0, 0, NULL, 0, NULL, 0) < 0) { 159 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 160 "the driver"); 161 return -1; 162 } 163 164 return 0; 165} 166 167 168static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 169{ 170 u8 key_len; 171 u8 rsc[6]; 172 enum wpa_alg alg; 173 174 os_memset(rsc, 0, 6); 175 176 switch (peer->cipher) { 177 case WPA_CIPHER_CCMP: 178 alg = WPA_ALG_CCMP; 179 key_len = 16; 180 break; 181 case WPA_CIPHER_NONE: 182 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 183 "NONE - do not use pairwise keys"); 184 return -1; 185 default: 186 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 187 sm->pairwise_cipher); 188 return -1; 189 } 190 191 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 192 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 193 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 194 "driver"); 195 return -1; 196 } 197 return 0; 198} 199 200 201static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 202 u8 action_code, u8 dialog_token, 203 u16 status_code, const u8 *buf, size_t len) 204{ 205 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 206 status_code, buf, len); 207} 208 209 210static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 211 u8 dialog_token, u16 status_code, 212 const u8 *msg, size_t msg_len) 213{ 214 struct wpa_tdls_peer *peer; 215 216 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 217 "dialog_token=%u status_code=%u msg_len=%u", 218 MAC2STR(dest), action_code, dialog_token, status_code, 219 (unsigned int) msg_len); 220 221 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 222 status_code, msg, msg_len)) { 223 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 224 "(action_code=%u)", action_code); 225 return -1; 226 } 227 228 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 229 action_code == WLAN_TDLS_TEARDOWN || 230 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 231 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 232 return 0; /* No retries */ 233 234 for (peer = sm->tdls; peer; peer = peer->next) { 235 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 236 break; 237 } 238 239 if (peer == NULL) { 240 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 241 "retry " MACSTR, MAC2STR(dest)); 242 return 0; 243 } 244 245 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 246 247 peer->sm_tmr.count = TPK_RETRY_COUNT; 248 peer->sm_tmr.timer = TPK_TIMEOUT; 249 250 /* Copy message to resend on timeout */ 251 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 252 peer->sm_tmr.action_code = action_code; 253 peer->sm_tmr.dialog_token = dialog_token; 254 peer->sm_tmr.status_code = status_code; 255 peer->sm_tmr.buf_len = msg_len; 256 os_free(peer->sm_tmr.buf); 257 peer->sm_tmr.buf = os_malloc(msg_len); 258 if (peer->sm_tmr.buf == NULL) 259 return -1; 260 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 261 262 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 263 "(action_code=%u)", action_code); 264 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0, 265 wpa_tdls_tpk_retry_timeout, sm, peer); 266 return 0; 267} 268 269 270static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 271 u16 reason_code, int free_peer) 272{ 273 int ret; 274 275 if (sm->tdls_external_setup) { 276 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 277 278 /* disable the link after teardown was sent */ 279 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 280 } else { 281 ret = wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 282 } 283 284 if (sm->tdls_external_setup || free_peer) 285 wpa_tdls_peer_free(sm, peer); 286 287 return ret; 288} 289 290 291static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 292{ 293 294 struct wpa_sm *sm = eloop_ctx; 295 struct wpa_tdls_peer *peer = timeout_ctx; 296 297 if (peer->sm_tmr.count) { 298 peer->sm_tmr.count--; 299 peer->sm_tmr.timer = TPK_TIMEOUT; 300 301 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 302 "(action_code=%u)", 303 peer->sm_tmr.action_code); 304 305 if (peer->sm_tmr.buf == NULL) { 306 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 307 "for action_code=%u", 308 peer->sm_tmr.action_code); 309 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 310 peer); 311 return; 312 } 313 314 /* resend TPK Handshake Message to Peer */ 315 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 316 peer->sm_tmr.action_code, 317 peer->sm_tmr.dialog_token, 318 peer->sm_tmr.status_code, 319 peer->sm_tmr.buf, 320 peer->sm_tmr.buf_len)) { 321 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 322 "transmission"); 323 } 324 325 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 326 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0, 327 wpa_tdls_tpk_retry_timeout, sm, peer); 328 } else { 329 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 330 331 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 332 wpa_tdls_do_teardown(sm, peer, 333 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 334 } 335} 336 337 338static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 339 struct wpa_tdls_peer *peer, 340 u8 action_code) 341{ 342 if (action_code == peer->sm_tmr.action_code) { 343 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 344 "action_code=%u", action_code); 345 346 /* Cancel Timeout registered */ 347 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 348 349 /* free all resources meant for retry */ 350 os_free(peer->sm_tmr.buf); 351 peer->sm_tmr.buf = NULL; 352 353 peer->sm_tmr.count = 0; 354 peer->sm_tmr.timer = 0; 355 peer->sm_tmr.buf_len = 0; 356 peer->sm_tmr.action_code = 0xff; 357 } else { 358 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 359 "(Unknown action_code=%u)", action_code); 360 } 361} 362 363 364static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 365 const u8 *own_addr, const u8 *bssid) 366{ 367 u8 key_input[SHA256_MAC_LEN]; 368 const u8 *nonce[2]; 369 size_t len[2]; 370 u8 data[3 * ETH_ALEN]; 371 372 /* IEEE Std 802.11z-2010 8.5.9.1: 373 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 374 */ 375 len[0] = WPA_NONCE_LEN; 376 len[1] = WPA_NONCE_LEN; 377 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 378 nonce[0] = peer->inonce; 379 nonce[1] = peer->rnonce; 380 } else { 381 nonce[0] = peer->rnonce; 382 nonce[1] = peer->inonce; 383 } 384 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 385 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 386 sha256_vector(2, nonce, len, key_input); 387 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 388 key_input, SHA256_MAC_LEN); 389 390 /* 391 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 392 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 393 * TODO: is N_KEY really included in KDF Context and if so, in which 394 * presentation format (little endian 16-bit?) is it used? It gets 395 * added by the KDF anyway.. 396 */ 397 398 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 399 os_memcpy(data, own_addr, ETH_ALEN); 400 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 401 } else { 402 os_memcpy(data, peer->addr, ETH_ALEN); 403 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 404 } 405 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 406 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 407 408 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 409 (u8 *) &peer->tpk, sizeof(peer->tpk)); 410 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 411 peer->tpk.kck, sizeof(peer->tpk.kck)); 412 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 413 peer->tpk.tk, sizeof(peer->tpk.tk)); 414 peer->tpk_set = 1; 415} 416 417 418/** 419 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 420 * @kck: TPK-KCK 421 * @lnkid: Pointer to the beginning of Link Identifier IE 422 * @rsnie: Pointer to the beginning of RSN IE used for handshake 423 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 424 * @ftie: Pointer to the beginning of FT IE 425 * @mic: Pointer for writing MIC 426 * 427 * Calculate MIC for TDLS frame. 428 */ 429static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 430 const u8 *rsnie, const u8 *timeoutie, 431 const u8 *ftie, u8 *mic) 432{ 433 u8 *buf, *pos; 434 struct wpa_tdls_ftie *_ftie; 435 const struct wpa_tdls_lnkid *_lnkid; 436 int ret; 437 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 438 2 + timeoutie[1] + 2 + ftie[1]; 439 buf = os_zalloc(len); 440 if (!buf) { 441 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 442 return -1; 443 } 444 445 pos = buf; 446 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 447 /* 1) TDLS initiator STA MAC address */ 448 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 449 pos += ETH_ALEN; 450 /* 2) TDLS responder STA MAC address */ 451 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 452 pos += ETH_ALEN; 453 /* 3) Transaction Sequence number */ 454 *pos++ = trans_seq; 455 /* 4) Link Identifier IE */ 456 os_memcpy(pos, lnkid, 2 + lnkid[1]); 457 pos += 2 + lnkid[1]; 458 /* 5) RSN IE */ 459 os_memcpy(pos, rsnie, 2 + rsnie[1]); 460 pos += 2 + rsnie[1]; 461 /* 6) Timeout Interval IE */ 462 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 463 pos += 2 + timeoutie[1]; 464 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 465 os_memcpy(pos, ftie, 2 + ftie[1]); 466 _ftie = (struct wpa_tdls_ftie *) pos; 467 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 468 pos += 2 + ftie[1]; 469 470 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 471 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 472 ret = omac1_aes_128(kck, buf, pos - buf, mic); 473 os_free(buf); 474 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 475 return ret; 476} 477 478 479/** 480 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 481 * @kck: TPK-KCK 482 * @trans_seq: Transaction Sequence Number (4 - Teardown) 483 * @rcode: Reason code for Teardown 484 * @dtoken: Dialog Token used for that particular link 485 * @lnkid: Pointer to the beginning of Link Identifier IE 486 * @ftie: Pointer to the beginning of FT IE 487 * @mic: Pointer for writing MIC 488 * 489 * Calculate MIC for TDLS frame. 490 */ 491static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 492 u8 dtoken, const u8 *lnkid, 493 const u8 *ftie, u8 *mic) 494{ 495 u8 *buf, *pos; 496 struct wpa_tdls_ftie *_ftie; 497 int ret; 498 int len; 499 500 if (lnkid == NULL) 501 return -1; 502 503 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 504 sizeof(trans_seq) + 2 + ftie[1]; 505 506 buf = os_zalloc(len); 507 if (!buf) { 508 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 509 return -1; 510 } 511 512 pos = buf; 513 /* 1) Link Identifier IE */ 514 os_memcpy(pos, lnkid, 2 + lnkid[1]); 515 pos += 2 + lnkid[1]; 516 /* 2) Reason Code */ 517 WPA_PUT_LE16(pos, rcode); 518 pos += sizeof(rcode); 519 /* 3) Dialog token */ 520 *pos++ = dtoken; 521 /* 4) Transaction Sequence number */ 522 *pos++ = trans_seq; 523 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 524 os_memcpy(pos, ftie, 2 + ftie[1]); 525 _ftie = (struct wpa_tdls_ftie *) pos; 526 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 527 pos += 2 + ftie[1]; 528 529 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 530 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 531 ret = omac1_aes_128(kck, buf, pos - buf, mic); 532 os_free(buf); 533 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 534 return ret; 535} 536 537 538static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 539 struct wpa_tdls_peer *peer, 540 const u8 *lnkid, const u8 *timeoutie, 541 const struct wpa_tdls_ftie *ftie) 542{ 543 u8 mic[16]; 544 545 if (peer->tpk_set) { 546 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 547 peer->rsnie_p, timeoutie, (u8 *) ftie, 548 mic); 549 if (os_memcmp(mic, ftie->mic, 16) != 0) { 550 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 551 "dropping packet"); 552 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 553 ftie->mic, 16); 554 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 555 mic, 16); 556 return -1; 557 } 558 } else { 559 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 560 "TPK not set - dropping packet"); 561 return -1; 562 } 563 return 0; 564} 565 566 567static int wpa_supplicant_verify_tdls_mic_teardown( 568 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 569 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 570{ 571 u8 mic[16]; 572 573 if (peer->tpk_set) { 574 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 575 dtoken, lnkid, (u8 *) ftie, mic); 576 if (os_memcmp(mic, ftie->mic, 16) != 0) { 577 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 578 "dropping packet"); 579 return -1; 580 } 581 } else { 582 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 583 "MIC, TPK not set - dropping packet"); 584 return -1; 585 } 586 return 0; 587} 588 589 590static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 591{ 592 struct wpa_sm *sm = eloop_ctx; 593 struct wpa_tdls_peer *peer = timeout_ctx; 594 595 /* 596 * On TPK lifetime expiration, we have an option of either tearing down 597 * the direct link or trying to re-initiate it. The selection of what 598 * to do is not strictly speaking controlled by our role in the expired 599 * link, but for now, use that to select whether to renew or tear down 600 * the link. 601 */ 602 603 if (peer->initiator) { 604 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 605 " - try to renew", MAC2STR(peer->addr)); 606 wpa_tdls_start(sm, peer->addr); 607 } else { 608 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 609 " - tear down", MAC2STR(peer->addr)); 610 wpa_tdls_do_teardown(sm, peer, 611 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 612 } 613} 614 615 616static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 617{ 618 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 619 MAC2STR(peer->addr)); 620 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 621 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 622 peer->reconfig_key = 0; 623 peer->initiator = 0; 624 os_free(peer->sm_tmr.buf); 625 peer->sm_tmr.buf = NULL; 626 os_free(peer->ht_capabilities); 627 peer->ht_capabilities = NULL; 628 os_free(peer->vht_capabilities); 629 peer->vht_capabilities = NULL; 630 os_free(peer->ext_capab); 631 peer->ext_capab = NULL; 632 peer->rsnie_i_len = peer->rsnie_p_len = 0; 633 peer->cipher = 0; 634 peer->tpk_set = peer->tpk_success = 0; 635 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 636 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 637 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 638} 639 640 641static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 642 struct wpa_tdls_lnkid *lnkid) 643{ 644 lnkid->ie_type = WLAN_EID_LINK_ID; 645 lnkid->ie_len = 3 * ETH_ALEN; 646 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 647 if (peer->initiator) { 648 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 649 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 650 } else { 651 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 652 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 653 } 654} 655 656 657int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 658{ 659 struct wpa_tdls_peer *peer; 660 struct wpa_tdls_ftie *ftie; 661 struct wpa_tdls_lnkid lnkid; 662 u8 dialog_token; 663 u8 *rbuf, *pos; 664 int ielen; 665 666 if (sm->tdls_disabled || !sm->tdls_supported) 667 return -1; 668 669 /* Find the node and free from the list */ 670 for (peer = sm->tdls; peer; peer = peer->next) { 671 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 672 break; 673 } 674 675 if (peer == NULL) { 676 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 677 "Teardown " MACSTR, MAC2STR(addr)); 678 return 0; 679 } 680 681 dialog_token = peer->dtoken; 682 683 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 684 MAC2STR(addr)); 685 686 ielen = 0; 687 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 688 /* To add FTIE for Teardown request and compute MIC */ 689 ielen += sizeof(*ftie); 690#ifdef CONFIG_TDLS_TESTING 691 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 692 ielen += 170; 693#endif /* CONFIG_TDLS_TESTING */ 694 } 695 696 rbuf = os_zalloc(ielen + 1); 697 if (rbuf == NULL) 698 return -1; 699 pos = rbuf; 700 701 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 702 goto skip_ies; 703 704 ftie = (struct wpa_tdls_ftie *) pos; 705 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 706 /* Using the recent nonce which should be for CONFIRM frame */ 707 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 708 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 709 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 710 pos = (u8 *) (ftie + 1); 711#ifdef CONFIG_TDLS_TESTING 712 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 713 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 714 "FTIE"); 715 ftie->ie_len += 170; 716 *pos++ = 255; /* FTIE subelem */ 717 *pos++ = 168; /* FTIE subelem length */ 718 pos += 168; 719 } 720#endif /* CONFIG_TDLS_TESTING */ 721 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 722 (u8 *) ftie, pos - (u8 *) ftie); 723 724 /* compute MIC before sending */ 725 wpa_tdls_linkid(sm, peer, &lnkid); 726 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 727 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 728 ftie->mic); 729 730skip_ies: 731 /* TODO: register for a Timeout handler, if Teardown is not received at 732 * the other end, then try again another time */ 733 734 /* request driver to send Teardown using this FTIE */ 735 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 736 reason_code, rbuf, pos - rbuf); 737 os_free(rbuf); 738 739 /* clear the Peerkey statemachine */ 740 wpa_tdls_peer_free(sm, peer); 741 742 return 0; 743} 744 745 746int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 747{ 748 struct wpa_tdls_peer *peer; 749 750 if (sm->tdls_disabled || !sm->tdls_supported) 751 return -1; 752 753 for (peer = sm->tdls; peer; peer = peer->next) { 754 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 755 break; 756 } 757 758 if (peer == NULL) { 759 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 760 " for link Teardown", MAC2STR(addr)); 761 return -1; 762 } 763 764 if (!peer->tpk_success) { 765 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 766 " not connected - cannot Teardown link", MAC2STR(addr)); 767 return -1; 768 } 769 770 return wpa_tdls_do_teardown(sm, peer, reason_code, 0); 771} 772 773 774void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 775{ 776 struct wpa_tdls_peer *peer; 777 778 for (peer = sm->tdls; peer; peer = peer->next) { 779 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 780 break; 781 } 782 783 if (peer) { 784 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr); 785 wpa_tdls_peer_free(sm, peer); 786 } 787} 788 789 790static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 791 const u8 *buf, size_t len) 792{ 793 struct wpa_tdls_peer *peer = NULL; 794 struct wpa_tdls_ftie *ftie; 795 struct wpa_tdls_lnkid *lnkid; 796 struct wpa_eapol_ie_parse kde; 797 u16 reason_code; 798 const u8 *pos; 799 int ielen; 800 801 /* Find the node and free from the list */ 802 for (peer = sm->tdls; peer; peer = peer->next) { 803 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 804 break; 805 } 806 807 if (peer == NULL) { 808 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 809 "Teardown " MACSTR, MAC2STR(src_addr)); 810 return 0; 811 } 812 813 pos = buf; 814 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 815 816 reason_code = WPA_GET_LE16(pos); 817 pos += 2; 818 819 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 820 " (reason code %u)", MAC2STR(src_addr), reason_code); 821 822 ielen = len - (pos - buf); /* start of IE in buf */ 823 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 824 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 825 return -1; 826 } 827 828 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 829 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 830 "Teardown"); 831 return -1; 832 } 833 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 834 835 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 836 goto skip_ftie; 837 838 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 839 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 840 return -1; 841 } 842 843 ftie = (struct wpa_tdls_ftie *) kde.ftie; 844 845 /* Process MIC check to see if TDLS Teardown is right */ 846 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 847 peer->dtoken, peer, 848 (u8 *) lnkid, ftie) < 0) { 849 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 850 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 851 return -1; 852 } 853 854skip_ftie: 855 /* 856 * Request the driver to disable the direct link and clear associated 857 * keys. 858 */ 859 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 860 861 /* clear the Peerkey statemachine */ 862 wpa_tdls_peer_free(sm, peer); 863 864 return 0; 865} 866 867 868/** 869 * wpa_tdls_send_error - To send suitable TDLS status response with 870 * appropriate status code mentioning reason for error/failure. 871 * @dst - MAC addr of Peer station 872 * @tdls_action - TDLS frame type for which error code is sent 873 * @status - status code mentioning reason 874 */ 875 876static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 877 u8 tdls_action, u8 dialog_token, u16 status) 878{ 879 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 880 " (action=%u status=%u)", 881 MAC2STR(dst), tdls_action, status); 882 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 883 NULL, 0); 884} 885 886 887static struct wpa_tdls_peer * 888wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 889{ 890 struct wpa_tdls_peer *peer; 891 892 if (existing) 893 *existing = 0; 894 for (peer = sm->tdls; peer; peer = peer->next) { 895 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 896 if (existing) 897 *existing = 1; 898 return peer; /* re-use existing entry */ 899 } 900 } 901 902 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 903 MAC2STR(addr)); 904 905 peer = os_zalloc(sizeof(*peer)); 906 if (peer == NULL) 907 return NULL; 908 909 os_memcpy(peer->addr, addr, ETH_ALEN); 910 peer->next = sm->tdls; 911 sm->tdls = peer; 912 913 return peer; 914} 915 916 917static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 918 struct wpa_tdls_peer *peer) 919{ 920 size_t buf_len; 921 struct wpa_tdls_timeoutie timeoutie; 922 u16 rsn_capab; 923 struct wpa_tdls_ftie *ftie; 924 u8 *rbuf, *pos, *count_pos; 925 u16 count; 926 struct rsn_ie_hdr *hdr; 927 928 if (!wpa_tdls_get_privacy(sm)) { 929 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 930 peer->rsnie_i_len = 0; 931 goto skip_rsnie; 932 } 933 934 /* 935 * TPK Handshake Message 1: 936 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 937 * Timeout Interval IE)) 938 */ 939 940 /* Filling RSN IE */ 941 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 942 hdr->elem_id = WLAN_EID_RSN; 943 WPA_PUT_LE16(hdr->version, RSN_VERSION); 944 945 pos = (u8 *) (hdr + 1); 946 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 947 pos += RSN_SELECTOR_LEN; 948 count_pos = pos; 949 pos += 2; 950 951 count = 0; 952 953 /* 954 * AES-CCMP is the default Encryption preferred for TDLS, so 955 * RSN IE is filled only with CCMP CIPHER 956 * Note: TKIP is not used to encrypt TDLS link. 957 * 958 * Regardless of the cipher used on the AP connection, select CCMP 959 * here. 960 */ 961 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 962 pos += RSN_SELECTOR_LEN; 963 count++; 964 965 WPA_PUT_LE16(count_pos, count); 966 967 WPA_PUT_LE16(pos, 1); 968 pos += 2; 969 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 970 pos += RSN_SELECTOR_LEN; 971 972 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 973 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 974#ifdef CONFIG_TDLS_TESTING 975 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 976 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 977 "testing"); 978 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 979 } 980#endif /* CONFIG_TDLS_TESTING */ 981 WPA_PUT_LE16(pos, rsn_capab); 982 pos += 2; 983#ifdef CONFIG_TDLS_TESTING 984 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 985 /* Number of PMKIDs */ 986 *pos++ = 0x00; 987 *pos++ = 0x00; 988 } 989#endif /* CONFIG_TDLS_TESTING */ 990 991 hdr->len = (pos - peer->rsnie_i) - 2; 992 peer->rsnie_i_len = pos - peer->rsnie_i; 993 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 994 peer->rsnie_i, peer->rsnie_i_len); 995 996skip_rsnie: 997 buf_len = 0; 998 if (wpa_tdls_get_privacy(sm)) 999 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1000 sizeof(struct wpa_tdls_timeoutie); 1001#ifdef CONFIG_TDLS_TESTING 1002 if (wpa_tdls_get_privacy(sm) && 1003 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1004 buf_len += 170; 1005 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1006 buf_len += sizeof(struct wpa_tdls_lnkid); 1007#endif /* CONFIG_TDLS_TESTING */ 1008 rbuf = os_zalloc(buf_len + 1); 1009 if (rbuf == NULL) { 1010 wpa_tdls_peer_free(sm, peer); 1011 return -1; 1012 } 1013 pos = rbuf; 1014 1015 if (!wpa_tdls_get_privacy(sm)) 1016 goto skip_ies; 1017 1018 /* Initiator RSN IE */ 1019 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1020 1021 ftie = (struct wpa_tdls_ftie *) pos; 1022 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1023 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1024 1025 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1026 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1027 "TDLS: Failed to get random data for initiator Nonce"); 1028 os_free(rbuf); 1029 wpa_tdls_peer_free(sm, peer); 1030 return -1; 1031 } 1032 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1033 peer->inonce, WPA_NONCE_LEN); 1034 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1035 1036 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1037 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1038 1039 pos = (u8 *) (ftie + 1); 1040 1041#ifdef CONFIG_TDLS_TESTING 1042 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1043 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1044 "FTIE"); 1045 ftie->ie_len += 170; 1046 *pos++ = 255; /* FTIE subelem */ 1047 *pos++ = 168; /* FTIE subelem length */ 1048 pos += 168; 1049 } 1050#endif /* CONFIG_TDLS_TESTING */ 1051 1052 /* Lifetime */ 1053 peer->lifetime = TPK_LIFETIME; 1054#ifdef CONFIG_TDLS_TESTING 1055 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1056 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1057 "lifetime"); 1058 peer->lifetime = 301; 1059 } 1060 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1061 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1062 "lifetime"); 1063 peer->lifetime = 0xffffffff; 1064 } 1065#endif /* CONFIG_TDLS_TESTING */ 1066 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1067 sizeof(timeoutie), peer->lifetime); 1068 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1069 1070skip_ies: 1071 1072#ifdef CONFIG_TDLS_TESTING 1073 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1074 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1075 "Link Identifier"); 1076 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1077 wpa_tdls_linkid(sm, peer, l); 1078 l->bssid[5] ^= 0x01; 1079 pos += sizeof(*l); 1080 } 1081#endif /* CONFIG_TDLS_TESTING */ 1082 1083 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1084 "Handshake Message 1 (peer " MACSTR ")", 1085 MAC2STR(peer->addr)); 1086 1087 wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1, 0, 1088 rbuf, pos - rbuf); 1089 os_free(rbuf); 1090 1091 return 0; 1092} 1093 1094 1095static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1096 const unsigned char *src_addr, u8 dtoken, 1097 struct wpa_tdls_lnkid *lnkid, 1098 const struct wpa_tdls_peer *peer) 1099{ 1100 u8 *rbuf, *pos; 1101 size_t buf_len; 1102 u32 lifetime; 1103 struct wpa_tdls_timeoutie timeoutie; 1104 struct wpa_tdls_ftie *ftie; 1105 1106 buf_len = 0; 1107 if (wpa_tdls_get_privacy(sm)) { 1108 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1109 * Lifetime */ 1110 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1111 sizeof(struct wpa_tdls_timeoutie); 1112#ifdef CONFIG_TDLS_TESTING 1113 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1114 buf_len += 170; 1115#endif /* CONFIG_TDLS_TESTING */ 1116 } 1117 1118 rbuf = os_zalloc(buf_len + 1); 1119 if (rbuf == NULL) 1120 return -1; 1121 pos = rbuf; 1122 1123 if (!wpa_tdls_get_privacy(sm)) 1124 goto skip_ies; 1125 1126 /* Peer RSN IE */ 1127 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1128 1129 ftie = (struct wpa_tdls_ftie *) pos; 1130 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1131 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1132 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1133 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1134 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1135 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1136 (u8 *) ftie, sizeof(*ftie)); 1137 1138 pos = (u8 *) (ftie + 1); 1139 1140#ifdef CONFIG_TDLS_TESTING 1141 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1142 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1143 "FTIE"); 1144 ftie->ie_len += 170; 1145 *pos++ = 255; /* FTIE subelem */ 1146 *pos++ = 168; /* FTIE subelem length */ 1147 pos += 168; 1148 } 1149#endif /* CONFIG_TDLS_TESTING */ 1150 1151 /* Lifetime */ 1152 lifetime = peer->lifetime; 1153#ifdef CONFIG_TDLS_TESTING 1154 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1155 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1156 "lifetime in response"); 1157 lifetime++; 1158 } 1159#endif /* CONFIG_TDLS_TESTING */ 1160 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1161 sizeof(timeoutie), lifetime); 1162 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1163 lifetime); 1164 1165 /* compute MIC before sending */ 1166 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1167 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1168 1169skip_ies: 1170 wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0, 1171 rbuf, pos - rbuf); 1172 os_free(rbuf); 1173 1174 return 0; 1175} 1176 1177 1178static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1179 const unsigned char *src_addr, u8 dtoken, 1180 struct wpa_tdls_lnkid *lnkid, 1181 const struct wpa_tdls_peer *peer) 1182{ 1183 u8 *rbuf, *pos; 1184 size_t buf_len; 1185 struct wpa_tdls_ftie *ftie; 1186 struct wpa_tdls_timeoutie timeoutie; 1187 u32 lifetime; 1188 1189 buf_len = 0; 1190 if (wpa_tdls_get_privacy(sm)) { 1191 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1192 * Lifetime */ 1193 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1194 sizeof(struct wpa_tdls_timeoutie); 1195#ifdef CONFIG_TDLS_TESTING 1196 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1197 buf_len += 170; 1198#endif /* CONFIG_TDLS_TESTING */ 1199 } 1200 1201 rbuf = os_zalloc(buf_len + 1); 1202 if (rbuf == NULL) 1203 return -1; 1204 pos = rbuf; 1205 1206 if (!wpa_tdls_get_privacy(sm)) 1207 goto skip_ies; 1208 1209 /* Peer RSN IE */ 1210 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1211 1212 ftie = (struct wpa_tdls_ftie *) pos; 1213 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1214 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1215 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1216 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1217 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1218 1219 pos = (u8 *) (ftie + 1); 1220 1221#ifdef CONFIG_TDLS_TESTING 1222 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1223 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1224 "FTIE"); 1225 ftie->ie_len += 170; 1226 *pos++ = 255; /* FTIE subelem */ 1227 *pos++ = 168; /* FTIE subelem length */ 1228 pos += 168; 1229 } 1230#endif /* CONFIG_TDLS_TESTING */ 1231 1232 /* Lifetime */ 1233 lifetime = peer->lifetime; 1234#ifdef CONFIG_TDLS_TESTING 1235 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1236 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1237 "lifetime in confirm"); 1238 lifetime++; 1239 } 1240#endif /* CONFIG_TDLS_TESTING */ 1241 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1242 sizeof(timeoutie), lifetime); 1243 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1244 lifetime); 1245 1246 /* compute MIC before sending */ 1247 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1248 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1249 1250skip_ies: 1251 wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 0, 1252 rbuf, pos - rbuf); 1253 os_free(rbuf); 1254 1255 return 0; 1256} 1257 1258 1259static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1260 struct wpa_tdls_peer *peer, 1261 u8 dialog_token) 1262{ 1263 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1264 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1265 1266 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1267 dialog_token, 0, NULL, 0); 1268} 1269 1270 1271static int 1272wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1273 const u8 *buf, size_t len) 1274{ 1275 struct wpa_eapol_ie_parse kde; 1276 const struct wpa_tdls_lnkid *lnkid; 1277 struct wpa_tdls_peer *peer; 1278 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1279 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1280 u8 dialog_token; 1281 1282 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1283 MAC2STR(addr)); 1284 1285 if (len < min_req_len) { 1286 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1287 "%d", (int) len); 1288 return -1; 1289 } 1290 1291 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1292 1293 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1294 len - (sizeof(struct wpa_tdls_frame) + 1), 1295 &kde) < 0) 1296 return -1; 1297 1298 if (!kde.lnkid) { 1299 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1300 "Request"); 1301 return -1; 1302 } 1303 1304 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1305 1306 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1307 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1308 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1309 return -1; 1310 } 1311 1312 peer = wpa_tdls_add_peer(sm, addr, NULL); 1313 if (peer == NULL) 1314 return -1; 1315 1316 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1317} 1318 1319 1320int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1321{ 1322 if (sm->tdls_disabled || !sm->tdls_supported) 1323 return -1; 1324 1325 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1326 MACSTR, MAC2STR(addr)); 1327 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1328 1, 0, NULL, 0); 1329} 1330 1331 1332static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1333 struct wpa_tdls_peer *peer) 1334{ 1335 if (!kde->supp_rates) { 1336 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1337 return -1; 1338 } 1339 peer->supp_rates_len = merge_byte_arrays( 1340 peer->supp_rates, sizeof(peer->supp_rates), 1341 kde->supp_rates + 2, kde->supp_rates_len - 2, 1342 kde->ext_supp_rates + 2, kde->ext_supp_rates_len - 2); 1343 return 0; 1344} 1345 1346 1347static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1348 struct wpa_tdls_peer *peer) 1349{ 1350 if (!kde->ht_capabilities || 1351 kde->ht_capabilities_len < 1352 sizeof(struct ieee80211_ht_capabilities) ) { 1353 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1354 "received"); 1355 return 0; 1356 } 1357 1358 if (!peer->ht_capabilities) { 1359 peer->ht_capabilities = 1360 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1361 if (peer->ht_capabilities == NULL) 1362 return -1; 1363 } 1364 1365 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1366 sizeof(struct ieee80211_ht_capabilities)); 1367 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1368 (u8 *) peer->ht_capabilities, 1369 sizeof(struct ieee80211_ht_capabilities)); 1370 1371 return 0; 1372} 1373 1374 1375static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1376 struct wpa_tdls_peer *peer) 1377{ 1378 if (!kde->vht_capabilities || 1379 kde->vht_capabilities_len < 1380 sizeof(struct ieee80211_vht_capabilities) ) { 1381 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1382 "received"); 1383 return 0; 1384 } 1385 1386 if (!peer->vht_capabilities) { 1387 peer->vht_capabilities = 1388 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1389 if (peer->vht_capabilities == NULL) 1390 return -1; 1391 } 1392 1393 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1394 sizeof(struct ieee80211_vht_capabilities)); 1395 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1396 (u8 *) peer->vht_capabilities, 1397 sizeof(struct ieee80211_vht_capabilities)); 1398 1399 return 0; 1400} 1401 1402 1403static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1404 struct wpa_tdls_peer *peer) 1405{ 1406 if (!kde->ext_capab) { 1407 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1408 "received"); 1409 return 0; 1410 } 1411 1412 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1413 /* Need to allocate buffer to fit the new information */ 1414 os_free(peer->ext_capab); 1415 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1416 if (peer->ext_capab == NULL) 1417 return -1; 1418 } 1419 1420 peer->ext_capab_len = kde->ext_capab_len - 2; 1421 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1422 1423 return 0; 1424} 1425 1426 1427static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1428 const u8 *buf, size_t len) 1429{ 1430 struct wpa_tdls_peer *peer; 1431 struct wpa_eapol_ie_parse kde; 1432 struct wpa_ie_data ie; 1433 int cipher; 1434 const u8 *cpos; 1435 struct wpa_tdls_ftie *ftie = NULL; 1436 struct wpa_tdls_timeoutie *timeoutie; 1437 struct wpa_tdls_lnkid *lnkid; 1438 u32 lifetime = 0; 1439#if 0 1440 struct rsn_ie_hdr *hdr; 1441 u8 *pos; 1442 u16 rsn_capab; 1443 u16 rsn_ver; 1444#endif 1445 u8 dtoken; 1446 u16 ielen; 1447 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1448 int tdls_prohibited = sm->tdls_prohibited; 1449 int existing_peer = 0; 1450 1451 if (len < 3 + 3) 1452 return -1; 1453 1454 cpos = buf; 1455 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1456 1457 /* driver had already verified the frame format */ 1458 dtoken = *cpos++; /* dialog token */ 1459 1460 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1461 1462 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1463 if (peer == NULL) 1464 goto error; 1465 1466 /* If found, use existing entry instead of adding a new one; 1467 * how to handle the case where both ends initiate at the 1468 * same time? */ 1469 if (existing_peer) { 1470 if (peer->tpk_success) { 1471 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1472 "direct link is enabled - tear down the " 1473 "old link first"); 1474#if 0 1475 /* TODO: Disabling the link would be more proper 1476 * operation here, but it seems to trigger a race with 1477 * some drivers handling the new request frame. */ 1478 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1479#else 1480 if (sm->tdls_external_setup) 1481 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1482 src_addr); 1483 else 1484 wpa_tdls_del_key(sm, peer); 1485#endif 1486 wpa_tdls_peer_free(sm, peer); 1487 } 1488 1489 /* 1490 * An entry is already present, so check if we already sent a 1491 * TDLS Setup Request. If so, compare MAC addresses and let the 1492 * STA with the lower MAC address continue as the initiator. 1493 * The other negotiation is terminated. 1494 */ 1495 if (peer->initiator) { 1496 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1497 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1498 "from peer with higher address " 1499 MACSTR, MAC2STR(src_addr)); 1500 return -1; 1501 } else { 1502 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1503 "from peer with lower address " 1504 MACSTR " (terminate previously " 1505 "initiated negotiation", 1506 MAC2STR(src_addr)); 1507 if (sm->tdls_external_setup) 1508 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1509 src_addr); 1510 else 1511 wpa_tdls_del_key(sm, peer); 1512 wpa_tdls_peer_free(sm, peer); 1513 } 1514 } 1515 } 1516 1517 /* capability information */ 1518 peer->capability = WPA_GET_LE16(cpos); 1519 cpos += 2; 1520 1521 ielen = len - (cpos - buf); /* start of IE in buf */ 1522 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1523 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1524 goto error; 1525 } 1526 1527 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1528 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1529 "TPK M1"); 1530 goto error; 1531 } 1532 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1533 kde.lnkid, kde.lnkid_len); 1534 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1535 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1536 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1537 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1538 goto error; 1539 } 1540 1541 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1542 MAC2STR(src_addr)); 1543 1544 if (copy_supp_rates(&kde, peer) < 0) 1545 goto error; 1546 1547 if (copy_peer_ht_capab(&kde, peer) < 0) 1548 goto error; 1549 1550 if (copy_peer_vht_capab(&kde, peer) < 0) 1551 goto error; 1552 1553 if (copy_peer_ext_capab(&kde, peer) < 0) 1554 goto error; 1555 1556 peer->qos_info = kde.qosinfo; 1557 1558 peer->aid = kde.aid; 1559 1560#ifdef CONFIG_TDLS_TESTING 1561 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1562 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1563 if (peer == NULL) 1564 goto error; 1565 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1566 "TDLS setup - send own request"); 1567 peer->initiator = 1; 1568 wpa_tdls_send_tpk_m1(sm, peer); 1569 } 1570 1571 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1572 tdls_prohibited) { 1573 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1574 "on TDLS"); 1575 tdls_prohibited = 0; 1576 } 1577#endif /* CONFIG_TDLS_TESTING */ 1578 1579 if (tdls_prohibited) { 1580 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1581 status = WLAN_STATUS_REQUEST_DECLINED; 1582 goto error; 1583 } 1584 1585 if (!wpa_tdls_get_privacy(sm)) { 1586 if (kde.rsn_ie) { 1587 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1588 "security is disabled"); 1589 status = WLAN_STATUS_SECURITY_DISABLED; 1590 goto error; 1591 } 1592 goto skip_rsn; 1593 } 1594 1595 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1596 kde.rsn_ie == NULL) { 1597 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1598 status = WLAN_STATUS_INVALID_PARAMETERS; 1599 goto error; 1600 } 1601 1602 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1603 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1604 "TPK M1"); 1605 status = WLAN_STATUS_INVALID_RSNIE; 1606 goto error; 1607 } 1608 1609 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1610 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1611 status = WLAN_STATUS_INVALID_RSNIE; 1612 goto error; 1613 } 1614 1615 cipher = ie.pairwise_cipher; 1616 if (cipher & WPA_CIPHER_CCMP) { 1617 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1618 cipher = WPA_CIPHER_CCMP; 1619 } else { 1620 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1621 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1622 goto error; 1623 } 1624 1625 if ((ie.capabilities & 1626 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1627 WPA_CAPABILITY_PEERKEY_ENABLED) { 1628 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1629 "TPK M1"); 1630 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1631 goto error; 1632 } 1633 1634 /* Lifetime */ 1635 if (kde.key_lifetime == NULL) { 1636 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1637 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1638 goto error; 1639 } 1640 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1641 lifetime = WPA_GET_LE32(timeoutie->value); 1642 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1643 if (lifetime < 300) { 1644 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1645 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1646 goto error; 1647 } 1648 1649skip_rsn: 1650#ifdef CONFIG_TDLS_TESTING 1651 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1652 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1653 /* 1654 * The request frame from us is going to win, so do not 1655 * replace information based on this request frame from 1656 * the peer. 1657 */ 1658 goto skip_rsn_check; 1659 } 1660 } 1661#endif /* CONFIG_TDLS_TESTING */ 1662 1663 peer->initiator = 0; /* Need to check */ 1664 peer->dtoken = dtoken; 1665 1666 if (!wpa_tdls_get_privacy(sm)) { 1667 peer->rsnie_i_len = 0; 1668 peer->rsnie_p_len = 0; 1669 peer->cipher = WPA_CIPHER_NONE; 1670 goto skip_rsn_check; 1671 } 1672 1673 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1674 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1675 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1676 peer->rsnie_i_len = kde.rsn_ie_len; 1677 peer->cipher = cipher; 1678 1679 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1680 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1681 "TDLS: Failed to get random data for responder nonce"); 1682 wpa_tdls_peer_free(sm, peer); 1683 goto error; 1684 } 1685 1686#if 0 1687 /* get version info from RSNIE received from Peer */ 1688 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1689 rsn_ver = WPA_GET_LE16(hdr->version); 1690 1691 /* use min(peer's version, out version) */ 1692 if (rsn_ver > RSN_VERSION) 1693 rsn_ver = RSN_VERSION; 1694 1695 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1696 1697 hdr->elem_id = WLAN_EID_RSN; 1698 WPA_PUT_LE16(hdr->version, rsn_ver); 1699 pos = (u8 *) (hdr + 1); 1700 1701 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1702 pos += RSN_SELECTOR_LEN; 1703 /* Include only the selected cipher in pairwise cipher suite */ 1704 WPA_PUT_LE16(pos, 1); 1705 pos += 2; 1706 if (cipher == WPA_CIPHER_CCMP) 1707 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1708 pos += RSN_SELECTOR_LEN; 1709 1710 WPA_PUT_LE16(pos, 1); 1711 pos += 2; 1712 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1713 pos += RSN_SELECTOR_LEN; 1714 1715 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1716 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1717 WPA_PUT_LE16(pos, rsn_capab); 1718 pos += 2; 1719 1720 hdr->len = (pos - peer->rsnie_p) - 2; 1721 peer->rsnie_p_len = pos - peer->rsnie_p; 1722#endif 1723 1724 /* temp fix: validation of RSNIE later */ 1725 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1726 peer->rsnie_p_len = peer->rsnie_i_len; 1727 1728 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1729 peer->rsnie_p, peer->rsnie_p_len); 1730 1731 peer->lifetime = lifetime; 1732 1733 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1734 1735skip_rsn_check: 1736 /* add the peer to the driver as a "setup in progress" peer */ 1737 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 1738 NULL, 0); 1739 1740 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1741 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1742 wpa_tdls_disable_link(sm, peer->addr); 1743 goto error; 1744 } 1745 1746 return 0; 1747 1748error: 1749 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1750 status); 1751 return -1; 1752} 1753 1754 1755static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1756{ 1757 peer->tpk_success = 1; 1758 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1759 if (wpa_tdls_get_privacy(sm)) { 1760 u32 lifetime = peer->lifetime; 1761 /* 1762 * Start the initiator process a bit earlier to avoid race 1763 * condition with the responder sending teardown request. 1764 */ 1765 if (lifetime > 3 && peer->initiator) 1766 lifetime -= 3; 1767 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1768 sm, peer); 1769#ifdef CONFIG_TDLS_TESTING 1770 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1771 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1772 "expiration"); 1773 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1774 } 1775#endif /* CONFIG_TDLS_TESTING */ 1776 } 1777 1778 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1779 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1780 peer->capability, 1781 peer->supp_rates, peer->supp_rates_len, 1782 peer->ht_capabilities, 1783 peer->vht_capabilities, 1784 peer->qos_info, peer->ext_capab, 1785 peer->ext_capab_len) < 0) 1786 return -1; 1787 1788 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1789 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1790 "driver"); 1791 return -1; 1792 } 1793 peer->reconfig_key = 0; 1794 1795 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1796} 1797 1798 1799static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1800 const u8 *buf, size_t len) 1801{ 1802 struct wpa_tdls_peer *peer; 1803 struct wpa_eapol_ie_parse kde; 1804 struct wpa_ie_data ie; 1805 int cipher; 1806 struct wpa_tdls_ftie *ftie; 1807 struct wpa_tdls_timeoutie *timeoutie; 1808 struct wpa_tdls_lnkid *lnkid; 1809 u32 lifetime; 1810 u8 dtoken; 1811 int ielen; 1812 u16 status; 1813 const u8 *pos; 1814 int ret; 1815 1816 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1817 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1818 for (peer = sm->tdls; peer; peer = peer->next) { 1819 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1820 break; 1821 } 1822 if (peer == NULL) { 1823 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1824 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1825 return -1; 1826 } 1827 if (!peer->initiator) { 1828 /* 1829 * This may happen if both devices try to initiate TDLS at the 1830 * same time and we accept the TPK M1 from the peer in 1831 * wpa_tdls_process_tpk_m1() and clear our previous state. 1832 */ 1833 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1834 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1835 return -1; 1836 } 1837 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1838 1839 if (len < 3 + 2 + 1) 1840 return -1; 1841 pos = buf; 1842 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1843 status = WPA_GET_LE16(pos); 1844 pos += 2 /* status code */; 1845 1846 if (status != WLAN_STATUS_SUCCESS) { 1847 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 1848 status); 1849 if (sm->tdls_external_setup) 1850 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1851 return -1; 1852 } 1853 1854 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1855 1856 /* TODO: need to verify dialog token matches here or in kernel */ 1857 dtoken = *pos++; /* dialog token */ 1858 1859 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 1860 1861 if (len < 3 + 2 + 1 + 2) 1862 return -1; 1863 1864 /* capability information */ 1865 peer->capability = WPA_GET_LE16(pos); 1866 pos += 2; 1867 1868 ielen = len - (pos - buf); /* start of IE in buf */ 1869 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 1870 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 1871 goto error; 1872 } 1873 1874#ifdef CONFIG_TDLS_TESTING 1875 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 1876 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 1877 status = WLAN_STATUS_REQUEST_DECLINED; 1878 goto error; 1879 } 1880#endif /* CONFIG_TDLS_TESTING */ 1881 1882 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1883 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1884 "TPK M2"); 1885 goto error; 1886 } 1887 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 1888 kde.lnkid, kde.lnkid_len); 1889 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1890 1891 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1892 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 1893 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1894 goto error; 1895 } 1896 1897 if (copy_supp_rates(&kde, peer) < 0) 1898 goto error; 1899 1900 if (copy_peer_ht_capab(&kde, peer) < 0) 1901 goto error; 1902 1903 if (copy_peer_vht_capab(&kde, peer) < 0) 1904 goto error; 1905 1906 if (copy_peer_ext_capab(&kde, peer) < 0) 1907 goto error; 1908 1909 peer->qos_info = kde.qosinfo; 1910 1911 peer->aid = kde.aid; 1912 1913 if (!wpa_tdls_get_privacy(sm)) { 1914 peer->rsnie_p_len = 0; 1915 peer->cipher = WPA_CIPHER_NONE; 1916 goto skip_rsn; 1917 } 1918 1919 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1920 kde.rsn_ie == NULL) { 1921 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 1922 status = WLAN_STATUS_INVALID_PARAMETERS; 1923 goto error; 1924 } 1925 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1926 kde.rsn_ie, kde.rsn_ie_len); 1927 1928 /* 1929 * FIX: bitwise comparison of RSN IE is not the correct way of 1930 * validation this. It can be different, but certain fields must 1931 * match. Since we list only a single pairwise cipher in TPK M1, the 1932 * memcmp is likely to work in most cases, though. 1933 */ 1934 if (kde.rsn_ie_len != peer->rsnie_i_len || 1935 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 1936 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 1937 "not match with RSN IE used in TPK M1"); 1938 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 1939 peer->rsnie_i, peer->rsnie_i_len); 1940 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1941 kde.rsn_ie, kde.rsn_ie_len); 1942 status = WLAN_STATUS_INVALID_RSNIE; 1943 goto error; 1944 } 1945 1946 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1947 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 1948 status = WLAN_STATUS_INVALID_RSNIE; 1949 goto error; 1950 } 1951 1952 cipher = ie.pairwise_cipher; 1953 if (cipher == WPA_CIPHER_CCMP) { 1954 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1955 cipher = WPA_CIPHER_CCMP; 1956 } else { 1957 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 1958 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1959 goto error; 1960 } 1961 1962 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 1963 kde.ftie, sizeof(*ftie)); 1964 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1965 1966 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 1967 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 1968 "not match with FTIE SNonce used in TPK M1"); 1969 /* Silently discard the frame */ 1970 return -1; 1971 } 1972 1973 /* Responder Nonce and RSN IE */ 1974 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 1975 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 1976 peer->rsnie_p_len = kde.rsn_ie_len; 1977 peer->cipher = cipher; 1978 1979 /* Lifetime */ 1980 if (kde.key_lifetime == NULL) { 1981 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 1982 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1983 goto error; 1984 } 1985 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1986 lifetime = WPA_GET_LE32(timeoutie->value); 1987 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 1988 lifetime); 1989 if (lifetime != peer->lifetime) { 1990 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 1991 "TPK M2 (expected %u)", lifetime, peer->lifetime); 1992 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1993 goto error; 1994 } 1995 1996 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1997 1998 /* Process MIC check to see if TPK M2 is right */ 1999 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2000 (u8 *) timeoutie, ftie) < 0) { 2001 /* Discard the frame */ 2002 wpa_tdls_del_key(sm, peer); 2003 wpa_tdls_peer_free(sm, peer); 2004 if (sm->tdls_external_setup) 2005 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2006 return -1; 2007 } 2008 2009 if (wpa_tdls_set_key(sm, peer) < 0) { 2010 /* 2011 * Some drivers may not be able to config the key prior to full 2012 * STA entry having been configured. 2013 */ 2014 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2015 "STA entry is complete"); 2016 peer->reconfig_key = 1; 2017 } 2018 2019skip_rsn: 2020 peer->dtoken = dtoken; 2021 2022 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2023 "TPK Handshake Message 3"); 2024 wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer); 2025 2026 ret = wpa_tdls_enable_link(sm, peer); 2027 if (ret < 0) { 2028 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2029 wpa_tdls_do_teardown(sm, peer, 2030 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 2031 } 2032 return ret; 2033 2034error: 2035 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2036 status); 2037 if (sm->tdls_external_setup) 2038 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2039 return -1; 2040} 2041 2042 2043static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2044 const u8 *buf, size_t len) 2045{ 2046 struct wpa_tdls_peer *peer; 2047 struct wpa_eapol_ie_parse kde; 2048 struct wpa_tdls_ftie *ftie; 2049 struct wpa_tdls_timeoutie *timeoutie; 2050 struct wpa_tdls_lnkid *lnkid; 2051 int ielen; 2052 u16 status; 2053 const u8 *pos; 2054 u32 lifetime; 2055 int ret; 2056 2057 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2058 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2059 for (peer = sm->tdls; peer; peer = peer->next) { 2060 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2061 break; 2062 } 2063 if (peer == NULL) { 2064 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2065 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2066 return -1; 2067 } 2068 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2069 2070 if (len < 3 + 3) 2071 return -1; 2072 pos = buf; 2073 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2074 2075 status = WPA_GET_LE16(pos); 2076 2077 if (status != 0) { 2078 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2079 status); 2080 if (sm->tdls_external_setup) 2081 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2082 return -1; 2083 } 2084 pos += 2 /* status code */ + 1 /* dialog token */; 2085 2086 ielen = len - (pos - buf); /* start of IE in buf */ 2087 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2088 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2089 return -1; 2090 } 2091 2092 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2093 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2094 return -1; 2095 } 2096 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2097 (u8 *) kde.lnkid, kde.lnkid_len); 2098 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2099 2100 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2101 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2102 return -1; 2103 } 2104 2105 if (!wpa_tdls_get_privacy(sm)) 2106 goto skip_rsn; 2107 2108 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2109 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2110 return -1; 2111 } 2112 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2113 kde.ftie, sizeof(*ftie)); 2114 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2115 2116 if (kde.rsn_ie == NULL) { 2117 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2118 return -1; 2119 } 2120 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2121 kde.rsn_ie, kde.rsn_ie_len); 2122 if (kde.rsn_ie_len != peer->rsnie_p_len || 2123 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2124 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2125 "with the one sent in TPK M2"); 2126 return -1; 2127 } 2128 2129 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2130 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2131 "not match with FTIE ANonce used in TPK M2"); 2132 return -1; 2133 } 2134 2135 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2136 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2137 "match with FTIE SNonce used in TPK M1"); 2138 return -1; 2139 } 2140 2141 if (kde.key_lifetime == NULL) { 2142 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2143 return -1; 2144 } 2145 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2146 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2147 (u8 *) timeoutie, sizeof(*timeoutie)); 2148 lifetime = WPA_GET_LE32(timeoutie->value); 2149 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2150 lifetime); 2151 if (lifetime != peer->lifetime) { 2152 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2153 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2154 if (sm->tdls_external_setup) 2155 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2156 return -1; 2157 } 2158 2159 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2160 (u8 *) timeoutie, ftie) < 0) { 2161 wpa_tdls_del_key(sm, peer); 2162 wpa_tdls_peer_free(sm, peer); 2163 return -1; 2164 } 2165 2166 if (wpa_tdls_set_key(sm, peer) < 0) { 2167 /* 2168 * Some drivers may not be able to config the key prior to full 2169 * STA entry having been configured. 2170 */ 2171 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2172 "STA entry is complete"); 2173 peer->reconfig_key = 1; 2174 } 2175 2176skip_rsn: 2177 ret = wpa_tdls_enable_link(sm, peer); 2178 if (ret < 0) { 2179 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2180 wpa_tdls_do_teardown(sm, peer, 2181 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 2182 } 2183 return ret; 2184} 2185 2186 2187static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2188{ 2189 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2190 2191 os_memset(lifetime, 0, ie_len); 2192 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2193 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2194 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2195 WPA_PUT_LE32(lifetime->value, tsecs); 2196 os_memcpy(pos, ie, ie_len); 2197 return pos + ie_len; 2198} 2199 2200 2201/** 2202 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2203 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2204 * @peer: MAC address of the peer STA 2205 * Returns: 0 on success, or -1 on failure 2206 * 2207 * Send TPK Handshake Message 1 info to driver to start TDLS 2208 * handshake with the peer. 2209 */ 2210int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2211{ 2212 struct wpa_tdls_peer *peer; 2213 int tdls_prohibited = sm->tdls_prohibited; 2214 2215 if (sm->tdls_disabled || !sm->tdls_supported) 2216 return -1; 2217 2218#ifdef CONFIG_TDLS_TESTING 2219 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2220 tdls_prohibited) { 2221 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2222 "on TDLS"); 2223 tdls_prohibited = 0; 2224 } 2225#endif /* CONFIG_TDLS_TESTING */ 2226 2227 if (tdls_prohibited) { 2228 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2229 "reject request to start setup"); 2230 return -1; 2231 } 2232 2233 peer = wpa_tdls_add_peer(sm, addr, NULL); 2234 if (peer == NULL) 2235 return -1; 2236 2237 peer->initiator = 1; 2238 2239 /* add the peer to the driver as a "setup in progress" peer */ 2240 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2241 NULL, 0); 2242 2243 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2244 wpa_tdls_disable_link(sm, peer->addr); 2245 return -1; 2246 } 2247 2248 return 0; 2249} 2250 2251 2252void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2253{ 2254 struct wpa_tdls_peer *peer; 2255 2256 if (sm->tdls_disabled || !sm->tdls_supported) 2257 return; 2258 2259 for (peer = sm->tdls; peer; peer = peer->next) { 2260 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2261 break; 2262 } 2263 2264 if (peer == NULL || !peer->tpk_success) 2265 return; 2266 2267 if (sm->tdls_external_setup) { 2268 /* 2269 * Disable previous link to allow renegotiation to be completed 2270 * on AP path. 2271 */ 2272 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2273 } 2274} 2275 2276 2277/** 2278 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2279 * 2280 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2281 */ 2282static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2283 const u8 *buf, size_t len) 2284{ 2285 struct wpa_sm *sm = ctx; 2286 struct wpa_tdls_frame *tf; 2287 2288 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2289 buf, len); 2290 2291 if (sm->tdls_disabled || !sm->tdls_supported) { 2292 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2293 "or unsupported by driver"); 2294 return; 2295 } 2296 2297 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2298 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2299 return; 2300 } 2301 2302 if (len < sizeof(*tf)) { 2303 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2304 return; 2305 } 2306 2307 /* Check to make sure its a valid encapsulated TDLS frame */ 2308 tf = (struct wpa_tdls_frame *) buf; 2309 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2310 tf->category != WLAN_ACTION_TDLS) { 2311 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2312 "category=%u action=%u", 2313 tf->payloadtype, tf->category, tf->action); 2314 return; 2315 } 2316 2317 switch (tf->action) { 2318 case WLAN_TDLS_SETUP_REQUEST: 2319 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2320 break; 2321 case WLAN_TDLS_SETUP_RESPONSE: 2322 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2323 break; 2324 case WLAN_TDLS_SETUP_CONFIRM: 2325 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2326 break; 2327 case WLAN_TDLS_TEARDOWN: 2328 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2329 break; 2330 case WLAN_TDLS_DISCOVERY_REQUEST: 2331 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2332 break; 2333 default: 2334 /* Kernel code will process remaining frames */ 2335 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2336 tf->action); 2337 break; 2338 } 2339} 2340 2341 2342/** 2343 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2344 * @wpa_s: Pointer to wpa_supplicant data 2345 * Returns: 0 on success, -1 on failure 2346 * 2347 * This function is called to initialize driver interface parameters for TDLS. 2348 * wpa_drv_init() must have been called before this function to initialize the 2349 * driver interface. 2350 */ 2351int wpa_tdls_init(struct wpa_sm *sm) 2352{ 2353 if (sm == NULL) 2354 return -1; 2355 2356 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2357 sm->ifname, 2358 sm->own_addr, 2359 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2360 sm, 0); 2361 if (sm->l2_tdls == NULL) { 2362 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2363 "connection"); 2364 return -1; 2365 } 2366 2367 /* 2368 * Drivers that support TDLS but don't implement the get_capa callback 2369 * are assumed to perform everything internally 2370 */ 2371 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2372 &sm->tdls_external_setup) < 0) { 2373 sm->tdls_supported = 1; 2374 sm->tdls_external_setup = 0; 2375 } 2376 2377 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2378 "driver", sm->tdls_supported ? "" : " not"); 2379 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2380 sm->tdls_external_setup ? "external" : "internal"); 2381 2382 return 0; 2383} 2384 2385 2386void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2387{ 2388 struct wpa_tdls_peer *peer; 2389 2390 peer = sm->tdls; 2391 2392 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2393 2394 while (peer) { 2395 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2396 MAC2STR(peer->addr)); 2397 if (sm->tdls_external_setup) 2398 wpa_tdls_send_teardown(sm, peer->addr, 2399 WLAN_REASON_DEAUTH_LEAVING); 2400 else 2401 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2402 2403 peer = peer->next; 2404 } 2405} 2406 2407 2408static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2409{ 2410 struct wpa_tdls_peer *peer, *tmp; 2411 2412 peer = sm->tdls; 2413 sm->tdls = NULL; 2414 2415 while (peer) { 2416 int res; 2417 tmp = peer->next; 2418 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2419 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2420 MAC2STR(peer->addr), res); 2421 wpa_tdls_peer_free(sm, peer); 2422 os_free(peer); 2423 peer = tmp; 2424 } 2425} 2426 2427 2428/** 2429 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2430 * 2431 * This function is called to recover driver interface parameters for TDLS 2432 * and frees resources allocated for it. 2433 */ 2434void wpa_tdls_deinit(struct wpa_sm *sm) 2435{ 2436 if (sm == NULL) 2437 return; 2438 2439 if (sm->l2_tdls) 2440 l2_packet_deinit(sm->l2_tdls); 2441 sm->l2_tdls = NULL; 2442 2443 wpa_tdls_remove_peers(sm); 2444} 2445 2446 2447void wpa_tdls_assoc(struct wpa_sm *sm) 2448{ 2449 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2450 wpa_tdls_remove_peers(sm); 2451} 2452 2453 2454void wpa_tdls_disassoc(struct wpa_sm *sm) 2455{ 2456 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2457 wpa_tdls_remove_peers(sm); 2458} 2459 2460 2461static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2462{ 2463 struct wpa_eapol_ie_parse elems; 2464 2465 if (ies == NULL) 2466 return 0; 2467 2468 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2469 return 0; 2470 2471 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2472 return 0; 2473 2474 /* bit 38 - TDLS Prohibited */ 2475 return !!(elems.ext_capab[2 + 4] & 0x40); 2476} 2477 2478 2479void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2480{ 2481 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2482 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2483 sm->tdls_prohibited ? "prohibited" : "allowed"); 2484} 2485 2486 2487void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2488{ 2489 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2490 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2491 "(Re)Association Response IEs"); 2492 sm->tdls_prohibited = 1; 2493 } 2494} 2495 2496 2497void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2498{ 2499 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2500 sm->tdls_disabled = !enabled; 2501} 2502 2503 2504int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2505{ 2506 return sm->tdls_external_setup; 2507} 2508