tdls.c revision 661b4f78e48c697429dc46154a4125892c001718
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36#define TDLS_TESTING_WRONG_MIC BIT(11) 37unsigned int tdls_testing = 0; 38#endif /* CONFIG_TDLS_TESTING */ 39 40#define TPK_LIFETIME 43200 /* 12 hours */ 41#define TPK_M1_RETRY_COUNT 3 42#define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 43#define TPK_M2_RETRY_COUNT 10 44#define TPK_M2_TIMEOUT 500 /* in milliseconds */ 45 46#define TDLS_MIC_LEN 16 47 48#define TDLS_TIMEOUT_LEN 4 49 50struct wpa_tdls_ftie { 51 u8 ie_type; /* FTIE */ 52 u8 ie_len; 53 u8 mic_ctrl[2]; 54 u8 mic[TDLS_MIC_LEN]; 55 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 56 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 57 /* followed by optional elements */ 58} STRUCT_PACKED; 59 60struct wpa_tdls_timeoutie { 61 u8 ie_type; /* Timeout IE */ 62 u8 ie_len; 63 u8 interval_type; 64 u8 value[TDLS_TIMEOUT_LEN]; 65} STRUCT_PACKED; 66 67struct wpa_tdls_lnkid { 68 u8 ie_type; /* Link Identifier IE */ 69 u8 ie_len; 70 u8 bssid[ETH_ALEN]; 71 u8 init_sta[ETH_ALEN]; 72 u8 resp_sta[ETH_ALEN]; 73} STRUCT_PACKED; 74 75/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 76struct wpa_tdls_frame { 77 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 78 u8 category; /* Category */ 79 u8 action; /* Action (enum tdls_frame_type) */ 80} STRUCT_PACKED; 81 82static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 83static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 84static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 85static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 86 struct wpa_tdls_peer *peer); 87static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 88 u16 reason_code); 89 90 91#define TDLS_MAX_IE_LEN 80 92#define IEEE80211_MAX_SUPP_RATES 32 93 94struct wpa_tdls_peer { 95 struct wpa_tdls_peer *next; 96 unsigned int reconfig_key:1; 97 int initiator; /* whether this end was initiator for TDLS setup */ 98 u8 addr[ETH_ALEN]; /* other end MAC address */ 99 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 100 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 101 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 102 size_t rsnie_i_len; 103 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 104 size_t rsnie_p_len; 105 u32 lifetime; 106 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 107 u8 dtoken; 108 109 struct tpk { 110 u8 kck[16]; /* TPK-KCK */ 111 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 112 } tpk; 113 int tpk_set; 114 int tpk_success; 115 int tpk_in_progress; 116 117 struct tpk_timer { 118 u8 dest[ETH_ALEN]; 119 int count; /* Retry Count */ 120 int timer; /* Timeout in milliseconds */ 121 u8 action_code; /* TDLS frame type */ 122 u8 dialog_token; 123 u16 status_code; 124 u32 peer_capab; 125 int buf_len; /* length of TPK message for retransmission */ 126 u8 *buf; /* buffer for TPK message */ 127 } sm_tmr; 128 129 u16 capability; 130 131 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 132 size_t supp_rates_len; 133 134 struct ieee80211_ht_capabilities *ht_capabilities; 135 struct ieee80211_vht_capabilities *vht_capabilities; 136 137 u8 qos_info; 138 139 u16 aid; 140 141 u8 *ext_capab; 142 size_t ext_capab_len; 143 144 u8 *supp_channels; 145 size_t supp_channels_len; 146 147 u8 *supp_oper_classes; 148 size_t supp_oper_classes_len; 149 150 u8 wmm_capable; 151}; 152 153 154static int wpa_tdls_get_privacy(struct wpa_sm *sm) 155{ 156 /* 157 * Get info needed from supplicant to check if the current BSS supports 158 * security. Other than OPEN mode, rest are considered secured 159 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 160 */ 161 return sm->pairwise_cipher != WPA_CIPHER_NONE; 162} 163 164 165static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 166{ 167 os_memcpy(pos, ie, ie_len); 168 return pos + ie_len; 169} 170 171 172static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 173{ 174 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 175 0, 0, NULL, 0, NULL, 0) < 0) { 176 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 177 "the driver"); 178 return -1; 179 } 180 181 return 0; 182} 183 184 185static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 186{ 187 u8 key_len; 188 u8 rsc[6]; 189 enum wpa_alg alg; 190 191 os_memset(rsc, 0, 6); 192 193 switch (peer->cipher) { 194 case WPA_CIPHER_CCMP: 195 alg = WPA_ALG_CCMP; 196 key_len = 16; 197 break; 198 case WPA_CIPHER_NONE: 199 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 200 "NONE - do not use pairwise keys"); 201 return -1; 202 default: 203 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 204 sm->pairwise_cipher); 205 return -1; 206 } 207 208 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 209 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 210 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 211 "driver"); 212 return -1; 213 } 214 return 0; 215} 216 217 218static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 219 u8 action_code, u8 dialog_token, 220 u16 status_code, u32 peer_capab, 221 const u8 *buf, size_t len) 222{ 223 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 224 status_code, peer_capab, buf, len); 225} 226 227 228static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 229 u8 dialog_token, u16 status_code, u32 peer_capab, 230 const u8 *msg, size_t msg_len) 231{ 232 struct wpa_tdls_peer *peer; 233 234 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 235 "dialog_token=%u status_code=%u peer_capab=%u msg_len=%u", 236 MAC2STR(dest), action_code, dialog_token, status_code, 237 peer_capab, (unsigned int) msg_len); 238 239 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 240 status_code, peer_capab, msg, msg_len)) { 241 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 242 "(action_code=%u)", action_code); 243 return -1; 244 } 245 246 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 247 action_code == WLAN_TDLS_TEARDOWN || 248 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 249 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 250 return 0; /* No retries */ 251 252 for (peer = sm->tdls; peer; peer = peer->next) { 253 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 254 break; 255 } 256 257 if (peer == NULL) { 258 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 259 "retry " MACSTR, MAC2STR(dest)); 260 return 0; 261 } 262 263 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 264 265 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 266 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 267 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 268 } else { 269 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 270 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 271 } 272 273 /* Copy message to resend on timeout */ 274 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 275 peer->sm_tmr.action_code = action_code; 276 peer->sm_tmr.dialog_token = dialog_token; 277 peer->sm_tmr.status_code = status_code; 278 peer->sm_tmr.peer_capab = peer_capab; 279 peer->sm_tmr.buf_len = msg_len; 280 os_free(peer->sm_tmr.buf); 281 peer->sm_tmr.buf = os_malloc(msg_len); 282 if (peer->sm_tmr.buf == NULL) 283 return -1; 284 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 285 286 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 287 "(action_code=%u)", action_code); 288 eloop_register_timeout(peer->sm_tmr.timer / 1000, 289 (peer->sm_tmr.timer % 1000) * 1000, 290 wpa_tdls_tpk_retry_timeout, sm, peer); 291 return 0; 292} 293 294 295static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 296 u16 reason_code) 297{ 298 int ret; 299 300 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 301 /* disable the link after teardown was sent */ 302 wpa_tdls_disable_peer_link(sm, peer); 303 304 return ret; 305} 306 307 308static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 309{ 310 311 struct wpa_sm *sm = eloop_ctx; 312 struct wpa_tdls_peer *peer = timeout_ctx; 313 314 if (peer->sm_tmr.count) { 315 peer->sm_tmr.count--; 316 317 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 318 "(action_code=%u)", 319 peer->sm_tmr.action_code); 320 321 if (peer->sm_tmr.buf == NULL) { 322 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 323 "for action_code=%u", 324 peer->sm_tmr.action_code); 325 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 326 peer); 327 return; 328 } 329 330 /* resend TPK Handshake Message to Peer */ 331 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 332 peer->sm_tmr.action_code, 333 peer->sm_tmr.dialog_token, 334 peer->sm_tmr.status_code, 335 peer->sm_tmr.peer_capab, 336 peer->sm_tmr.buf, 337 peer->sm_tmr.buf_len)) { 338 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 339 "transmission"); 340 } 341 342 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 343 eloop_register_timeout(peer->sm_tmr.timer / 1000, 344 (peer->sm_tmr.timer % 1000) * 1000, 345 wpa_tdls_tpk_retry_timeout, sm, peer); 346 } else { 347 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 348 349 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 350 wpa_tdls_do_teardown(sm, peer, 351 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 352 } 353} 354 355 356static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 357 struct wpa_tdls_peer *peer, 358 u8 action_code) 359{ 360 if (action_code == peer->sm_tmr.action_code) { 361 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 362 "action_code=%u", action_code); 363 364 /* Cancel Timeout registered */ 365 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 366 367 /* free all resources meant for retry */ 368 os_free(peer->sm_tmr.buf); 369 peer->sm_tmr.buf = NULL; 370 371 peer->sm_tmr.count = 0; 372 peer->sm_tmr.timer = 0; 373 peer->sm_tmr.buf_len = 0; 374 peer->sm_tmr.action_code = 0xff; 375 } else { 376 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 377 "(Unknown action_code=%u)", action_code); 378 } 379} 380 381 382static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 383 const u8 *own_addr, const u8 *bssid) 384{ 385 u8 key_input[SHA256_MAC_LEN]; 386 const u8 *nonce[2]; 387 size_t len[2]; 388 u8 data[3 * ETH_ALEN]; 389 390 /* IEEE Std 802.11z-2010 8.5.9.1: 391 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 392 */ 393 len[0] = WPA_NONCE_LEN; 394 len[1] = WPA_NONCE_LEN; 395 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 396 nonce[0] = peer->inonce; 397 nonce[1] = peer->rnonce; 398 } else { 399 nonce[0] = peer->rnonce; 400 nonce[1] = peer->inonce; 401 } 402 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 403 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 404 sha256_vector(2, nonce, len, key_input); 405 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 406 key_input, SHA256_MAC_LEN); 407 408 /* 409 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 410 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 411 * TODO: is N_KEY really included in KDF Context and if so, in which 412 * presentation format (little endian 16-bit?) is it used? It gets 413 * added by the KDF anyway.. 414 */ 415 416 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 417 os_memcpy(data, own_addr, ETH_ALEN); 418 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 419 } else { 420 os_memcpy(data, peer->addr, ETH_ALEN); 421 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 422 } 423 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 424 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 425 426 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 427 (u8 *) &peer->tpk, sizeof(peer->tpk)); 428 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 429 peer->tpk.kck, sizeof(peer->tpk.kck)); 430 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 431 peer->tpk.tk, sizeof(peer->tpk.tk)); 432 peer->tpk_set = 1; 433} 434 435 436/** 437 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 438 * @kck: TPK-KCK 439 * @lnkid: Pointer to the beginning of Link Identifier IE 440 * @rsnie: Pointer to the beginning of RSN IE used for handshake 441 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 442 * @ftie: Pointer to the beginning of FT IE 443 * @mic: Pointer for writing MIC 444 * 445 * Calculate MIC for TDLS frame. 446 */ 447static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 448 const u8 *rsnie, const u8 *timeoutie, 449 const u8 *ftie, u8 *mic) 450{ 451 u8 *buf, *pos; 452 struct wpa_tdls_ftie *_ftie; 453 const struct wpa_tdls_lnkid *_lnkid; 454 int ret; 455 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 456 2 + timeoutie[1] + 2 + ftie[1]; 457 buf = os_zalloc(len); 458 if (!buf) { 459 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 460 return -1; 461 } 462 463 pos = buf; 464 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 465 /* 1) TDLS initiator STA MAC address */ 466 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 467 pos += ETH_ALEN; 468 /* 2) TDLS responder STA MAC address */ 469 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 470 pos += ETH_ALEN; 471 /* 3) Transaction Sequence number */ 472 *pos++ = trans_seq; 473 /* 4) Link Identifier IE */ 474 os_memcpy(pos, lnkid, 2 + lnkid[1]); 475 pos += 2 + lnkid[1]; 476 /* 5) RSN IE */ 477 os_memcpy(pos, rsnie, 2 + rsnie[1]); 478 pos += 2 + rsnie[1]; 479 /* 6) Timeout Interval IE */ 480 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 481 pos += 2 + timeoutie[1]; 482 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 483 os_memcpy(pos, ftie, 2 + ftie[1]); 484 _ftie = (struct wpa_tdls_ftie *) pos; 485 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 486 pos += 2 + ftie[1]; 487 488 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 489 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 490 ret = omac1_aes_128(kck, buf, pos - buf, mic); 491 os_free(buf); 492 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 493 return ret; 494} 495 496 497/** 498 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 499 * @kck: TPK-KCK 500 * @trans_seq: Transaction Sequence Number (4 - Teardown) 501 * @rcode: Reason code for Teardown 502 * @dtoken: Dialog Token used for that particular link 503 * @lnkid: Pointer to the beginning of Link Identifier IE 504 * @ftie: Pointer to the beginning of FT IE 505 * @mic: Pointer for writing MIC 506 * 507 * Calculate MIC for TDLS frame. 508 */ 509static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 510 u8 dtoken, const u8 *lnkid, 511 const u8 *ftie, u8 *mic) 512{ 513 u8 *buf, *pos; 514 struct wpa_tdls_ftie *_ftie; 515 int ret; 516 int len; 517 518 if (lnkid == NULL) 519 return -1; 520 521 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 522 sizeof(trans_seq) + 2 + ftie[1]; 523 524 buf = os_zalloc(len); 525 if (!buf) { 526 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 527 return -1; 528 } 529 530 pos = buf; 531 /* 1) Link Identifier IE */ 532 os_memcpy(pos, lnkid, 2 + lnkid[1]); 533 pos += 2 + lnkid[1]; 534 /* 2) Reason Code */ 535 WPA_PUT_LE16(pos, rcode); 536 pos += sizeof(rcode); 537 /* 3) Dialog token */ 538 *pos++ = dtoken; 539 /* 4) Transaction Sequence number */ 540 *pos++ = trans_seq; 541 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 542 os_memcpy(pos, ftie, 2 + ftie[1]); 543 _ftie = (struct wpa_tdls_ftie *) pos; 544 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 545 pos += 2 + ftie[1]; 546 547 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 548 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 549 ret = omac1_aes_128(kck, buf, pos - buf, mic); 550 os_free(buf); 551 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 552 return ret; 553} 554 555 556static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 557 struct wpa_tdls_peer *peer, 558 const u8 *lnkid, const u8 *timeoutie, 559 const struct wpa_tdls_ftie *ftie) 560{ 561 u8 mic[16]; 562 563 if (peer->tpk_set) { 564 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 565 peer->rsnie_p, timeoutie, (u8 *) ftie, 566 mic); 567 if (os_memcmp_const(mic, ftie->mic, 16) != 0) { 568 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 569 "dropping packet"); 570 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 571 ftie->mic, 16); 572 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 573 mic, 16); 574 return -1; 575 } 576 } else { 577 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 578 "TPK not set - dropping packet"); 579 return -1; 580 } 581 return 0; 582} 583 584 585static int wpa_supplicant_verify_tdls_mic_teardown( 586 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 587 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 588{ 589 u8 mic[16]; 590 591 if (peer->tpk_set) { 592 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 593 dtoken, lnkid, (u8 *) ftie, mic); 594 if (os_memcmp_const(mic, ftie->mic, 16) != 0) { 595 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 596 "dropping packet"); 597 return -1; 598 } 599 } else { 600 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 601 "MIC, TPK not set - dropping packet"); 602 return -1; 603 } 604 return 0; 605} 606 607 608static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 609{ 610 struct wpa_sm *sm = eloop_ctx; 611 struct wpa_tdls_peer *peer = timeout_ctx; 612 613 /* 614 * On TPK lifetime expiration, we have an option of either tearing down 615 * the direct link or trying to re-initiate it. The selection of what 616 * to do is not strictly speaking controlled by our role in the expired 617 * link, but for now, use that to select whether to renew or tear down 618 * the link. 619 */ 620 621 if (peer->initiator) { 622 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 623 " - try to renew", MAC2STR(peer->addr)); 624 wpa_tdls_start(sm, peer->addr); 625 } else { 626 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 627 " - tear down", MAC2STR(peer->addr)); 628 wpa_tdls_do_teardown(sm, peer, 629 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 630 } 631} 632 633 634static void wpa_tdls_peer_remove_from_list(struct wpa_sm *sm, 635 struct wpa_tdls_peer *peer) 636{ 637 struct wpa_tdls_peer *cur, *prev; 638 639 cur = sm->tdls; 640 prev = NULL; 641 while (cur && cur != peer) { 642 prev = cur; 643 cur = cur->next; 644 } 645 646 if (cur != peer) { 647 wpa_printf(MSG_ERROR, "TDLS: Could not find peer " MACSTR 648 " to remove it from the list", 649 MAC2STR(peer->addr)); 650 return; 651 } 652 653 if (prev) 654 prev->next = peer->next; 655 else 656 sm->tdls = peer->next; 657} 658 659 660static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 661{ 662 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 663 MAC2STR(peer->addr)); 664 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 665 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 666 peer->reconfig_key = 0; 667 peer->initiator = 0; 668 peer->tpk_in_progress = 0; 669 os_free(peer->sm_tmr.buf); 670 peer->sm_tmr.buf = NULL; 671 os_free(peer->ht_capabilities); 672 peer->ht_capabilities = NULL; 673 os_free(peer->vht_capabilities); 674 peer->vht_capabilities = NULL; 675 os_free(peer->ext_capab); 676 peer->ext_capab = NULL; 677 os_free(peer->supp_channels); 678 peer->supp_channels = NULL; 679 os_free(peer->supp_oper_classes); 680 peer->supp_oper_classes = NULL; 681 peer->rsnie_i_len = peer->rsnie_p_len = 0; 682 peer->cipher = 0; 683 peer->qos_info = 0; 684 peer->wmm_capable = 0; 685 peer->tpk_set = peer->tpk_success = 0; 686 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 687 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 688 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 689} 690 691 692static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 693{ 694 wpa_tdls_peer_clear(sm, peer); 695 wpa_tdls_peer_remove_from_list(sm, peer); 696 os_free(peer); 697} 698 699 700static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 701 struct wpa_tdls_lnkid *lnkid) 702{ 703 lnkid->ie_type = WLAN_EID_LINK_ID; 704 lnkid->ie_len = 3 * ETH_ALEN; 705 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 706 if (peer->initiator) { 707 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 708 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 709 } else { 710 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 711 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 712 } 713} 714 715 716static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, 717 u16 reason_code) 718{ 719 struct wpa_tdls_peer *peer; 720 struct wpa_tdls_ftie *ftie; 721 struct wpa_tdls_lnkid lnkid; 722 u8 dialog_token; 723 u8 *rbuf, *pos; 724 int ielen; 725 726 if (sm->tdls_disabled || !sm->tdls_supported) 727 return -1; 728 729 /* Find the node and free from the list */ 730 for (peer = sm->tdls; peer; peer = peer->next) { 731 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 732 break; 733 } 734 735 if (peer == NULL) { 736 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 737 "Teardown " MACSTR, MAC2STR(addr)); 738 return 0; 739 } 740 741 dialog_token = peer->dtoken; 742 743 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 744 MAC2STR(addr)); 745 746 ielen = 0; 747 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 748 /* To add FTIE for Teardown request and compute MIC */ 749 ielen += sizeof(*ftie); 750#ifdef CONFIG_TDLS_TESTING 751 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 752 ielen += 170; 753#endif /* CONFIG_TDLS_TESTING */ 754 } 755 756 rbuf = os_zalloc(ielen + 1); 757 if (rbuf == NULL) 758 return -1; 759 pos = rbuf; 760 761 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 762 goto skip_ies; 763 764 ftie = (struct wpa_tdls_ftie *) pos; 765 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 766 /* Using the recent nonce which should be for CONFIRM frame */ 767 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 768 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 769 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 770 pos = (u8 *) (ftie + 1); 771#ifdef CONFIG_TDLS_TESTING 772 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 773 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 774 "FTIE"); 775 ftie->ie_len += 170; 776 *pos++ = 255; /* FTIE subelem */ 777 *pos++ = 168; /* FTIE subelem length */ 778 pos += 168; 779 } 780#endif /* CONFIG_TDLS_TESTING */ 781 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 782 (u8 *) ftie, pos - (u8 *) ftie); 783 784 /* compute MIC before sending */ 785 wpa_tdls_linkid(sm, peer, &lnkid); 786 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 787 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 788 ftie->mic); 789 790skip_ies: 791 /* TODO: register for a Timeout handler, if Teardown is not received at 792 * the other end, then try again another time */ 793 794 /* request driver to send Teardown using this FTIE */ 795 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 796 reason_code, 0, rbuf, pos - rbuf); 797 os_free(rbuf); 798 799 return 0; 800} 801 802 803int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 804{ 805 struct wpa_tdls_peer *peer; 806 807 if (sm->tdls_disabled || !sm->tdls_supported) 808 return -1; 809 810 for (peer = sm->tdls; peer; peer = peer->next) { 811 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 812 break; 813 } 814 815 if (peer == NULL) { 816 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 817 " for link Teardown", MAC2STR(addr)); 818 return -1; 819 } 820 821 if (!peer->tpk_success) { 822 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 823 " not connected - cannot Teardown link", MAC2STR(addr)); 824 return -1; 825 } 826 827 return wpa_tdls_do_teardown(sm, peer, reason_code); 828} 829 830 831static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 832 struct wpa_tdls_peer *peer) 833{ 834 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 835 wpa_tdls_peer_free(sm, peer); 836} 837 838 839void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr) 840{ 841 struct wpa_tdls_peer *peer; 842 843 for (peer = sm->tdls; peer; peer = peer->next) { 844 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 845 break; 846 } 847 848 if (!peer || !peer->tpk_success) { 849 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 850 " not connected - cannot teardown unreachable link", 851 MAC2STR(addr)); 852 return; 853 } 854 855 if (wpa_tdls_is_external_setup(sm)) { 856 /* 857 * Disable the link, send a teardown packet through the 858 * AP, and then reset link data. 859 */ 860 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr); 861 wpa_tdls_send_teardown(sm, addr, 862 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE); 863 wpa_tdls_peer_free(sm, peer); 864 } else { 865 wpa_tdls_disable_peer_link(sm, peer); 866 } 867} 868 869 870const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr) 871{ 872 struct wpa_tdls_peer *peer; 873 874 if (sm->tdls_disabled || !sm->tdls_supported) 875 return "disabled"; 876 877 for (peer = sm->tdls; peer; peer = peer->next) { 878 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 879 break; 880 } 881 882 if (peer == NULL) 883 return "peer does not exist"; 884 885 if (!peer->tpk_success) 886 return "peer not connected"; 887 888 return "connected"; 889} 890 891 892static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 893 const u8 *buf, size_t len) 894{ 895 struct wpa_tdls_peer *peer = NULL; 896 struct wpa_tdls_ftie *ftie; 897 struct wpa_tdls_lnkid *lnkid; 898 struct wpa_eapol_ie_parse kde; 899 u16 reason_code; 900 const u8 *pos; 901 int ielen; 902 903 /* Find the node and free from the list */ 904 for (peer = sm->tdls; peer; peer = peer->next) { 905 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 906 break; 907 } 908 909 if (peer == NULL) { 910 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 911 "Teardown " MACSTR, MAC2STR(src_addr)); 912 return 0; 913 } 914 915 pos = buf; 916 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 917 918 reason_code = WPA_GET_LE16(pos); 919 pos += 2; 920 921 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 922 " (reason code %u)", MAC2STR(src_addr), reason_code); 923 924 ielen = len - (pos - buf); /* start of IE in buf */ 925 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 926 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 927 return -1; 928 } 929 930 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 931 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 932 "Teardown"); 933 return -1; 934 } 935 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 936 937 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 938 goto skip_ftie; 939 940 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 941 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 942 return -1; 943 } 944 945 ftie = (struct wpa_tdls_ftie *) kde.ftie; 946 947 /* Process MIC check to see if TDLS Teardown is right */ 948 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 949 peer->dtoken, peer, 950 (u8 *) lnkid, ftie) < 0) { 951 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 952 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 953 return -1; 954 } 955 956skip_ftie: 957 /* 958 * Request the driver to disable the direct link and clear associated 959 * keys. 960 */ 961 wpa_tdls_disable_peer_link(sm, peer); 962 return 0; 963} 964 965 966/** 967 * wpa_tdls_send_error - To send suitable TDLS status response with 968 * appropriate status code mentioning reason for error/failure. 969 * @dst - MAC addr of Peer station 970 * @tdls_action - TDLS frame type for which error code is sent 971 * @status - status code mentioning reason 972 */ 973 974static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 975 u8 tdls_action, u8 dialog_token, u16 status) 976{ 977 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 978 " (action=%u status=%u)", 979 MAC2STR(dst), tdls_action, status); 980 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 981 0, NULL, 0); 982} 983 984 985static struct wpa_tdls_peer * 986wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 987{ 988 struct wpa_tdls_peer *peer; 989 990 if (existing) 991 *existing = 0; 992 for (peer = sm->tdls; peer; peer = peer->next) { 993 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 994 if (existing) 995 *existing = 1; 996 return peer; /* re-use existing entry */ 997 } 998 } 999 1000 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 1001 MAC2STR(addr)); 1002 1003 peer = os_zalloc(sizeof(*peer)); 1004 if (peer == NULL) 1005 return NULL; 1006 1007 os_memcpy(peer->addr, addr, ETH_ALEN); 1008 peer->next = sm->tdls; 1009 sm->tdls = peer; 1010 1011 return peer; 1012} 1013 1014 1015static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 1016 struct wpa_tdls_peer *peer) 1017{ 1018 size_t buf_len; 1019 struct wpa_tdls_timeoutie timeoutie; 1020 u16 rsn_capab; 1021 struct wpa_tdls_ftie *ftie; 1022 u8 *rbuf, *pos, *count_pos; 1023 u16 count; 1024 struct rsn_ie_hdr *hdr; 1025 int status; 1026 1027 if (!wpa_tdls_get_privacy(sm)) { 1028 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 1029 peer->rsnie_i_len = 0; 1030 goto skip_rsnie; 1031 } 1032 1033 /* 1034 * TPK Handshake Message 1: 1035 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 1036 * Timeout Interval IE)) 1037 */ 1038 1039 /* Filling RSN IE */ 1040 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 1041 hdr->elem_id = WLAN_EID_RSN; 1042 WPA_PUT_LE16(hdr->version, RSN_VERSION); 1043 1044 pos = (u8 *) (hdr + 1); 1045 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1046 pos += RSN_SELECTOR_LEN; 1047 count_pos = pos; 1048 pos += 2; 1049 1050 count = 0; 1051 1052 /* 1053 * AES-CCMP is the default Encryption preferred for TDLS, so 1054 * RSN IE is filled only with CCMP CIPHER 1055 * Note: TKIP is not used to encrypt TDLS link. 1056 * 1057 * Regardless of the cipher used on the AP connection, select CCMP 1058 * here. 1059 */ 1060 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1061 pos += RSN_SELECTOR_LEN; 1062 count++; 1063 1064 WPA_PUT_LE16(count_pos, count); 1065 1066 WPA_PUT_LE16(pos, 1); 1067 pos += 2; 1068 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1069 pos += RSN_SELECTOR_LEN; 1070 1071 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1072 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1073#ifdef CONFIG_TDLS_TESTING 1074 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1075 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 1076 "testing"); 1077 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1078 } 1079#endif /* CONFIG_TDLS_TESTING */ 1080 WPA_PUT_LE16(pos, rsn_capab); 1081 pos += 2; 1082#ifdef CONFIG_TDLS_TESTING 1083 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 1084 /* Number of PMKIDs */ 1085 *pos++ = 0x00; 1086 *pos++ = 0x00; 1087 } 1088#endif /* CONFIG_TDLS_TESTING */ 1089 1090 hdr->len = (pos - peer->rsnie_i) - 2; 1091 peer->rsnie_i_len = pos - peer->rsnie_i; 1092 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1093 peer->rsnie_i, peer->rsnie_i_len); 1094 1095skip_rsnie: 1096 buf_len = 0; 1097 if (wpa_tdls_get_privacy(sm)) 1098 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1099 sizeof(struct wpa_tdls_timeoutie); 1100#ifdef CONFIG_TDLS_TESTING 1101 if (wpa_tdls_get_privacy(sm) && 1102 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1103 buf_len += 170; 1104 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1105 buf_len += sizeof(struct wpa_tdls_lnkid); 1106#endif /* CONFIG_TDLS_TESTING */ 1107 rbuf = os_zalloc(buf_len + 1); 1108 if (rbuf == NULL) { 1109 wpa_tdls_peer_free(sm, peer); 1110 return -1; 1111 } 1112 pos = rbuf; 1113 1114 if (!wpa_tdls_get_privacy(sm)) 1115 goto skip_ies; 1116 1117 /* Initiator RSN IE */ 1118 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1119 1120 ftie = (struct wpa_tdls_ftie *) pos; 1121 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1122 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1123 1124 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1125 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1126 "TDLS: Failed to get random data for initiator Nonce"); 1127 os_free(rbuf); 1128 wpa_tdls_peer_free(sm, peer); 1129 return -1; 1130 } 1131 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1132 peer->inonce, WPA_NONCE_LEN); 1133 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1134 1135 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1136 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1137 1138 pos = (u8 *) (ftie + 1); 1139 1140#ifdef CONFIG_TDLS_TESTING 1141 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1142 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1143 "FTIE"); 1144 ftie->ie_len += 170; 1145 *pos++ = 255; /* FTIE subelem */ 1146 *pos++ = 168; /* FTIE subelem length */ 1147 pos += 168; 1148 } 1149#endif /* CONFIG_TDLS_TESTING */ 1150 1151 /* Lifetime */ 1152 peer->lifetime = TPK_LIFETIME; 1153#ifdef CONFIG_TDLS_TESTING 1154 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1155 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1156 "lifetime"); 1157 peer->lifetime = 301; 1158 } 1159 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1160 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1161 "lifetime"); 1162 peer->lifetime = 0xffffffff; 1163 } 1164#endif /* CONFIG_TDLS_TESTING */ 1165 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1166 sizeof(timeoutie), peer->lifetime); 1167 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1168 1169skip_ies: 1170 1171#ifdef CONFIG_TDLS_TESTING 1172 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1173 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1174 "Link Identifier"); 1175 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1176 wpa_tdls_linkid(sm, peer, l); 1177 l->bssid[5] ^= 0x01; 1178 pos += sizeof(*l); 1179 } 1180#endif /* CONFIG_TDLS_TESTING */ 1181 1182 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1183 "Handshake Message 1 (peer " MACSTR ")", 1184 MAC2STR(peer->addr)); 1185 1186 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1187 1, 0, 0, rbuf, pos - rbuf); 1188 os_free(rbuf); 1189 1190 return status; 1191} 1192 1193 1194static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1195 const unsigned char *src_addr, u8 dtoken, 1196 struct wpa_tdls_lnkid *lnkid, 1197 const struct wpa_tdls_peer *peer) 1198{ 1199 u8 *rbuf, *pos; 1200 size_t buf_len; 1201 u32 lifetime; 1202 struct wpa_tdls_timeoutie timeoutie; 1203 struct wpa_tdls_ftie *ftie; 1204 int status; 1205 1206 buf_len = 0; 1207 if (wpa_tdls_get_privacy(sm)) { 1208 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1209 * Lifetime */ 1210 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1211 sizeof(struct wpa_tdls_timeoutie); 1212#ifdef CONFIG_TDLS_TESTING 1213 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1214 buf_len += 170; 1215#endif /* CONFIG_TDLS_TESTING */ 1216 } 1217 1218 rbuf = os_zalloc(buf_len + 1); 1219 if (rbuf == NULL) 1220 return -1; 1221 pos = rbuf; 1222 1223 if (!wpa_tdls_get_privacy(sm)) 1224 goto skip_ies; 1225 1226 /* Peer RSN IE */ 1227 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1228 1229 ftie = (struct wpa_tdls_ftie *) pos; 1230 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1231 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1232 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1233 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1234 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1235 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1236 (u8 *) ftie, sizeof(*ftie)); 1237 1238 pos = (u8 *) (ftie + 1); 1239 1240#ifdef CONFIG_TDLS_TESTING 1241 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1242 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1243 "FTIE"); 1244 ftie->ie_len += 170; 1245 *pos++ = 255; /* FTIE subelem */ 1246 *pos++ = 168; /* FTIE subelem length */ 1247 pos += 168; 1248 } 1249#endif /* CONFIG_TDLS_TESTING */ 1250 1251 /* Lifetime */ 1252 lifetime = peer->lifetime; 1253#ifdef CONFIG_TDLS_TESTING 1254 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1255 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1256 "lifetime in response"); 1257 lifetime++; 1258 } 1259#endif /* CONFIG_TDLS_TESTING */ 1260 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1261 sizeof(timeoutie), lifetime); 1262 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1263 lifetime); 1264 1265 /* compute MIC before sending */ 1266 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1267 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1268#ifdef CONFIG_TDLS_TESTING 1269 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1270 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1271 ftie->mic[0] ^= 0x01; 1272 } 1273#endif /* CONFIG_TDLS_TESTING */ 1274 1275skip_ies: 1276 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1277 dtoken, 0, 0, rbuf, pos - rbuf); 1278 os_free(rbuf); 1279 1280 return status; 1281} 1282 1283 1284static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1285 const unsigned char *src_addr, u8 dtoken, 1286 struct wpa_tdls_lnkid *lnkid, 1287 const struct wpa_tdls_peer *peer) 1288{ 1289 u8 *rbuf, *pos; 1290 size_t buf_len; 1291 struct wpa_tdls_ftie *ftie; 1292 struct wpa_tdls_timeoutie timeoutie; 1293 u32 lifetime; 1294 int status; 1295 u32 peer_capab = 0; 1296 1297 buf_len = 0; 1298 if (wpa_tdls_get_privacy(sm)) { 1299 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1300 * Lifetime */ 1301 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1302 sizeof(struct wpa_tdls_timeoutie); 1303#ifdef CONFIG_TDLS_TESTING 1304 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1305 buf_len += 170; 1306#endif /* CONFIG_TDLS_TESTING */ 1307 } 1308 1309 rbuf = os_zalloc(buf_len + 1); 1310 if (rbuf == NULL) 1311 return -1; 1312 pos = rbuf; 1313 1314 if (!wpa_tdls_get_privacy(sm)) 1315 goto skip_ies; 1316 1317 /* Peer RSN IE */ 1318 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1319 1320 ftie = (struct wpa_tdls_ftie *) pos; 1321 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1322 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1323 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1324 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1325 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1326 1327 pos = (u8 *) (ftie + 1); 1328 1329#ifdef CONFIG_TDLS_TESTING 1330 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1331 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1332 "FTIE"); 1333 ftie->ie_len += 170; 1334 *pos++ = 255; /* FTIE subelem */ 1335 *pos++ = 168; /* FTIE subelem length */ 1336 pos += 168; 1337 } 1338#endif /* CONFIG_TDLS_TESTING */ 1339 1340 /* Lifetime */ 1341 lifetime = peer->lifetime; 1342#ifdef CONFIG_TDLS_TESTING 1343 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1344 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1345 "lifetime in confirm"); 1346 lifetime++; 1347 } 1348#endif /* CONFIG_TDLS_TESTING */ 1349 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1350 sizeof(timeoutie), lifetime); 1351 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1352 lifetime); 1353 1354 /* compute MIC before sending */ 1355 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1356 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1357#ifdef CONFIG_TDLS_TESTING 1358 if (tdls_testing & TDLS_TESTING_WRONG_MIC) { 1359 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC"); 1360 ftie->mic[0] ^= 0x01; 1361 } 1362#endif /* CONFIG_TDLS_TESTING */ 1363 1364skip_ies: 1365 1366 if (peer->vht_capabilities) 1367 peer_capab |= TDLS_PEER_VHT; 1368 if (peer->ht_capabilities) 1369 peer_capab |= TDLS_PEER_HT; 1370 if (peer->wmm_capable) 1371 peer_capab |= TDLS_PEER_WMM; 1372 1373 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1374 dtoken, 0, peer_capab, rbuf, pos - rbuf); 1375 os_free(rbuf); 1376 1377 return status; 1378} 1379 1380 1381static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1382 struct wpa_tdls_peer *peer, 1383 u8 dialog_token) 1384{ 1385 size_t buf_len = 0; 1386 struct wpa_tdls_timeoutie timeoutie; 1387 u16 rsn_capab; 1388 u8 *rbuf, *pos, *count_pos; 1389 u16 count; 1390 struct rsn_ie_hdr *hdr; 1391 int status; 1392 1393 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1394 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1395 if (!wpa_tdls_get_privacy(sm)) 1396 goto skip_rsn_ies; 1397 1398 /* Filling RSN IE */ 1399 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 1400 hdr->elem_id = WLAN_EID_RSN; 1401 WPA_PUT_LE16(hdr->version, RSN_VERSION); 1402 pos = (u8 *) (hdr + 1); 1403 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1404 pos += RSN_SELECTOR_LEN; 1405 count_pos = pos; 1406 pos += 2; 1407 count = 0; 1408 1409 /* 1410 * AES-CCMP is the default encryption preferred for TDLS, so 1411 * RSN IE is filled only with CCMP cipher suite. 1412 * Note: TKIP is not used to encrypt TDLS link. 1413 * 1414 * Regardless of the cipher used on the AP connection, select CCMP 1415 * here. 1416 */ 1417 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1418 pos += RSN_SELECTOR_LEN; 1419 count++; 1420 WPA_PUT_LE16(count_pos, count); 1421 WPA_PUT_LE16(pos, 1); 1422 pos += 2; 1423 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1424 pos += RSN_SELECTOR_LEN; 1425 1426 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1427 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1428 WPA_PUT_LE16(pos, rsn_capab); 1429 pos += 2; 1430 hdr->len = (pos - (u8 *) hdr) - 2; 1431 peer->rsnie_i_len = pos - peer->rsnie_i; 1432 1433 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for Discovery Response", 1434 (u8 *) hdr, hdr->len + 2); 1435skip_rsn_ies: 1436 buf_len = 0; 1437 if (wpa_tdls_get_privacy(sm)) { 1438 /* Peer RSN IE, Lifetime */ 1439 buf_len += peer->rsnie_i_len + 1440 sizeof(struct wpa_tdls_timeoutie); 1441 } 1442 rbuf = os_zalloc(buf_len + 1); 1443 if (rbuf == NULL) { 1444 wpa_tdls_peer_free(sm, peer); 1445 return -1; 1446 } 1447 pos = rbuf; 1448 1449 if (!wpa_tdls_get_privacy(sm)) 1450 goto skip_ies; 1451 /* Initiator RSN IE */ 1452 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1453 /* Lifetime */ 1454 peer->lifetime = TPK_LIFETIME; 1455 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1456 sizeof(timeoutie), peer->lifetime); 1457 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1458skip_ies: 1459 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1460 dialog_token, 0, 0, rbuf, pos - rbuf); 1461 os_free(rbuf); 1462 1463 return status; 1464} 1465 1466 1467static int 1468wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1469 const u8 *buf, size_t len) 1470{ 1471 struct wpa_eapol_ie_parse kde; 1472 const struct wpa_tdls_lnkid *lnkid; 1473 struct wpa_tdls_peer *peer; 1474 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1475 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1476 u8 dialog_token; 1477 1478 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1479 MAC2STR(addr)); 1480 1481 if (len < min_req_len) { 1482 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1483 "%d", (int) len); 1484 return -1; 1485 } 1486 1487 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1488 1489 /* 1490 * Some APs will tack on a weird IE to the end of a TDLS 1491 * discovery request packet. This needn't fail the response, 1492 * since the required IE are verified separately. 1493 */ 1494 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1495 len - (sizeof(struct wpa_tdls_frame) + 1), 1496 &kde) < 0) { 1497 wpa_printf(MSG_DEBUG, 1498 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround"); 1499 } 1500 1501 if (!kde.lnkid) { 1502 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1503 "Request"); 1504 return -1; 1505 } 1506 1507 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1508 1509 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1510 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1511 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1512 return -1; 1513 } 1514 1515 peer = wpa_tdls_add_peer(sm, addr, NULL); 1516 if (peer == NULL) 1517 return -1; 1518 1519 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1520} 1521 1522 1523int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1524{ 1525 if (sm->tdls_disabled || !sm->tdls_supported) 1526 return -1; 1527 1528 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1529 MACSTR, MAC2STR(addr)); 1530 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1531 1, 0, 0, NULL, 0); 1532} 1533 1534 1535static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1536 struct wpa_tdls_peer *peer) 1537{ 1538 if (!kde->supp_rates) { 1539 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1540 return -1; 1541 } 1542 peer->supp_rates_len = merge_byte_arrays( 1543 peer->supp_rates, sizeof(peer->supp_rates), 1544 kde->supp_rates + 2, kde->supp_rates_len - 2, 1545 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1546 kde->ext_supp_rates_len - 2); 1547 return 0; 1548} 1549 1550 1551static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1552 struct wpa_tdls_peer *peer) 1553{ 1554 if (!kde->ht_capabilities || 1555 kde->ht_capabilities_len < 1556 sizeof(struct ieee80211_ht_capabilities) ) { 1557 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1558 "received"); 1559 return 0; 1560 } 1561 1562 if (!peer->ht_capabilities) { 1563 peer->ht_capabilities = 1564 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1565 if (peer->ht_capabilities == NULL) 1566 return -1; 1567 } 1568 1569 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1570 sizeof(struct ieee80211_ht_capabilities)); 1571 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1572 (u8 *) peer->ht_capabilities, 1573 sizeof(struct ieee80211_ht_capabilities)); 1574 1575 return 0; 1576} 1577 1578 1579static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1580 struct wpa_tdls_peer *peer) 1581{ 1582 if (!kde->vht_capabilities || 1583 kde->vht_capabilities_len < 1584 sizeof(struct ieee80211_vht_capabilities) ) { 1585 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1586 "received"); 1587 return 0; 1588 } 1589 1590 if (!peer->vht_capabilities) { 1591 peer->vht_capabilities = 1592 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1593 if (peer->vht_capabilities == NULL) 1594 return -1; 1595 } 1596 1597 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1598 sizeof(struct ieee80211_vht_capabilities)); 1599 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1600 (u8 *) peer->vht_capabilities, 1601 sizeof(struct ieee80211_vht_capabilities)); 1602 1603 return 0; 1604} 1605 1606 1607static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1608 struct wpa_tdls_peer *peer) 1609{ 1610 if (!kde->ext_capab) { 1611 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1612 "received"); 1613 return 0; 1614 } 1615 1616 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1617 /* Need to allocate buffer to fit the new information */ 1618 os_free(peer->ext_capab); 1619 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1620 if (peer->ext_capab == NULL) 1621 return -1; 1622 } 1623 1624 peer->ext_capab_len = kde->ext_capab_len - 2; 1625 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1626 1627 return 0; 1628} 1629 1630 1631static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde, 1632 struct wpa_tdls_peer *peer) 1633{ 1634 struct wmm_information_element *wmm; 1635 1636 if (!kde->wmm) { 1637 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received"); 1638 return 0; 1639 } 1640 1641 if (kde->wmm_len < sizeof(struct wmm_information_element)) { 1642 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received"); 1643 return -1; 1644 } 1645 1646 wmm = (struct wmm_information_element *) kde->wmm; 1647 peer->qos_info = wmm->qos_info; 1648 1649 peer->wmm_capable = 1; 1650 1651 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info); 1652 return 0; 1653} 1654 1655 1656static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde, 1657 struct wpa_tdls_peer *peer) 1658{ 1659 if (!kde->supp_channels) { 1660 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received"); 1661 return 0; 1662 } 1663 1664 if (!peer->supp_channels || 1665 peer->supp_channels_len < kde->supp_channels_len) { 1666 os_free(peer->supp_channels); 1667 peer->supp_channels = os_zalloc(kde->supp_channels_len); 1668 if (peer->supp_channels == NULL) 1669 return -1; 1670 } 1671 1672 peer->supp_channels_len = kde->supp_channels_len; 1673 1674 os_memcpy(peer->supp_channels, kde->supp_channels, 1675 peer->supp_channels_len); 1676 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels", 1677 (u8 *) peer->supp_channels, peer->supp_channels_len); 1678 return 0; 1679} 1680 1681 1682static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde, 1683 struct wpa_tdls_peer *peer) 1684{ 1685 if (!kde->supp_oper_classes) { 1686 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received"); 1687 return 0; 1688 } 1689 1690 if (!peer->supp_oper_classes || 1691 peer->supp_oper_classes_len < kde->supp_oper_classes_len) { 1692 os_free(peer->supp_oper_classes); 1693 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len); 1694 if (peer->supp_oper_classes == NULL) 1695 return -1; 1696 } 1697 1698 peer->supp_oper_classes_len = kde->supp_oper_classes_len; 1699 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes, 1700 peer->supp_oper_classes_len); 1701 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes", 1702 (u8 *) peer->supp_oper_classes, 1703 peer->supp_oper_classes_len); 1704 return 0; 1705} 1706 1707 1708static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 1709 int add) 1710{ 1711 return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid, 1712 peer->capability, 1713 peer->supp_rates, peer->supp_rates_len, 1714 peer->ht_capabilities, 1715 peer->vht_capabilities, 1716 peer->qos_info, peer->ext_capab, 1717 peer->ext_capab_len, 1718 peer->supp_channels, 1719 peer->supp_channels_len, 1720 peer->supp_oper_classes, 1721 peer->supp_oper_classes_len); 1722} 1723 1724 1725static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1726 const u8 *buf, size_t len) 1727{ 1728 struct wpa_tdls_peer *peer; 1729 struct wpa_eapol_ie_parse kde; 1730 struct wpa_ie_data ie; 1731 int cipher; 1732 const u8 *cpos; 1733 struct wpa_tdls_ftie *ftie = NULL; 1734 struct wpa_tdls_timeoutie *timeoutie; 1735 struct wpa_tdls_lnkid *lnkid; 1736 u32 lifetime = 0; 1737#if 0 1738 struct rsn_ie_hdr *hdr; 1739 u8 *pos; 1740 u16 rsn_capab; 1741 u16 rsn_ver; 1742#endif 1743 u8 dtoken; 1744 u16 ielen; 1745 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1746 int tdls_prohibited = sm->tdls_prohibited; 1747 int existing_peer = 0; 1748 1749 if (len < 3 + 3) 1750 return -1; 1751 1752 cpos = buf; 1753 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1754 1755 /* driver had already verified the frame format */ 1756 dtoken = *cpos++; /* dialog token */ 1757 1758 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1759 1760 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1761 if (peer == NULL) 1762 goto error; 1763 1764 /* If found, use existing entry instead of adding a new one; 1765 * how to handle the case where both ends initiate at the 1766 * same time? */ 1767 if (existing_peer) { 1768 if (peer->tpk_success) { 1769 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1770 "direct link is enabled - tear down the " 1771 "old link first"); 1772 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 1773 wpa_tdls_peer_clear(sm, peer); 1774 } else if (peer->initiator) { 1775 /* 1776 * An entry is already present, so check if we already 1777 * sent a TDLS Setup Request. If so, compare MAC 1778 * addresses and let the STA with the lower MAC address 1779 * continue as the initiator. The other negotiation is 1780 * terminated. 1781 */ 1782 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1783 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1784 "from peer with higher address " 1785 MACSTR, MAC2STR(src_addr)); 1786 return -1; 1787 } else { 1788 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1789 "from peer with lower address " 1790 MACSTR " (terminate previously " 1791 "initiated negotiation", 1792 MAC2STR(src_addr)); 1793 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1794 peer->addr); 1795 wpa_tdls_peer_clear(sm, peer); 1796 } 1797 } 1798 } 1799 1800 /* capability information */ 1801 peer->capability = WPA_GET_LE16(cpos); 1802 cpos += 2; 1803 1804 ielen = len - (cpos - buf); /* start of IE in buf */ 1805 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1806 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1807 goto error; 1808 } 1809 1810 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1811 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1812 "TPK M1"); 1813 goto error; 1814 } 1815 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1816 kde.lnkid, kde.lnkid_len); 1817 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1818 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1819 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1820 status = WLAN_STATUS_REQUEST_DECLINED; 1821 goto error; 1822 } 1823 1824 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1825 MAC2STR(src_addr)); 1826 1827 if (copy_supp_rates(&kde, peer) < 0) 1828 goto error; 1829 1830 if (copy_peer_ht_capab(&kde, peer) < 0) 1831 goto error; 1832 1833 if (copy_peer_vht_capab(&kde, peer) < 0) 1834 goto error; 1835 1836 if (copy_peer_ext_capab(&kde, peer) < 0) 1837 goto error; 1838 1839 if (copy_peer_supp_channels(&kde, peer) < 0) 1840 goto error; 1841 1842 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 1843 goto error; 1844 1845 peer->qos_info = kde.qosinfo; 1846 1847 /* Overwrite with the qos_info obtained in WMM IE */ 1848 if (copy_peer_wmm_capab(&kde, peer) < 0) 1849 goto error; 1850 1851 peer->aid = kde.aid; 1852 1853#ifdef CONFIG_TDLS_TESTING 1854 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1855 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1856 if (peer == NULL) 1857 goto error; 1858 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1859 "TDLS setup - send own request"); 1860 peer->initiator = 1; 1861 wpa_tdls_send_tpk_m1(sm, peer); 1862 } 1863 1864 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1865 tdls_prohibited) { 1866 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1867 "on TDLS"); 1868 tdls_prohibited = 0; 1869 } 1870#endif /* CONFIG_TDLS_TESTING */ 1871 1872 if (tdls_prohibited) { 1873 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1874 status = WLAN_STATUS_REQUEST_DECLINED; 1875 goto error; 1876 } 1877 1878 if (!wpa_tdls_get_privacy(sm)) { 1879 if (kde.rsn_ie) { 1880 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1881 "security is disabled"); 1882 status = WLAN_STATUS_SECURITY_DISABLED; 1883 goto error; 1884 } 1885 goto skip_rsn; 1886 } 1887 1888 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1889 kde.rsn_ie == NULL) { 1890 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1891 status = WLAN_STATUS_INVALID_PARAMETERS; 1892 goto error; 1893 } 1894 1895 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1896 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1897 "TPK M1"); 1898 status = WLAN_STATUS_INVALID_RSNIE; 1899 goto error; 1900 } 1901 1902 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1903 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1904 status = WLAN_STATUS_INVALID_RSNIE; 1905 goto error; 1906 } 1907 1908 cipher = ie.pairwise_cipher; 1909 if (cipher & WPA_CIPHER_CCMP) { 1910 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1911 cipher = WPA_CIPHER_CCMP; 1912 } else { 1913 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1914 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1915 goto error; 1916 } 1917 1918 if ((ie.capabilities & 1919 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1920 WPA_CAPABILITY_PEERKEY_ENABLED) { 1921 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1922 "TPK M1"); 1923 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1924 goto error; 1925 } 1926 1927 /* Lifetime */ 1928 if (kde.key_lifetime == NULL) { 1929 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1930 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1931 goto error; 1932 } 1933 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1934 lifetime = WPA_GET_LE32(timeoutie->value); 1935 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1936 if (lifetime < 300) { 1937 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1938 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1939 goto error; 1940 } 1941 1942skip_rsn: 1943#ifdef CONFIG_TDLS_TESTING 1944 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1945 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1946 /* 1947 * The request frame from us is going to win, so do not 1948 * replace information based on this request frame from 1949 * the peer. 1950 */ 1951 goto skip_rsn_check; 1952 } 1953 } 1954#endif /* CONFIG_TDLS_TESTING */ 1955 1956 peer->initiator = 0; /* Need to check */ 1957 peer->dtoken = dtoken; 1958 1959 if (!wpa_tdls_get_privacy(sm)) { 1960 peer->rsnie_i_len = 0; 1961 peer->rsnie_p_len = 0; 1962 peer->cipher = WPA_CIPHER_NONE; 1963 goto skip_rsn_check; 1964 } 1965 1966 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1967 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1968 peer->rsnie_i_len = kde.rsn_ie_len; 1969 peer->cipher = cipher; 1970 1971 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1972 /* 1973 * There is no point in updating the RNonce for every obtained 1974 * TPK M1 frame (e.g., retransmission due to timeout) with the 1975 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1976 * retransmitted with a different INonce, update the RNonce 1977 * since this is for a new TDLS session. 1978 */ 1979 wpa_printf(MSG_DEBUG, 1980 "TDLS: New TPK M1 INonce - generate new RNonce"); 1981 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1982 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1983 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1984 "TDLS: Failed to get random data for responder nonce"); 1985 goto error; 1986 } 1987 } 1988 1989#if 0 1990 /* get version info from RSNIE received from Peer */ 1991 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1992 rsn_ver = WPA_GET_LE16(hdr->version); 1993 1994 /* use min(peer's version, out version) */ 1995 if (rsn_ver > RSN_VERSION) 1996 rsn_ver = RSN_VERSION; 1997 1998 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1999 2000 hdr->elem_id = WLAN_EID_RSN; 2001 WPA_PUT_LE16(hdr->version, rsn_ver); 2002 pos = (u8 *) (hdr + 1); 2003 2004 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 2005 pos += RSN_SELECTOR_LEN; 2006 /* Include only the selected cipher in pairwise cipher suite */ 2007 WPA_PUT_LE16(pos, 1); 2008 pos += 2; 2009 if (cipher == WPA_CIPHER_CCMP) 2010 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 2011 pos += RSN_SELECTOR_LEN; 2012 2013 WPA_PUT_LE16(pos, 1); 2014 pos += 2; 2015 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 2016 pos += RSN_SELECTOR_LEN; 2017 2018 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 2019 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 2020 WPA_PUT_LE16(pos, rsn_capab); 2021 pos += 2; 2022 2023 hdr->len = (pos - peer->rsnie_p) - 2; 2024 peer->rsnie_p_len = pos - peer->rsnie_p; 2025#endif 2026 2027 /* temp fix: validation of RSNIE later */ 2028 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 2029 peer->rsnie_p_len = peer->rsnie_i_len; 2030 2031 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 2032 peer->rsnie_p, peer->rsnie_p_len); 2033 2034 peer->lifetime = lifetime; 2035 2036 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2037 2038skip_rsn_check: 2039 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 2040 if (wpa_tdls_addset_peer(sm, peer, 1) < 0) 2041 goto error; 2042 2043 peer->tpk_in_progress = 1; 2044 2045 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 2046 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 2047 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2048 goto error; 2049 } 2050 2051 return 0; 2052 2053error: 2054 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 2055 status); 2056 if (peer) 2057 wpa_tdls_peer_free(sm, peer); 2058 return -1; 2059} 2060 2061 2062static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 2063{ 2064 peer->tpk_success = 1; 2065 peer->tpk_in_progress = 0; 2066 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 2067 if (wpa_tdls_get_privacy(sm)) { 2068 u32 lifetime = peer->lifetime; 2069 /* 2070 * Start the initiator process a bit earlier to avoid race 2071 * condition with the responder sending teardown request. 2072 */ 2073 if (lifetime > 3 && peer->initiator) 2074 lifetime -= 3; 2075 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 2076 sm, peer); 2077#ifdef CONFIG_TDLS_TESTING 2078 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 2079 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 2080 "expiration"); 2081 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 2082 } 2083#endif /* CONFIG_TDLS_TESTING */ 2084 } 2085 2086 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 2087 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 2088 "driver"); 2089 return -1; 2090 } 2091 peer->reconfig_key = 0; 2092 2093 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 2094} 2095 2096 2097static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 2098 const u8 *buf, size_t len) 2099{ 2100 struct wpa_tdls_peer *peer; 2101 struct wpa_eapol_ie_parse kde; 2102 struct wpa_ie_data ie; 2103 int cipher; 2104 struct wpa_tdls_ftie *ftie; 2105 struct wpa_tdls_timeoutie *timeoutie; 2106 struct wpa_tdls_lnkid *lnkid; 2107 u32 lifetime; 2108 u8 dtoken; 2109 int ielen; 2110 u16 status; 2111 const u8 *pos; 2112 int ret = 0; 2113 2114 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 2115 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2116 for (peer = sm->tdls; peer; peer = peer->next) { 2117 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2118 break; 2119 } 2120 if (peer == NULL) { 2121 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2122 "TPK M2: " MACSTR, MAC2STR(src_addr)); 2123 return -1; 2124 } 2125 if (!peer->initiator) { 2126 /* 2127 * This may happen if both devices try to initiate TDLS at the 2128 * same time and we accept the TPK M1 from the peer in 2129 * wpa_tdls_process_tpk_m1() and clear our previous state. 2130 */ 2131 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 2132 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 2133 return -1; 2134 } 2135 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 2136 2137 if (len < 3 + 2 + 1) { 2138 wpa_tdls_disable_peer_link(sm, peer); 2139 return -1; 2140 } 2141 2142 pos = buf; 2143 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2144 status = WPA_GET_LE16(pos); 2145 pos += 2 /* status code */; 2146 2147 if (status != WLAN_STATUS_SUCCESS) { 2148 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 2149 status); 2150 wpa_tdls_disable_peer_link(sm, peer); 2151 return -1; 2152 } 2153 2154 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 2155 2156 /* TODO: need to verify dialog token matches here or in kernel */ 2157 dtoken = *pos++; /* dialog token */ 2158 2159 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 2160 2161 if (len < 3 + 2 + 1 + 2) { 2162 wpa_tdls_disable_peer_link(sm, peer); 2163 return -1; 2164 } 2165 2166 /* capability information */ 2167 peer->capability = WPA_GET_LE16(pos); 2168 pos += 2; 2169 2170 ielen = len - (pos - buf); /* start of IE in buf */ 2171 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 2172 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 2173 goto error; 2174 } 2175 2176#ifdef CONFIG_TDLS_TESTING 2177 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 2178 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 2179 status = WLAN_STATUS_REQUEST_DECLINED; 2180 goto error; 2181 } 2182#endif /* CONFIG_TDLS_TESTING */ 2183 2184 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2185 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 2186 "TPK M2"); 2187 goto error; 2188 } 2189 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 2190 kde.lnkid, kde.lnkid_len); 2191 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2192 2193 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2194 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 2195 status = WLAN_STATUS_NOT_IN_SAME_BSS; 2196 goto error; 2197 } 2198 2199 if (copy_supp_rates(&kde, peer) < 0) 2200 goto error; 2201 2202 if (copy_peer_ht_capab(&kde, peer) < 0) 2203 goto error; 2204 2205 if (copy_peer_vht_capab(&kde, peer) < 0) 2206 goto error; 2207 2208 if (copy_peer_ext_capab(&kde, peer) < 0) 2209 goto error; 2210 2211 if (copy_peer_supp_channels(&kde, peer) < 0) 2212 goto error; 2213 2214 if (copy_peer_supp_oper_classes(&kde, peer) < 0) 2215 goto error; 2216 2217 peer->qos_info = kde.qosinfo; 2218 2219 /* Overwrite with the qos_info obtained in WMM IE */ 2220 if (copy_peer_wmm_capab(&kde, peer) < 0) 2221 goto error; 2222 2223 peer->aid = kde.aid; 2224 2225 if (!wpa_tdls_get_privacy(sm)) { 2226 peer->rsnie_p_len = 0; 2227 peer->cipher = WPA_CIPHER_NONE; 2228 goto skip_rsn; 2229 } 2230 2231 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 2232 kde.rsn_ie == NULL) { 2233 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 2234 status = WLAN_STATUS_INVALID_PARAMETERS; 2235 goto error; 2236 } 2237 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2238 kde.rsn_ie, kde.rsn_ie_len); 2239 2240 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 2241 wpa_printf(MSG_INFO, 2242 "TDLS: Too long Responder RSN IE in TPK M2"); 2243 status = WLAN_STATUS_INVALID_RSNIE; 2244 goto error; 2245 } 2246 2247 /* 2248 * FIX: bitwise comparison of RSN IE is not the correct way of 2249 * validation this. It can be different, but certain fields must 2250 * match. Since we list only a single pairwise cipher in TPK M1, the 2251 * memcmp is likely to work in most cases, though. 2252 */ 2253 if (kde.rsn_ie_len != peer->rsnie_i_len || 2254 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 2255 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 2256 "not match with RSN IE used in TPK M1"); 2257 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 2258 peer->rsnie_i, peer->rsnie_i_len); 2259 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 2260 kde.rsn_ie, kde.rsn_ie_len); 2261 status = WLAN_STATUS_INVALID_RSNIE; 2262 goto error; 2263 } 2264 2265 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 2266 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 2267 status = WLAN_STATUS_INVALID_RSNIE; 2268 goto error; 2269 } 2270 2271 cipher = ie.pairwise_cipher; 2272 if (cipher == WPA_CIPHER_CCMP) { 2273 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 2274 cipher = WPA_CIPHER_CCMP; 2275 } else { 2276 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 2277 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 2278 goto error; 2279 } 2280 2281 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 2282 kde.ftie, sizeof(*ftie)); 2283 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2284 2285 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2286 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 2287 "not match with FTIE SNonce used in TPK M1"); 2288 /* Silently discard the frame */ 2289 return -1; 2290 } 2291 2292 /* Responder Nonce and RSN IE */ 2293 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 2294 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 2295 peer->rsnie_p_len = kde.rsn_ie_len; 2296 peer->cipher = cipher; 2297 2298 /* Lifetime */ 2299 if (kde.key_lifetime == NULL) { 2300 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 2301 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2302 goto error; 2303 } 2304 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2305 lifetime = WPA_GET_LE32(timeoutie->value); 2306 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 2307 lifetime); 2308 if (lifetime != peer->lifetime) { 2309 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2310 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2311 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2312 goto error; 2313 } 2314 2315 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2316 2317 /* Process MIC check to see if TPK M2 is right */ 2318 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2319 (u8 *) timeoutie, ftie) < 0) { 2320 /* Discard the frame */ 2321 wpa_tdls_del_key(sm, peer); 2322 wpa_tdls_disable_peer_link(sm, peer); 2323 return -1; 2324 } 2325 2326 if (wpa_tdls_set_key(sm, peer) < 0) { 2327 /* 2328 * Some drivers may not be able to config the key prior to full 2329 * STA entry having been configured. 2330 */ 2331 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2332 "STA entry is complete"); 2333 peer->reconfig_key = 1; 2334 } 2335 2336skip_rsn: 2337 peer->dtoken = dtoken; 2338 2339 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 2340 if (wpa_tdls_addset_peer(sm, peer, 0) < 0) 2341 goto error; 2342 2343 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2344 "TPK Handshake Message 3"); 2345 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) 2346 goto error; 2347 2348 if (!peer->tpk_success) { 2349 /* 2350 * Enable Link only when tpk_success is 0, signifying that this 2351 * processing of TPK M2 frame is not because of a retransmission 2352 * during TDLS setup handshake. 2353 */ 2354 ret = wpa_tdls_enable_link(sm, peer); 2355 if (ret < 0) { 2356 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2357 wpa_tdls_do_teardown( 2358 sm, peer, 2359 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2360 } 2361 } 2362 return ret; 2363 2364error: 2365 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2366 status); 2367 wpa_tdls_disable_peer_link(sm, peer); 2368 return -1; 2369} 2370 2371 2372static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2373 const u8 *buf, size_t len) 2374{ 2375 struct wpa_tdls_peer *peer; 2376 struct wpa_eapol_ie_parse kde; 2377 struct wpa_tdls_ftie *ftie; 2378 struct wpa_tdls_timeoutie *timeoutie; 2379 struct wpa_tdls_lnkid *lnkid; 2380 int ielen; 2381 u16 status; 2382 const u8 *pos; 2383 u32 lifetime; 2384 int ret = 0; 2385 2386 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2387 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2388 for (peer = sm->tdls; peer; peer = peer->next) { 2389 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2390 break; 2391 } 2392 if (peer == NULL) { 2393 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2394 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2395 return -1; 2396 } 2397 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2398 2399 if (len < 3 + 3) 2400 goto error; 2401 pos = buf; 2402 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2403 2404 status = WPA_GET_LE16(pos); 2405 2406 if (status != 0) { 2407 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2408 status); 2409 goto error; 2410 } 2411 pos += 2 /* status code */ + 1 /* dialog token */; 2412 2413 ielen = len - (pos - buf); /* start of IE in buf */ 2414 2415 /* 2416 * Don't reject the message if failing to parse IEs. The IEs we need are 2417 * explicitly checked below. Some APs piggy-back broken IEs to the end 2418 * of a TDLS Confirm packet, which will fail the link if we don't ignore 2419 * this error. 2420 */ 2421 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2422 wpa_printf(MSG_DEBUG, 2423 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround"); 2424 } 2425 2426 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2427 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2428 goto error; 2429 } 2430 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2431 (u8 *) kde.lnkid, kde.lnkid_len); 2432 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2433 2434 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2435 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2436 goto error; 2437 } 2438 2439 if (!wpa_tdls_get_privacy(sm)) 2440 goto skip_rsn; 2441 2442 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2443 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2444 goto error; 2445 } 2446 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2447 kde.ftie, sizeof(*ftie)); 2448 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2449 2450 if (kde.rsn_ie == NULL) { 2451 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2452 goto error; 2453 } 2454 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2455 kde.rsn_ie, kde.rsn_ie_len); 2456 if (kde.rsn_ie_len != peer->rsnie_p_len || 2457 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2458 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2459 "with the one sent in TPK M2"); 2460 goto error; 2461 } 2462 2463 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2464 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2465 "not match with FTIE ANonce used in TPK M2"); 2466 goto error; 2467 } 2468 2469 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2470 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2471 "match with FTIE SNonce used in TPK M1"); 2472 goto error; 2473 } 2474 2475 if (kde.key_lifetime == NULL) { 2476 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2477 goto error; 2478 } 2479 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2480 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2481 (u8 *) timeoutie, sizeof(*timeoutie)); 2482 lifetime = WPA_GET_LE32(timeoutie->value); 2483 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2484 lifetime); 2485 if (lifetime != peer->lifetime) { 2486 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2487 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2488 goto error; 2489 } 2490 2491 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2492 (u8 *) timeoutie, ftie) < 0) { 2493 wpa_tdls_del_key(sm, peer); 2494 goto error; 2495 } 2496 2497 if (wpa_tdls_set_key(sm, peer) < 0) { 2498 /* 2499 * Some drivers may not be able to config the key prior to full 2500 * STA entry having been configured. 2501 */ 2502 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2503 "STA entry is complete"); 2504 peer->reconfig_key = 1; 2505 } 2506 2507skip_rsn: 2508 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 2509 if (wpa_tdls_addset_peer(sm, peer, 0) < 0) 2510 goto error; 2511 2512 if (!peer->tpk_success) { 2513 /* 2514 * Enable Link only when tpk_success is 0, signifying that this 2515 * processing of TPK M3 frame is not because of a retransmission 2516 * during TDLS setup handshake. 2517 */ 2518 ret = wpa_tdls_enable_link(sm, peer); 2519 if (ret < 0) { 2520 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2521 goto error; 2522 } 2523 } 2524 return ret; 2525error: 2526 wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2527 return -1; 2528} 2529 2530 2531static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2532{ 2533 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2534 2535 os_memset(lifetime, 0, ie_len); 2536 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2537 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2538 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2539 WPA_PUT_LE32(lifetime->value, tsecs); 2540 os_memcpy(pos, ie, ie_len); 2541 return pos + ie_len; 2542} 2543 2544 2545/** 2546 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2547 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2548 * @peer: MAC address of the peer STA 2549 * Returns: 0 on success, or -1 on failure 2550 * 2551 * Send TPK Handshake Message 1 info to driver to start TDLS 2552 * handshake with the peer. 2553 */ 2554int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2555{ 2556 struct wpa_tdls_peer *peer; 2557 int tdls_prohibited = sm->tdls_prohibited; 2558 2559 if (sm->tdls_disabled || !sm->tdls_supported) 2560 return -1; 2561 2562#ifdef CONFIG_TDLS_TESTING 2563 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2564 tdls_prohibited) { 2565 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2566 "on TDLS"); 2567 tdls_prohibited = 0; 2568 } 2569#endif /* CONFIG_TDLS_TESTING */ 2570 2571 if (tdls_prohibited) { 2572 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2573 "reject request to start setup"); 2574 return -1; 2575 } 2576 2577 peer = wpa_tdls_add_peer(sm, addr, NULL); 2578 if (peer == NULL) 2579 return -1; 2580 2581 if (peer->tpk_in_progress) { 2582 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer"); 2583 return 0; 2584 } 2585 2586 peer->initiator = 1; 2587 2588 /* add the peer to the driver as a "setup in progress" peer */ 2589 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, 2590 NULL, 0, NULL, 0, NULL, 0, NULL, 0)) { 2591 wpa_tdls_disable_peer_link(sm, peer); 2592 return -1; 2593 } 2594 2595 peer->tpk_in_progress = 1; 2596 2597 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2598 wpa_tdls_disable_peer_link(sm, peer); 2599 return -1; 2600 } 2601 2602 return 0; 2603} 2604 2605 2606void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2607{ 2608 struct wpa_tdls_peer *peer; 2609 2610 if (sm->tdls_disabled || !sm->tdls_supported) 2611 return; 2612 2613 for (peer = sm->tdls; peer; peer = peer->next) { 2614 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2615 break; 2616 } 2617 2618 if (peer == NULL || !peer->tpk_success) 2619 return; 2620 2621 if (sm->tdls_external_setup) { 2622 /* 2623 * Disable previous link to allow renegotiation to be completed 2624 * on AP path. 2625 */ 2626 wpa_tdls_do_teardown(sm, peer, 2627 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2628 } 2629} 2630 2631 2632/** 2633 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2634 * 2635 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2636 */ 2637static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2638 const u8 *buf, size_t len) 2639{ 2640 struct wpa_sm *sm = ctx; 2641 struct wpa_tdls_frame *tf; 2642 2643 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2644 buf, len); 2645 2646 if (sm->tdls_disabled || !sm->tdls_supported) { 2647 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2648 "or unsupported by driver"); 2649 return; 2650 } 2651 2652 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2653 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2654 return; 2655 } 2656 2657 if (len < sizeof(*tf)) { 2658 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2659 return; 2660 } 2661 2662 /* Check to make sure its a valid encapsulated TDLS frame */ 2663 tf = (struct wpa_tdls_frame *) buf; 2664 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2665 tf->category != WLAN_ACTION_TDLS) { 2666 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2667 "category=%u action=%u", 2668 tf->payloadtype, tf->category, tf->action); 2669 return; 2670 } 2671 2672 switch (tf->action) { 2673 case WLAN_TDLS_SETUP_REQUEST: 2674 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2675 break; 2676 case WLAN_TDLS_SETUP_RESPONSE: 2677 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2678 break; 2679 case WLAN_TDLS_SETUP_CONFIRM: 2680 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2681 break; 2682 case WLAN_TDLS_TEARDOWN: 2683 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2684 break; 2685 case WLAN_TDLS_DISCOVERY_REQUEST: 2686 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2687 break; 2688 default: 2689 /* Kernel code will process remaining frames */ 2690 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2691 tf->action); 2692 break; 2693 } 2694} 2695 2696 2697/** 2698 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2699 * @wpa_s: Pointer to wpa_supplicant data 2700 * Returns: 0 on success, -1 on failure 2701 * 2702 * This function is called to initialize driver interface parameters for TDLS. 2703 * wpa_drv_init() must have been called before this function to initialize the 2704 * driver interface. 2705 */ 2706int wpa_tdls_init(struct wpa_sm *sm) 2707{ 2708 if (sm == NULL) 2709 return -1; 2710 2711 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2712 sm->ifname, 2713 sm->own_addr, 2714 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2715 sm, 0); 2716 if (sm->l2_tdls == NULL) { 2717 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2718 "connection"); 2719 return -1; 2720 } 2721 2722 /* 2723 * Drivers that support TDLS but don't implement the get_capa callback 2724 * are assumed to perform everything internally 2725 */ 2726 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2727 &sm->tdls_external_setup) < 0) { 2728 sm->tdls_supported = 1; 2729 sm->tdls_external_setup = 0; 2730 } 2731 2732 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2733 "driver", sm->tdls_supported ? "" : " not"); 2734 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2735 sm->tdls_external_setup ? "external" : "internal"); 2736 2737 return 0; 2738} 2739 2740 2741void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2742{ 2743 struct wpa_tdls_peer *peer, *tmp; 2744 2745 peer = sm->tdls; 2746 2747 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2748 2749 while (peer) { 2750 tmp = peer->next; 2751 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2752 MAC2STR(peer->addr)); 2753 if (sm->tdls_external_setup) 2754 wpa_tdls_do_teardown(sm, peer, 2755 WLAN_REASON_DEAUTH_LEAVING); 2756 else 2757 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2758 2759 peer = tmp; 2760 } 2761} 2762 2763 2764static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2765{ 2766 struct wpa_tdls_peer *peer, *tmp; 2767 2768 peer = sm->tdls; 2769 2770 while (peer) { 2771 int res; 2772 tmp = peer->next; 2773 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2774 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2775 MAC2STR(peer->addr), res); 2776 wpa_tdls_peer_free(sm, peer); 2777 peer = tmp; 2778 } 2779} 2780 2781 2782/** 2783 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2784 * 2785 * This function is called to recover driver interface parameters for TDLS 2786 * and frees resources allocated for it. 2787 */ 2788void wpa_tdls_deinit(struct wpa_sm *sm) 2789{ 2790 if (sm == NULL) 2791 return; 2792 2793 if (sm->l2_tdls) 2794 l2_packet_deinit(sm->l2_tdls); 2795 sm->l2_tdls = NULL; 2796 2797 wpa_tdls_remove_peers(sm); 2798} 2799 2800 2801void wpa_tdls_assoc(struct wpa_sm *sm) 2802{ 2803 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2804 wpa_tdls_remove_peers(sm); 2805} 2806 2807 2808void wpa_tdls_disassoc(struct wpa_sm *sm) 2809{ 2810 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2811 wpa_tdls_remove_peers(sm); 2812} 2813 2814 2815static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2816{ 2817 struct wpa_eapol_ie_parse elems; 2818 2819 if (ies == NULL) 2820 return 0; 2821 2822 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2823 return 0; 2824 2825 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2826 return 0; 2827 2828 /* bit 38 - TDLS Prohibited */ 2829 return !!(elems.ext_capab[2 + 4] & 0x40); 2830} 2831 2832 2833void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2834{ 2835 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2836 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2837 sm->tdls_prohibited ? "prohibited" : "allowed"); 2838} 2839 2840 2841void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2842{ 2843 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2844 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2845 "(Re)Association Response IEs"); 2846 sm->tdls_prohibited = 1; 2847 } 2848} 2849 2850 2851void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2852{ 2853 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2854 sm->tdls_disabled = !enabled; 2855} 2856 2857 2858int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2859{ 2860 return sm->tdls_external_setup; 2861} 2862