tdls.c revision 6a9f522e56dae5b1fff00642e27b82e82772dcf7
1/* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9#include "utils/includes.h" 10 11#include "utils/common.h" 12#include "utils/eloop.h" 13#include "utils/os.h" 14#include "common/ieee802_11_defs.h" 15#include "crypto/sha256.h" 16#include "crypto/crypto.h" 17#include "crypto/aes_wrap.h" 18#include "rsn_supp/wpa.h" 19#include "rsn_supp/wpa_ie.h" 20#include "rsn_supp/wpa_i.h" 21#include "drivers/driver.h" 22#include "l2_packet/l2_packet.h" 23 24#ifdef CONFIG_TDLS_TESTING 25#define TDLS_TESTING_LONG_FRAME BIT(0) 26#define TDLS_TESTING_ALT_RSN_IE BIT(1) 27#define TDLS_TESTING_DIFF_BSSID BIT(2) 28#define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31#define TDLS_TESTING_LONG_LIFETIME BIT(6) 32#define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34#define TDLS_TESTING_DECLINE_RESP BIT(9) 35#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36unsigned int tdls_testing = 0; 37#endif /* CONFIG_TDLS_TESTING */ 38 39#define TPK_LIFETIME 43200 /* 12 hours */ 40#define TPK_M1_RETRY_COUNT 3 41#define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 42#define TPK_M2_RETRY_COUNT 10 43#define TPK_M2_TIMEOUT 500 /* in milliseconds */ 44 45#define TDLS_MIC_LEN 16 46 47#define TDLS_TIMEOUT_LEN 4 48 49struct wpa_tdls_ftie { 50 u8 ie_type; /* FTIE */ 51 u8 ie_len; 52 u8 mic_ctrl[2]; 53 u8 mic[TDLS_MIC_LEN]; 54 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 55 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 56 /* followed by optional elements */ 57} STRUCT_PACKED; 58 59struct wpa_tdls_timeoutie { 60 u8 ie_type; /* Timeout IE */ 61 u8 ie_len; 62 u8 interval_type; 63 u8 value[TDLS_TIMEOUT_LEN]; 64} STRUCT_PACKED; 65 66struct wpa_tdls_lnkid { 67 u8 ie_type; /* Link Identifier IE */ 68 u8 ie_len; 69 u8 bssid[ETH_ALEN]; 70 u8 init_sta[ETH_ALEN]; 71 u8 resp_sta[ETH_ALEN]; 72} STRUCT_PACKED; 73 74/* TDLS frame headers as per IEEE Std 802.11z-2010 */ 75struct wpa_tdls_frame { 76 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 77 u8 category; /* Category */ 78 u8 action; /* Action (enum tdls_frame_type) */ 79} STRUCT_PACKED; 80 81static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 82static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 83static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 84 85 86#define TDLS_MAX_IE_LEN 80 87#define IEEE80211_MAX_SUPP_RATES 32 88 89struct wpa_tdls_peer { 90 struct wpa_tdls_peer *next; 91 unsigned int reconfig_key:1; 92 int initiator; /* whether this end was initiator for TDLS setup */ 93 u8 addr[ETH_ALEN]; /* other end MAC address */ 94 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 95 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 96 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 97 size_t rsnie_i_len; 98 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 99 size_t rsnie_p_len; 100 u32 lifetime; 101 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 102 u8 dtoken; 103 104 struct tpk { 105 u8 kck[16]; /* TPK-KCK */ 106 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 107 } tpk; 108 int tpk_set; 109 int tpk_success; 110 111 struct tpk_timer { 112 u8 dest[ETH_ALEN]; 113 int count; /* Retry Count */ 114 int timer; /* Timeout in milliseconds */ 115 u8 action_code; /* TDLS frame type */ 116 u8 dialog_token; 117 u16 status_code; 118 int buf_len; /* length of TPK message for retransmission */ 119 u8 *buf; /* buffer for TPK message */ 120 } sm_tmr; 121 122 u16 capability; 123 124 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 125 size_t supp_rates_len; 126 127 struct ieee80211_ht_capabilities *ht_capabilities; 128 struct ieee80211_vht_capabilities *vht_capabilities; 129 130 u8 qos_info; 131 132 u16 aid; 133 134 u8 *ext_capab; 135 size_t ext_capab_len; 136}; 137 138 139static int wpa_tdls_get_privacy(struct wpa_sm *sm) 140{ 141 /* 142 * Get info needed from supplicant to check if the current BSS supports 143 * security. Other than OPEN mode, rest are considered secured 144 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 145 */ 146 return sm->pairwise_cipher != WPA_CIPHER_NONE; 147} 148 149 150static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 151{ 152 os_memcpy(pos, ie, ie_len); 153 return pos + ie_len; 154} 155 156 157static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 158{ 159 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 160 0, 0, NULL, 0, NULL, 0) < 0) { 161 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 162 "the driver"); 163 return -1; 164 } 165 166 return 0; 167} 168 169 170static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 171{ 172 u8 key_len; 173 u8 rsc[6]; 174 enum wpa_alg alg; 175 176 os_memset(rsc, 0, 6); 177 178 switch (peer->cipher) { 179 case WPA_CIPHER_CCMP: 180 alg = WPA_ALG_CCMP; 181 key_len = 16; 182 break; 183 case WPA_CIPHER_NONE: 184 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 185 "NONE - do not use pairwise keys"); 186 return -1; 187 default: 188 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 189 sm->pairwise_cipher); 190 return -1; 191 } 192 193 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 194 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 195 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 196 "driver"); 197 return -1; 198 } 199 return 0; 200} 201 202 203static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 204 u8 action_code, u8 dialog_token, 205 u16 status_code, const u8 *buf, size_t len) 206{ 207 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 208 status_code, buf, len); 209} 210 211 212static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 213 u8 dialog_token, u16 status_code, 214 const u8 *msg, size_t msg_len) 215{ 216 struct wpa_tdls_peer *peer; 217 218 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 219 "dialog_token=%u status_code=%u msg_len=%u", 220 MAC2STR(dest), action_code, dialog_token, status_code, 221 (unsigned int) msg_len); 222 223 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 224 status_code, msg, msg_len)) { 225 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 226 "(action_code=%u)", action_code); 227 return -1; 228 } 229 230 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 231 action_code == WLAN_TDLS_TEARDOWN || 232 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 233 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 234 return 0; /* No retries */ 235 236 for (peer = sm->tdls; peer; peer = peer->next) { 237 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 238 break; 239 } 240 241 if (peer == NULL) { 242 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 243 "retry " MACSTR, MAC2STR(dest)); 244 return 0; 245 } 246 247 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 248 249 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 250 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 251 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 252 } else { 253 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 254 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 255 } 256 257 /* Copy message to resend on timeout */ 258 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 259 peer->sm_tmr.action_code = action_code; 260 peer->sm_tmr.dialog_token = dialog_token; 261 peer->sm_tmr.status_code = status_code; 262 peer->sm_tmr.buf_len = msg_len; 263 os_free(peer->sm_tmr.buf); 264 peer->sm_tmr.buf = os_malloc(msg_len); 265 if (peer->sm_tmr.buf == NULL) 266 return -1; 267 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 268 269 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 270 "(action_code=%u)", action_code); 271 eloop_register_timeout(peer->sm_tmr.timer / 1000, 272 (peer->sm_tmr.timer % 1000) * 1000, 273 wpa_tdls_tpk_retry_timeout, sm, peer); 274 return 0; 275} 276 277 278static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 279 u16 reason_code) 280{ 281 int ret; 282 283 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 284 /* disable the link after teardown was sent */ 285 wpa_tdls_disable_link(sm, peer->addr); 286 287 return ret; 288} 289 290 291static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 292{ 293 294 struct wpa_sm *sm = eloop_ctx; 295 struct wpa_tdls_peer *peer = timeout_ctx; 296 297 if (peer->sm_tmr.count) { 298 peer->sm_tmr.count--; 299 300 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 301 "(action_code=%u)", 302 peer->sm_tmr.action_code); 303 304 if (peer->sm_tmr.buf == NULL) { 305 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 306 "for action_code=%u", 307 peer->sm_tmr.action_code); 308 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 309 peer); 310 return; 311 } 312 313 /* resend TPK Handshake Message to Peer */ 314 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 315 peer->sm_tmr.action_code, 316 peer->sm_tmr.dialog_token, 317 peer->sm_tmr.status_code, 318 peer->sm_tmr.buf, 319 peer->sm_tmr.buf_len)) { 320 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 321 "transmission"); 322 } 323 324 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 325 eloop_register_timeout(peer->sm_tmr.timer / 1000, 326 (peer->sm_tmr.timer % 1000) * 1000, 327 wpa_tdls_tpk_retry_timeout, sm, peer); 328 } else { 329 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 330 331 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 332 wpa_tdls_do_teardown(sm, peer, 333 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 334 } 335} 336 337 338static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 339 struct wpa_tdls_peer *peer, 340 u8 action_code) 341{ 342 if (action_code == peer->sm_tmr.action_code) { 343 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 344 "action_code=%u", action_code); 345 346 /* Cancel Timeout registered */ 347 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 348 349 /* free all resources meant for retry */ 350 os_free(peer->sm_tmr.buf); 351 peer->sm_tmr.buf = NULL; 352 353 peer->sm_tmr.count = 0; 354 peer->sm_tmr.timer = 0; 355 peer->sm_tmr.buf_len = 0; 356 peer->sm_tmr.action_code = 0xff; 357 } else { 358 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 359 "(Unknown action_code=%u)", action_code); 360 } 361} 362 363 364static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 365 const u8 *own_addr, const u8 *bssid) 366{ 367 u8 key_input[SHA256_MAC_LEN]; 368 const u8 *nonce[2]; 369 size_t len[2]; 370 u8 data[3 * ETH_ALEN]; 371 372 /* IEEE Std 802.11z-2010 8.5.9.1: 373 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 374 */ 375 len[0] = WPA_NONCE_LEN; 376 len[1] = WPA_NONCE_LEN; 377 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 378 nonce[0] = peer->inonce; 379 nonce[1] = peer->rnonce; 380 } else { 381 nonce[0] = peer->rnonce; 382 nonce[1] = peer->inonce; 383 } 384 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 385 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 386 sha256_vector(2, nonce, len, key_input); 387 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 388 key_input, SHA256_MAC_LEN); 389 390 /* 391 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 392 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 393 * TODO: is N_KEY really included in KDF Context and if so, in which 394 * presentation format (little endian 16-bit?) is it used? It gets 395 * added by the KDF anyway.. 396 */ 397 398 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 399 os_memcpy(data, own_addr, ETH_ALEN); 400 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 401 } else { 402 os_memcpy(data, peer->addr, ETH_ALEN); 403 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 404 } 405 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 406 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 407 408 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 409 (u8 *) &peer->tpk, sizeof(peer->tpk)); 410 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 411 peer->tpk.kck, sizeof(peer->tpk.kck)); 412 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 413 peer->tpk.tk, sizeof(peer->tpk.tk)); 414 peer->tpk_set = 1; 415} 416 417 418/** 419 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 420 * @kck: TPK-KCK 421 * @lnkid: Pointer to the beginning of Link Identifier IE 422 * @rsnie: Pointer to the beginning of RSN IE used for handshake 423 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 424 * @ftie: Pointer to the beginning of FT IE 425 * @mic: Pointer for writing MIC 426 * 427 * Calculate MIC for TDLS frame. 428 */ 429static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 430 const u8 *rsnie, const u8 *timeoutie, 431 const u8 *ftie, u8 *mic) 432{ 433 u8 *buf, *pos; 434 struct wpa_tdls_ftie *_ftie; 435 const struct wpa_tdls_lnkid *_lnkid; 436 int ret; 437 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 438 2 + timeoutie[1] + 2 + ftie[1]; 439 buf = os_zalloc(len); 440 if (!buf) { 441 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 442 return -1; 443 } 444 445 pos = buf; 446 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 447 /* 1) TDLS initiator STA MAC address */ 448 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 449 pos += ETH_ALEN; 450 /* 2) TDLS responder STA MAC address */ 451 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 452 pos += ETH_ALEN; 453 /* 3) Transaction Sequence number */ 454 *pos++ = trans_seq; 455 /* 4) Link Identifier IE */ 456 os_memcpy(pos, lnkid, 2 + lnkid[1]); 457 pos += 2 + lnkid[1]; 458 /* 5) RSN IE */ 459 os_memcpy(pos, rsnie, 2 + rsnie[1]); 460 pos += 2 + rsnie[1]; 461 /* 6) Timeout Interval IE */ 462 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 463 pos += 2 + timeoutie[1]; 464 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 465 os_memcpy(pos, ftie, 2 + ftie[1]); 466 _ftie = (struct wpa_tdls_ftie *) pos; 467 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 468 pos += 2 + ftie[1]; 469 470 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 471 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 472 ret = omac1_aes_128(kck, buf, pos - buf, mic); 473 os_free(buf); 474 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 475 return ret; 476} 477 478 479/** 480 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 481 * @kck: TPK-KCK 482 * @trans_seq: Transaction Sequence Number (4 - Teardown) 483 * @rcode: Reason code for Teardown 484 * @dtoken: Dialog Token used for that particular link 485 * @lnkid: Pointer to the beginning of Link Identifier IE 486 * @ftie: Pointer to the beginning of FT IE 487 * @mic: Pointer for writing MIC 488 * 489 * Calculate MIC for TDLS frame. 490 */ 491static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 492 u8 dtoken, const u8 *lnkid, 493 const u8 *ftie, u8 *mic) 494{ 495 u8 *buf, *pos; 496 struct wpa_tdls_ftie *_ftie; 497 int ret; 498 int len; 499 500 if (lnkid == NULL) 501 return -1; 502 503 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 504 sizeof(trans_seq) + 2 + ftie[1]; 505 506 buf = os_zalloc(len); 507 if (!buf) { 508 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 509 return -1; 510 } 511 512 pos = buf; 513 /* 1) Link Identifier IE */ 514 os_memcpy(pos, lnkid, 2 + lnkid[1]); 515 pos += 2 + lnkid[1]; 516 /* 2) Reason Code */ 517 WPA_PUT_LE16(pos, rcode); 518 pos += sizeof(rcode); 519 /* 3) Dialog token */ 520 *pos++ = dtoken; 521 /* 4) Transaction Sequence number */ 522 *pos++ = trans_seq; 523 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 524 os_memcpy(pos, ftie, 2 + ftie[1]); 525 _ftie = (struct wpa_tdls_ftie *) pos; 526 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 527 pos += 2 + ftie[1]; 528 529 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 530 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 531 ret = omac1_aes_128(kck, buf, pos - buf, mic); 532 os_free(buf); 533 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 534 return ret; 535} 536 537 538static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 539 struct wpa_tdls_peer *peer, 540 const u8 *lnkid, const u8 *timeoutie, 541 const struct wpa_tdls_ftie *ftie) 542{ 543 u8 mic[16]; 544 545 if (peer->tpk_set) { 546 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 547 peer->rsnie_p, timeoutie, (u8 *) ftie, 548 mic); 549 if (os_memcmp(mic, ftie->mic, 16) != 0) { 550 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 551 "dropping packet"); 552 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 553 ftie->mic, 16); 554 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 555 mic, 16); 556 return -1; 557 } 558 } else { 559 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 560 "TPK not set - dropping packet"); 561 return -1; 562 } 563 return 0; 564} 565 566 567static int wpa_supplicant_verify_tdls_mic_teardown( 568 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 569 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 570{ 571 u8 mic[16]; 572 573 if (peer->tpk_set) { 574 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 575 dtoken, lnkid, (u8 *) ftie, mic); 576 if (os_memcmp(mic, ftie->mic, 16) != 0) { 577 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 578 "dropping packet"); 579 return -1; 580 } 581 } else { 582 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 583 "MIC, TPK not set - dropping packet"); 584 return -1; 585 } 586 return 0; 587} 588 589 590static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 591{ 592 struct wpa_sm *sm = eloop_ctx; 593 struct wpa_tdls_peer *peer = timeout_ctx; 594 595 /* 596 * On TPK lifetime expiration, we have an option of either tearing down 597 * the direct link or trying to re-initiate it. The selection of what 598 * to do is not strictly speaking controlled by our role in the expired 599 * link, but for now, use that to select whether to renew or tear down 600 * the link. 601 */ 602 603 if (peer->initiator) { 604 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 605 " - try to renew", MAC2STR(peer->addr)); 606 wpa_tdls_start(sm, peer->addr); 607 } else { 608 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 609 " - tear down", MAC2STR(peer->addr)); 610 wpa_tdls_do_teardown(sm, peer, 611 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 612 } 613} 614 615 616static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 617{ 618 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 619 MAC2STR(peer->addr)); 620 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 621 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 622 peer->reconfig_key = 0; 623 peer->initiator = 0; 624 os_free(peer->sm_tmr.buf); 625 peer->sm_tmr.buf = NULL; 626 os_free(peer->ht_capabilities); 627 peer->ht_capabilities = NULL; 628 os_free(peer->vht_capabilities); 629 peer->vht_capabilities = NULL; 630 os_free(peer->ext_capab); 631 peer->ext_capab = NULL; 632 peer->rsnie_i_len = peer->rsnie_p_len = 0; 633 peer->cipher = 0; 634 peer->tpk_set = peer->tpk_success = 0; 635 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 636 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 637 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 638} 639 640 641static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 642 struct wpa_tdls_lnkid *lnkid) 643{ 644 lnkid->ie_type = WLAN_EID_LINK_ID; 645 lnkid->ie_len = 3 * ETH_ALEN; 646 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 647 if (peer->initiator) { 648 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 649 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 650 } else { 651 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 652 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 653 } 654} 655 656 657int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 658{ 659 struct wpa_tdls_peer *peer; 660 struct wpa_tdls_ftie *ftie; 661 struct wpa_tdls_lnkid lnkid; 662 u8 dialog_token; 663 u8 *rbuf, *pos; 664 int ielen; 665 666 if (sm->tdls_disabled || !sm->tdls_supported) 667 return -1; 668 669 /* Find the node and free from the list */ 670 for (peer = sm->tdls; peer; peer = peer->next) { 671 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 672 break; 673 } 674 675 if (peer == NULL) { 676 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 677 "Teardown " MACSTR, MAC2STR(addr)); 678 return 0; 679 } 680 681 dialog_token = peer->dtoken; 682 683 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 684 MAC2STR(addr)); 685 686 ielen = 0; 687 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 688 /* To add FTIE for Teardown request and compute MIC */ 689 ielen += sizeof(*ftie); 690#ifdef CONFIG_TDLS_TESTING 691 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 692 ielen += 170; 693#endif /* CONFIG_TDLS_TESTING */ 694 } 695 696 rbuf = os_zalloc(ielen + 1); 697 if (rbuf == NULL) 698 return -1; 699 pos = rbuf; 700 701 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 702 goto skip_ies; 703 704 ftie = (struct wpa_tdls_ftie *) pos; 705 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 706 /* Using the recent nonce which should be for CONFIRM frame */ 707 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 708 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 709 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 710 pos = (u8 *) (ftie + 1); 711#ifdef CONFIG_TDLS_TESTING 712 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 713 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 714 "FTIE"); 715 ftie->ie_len += 170; 716 *pos++ = 255; /* FTIE subelem */ 717 *pos++ = 168; /* FTIE subelem length */ 718 pos += 168; 719 } 720#endif /* CONFIG_TDLS_TESTING */ 721 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 722 (u8 *) ftie, pos - (u8 *) ftie); 723 724 /* compute MIC before sending */ 725 wpa_tdls_linkid(sm, peer, &lnkid); 726 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 727 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 728 ftie->mic); 729 730skip_ies: 731 /* TODO: register for a Timeout handler, if Teardown is not received at 732 * the other end, then try again another time */ 733 734 /* request driver to send Teardown using this FTIE */ 735 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 736 reason_code, rbuf, pos - rbuf); 737 os_free(rbuf); 738 739 /* clear the Peerkey statemachine */ 740 wpa_tdls_peer_free(sm, peer); 741 742 return 0; 743} 744 745 746int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 747{ 748 struct wpa_tdls_peer *peer; 749 750 if (sm->tdls_disabled || !sm->tdls_supported) 751 return -1; 752 753 for (peer = sm->tdls; peer; peer = peer->next) { 754 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 755 break; 756 } 757 758 if (peer == NULL) { 759 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 760 " for link Teardown", MAC2STR(addr)); 761 return -1; 762 } 763 764 if (!peer->tpk_success) { 765 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 766 " not connected - cannot Teardown link", MAC2STR(addr)); 767 return -1; 768 } 769 770 return wpa_tdls_do_teardown(sm, peer, reason_code); 771} 772 773 774void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 775{ 776 struct wpa_tdls_peer *peer; 777 778 for (peer = sm->tdls; peer; peer = peer->next) { 779 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 780 break; 781 } 782 783 if (peer) { 784 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr); 785 wpa_tdls_peer_free(sm, peer); 786 } 787} 788 789 790static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 791 const u8 *buf, size_t len) 792{ 793 struct wpa_tdls_peer *peer = NULL; 794 struct wpa_tdls_ftie *ftie; 795 struct wpa_tdls_lnkid *lnkid; 796 struct wpa_eapol_ie_parse kde; 797 u16 reason_code; 798 const u8 *pos; 799 int ielen; 800 801 /* Find the node and free from the list */ 802 for (peer = sm->tdls; peer; peer = peer->next) { 803 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 804 break; 805 } 806 807 if (peer == NULL) { 808 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 809 "Teardown " MACSTR, MAC2STR(src_addr)); 810 return 0; 811 } 812 813 pos = buf; 814 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 815 816 reason_code = WPA_GET_LE16(pos); 817 pos += 2; 818 819 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 820 " (reason code %u)", MAC2STR(src_addr), reason_code); 821 822 ielen = len - (pos - buf); /* start of IE in buf */ 823 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 824 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 825 return -1; 826 } 827 828 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 829 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 830 "Teardown"); 831 return -1; 832 } 833 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 834 835 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 836 goto skip_ftie; 837 838 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 839 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 840 return -1; 841 } 842 843 ftie = (struct wpa_tdls_ftie *) kde.ftie; 844 845 /* Process MIC check to see if TDLS Teardown is right */ 846 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 847 peer->dtoken, peer, 848 (u8 *) lnkid, ftie) < 0) { 849 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 850 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 851 return -1; 852 } 853 854skip_ftie: 855 /* 856 * Request the driver to disable the direct link and clear associated 857 * keys. 858 */ 859 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 860 861 /* clear the Peerkey statemachine */ 862 wpa_tdls_peer_free(sm, peer); 863 864 return 0; 865} 866 867 868/** 869 * wpa_tdls_send_error - To send suitable TDLS status response with 870 * appropriate status code mentioning reason for error/failure. 871 * @dst - MAC addr of Peer station 872 * @tdls_action - TDLS frame type for which error code is sent 873 * @status - status code mentioning reason 874 */ 875 876static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 877 u8 tdls_action, u8 dialog_token, u16 status) 878{ 879 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 880 " (action=%u status=%u)", 881 MAC2STR(dst), tdls_action, status); 882 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 883 NULL, 0); 884} 885 886 887static struct wpa_tdls_peer * 888wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 889{ 890 struct wpa_tdls_peer *peer; 891 892 if (existing) 893 *existing = 0; 894 for (peer = sm->tdls; peer; peer = peer->next) { 895 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 896 if (existing) 897 *existing = 1; 898 return peer; /* re-use existing entry */ 899 } 900 } 901 902 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 903 MAC2STR(addr)); 904 905 peer = os_zalloc(sizeof(*peer)); 906 if (peer == NULL) 907 return NULL; 908 909 os_memcpy(peer->addr, addr, ETH_ALEN); 910 peer->next = sm->tdls; 911 sm->tdls = peer; 912 913 return peer; 914} 915 916 917static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 918 struct wpa_tdls_peer *peer) 919{ 920 size_t buf_len; 921 struct wpa_tdls_timeoutie timeoutie; 922 u16 rsn_capab; 923 struct wpa_tdls_ftie *ftie; 924 u8 *rbuf, *pos, *count_pos; 925 u16 count; 926 struct rsn_ie_hdr *hdr; 927 int status; 928 929 if (!wpa_tdls_get_privacy(sm)) { 930 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 931 peer->rsnie_i_len = 0; 932 goto skip_rsnie; 933 } 934 935 /* 936 * TPK Handshake Message 1: 937 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 938 * Timeout Interval IE)) 939 */ 940 941 /* Filling RSN IE */ 942 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 943 hdr->elem_id = WLAN_EID_RSN; 944 WPA_PUT_LE16(hdr->version, RSN_VERSION); 945 946 pos = (u8 *) (hdr + 1); 947 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 948 pos += RSN_SELECTOR_LEN; 949 count_pos = pos; 950 pos += 2; 951 952 count = 0; 953 954 /* 955 * AES-CCMP is the default Encryption preferred for TDLS, so 956 * RSN IE is filled only with CCMP CIPHER 957 * Note: TKIP is not used to encrypt TDLS link. 958 * 959 * Regardless of the cipher used on the AP connection, select CCMP 960 * here. 961 */ 962 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 963 pos += RSN_SELECTOR_LEN; 964 count++; 965 966 WPA_PUT_LE16(count_pos, count); 967 968 WPA_PUT_LE16(pos, 1); 969 pos += 2; 970 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 971 pos += RSN_SELECTOR_LEN; 972 973 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 974 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 975#ifdef CONFIG_TDLS_TESTING 976 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 977 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 978 "testing"); 979 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 980 } 981#endif /* CONFIG_TDLS_TESTING */ 982 WPA_PUT_LE16(pos, rsn_capab); 983 pos += 2; 984#ifdef CONFIG_TDLS_TESTING 985 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 986 /* Number of PMKIDs */ 987 *pos++ = 0x00; 988 *pos++ = 0x00; 989 } 990#endif /* CONFIG_TDLS_TESTING */ 991 992 hdr->len = (pos - peer->rsnie_i) - 2; 993 peer->rsnie_i_len = pos - peer->rsnie_i; 994 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 995 peer->rsnie_i, peer->rsnie_i_len); 996 997skip_rsnie: 998 buf_len = 0; 999 if (wpa_tdls_get_privacy(sm)) 1000 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1001 sizeof(struct wpa_tdls_timeoutie); 1002#ifdef CONFIG_TDLS_TESTING 1003 if (wpa_tdls_get_privacy(sm) && 1004 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1005 buf_len += 170; 1006 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1007 buf_len += sizeof(struct wpa_tdls_lnkid); 1008#endif /* CONFIG_TDLS_TESTING */ 1009 rbuf = os_zalloc(buf_len + 1); 1010 if (rbuf == NULL) { 1011 wpa_tdls_peer_free(sm, peer); 1012 return -1; 1013 } 1014 pos = rbuf; 1015 1016 if (!wpa_tdls_get_privacy(sm)) 1017 goto skip_ies; 1018 1019 /* Initiator RSN IE */ 1020 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1021 1022 ftie = (struct wpa_tdls_ftie *) pos; 1023 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1024 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1025 1026 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1027 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1028 "TDLS: Failed to get random data for initiator Nonce"); 1029 os_free(rbuf); 1030 wpa_tdls_peer_free(sm, peer); 1031 return -1; 1032 } 1033 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1034 peer->inonce, WPA_NONCE_LEN); 1035 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1036 1037 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1038 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1039 1040 pos = (u8 *) (ftie + 1); 1041 1042#ifdef CONFIG_TDLS_TESTING 1043 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1044 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1045 "FTIE"); 1046 ftie->ie_len += 170; 1047 *pos++ = 255; /* FTIE subelem */ 1048 *pos++ = 168; /* FTIE subelem length */ 1049 pos += 168; 1050 } 1051#endif /* CONFIG_TDLS_TESTING */ 1052 1053 /* Lifetime */ 1054 peer->lifetime = TPK_LIFETIME; 1055#ifdef CONFIG_TDLS_TESTING 1056 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1057 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1058 "lifetime"); 1059 peer->lifetime = 301; 1060 } 1061 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1062 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1063 "lifetime"); 1064 peer->lifetime = 0xffffffff; 1065 } 1066#endif /* CONFIG_TDLS_TESTING */ 1067 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1068 sizeof(timeoutie), peer->lifetime); 1069 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1070 1071skip_ies: 1072 1073#ifdef CONFIG_TDLS_TESTING 1074 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1075 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1076 "Link Identifier"); 1077 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1078 wpa_tdls_linkid(sm, peer, l); 1079 l->bssid[5] ^= 0x01; 1080 pos += sizeof(*l); 1081 } 1082#endif /* CONFIG_TDLS_TESTING */ 1083 1084 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1085 "Handshake Message 1 (peer " MACSTR ")", 1086 MAC2STR(peer->addr)); 1087 1088 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1089 1, 0, rbuf, pos - rbuf); 1090 os_free(rbuf); 1091 1092 return status; 1093} 1094 1095 1096static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1097 const unsigned char *src_addr, u8 dtoken, 1098 struct wpa_tdls_lnkid *lnkid, 1099 const struct wpa_tdls_peer *peer) 1100{ 1101 u8 *rbuf, *pos; 1102 size_t buf_len; 1103 u32 lifetime; 1104 struct wpa_tdls_timeoutie timeoutie; 1105 struct wpa_tdls_ftie *ftie; 1106 int status; 1107 1108 buf_len = 0; 1109 if (wpa_tdls_get_privacy(sm)) { 1110 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1111 * Lifetime */ 1112 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1113 sizeof(struct wpa_tdls_timeoutie); 1114#ifdef CONFIG_TDLS_TESTING 1115 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1116 buf_len += 170; 1117#endif /* CONFIG_TDLS_TESTING */ 1118 } 1119 1120 rbuf = os_zalloc(buf_len + 1); 1121 if (rbuf == NULL) 1122 return -1; 1123 pos = rbuf; 1124 1125 if (!wpa_tdls_get_privacy(sm)) 1126 goto skip_ies; 1127 1128 /* Peer RSN IE */ 1129 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1130 1131 ftie = (struct wpa_tdls_ftie *) pos; 1132 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1133 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1134 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1135 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1136 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1137 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1138 (u8 *) ftie, sizeof(*ftie)); 1139 1140 pos = (u8 *) (ftie + 1); 1141 1142#ifdef CONFIG_TDLS_TESTING 1143 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1144 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1145 "FTIE"); 1146 ftie->ie_len += 170; 1147 *pos++ = 255; /* FTIE subelem */ 1148 *pos++ = 168; /* FTIE subelem length */ 1149 pos += 168; 1150 } 1151#endif /* CONFIG_TDLS_TESTING */ 1152 1153 /* Lifetime */ 1154 lifetime = peer->lifetime; 1155#ifdef CONFIG_TDLS_TESTING 1156 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1157 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1158 "lifetime in response"); 1159 lifetime++; 1160 } 1161#endif /* CONFIG_TDLS_TESTING */ 1162 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1163 sizeof(timeoutie), lifetime); 1164 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1165 lifetime); 1166 1167 /* compute MIC before sending */ 1168 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1169 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1170 1171skip_ies: 1172 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1173 dtoken, 0, rbuf, pos - rbuf); 1174 os_free(rbuf); 1175 1176 return status; 1177} 1178 1179 1180static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1181 const unsigned char *src_addr, u8 dtoken, 1182 struct wpa_tdls_lnkid *lnkid, 1183 const struct wpa_tdls_peer *peer) 1184{ 1185 u8 *rbuf, *pos; 1186 size_t buf_len; 1187 struct wpa_tdls_ftie *ftie; 1188 struct wpa_tdls_timeoutie timeoutie; 1189 u32 lifetime; 1190 int status; 1191 1192 buf_len = 0; 1193 if (wpa_tdls_get_privacy(sm)) { 1194 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1195 * Lifetime */ 1196 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1197 sizeof(struct wpa_tdls_timeoutie); 1198#ifdef CONFIG_TDLS_TESTING 1199 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1200 buf_len += 170; 1201#endif /* CONFIG_TDLS_TESTING */ 1202 } 1203 1204 rbuf = os_zalloc(buf_len + 1); 1205 if (rbuf == NULL) 1206 return -1; 1207 pos = rbuf; 1208 1209 if (!wpa_tdls_get_privacy(sm)) 1210 goto skip_ies; 1211 1212 /* Peer RSN IE */ 1213 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1214 1215 ftie = (struct wpa_tdls_ftie *) pos; 1216 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1217 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1218 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1219 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1220 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1221 1222 pos = (u8 *) (ftie + 1); 1223 1224#ifdef CONFIG_TDLS_TESTING 1225 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1226 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1227 "FTIE"); 1228 ftie->ie_len += 170; 1229 *pos++ = 255; /* FTIE subelem */ 1230 *pos++ = 168; /* FTIE subelem length */ 1231 pos += 168; 1232 } 1233#endif /* CONFIG_TDLS_TESTING */ 1234 1235 /* Lifetime */ 1236 lifetime = peer->lifetime; 1237#ifdef CONFIG_TDLS_TESTING 1238 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1239 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1240 "lifetime in confirm"); 1241 lifetime++; 1242 } 1243#endif /* CONFIG_TDLS_TESTING */ 1244 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1245 sizeof(timeoutie), lifetime); 1246 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1247 lifetime); 1248 1249 /* compute MIC before sending */ 1250 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1251 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1252 1253skip_ies: 1254 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1255 dtoken, 0, rbuf, pos - rbuf); 1256 os_free(rbuf); 1257 1258 return status; 1259} 1260 1261 1262static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1263 struct wpa_tdls_peer *peer, 1264 u8 dialog_token) 1265{ 1266 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1267 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1268 1269 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1270 dialog_token, 0, NULL, 0); 1271} 1272 1273 1274static int 1275wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1276 const u8 *buf, size_t len) 1277{ 1278 struct wpa_eapol_ie_parse kde; 1279 const struct wpa_tdls_lnkid *lnkid; 1280 struct wpa_tdls_peer *peer; 1281 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1282 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1283 u8 dialog_token; 1284 1285 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1286 MAC2STR(addr)); 1287 1288 if (len < min_req_len) { 1289 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1290 "%d", (int) len); 1291 return -1; 1292 } 1293 1294 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1295 1296 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1297 len - (sizeof(struct wpa_tdls_frame) + 1), 1298 &kde) < 0) 1299 return -1; 1300 1301 if (!kde.lnkid) { 1302 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1303 "Request"); 1304 return -1; 1305 } 1306 1307 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1308 1309 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1310 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1311 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1312 return -1; 1313 } 1314 1315 peer = wpa_tdls_add_peer(sm, addr, NULL); 1316 if (peer == NULL) 1317 return -1; 1318 1319 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1320} 1321 1322 1323int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1324{ 1325 if (sm->tdls_disabled || !sm->tdls_supported) 1326 return -1; 1327 1328 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1329 MACSTR, MAC2STR(addr)); 1330 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1331 1, 0, NULL, 0); 1332} 1333 1334 1335static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1336 struct wpa_tdls_peer *peer) 1337{ 1338 if (!kde->supp_rates) { 1339 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1340 return -1; 1341 } 1342 peer->supp_rates_len = merge_byte_arrays( 1343 peer->supp_rates, sizeof(peer->supp_rates), 1344 kde->supp_rates + 2, kde->supp_rates_len - 2, 1345 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1346 kde->ext_supp_rates_len - 2); 1347 return 0; 1348} 1349 1350 1351static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1352 struct wpa_tdls_peer *peer) 1353{ 1354 if (!kde->ht_capabilities || 1355 kde->ht_capabilities_len < 1356 sizeof(struct ieee80211_ht_capabilities) ) { 1357 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1358 "received"); 1359 return 0; 1360 } 1361 1362 if (!peer->ht_capabilities) { 1363 peer->ht_capabilities = 1364 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1365 if (peer->ht_capabilities == NULL) 1366 return -1; 1367 } 1368 1369 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1370 sizeof(struct ieee80211_ht_capabilities)); 1371 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1372 (u8 *) peer->ht_capabilities, 1373 sizeof(struct ieee80211_ht_capabilities)); 1374 1375 return 0; 1376} 1377 1378 1379static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1380 struct wpa_tdls_peer *peer) 1381{ 1382 if (!kde->vht_capabilities || 1383 kde->vht_capabilities_len < 1384 sizeof(struct ieee80211_vht_capabilities) ) { 1385 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1386 "received"); 1387 return 0; 1388 } 1389 1390 if (!peer->vht_capabilities) { 1391 peer->vht_capabilities = 1392 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1393 if (peer->vht_capabilities == NULL) 1394 return -1; 1395 } 1396 1397 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1398 sizeof(struct ieee80211_vht_capabilities)); 1399 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1400 (u8 *) peer->vht_capabilities, 1401 sizeof(struct ieee80211_vht_capabilities)); 1402 1403 return 0; 1404} 1405 1406 1407static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1408 struct wpa_tdls_peer *peer) 1409{ 1410 if (!kde->ext_capab) { 1411 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1412 "received"); 1413 return 0; 1414 } 1415 1416 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1417 /* Need to allocate buffer to fit the new information */ 1418 os_free(peer->ext_capab); 1419 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1420 if (peer->ext_capab == NULL) 1421 return -1; 1422 } 1423 1424 peer->ext_capab_len = kde->ext_capab_len - 2; 1425 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1426 1427 return 0; 1428} 1429 1430 1431static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1432 const u8 *buf, size_t len) 1433{ 1434 struct wpa_tdls_peer *peer; 1435 struct wpa_eapol_ie_parse kde; 1436 struct wpa_ie_data ie; 1437 int cipher; 1438 const u8 *cpos; 1439 struct wpa_tdls_ftie *ftie = NULL; 1440 struct wpa_tdls_timeoutie *timeoutie; 1441 struct wpa_tdls_lnkid *lnkid; 1442 u32 lifetime = 0; 1443#if 0 1444 struct rsn_ie_hdr *hdr; 1445 u8 *pos; 1446 u16 rsn_capab; 1447 u16 rsn_ver; 1448#endif 1449 u8 dtoken; 1450 u16 ielen; 1451 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1452 int tdls_prohibited = sm->tdls_prohibited; 1453 int existing_peer = 0; 1454 1455 if (len < 3 + 3) 1456 return -1; 1457 1458 cpos = buf; 1459 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1460 1461 /* driver had already verified the frame format */ 1462 dtoken = *cpos++; /* dialog token */ 1463 1464 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1465 1466 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1467 if (peer == NULL) 1468 goto error; 1469 1470 /* If found, use existing entry instead of adding a new one; 1471 * how to handle the case where both ends initiate at the 1472 * same time? */ 1473 if (existing_peer) { 1474 if (peer->tpk_success) { 1475 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1476 "direct link is enabled - tear down the " 1477 "old link first"); 1478#if 0 1479 /* TODO: Disabling the link would be more proper 1480 * operation here, but it seems to trigger a race with 1481 * some drivers handling the new request frame. */ 1482 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1483#else 1484 if (sm->tdls_external_setup) 1485 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1486 src_addr); 1487 else 1488 wpa_tdls_del_key(sm, peer); 1489#endif 1490 wpa_tdls_peer_free(sm, peer); 1491 } 1492 1493 /* 1494 * An entry is already present, so check if we already sent a 1495 * TDLS Setup Request. If so, compare MAC addresses and let the 1496 * STA with the lower MAC address continue as the initiator. 1497 * The other negotiation is terminated. 1498 */ 1499 if (peer->initiator) { 1500 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1501 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1502 "from peer with higher address " 1503 MACSTR, MAC2STR(src_addr)); 1504 return -1; 1505 } else { 1506 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1507 "from peer with lower address " 1508 MACSTR " (terminate previously " 1509 "initiated negotiation", 1510 MAC2STR(src_addr)); 1511 if (sm->tdls_external_setup) 1512 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1513 src_addr); 1514 else 1515 wpa_tdls_del_key(sm, peer); 1516 wpa_tdls_peer_free(sm, peer); 1517 } 1518 } 1519 } 1520 1521 /* capability information */ 1522 peer->capability = WPA_GET_LE16(cpos); 1523 cpos += 2; 1524 1525 ielen = len - (cpos - buf); /* start of IE in buf */ 1526 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1527 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1528 goto error; 1529 } 1530 1531 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1532 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1533 "TPK M1"); 1534 goto error; 1535 } 1536 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1537 kde.lnkid, kde.lnkid_len); 1538 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1539 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1540 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1541 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1542 goto error; 1543 } 1544 1545 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1546 MAC2STR(src_addr)); 1547 1548 if (copy_supp_rates(&kde, peer) < 0) 1549 goto error; 1550 1551 if (copy_peer_ht_capab(&kde, peer) < 0) 1552 goto error; 1553 1554 if (copy_peer_vht_capab(&kde, peer) < 0) 1555 goto error; 1556 1557 if (copy_peer_ext_capab(&kde, peer) < 0) 1558 goto error; 1559 1560 peer->qos_info = kde.qosinfo; 1561 1562 peer->aid = kde.aid; 1563 1564#ifdef CONFIG_TDLS_TESTING 1565 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1566 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1567 if (peer == NULL) 1568 goto error; 1569 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1570 "TDLS setup - send own request"); 1571 peer->initiator = 1; 1572 wpa_tdls_send_tpk_m1(sm, peer); 1573 } 1574 1575 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1576 tdls_prohibited) { 1577 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1578 "on TDLS"); 1579 tdls_prohibited = 0; 1580 } 1581#endif /* CONFIG_TDLS_TESTING */ 1582 1583 if (tdls_prohibited) { 1584 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1585 status = WLAN_STATUS_REQUEST_DECLINED; 1586 goto error; 1587 } 1588 1589 if (!wpa_tdls_get_privacy(sm)) { 1590 if (kde.rsn_ie) { 1591 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1592 "security is disabled"); 1593 status = WLAN_STATUS_SECURITY_DISABLED; 1594 goto error; 1595 } 1596 goto skip_rsn; 1597 } 1598 1599 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1600 kde.rsn_ie == NULL) { 1601 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1602 status = WLAN_STATUS_INVALID_PARAMETERS; 1603 goto error; 1604 } 1605 1606 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1607 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1608 "TPK M1"); 1609 status = WLAN_STATUS_INVALID_RSNIE; 1610 goto error; 1611 } 1612 1613 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1614 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1615 status = WLAN_STATUS_INVALID_RSNIE; 1616 goto error; 1617 } 1618 1619 cipher = ie.pairwise_cipher; 1620 if (cipher & WPA_CIPHER_CCMP) { 1621 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1622 cipher = WPA_CIPHER_CCMP; 1623 } else { 1624 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1625 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1626 goto error; 1627 } 1628 1629 if ((ie.capabilities & 1630 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1631 WPA_CAPABILITY_PEERKEY_ENABLED) { 1632 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1633 "TPK M1"); 1634 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1635 goto error; 1636 } 1637 1638 /* Lifetime */ 1639 if (kde.key_lifetime == NULL) { 1640 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1641 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1642 goto error; 1643 } 1644 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1645 lifetime = WPA_GET_LE32(timeoutie->value); 1646 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1647 if (lifetime < 300) { 1648 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1649 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1650 goto error; 1651 } 1652 1653skip_rsn: 1654#ifdef CONFIG_TDLS_TESTING 1655 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1656 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1657 /* 1658 * The request frame from us is going to win, so do not 1659 * replace information based on this request frame from 1660 * the peer. 1661 */ 1662 goto skip_rsn_check; 1663 } 1664 } 1665#endif /* CONFIG_TDLS_TESTING */ 1666 1667 peer->initiator = 0; /* Need to check */ 1668 peer->dtoken = dtoken; 1669 1670 if (!wpa_tdls_get_privacy(sm)) { 1671 peer->rsnie_i_len = 0; 1672 peer->rsnie_p_len = 0; 1673 peer->cipher = WPA_CIPHER_NONE; 1674 goto skip_rsn_check; 1675 } 1676 1677 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1678 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1679 peer->rsnie_i_len = kde.rsn_ie_len; 1680 peer->cipher = cipher; 1681 1682 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1683 /* 1684 * There is no point in updating the RNonce for every obtained 1685 * TPK M1 frame (e.g., retransmission due to timeout) with the 1686 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1687 * retransmitted with a different INonce, update the RNonce 1688 * since this is for a new TDLS session. 1689 */ 1690 wpa_printf(MSG_DEBUG, 1691 "TDLS: New TPK M1 INonce - generate new RNonce"); 1692 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1693 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1694 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1695 "TDLS: Failed to get random data for responder nonce"); 1696 wpa_tdls_peer_free(sm, peer); 1697 goto error; 1698 } 1699 } 1700 1701#if 0 1702 /* get version info from RSNIE received from Peer */ 1703 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1704 rsn_ver = WPA_GET_LE16(hdr->version); 1705 1706 /* use min(peer's version, out version) */ 1707 if (rsn_ver > RSN_VERSION) 1708 rsn_ver = RSN_VERSION; 1709 1710 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1711 1712 hdr->elem_id = WLAN_EID_RSN; 1713 WPA_PUT_LE16(hdr->version, rsn_ver); 1714 pos = (u8 *) (hdr + 1); 1715 1716 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1717 pos += RSN_SELECTOR_LEN; 1718 /* Include only the selected cipher in pairwise cipher suite */ 1719 WPA_PUT_LE16(pos, 1); 1720 pos += 2; 1721 if (cipher == WPA_CIPHER_CCMP) 1722 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1723 pos += RSN_SELECTOR_LEN; 1724 1725 WPA_PUT_LE16(pos, 1); 1726 pos += 2; 1727 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1728 pos += RSN_SELECTOR_LEN; 1729 1730 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1731 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1732 WPA_PUT_LE16(pos, rsn_capab); 1733 pos += 2; 1734 1735 hdr->len = (pos - peer->rsnie_p) - 2; 1736 peer->rsnie_p_len = pos - peer->rsnie_p; 1737#endif 1738 1739 /* temp fix: validation of RSNIE later */ 1740 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1741 peer->rsnie_p_len = peer->rsnie_i_len; 1742 1743 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1744 peer->rsnie_p, peer->rsnie_p_len); 1745 1746 peer->lifetime = lifetime; 1747 1748 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1749 1750skip_rsn_check: 1751 /* add the peer to the driver as a "setup in progress" peer */ 1752 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 1753 NULL, 0); 1754 1755 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1756 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1757 wpa_tdls_disable_link(sm, peer->addr); 1758 goto error; 1759 } 1760 1761 return 0; 1762 1763error: 1764 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1765 status); 1766 return -1; 1767} 1768 1769 1770static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1771{ 1772 peer->tpk_success = 1; 1773 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1774 if (wpa_tdls_get_privacy(sm)) { 1775 u32 lifetime = peer->lifetime; 1776 /* 1777 * Start the initiator process a bit earlier to avoid race 1778 * condition with the responder sending teardown request. 1779 */ 1780 if (lifetime > 3 && peer->initiator) 1781 lifetime -= 3; 1782 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1783 sm, peer); 1784#ifdef CONFIG_TDLS_TESTING 1785 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1786 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1787 "expiration"); 1788 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1789 } 1790#endif /* CONFIG_TDLS_TESTING */ 1791 } 1792 1793 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1794 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1795 peer->capability, 1796 peer->supp_rates, peer->supp_rates_len, 1797 peer->ht_capabilities, 1798 peer->vht_capabilities, 1799 peer->qos_info, peer->ext_capab, 1800 peer->ext_capab_len) < 0) 1801 return -1; 1802 1803 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1804 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1805 "driver"); 1806 return -1; 1807 } 1808 peer->reconfig_key = 0; 1809 1810 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1811} 1812 1813 1814static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1815 const u8 *buf, size_t len) 1816{ 1817 struct wpa_tdls_peer *peer; 1818 struct wpa_eapol_ie_parse kde; 1819 struct wpa_ie_data ie; 1820 int cipher; 1821 struct wpa_tdls_ftie *ftie; 1822 struct wpa_tdls_timeoutie *timeoutie; 1823 struct wpa_tdls_lnkid *lnkid; 1824 u32 lifetime; 1825 u8 dtoken; 1826 int ielen; 1827 u16 status; 1828 const u8 *pos; 1829 int ret; 1830 1831 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1832 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1833 for (peer = sm->tdls; peer; peer = peer->next) { 1834 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1835 break; 1836 } 1837 if (peer == NULL) { 1838 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1839 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1840 return -1; 1841 } 1842 if (!peer->initiator) { 1843 /* 1844 * This may happen if both devices try to initiate TDLS at the 1845 * same time and we accept the TPK M1 from the peer in 1846 * wpa_tdls_process_tpk_m1() and clear our previous state. 1847 */ 1848 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1849 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1850 return -1; 1851 } 1852 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1853 1854 if (len < 3 + 2 + 1) { 1855 wpa_tdls_disable_link(sm, src_addr); 1856 return -1; 1857 } 1858 1859 pos = buf; 1860 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1861 status = WPA_GET_LE16(pos); 1862 pos += 2 /* status code */; 1863 1864 if (status != WLAN_STATUS_SUCCESS) { 1865 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 1866 status); 1867 wpa_tdls_disable_link(sm, src_addr); 1868 return -1; 1869 } 1870 1871 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1872 1873 /* TODO: need to verify dialog token matches here or in kernel */ 1874 dtoken = *pos++; /* dialog token */ 1875 1876 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 1877 1878 if (len < 3 + 2 + 1 + 2) { 1879 wpa_tdls_disable_link(sm, src_addr); 1880 return -1; 1881 } 1882 1883 /* capability information */ 1884 peer->capability = WPA_GET_LE16(pos); 1885 pos += 2; 1886 1887 ielen = len - (pos - buf); /* start of IE in buf */ 1888 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 1889 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 1890 goto error; 1891 } 1892 1893#ifdef CONFIG_TDLS_TESTING 1894 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 1895 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 1896 status = WLAN_STATUS_REQUEST_DECLINED; 1897 goto error; 1898 } 1899#endif /* CONFIG_TDLS_TESTING */ 1900 1901 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1902 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1903 "TPK M2"); 1904 goto error; 1905 } 1906 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 1907 kde.lnkid, kde.lnkid_len); 1908 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1909 1910 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1911 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 1912 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1913 goto error; 1914 } 1915 1916 if (copy_supp_rates(&kde, peer) < 0) 1917 goto error; 1918 1919 if (copy_peer_ht_capab(&kde, peer) < 0) 1920 goto error; 1921 1922 if (copy_peer_vht_capab(&kde, peer) < 0) 1923 goto error; 1924 1925 if (copy_peer_ext_capab(&kde, peer) < 0) 1926 goto error; 1927 1928 peer->qos_info = kde.qosinfo; 1929 1930 peer->aid = kde.aid; 1931 1932 if (!wpa_tdls_get_privacy(sm)) { 1933 peer->rsnie_p_len = 0; 1934 peer->cipher = WPA_CIPHER_NONE; 1935 goto skip_rsn; 1936 } 1937 1938 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1939 kde.rsn_ie == NULL) { 1940 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 1941 status = WLAN_STATUS_INVALID_PARAMETERS; 1942 goto error; 1943 } 1944 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1945 kde.rsn_ie, kde.rsn_ie_len); 1946 1947 /* 1948 * FIX: bitwise comparison of RSN IE is not the correct way of 1949 * validation this. It can be different, but certain fields must 1950 * match. Since we list only a single pairwise cipher in TPK M1, the 1951 * memcmp is likely to work in most cases, though. 1952 */ 1953 if (kde.rsn_ie_len != peer->rsnie_i_len || 1954 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 1955 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 1956 "not match with RSN IE used in TPK M1"); 1957 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 1958 peer->rsnie_i, peer->rsnie_i_len); 1959 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1960 kde.rsn_ie, kde.rsn_ie_len); 1961 status = WLAN_STATUS_INVALID_RSNIE; 1962 goto error; 1963 } 1964 1965 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1966 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 1967 status = WLAN_STATUS_INVALID_RSNIE; 1968 goto error; 1969 } 1970 1971 cipher = ie.pairwise_cipher; 1972 if (cipher == WPA_CIPHER_CCMP) { 1973 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1974 cipher = WPA_CIPHER_CCMP; 1975 } else { 1976 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 1977 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1978 goto error; 1979 } 1980 1981 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 1982 kde.ftie, sizeof(*ftie)); 1983 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1984 1985 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 1986 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 1987 "not match with FTIE SNonce used in TPK M1"); 1988 /* Silently discard the frame */ 1989 return -1; 1990 } 1991 1992 /* Responder Nonce and RSN IE */ 1993 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 1994 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 1995 peer->rsnie_p_len = kde.rsn_ie_len; 1996 peer->cipher = cipher; 1997 1998 /* Lifetime */ 1999 if (kde.key_lifetime == NULL) { 2000 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 2001 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2002 goto error; 2003 } 2004 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2005 lifetime = WPA_GET_LE32(timeoutie->value); 2006 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 2007 lifetime); 2008 if (lifetime != peer->lifetime) { 2009 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2010 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2011 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2012 goto error; 2013 } 2014 2015 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2016 2017 /* Process MIC check to see if TPK M2 is right */ 2018 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2019 (u8 *) timeoutie, ftie) < 0) { 2020 /* Discard the frame */ 2021 wpa_tdls_del_key(sm, peer); 2022 wpa_tdls_peer_free(sm, peer); 2023 if (sm->tdls_external_setup) 2024 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2025 return -1; 2026 } 2027 2028 if (wpa_tdls_set_key(sm, peer) < 0) { 2029 /* 2030 * Some drivers may not be able to config the key prior to full 2031 * STA entry having been configured. 2032 */ 2033 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2034 "STA entry is complete"); 2035 peer->reconfig_key = 1; 2036 } 2037 2038skip_rsn: 2039 peer->dtoken = dtoken; 2040 2041 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2042 "TPK Handshake Message 3"); 2043 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) { 2044 wpa_tdls_disable_link(sm, peer->addr); 2045 return -1; 2046 } 2047 2048 ret = wpa_tdls_enable_link(sm, peer); 2049 if (ret < 0) { 2050 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2051 wpa_tdls_do_teardown(sm, peer, 2052 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2053 } 2054 return ret; 2055 2056error: 2057 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2058 status); 2059 wpa_tdls_disable_link(sm, peer->addr); 2060 return -1; 2061} 2062 2063 2064static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2065 const u8 *buf, size_t len) 2066{ 2067 struct wpa_tdls_peer *peer; 2068 struct wpa_eapol_ie_parse kde; 2069 struct wpa_tdls_ftie *ftie; 2070 struct wpa_tdls_timeoutie *timeoutie; 2071 struct wpa_tdls_lnkid *lnkid; 2072 int ielen; 2073 u16 status; 2074 const u8 *pos; 2075 u32 lifetime; 2076 int ret; 2077 2078 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2079 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2080 for (peer = sm->tdls; peer; peer = peer->next) { 2081 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2082 break; 2083 } 2084 if (peer == NULL) { 2085 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2086 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2087 return -1; 2088 } 2089 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2090 2091 if (len < 3 + 3) 2092 goto error; 2093 pos = buf; 2094 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2095 2096 status = WPA_GET_LE16(pos); 2097 2098 if (status != 0) { 2099 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2100 status); 2101 goto error; 2102 } 2103 pos += 2 /* status code */ + 1 /* dialog token */; 2104 2105 ielen = len - (pos - buf); /* start of IE in buf */ 2106 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2107 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2108 goto error; 2109 } 2110 2111 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2112 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2113 goto error; 2114 } 2115 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2116 (u8 *) kde.lnkid, kde.lnkid_len); 2117 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2118 2119 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2120 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2121 goto error; 2122 } 2123 2124 if (!wpa_tdls_get_privacy(sm)) 2125 goto skip_rsn; 2126 2127 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2128 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2129 goto error; 2130 } 2131 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2132 kde.ftie, sizeof(*ftie)); 2133 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2134 2135 if (kde.rsn_ie == NULL) { 2136 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2137 goto error; 2138 } 2139 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2140 kde.rsn_ie, kde.rsn_ie_len); 2141 if (kde.rsn_ie_len != peer->rsnie_p_len || 2142 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2143 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2144 "with the one sent in TPK M2"); 2145 goto error; 2146 } 2147 2148 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2149 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2150 "not match with FTIE ANonce used in TPK M2"); 2151 goto error; 2152 } 2153 2154 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2155 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2156 "match with FTIE SNonce used in TPK M1"); 2157 goto error; 2158 } 2159 2160 if (kde.key_lifetime == NULL) { 2161 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2162 goto error; 2163 } 2164 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2165 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2166 (u8 *) timeoutie, sizeof(*timeoutie)); 2167 lifetime = WPA_GET_LE32(timeoutie->value); 2168 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2169 lifetime); 2170 if (lifetime != peer->lifetime) { 2171 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2172 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2173 goto error; 2174 } 2175 2176 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2177 (u8 *) timeoutie, ftie) < 0) { 2178 wpa_tdls_del_key(sm, peer); 2179 goto error; 2180 } 2181 2182 if (wpa_tdls_set_key(sm, peer) < 0) { 2183 /* 2184 * Some drivers may not be able to config the key prior to full 2185 * STA entry having been configured. 2186 */ 2187 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2188 "STA entry is complete"); 2189 peer->reconfig_key = 1; 2190 } 2191 2192skip_rsn: 2193 ret = wpa_tdls_enable_link(sm, peer); 2194 if (ret < 0) { 2195 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2196 wpa_tdls_do_teardown(sm, peer, 2197 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2198 } 2199 return ret; 2200error: 2201 wpa_tdls_disable_link(sm, peer->addr); 2202 return -1; 2203} 2204 2205 2206static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2207{ 2208 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2209 2210 os_memset(lifetime, 0, ie_len); 2211 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2212 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2213 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2214 WPA_PUT_LE32(lifetime->value, tsecs); 2215 os_memcpy(pos, ie, ie_len); 2216 return pos + ie_len; 2217} 2218 2219 2220/** 2221 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2222 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2223 * @peer: MAC address of the peer STA 2224 * Returns: 0 on success, or -1 on failure 2225 * 2226 * Send TPK Handshake Message 1 info to driver to start TDLS 2227 * handshake with the peer. 2228 */ 2229int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2230{ 2231 struct wpa_tdls_peer *peer; 2232 int tdls_prohibited = sm->tdls_prohibited; 2233 2234 if (sm->tdls_disabled || !sm->tdls_supported) 2235 return -1; 2236 2237#ifdef CONFIG_TDLS_TESTING 2238 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2239 tdls_prohibited) { 2240 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2241 "on TDLS"); 2242 tdls_prohibited = 0; 2243 } 2244#endif /* CONFIG_TDLS_TESTING */ 2245 2246 if (tdls_prohibited) { 2247 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2248 "reject request to start setup"); 2249 return -1; 2250 } 2251 2252 peer = wpa_tdls_add_peer(sm, addr, NULL); 2253 if (peer == NULL) 2254 return -1; 2255 2256 peer->initiator = 1; 2257 2258 /* add the peer to the driver as a "setup in progress" peer */ 2259 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2260 NULL, 0); 2261 2262 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2263 wpa_tdls_disable_link(sm, peer->addr); 2264 return -1; 2265 } 2266 2267 return 0; 2268} 2269 2270 2271void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2272{ 2273 struct wpa_tdls_peer *peer; 2274 2275 if (sm->tdls_disabled || !sm->tdls_supported) 2276 return; 2277 2278 for (peer = sm->tdls; peer; peer = peer->next) { 2279 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2280 break; 2281 } 2282 2283 if (peer == NULL || !peer->tpk_success) 2284 return; 2285 2286 if (sm->tdls_external_setup) { 2287 /* 2288 * Disable previous link to allow renegotiation to be completed 2289 * on AP path. 2290 */ 2291 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2292 } 2293} 2294 2295 2296/** 2297 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2298 * 2299 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2300 */ 2301static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2302 const u8 *buf, size_t len) 2303{ 2304 struct wpa_sm *sm = ctx; 2305 struct wpa_tdls_frame *tf; 2306 2307 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2308 buf, len); 2309 2310 if (sm->tdls_disabled || !sm->tdls_supported) { 2311 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2312 "or unsupported by driver"); 2313 return; 2314 } 2315 2316 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2317 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2318 return; 2319 } 2320 2321 if (len < sizeof(*tf)) { 2322 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2323 return; 2324 } 2325 2326 /* Check to make sure its a valid encapsulated TDLS frame */ 2327 tf = (struct wpa_tdls_frame *) buf; 2328 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2329 tf->category != WLAN_ACTION_TDLS) { 2330 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2331 "category=%u action=%u", 2332 tf->payloadtype, tf->category, tf->action); 2333 return; 2334 } 2335 2336 switch (tf->action) { 2337 case WLAN_TDLS_SETUP_REQUEST: 2338 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2339 break; 2340 case WLAN_TDLS_SETUP_RESPONSE: 2341 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2342 break; 2343 case WLAN_TDLS_SETUP_CONFIRM: 2344 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2345 break; 2346 case WLAN_TDLS_TEARDOWN: 2347 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2348 break; 2349 case WLAN_TDLS_DISCOVERY_REQUEST: 2350 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2351 break; 2352 default: 2353 /* Kernel code will process remaining frames */ 2354 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2355 tf->action); 2356 break; 2357 } 2358} 2359 2360 2361/** 2362 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2363 * @wpa_s: Pointer to wpa_supplicant data 2364 * Returns: 0 on success, -1 on failure 2365 * 2366 * This function is called to initialize driver interface parameters for TDLS. 2367 * wpa_drv_init() must have been called before this function to initialize the 2368 * driver interface. 2369 */ 2370int wpa_tdls_init(struct wpa_sm *sm) 2371{ 2372 if (sm == NULL) 2373 return -1; 2374 2375 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2376 sm->ifname, 2377 sm->own_addr, 2378 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2379 sm, 0); 2380 if (sm->l2_tdls == NULL) { 2381 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2382 "connection"); 2383 return -1; 2384 } 2385 2386 /* 2387 * Drivers that support TDLS but don't implement the get_capa callback 2388 * are assumed to perform everything internally 2389 */ 2390 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2391 &sm->tdls_external_setup) < 0) { 2392 sm->tdls_supported = 1; 2393 sm->tdls_external_setup = 0; 2394 } 2395 2396 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2397 "driver", sm->tdls_supported ? "" : " not"); 2398 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2399 sm->tdls_external_setup ? "external" : "internal"); 2400 2401 return 0; 2402} 2403 2404 2405void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2406{ 2407 struct wpa_tdls_peer *peer; 2408 2409 peer = sm->tdls; 2410 2411 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2412 2413 while (peer) { 2414 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2415 MAC2STR(peer->addr)); 2416 if (sm->tdls_external_setup) 2417 wpa_tdls_send_teardown(sm, peer->addr, 2418 WLAN_REASON_DEAUTH_LEAVING); 2419 else 2420 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2421 2422 peer = peer->next; 2423 } 2424} 2425 2426 2427static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2428{ 2429 struct wpa_tdls_peer *peer, *tmp; 2430 2431 peer = sm->tdls; 2432 sm->tdls = NULL; 2433 2434 while (peer) { 2435 int res; 2436 tmp = peer->next; 2437 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2438 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2439 MAC2STR(peer->addr), res); 2440 wpa_tdls_peer_free(sm, peer); 2441 os_free(peer); 2442 peer = tmp; 2443 } 2444} 2445 2446 2447/** 2448 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2449 * 2450 * This function is called to recover driver interface parameters for TDLS 2451 * and frees resources allocated for it. 2452 */ 2453void wpa_tdls_deinit(struct wpa_sm *sm) 2454{ 2455 if (sm == NULL) 2456 return; 2457 2458 if (sm->l2_tdls) 2459 l2_packet_deinit(sm->l2_tdls); 2460 sm->l2_tdls = NULL; 2461 2462 wpa_tdls_remove_peers(sm); 2463} 2464 2465 2466void wpa_tdls_assoc(struct wpa_sm *sm) 2467{ 2468 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2469 wpa_tdls_remove_peers(sm); 2470} 2471 2472 2473void wpa_tdls_disassoc(struct wpa_sm *sm) 2474{ 2475 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2476 wpa_tdls_remove_peers(sm); 2477} 2478 2479 2480static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2481{ 2482 struct wpa_eapol_ie_parse elems; 2483 2484 if (ies == NULL) 2485 return 0; 2486 2487 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2488 return 0; 2489 2490 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2491 return 0; 2492 2493 /* bit 38 - TDLS Prohibited */ 2494 return !!(elems.ext_capab[2 + 4] & 0x40); 2495} 2496 2497 2498void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2499{ 2500 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2501 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2502 sm->tdls_prohibited ? "prohibited" : "allowed"); 2503} 2504 2505 2506void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2507{ 2508 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2509 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2510 "(Re)Association Response IEs"); 2511 sm->tdls_prohibited = 1; 2512 } 2513} 2514 2515 2516void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2517{ 2518 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2519 sm->tdls_disabled = !enabled; 2520} 2521 2522 2523int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2524{ 2525 return sm->tdls_external_setup; 2526} 2527