1 /* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "utils/eloop.h" 13 #include "utils/os.h" 14 #include "common/ieee802_11_defs.h" 15 #include "crypto/sha256.h" 16 #include "crypto/crypto.h" 17 #include "crypto/aes_wrap.h" 18 #include "rsn_supp/wpa.h" 19 #include "rsn_supp/wpa_ie.h" 20 #include "rsn_supp/wpa_i.h" 21 #include "drivers/driver.h" 22 #include "l2_packet/l2_packet.h" 23 24 #ifdef CONFIG_TDLS_TESTING 25 #define TDLS_TESTING_LONG_FRAME BIT(0) 26 #define TDLS_TESTING_ALT_RSN_IE BIT(1) 27 #define TDLS_TESTING_DIFF_BSSID BIT(2) 28 #define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31 #define TDLS_TESTING_LONG_LIFETIME BIT(6) 32 #define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34 #define TDLS_TESTING_DECLINE_RESP BIT(9) 35 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36 unsigned int tdls_testing = 0; 37 #endif /* CONFIG_TDLS_TESTING */ 38 39 #define TPK_LIFETIME 43200 /* 12 hours */ 40 #define TPK_RETRY_COUNT 3 41 #define TPK_TIMEOUT 5000 /* in milliseconds */ 42 43 #define TDLS_MIC_LEN 16 44 45 #define TDLS_TIMEOUT_LEN 4 46 47 struct wpa_tdls_ftie { 48 u8 ie_type; /* FTIE */ 49 u8 ie_len; 50 u8 mic_ctrl[2]; 51 u8 mic[TDLS_MIC_LEN]; 52 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 53 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 54 /* followed by optional elements */ 55 } STRUCT_PACKED; 56 57 struct wpa_tdls_timeoutie { 58 u8 ie_type; /* Timeout IE */ 59 u8 ie_len; 60 u8 interval_type; 61 u8 value[TDLS_TIMEOUT_LEN]; 62 } STRUCT_PACKED; 63 64 struct wpa_tdls_lnkid { 65 u8 ie_type; /* Link Identifier IE */ 66 u8 ie_len; 67 u8 bssid[ETH_ALEN]; 68 u8 init_sta[ETH_ALEN]; 69 u8 resp_sta[ETH_ALEN]; 70 } STRUCT_PACKED; 71 72 /* TDLS frame headers as per IEEE Std 802.11z-2010 */ 73 struct wpa_tdls_frame { 74 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 75 u8 category; /* Category */ 76 u8 action; /* Action (enum tdls_frame_type) */ 77 } STRUCT_PACKED; 78 79 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 80 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 81 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 82 83 84 #define TDLS_MAX_IE_LEN 80 85 #define IEEE80211_MAX_SUPP_RATES 32 86 87 struct wpa_tdls_peer { 88 struct wpa_tdls_peer *next; 89 int initiator; /* whether this end was initiator for TDLS setup */ 90 u8 addr[ETH_ALEN]; /* other end MAC address */ 91 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 92 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 93 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 94 size_t rsnie_i_len; 95 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 96 size_t rsnie_p_len; 97 u32 lifetime; 98 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 99 u8 dtoken; 100 101 struct tpk { 102 u8 kck[16]; /* TPK-KCK */ 103 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 104 } tpk; 105 int tpk_set; 106 int tpk_success; 107 108 struct tpk_timer { 109 u8 dest[ETH_ALEN]; 110 int count; /* Retry Count */ 111 int timer; /* Timeout in milliseconds */ 112 u8 action_code; /* TDLS frame type */ 113 u8 dialog_token; 114 u16 status_code; 115 int buf_len; /* length of TPK message for retransmission */ 116 u8 *buf; /* buffer for TPK message */ 117 } sm_tmr; 118 119 u16 capability; 120 121 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 122 size_t supp_rates_len; 123 124 struct ieee80211_ht_capabilities *ht_capabilities; 125 struct ieee80211_vht_capabilities *vht_capabilities; 126 127 u8 qos_info; 128 129 u8 *ext_capab; 130 size_t ext_capab_len; 131 }; 132 133 134 static int wpa_tdls_get_privacy(struct wpa_sm *sm) 135 { 136 /* 137 * Get info needed from supplicant to check if the current BSS supports 138 * security. Other than OPEN mode, rest are considered secured 139 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 140 */ 141 return sm->pairwise_cipher != WPA_CIPHER_NONE; 142 } 143 144 145 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 146 { 147 os_memcpy(pos, ie, ie_len); 148 return pos + ie_len; 149 } 150 151 152 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 153 { 154 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 155 0, 0, NULL, 0, NULL, 0) < 0) { 156 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 157 "the driver"); 158 return -1; 159 } 160 161 return 0; 162 } 163 164 165 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 166 { 167 u8 key_len; 168 u8 rsc[6]; 169 enum wpa_alg alg; 170 171 os_memset(rsc, 0, 6); 172 173 switch (peer->cipher) { 174 case WPA_CIPHER_CCMP: 175 alg = WPA_ALG_CCMP; 176 key_len = 16; 177 break; 178 case WPA_CIPHER_NONE: 179 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 180 "NONE - do not use pairwise keys"); 181 return -1; 182 default: 183 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 184 sm->pairwise_cipher); 185 return -1; 186 } 187 188 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 189 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 190 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 191 "driver"); 192 return -1; 193 } 194 return 0; 195 } 196 197 198 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 199 u8 action_code, u8 dialog_token, 200 u16 status_code, const u8 *buf, size_t len) 201 { 202 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 203 status_code, buf, len); 204 } 205 206 207 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 208 u8 dialog_token, u16 status_code, 209 const u8 *msg, size_t msg_len) 210 { 211 struct wpa_tdls_peer *peer; 212 213 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 214 "dialog_token=%u status_code=%u msg_len=%u", 215 MAC2STR(dest), action_code, dialog_token, status_code, 216 (unsigned int) msg_len); 217 218 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 219 status_code, msg, msg_len)) { 220 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 221 "(action_code=%u)", action_code); 222 return -1; 223 } 224 225 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 226 action_code == WLAN_TDLS_TEARDOWN || 227 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 228 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 229 return 0; /* No retries */ 230 231 for (peer = sm->tdls; peer; peer = peer->next) { 232 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 233 break; 234 } 235 236 if (peer == NULL) { 237 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 238 "retry " MACSTR, MAC2STR(dest)); 239 return 0; 240 } 241 242 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 243 244 peer->sm_tmr.count = TPK_RETRY_COUNT; 245 peer->sm_tmr.timer = TPK_TIMEOUT; 246 247 /* Copy message to resend on timeout */ 248 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 249 peer->sm_tmr.action_code = action_code; 250 peer->sm_tmr.dialog_token = dialog_token; 251 peer->sm_tmr.status_code = status_code; 252 peer->sm_tmr.buf_len = msg_len; 253 os_free(peer->sm_tmr.buf); 254 peer->sm_tmr.buf = os_malloc(msg_len); 255 if (peer->sm_tmr.buf == NULL) 256 return -1; 257 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 258 259 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 260 "(action_code=%u)", action_code); 261 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0, 262 wpa_tdls_tpk_retry_timeout, sm, peer); 263 return 0; 264 } 265 266 267 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 268 u16 reason_code, int free_peer) 269 { 270 int ret; 271 272 if (sm->tdls_external_setup) { 273 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 274 275 /* disable the link after teardown was sent */ 276 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 277 } else { 278 ret = wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 279 } 280 281 if (sm->tdls_external_setup || free_peer) 282 wpa_tdls_peer_free(sm, peer); 283 284 return ret; 285 } 286 287 288 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 289 { 290 291 struct wpa_sm *sm = eloop_ctx; 292 struct wpa_tdls_peer *peer = timeout_ctx; 293 294 if (peer->sm_tmr.count) { 295 peer->sm_tmr.count--; 296 peer->sm_tmr.timer = TPK_TIMEOUT; 297 298 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 299 "(action_code=%u)", 300 peer->sm_tmr.action_code); 301 302 if (peer->sm_tmr.buf == NULL) { 303 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 304 "for action_code=%u", 305 peer->sm_tmr.action_code); 306 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 307 peer); 308 return; 309 } 310 311 /* resend TPK Handshake Message to Peer */ 312 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 313 peer->sm_tmr.action_code, 314 peer->sm_tmr.dialog_token, 315 peer->sm_tmr.status_code, 316 peer->sm_tmr.buf, 317 peer->sm_tmr.buf_len)) { 318 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 319 "transmission"); 320 } 321 322 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 323 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0, 324 wpa_tdls_tpk_retry_timeout, sm, peer); 325 } else { 326 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 327 328 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 329 wpa_tdls_do_teardown(sm, peer, 330 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 331 } 332 } 333 334 335 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 336 struct wpa_tdls_peer *peer, 337 u8 action_code) 338 { 339 if (action_code == peer->sm_tmr.action_code) { 340 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 341 "action_code=%u", action_code); 342 343 /* Cancel Timeout registered */ 344 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 345 346 /* free all resources meant for retry */ 347 os_free(peer->sm_tmr.buf); 348 peer->sm_tmr.buf = NULL; 349 350 peer->sm_tmr.count = 0; 351 peer->sm_tmr.timer = 0; 352 peer->sm_tmr.buf_len = 0; 353 peer->sm_tmr.action_code = 0xff; 354 } else { 355 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 356 "(Unknown action_code=%u)", action_code); 357 } 358 } 359 360 361 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 362 const u8 *own_addr, const u8 *bssid) 363 { 364 u8 key_input[SHA256_MAC_LEN]; 365 const u8 *nonce[2]; 366 size_t len[2]; 367 u8 data[3 * ETH_ALEN]; 368 369 /* IEEE Std 802.11z-2010 8.5.9.1: 370 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 371 */ 372 len[0] = WPA_NONCE_LEN; 373 len[1] = WPA_NONCE_LEN; 374 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 375 nonce[0] = peer->inonce; 376 nonce[1] = peer->rnonce; 377 } else { 378 nonce[0] = peer->rnonce; 379 nonce[1] = peer->inonce; 380 } 381 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 382 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 383 sha256_vector(2, nonce, len, key_input); 384 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 385 key_input, SHA256_MAC_LEN); 386 387 /* 388 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 389 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 390 * TODO: is N_KEY really included in KDF Context and if so, in which 391 * presentation format (little endian 16-bit?) is it used? It gets 392 * added by the KDF anyway.. 393 */ 394 395 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 396 os_memcpy(data, own_addr, ETH_ALEN); 397 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 398 } else { 399 os_memcpy(data, peer->addr, ETH_ALEN); 400 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 401 } 402 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 403 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 404 405 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 406 (u8 *) &peer->tpk, sizeof(peer->tpk)); 407 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 408 peer->tpk.kck, sizeof(peer->tpk.kck)); 409 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 410 peer->tpk.tk, sizeof(peer->tpk.tk)); 411 peer->tpk_set = 1; 412 } 413 414 415 /** 416 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 417 * @kck: TPK-KCK 418 * @lnkid: Pointer to the beginning of Link Identifier IE 419 * @rsnie: Pointer to the beginning of RSN IE used for handshake 420 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 421 * @ftie: Pointer to the beginning of FT IE 422 * @mic: Pointer for writing MIC 423 * 424 * Calculate MIC for TDLS frame. 425 */ 426 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 427 const u8 *rsnie, const u8 *timeoutie, 428 const u8 *ftie, u8 *mic) 429 { 430 u8 *buf, *pos; 431 struct wpa_tdls_ftie *_ftie; 432 const struct wpa_tdls_lnkid *_lnkid; 433 int ret; 434 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 435 2 + timeoutie[1] + 2 + ftie[1]; 436 buf = os_zalloc(len); 437 if (!buf) { 438 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 439 return -1; 440 } 441 442 pos = buf; 443 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 444 /* 1) TDLS initiator STA MAC address */ 445 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 446 pos += ETH_ALEN; 447 /* 2) TDLS responder STA MAC address */ 448 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 449 pos += ETH_ALEN; 450 /* 3) Transaction Sequence number */ 451 *pos++ = trans_seq; 452 /* 4) Link Identifier IE */ 453 os_memcpy(pos, lnkid, 2 + lnkid[1]); 454 pos += 2 + lnkid[1]; 455 /* 5) RSN IE */ 456 os_memcpy(pos, rsnie, 2 + rsnie[1]); 457 pos += 2 + rsnie[1]; 458 /* 6) Timeout Interval IE */ 459 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 460 pos += 2 + timeoutie[1]; 461 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 462 os_memcpy(pos, ftie, 2 + ftie[1]); 463 _ftie = (struct wpa_tdls_ftie *) pos; 464 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 465 pos += 2 + ftie[1]; 466 467 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 468 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 469 ret = omac1_aes_128(kck, buf, pos - buf, mic); 470 os_free(buf); 471 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 472 return ret; 473 } 474 475 476 /** 477 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 478 * @kck: TPK-KCK 479 * @trans_seq: Transaction Sequence Number (4 - Teardown) 480 * @rcode: Reason code for Teardown 481 * @dtoken: Dialog Token used for that particular link 482 * @lnkid: Pointer to the beginning of Link Identifier IE 483 * @ftie: Pointer to the beginning of FT IE 484 * @mic: Pointer for writing MIC 485 * 486 * Calculate MIC for TDLS frame. 487 */ 488 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 489 u8 dtoken, const u8 *lnkid, 490 const u8 *ftie, u8 *mic) 491 { 492 u8 *buf, *pos; 493 struct wpa_tdls_ftie *_ftie; 494 int ret; 495 int len; 496 497 if (lnkid == NULL) 498 return -1; 499 500 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 501 sizeof(trans_seq) + 2 + ftie[1]; 502 503 buf = os_zalloc(len); 504 if (!buf) { 505 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 506 return -1; 507 } 508 509 pos = buf; 510 /* 1) Link Identifier IE */ 511 os_memcpy(pos, lnkid, 2 + lnkid[1]); 512 pos += 2 + lnkid[1]; 513 /* 2) Reason Code */ 514 WPA_PUT_LE16(pos, rcode); 515 pos += sizeof(rcode); 516 /* 3) Dialog token */ 517 *pos++ = dtoken; 518 /* 4) Transaction Sequence number */ 519 *pos++ = trans_seq; 520 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 521 os_memcpy(pos, ftie, 2 + ftie[1]); 522 _ftie = (struct wpa_tdls_ftie *) pos; 523 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 524 pos += 2 + ftie[1]; 525 526 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 527 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 528 ret = omac1_aes_128(kck, buf, pos - buf, mic); 529 os_free(buf); 530 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 531 return ret; 532 } 533 534 535 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 536 struct wpa_tdls_peer *peer, 537 const u8 *lnkid, const u8 *timeoutie, 538 const struct wpa_tdls_ftie *ftie) 539 { 540 u8 mic[16]; 541 542 if (peer->tpk_set) { 543 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 544 peer->rsnie_p, timeoutie, (u8 *) ftie, 545 mic); 546 if (os_memcmp(mic, ftie->mic, 16) != 0) { 547 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 548 "dropping packet"); 549 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 550 ftie->mic, 16); 551 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 552 mic, 16); 553 return -1; 554 } 555 } else { 556 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 557 "TPK not set - dropping packet"); 558 return -1; 559 } 560 return 0; 561 } 562 563 564 static int wpa_supplicant_verify_tdls_mic_teardown( 565 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 566 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 567 { 568 u8 mic[16]; 569 570 if (peer->tpk_set) { 571 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 572 dtoken, lnkid, (u8 *) ftie, mic); 573 if (os_memcmp(mic, ftie->mic, 16) != 0) { 574 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 575 "dropping packet"); 576 return -1; 577 } 578 } else { 579 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 580 "MIC, TPK not set - dropping packet"); 581 return -1; 582 } 583 return 0; 584 } 585 586 587 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 588 { 589 struct wpa_sm *sm = eloop_ctx; 590 struct wpa_tdls_peer *peer = timeout_ctx; 591 592 /* 593 * On TPK lifetime expiration, we have an option of either tearing down 594 * the direct link or trying to re-initiate it. The selection of what 595 * to do is not strictly speaking controlled by our role in the expired 596 * link, but for now, use that to select whether to renew or tear down 597 * the link. 598 */ 599 600 if (peer->initiator) { 601 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 602 " - try to renew", MAC2STR(peer->addr)); 603 wpa_tdls_start(sm, peer->addr); 604 } else { 605 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 606 " - tear down", MAC2STR(peer->addr)); 607 wpa_tdls_do_teardown(sm, peer, 608 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, 1); 609 } 610 } 611 612 613 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 614 { 615 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 616 MAC2STR(peer->addr)); 617 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 618 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 619 peer->initiator = 0; 620 os_free(peer->sm_tmr.buf); 621 peer->sm_tmr.buf = NULL; 622 os_free(peer->ht_capabilities); 623 peer->ht_capabilities = NULL; 624 os_free(peer->vht_capabilities); 625 peer->vht_capabilities = NULL; 626 os_free(peer->ext_capab); 627 peer->ext_capab = NULL; 628 peer->rsnie_i_len = peer->rsnie_p_len = 0; 629 peer->cipher = 0; 630 peer->tpk_set = peer->tpk_success = 0; 631 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 632 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 633 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 634 } 635 636 637 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 638 struct wpa_tdls_lnkid *lnkid) 639 { 640 lnkid->ie_type = WLAN_EID_LINK_ID; 641 lnkid->ie_len = 3 * ETH_ALEN; 642 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 643 if (peer->initiator) { 644 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 645 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 646 } else { 647 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 648 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 649 } 650 } 651 652 653 int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 654 { 655 struct wpa_tdls_peer *peer; 656 struct wpa_tdls_ftie *ftie; 657 struct wpa_tdls_lnkid lnkid; 658 u8 dialog_token; 659 u8 *rbuf, *pos; 660 int ielen; 661 662 if (sm->tdls_disabled || !sm->tdls_supported) 663 return -1; 664 665 /* Find the node and free from the list */ 666 for (peer = sm->tdls; peer; peer = peer->next) { 667 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 668 break; 669 } 670 671 if (peer == NULL) { 672 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 673 "Teardown " MACSTR, MAC2STR(addr)); 674 return 0; 675 } 676 677 dialog_token = peer->dtoken; 678 679 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 680 MAC2STR(addr)); 681 682 ielen = 0; 683 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 684 /* To add FTIE for Teardown request and compute MIC */ 685 ielen += sizeof(*ftie); 686 #ifdef CONFIG_TDLS_TESTING 687 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 688 ielen += 170; 689 #endif /* CONFIG_TDLS_TESTING */ 690 } 691 692 rbuf = os_zalloc(ielen + 1); 693 if (rbuf == NULL) 694 return -1; 695 pos = rbuf; 696 697 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) { 698 if (reason_code != WLAN_REASON_DEAUTH_LEAVING) { 699 /* Overwrite the reason code */ 700 reason_code = WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED; 701 } 702 goto skip_ies; 703 } 704 705 ftie = (struct wpa_tdls_ftie *) pos; 706 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 707 /* Using the recent nonce which should be for CONFIRM frame */ 708 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 709 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 710 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 711 pos = (u8 *) (ftie + 1); 712 #ifdef CONFIG_TDLS_TESTING 713 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 714 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 715 "FTIE"); 716 ftie->ie_len += 170; 717 *pos++ = 255; /* FTIE subelem */ 718 *pos++ = 168; /* FTIE subelem length */ 719 pos += 168; 720 } 721 #endif /* CONFIG_TDLS_TESTING */ 722 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 723 (u8 *) ftie, pos - (u8 *) ftie); 724 725 /* compute MIC before sending */ 726 wpa_tdls_linkid(sm, peer, &lnkid); 727 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 728 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 729 ftie->mic); 730 731 skip_ies: 732 /* TODO: register for a Timeout handler, if Teardown is not received at 733 * the other end, then try again another time */ 734 735 /* request driver to send Teardown using this FTIE */ 736 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 737 reason_code, rbuf, pos - rbuf); 738 os_free(rbuf); 739 740 /* clear the Peerkey statemachine */ 741 wpa_tdls_peer_free(sm, peer); 742 743 return 0; 744 } 745 746 747 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 748 { 749 struct wpa_tdls_peer *peer; 750 751 if (sm->tdls_disabled || !sm->tdls_supported) 752 return -1; 753 754 for (peer = sm->tdls; peer; peer = peer->next) { 755 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 756 break; 757 } 758 759 if (peer == NULL) { 760 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 761 " for link Teardown", MAC2STR(addr)); 762 return -1; 763 } 764 765 if (!peer->tpk_success) { 766 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 767 " not connected - cannot Teardown link", MAC2STR(addr)); 768 return -1; 769 } 770 771 return wpa_tdls_do_teardown(sm, peer, reason_code, 0); 772 } 773 774 775 void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 776 { 777 struct wpa_tdls_peer *peer; 778 779 for (peer = sm->tdls; peer; peer = peer->next) { 780 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 781 break; 782 } 783 784 if (peer) { 785 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr); 786 wpa_tdls_peer_free(sm, peer); 787 } 788 } 789 790 791 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 792 const u8 *buf, size_t len) 793 { 794 struct wpa_tdls_peer *peer = NULL; 795 struct wpa_tdls_ftie *ftie; 796 struct wpa_tdls_lnkid *lnkid; 797 struct wpa_eapol_ie_parse kde; 798 u16 reason_code; 799 const u8 *pos; 800 int ielen; 801 802 /* Find the node and free from the list */ 803 for (peer = sm->tdls; peer; peer = peer->next) { 804 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 805 break; 806 } 807 808 if (peer == NULL) { 809 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 810 "Teardown " MACSTR, MAC2STR(src_addr)); 811 return 0; 812 } 813 814 pos = buf; 815 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 816 817 reason_code = WPA_GET_LE16(pos); 818 pos += 2; 819 820 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 821 " (reason code %u)", MAC2STR(src_addr), reason_code); 822 823 ielen = len - (pos - buf); /* start of IE in buf */ 824 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 825 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 826 return -1; 827 } 828 829 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 830 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 831 "Teardown"); 832 return -1; 833 } 834 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 835 836 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 837 goto skip_ftie; 838 839 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 840 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 841 return -1; 842 } 843 844 ftie = (struct wpa_tdls_ftie *) kde.ftie; 845 846 /* Process MIC check to see if TDLS Teardown is right */ 847 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 848 peer->dtoken, peer, 849 (u8 *) lnkid, ftie) < 0) { 850 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 851 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 852 return -1; 853 } 854 855 skip_ftie: 856 /* 857 * Request the driver to disable the direct link and clear associated 858 * keys. 859 */ 860 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 861 862 /* clear the Peerkey statemachine */ 863 wpa_tdls_peer_free(sm, peer); 864 865 return 0; 866 } 867 868 869 /** 870 * wpa_tdls_send_error - To send suitable TDLS status response with 871 * appropriate status code mentioning reason for error/failure. 872 * @dst - MAC addr of Peer station 873 * @tdls_action - TDLS frame type for which error code is sent 874 * @status - status code mentioning reason 875 */ 876 877 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 878 u8 tdls_action, u8 dialog_token, u16 status) 879 { 880 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 881 " (action=%u status=%u)", 882 MAC2STR(dst), tdls_action, status); 883 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 884 NULL, 0); 885 } 886 887 888 static struct wpa_tdls_peer * 889 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 890 { 891 struct wpa_tdls_peer *peer; 892 893 if (existing) 894 *existing = 0; 895 for (peer = sm->tdls; peer; peer = peer->next) { 896 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 897 if (existing) 898 *existing = 1; 899 return peer; /* re-use existing entry */ 900 } 901 } 902 903 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 904 MAC2STR(addr)); 905 906 peer = os_zalloc(sizeof(*peer)); 907 if (peer == NULL) 908 return NULL; 909 910 os_memcpy(peer->addr, addr, ETH_ALEN); 911 peer->next = sm->tdls; 912 sm->tdls = peer; 913 914 return peer; 915 } 916 917 918 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 919 struct wpa_tdls_peer *peer) 920 { 921 size_t buf_len; 922 struct wpa_tdls_timeoutie timeoutie; 923 u16 rsn_capab; 924 struct wpa_tdls_ftie *ftie; 925 u8 *rbuf, *pos, *count_pos; 926 u16 count; 927 struct rsn_ie_hdr *hdr; 928 929 if (!wpa_tdls_get_privacy(sm)) { 930 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 931 peer->rsnie_i_len = 0; 932 goto skip_rsnie; 933 } 934 935 /* 936 * TPK Handshake Message 1: 937 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 938 * Timeout Interval IE)) 939 */ 940 941 /* Filling RSN IE */ 942 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 943 hdr->elem_id = WLAN_EID_RSN; 944 WPA_PUT_LE16(hdr->version, RSN_VERSION); 945 946 pos = (u8 *) (hdr + 1); 947 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 948 pos += RSN_SELECTOR_LEN; 949 count_pos = pos; 950 pos += 2; 951 952 count = 0; 953 954 /* 955 * AES-CCMP is the default Encryption preferred for TDLS, so 956 * RSN IE is filled only with CCMP CIPHER 957 * Note: TKIP is not used to encrypt TDLS link. 958 * 959 * Regardless of the cipher used on the AP connection, select CCMP 960 * here. 961 */ 962 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 963 pos += RSN_SELECTOR_LEN; 964 count++; 965 966 WPA_PUT_LE16(count_pos, count); 967 968 WPA_PUT_LE16(pos, 1); 969 pos += 2; 970 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 971 pos += RSN_SELECTOR_LEN; 972 973 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 974 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 975 #ifdef CONFIG_TDLS_TESTING 976 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 977 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 978 "testing"); 979 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 980 } 981 #endif /* CONFIG_TDLS_TESTING */ 982 WPA_PUT_LE16(pos, rsn_capab); 983 pos += 2; 984 #ifdef CONFIG_TDLS_TESTING 985 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 986 /* Number of PMKIDs */ 987 *pos++ = 0x00; 988 *pos++ = 0x00; 989 } 990 #endif /* CONFIG_TDLS_TESTING */ 991 992 hdr->len = (pos - peer->rsnie_i) - 2; 993 peer->rsnie_i_len = pos - peer->rsnie_i; 994 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 995 peer->rsnie_i, peer->rsnie_i_len); 996 997 skip_rsnie: 998 buf_len = 0; 999 if (wpa_tdls_get_privacy(sm)) 1000 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1001 sizeof(struct wpa_tdls_timeoutie); 1002 #ifdef CONFIG_TDLS_TESTING 1003 if (wpa_tdls_get_privacy(sm) && 1004 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1005 buf_len += 170; 1006 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1007 buf_len += sizeof(struct wpa_tdls_lnkid); 1008 #endif /* CONFIG_TDLS_TESTING */ 1009 rbuf = os_zalloc(buf_len + 1); 1010 if (rbuf == NULL) { 1011 wpa_tdls_peer_free(sm, peer); 1012 return -1; 1013 } 1014 pos = rbuf; 1015 1016 if (!wpa_tdls_get_privacy(sm)) 1017 goto skip_ies; 1018 1019 /* Initiator RSN IE */ 1020 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1021 1022 ftie = (struct wpa_tdls_ftie *) pos; 1023 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1024 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1025 1026 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1027 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1028 "TDLS: Failed to get random data for initiator Nonce"); 1029 os_free(rbuf); 1030 wpa_tdls_peer_free(sm, peer); 1031 return -1; 1032 } 1033 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1034 peer->inonce, WPA_NONCE_LEN); 1035 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1036 1037 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1038 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1039 1040 pos = (u8 *) (ftie + 1); 1041 1042 #ifdef CONFIG_TDLS_TESTING 1043 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1044 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1045 "FTIE"); 1046 ftie->ie_len += 170; 1047 *pos++ = 255; /* FTIE subelem */ 1048 *pos++ = 168; /* FTIE subelem length */ 1049 pos += 168; 1050 } 1051 #endif /* CONFIG_TDLS_TESTING */ 1052 1053 /* Lifetime */ 1054 peer->lifetime = TPK_LIFETIME; 1055 #ifdef CONFIG_TDLS_TESTING 1056 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1057 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1058 "lifetime"); 1059 peer->lifetime = 301; 1060 } 1061 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1062 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1063 "lifetime"); 1064 peer->lifetime = 0xffffffff; 1065 } 1066 #endif /* CONFIG_TDLS_TESTING */ 1067 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1068 sizeof(timeoutie), peer->lifetime); 1069 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1070 1071 skip_ies: 1072 1073 #ifdef CONFIG_TDLS_TESTING 1074 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1075 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1076 "Link Identifier"); 1077 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1078 wpa_tdls_linkid(sm, peer, l); 1079 l->bssid[5] ^= 0x01; 1080 pos += sizeof(*l); 1081 } 1082 #endif /* CONFIG_TDLS_TESTING */ 1083 1084 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1085 "Handshake Message 1 (peer " MACSTR ")", 1086 MAC2STR(peer->addr)); 1087 1088 wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1, 0, 1089 rbuf, pos - rbuf); 1090 os_free(rbuf); 1091 1092 return 0; 1093 } 1094 1095 1096 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1097 const unsigned char *src_addr, u8 dtoken, 1098 struct wpa_tdls_lnkid *lnkid, 1099 const struct wpa_tdls_peer *peer) 1100 { 1101 u8 *rbuf, *pos; 1102 size_t buf_len; 1103 u32 lifetime; 1104 struct wpa_tdls_timeoutie timeoutie; 1105 struct wpa_tdls_ftie *ftie; 1106 1107 buf_len = 0; 1108 if (wpa_tdls_get_privacy(sm)) { 1109 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1110 * Lifetime */ 1111 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1112 sizeof(struct wpa_tdls_timeoutie); 1113 #ifdef CONFIG_TDLS_TESTING 1114 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1115 buf_len += 170; 1116 #endif /* CONFIG_TDLS_TESTING */ 1117 } 1118 1119 rbuf = os_zalloc(buf_len + 1); 1120 if (rbuf == NULL) 1121 return -1; 1122 pos = rbuf; 1123 1124 if (!wpa_tdls_get_privacy(sm)) 1125 goto skip_ies; 1126 1127 /* Peer RSN IE */ 1128 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1129 1130 ftie = (struct wpa_tdls_ftie *) pos; 1131 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1132 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1133 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1134 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1135 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1136 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1137 (u8 *) ftie, sizeof(*ftie)); 1138 1139 pos = (u8 *) (ftie + 1); 1140 1141 #ifdef CONFIG_TDLS_TESTING 1142 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1143 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1144 "FTIE"); 1145 ftie->ie_len += 170; 1146 *pos++ = 255; /* FTIE subelem */ 1147 *pos++ = 168; /* FTIE subelem length */ 1148 pos += 168; 1149 } 1150 #endif /* CONFIG_TDLS_TESTING */ 1151 1152 /* Lifetime */ 1153 lifetime = peer->lifetime; 1154 #ifdef CONFIG_TDLS_TESTING 1155 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1156 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1157 "lifetime in response"); 1158 lifetime++; 1159 } 1160 #endif /* CONFIG_TDLS_TESTING */ 1161 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1162 sizeof(timeoutie), lifetime); 1163 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1164 lifetime); 1165 1166 /* compute MIC before sending */ 1167 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1168 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1169 1170 skip_ies: 1171 wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0, 1172 rbuf, pos - rbuf); 1173 os_free(rbuf); 1174 1175 return 0; 1176 } 1177 1178 1179 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1180 const unsigned char *src_addr, u8 dtoken, 1181 struct wpa_tdls_lnkid *lnkid, 1182 const struct wpa_tdls_peer *peer) 1183 { 1184 u8 *rbuf, *pos; 1185 size_t buf_len; 1186 struct wpa_tdls_ftie *ftie; 1187 struct wpa_tdls_timeoutie timeoutie; 1188 u32 lifetime; 1189 1190 buf_len = 0; 1191 if (wpa_tdls_get_privacy(sm)) { 1192 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1193 * Lifetime */ 1194 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1195 sizeof(struct wpa_tdls_timeoutie); 1196 #ifdef CONFIG_TDLS_TESTING 1197 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1198 buf_len += 170; 1199 #endif /* CONFIG_TDLS_TESTING */ 1200 } 1201 1202 rbuf = os_zalloc(buf_len + 1); 1203 if (rbuf == NULL) 1204 return -1; 1205 pos = rbuf; 1206 1207 if (!wpa_tdls_get_privacy(sm)) 1208 goto skip_ies; 1209 1210 /* Peer RSN IE */ 1211 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1212 1213 ftie = (struct wpa_tdls_ftie *) pos; 1214 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1215 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1216 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1217 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1218 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1219 1220 pos = (u8 *) (ftie + 1); 1221 1222 #ifdef CONFIG_TDLS_TESTING 1223 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1224 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1225 "FTIE"); 1226 ftie->ie_len += 170; 1227 *pos++ = 255; /* FTIE subelem */ 1228 *pos++ = 168; /* FTIE subelem length */ 1229 pos += 168; 1230 } 1231 #endif /* CONFIG_TDLS_TESTING */ 1232 1233 /* Lifetime */ 1234 lifetime = peer->lifetime; 1235 #ifdef CONFIG_TDLS_TESTING 1236 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1237 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1238 "lifetime in confirm"); 1239 lifetime++; 1240 } 1241 #endif /* CONFIG_TDLS_TESTING */ 1242 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1243 sizeof(timeoutie), lifetime); 1244 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1245 lifetime); 1246 1247 /* compute MIC before sending */ 1248 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1249 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1250 1251 skip_ies: 1252 wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 0, 1253 rbuf, pos - rbuf); 1254 os_free(rbuf); 1255 1256 return 0; 1257 } 1258 1259 1260 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1261 struct wpa_tdls_peer *peer, 1262 u8 dialog_token) 1263 { 1264 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1265 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1266 1267 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1268 dialog_token, 0, NULL, 0); 1269 } 1270 1271 1272 static int 1273 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1274 const u8 *buf, size_t len) 1275 { 1276 struct wpa_eapol_ie_parse kde; 1277 const struct wpa_tdls_lnkid *lnkid; 1278 struct wpa_tdls_peer *peer; 1279 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1280 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1281 u8 dialog_token; 1282 1283 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1284 MAC2STR(addr)); 1285 1286 if (len < min_req_len) { 1287 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1288 "%d", (int) len); 1289 return -1; 1290 } 1291 1292 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1293 1294 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1295 len - (sizeof(struct wpa_tdls_frame) + 1), 1296 &kde) < 0) 1297 return -1; 1298 1299 if (!kde.lnkid) { 1300 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1301 "Request"); 1302 return -1; 1303 } 1304 1305 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1306 1307 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1308 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1309 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1310 return -1; 1311 } 1312 1313 peer = wpa_tdls_add_peer(sm, addr, NULL); 1314 if (peer == NULL) 1315 return -1; 1316 1317 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1318 } 1319 1320 1321 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1322 { 1323 if (sm->tdls_disabled || !sm->tdls_supported) 1324 return -1; 1325 1326 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1327 MACSTR, MAC2STR(addr)); 1328 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1329 1, 0, NULL, 0); 1330 } 1331 1332 1333 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1334 struct wpa_tdls_peer *peer) 1335 { 1336 if (!kde->supp_rates) { 1337 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1338 return -1; 1339 } 1340 peer->supp_rates_len = merge_byte_arrays( 1341 peer->supp_rates, sizeof(peer->supp_rates), 1342 kde->supp_rates + 2, kde->supp_rates_len - 2, 1343 kde->ext_supp_rates + 2, kde->ext_supp_rates_len - 2); 1344 return 0; 1345 } 1346 1347 1348 static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1349 struct wpa_tdls_peer *peer) 1350 { 1351 if (!kde->ht_capabilities || 1352 kde->ht_capabilities_len < 1353 sizeof(struct ieee80211_ht_capabilities) ) { 1354 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1355 "received"); 1356 return 0; 1357 } 1358 1359 if (!peer->ht_capabilities) { 1360 peer->ht_capabilities = 1361 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1362 if (peer->ht_capabilities == NULL) 1363 return -1; 1364 } 1365 1366 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1367 sizeof(struct ieee80211_ht_capabilities)); 1368 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1369 (u8 *) peer->ht_capabilities, 1370 sizeof(struct ieee80211_ht_capabilities)); 1371 1372 return 0; 1373 } 1374 1375 1376 static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1377 struct wpa_tdls_peer *peer) 1378 { 1379 if (!kde->vht_capabilities || 1380 kde->vht_capabilities_len < 1381 sizeof(struct ieee80211_vht_capabilities) ) { 1382 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1383 "received"); 1384 return 0; 1385 } 1386 1387 if (!peer->vht_capabilities) { 1388 peer->vht_capabilities = 1389 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1390 if (peer->vht_capabilities == NULL) 1391 return -1; 1392 } 1393 1394 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1395 sizeof(struct ieee80211_vht_capabilities)); 1396 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1397 (u8 *) peer->vht_capabilities, 1398 sizeof(struct ieee80211_vht_capabilities)); 1399 1400 return 0; 1401 } 1402 1403 1404 static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1405 struct wpa_tdls_peer *peer) 1406 { 1407 if (!kde->ext_capab) { 1408 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1409 "received"); 1410 return 0; 1411 } 1412 1413 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1414 /* Need to allocate buffer to fit the new information */ 1415 os_free(peer->ext_capab); 1416 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1417 if (peer->ext_capab == NULL) 1418 return -1; 1419 } 1420 1421 peer->ext_capab_len = kde->ext_capab_len - 2; 1422 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1423 1424 return 0; 1425 } 1426 1427 1428 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1429 const u8 *buf, size_t len) 1430 { 1431 struct wpa_tdls_peer *peer; 1432 struct wpa_eapol_ie_parse kde; 1433 struct wpa_ie_data ie; 1434 int cipher; 1435 const u8 *cpos; 1436 struct wpa_tdls_ftie *ftie = NULL; 1437 struct wpa_tdls_timeoutie *timeoutie; 1438 struct wpa_tdls_lnkid *lnkid; 1439 u32 lifetime = 0; 1440 #if 0 1441 struct rsn_ie_hdr *hdr; 1442 u8 *pos; 1443 u16 rsn_capab; 1444 u16 rsn_ver; 1445 #endif 1446 u8 dtoken; 1447 u16 ielen; 1448 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1449 int tdls_prohibited = sm->tdls_prohibited; 1450 int existing_peer = 0; 1451 1452 if (len < 3 + 3) 1453 return -1; 1454 1455 cpos = buf; 1456 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1457 1458 /* driver had already verified the frame format */ 1459 dtoken = *cpos++; /* dialog token */ 1460 1461 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1462 1463 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1464 if (peer == NULL) 1465 goto error; 1466 1467 /* If found, use existing entry instead of adding a new one; 1468 * how to handle the case where both ends initiate at the 1469 * same time? */ 1470 if (existing_peer) { 1471 if (peer->tpk_success) { 1472 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1473 "direct link is enabled - tear down the " 1474 "old link first"); 1475 #if 0 1476 /* TODO: Disabling the link would be more proper 1477 * operation here, but it seems to trigger a race with 1478 * some drivers handling the new request frame. */ 1479 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1480 #else 1481 if (sm->tdls_external_setup) 1482 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1483 src_addr); 1484 else 1485 wpa_tdls_del_key(sm, peer); 1486 #endif 1487 wpa_tdls_peer_free(sm, peer); 1488 } 1489 1490 /* 1491 * An entry is already present, so check if we already sent a 1492 * TDLS Setup Request. If so, compare MAC addresses and let the 1493 * STA with the lower MAC address continue as the initiator. 1494 * The other negotiation is terminated. 1495 */ 1496 if (peer->initiator) { 1497 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1498 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1499 "from peer with higher address " 1500 MACSTR, MAC2STR(src_addr)); 1501 return -1; 1502 } else { 1503 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1504 "from peer with lower address " 1505 MACSTR " (terminate previously " 1506 "initiated negotiation", 1507 MAC2STR(src_addr)); 1508 if (sm->tdls_external_setup) 1509 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, 1510 src_addr); 1511 else 1512 wpa_tdls_del_key(sm, peer); 1513 wpa_tdls_peer_free(sm, peer); 1514 } 1515 } 1516 } 1517 1518 /* capability information */ 1519 peer->capability = WPA_GET_LE16(cpos); 1520 cpos += 2; 1521 1522 ielen = len - (cpos - buf); /* start of IE in buf */ 1523 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1524 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1525 goto error; 1526 } 1527 1528 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1529 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1530 "TPK M1"); 1531 goto error; 1532 } 1533 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1534 kde.lnkid, kde.lnkid_len); 1535 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1536 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1537 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1538 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1539 goto error; 1540 } 1541 1542 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1543 MAC2STR(src_addr)); 1544 1545 if (copy_supp_rates(&kde, peer) < 0) 1546 goto error; 1547 1548 if (copy_peer_ht_capab(&kde, peer) < 0) 1549 goto error; 1550 1551 if (copy_peer_vht_capab(&kde, peer) < 0) 1552 goto error; 1553 1554 if (copy_peer_ext_capab(&kde, peer) < 0) 1555 goto error; 1556 1557 peer->qos_info = kde.qosinfo; 1558 1559 #ifdef CONFIG_TDLS_TESTING 1560 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1561 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1562 if (peer == NULL) 1563 goto error; 1564 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1565 "TDLS setup - send own request"); 1566 peer->initiator = 1; 1567 wpa_tdls_send_tpk_m1(sm, peer); 1568 } 1569 1570 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1571 tdls_prohibited) { 1572 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1573 "on TDLS"); 1574 tdls_prohibited = 0; 1575 } 1576 #endif /* CONFIG_TDLS_TESTING */ 1577 1578 if (tdls_prohibited) { 1579 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1580 status = WLAN_STATUS_REQUEST_DECLINED; 1581 goto error; 1582 } 1583 1584 if (!wpa_tdls_get_privacy(sm)) { 1585 if (kde.rsn_ie) { 1586 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1587 "security is disabled"); 1588 status = WLAN_STATUS_SECURITY_DISABLED; 1589 goto error; 1590 } 1591 goto skip_rsn; 1592 } 1593 1594 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1595 kde.rsn_ie == NULL) { 1596 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1597 status = WLAN_STATUS_INVALID_PARAMETERS; 1598 goto error; 1599 } 1600 1601 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1602 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1603 "TPK M1"); 1604 status = WLAN_STATUS_INVALID_RSNIE; 1605 goto error; 1606 } 1607 1608 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1609 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1610 status = WLAN_STATUS_INVALID_RSNIE; 1611 goto error; 1612 } 1613 1614 cipher = ie.pairwise_cipher; 1615 if (cipher & WPA_CIPHER_CCMP) { 1616 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1617 cipher = WPA_CIPHER_CCMP; 1618 } else { 1619 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1620 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1621 goto error; 1622 } 1623 1624 if ((ie.capabilities & 1625 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1626 WPA_CAPABILITY_PEERKEY_ENABLED) { 1627 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1628 "TPK M1"); 1629 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1630 goto error; 1631 } 1632 1633 /* Lifetime */ 1634 if (kde.key_lifetime == NULL) { 1635 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1636 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1637 goto error; 1638 } 1639 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1640 lifetime = WPA_GET_LE32(timeoutie->value); 1641 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1642 if (lifetime < 300) { 1643 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1644 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1645 goto error; 1646 } 1647 1648 skip_rsn: 1649 #ifdef CONFIG_TDLS_TESTING 1650 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1651 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1652 /* 1653 * The request frame from us is going to win, so do not 1654 * replace information based on this request frame from 1655 * the peer. 1656 */ 1657 goto skip_rsn_check; 1658 } 1659 } 1660 #endif /* CONFIG_TDLS_TESTING */ 1661 1662 peer->initiator = 0; /* Need to check */ 1663 peer->dtoken = dtoken; 1664 1665 if (!wpa_tdls_get_privacy(sm)) { 1666 peer->rsnie_i_len = 0; 1667 peer->rsnie_p_len = 0; 1668 peer->cipher = WPA_CIPHER_NONE; 1669 goto skip_rsn_check; 1670 } 1671 1672 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1673 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1674 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1675 peer->rsnie_i_len = kde.rsn_ie_len; 1676 peer->cipher = cipher; 1677 1678 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1679 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1680 "TDLS: Failed to get random data for responder nonce"); 1681 wpa_tdls_peer_free(sm, peer); 1682 goto error; 1683 } 1684 1685 #if 0 1686 /* get version info from RSNIE received from Peer */ 1687 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1688 rsn_ver = WPA_GET_LE16(hdr->version); 1689 1690 /* use min(peer's version, out version) */ 1691 if (rsn_ver > RSN_VERSION) 1692 rsn_ver = RSN_VERSION; 1693 1694 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1695 1696 hdr->elem_id = WLAN_EID_RSN; 1697 WPA_PUT_LE16(hdr->version, rsn_ver); 1698 pos = (u8 *) (hdr + 1); 1699 1700 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1701 pos += RSN_SELECTOR_LEN; 1702 /* Include only the selected cipher in pairwise cipher suite */ 1703 WPA_PUT_LE16(pos, 1); 1704 pos += 2; 1705 if (cipher == WPA_CIPHER_CCMP) 1706 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1707 pos += RSN_SELECTOR_LEN; 1708 1709 WPA_PUT_LE16(pos, 1); 1710 pos += 2; 1711 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1712 pos += RSN_SELECTOR_LEN; 1713 1714 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1715 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1716 WPA_PUT_LE16(pos, rsn_capab); 1717 pos += 2; 1718 1719 hdr->len = (pos - peer->rsnie_p) - 2; 1720 peer->rsnie_p_len = pos - peer->rsnie_p; 1721 #endif 1722 1723 /* temp fix: validation of RSNIE later */ 1724 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1725 peer->rsnie_p_len = peer->rsnie_i_len; 1726 1727 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1728 peer->rsnie_p, peer->rsnie_p_len); 1729 1730 peer->lifetime = lifetime; 1731 1732 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1733 1734 skip_rsn_check: 1735 /* add the peer to the driver as a "setup in progress" peer */ 1736 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0, NULL, NULL, 0, 1737 NULL, 0); 1738 1739 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1740 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1741 wpa_tdls_disable_link(sm, peer->addr); 1742 goto error; 1743 } 1744 1745 return 0; 1746 1747 error: 1748 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1749 status); 1750 return -1; 1751 } 1752 1753 1754 static void wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1755 { 1756 peer->tpk_success = 1; 1757 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1758 if (wpa_tdls_get_privacy(sm)) { 1759 u32 lifetime = peer->lifetime; 1760 /* 1761 * Start the initiator process a bit earlier to avoid race 1762 * condition with the responder sending teardown request. 1763 */ 1764 if (lifetime > 3 && peer->initiator) 1765 lifetime -= 3; 1766 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1767 sm, peer); 1768 #ifdef CONFIG_TDLS_TESTING 1769 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1770 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1771 "expiration"); 1772 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1773 } 1774 #endif /* CONFIG_TDLS_TESTING */ 1775 } 1776 1777 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1778 wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->capability, 1779 peer->supp_rates, peer->supp_rates_len, 1780 peer->ht_capabilities, peer->vht_capabilities, 1781 peer->qos_info, peer->ext_capab, 1782 peer->ext_capab_len); 1783 1784 wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1785 } 1786 1787 1788 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1789 const u8 *buf, size_t len) 1790 { 1791 struct wpa_tdls_peer *peer; 1792 struct wpa_eapol_ie_parse kde; 1793 struct wpa_ie_data ie; 1794 int cipher; 1795 struct wpa_tdls_ftie *ftie; 1796 struct wpa_tdls_timeoutie *timeoutie; 1797 struct wpa_tdls_lnkid *lnkid; 1798 u32 lifetime; 1799 u8 dtoken; 1800 int ielen; 1801 u16 status; 1802 const u8 *pos; 1803 1804 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1805 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1806 for (peer = sm->tdls; peer; peer = peer->next) { 1807 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1808 break; 1809 } 1810 if (peer == NULL) { 1811 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1812 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1813 return -1; 1814 } 1815 if (!peer->initiator) { 1816 /* 1817 * This may happen if both devices try to initiate TDLS at the 1818 * same time and we accept the TPK M1 from the peer in 1819 * wpa_tdls_process_tpk_m1() and clear our previous state. 1820 */ 1821 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1822 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1823 return -1; 1824 } 1825 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1826 1827 if (len < 3 + 2 + 1) 1828 return -1; 1829 pos = buf; 1830 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1831 status = WPA_GET_LE16(pos); 1832 pos += 2 /* status code */; 1833 1834 if (status != WLAN_STATUS_SUCCESS) { 1835 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 1836 status); 1837 if (sm->tdls_external_setup) 1838 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1839 return -1; 1840 } 1841 1842 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1843 1844 /* TODO: need to verify dialog token matches here or in kernel */ 1845 dtoken = *pos++; /* dialog token */ 1846 1847 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 1848 1849 if (len < 3 + 2 + 1 + 2) 1850 return -1; 1851 1852 /* capability information */ 1853 peer->capability = WPA_GET_LE16(pos); 1854 pos += 2; 1855 1856 ielen = len - (pos - buf); /* start of IE in buf */ 1857 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 1858 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 1859 goto error; 1860 } 1861 1862 #ifdef CONFIG_TDLS_TESTING 1863 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 1864 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 1865 status = WLAN_STATUS_REQUEST_DECLINED; 1866 goto error; 1867 } 1868 #endif /* CONFIG_TDLS_TESTING */ 1869 1870 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1871 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1872 "TPK M2"); 1873 goto error; 1874 } 1875 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 1876 kde.lnkid, kde.lnkid_len); 1877 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1878 1879 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1880 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 1881 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1882 goto error; 1883 } 1884 1885 if (copy_supp_rates(&kde, peer) < 0) 1886 goto error; 1887 1888 if (copy_peer_ht_capab(&kde, peer) < 0) 1889 goto error; 1890 1891 if (copy_peer_vht_capab(&kde, peer) < 0) 1892 goto error; 1893 1894 if (copy_peer_ext_capab(&kde, peer) < 0) 1895 goto error; 1896 1897 peer->qos_info = kde.qosinfo; 1898 1899 if (!wpa_tdls_get_privacy(sm)) { 1900 peer->rsnie_p_len = 0; 1901 peer->cipher = WPA_CIPHER_NONE; 1902 goto skip_rsn; 1903 } 1904 1905 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1906 kde.rsn_ie == NULL) { 1907 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 1908 status = WLAN_STATUS_INVALID_PARAMETERS; 1909 goto error; 1910 } 1911 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1912 kde.rsn_ie, kde.rsn_ie_len); 1913 1914 /* 1915 * FIX: bitwise comparison of RSN IE is not the correct way of 1916 * validation this. It can be different, but certain fields must 1917 * match. Since we list only a single pairwise cipher in TPK M1, the 1918 * memcmp is likely to work in most cases, though. 1919 */ 1920 if (kde.rsn_ie_len != peer->rsnie_i_len || 1921 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 1922 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 1923 "not match with RSN IE used in TPK M1"); 1924 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 1925 peer->rsnie_i, peer->rsnie_i_len); 1926 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1927 kde.rsn_ie, kde.rsn_ie_len); 1928 status = WLAN_STATUS_INVALID_RSNIE; 1929 goto error; 1930 } 1931 1932 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1933 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 1934 status = WLAN_STATUS_INVALID_RSNIE; 1935 goto error; 1936 } 1937 1938 cipher = ie.pairwise_cipher; 1939 if (cipher == WPA_CIPHER_CCMP) { 1940 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1941 cipher = WPA_CIPHER_CCMP; 1942 } else { 1943 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 1944 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1945 goto error; 1946 } 1947 1948 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 1949 kde.ftie, sizeof(*ftie)); 1950 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1951 1952 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 1953 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 1954 "not match with FTIE SNonce used in TPK M1"); 1955 /* Silently discard the frame */ 1956 return -1; 1957 } 1958 1959 /* Responder Nonce and RSN IE */ 1960 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 1961 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 1962 peer->rsnie_p_len = kde.rsn_ie_len; 1963 peer->cipher = cipher; 1964 1965 /* Lifetime */ 1966 if (kde.key_lifetime == NULL) { 1967 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 1968 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1969 goto error; 1970 } 1971 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1972 lifetime = WPA_GET_LE32(timeoutie->value); 1973 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 1974 lifetime); 1975 if (lifetime != peer->lifetime) { 1976 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 1977 "TPK M2 (expected %u)", lifetime, peer->lifetime); 1978 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1979 goto error; 1980 } 1981 1982 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1983 1984 /* Process MIC check to see if TPK M2 is right */ 1985 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 1986 (u8 *) timeoutie, ftie) < 0) { 1987 /* Discard the frame */ 1988 wpa_tdls_del_key(sm, peer); 1989 wpa_tdls_peer_free(sm, peer); 1990 if (sm->tdls_external_setup) 1991 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 1992 return -1; 1993 } 1994 1995 wpa_tdls_set_key(sm, peer); 1996 1997 skip_rsn: 1998 peer->dtoken = dtoken; 1999 2000 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2001 "TPK Handshake Message 3"); 2002 wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer); 2003 2004 wpa_tdls_enable_link(sm, peer); 2005 2006 return 0; 2007 2008 error: 2009 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2010 status); 2011 if (sm->tdls_external_setup) 2012 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2013 return -1; 2014 } 2015 2016 2017 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2018 const u8 *buf, size_t len) 2019 { 2020 struct wpa_tdls_peer *peer; 2021 struct wpa_eapol_ie_parse kde; 2022 struct wpa_tdls_ftie *ftie; 2023 struct wpa_tdls_timeoutie *timeoutie; 2024 struct wpa_tdls_lnkid *lnkid; 2025 int ielen; 2026 u16 status; 2027 const u8 *pos; 2028 u32 lifetime; 2029 2030 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2031 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2032 for (peer = sm->tdls; peer; peer = peer->next) { 2033 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2034 break; 2035 } 2036 if (peer == NULL) { 2037 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2038 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2039 return -1; 2040 } 2041 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2042 2043 if (len < 3 + 3) 2044 return -1; 2045 pos = buf; 2046 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2047 2048 status = WPA_GET_LE16(pos); 2049 2050 if (status != 0) { 2051 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2052 status); 2053 if (sm->tdls_external_setup) 2054 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2055 return -1; 2056 } 2057 pos += 2 /* status code */ + 1 /* dialog token */; 2058 2059 ielen = len - (pos - buf); /* start of IE in buf */ 2060 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2061 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2062 return -1; 2063 } 2064 2065 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2066 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2067 return -1; 2068 } 2069 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2070 (u8 *) kde.lnkid, kde.lnkid_len); 2071 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2072 2073 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2074 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2075 return -1; 2076 } 2077 2078 if (!wpa_tdls_get_privacy(sm)) 2079 goto skip_rsn; 2080 2081 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2082 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2083 return -1; 2084 } 2085 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2086 kde.ftie, sizeof(*ftie)); 2087 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2088 2089 if (kde.rsn_ie == NULL) { 2090 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2091 return -1; 2092 } 2093 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2094 kde.rsn_ie, kde.rsn_ie_len); 2095 if (kde.rsn_ie_len != peer->rsnie_p_len || 2096 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2097 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2098 "with the one sent in TPK M2"); 2099 return -1; 2100 } 2101 2102 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2103 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2104 "not match with FTIE ANonce used in TPK M2"); 2105 return -1; 2106 } 2107 2108 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2109 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2110 "match with FTIE SNonce used in TPK M1"); 2111 return -1; 2112 } 2113 2114 if (kde.key_lifetime == NULL) { 2115 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2116 return -1; 2117 } 2118 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2119 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2120 (u8 *) timeoutie, sizeof(*timeoutie)); 2121 lifetime = WPA_GET_LE32(timeoutie->value); 2122 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2123 lifetime); 2124 if (lifetime != peer->lifetime) { 2125 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2126 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2127 if (sm->tdls_external_setup) 2128 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr); 2129 return -1; 2130 } 2131 2132 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2133 (u8 *) timeoutie, ftie) < 0) { 2134 wpa_tdls_del_key(sm, peer); 2135 wpa_tdls_peer_free(sm, peer); 2136 return -1; 2137 } 2138 2139 if (wpa_tdls_set_key(sm, peer) < 0) 2140 return -1; 2141 2142 skip_rsn: 2143 wpa_tdls_enable_link(sm, peer); 2144 2145 return 0; 2146 } 2147 2148 2149 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2150 { 2151 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2152 2153 os_memset(lifetime, 0, ie_len); 2154 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2155 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2156 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2157 WPA_PUT_LE32(lifetime->value, tsecs); 2158 os_memcpy(pos, ie, ie_len); 2159 return pos + ie_len; 2160 } 2161 2162 2163 /** 2164 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2165 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2166 * @peer: MAC address of the peer STA 2167 * Returns: 0 on success, or -1 on failure 2168 * 2169 * Send TPK Handshake Message 1 info to driver to start TDLS 2170 * handshake with the peer. 2171 */ 2172 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2173 { 2174 struct wpa_tdls_peer *peer; 2175 int tdls_prohibited = sm->tdls_prohibited; 2176 2177 if (sm->tdls_disabled || !sm->tdls_supported) 2178 return -1; 2179 2180 #ifdef CONFIG_TDLS_TESTING 2181 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2182 tdls_prohibited) { 2183 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2184 "on TDLS"); 2185 tdls_prohibited = 0; 2186 } 2187 #endif /* CONFIG_TDLS_TESTING */ 2188 2189 if (tdls_prohibited) { 2190 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2191 "reject request to start setup"); 2192 return -1; 2193 } 2194 2195 peer = wpa_tdls_add_peer(sm, addr, NULL); 2196 if (peer == NULL) 2197 return -1; 2198 2199 peer->initiator = 1; 2200 2201 /* add the peer to the driver as a "setup in progress" peer */ 2202 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0, NULL, NULL, 0, 2203 NULL, 0); 2204 2205 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2206 wpa_tdls_disable_link(sm, peer->addr); 2207 return -1; 2208 } 2209 2210 return 0; 2211 } 2212 2213 2214 void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2215 { 2216 struct wpa_tdls_peer *peer; 2217 2218 if (sm->tdls_disabled || !sm->tdls_supported) 2219 return; 2220 2221 for (peer = sm->tdls; peer; peer = peer->next) { 2222 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2223 break; 2224 } 2225 2226 if (peer == NULL || !peer->tpk_success) 2227 return; 2228 2229 if (sm->tdls_external_setup) { 2230 /* 2231 * Disable previous link to allow renegotiation to be completed 2232 * on AP path. 2233 */ 2234 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2235 } 2236 } 2237 2238 2239 /** 2240 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2241 * 2242 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2243 */ 2244 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2245 const u8 *buf, size_t len) 2246 { 2247 struct wpa_sm *sm = ctx; 2248 struct wpa_tdls_frame *tf; 2249 2250 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2251 buf, len); 2252 2253 if (sm->tdls_disabled || !sm->tdls_supported) { 2254 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2255 "or unsupported by driver"); 2256 return; 2257 } 2258 2259 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2260 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2261 return; 2262 } 2263 2264 if (len < sizeof(*tf)) { 2265 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2266 return; 2267 } 2268 2269 /* Check to make sure its a valid encapsulated TDLS frame */ 2270 tf = (struct wpa_tdls_frame *) buf; 2271 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2272 tf->category != WLAN_ACTION_TDLS) { 2273 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2274 "category=%u action=%u", 2275 tf->payloadtype, tf->category, tf->action); 2276 return; 2277 } 2278 2279 switch (tf->action) { 2280 case WLAN_TDLS_SETUP_REQUEST: 2281 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2282 break; 2283 case WLAN_TDLS_SETUP_RESPONSE: 2284 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2285 break; 2286 case WLAN_TDLS_SETUP_CONFIRM: 2287 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2288 break; 2289 case WLAN_TDLS_TEARDOWN: 2290 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2291 break; 2292 case WLAN_TDLS_DISCOVERY_REQUEST: 2293 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2294 break; 2295 default: 2296 /* Kernel code will process remaining frames */ 2297 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2298 tf->action); 2299 break; 2300 } 2301 } 2302 2303 2304 /** 2305 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2306 * @wpa_s: Pointer to wpa_supplicant data 2307 * Returns: 0 on success, -1 on failure 2308 * 2309 * This function is called to initialize driver interface parameters for TDLS. 2310 * wpa_drv_init() must have been called before this function to initialize the 2311 * driver interface. 2312 */ 2313 int wpa_tdls_init(struct wpa_sm *sm) 2314 { 2315 if (sm == NULL) 2316 return -1; 2317 2318 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2319 sm->ifname, 2320 sm->own_addr, 2321 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2322 sm, 0); 2323 if (sm->l2_tdls == NULL) { 2324 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2325 "connection"); 2326 return -1; 2327 } 2328 2329 /* 2330 * Drivers that support TDLS but don't implement the get_capa callback 2331 * are assumed to perform everything internally 2332 */ 2333 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2334 &sm->tdls_external_setup) < 0) { 2335 sm->tdls_supported = 1; 2336 sm->tdls_external_setup = 0; 2337 } 2338 2339 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2340 "driver", sm->tdls_supported ? "" : " not"); 2341 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2342 sm->tdls_external_setup ? "external" : "internal"); 2343 2344 return 0; 2345 } 2346 2347 2348 void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2349 { 2350 struct wpa_tdls_peer *peer; 2351 2352 peer = sm->tdls; 2353 2354 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2355 2356 while (peer) { 2357 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2358 MAC2STR(peer->addr)); 2359 if (sm->tdls_external_setup) 2360 wpa_tdls_send_teardown(sm, peer->addr, 2361 WLAN_REASON_DEAUTH_LEAVING); 2362 else 2363 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2364 2365 peer = peer->next; 2366 } 2367 } 2368 2369 2370 static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2371 { 2372 struct wpa_tdls_peer *peer, *tmp; 2373 2374 peer = sm->tdls; 2375 sm->tdls = NULL; 2376 2377 while (peer) { 2378 int res; 2379 tmp = peer->next; 2380 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2381 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2382 MAC2STR(peer->addr), res); 2383 wpa_tdls_peer_free(sm, peer); 2384 os_free(peer); 2385 peer = tmp; 2386 } 2387 } 2388 2389 2390 /** 2391 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2392 * 2393 * This function is called to recover driver interface parameters for TDLS 2394 * and frees resources allocated for it. 2395 */ 2396 void wpa_tdls_deinit(struct wpa_sm *sm) 2397 { 2398 if (sm == NULL) 2399 return; 2400 2401 if (sm->l2_tdls) 2402 l2_packet_deinit(sm->l2_tdls); 2403 sm->l2_tdls = NULL; 2404 2405 wpa_tdls_remove_peers(sm); 2406 } 2407 2408 2409 void wpa_tdls_assoc(struct wpa_sm *sm) 2410 { 2411 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2412 wpa_tdls_remove_peers(sm); 2413 } 2414 2415 2416 void wpa_tdls_disassoc(struct wpa_sm *sm) 2417 { 2418 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2419 wpa_tdls_remove_peers(sm); 2420 } 2421 2422 2423 static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2424 { 2425 struct wpa_eapol_ie_parse elems; 2426 2427 if (ies == NULL) 2428 return 0; 2429 2430 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2431 return 0; 2432 2433 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2434 return 0; 2435 2436 /* bit 38 - TDLS Prohibited */ 2437 return !!(elems.ext_capab[2 + 4] & 0x40); 2438 } 2439 2440 2441 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2442 { 2443 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2444 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2445 sm->tdls_prohibited ? "prohibited" : "allowed"); 2446 } 2447 2448 2449 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2450 { 2451 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2452 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2453 "(Re)Association Response IEs"); 2454 sm->tdls_prohibited = 1; 2455 } 2456 } 2457 2458 2459 void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2460 { 2461 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2462 sm->tdls_disabled = !enabled; 2463 } 2464 2465 2466 int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2467 { 2468 return sm->tdls_external_setup; 2469 } 2470
