1 /* 2 * wpa_supplicant - TDLS 3 * Copyright (c) 2010-2011, Atheros Communications 4 * 5 * This software may be distributed under the terms of the BSD license. 6 * See README for more details. 7 */ 8 9 #include "utils/includes.h" 10 11 #include "utils/common.h" 12 #include "utils/eloop.h" 13 #include "utils/os.h" 14 #include "common/ieee802_11_defs.h" 15 #include "crypto/sha256.h" 16 #include "crypto/crypto.h" 17 #include "crypto/aes_wrap.h" 18 #include "rsn_supp/wpa.h" 19 #include "rsn_supp/wpa_ie.h" 20 #include "rsn_supp/wpa_i.h" 21 #include "drivers/driver.h" 22 #include "l2_packet/l2_packet.h" 23 24 #ifdef CONFIG_TDLS_TESTING 25 #define TDLS_TESTING_LONG_FRAME BIT(0) 26 #define TDLS_TESTING_ALT_RSN_IE BIT(1) 27 #define TDLS_TESTING_DIFF_BSSID BIT(2) 28 #define TDLS_TESTING_SHORT_LIFETIME BIT(3) 29 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4) 30 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5) 31 #define TDLS_TESTING_LONG_LIFETIME BIT(6) 32 #define TDLS_TESTING_CONCURRENT_INIT BIT(7) 33 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8) 34 #define TDLS_TESTING_DECLINE_RESP BIT(9) 35 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10) 36 unsigned int tdls_testing = 0; 37 #endif /* CONFIG_TDLS_TESTING */ 38 39 #define TPK_LIFETIME 43200 /* 12 hours */ 40 #define TPK_M1_RETRY_COUNT 3 41 #define TPK_M1_TIMEOUT 5000 /* in milliseconds */ 42 #define TPK_M2_RETRY_COUNT 10 43 #define TPK_M2_TIMEOUT 500 /* in milliseconds */ 44 45 #define TDLS_MIC_LEN 16 46 47 #define TDLS_TIMEOUT_LEN 4 48 49 struct wpa_tdls_ftie { 50 u8 ie_type; /* FTIE */ 51 u8 ie_len; 52 u8 mic_ctrl[2]; 53 u8 mic[TDLS_MIC_LEN]; 54 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */ 55 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */ 56 /* followed by optional elements */ 57 } STRUCT_PACKED; 58 59 struct wpa_tdls_timeoutie { 60 u8 ie_type; /* Timeout IE */ 61 u8 ie_len; 62 u8 interval_type; 63 u8 value[TDLS_TIMEOUT_LEN]; 64 } STRUCT_PACKED; 65 66 struct wpa_tdls_lnkid { 67 u8 ie_type; /* Link Identifier IE */ 68 u8 ie_len; 69 u8 bssid[ETH_ALEN]; 70 u8 init_sta[ETH_ALEN]; 71 u8 resp_sta[ETH_ALEN]; 72 } STRUCT_PACKED; 73 74 /* TDLS frame headers as per IEEE Std 802.11z-2010 */ 75 struct wpa_tdls_frame { 76 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */ 77 u8 category; /* Category */ 78 u8 action; /* Action (enum tdls_frame_type) */ 79 } STRUCT_PACKED; 80 81 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs); 82 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx); 83 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer); 84 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 85 struct wpa_tdls_peer *peer); 86 87 88 #define TDLS_MAX_IE_LEN 80 89 #define IEEE80211_MAX_SUPP_RATES 32 90 91 struct wpa_tdls_peer { 92 struct wpa_tdls_peer *next; 93 unsigned int reconfig_key:1; 94 int initiator; /* whether this end was initiator for TDLS setup */ 95 u8 addr[ETH_ALEN]; /* other end MAC address */ 96 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */ 97 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */ 98 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */ 99 size_t rsnie_i_len; 100 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */ 101 size_t rsnie_p_len; 102 u32 lifetime; 103 int cipher; /* Selected cipher (WPA_CIPHER_*) */ 104 u8 dtoken; 105 106 struct tpk { 107 u8 kck[16]; /* TPK-KCK */ 108 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */ 109 } tpk; 110 int tpk_set; 111 int tpk_success; 112 int tpk_in_progress; 113 114 struct tpk_timer { 115 u8 dest[ETH_ALEN]; 116 int count; /* Retry Count */ 117 int timer; /* Timeout in milliseconds */ 118 u8 action_code; /* TDLS frame type */ 119 u8 dialog_token; 120 u16 status_code; 121 int buf_len; /* length of TPK message for retransmission */ 122 u8 *buf; /* buffer for TPK message */ 123 } sm_tmr; 124 125 u16 capability; 126 127 u8 supp_rates[IEEE80211_MAX_SUPP_RATES]; 128 size_t supp_rates_len; 129 130 struct ieee80211_ht_capabilities *ht_capabilities; 131 struct ieee80211_vht_capabilities *vht_capabilities; 132 133 u8 qos_info; 134 135 u16 aid; 136 137 u8 *ext_capab; 138 size_t ext_capab_len; 139 }; 140 141 142 static int wpa_tdls_get_privacy(struct wpa_sm *sm) 143 { 144 /* 145 * Get info needed from supplicant to check if the current BSS supports 146 * security. Other than OPEN mode, rest are considered secured 147 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake. 148 */ 149 return sm->pairwise_cipher != WPA_CIPHER_NONE; 150 } 151 152 153 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len) 154 { 155 os_memcpy(pos, ie, ie_len); 156 return pos + ie_len; 157 } 158 159 160 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 161 { 162 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr, 163 0, 0, NULL, 0, NULL, 0) < 0) { 164 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from " 165 "the driver"); 166 return -1; 167 } 168 169 return 0; 170 } 171 172 173 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 174 { 175 u8 key_len; 176 u8 rsc[6]; 177 enum wpa_alg alg; 178 179 os_memset(rsc, 0, 6); 180 181 switch (peer->cipher) { 182 case WPA_CIPHER_CCMP: 183 alg = WPA_ALG_CCMP; 184 key_len = 16; 185 break; 186 case WPA_CIPHER_NONE: 187 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: " 188 "NONE - do not use pairwise keys"); 189 return -1; 190 default: 191 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d", 192 sm->pairwise_cipher); 193 return -1; 194 } 195 196 if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1, 197 rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) { 198 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the " 199 "driver"); 200 return -1; 201 } 202 return 0; 203 } 204 205 206 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst, 207 u8 action_code, u8 dialog_token, 208 u16 status_code, const u8 *buf, size_t len) 209 { 210 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token, 211 status_code, buf, len); 212 } 213 214 215 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code, 216 u8 dialog_token, u16 status_code, 217 const u8 *msg, size_t msg_len) 218 { 219 struct wpa_tdls_peer *peer; 220 221 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u " 222 "dialog_token=%u status_code=%u msg_len=%u", 223 MAC2STR(dest), action_code, dialog_token, status_code, 224 (unsigned int) msg_len); 225 226 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token, 227 status_code, msg, msg_len)) { 228 wpa_printf(MSG_INFO, "TDLS: Failed to send message " 229 "(action_code=%u)", action_code); 230 return -1; 231 } 232 233 if (action_code == WLAN_TDLS_SETUP_CONFIRM || 234 action_code == WLAN_TDLS_TEARDOWN || 235 action_code == WLAN_TDLS_DISCOVERY_REQUEST || 236 action_code == WLAN_TDLS_DISCOVERY_RESPONSE) 237 return 0; /* No retries */ 238 239 for (peer = sm->tdls; peer; peer = peer->next) { 240 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0) 241 break; 242 } 243 244 if (peer == NULL) { 245 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 246 "retry " MACSTR, MAC2STR(dest)); 247 return 0; 248 } 249 250 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 251 252 if (action_code == WLAN_TDLS_SETUP_RESPONSE) { 253 peer->sm_tmr.count = TPK_M2_RETRY_COUNT; 254 peer->sm_tmr.timer = TPK_M2_TIMEOUT; 255 } else { 256 peer->sm_tmr.count = TPK_M1_RETRY_COUNT; 257 peer->sm_tmr.timer = TPK_M1_TIMEOUT; 258 } 259 260 /* Copy message to resend on timeout */ 261 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN); 262 peer->sm_tmr.action_code = action_code; 263 peer->sm_tmr.dialog_token = dialog_token; 264 peer->sm_tmr.status_code = status_code; 265 peer->sm_tmr.buf_len = msg_len; 266 os_free(peer->sm_tmr.buf); 267 peer->sm_tmr.buf = os_malloc(msg_len); 268 if (peer->sm_tmr.buf == NULL) 269 return -1; 270 os_memcpy(peer->sm_tmr.buf, msg, msg_len); 271 272 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered " 273 "(action_code=%u)", action_code); 274 eloop_register_timeout(peer->sm_tmr.timer / 1000, 275 (peer->sm_tmr.timer % 1000) * 1000, 276 wpa_tdls_tpk_retry_timeout, sm, peer); 277 return 0; 278 } 279 280 281 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 282 u16 reason_code) 283 { 284 int ret; 285 286 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code); 287 /* disable the link after teardown was sent */ 288 wpa_tdls_disable_peer_link(sm, peer); 289 290 return ret; 291 } 292 293 294 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx) 295 { 296 297 struct wpa_sm *sm = eloop_ctx; 298 struct wpa_tdls_peer *peer = timeout_ctx; 299 300 if (peer->sm_tmr.count) { 301 peer->sm_tmr.count--; 302 303 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message " 304 "(action_code=%u)", 305 peer->sm_tmr.action_code); 306 307 if (peer->sm_tmr.buf == NULL) { 308 wpa_printf(MSG_INFO, "TDLS: No retry buffer available " 309 "for action_code=%u", 310 peer->sm_tmr.action_code); 311 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, 312 peer); 313 return; 314 } 315 316 /* resend TPK Handshake Message to Peer */ 317 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest, 318 peer->sm_tmr.action_code, 319 peer->sm_tmr.dialog_token, 320 peer->sm_tmr.status_code, 321 peer->sm_tmr.buf, 322 peer->sm_tmr.buf_len)) { 323 wpa_printf(MSG_INFO, "TDLS: Failed to retry " 324 "transmission"); 325 } 326 327 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 328 eloop_register_timeout(peer->sm_tmr.timer / 1000, 329 (peer->sm_tmr.timer % 1000) * 1000, 330 wpa_tdls_tpk_retry_timeout, sm, peer); 331 } else { 332 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 333 334 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request"); 335 wpa_tdls_do_teardown(sm, peer, 336 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 337 } 338 } 339 340 341 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm, 342 struct wpa_tdls_peer *peer, 343 u8 action_code) 344 { 345 if (action_code == peer->sm_tmr.action_code) { 346 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for " 347 "action_code=%u", action_code); 348 349 /* Cancel Timeout registered */ 350 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 351 352 /* free all resources meant for retry */ 353 os_free(peer->sm_tmr.buf); 354 peer->sm_tmr.buf = NULL; 355 356 peer->sm_tmr.count = 0; 357 peer->sm_tmr.timer = 0; 358 peer->sm_tmr.buf_len = 0; 359 peer->sm_tmr.action_code = 0xff; 360 } else { 361 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout " 362 "(Unknown action_code=%u)", action_code); 363 } 364 } 365 366 367 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer, 368 const u8 *own_addr, const u8 *bssid) 369 { 370 u8 key_input[SHA256_MAC_LEN]; 371 const u8 *nonce[2]; 372 size_t len[2]; 373 u8 data[3 * ETH_ALEN]; 374 375 /* IEEE Std 802.11z-2010 8.5.9.1: 376 * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce)) 377 */ 378 len[0] = WPA_NONCE_LEN; 379 len[1] = WPA_NONCE_LEN; 380 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) { 381 nonce[0] = peer->inonce; 382 nonce[1] = peer->rnonce; 383 } else { 384 nonce[0] = peer->rnonce; 385 nonce[1] = peer->inonce; 386 } 387 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN); 388 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN); 389 sha256_vector(2, nonce, len, key_input); 390 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input", 391 key_input, SHA256_MAC_LEN); 392 393 /* 394 * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK", 395 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY) 396 * TODO: is N_KEY really included in KDF Context and if so, in which 397 * presentation format (little endian 16-bit?) is it used? It gets 398 * added by the KDF anyway.. 399 */ 400 401 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) { 402 os_memcpy(data, own_addr, ETH_ALEN); 403 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN); 404 } else { 405 os_memcpy(data, peer->addr, ETH_ALEN); 406 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN); 407 } 408 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN); 409 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data)); 410 411 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data), 412 (u8 *) &peer->tpk, sizeof(peer->tpk)); 413 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK", 414 peer->tpk.kck, sizeof(peer->tpk.kck)); 415 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK", 416 peer->tpk.tk, sizeof(peer->tpk.tk)); 417 peer->tpk_set = 1; 418 } 419 420 421 /** 422 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC 423 * @kck: TPK-KCK 424 * @lnkid: Pointer to the beginning of Link Identifier IE 425 * @rsnie: Pointer to the beginning of RSN IE used for handshake 426 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake 427 * @ftie: Pointer to the beginning of FT IE 428 * @mic: Pointer for writing MIC 429 * 430 * Calculate MIC for TDLS frame. 431 */ 432 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid, 433 const u8 *rsnie, const u8 *timeoutie, 434 const u8 *ftie, u8 *mic) 435 { 436 u8 *buf, *pos; 437 struct wpa_tdls_ftie *_ftie; 438 const struct wpa_tdls_lnkid *_lnkid; 439 int ret; 440 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] + 441 2 + timeoutie[1] + 2 + ftie[1]; 442 buf = os_zalloc(len); 443 if (!buf) { 444 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 445 return -1; 446 } 447 448 pos = buf; 449 _lnkid = (const struct wpa_tdls_lnkid *) lnkid; 450 /* 1) TDLS initiator STA MAC address */ 451 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN); 452 pos += ETH_ALEN; 453 /* 2) TDLS responder STA MAC address */ 454 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN); 455 pos += ETH_ALEN; 456 /* 3) Transaction Sequence number */ 457 *pos++ = trans_seq; 458 /* 4) Link Identifier IE */ 459 os_memcpy(pos, lnkid, 2 + lnkid[1]); 460 pos += 2 + lnkid[1]; 461 /* 5) RSN IE */ 462 os_memcpy(pos, rsnie, 2 + rsnie[1]); 463 pos += 2 + rsnie[1]; 464 /* 6) Timeout Interval IE */ 465 os_memcpy(pos, timeoutie, 2 + timeoutie[1]); 466 pos += 2 + timeoutie[1]; 467 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 468 os_memcpy(pos, ftie, 2 + ftie[1]); 469 _ftie = (struct wpa_tdls_ftie *) pos; 470 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 471 pos += 2 + ftie[1]; 472 473 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 474 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 475 ret = omac1_aes_128(kck, buf, pos - buf, mic); 476 os_free(buf); 477 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 478 return ret; 479 } 480 481 482 /** 483 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame 484 * @kck: TPK-KCK 485 * @trans_seq: Transaction Sequence Number (4 - Teardown) 486 * @rcode: Reason code for Teardown 487 * @dtoken: Dialog Token used for that particular link 488 * @lnkid: Pointer to the beginning of Link Identifier IE 489 * @ftie: Pointer to the beginning of FT IE 490 * @mic: Pointer for writing MIC 491 * 492 * Calculate MIC for TDLS frame. 493 */ 494 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode, 495 u8 dtoken, const u8 *lnkid, 496 const u8 *ftie, u8 *mic) 497 { 498 u8 *buf, *pos; 499 struct wpa_tdls_ftie *_ftie; 500 int ret; 501 int len; 502 503 if (lnkid == NULL) 504 return -1; 505 506 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) + 507 sizeof(trans_seq) + 2 + ftie[1]; 508 509 buf = os_zalloc(len); 510 if (!buf) { 511 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation"); 512 return -1; 513 } 514 515 pos = buf; 516 /* 1) Link Identifier IE */ 517 os_memcpy(pos, lnkid, 2 + lnkid[1]); 518 pos += 2 + lnkid[1]; 519 /* 2) Reason Code */ 520 WPA_PUT_LE16(pos, rcode); 521 pos += sizeof(rcode); 522 /* 3) Dialog token */ 523 *pos++ = dtoken; 524 /* 4) Transaction Sequence number */ 525 *pos++ = trans_seq; 526 /* 7) FTIE, with the MIC field of the FTIE set to 0 */ 527 os_memcpy(pos, ftie, 2 + ftie[1]); 528 _ftie = (struct wpa_tdls_ftie *) pos; 529 os_memset(_ftie->mic, 0, TDLS_MIC_LEN); 530 pos += 2 + ftie[1]; 531 532 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf); 533 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16); 534 ret = omac1_aes_128(kck, buf, pos - buf, mic); 535 os_free(buf); 536 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16); 537 return ret; 538 } 539 540 541 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq, 542 struct wpa_tdls_peer *peer, 543 const u8 *lnkid, const u8 *timeoutie, 544 const struct wpa_tdls_ftie *ftie) 545 { 546 u8 mic[16]; 547 548 if (peer->tpk_set) { 549 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid, 550 peer->rsnie_p, timeoutie, (u8 *) ftie, 551 mic); 552 if (os_memcmp(mic, ftie->mic, 16) != 0) { 553 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - " 554 "dropping packet"); 555 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC", 556 ftie->mic, 16); 557 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC", 558 mic, 16); 559 return -1; 560 } 561 } else { 562 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, " 563 "TPK not set - dropping packet"); 564 return -1; 565 } 566 return 0; 567 } 568 569 570 static int wpa_supplicant_verify_tdls_mic_teardown( 571 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer, 572 const u8 *lnkid, const struct wpa_tdls_ftie *ftie) 573 { 574 u8 mic[16]; 575 576 if (peer->tpk_set) { 577 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode, 578 dtoken, lnkid, (u8 *) ftie, mic); 579 if (os_memcmp(mic, ftie->mic, 16) != 0) { 580 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - " 581 "dropping packet"); 582 return -1; 583 } 584 } else { 585 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown " 586 "MIC, TPK not set - dropping packet"); 587 return -1; 588 } 589 return 0; 590 } 591 592 593 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx) 594 { 595 struct wpa_sm *sm = eloop_ctx; 596 struct wpa_tdls_peer *peer = timeout_ctx; 597 598 /* 599 * On TPK lifetime expiration, we have an option of either tearing down 600 * the direct link or trying to re-initiate it. The selection of what 601 * to do is not strictly speaking controlled by our role in the expired 602 * link, but for now, use that to select whether to renew or tear down 603 * the link. 604 */ 605 606 if (peer->initiator) { 607 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 608 " - try to renew", MAC2STR(peer->addr)); 609 wpa_tdls_start(sm, peer->addr); 610 } else { 611 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR 612 " - tear down", MAC2STR(peer->addr)); 613 wpa_tdls_do_teardown(sm, peer, 614 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 615 } 616 } 617 618 619 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 620 { 621 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR, 622 MAC2STR(peer->addr)); 623 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 624 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer); 625 peer->reconfig_key = 0; 626 peer->initiator = 0; 627 peer->tpk_in_progress = 0; 628 os_free(peer->sm_tmr.buf); 629 peer->sm_tmr.buf = NULL; 630 os_free(peer->ht_capabilities); 631 peer->ht_capabilities = NULL; 632 os_free(peer->vht_capabilities); 633 peer->vht_capabilities = NULL; 634 os_free(peer->ext_capab); 635 peer->ext_capab = NULL; 636 peer->rsnie_i_len = peer->rsnie_p_len = 0; 637 peer->cipher = 0; 638 peer->tpk_set = peer->tpk_success = 0; 639 os_memset(&peer->tpk, 0, sizeof(peer->tpk)); 640 os_memset(peer->inonce, 0, WPA_NONCE_LEN); 641 os_memset(peer->rnonce, 0, WPA_NONCE_LEN); 642 } 643 644 645 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer, 646 struct wpa_tdls_lnkid *lnkid) 647 { 648 lnkid->ie_type = WLAN_EID_LINK_ID; 649 lnkid->ie_len = 3 * ETH_ALEN; 650 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN); 651 if (peer->initiator) { 652 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN); 653 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN); 654 } else { 655 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN); 656 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN); 657 } 658 } 659 660 661 int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 662 { 663 struct wpa_tdls_peer *peer; 664 struct wpa_tdls_ftie *ftie; 665 struct wpa_tdls_lnkid lnkid; 666 u8 dialog_token; 667 u8 *rbuf, *pos; 668 int ielen; 669 670 if (sm->tdls_disabled || !sm->tdls_supported) 671 return -1; 672 673 /* Find the node and free from the list */ 674 for (peer = sm->tdls; peer; peer = peer->next) { 675 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 676 break; 677 } 678 679 if (peer == NULL) { 680 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 681 "Teardown " MACSTR, MAC2STR(addr)); 682 return 0; 683 } 684 685 dialog_token = peer->dtoken; 686 687 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR, 688 MAC2STR(addr)); 689 690 ielen = 0; 691 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) { 692 /* To add FTIE for Teardown request and compute MIC */ 693 ielen += sizeof(*ftie); 694 #ifdef CONFIG_TDLS_TESTING 695 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 696 ielen += 170; 697 #endif /* CONFIG_TDLS_TESTING */ 698 } 699 700 rbuf = os_zalloc(ielen + 1); 701 if (rbuf == NULL) 702 return -1; 703 pos = rbuf; 704 705 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 706 goto skip_ies; 707 708 ftie = (struct wpa_tdls_ftie *) pos; 709 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 710 /* Using the recent nonce which should be for CONFIRM frame */ 711 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 712 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 713 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 714 pos = (u8 *) (ftie + 1); 715 #ifdef CONFIG_TDLS_TESTING 716 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 717 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 718 "FTIE"); 719 ftie->ie_len += 170; 720 *pos++ = 255; /* FTIE subelem */ 721 *pos++ = 168; /* FTIE subelem length */ 722 pos += 168; 723 } 724 #endif /* CONFIG_TDLS_TESTING */ 725 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake", 726 (u8 *) ftie, pos - (u8 *) ftie); 727 728 /* compute MIC before sending */ 729 wpa_tdls_linkid(sm, peer, &lnkid); 730 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code, 731 dialog_token, (u8 *) &lnkid, (u8 *) ftie, 732 ftie->mic); 733 734 skip_ies: 735 /* TODO: register for a Timeout handler, if Teardown is not received at 736 * the other end, then try again another time */ 737 738 /* request driver to send Teardown using this FTIE */ 739 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0, 740 reason_code, rbuf, pos - rbuf); 741 os_free(rbuf); 742 743 /* clear the Peerkey statemachine */ 744 wpa_tdls_peer_free(sm, peer); 745 746 return 0; 747 } 748 749 750 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code) 751 { 752 struct wpa_tdls_peer *peer; 753 754 if (sm->tdls_disabled || !sm->tdls_supported) 755 return -1; 756 757 for (peer = sm->tdls; peer; peer = peer->next) { 758 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 759 break; 760 } 761 762 if (peer == NULL) { 763 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR 764 " for link Teardown", MAC2STR(addr)); 765 return -1; 766 } 767 768 if (!peer->tpk_success) { 769 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR 770 " not connected - cannot Teardown link", MAC2STR(addr)); 771 return -1; 772 } 773 774 return wpa_tdls_do_teardown(sm, peer, reason_code); 775 } 776 777 778 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm, 779 struct wpa_tdls_peer *peer) 780 { 781 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 782 wpa_tdls_peer_free(sm, peer); 783 } 784 785 786 void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr) 787 { 788 struct wpa_tdls_peer *peer; 789 790 for (peer = sm->tdls; peer; peer = peer->next) { 791 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 792 break; 793 } 794 795 if (peer) 796 wpa_tdls_disable_peer_link(sm, peer); 797 } 798 799 800 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr, 801 const u8 *buf, size_t len) 802 { 803 struct wpa_tdls_peer *peer = NULL; 804 struct wpa_tdls_ftie *ftie; 805 struct wpa_tdls_lnkid *lnkid; 806 struct wpa_eapol_ie_parse kde; 807 u16 reason_code; 808 const u8 *pos; 809 int ielen; 810 811 /* Find the node and free from the list */ 812 for (peer = sm->tdls; peer; peer = peer->next) { 813 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 814 break; 815 } 816 817 if (peer == NULL) { 818 wpa_printf(MSG_INFO, "TDLS: No matching entry found for " 819 "Teardown " MACSTR, MAC2STR(src_addr)); 820 return 0; 821 } 822 823 pos = buf; 824 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 825 826 reason_code = WPA_GET_LE16(pos); 827 pos += 2; 828 829 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR 830 " (reason code %u)", MAC2STR(src_addr), reason_code); 831 832 ielen = len - (pos - buf); /* start of IE in buf */ 833 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 834 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown"); 835 return -1; 836 } 837 838 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 839 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS " 840 "Teardown"); 841 return -1; 842 } 843 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 844 845 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success) 846 goto skip_ftie; 847 848 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 849 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown"); 850 return -1; 851 } 852 853 ftie = (struct wpa_tdls_ftie *) kde.ftie; 854 855 /* Process MIC check to see if TDLS Teardown is right */ 856 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code, 857 peer->dtoken, peer, 858 (u8 *) lnkid, ftie) < 0) { 859 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS " 860 "Teardown Request from " MACSTR, MAC2STR(src_addr)); 861 return -1; 862 } 863 864 skip_ftie: 865 /* 866 * Request the driver to disable the direct link and clear associated 867 * keys. 868 */ 869 wpa_tdls_disable_peer_link(sm, peer); 870 return 0; 871 } 872 873 874 /** 875 * wpa_tdls_send_error - To send suitable TDLS status response with 876 * appropriate status code mentioning reason for error/failure. 877 * @dst - MAC addr of Peer station 878 * @tdls_action - TDLS frame type for which error code is sent 879 * @status - status code mentioning reason 880 */ 881 882 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst, 883 u8 tdls_action, u8 dialog_token, u16 status) 884 { 885 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR 886 " (action=%u status=%u)", 887 MAC2STR(dst), tdls_action, status); 888 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status, 889 NULL, 0); 890 } 891 892 893 static struct wpa_tdls_peer * 894 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing) 895 { 896 struct wpa_tdls_peer *peer; 897 898 if (existing) 899 *existing = 0; 900 for (peer = sm->tdls; peer; peer = peer->next) { 901 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) { 902 if (existing) 903 *existing = 1; 904 return peer; /* re-use existing entry */ 905 } 906 } 907 908 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR, 909 MAC2STR(addr)); 910 911 peer = os_zalloc(sizeof(*peer)); 912 if (peer == NULL) 913 return NULL; 914 915 os_memcpy(peer->addr, addr, ETH_ALEN); 916 peer->next = sm->tdls; 917 sm->tdls = peer; 918 919 return peer; 920 } 921 922 923 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm, 924 struct wpa_tdls_peer *peer) 925 { 926 size_t buf_len; 927 struct wpa_tdls_timeoutie timeoutie; 928 u16 rsn_capab; 929 struct wpa_tdls_ftie *ftie; 930 u8 *rbuf, *pos, *count_pos; 931 u16 count; 932 struct rsn_ie_hdr *hdr; 933 int status; 934 935 if (!wpa_tdls_get_privacy(sm)) { 936 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link"); 937 peer->rsnie_i_len = 0; 938 goto skip_rsnie; 939 } 940 941 /* 942 * TPK Handshake Message 1: 943 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I, 944 * Timeout Interval IE)) 945 */ 946 947 /* Filling RSN IE */ 948 hdr = (struct rsn_ie_hdr *) peer->rsnie_i; 949 hdr->elem_id = WLAN_EID_RSN; 950 WPA_PUT_LE16(hdr->version, RSN_VERSION); 951 952 pos = (u8 *) (hdr + 1); 953 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 954 pos += RSN_SELECTOR_LEN; 955 count_pos = pos; 956 pos += 2; 957 958 count = 0; 959 960 /* 961 * AES-CCMP is the default Encryption preferred for TDLS, so 962 * RSN IE is filled only with CCMP CIPHER 963 * Note: TKIP is not used to encrypt TDLS link. 964 * 965 * Regardless of the cipher used on the AP connection, select CCMP 966 * here. 967 */ 968 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 969 pos += RSN_SELECTOR_LEN; 970 count++; 971 972 WPA_PUT_LE16(count_pos, count); 973 974 WPA_PUT_LE16(pos, 1); 975 pos += 2; 976 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 977 pos += RSN_SELECTOR_LEN; 978 979 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 980 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 981 #ifdef CONFIG_TDLS_TESTING 982 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 983 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for " 984 "testing"); 985 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 986 } 987 #endif /* CONFIG_TDLS_TESTING */ 988 WPA_PUT_LE16(pos, rsn_capab); 989 pos += 2; 990 #ifdef CONFIG_TDLS_TESTING 991 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) { 992 /* Number of PMKIDs */ 993 *pos++ = 0x00; 994 *pos++ = 0x00; 995 } 996 #endif /* CONFIG_TDLS_TESTING */ 997 998 hdr->len = (pos - peer->rsnie_i) - 2; 999 peer->rsnie_i_len = pos - peer->rsnie_i; 1000 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1001 peer->rsnie_i, peer->rsnie_i_len); 1002 1003 skip_rsnie: 1004 buf_len = 0; 1005 if (wpa_tdls_get_privacy(sm)) 1006 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1007 sizeof(struct wpa_tdls_timeoutie); 1008 #ifdef CONFIG_TDLS_TESTING 1009 if (wpa_tdls_get_privacy(sm) && 1010 (tdls_testing & TDLS_TESTING_LONG_FRAME)) 1011 buf_len += 170; 1012 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) 1013 buf_len += sizeof(struct wpa_tdls_lnkid); 1014 #endif /* CONFIG_TDLS_TESTING */ 1015 rbuf = os_zalloc(buf_len + 1); 1016 if (rbuf == NULL) { 1017 wpa_tdls_peer_free(sm, peer); 1018 return -1; 1019 } 1020 pos = rbuf; 1021 1022 if (!wpa_tdls_get_privacy(sm)) 1023 goto skip_ies; 1024 1025 /* Initiator RSN IE */ 1026 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len); 1027 1028 ftie = (struct wpa_tdls_ftie *) pos; 1029 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1030 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1031 1032 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) { 1033 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING, 1034 "TDLS: Failed to get random data for initiator Nonce"); 1035 os_free(rbuf); 1036 wpa_tdls_peer_free(sm, peer); 1037 return -1; 1038 } 1039 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake", 1040 peer->inonce, WPA_NONCE_LEN); 1041 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1042 1043 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1", 1044 (u8 *) ftie, sizeof(struct wpa_tdls_ftie)); 1045 1046 pos = (u8 *) (ftie + 1); 1047 1048 #ifdef CONFIG_TDLS_TESTING 1049 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1050 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1051 "FTIE"); 1052 ftie->ie_len += 170; 1053 *pos++ = 255; /* FTIE subelem */ 1054 *pos++ = 168; /* FTIE subelem length */ 1055 pos += 168; 1056 } 1057 #endif /* CONFIG_TDLS_TESTING */ 1058 1059 /* Lifetime */ 1060 peer->lifetime = TPK_LIFETIME; 1061 #ifdef CONFIG_TDLS_TESTING 1062 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) { 1063 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK " 1064 "lifetime"); 1065 peer->lifetime = 301; 1066 } 1067 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) { 1068 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK " 1069 "lifetime"); 1070 peer->lifetime = 0xffffffff; 1071 } 1072 #endif /* CONFIG_TDLS_TESTING */ 1073 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1074 sizeof(timeoutie), peer->lifetime); 1075 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime); 1076 1077 skip_ies: 1078 1079 #ifdef CONFIG_TDLS_TESTING 1080 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) { 1081 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in " 1082 "Link Identifier"); 1083 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos; 1084 wpa_tdls_linkid(sm, peer, l); 1085 l->bssid[5] ^= 0x01; 1086 pos += sizeof(*l); 1087 } 1088 #endif /* CONFIG_TDLS_TESTING */ 1089 1090 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK " 1091 "Handshake Message 1 (peer " MACSTR ")", 1092 MAC2STR(peer->addr)); 1093 1094 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1095 1, 0, rbuf, pos - rbuf); 1096 os_free(rbuf); 1097 1098 return status; 1099 } 1100 1101 1102 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm, 1103 const unsigned char *src_addr, u8 dtoken, 1104 struct wpa_tdls_lnkid *lnkid, 1105 const struct wpa_tdls_peer *peer) 1106 { 1107 u8 *rbuf, *pos; 1108 size_t buf_len; 1109 u32 lifetime; 1110 struct wpa_tdls_timeoutie timeoutie; 1111 struct wpa_tdls_ftie *ftie; 1112 int status; 1113 1114 buf_len = 0; 1115 if (wpa_tdls_get_privacy(sm)) { 1116 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1117 * Lifetime */ 1118 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1119 sizeof(struct wpa_tdls_timeoutie); 1120 #ifdef CONFIG_TDLS_TESTING 1121 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1122 buf_len += 170; 1123 #endif /* CONFIG_TDLS_TESTING */ 1124 } 1125 1126 rbuf = os_zalloc(buf_len + 1); 1127 if (rbuf == NULL) 1128 return -1; 1129 pos = rbuf; 1130 1131 if (!wpa_tdls_get_privacy(sm)) 1132 goto skip_ies; 1133 1134 /* Peer RSN IE */ 1135 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1136 1137 ftie = (struct wpa_tdls_ftie *) pos; 1138 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1139 /* TODO: ftie->mic_control to set 2-RESPONSE */ 1140 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1141 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1142 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1143 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2", 1144 (u8 *) ftie, sizeof(*ftie)); 1145 1146 pos = (u8 *) (ftie + 1); 1147 1148 #ifdef CONFIG_TDLS_TESTING 1149 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1150 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1151 "FTIE"); 1152 ftie->ie_len += 170; 1153 *pos++ = 255; /* FTIE subelem */ 1154 *pos++ = 168; /* FTIE subelem length */ 1155 pos += 168; 1156 } 1157 #endif /* CONFIG_TDLS_TESTING */ 1158 1159 /* Lifetime */ 1160 lifetime = peer->lifetime; 1161 #ifdef CONFIG_TDLS_TESTING 1162 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) { 1163 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1164 "lifetime in response"); 1165 lifetime++; 1166 } 1167 #endif /* CONFIG_TDLS_TESTING */ 1168 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1169 sizeof(timeoutie), lifetime); 1170 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator", 1171 lifetime); 1172 1173 /* compute MIC before sending */ 1174 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p, 1175 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1176 1177 skip_ies: 1178 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, 1179 dtoken, 0, rbuf, pos - rbuf); 1180 os_free(rbuf); 1181 1182 return status; 1183 } 1184 1185 1186 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm, 1187 const unsigned char *src_addr, u8 dtoken, 1188 struct wpa_tdls_lnkid *lnkid, 1189 const struct wpa_tdls_peer *peer) 1190 { 1191 u8 *rbuf, *pos; 1192 size_t buf_len; 1193 struct wpa_tdls_ftie *ftie; 1194 struct wpa_tdls_timeoutie timeoutie; 1195 u32 lifetime; 1196 int status; 1197 1198 buf_len = 0; 1199 if (wpa_tdls_get_privacy(sm)) { 1200 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce), 1201 * Lifetime */ 1202 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) + 1203 sizeof(struct wpa_tdls_timeoutie); 1204 #ifdef CONFIG_TDLS_TESTING 1205 if (tdls_testing & TDLS_TESTING_LONG_FRAME) 1206 buf_len += 170; 1207 #endif /* CONFIG_TDLS_TESTING */ 1208 } 1209 1210 rbuf = os_zalloc(buf_len + 1); 1211 if (rbuf == NULL) 1212 return -1; 1213 pos = rbuf; 1214 1215 if (!wpa_tdls_get_privacy(sm)) 1216 goto skip_ies; 1217 1218 /* Peer RSN IE */ 1219 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len); 1220 1221 ftie = (struct wpa_tdls_ftie *) pos; 1222 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION; 1223 /*TODO: ftie->mic_control to set 3-CONFIRM */ 1224 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN); 1225 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN); 1226 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2; 1227 1228 pos = (u8 *) (ftie + 1); 1229 1230 #ifdef CONFIG_TDLS_TESTING 1231 if (tdls_testing & TDLS_TESTING_LONG_FRAME) { 1232 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to " 1233 "FTIE"); 1234 ftie->ie_len += 170; 1235 *pos++ = 255; /* FTIE subelem */ 1236 *pos++ = 168; /* FTIE subelem length */ 1237 pos += 168; 1238 } 1239 #endif /* CONFIG_TDLS_TESTING */ 1240 1241 /* Lifetime */ 1242 lifetime = peer->lifetime; 1243 #ifdef CONFIG_TDLS_TESTING 1244 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) { 1245 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK " 1246 "lifetime in confirm"); 1247 lifetime++; 1248 } 1249 #endif /* CONFIG_TDLS_TESTING */ 1250 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie, 1251 sizeof(timeoutie), lifetime); 1252 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", 1253 lifetime); 1254 1255 /* compute MIC before sending */ 1256 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p, 1257 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic); 1258 1259 skip_ies: 1260 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, 1261 dtoken, 0, rbuf, pos - rbuf); 1262 os_free(rbuf); 1263 1264 return status; 1265 } 1266 1267 1268 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm, 1269 struct wpa_tdls_peer *peer, 1270 u8 dialog_token) 1271 { 1272 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response " 1273 "(peer " MACSTR ")", MAC2STR(peer->addr)); 1274 1275 return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE, 1276 dialog_token, 0, NULL, 0); 1277 } 1278 1279 1280 static int 1281 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr, 1282 const u8 *buf, size_t len) 1283 { 1284 struct wpa_eapol_ie_parse kde; 1285 const struct wpa_tdls_lnkid *lnkid; 1286 struct wpa_tdls_peer *peer; 1287 size_t min_req_len = sizeof(struct wpa_tdls_frame) + 1288 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid); 1289 u8 dialog_token; 1290 1291 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR, 1292 MAC2STR(addr)); 1293 1294 if (len < min_req_len) { 1295 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: " 1296 "%d", (int) len); 1297 return -1; 1298 } 1299 1300 dialog_token = buf[sizeof(struct wpa_tdls_frame)]; 1301 1302 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1, 1303 len - (sizeof(struct wpa_tdls_frame) + 1), 1304 &kde) < 0) 1305 return -1; 1306 1307 if (!kde.lnkid) { 1308 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery " 1309 "Request"); 1310 return -1; 1311 } 1312 1313 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid; 1314 1315 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1316 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different " 1317 " BSS " MACSTR, MAC2STR(lnkid->bssid)); 1318 return -1; 1319 } 1320 1321 peer = wpa_tdls_add_peer(sm, addr, NULL); 1322 if (peer == NULL) 1323 return -1; 1324 1325 return wpa_tdls_send_discovery_response(sm, peer, dialog_token); 1326 } 1327 1328 1329 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr) 1330 { 1331 if (sm->tdls_disabled || !sm->tdls_supported) 1332 return -1; 1333 1334 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer " 1335 MACSTR, MAC2STR(addr)); 1336 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST, 1337 1, 0, NULL, 0); 1338 } 1339 1340 1341 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde, 1342 struct wpa_tdls_peer *peer) 1343 { 1344 if (!kde->supp_rates) { 1345 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received"); 1346 return -1; 1347 } 1348 peer->supp_rates_len = merge_byte_arrays( 1349 peer->supp_rates, sizeof(peer->supp_rates), 1350 kde->supp_rates + 2, kde->supp_rates_len - 2, 1351 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL, 1352 kde->ext_supp_rates_len - 2); 1353 return 0; 1354 } 1355 1356 1357 static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde, 1358 struct wpa_tdls_peer *peer) 1359 { 1360 if (!kde->ht_capabilities || 1361 kde->ht_capabilities_len < 1362 sizeof(struct ieee80211_ht_capabilities) ) { 1363 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities " 1364 "received"); 1365 return 0; 1366 } 1367 1368 if (!peer->ht_capabilities) { 1369 peer->ht_capabilities = 1370 os_zalloc(sizeof(struct ieee80211_ht_capabilities)); 1371 if (peer->ht_capabilities == NULL) 1372 return -1; 1373 } 1374 1375 os_memcpy(peer->ht_capabilities, kde->ht_capabilities, 1376 sizeof(struct ieee80211_ht_capabilities)); 1377 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities", 1378 (u8 *) peer->ht_capabilities, 1379 sizeof(struct ieee80211_ht_capabilities)); 1380 1381 return 0; 1382 } 1383 1384 1385 static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde, 1386 struct wpa_tdls_peer *peer) 1387 { 1388 if (!kde->vht_capabilities || 1389 kde->vht_capabilities_len < 1390 sizeof(struct ieee80211_vht_capabilities) ) { 1391 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities " 1392 "received"); 1393 return 0; 1394 } 1395 1396 if (!peer->vht_capabilities) { 1397 peer->vht_capabilities = 1398 os_zalloc(sizeof(struct ieee80211_vht_capabilities)); 1399 if (peer->vht_capabilities == NULL) 1400 return -1; 1401 } 1402 1403 os_memcpy(peer->vht_capabilities, kde->vht_capabilities, 1404 sizeof(struct ieee80211_vht_capabilities)); 1405 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities", 1406 (u8 *) peer->vht_capabilities, 1407 sizeof(struct ieee80211_vht_capabilities)); 1408 1409 return 0; 1410 } 1411 1412 1413 static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde, 1414 struct wpa_tdls_peer *peer) 1415 { 1416 if (!kde->ext_capab) { 1417 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities " 1418 "received"); 1419 return 0; 1420 } 1421 1422 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) { 1423 /* Need to allocate buffer to fit the new information */ 1424 os_free(peer->ext_capab); 1425 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2); 1426 if (peer->ext_capab == NULL) 1427 return -1; 1428 } 1429 1430 peer->ext_capab_len = kde->ext_capab_len - 2; 1431 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len); 1432 1433 return 0; 1434 } 1435 1436 1437 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, 1438 const u8 *buf, size_t len) 1439 { 1440 struct wpa_tdls_peer *peer; 1441 struct wpa_eapol_ie_parse kde; 1442 struct wpa_ie_data ie; 1443 int cipher; 1444 const u8 *cpos; 1445 struct wpa_tdls_ftie *ftie = NULL; 1446 struct wpa_tdls_timeoutie *timeoutie; 1447 struct wpa_tdls_lnkid *lnkid; 1448 u32 lifetime = 0; 1449 #if 0 1450 struct rsn_ie_hdr *hdr; 1451 u8 *pos; 1452 u16 rsn_capab; 1453 u16 rsn_ver; 1454 #endif 1455 u8 dtoken; 1456 u16 ielen; 1457 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1458 int tdls_prohibited = sm->tdls_prohibited; 1459 int existing_peer = 0; 1460 1461 if (len < 3 + 3) 1462 return -1; 1463 1464 cpos = buf; 1465 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1466 1467 /* driver had already verified the frame format */ 1468 dtoken = *cpos++; /* dialog token */ 1469 1470 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken); 1471 1472 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer); 1473 if (peer == NULL) 1474 goto error; 1475 1476 /* If found, use existing entry instead of adding a new one; 1477 * how to handle the case where both ends initiate at the 1478 * same time? */ 1479 if (existing_peer) { 1480 if (peer->tpk_success) { 1481 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while " 1482 "direct link is enabled - tear down the " 1483 "old link first"); 1484 wpa_tdls_disable_peer_link(sm, peer); 1485 } 1486 1487 /* 1488 * An entry is already present, so check if we already sent a 1489 * TDLS Setup Request. If so, compare MAC addresses and let the 1490 * STA with the lower MAC address continue as the initiator. 1491 * The other negotiation is terminated. 1492 */ 1493 if (peer->initiator) { 1494 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) { 1495 wpa_printf(MSG_DEBUG, "TDLS: Discard request " 1496 "from peer with higher address " 1497 MACSTR, MAC2STR(src_addr)); 1498 return -1; 1499 } else { 1500 wpa_printf(MSG_DEBUG, "TDLS: Accept request " 1501 "from peer with lower address " 1502 MACSTR " (terminate previously " 1503 "initiated negotiation", 1504 MAC2STR(src_addr)); 1505 wpa_tdls_disable_peer_link(sm, peer); 1506 } 1507 } 1508 } 1509 1510 /* capability information */ 1511 peer->capability = WPA_GET_LE16(cpos); 1512 cpos += 2; 1513 1514 ielen = len - (cpos - buf); /* start of IE in buf */ 1515 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) { 1516 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1"); 1517 goto error; 1518 } 1519 1520 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1521 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1522 "TPK M1"); 1523 goto error; 1524 } 1525 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1", 1526 kde.lnkid, kde.lnkid_len); 1527 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1528 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1529 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS"); 1530 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1531 goto error; 1532 } 1533 1534 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR, 1535 MAC2STR(src_addr)); 1536 1537 if (copy_supp_rates(&kde, peer) < 0) 1538 goto error; 1539 1540 if (copy_peer_ht_capab(&kde, peer) < 0) 1541 goto error; 1542 1543 if (copy_peer_vht_capab(&kde, peer) < 0) 1544 goto error; 1545 1546 if (copy_peer_ext_capab(&kde, peer) < 0) 1547 goto error; 1548 1549 peer->qos_info = kde.qosinfo; 1550 1551 peer->aid = kde.aid; 1552 1553 #ifdef CONFIG_TDLS_TESTING 1554 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1555 peer = wpa_tdls_add_peer(sm, src_addr, NULL); 1556 if (peer == NULL) 1557 goto error; 1558 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of " 1559 "TDLS setup - send own request"); 1560 peer->initiator = 1; 1561 wpa_tdls_send_tpk_m1(sm, peer); 1562 } 1563 1564 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 1565 tdls_prohibited) { 1566 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 1567 "on TDLS"); 1568 tdls_prohibited = 0; 1569 } 1570 #endif /* CONFIG_TDLS_TESTING */ 1571 1572 if (tdls_prohibited) { 1573 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS"); 1574 status = WLAN_STATUS_REQUEST_DECLINED; 1575 goto error; 1576 } 1577 1578 if (!wpa_tdls_get_privacy(sm)) { 1579 if (kde.rsn_ie) { 1580 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while " 1581 "security is disabled"); 1582 status = WLAN_STATUS_SECURITY_DISABLED; 1583 goto error; 1584 } 1585 goto skip_rsn; 1586 } 1587 1588 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1589 kde.rsn_ie == NULL) { 1590 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1"); 1591 status = WLAN_STATUS_INVALID_PARAMETERS; 1592 goto error; 1593 } 1594 1595 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) { 1596 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in " 1597 "TPK M1"); 1598 status = WLAN_STATUS_INVALID_RSNIE; 1599 goto error; 1600 } 1601 1602 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1603 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1"); 1604 status = WLAN_STATUS_INVALID_RSNIE; 1605 goto error; 1606 } 1607 1608 cipher = ie.pairwise_cipher; 1609 if (cipher & WPA_CIPHER_CCMP) { 1610 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1611 cipher = WPA_CIPHER_CCMP; 1612 } else { 1613 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1"); 1614 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1615 goto error; 1616 } 1617 1618 if ((ie.capabilities & 1619 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) != 1620 WPA_CAPABILITY_PEERKEY_ENABLED) { 1621 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in " 1622 "TPK M1"); 1623 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB; 1624 goto error; 1625 } 1626 1627 /* Lifetime */ 1628 if (kde.key_lifetime == NULL) { 1629 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1"); 1630 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1631 goto error; 1632 } 1633 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1634 lifetime = WPA_GET_LE32(timeoutie->value); 1635 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime); 1636 if (lifetime < 300) { 1637 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime"); 1638 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1639 goto error; 1640 } 1641 1642 skip_rsn: 1643 #ifdef CONFIG_TDLS_TESTING 1644 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) { 1645 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) { 1646 /* 1647 * The request frame from us is going to win, so do not 1648 * replace information based on this request frame from 1649 * the peer. 1650 */ 1651 goto skip_rsn_check; 1652 } 1653 } 1654 #endif /* CONFIG_TDLS_TESTING */ 1655 1656 peer->initiator = 0; /* Need to check */ 1657 peer->dtoken = dtoken; 1658 1659 if (!wpa_tdls_get_privacy(sm)) { 1660 peer->rsnie_i_len = 0; 1661 peer->rsnie_p_len = 0; 1662 peer->cipher = WPA_CIPHER_NONE; 1663 goto skip_rsn_check; 1664 } 1665 1666 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1667 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len); 1668 peer->rsnie_i_len = kde.rsn_ie_len; 1669 peer->cipher = cipher; 1670 1671 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) { 1672 /* 1673 * There is no point in updating the RNonce for every obtained 1674 * TPK M1 frame (e.g., retransmission due to timeout) with the 1675 * same INonce (SNonce in FTIE). However, if the TPK M1 is 1676 * retransmitted with a different INonce, update the RNonce 1677 * since this is for a new TDLS session. 1678 */ 1679 wpa_printf(MSG_DEBUG, 1680 "TDLS: New TPK M1 INonce - generate new RNonce"); 1681 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN); 1682 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) { 1683 wpa_msg(sm->ctx->ctx, MSG_WARNING, 1684 "TDLS: Failed to get random data for responder nonce"); 1685 wpa_tdls_peer_free(sm, peer); 1686 goto error; 1687 } 1688 } 1689 1690 #if 0 1691 /* get version info from RSNIE received from Peer */ 1692 hdr = (struct rsn_ie_hdr *) kde.rsn_ie; 1693 rsn_ver = WPA_GET_LE16(hdr->version); 1694 1695 /* use min(peer's version, out version) */ 1696 if (rsn_ver > RSN_VERSION) 1697 rsn_ver = RSN_VERSION; 1698 1699 hdr = (struct rsn_ie_hdr *) peer->rsnie_p; 1700 1701 hdr->elem_id = WLAN_EID_RSN; 1702 WPA_PUT_LE16(hdr->version, rsn_ver); 1703 pos = (u8 *) (hdr + 1); 1704 1705 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED); 1706 pos += RSN_SELECTOR_LEN; 1707 /* Include only the selected cipher in pairwise cipher suite */ 1708 WPA_PUT_LE16(pos, 1); 1709 pos += 2; 1710 if (cipher == WPA_CIPHER_CCMP) 1711 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP); 1712 pos += RSN_SELECTOR_LEN; 1713 1714 WPA_PUT_LE16(pos, 1); 1715 pos += 2; 1716 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE); 1717 pos += RSN_SELECTOR_LEN; 1718 1719 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED; 1720 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2; 1721 WPA_PUT_LE16(pos, rsn_capab); 1722 pos += 2; 1723 1724 hdr->len = (pos - peer->rsnie_p) - 2; 1725 peer->rsnie_p_len = pos - peer->rsnie_p; 1726 #endif 1727 1728 /* temp fix: validation of RSNIE later */ 1729 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len); 1730 peer->rsnie_p_len = peer->rsnie_i_len; 1731 1732 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake", 1733 peer->rsnie_p, peer->rsnie_p_len); 1734 1735 peer->lifetime = lifetime; 1736 1737 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 1738 1739 skip_rsn_check: 1740 /* add the peer to the driver as a "setup in progress" peer */ 1741 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 1742 NULL, 0); 1743 peer->tpk_in_progress = 1; 1744 1745 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2"); 1746 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) { 1747 wpa_tdls_disable_peer_link(sm, peer); 1748 goto error; 1749 } 1750 1751 return 0; 1752 1753 error: 1754 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 1755 status); 1756 return -1; 1757 } 1758 1759 1760 static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer) 1761 { 1762 peer->tpk_success = 1; 1763 peer->tpk_in_progress = 0; 1764 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1765 if (wpa_tdls_get_privacy(sm)) { 1766 u32 lifetime = peer->lifetime; 1767 /* 1768 * Start the initiator process a bit earlier to avoid race 1769 * condition with the responder sending teardown request. 1770 */ 1771 if (lifetime > 3 && peer->initiator) 1772 lifetime -= 3; 1773 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout, 1774 sm, peer); 1775 #ifdef CONFIG_TDLS_TESTING 1776 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) { 1777 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK " 1778 "expiration"); 1779 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer); 1780 } 1781 #endif /* CONFIG_TDLS_TESTING */ 1782 } 1783 1784 /* add supported rates, capabilities, and qos_info to the TDLS peer */ 1785 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->aid, 1786 peer->capability, 1787 peer->supp_rates, peer->supp_rates_len, 1788 peer->ht_capabilities, 1789 peer->vht_capabilities, 1790 peer->qos_info, peer->ext_capab, 1791 peer->ext_capab_len) < 0) 1792 return -1; 1793 1794 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) { 1795 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the " 1796 "driver"); 1797 return -1; 1798 } 1799 peer->reconfig_key = 0; 1800 1801 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr); 1802 } 1803 1804 1805 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr, 1806 const u8 *buf, size_t len) 1807 { 1808 struct wpa_tdls_peer *peer; 1809 struct wpa_eapol_ie_parse kde; 1810 struct wpa_ie_data ie; 1811 int cipher; 1812 struct wpa_tdls_ftie *ftie; 1813 struct wpa_tdls_timeoutie *timeoutie; 1814 struct wpa_tdls_lnkid *lnkid; 1815 u32 lifetime; 1816 u8 dtoken; 1817 int ielen; 1818 u16 status; 1819 const u8 *pos; 1820 int ret; 1821 1822 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 " 1823 "(Peer " MACSTR ")", MAC2STR(src_addr)); 1824 for (peer = sm->tdls; peer; peer = peer->next) { 1825 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 1826 break; 1827 } 1828 if (peer == NULL) { 1829 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 1830 "TPK M2: " MACSTR, MAC2STR(src_addr)); 1831 return -1; 1832 } 1833 if (!peer->initiator) { 1834 /* 1835 * This may happen if both devices try to initiate TDLS at the 1836 * same time and we accept the TPK M1 from the peer in 1837 * wpa_tdls_process_tpk_m1() and clear our previous state. 1838 */ 1839 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so " 1840 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr)); 1841 return -1; 1842 } 1843 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST); 1844 1845 if (len < 3 + 2 + 1) { 1846 wpa_tdls_disable_peer_link(sm, peer); 1847 return -1; 1848 } 1849 1850 pos = buf; 1851 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 1852 status = WPA_GET_LE16(pos); 1853 pos += 2 /* status code */; 1854 1855 if (status != WLAN_STATUS_SUCCESS) { 1856 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u", 1857 status); 1858 wpa_tdls_disable_peer_link(sm, peer); 1859 return -1; 1860 } 1861 1862 status = WLAN_STATUS_UNSPECIFIED_FAILURE; 1863 1864 /* TODO: need to verify dialog token matches here or in kernel */ 1865 dtoken = *pos++; /* dialog token */ 1866 1867 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken); 1868 1869 if (len < 3 + 2 + 1 + 2) { 1870 wpa_tdls_disable_peer_link(sm, peer); 1871 return -1; 1872 } 1873 1874 /* capability information */ 1875 peer->capability = WPA_GET_LE16(pos); 1876 pos += 2; 1877 1878 ielen = len - (pos - buf); /* start of IE in buf */ 1879 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) { 1880 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2"); 1881 goto error; 1882 } 1883 1884 #ifdef CONFIG_TDLS_TESTING 1885 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) { 1886 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response"); 1887 status = WLAN_STATUS_REQUEST_DECLINED; 1888 goto error; 1889 } 1890 #endif /* CONFIG_TDLS_TESTING */ 1891 1892 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 1893 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in " 1894 "TPK M2"); 1895 goto error; 1896 } 1897 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2", 1898 kde.lnkid, kde.lnkid_len); 1899 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 1900 1901 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 1902 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS"); 1903 status = WLAN_STATUS_NOT_IN_SAME_BSS; 1904 goto error; 1905 } 1906 1907 if (copy_supp_rates(&kde, peer) < 0) 1908 goto error; 1909 1910 if (copy_peer_ht_capab(&kde, peer) < 0) 1911 goto error; 1912 1913 if (copy_peer_vht_capab(&kde, peer) < 0) 1914 goto error; 1915 1916 if (copy_peer_ext_capab(&kde, peer) < 0) 1917 goto error; 1918 1919 peer->qos_info = kde.qosinfo; 1920 1921 peer->aid = kde.aid; 1922 1923 if (!wpa_tdls_get_privacy(sm)) { 1924 peer->rsnie_p_len = 0; 1925 peer->cipher = WPA_CIPHER_NONE; 1926 goto skip_rsn; 1927 } 1928 1929 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) || 1930 kde.rsn_ie == NULL) { 1931 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2"); 1932 status = WLAN_STATUS_INVALID_PARAMETERS; 1933 goto error; 1934 } 1935 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1936 kde.rsn_ie, kde.rsn_ie_len); 1937 1938 /* 1939 * FIX: bitwise comparison of RSN IE is not the correct way of 1940 * validation this. It can be different, but certain fields must 1941 * match. Since we list only a single pairwise cipher in TPK M1, the 1942 * memcmp is likely to work in most cases, though. 1943 */ 1944 if (kde.rsn_ie_len != peer->rsnie_i_len || 1945 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) { 1946 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does " 1947 "not match with RSN IE used in TPK M1"); 1948 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1", 1949 peer->rsnie_i, peer->rsnie_i_len); 1950 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2", 1951 kde.rsn_ie, kde.rsn_ie_len); 1952 status = WLAN_STATUS_INVALID_RSNIE; 1953 goto error; 1954 } 1955 1956 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) { 1957 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2"); 1958 status = WLAN_STATUS_INVALID_RSNIE; 1959 goto error; 1960 } 1961 1962 cipher = ie.pairwise_cipher; 1963 if (cipher == WPA_CIPHER_CCMP) { 1964 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link"); 1965 cipher = WPA_CIPHER_CCMP; 1966 } else { 1967 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2"); 1968 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID; 1969 goto error; 1970 } 1971 1972 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2", 1973 kde.ftie, sizeof(*ftie)); 1974 ftie = (struct wpa_tdls_ftie *) kde.ftie; 1975 1976 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 1977 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does " 1978 "not match with FTIE SNonce used in TPK M1"); 1979 /* Silently discard the frame */ 1980 return -1; 1981 } 1982 1983 /* Responder Nonce and RSN IE */ 1984 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN); 1985 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len); 1986 peer->rsnie_p_len = kde.rsn_ie_len; 1987 peer->cipher = cipher; 1988 1989 /* Lifetime */ 1990 if (kde.key_lifetime == NULL) { 1991 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2"); 1992 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 1993 goto error; 1994 } 1995 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 1996 lifetime = WPA_GET_LE32(timeoutie->value); 1997 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2", 1998 lifetime); 1999 if (lifetime != peer->lifetime) { 2000 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2001 "TPK M2 (expected %u)", lifetime, peer->lifetime); 2002 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME; 2003 goto error; 2004 } 2005 2006 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid); 2007 2008 /* Process MIC check to see if TPK M2 is right */ 2009 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid, 2010 (u8 *) timeoutie, ftie) < 0) { 2011 /* Discard the frame */ 2012 wpa_tdls_del_key(sm, peer); 2013 wpa_tdls_disable_peer_link(sm, peer); 2014 return -1; 2015 } 2016 2017 if (wpa_tdls_set_key(sm, peer) < 0) { 2018 /* 2019 * Some drivers may not be able to config the key prior to full 2020 * STA entry having been configured. 2021 */ 2022 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2023 "STA entry is complete"); 2024 peer->reconfig_key = 1; 2025 } 2026 2027 skip_rsn: 2028 peer->dtoken = dtoken; 2029 2030 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / " 2031 "TPK Handshake Message 3"); 2032 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0) { 2033 wpa_tdls_disable_peer_link(sm, peer); 2034 return -1; 2035 } 2036 2037 ret = wpa_tdls_enable_link(sm, peer); 2038 if (ret < 0) { 2039 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2040 wpa_tdls_do_teardown(sm, peer, 2041 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2042 } 2043 return ret; 2044 2045 error: 2046 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 2047 status); 2048 wpa_tdls_disable_peer_link(sm, peer); 2049 return -1; 2050 } 2051 2052 2053 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr, 2054 const u8 *buf, size_t len) 2055 { 2056 struct wpa_tdls_peer *peer; 2057 struct wpa_eapol_ie_parse kde; 2058 struct wpa_tdls_ftie *ftie; 2059 struct wpa_tdls_timeoutie *timeoutie; 2060 struct wpa_tdls_lnkid *lnkid; 2061 int ielen; 2062 u16 status; 2063 const u8 *pos; 2064 u32 lifetime; 2065 int ret; 2066 2067 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 " 2068 "(Peer " MACSTR ")", MAC2STR(src_addr)); 2069 for (peer = sm->tdls; peer; peer = peer->next) { 2070 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) 2071 break; 2072 } 2073 if (peer == NULL) { 2074 wpa_printf(MSG_INFO, "TDLS: No matching peer found for " 2075 "TPK M3: " MACSTR, MAC2STR(src_addr)); 2076 return -1; 2077 } 2078 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE); 2079 2080 if (len < 3 + 3) 2081 goto error; 2082 pos = buf; 2083 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */; 2084 2085 status = WPA_GET_LE16(pos); 2086 2087 if (status != 0) { 2088 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u", 2089 status); 2090 goto error; 2091 } 2092 pos += 2 /* status code */ + 1 /* dialog token */; 2093 2094 ielen = len - (pos - buf); /* start of IE in buf */ 2095 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) { 2096 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3"); 2097 goto error; 2098 } 2099 2100 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) { 2101 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3"); 2102 goto error; 2103 } 2104 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3", 2105 (u8 *) kde.lnkid, kde.lnkid_len); 2106 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid; 2107 2108 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) { 2109 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS"); 2110 goto error; 2111 } 2112 2113 if (!wpa_tdls_get_privacy(sm)) 2114 goto skip_rsn; 2115 2116 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) { 2117 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3"); 2118 goto error; 2119 } 2120 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3", 2121 kde.ftie, sizeof(*ftie)); 2122 ftie = (struct wpa_tdls_ftie *) kde.ftie; 2123 2124 if (kde.rsn_ie == NULL) { 2125 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3"); 2126 goto error; 2127 } 2128 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3", 2129 kde.rsn_ie, kde.rsn_ie_len); 2130 if (kde.rsn_ie_len != peer->rsnie_p_len || 2131 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) { 2132 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match " 2133 "with the one sent in TPK M2"); 2134 goto error; 2135 } 2136 2137 if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) { 2138 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does " 2139 "not match with FTIE ANonce used in TPK M2"); 2140 goto error; 2141 } 2142 2143 if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) { 2144 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not " 2145 "match with FTIE SNonce used in TPK M1"); 2146 goto error; 2147 } 2148 2149 if (kde.key_lifetime == NULL) { 2150 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3"); 2151 goto error; 2152 } 2153 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime; 2154 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3", 2155 (u8 *) timeoutie, sizeof(*timeoutie)); 2156 lifetime = WPA_GET_LE32(timeoutie->value); 2157 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3", 2158 lifetime); 2159 if (lifetime != peer->lifetime) { 2160 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in " 2161 "TPK M3 (expected %u)", lifetime, peer->lifetime); 2162 goto error; 2163 } 2164 2165 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid, 2166 (u8 *) timeoutie, ftie) < 0) { 2167 wpa_tdls_del_key(sm, peer); 2168 goto error; 2169 } 2170 2171 if (wpa_tdls_set_key(sm, peer) < 0) { 2172 /* 2173 * Some drivers may not be able to config the key prior to full 2174 * STA entry having been configured. 2175 */ 2176 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after " 2177 "STA entry is complete"); 2178 peer->reconfig_key = 1; 2179 } 2180 2181 skip_rsn: 2182 ret = wpa_tdls_enable_link(sm, peer); 2183 if (ret < 0) { 2184 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link"); 2185 wpa_tdls_do_teardown(sm, peer, 2186 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED); 2187 } 2188 return ret; 2189 error: 2190 wpa_tdls_disable_peer_link(sm, peer); 2191 return -1; 2192 } 2193 2194 2195 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs) 2196 { 2197 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie; 2198 2199 os_memset(lifetime, 0, ie_len); 2200 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL; 2201 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2; 2202 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME; 2203 WPA_PUT_LE32(lifetime->value, tsecs); 2204 os_memcpy(pos, ie, ie_len); 2205 return pos + ie_len; 2206 } 2207 2208 2209 /** 2210 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1) 2211 * @sm: Pointer to WPA state machine data from wpa_sm_init() 2212 * @peer: MAC address of the peer STA 2213 * Returns: 0 on success, or -1 on failure 2214 * 2215 * Send TPK Handshake Message 1 info to driver to start TDLS 2216 * handshake with the peer. 2217 */ 2218 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr) 2219 { 2220 struct wpa_tdls_peer *peer; 2221 int tdls_prohibited = sm->tdls_prohibited; 2222 2223 if (sm->tdls_disabled || !sm->tdls_supported) 2224 return -1; 2225 2226 #ifdef CONFIG_TDLS_TESTING 2227 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) && 2228 tdls_prohibited) { 2229 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition " 2230 "on TDLS"); 2231 tdls_prohibited = 0; 2232 } 2233 #endif /* CONFIG_TDLS_TESTING */ 2234 2235 if (tdls_prohibited) { 2236 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - " 2237 "reject request to start setup"); 2238 return -1; 2239 } 2240 2241 peer = wpa_tdls_add_peer(sm, addr, NULL); 2242 if (peer == NULL) 2243 return -1; 2244 2245 if (peer->tpk_in_progress) { 2246 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer"); 2247 return 0; 2248 } 2249 2250 peer->initiator = 1; 2251 2252 /* add the peer to the driver as a "setup in progress" peer */ 2253 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 2254 NULL, 0); 2255 2256 peer->tpk_in_progress = 1; 2257 2258 if (wpa_tdls_send_tpk_m1(sm, peer) < 0) { 2259 wpa_tdls_disable_peer_link(sm, peer); 2260 return -1; 2261 } 2262 2263 return 0; 2264 } 2265 2266 2267 void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr) 2268 { 2269 struct wpa_tdls_peer *peer; 2270 2271 if (sm->tdls_disabled || !sm->tdls_supported) 2272 return; 2273 2274 for (peer = sm->tdls; peer; peer = peer->next) { 2275 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) 2276 break; 2277 } 2278 2279 if (peer == NULL || !peer->tpk_success) 2280 return; 2281 2282 if (sm->tdls_external_setup) { 2283 /* 2284 * Disable previous link to allow renegotiation to be completed 2285 * on AP path. 2286 */ 2287 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2288 } 2289 } 2290 2291 2292 /** 2293 * wpa_supplicant_rx_tdls - Receive TDLS data frame 2294 * 2295 * This function is called to receive TDLS (ethertype = 0x890d) data frames. 2296 */ 2297 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr, 2298 const u8 *buf, size_t len) 2299 { 2300 struct wpa_sm *sm = ctx; 2301 struct wpa_tdls_frame *tf; 2302 2303 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation", 2304 buf, len); 2305 2306 if (sm->tdls_disabled || !sm->tdls_supported) { 2307 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled " 2308 "or unsupported by driver"); 2309 return; 2310 } 2311 2312 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) { 2313 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message"); 2314 return; 2315 } 2316 2317 if (len < sizeof(*tf)) { 2318 wpa_printf(MSG_INFO, "TDLS: Drop too short frame"); 2319 return; 2320 } 2321 2322 /* Check to make sure its a valid encapsulated TDLS frame */ 2323 tf = (struct wpa_tdls_frame *) buf; 2324 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ || 2325 tf->category != WLAN_ACTION_TDLS) { 2326 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u " 2327 "category=%u action=%u", 2328 tf->payloadtype, tf->category, tf->action); 2329 return; 2330 } 2331 2332 switch (tf->action) { 2333 case WLAN_TDLS_SETUP_REQUEST: 2334 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len); 2335 break; 2336 case WLAN_TDLS_SETUP_RESPONSE: 2337 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len); 2338 break; 2339 case WLAN_TDLS_SETUP_CONFIRM: 2340 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len); 2341 break; 2342 case WLAN_TDLS_TEARDOWN: 2343 wpa_tdls_recv_teardown(sm, src_addr, buf, len); 2344 break; 2345 case WLAN_TDLS_DISCOVERY_REQUEST: 2346 wpa_tdls_process_discovery_request(sm, src_addr, buf, len); 2347 break; 2348 default: 2349 /* Kernel code will process remaining frames */ 2350 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u", 2351 tf->action); 2352 break; 2353 } 2354 } 2355 2356 2357 /** 2358 * wpa_tdls_init - Initialize driver interface parameters for TDLS 2359 * @wpa_s: Pointer to wpa_supplicant data 2360 * Returns: 0 on success, -1 on failure 2361 * 2362 * This function is called to initialize driver interface parameters for TDLS. 2363 * wpa_drv_init() must have been called before this function to initialize the 2364 * driver interface. 2365 */ 2366 int wpa_tdls_init(struct wpa_sm *sm) 2367 { 2368 if (sm == NULL) 2369 return -1; 2370 2371 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname : 2372 sm->ifname, 2373 sm->own_addr, 2374 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls, 2375 sm, 0); 2376 if (sm->l2_tdls == NULL) { 2377 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet " 2378 "connection"); 2379 return -1; 2380 } 2381 2382 /* 2383 * Drivers that support TDLS but don't implement the get_capa callback 2384 * are assumed to perform everything internally 2385 */ 2386 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported, 2387 &sm->tdls_external_setup) < 0) { 2388 sm->tdls_supported = 1; 2389 sm->tdls_external_setup = 0; 2390 } 2391 2392 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by " 2393 "driver", sm->tdls_supported ? "" : " not"); 2394 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup", 2395 sm->tdls_external_setup ? "external" : "internal"); 2396 2397 return 0; 2398 } 2399 2400 2401 void wpa_tdls_teardown_peers(struct wpa_sm *sm) 2402 { 2403 struct wpa_tdls_peer *peer; 2404 2405 peer = sm->tdls; 2406 2407 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers"); 2408 2409 while (peer) { 2410 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR, 2411 MAC2STR(peer->addr)); 2412 if (sm->tdls_external_setup) 2413 wpa_tdls_send_teardown(sm, peer->addr, 2414 WLAN_REASON_DEAUTH_LEAVING); 2415 else 2416 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr); 2417 2418 peer = peer->next; 2419 } 2420 } 2421 2422 2423 static void wpa_tdls_remove_peers(struct wpa_sm *sm) 2424 { 2425 struct wpa_tdls_peer *peer, *tmp; 2426 2427 peer = sm->tdls; 2428 sm->tdls = NULL; 2429 2430 while (peer) { 2431 int res; 2432 tmp = peer->next; 2433 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr); 2434 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)", 2435 MAC2STR(peer->addr), res); 2436 wpa_tdls_peer_free(sm, peer); 2437 os_free(peer); 2438 peer = tmp; 2439 } 2440 } 2441 2442 2443 /** 2444 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS 2445 * 2446 * This function is called to recover driver interface parameters for TDLS 2447 * and frees resources allocated for it. 2448 */ 2449 void wpa_tdls_deinit(struct wpa_sm *sm) 2450 { 2451 if (sm == NULL) 2452 return; 2453 2454 if (sm->l2_tdls) 2455 l2_packet_deinit(sm->l2_tdls); 2456 sm->l2_tdls = NULL; 2457 2458 wpa_tdls_remove_peers(sm); 2459 } 2460 2461 2462 void wpa_tdls_assoc(struct wpa_sm *sm) 2463 { 2464 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association"); 2465 wpa_tdls_remove_peers(sm); 2466 } 2467 2468 2469 void wpa_tdls_disassoc(struct wpa_sm *sm) 2470 { 2471 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation"); 2472 wpa_tdls_remove_peers(sm); 2473 } 2474 2475 2476 static int wpa_tdls_prohibited(const u8 *ies, size_t len) 2477 { 2478 struct wpa_eapol_ie_parse elems; 2479 2480 if (ies == NULL) 2481 return 0; 2482 2483 if (wpa_supplicant_parse_ies(ies, len, &elems) < 0) 2484 return 0; 2485 2486 if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5) 2487 return 0; 2488 2489 /* bit 38 - TDLS Prohibited */ 2490 return !!(elems.ext_capab[2 + 4] & 0x40); 2491 } 2492 2493 2494 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2495 { 2496 sm->tdls_prohibited = wpa_tdls_prohibited(ies, len); 2497 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS", 2498 sm->tdls_prohibited ? "prohibited" : "allowed"); 2499 } 2500 2501 2502 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len) 2503 { 2504 if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) { 2505 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on " 2506 "(Re)Association Response IEs"); 2507 sm->tdls_prohibited = 1; 2508 } 2509 } 2510 2511 2512 void wpa_tdls_enable(struct wpa_sm *sm, int enabled) 2513 { 2514 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled"); 2515 sm->tdls_disabled = !enabled; 2516 } 2517 2518 2519 int wpa_tdls_is_external_setup(struct wpa_sm *sm) 2520 { 2521 return sm->tdls_external_setup; 2522 } 2523
