blob: 7c4ef191c4f47ab3cc088a7f002fa5d90b69ef97 [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * wpa_supplicant - TDLS
3 * Copyright (c) 2010-2011, Atheros Communications
4 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
12#include "utils/eloop.h"
13#include "utils/os.h"
14#include "common/ieee802_11_defs.h"
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080015#include "common/ieee802_11_common.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070016#include "crypto/sha256.h"
17#include "crypto/crypto.h"
18#include "crypto/aes_wrap.h"
19#include "rsn_supp/wpa.h"
20#include "rsn_supp/wpa_ie.h"
21#include "rsn_supp/wpa_i.h"
22#include "drivers/driver.h"
23#include "l2_packet/l2_packet.h"
24
25#ifdef CONFIG_TDLS_TESTING
26#define TDLS_TESTING_LONG_FRAME BIT(0)
27#define TDLS_TESTING_ALT_RSN_IE BIT(1)
28#define TDLS_TESTING_DIFF_BSSID BIT(2)
29#define TDLS_TESTING_SHORT_LIFETIME BIT(3)
30#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
31#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
32#define TDLS_TESTING_LONG_LIFETIME BIT(6)
33#define TDLS_TESTING_CONCURRENT_INIT BIT(7)
34#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
35#define TDLS_TESTING_DECLINE_RESP BIT(9)
36#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
Dmitry Shmidt21de2142014-04-08 10:50:52 -070037#define TDLS_TESTING_WRONG_MIC BIT(11)
Roshan Pius3a1667e2018-07-03 15:17:14 -070038#define TDLS_TESTING_DOUBLE_TPK_M2 BIT(12)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070039unsigned int tdls_testing = 0;
40#endif /* CONFIG_TDLS_TESTING */
41
42#define TPK_LIFETIME 43200 /* 12 hours */
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -070043#define TPK_M1_RETRY_COUNT 3
44#define TPK_M1_TIMEOUT 5000 /* in milliseconds */
45#define TPK_M2_RETRY_COUNT 10
46#define TPK_M2_TIMEOUT 500 /* in milliseconds */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070047
48#define TDLS_MIC_LEN 16
49
50#define TDLS_TIMEOUT_LEN 4
51
52struct wpa_tdls_ftie {
53 u8 ie_type; /* FTIE */
54 u8 ie_len;
55 u8 mic_ctrl[2];
56 u8 mic[TDLS_MIC_LEN];
57 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
58 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
59 /* followed by optional elements */
60} STRUCT_PACKED;
61
62struct wpa_tdls_timeoutie {
63 u8 ie_type; /* Timeout IE */
64 u8 ie_len;
65 u8 interval_type;
66 u8 value[TDLS_TIMEOUT_LEN];
67} STRUCT_PACKED;
68
69struct wpa_tdls_lnkid {
70 u8 ie_type; /* Link Identifier IE */
71 u8 ie_len;
72 u8 bssid[ETH_ALEN];
73 u8 init_sta[ETH_ALEN];
74 u8 resp_sta[ETH_ALEN];
75} STRUCT_PACKED;
76
77/* TDLS frame headers as per IEEE Std 802.11z-2010 */
78struct wpa_tdls_frame {
79 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
80 u8 category; /* Category */
81 u8 action; /* Action (enum tdls_frame_type) */
82} STRUCT_PACKED;
83
84static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
85static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
86static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
Sunil Duttd0ef38b2013-09-30 17:34:13 +030087static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
88 struct wpa_tdls_peer *peer);
Dmitry Shmidtb58836e2014-04-29 14:35:56 -070089static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
90 u16 reason_code);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070091
92
93#define TDLS_MAX_IE_LEN 80
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -080094#define IEEE80211_MAX_SUPP_RATES 32
95
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070096struct wpa_tdls_peer {
97 struct wpa_tdls_peer *next;
Dmitry Shmidt8da800a2013-04-24 12:57:01 -070098 unsigned int reconfig_key:1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070099 int initiator; /* whether this end was initiator for TDLS setup */
100 u8 addr[ETH_ALEN]; /* other end MAC address */
101 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
102 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
103 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
104 size_t rsnie_i_len;
105 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
106 size_t rsnie_p_len;
107 u32 lifetime;
108 int cipher; /* Selected cipher (WPA_CIPHER_*) */
109 u8 dtoken;
110
111 struct tpk {
112 u8 kck[16]; /* TPK-KCK */
113 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
114 } tpk;
115 int tpk_set;
Jouni Malinenc580b552017-09-22 11:03:15 +0300116 int tk_set; /* TPK-TK configured to the driver */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700117 int tpk_success;
Sunil Dutt73b28cc2013-09-30 17:38:41 +0300118 int tpk_in_progress;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700119
120 struct tpk_timer {
121 u8 dest[ETH_ALEN];
122 int count; /* Retry Count */
123 int timer; /* Timeout in milliseconds */
124 u8 action_code; /* TDLS frame type */
125 u8 dialog_token;
126 u16 status_code;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700127 u32 peer_capab;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700128 int buf_len; /* length of TPK message for retransmission */
129 u8 *buf; /* buffer for TPK message */
130 } sm_tmr;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800131
132 u16 capability;
133
134 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
135 size_t supp_rates_len;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800136
137 struct ieee80211_ht_capabilities *ht_capabilities;
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800138 struct ieee80211_vht_capabilities *vht_capabilities;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800139
140 u8 qos_info;
141
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700142 u16 aid;
143
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800144 u8 *ext_capab;
145 size_t ext_capab_len;
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800146
147 u8 *supp_channels;
148 size_t supp_channels_len;
149
150 u8 *supp_oper_classes;
151 size_t supp_oper_classes_len;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700152
153 u8 wmm_capable;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800154
155 /* channel switch currently enabled */
156 int chan_switch_enabled;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700157};
158
159
160static int wpa_tdls_get_privacy(struct wpa_sm *sm)
161{
162 /*
163 * Get info needed from supplicant to check if the current BSS supports
164 * security. Other than OPEN mode, rest are considered secured
165 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
166 */
167 return sm->pairwise_cipher != WPA_CIPHER_NONE;
168}
169
170
171static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
172{
173 os_memcpy(pos, ie, ie_len);
174 return pos + ie_len;
175}
176
177
178static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
179{
180 if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,
Hai Shalomfdcde762020-04-02 11:19:20 -0700181 0, 0, NULL, 0, NULL, 0, KEY_FLAG_PAIRWISE) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700182 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
183 "the driver");
184 return -1;
185 }
186
187 return 0;
188}
189
190
191static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
192{
193 u8 key_len;
194 u8 rsc[6];
195 enum wpa_alg alg;
196
Jouni Malinenc580b552017-09-22 11:03:15 +0300197 if (peer->tk_set) {
198 /*
199 * This same TPK-TK has already been configured to the driver
200 * and this new configuration attempt (likely due to an
201 * unexpected retransmitted frame) would result in clearing
202 * the TX/RX sequence number which can break security, so must
203 * not allow that to happen.
204 */
205 wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
206 " has already been configured to the driver - do not reconfigure",
207 MAC2STR(peer->addr));
208 return -1;
209 }
210
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700211 os_memset(rsc, 0, 6);
212
213 switch (peer->cipher) {
214 case WPA_CIPHER_CCMP:
215 alg = WPA_ALG_CCMP;
216 key_len = 16;
217 break;
218 case WPA_CIPHER_NONE:
219 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
220 "NONE - do not use pairwise keys");
221 return -1;
222 default:
223 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
224 sm->pairwise_cipher);
225 return -1;
226 }
227
Jouni Malinenc580b552017-09-22 11:03:15 +0300228 wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
229 MAC2STR(peer->addr));
Hai Shalomfdcde762020-04-02 11:19:20 -0700230 if (wpa_sm_set_key(sm, alg, peer->addr, 0, 1, rsc, sizeof(rsc),
231 peer->tpk.tk, key_len,
232 KEY_FLAG_PAIRWISE_RX_TX) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700233 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
234 "driver");
235 return -1;
236 }
Jouni Malinenc580b552017-09-22 11:03:15 +0300237 peer->tk_set = 1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700238 return 0;
239}
240
241
242static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
243 u8 action_code, u8 dialog_token,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700244 u16 status_code, u32 peer_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700245 int initiator, const u8 *buf, size_t len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700246{
247 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700248 status_code, peer_capab, initiator, buf,
249 len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700250}
251
252
253static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700254 u8 dialog_token, u16 status_code, u32 peer_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700255 int initiator, const u8 *msg, size_t msg_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700256{
257 struct wpa_tdls_peer *peer;
258
259 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700260 "dialog_token=%u status_code=%u peer_capab=%u initiator=%d "
261 "msg_len=%u",
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700262 MAC2STR(dest), action_code, dialog_token, status_code,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700263 peer_capab, initiator, (unsigned int) msg_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700264
265 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700266 status_code, peer_capab, initiator, msg,
267 msg_len)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700268 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
269 "(action_code=%u)", action_code);
270 return -1;
271 }
272
273 if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800274 action_code == WLAN_TDLS_TEARDOWN ||
275 action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
276 action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700277 return 0; /* No retries */
278
279 for (peer = sm->tdls; peer; peer = peer->next) {
280 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)
281 break;
282 }
283
284 if (peer == NULL) {
285 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
286 "retry " MACSTR, MAC2STR(dest));
287 return 0;
288 }
289
290 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
291
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700292 if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
293 peer->sm_tmr.count = TPK_M2_RETRY_COUNT;
294 peer->sm_tmr.timer = TPK_M2_TIMEOUT;
295 } else {
296 peer->sm_tmr.count = TPK_M1_RETRY_COUNT;
297 peer->sm_tmr.timer = TPK_M1_TIMEOUT;
298 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700299
300 /* Copy message to resend on timeout */
301 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
302 peer->sm_tmr.action_code = action_code;
303 peer->sm_tmr.dialog_token = dialog_token;
304 peer->sm_tmr.status_code = status_code;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700305 peer->sm_tmr.peer_capab = peer_capab;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700306 peer->sm_tmr.buf_len = msg_len;
307 os_free(peer->sm_tmr.buf);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700308 peer->sm_tmr.buf = os_memdup(msg, msg_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700309 if (peer->sm_tmr.buf == NULL)
310 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700311
312 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
313 "(action_code=%u)", action_code);
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700314 eloop_register_timeout(peer->sm_tmr.timer / 1000,
315 (peer->sm_tmr.timer % 1000) * 1000,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700316 wpa_tdls_tpk_retry_timeout, sm, peer);
317 return 0;
318}
319
320
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800321static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300322 u16 reason_code)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800323{
324 int ret;
325
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300326 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
327 /* disable the link after teardown was sent */
Sunil Duttd0ef38b2013-09-30 17:34:13 +0300328 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800329
330 return ret;
331}
332
333
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700334static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
335{
336
337 struct wpa_sm *sm = eloop_ctx;
338 struct wpa_tdls_peer *peer = timeout_ctx;
339
340 if (peer->sm_tmr.count) {
341 peer->sm_tmr.count--;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700342
343 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
344 "(action_code=%u)",
345 peer->sm_tmr.action_code);
346
347 if (peer->sm_tmr.buf == NULL) {
348 wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
349 "for action_code=%u",
350 peer->sm_tmr.action_code);
351 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
352 peer);
353 return;
354 }
355
356 /* resend TPK Handshake Message to Peer */
357 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
358 peer->sm_tmr.action_code,
359 peer->sm_tmr.dialog_token,
360 peer->sm_tmr.status_code,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700361 peer->sm_tmr.peer_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700362 peer->initiator,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700363 peer->sm_tmr.buf,
364 peer->sm_tmr.buf_len)) {
365 wpa_printf(MSG_INFO, "TDLS: Failed to retry "
366 "transmission");
367 }
368
369 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700370 eloop_register_timeout(peer->sm_tmr.timer / 1000,
371 (peer->sm_tmr.timer % 1000) * 1000,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700372 wpa_tdls_tpk_retry_timeout, sm, peer);
373 } else {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700374 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
375
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800376 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
377 wpa_tdls_do_teardown(sm, peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300378 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700379 }
380}
381
382
383static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
384 struct wpa_tdls_peer *peer,
385 u8 action_code)
386{
387 if (action_code == peer->sm_tmr.action_code) {
388 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
389 "action_code=%u", action_code);
390
391 /* Cancel Timeout registered */
392 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
393
394 /* free all resources meant for retry */
395 os_free(peer->sm_tmr.buf);
396 peer->sm_tmr.buf = NULL;
397
398 peer->sm_tmr.count = 0;
399 peer->sm_tmr.timer = 0;
400 peer->sm_tmr.buf_len = 0;
401 peer->sm_tmr.action_code = 0xff;
402 } else {
403 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
404 "(Unknown action_code=%u)", action_code);
405 }
406}
407
408
409static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
410 const u8 *own_addr, const u8 *bssid)
411{
412 u8 key_input[SHA256_MAC_LEN];
413 const u8 *nonce[2];
414 size_t len[2];
415 u8 data[3 * ETH_ALEN];
416
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700417 /* IEEE Std 802.11-2016 12.7.9.2:
418 * TPK-Key-Input = Hash(min(SNonce, ANonce) || max(SNonce, ANonce))
419 * Hash = SHA-256 for TDLS
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700420 */
421 len[0] = WPA_NONCE_LEN;
422 len[1] = WPA_NONCE_LEN;
423 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
424 nonce[0] = peer->inonce;
425 nonce[1] = peer->rnonce;
426 } else {
427 nonce[0] = peer->rnonce;
428 nonce[1] = peer->inonce;
429 }
430 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
431 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
432 sha256_vector(2, nonce, len, key_input);
433 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
434 key_input, SHA256_MAC_LEN);
435
436 /*
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700437 * TPK = KDF-Hash-Length(TPK-Key-Input, "TDLS PMK",
438 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700439 */
440
441 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
442 os_memcpy(data, own_addr, ETH_ALEN);
443 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
444 } else {
445 os_memcpy(data, peer->addr, ETH_ALEN);
446 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
447 }
448 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
449 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
450
451 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
452 (u8 *) &peer->tpk, sizeof(peer->tpk));
453 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
454 peer->tpk.kck, sizeof(peer->tpk.kck));
455 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
456 peer->tpk.tk, sizeof(peer->tpk.tk));
457 peer->tpk_set = 1;
458}
459
460
461/**
462 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
463 * @kck: TPK-KCK
464 * @lnkid: Pointer to the beginning of Link Identifier IE
465 * @rsnie: Pointer to the beginning of RSN IE used for handshake
466 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
467 * @ftie: Pointer to the beginning of FT IE
468 * @mic: Pointer for writing MIC
469 *
470 * Calculate MIC for TDLS frame.
471 */
472static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
473 const u8 *rsnie, const u8 *timeoutie,
474 const u8 *ftie, u8 *mic)
475{
476 u8 *buf, *pos;
477 struct wpa_tdls_ftie *_ftie;
478 const struct wpa_tdls_lnkid *_lnkid;
479 int ret;
480 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
481 2 + timeoutie[1] + 2 + ftie[1];
482 buf = os_zalloc(len);
483 if (!buf) {
484 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
485 return -1;
486 }
487
488 pos = buf;
489 _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
490 /* 1) TDLS initiator STA MAC address */
491 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
492 pos += ETH_ALEN;
493 /* 2) TDLS responder STA MAC address */
494 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
495 pos += ETH_ALEN;
496 /* 3) Transaction Sequence number */
497 *pos++ = trans_seq;
498 /* 4) Link Identifier IE */
499 os_memcpy(pos, lnkid, 2 + lnkid[1]);
500 pos += 2 + lnkid[1];
501 /* 5) RSN IE */
502 os_memcpy(pos, rsnie, 2 + rsnie[1]);
503 pos += 2 + rsnie[1];
504 /* 6) Timeout Interval IE */
505 os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
506 pos += 2 + timeoutie[1];
507 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
508 os_memcpy(pos, ftie, 2 + ftie[1]);
509 _ftie = (struct wpa_tdls_ftie *) pos;
510 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
511 pos += 2 + ftie[1];
512
513 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
514 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
515 ret = omac1_aes_128(kck, buf, pos - buf, mic);
516 os_free(buf);
517 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
518 return ret;
519}
520
521
522/**
523 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
524 * @kck: TPK-KCK
525 * @trans_seq: Transaction Sequence Number (4 - Teardown)
526 * @rcode: Reason code for Teardown
527 * @dtoken: Dialog Token used for that particular link
528 * @lnkid: Pointer to the beginning of Link Identifier IE
529 * @ftie: Pointer to the beginning of FT IE
530 * @mic: Pointer for writing MIC
531 *
532 * Calculate MIC for TDLS frame.
533 */
534static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
535 u8 dtoken, const u8 *lnkid,
536 const u8 *ftie, u8 *mic)
537{
538 u8 *buf, *pos;
539 struct wpa_tdls_ftie *_ftie;
540 int ret;
541 int len;
542
543 if (lnkid == NULL)
544 return -1;
545
546 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
547 sizeof(trans_seq) + 2 + ftie[1];
548
549 buf = os_zalloc(len);
550 if (!buf) {
551 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
552 return -1;
553 }
554
555 pos = buf;
556 /* 1) Link Identifier IE */
557 os_memcpy(pos, lnkid, 2 + lnkid[1]);
558 pos += 2 + lnkid[1];
559 /* 2) Reason Code */
560 WPA_PUT_LE16(pos, rcode);
561 pos += sizeof(rcode);
562 /* 3) Dialog token */
563 *pos++ = dtoken;
564 /* 4) Transaction Sequence number */
565 *pos++ = trans_seq;
566 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
567 os_memcpy(pos, ftie, 2 + ftie[1]);
568 _ftie = (struct wpa_tdls_ftie *) pos;
569 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
570 pos += 2 + ftie[1];
571
572 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
573 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
574 ret = omac1_aes_128(kck, buf, pos - buf, mic);
575 os_free(buf);
576 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
577 return ret;
578}
579
580
581static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
582 struct wpa_tdls_peer *peer,
583 const u8 *lnkid, const u8 *timeoutie,
584 const struct wpa_tdls_ftie *ftie)
585{
586 u8 mic[16];
587
588 if (peer->tpk_set) {
589 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
590 peer->rsnie_p, timeoutie, (u8 *) ftie,
591 mic);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700592 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700593 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
594 "dropping packet");
595 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
596 ftie->mic, 16);
597 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
598 mic, 16);
599 return -1;
600 }
601 } else {
602 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
603 "TPK not set - dropping packet");
604 return -1;
605 }
606 return 0;
607}
608
609
610static int wpa_supplicant_verify_tdls_mic_teardown(
611 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
612 const u8 *lnkid, const struct wpa_tdls_ftie *ftie)
613{
614 u8 mic[16];
615
616 if (peer->tpk_set) {
617 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
618 dtoken, lnkid, (u8 *) ftie, mic);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700619 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700620 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
621 "dropping packet");
622 return -1;
623 }
624 } else {
625 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
626 "MIC, TPK not set - dropping packet");
627 return -1;
628 }
629 return 0;
630}
631
632
633static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
634{
635 struct wpa_sm *sm = eloop_ctx;
636 struct wpa_tdls_peer *peer = timeout_ctx;
637
638 /*
639 * On TPK lifetime expiration, we have an option of either tearing down
640 * the direct link or trying to re-initiate it. The selection of what
641 * to do is not strictly speaking controlled by our role in the expired
642 * link, but for now, use that to select whether to renew or tear down
643 * the link.
644 */
645
646 if (peer->initiator) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800647 u8 addr[ETH_ALEN];
648
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700649 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
650 " - try to renew", MAC2STR(peer->addr));
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800651 /* cache the peer address before do_teardown */
652 os_memcpy(addr, peer->addr, ETH_ALEN);
653 wpa_tdls_do_teardown(sm, peer,
654 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
655 wpa_tdls_start(sm, addr);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700656 } else {
657 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
658 " - tear down", MAC2STR(peer->addr));
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800659 wpa_tdls_do_teardown(sm, peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300660 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700661 }
662}
663
664
Dmitry Shmidtd30ac602014-06-30 09:54:22 -0700665static void wpa_tdls_peer_remove_from_list(struct wpa_sm *sm,
666 struct wpa_tdls_peer *peer)
667{
668 struct wpa_tdls_peer *cur, *prev;
669
670 cur = sm->tdls;
671 prev = NULL;
672 while (cur && cur != peer) {
673 prev = cur;
674 cur = cur->next;
675 }
676
677 if (cur != peer) {
678 wpa_printf(MSG_ERROR, "TDLS: Could not find peer " MACSTR
679 " to remove it from the list",
680 MAC2STR(peer->addr));
681 return;
682 }
683
684 if (prev)
685 prev->next = peer->next;
686 else
687 sm->tdls = peer->next;
688}
689
690
691static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700692{
693 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
694 MAC2STR(peer->addr));
695 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
696 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
Dmitry Shmidt8da800a2013-04-24 12:57:01 -0700697 peer->reconfig_key = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700698 peer->initiator = 0;
Sunil Dutt73b28cc2013-09-30 17:38:41 +0300699 peer->tpk_in_progress = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700700 os_free(peer->sm_tmr.buf);
701 peer->sm_tmr.buf = NULL;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800702 os_free(peer->ht_capabilities);
703 peer->ht_capabilities = NULL;
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800704 os_free(peer->vht_capabilities);
705 peer->vht_capabilities = NULL;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800706 os_free(peer->ext_capab);
707 peer->ext_capab = NULL;
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800708 os_free(peer->supp_channels);
709 peer->supp_channels = NULL;
710 os_free(peer->supp_oper_classes);
711 peer->supp_oper_classes = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700712 peer->rsnie_i_len = peer->rsnie_p_len = 0;
713 peer->cipher = 0;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700714 peer->qos_info = 0;
715 peer->wmm_capable = 0;
Jouni Malinenc580b552017-09-22 11:03:15 +0300716 peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800717 peer->chan_switch_enabled = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700718 os_memset(&peer->tpk, 0, sizeof(peer->tpk));
719 os_memset(peer->inonce, 0, WPA_NONCE_LEN);
720 os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
721}
722
723
Dmitry Shmidtd30ac602014-06-30 09:54:22 -0700724static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
725{
726 wpa_tdls_peer_clear(sm, peer);
727 wpa_tdls_peer_remove_from_list(sm, peer);
728 os_free(peer);
729}
730
731
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700732static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
733 struct wpa_tdls_lnkid *lnkid)
734{
735 lnkid->ie_type = WLAN_EID_LINK_ID;
736 lnkid->ie_len = 3 * ETH_ALEN;
737 os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN);
738 if (peer->initiator) {
739 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
740 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
741 } else {
742 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
743 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
744 }
745}
746
747
Dmitry Shmidtb58836e2014-04-29 14:35:56 -0700748static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
749 u16 reason_code)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700750{
751 struct wpa_tdls_peer *peer;
752 struct wpa_tdls_ftie *ftie;
753 struct wpa_tdls_lnkid lnkid;
754 u8 dialog_token;
755 u8 *rbuf, *pos;
756 int ielen;
757
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800758 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700759 return -1;
760
761 /* Find the node and free from the list */
762 for (peer = sm->tdls; peer; peer = peer->next) {
763 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
764 break;
765 }
766
767 if (peer == NULL) {
768 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
769 "Teardown " MACSTR, MAC2STR(addr));
770 return 0;
771 }
772
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800773 /* Cancel active channel switch before teardown */
774 if (peer->chan_switch_enabled) {
775 wpa_printf(MSG_DEBUG, "TDLS: First returning link with " MACSTR
776 " to base channel", MAC2STR(addr));
777 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
778 }
779
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700780 dialog_token = peer->dtoken;
781
782 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
783 MAC2STR(addr));
784
785 ielen = 0;
786 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
787 /* To add FTIE for Teardown request and compute MIC */
788 ielen += sizeof(*ftie);
789#ifdef CONFIG_TDLS_TESTING
790 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
791 ielen += 170;
792#endif /* CONFIG_TDLS_TESTING */
793 }
794
795 rbuf = os_zalloc(ielen + 1);
796 if (rbuf == NULL)
797 return -1;
798 pos = rbuf;
799
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700800 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700801 goto skip_ies;
802
803 ftie = (struct wpa_tdls_ftie *) pos;
804 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
805 /* Using the recent nonce which should be for CONFIRM frame */
806 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
807 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
808 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
809 pos = (u8 *) (ftie + 1);
810#ifdef CONFIG_TDLS_TESTING
811 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
812 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
813 "FTIE");
814 ftie->ie_len += 170;
815 *pos++ = 255; /* FTIE subelem */
816 *pos++ = 168; /* FTIE subelem length */
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800817 pos += 168;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700818 }
819#endif /* CONFIG_TDLS_TESTING */
820 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800821 (u8 *) ftie, pos - (u8 *) ftie);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700822
823 /* compute MIC before sending */
824 wpa_tdls_linkid(sm, peer, &lnkid);
825 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
826 dialog_token, (u8 *) &lnkid, (u8 *) ftie,
827 ftie->mic);
828
829skip_ies:
830 /* TODO: register for a Timeout handler, if Teardown is not received at
831 * the other end, then try again another time */
832
833 /* request driver to send Teardown using this FTIE */
834 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700835 reason_code, 0, peer->initiator, rbuf, pos - rbuf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700836 os_free(rbuf);
837
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700838 return 0;
839}
840
841
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800842int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
843{
844 struct wpa_tdls_peer *peer;
845
846 if (sm->tdls_disabled || !sm->tdls_supported)
847 return -1;
848
849 for (peer = sm->tdls; peer; peer = peer->next) {
850 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
851 break;
852 }
853
854 if (peer == NULL) {
855 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
856 " for link Teardown", MAC2STR(addr));
857 return -1;
858 }
859
860 if (!peer->tpk_success) {
861 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
862 " not connected - cannot Teardown link", MAC2STR(addr));
863 return -1;
864 }
865
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300866 return wpa_tdls_do_teardown(sm, peer, reason_code);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800867}
868
869
Sunil Dutt38ffd882013-09-30 17:23:23 +0300870static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
871 struct wpa_tdls_peer *peer)
872{
873 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
874 wpa_tdls_peer_free(sm, peer);
875}
876
877
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700878void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800879{
880 struct wpa_tdls_peer *peer;
881
882 for (peer = sm->tdls; peer; peer = peer->next) {
883 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
884 break;
885 }
886
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700887 if (!peer || !peer->tpk_success) {
888 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
889 " not connected - cannot teardown unreachable link",
890 MAC2STR(addr));
891 return;
892 }
893
894 if (wpa_tdls_is_external_setup(sm)) {
895 /*
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800896 * Get us on the base channel, disable the link, send a
897 * teardown packet through the AP, and then reset link data.
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700898 */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800899 if (peer->chan_switch_enabled)
900 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700901 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
902 wpa_tdls_send_teardown(sm, addr,
903 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE);
904 wpa_tdls_peer_free(sm, peer);
905 } else {
Sunil Dutt38ffd882013-09-30 17:23:23 +0300906 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700907 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800908}
909
910
Dmitry Shmidte0e48dc2013-11-18 12:00:06 -0800911const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr)
912{
913 struct wpa_tdls_peer *peer;
914
915 if (sm->tdls_disabled || !sm->tdls_supported)
916 return "disabled";
917
918 for (peer = sm->tdls; peer; peer = peer->next) {
919 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
920 break;
921 }
922
923 if (peer == NULL)
924 return "peer does not exist";
925
926 if (!peer->tpk_success)
927 return "peer not connected";
928
929 return "connected";
930}
931
932
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700933static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
934 const u8 *buf, size_t len)
935{
936 struct wpa_tdls_peer *peer = NULL;
937 struct wpa_tdls_ftie *ftie;
938 struct wpa_tdls_lnkid *lnkid;
939 struct wpa_eapol_ie_parse kde;
940 u16 reason_code;
941 const u8 *pos;
942 int ielen;
943
944 /* Find the node and free from the list */
945 for (peer = sm->tdls; peer; peer = peer->next) {
946 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
947 break;
948 }
949
950 if (peer == NULL) {
951 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
952 "Teardown " MACSTR, MAC2STR(src_addr));
953 return 0;
954 }
955
956 pos = buf;
957 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
958
959 reason_code = WPA_GET_LE16(pos);
960 pos += 2;
961
962 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
963 " (reason code %u)", MAC2STR(src_addr), reason_code);
964
965 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -0800966
967 /*
968 * Don't reject the message if failing to parse IEs. The IEs we need are
969 * explicitly checked below. Some APs may add arbitrary padding to the
970 * end of short TDLS frames and that would look like invalid IEs.
971 */
972 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0)
973 wpa_printf(MSG_DEBUG,
974 "TDLS: Failed to parse IEs in Teardown - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700975
976 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
977 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
978 "Teardown");
979 return -1;
980 }
981 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
982
983 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
984 goto skip_ftie;
985
986 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
987 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
988 return -1;
989 }
990
991 ftie = (struct wpa_tdls_ftie *) kde.ftie;
992
993 /* Process MIC check to see if TDLS Teardown is right */
994 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
995 peer->dtoken, peer,
996 (u8 *) lnkid, ftie) < 0) {
997 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
998 "Teardown Request from " MACSTR, MAC2STR(src_addr));
999 return -1;
1000 }
1001
1002skip_ftie:
1003 /*
1004 * Request the driver to disable the direct link and clear associated
1005 * keys.
1006 */
Sunil Dutt38ffd882013-09-30 17:23:23 +03001007 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001008 return 0;
1009}
1010
1011
1012/**
1013 * wpa_tdls_send_error - To send suitable TDLS status response with
1014 * appropriate status code mentioning reason for error/failure.
1015 * @dst - MAC addr of Peer station
1016 * @tdls_action - TDLS frame type for which error code is sent
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001017 * @initiator - was this end the initiator of the connection
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001018 * @status - status code mentioning reason
1019 */
1020
1021static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001022 u8 tdls_action, u8 dialog_token, int initiator,
1023 u16 status)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001024{
1025 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
1026 " (action=%u status=%u)",
1027 MAC2STR(dst), tdls_action, status);
1028 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001029 0, initiator, NULL, 0);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001030}
1031
1032
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001033static struct wpa_tdls_peer *
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001034wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001035{
1036 struct wpa_tdls_peer *peer;
1037
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001038 if (existing)
1039 *existing = 0;
1040 for (peer = sm->tdls; peer; peer = peer->next) {
1041 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0) {
1042 if (existing)
1043 *existing = 1;
1044 return peer; /* re-use existing entry */
1045 }
1046 }
1047
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001048 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
1049 MAC2STR(addr));
1050
1051 peer = os_zalloc(sizeof(*peer));
1052 if (peer == NULL)
1053 return NULL;
1054
1055 os_memcpy(peer->addr, addr, ETH_ALEN);
1056 peer->next = sm->tdls;
1057 sm->tdls = peer;
1058
1059 return peer;
1060}
1061
1062
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001063static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
1064 struct wpa_tdls_peer *peer)
1065{
1066 size_t buf_len;
1067 struct wpa_tdls_timeoutie timeoutie;
1068 u16 rsn_capab;
1069 struct wpa_tdls_ftie *ftie;
1070 u8 *rbuf, *pos, *count_pos;
1071 u16 count;
1072 struct rsn_ie_hdr *hdr;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001073 int status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001074
1075 if (!wpa_tdls_get_privacy(sm)) {
1076 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
1077 peer->rsnie_i_len = 0;
1078 goto skip_rsnie;
1079 }
1080
1081 /*
1082 * TPK Handshake Message 1:
1083 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
1084 * Timeout Interval IE))
1085 */
1086
1087 /* Filling RSN IE */
1088 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1089 hdr->elem_id = WLAN_EID_RSN;
1090 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1091
1092 pos = (u8 *) (hdr + 1);
1093 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1094 pos += RSN_SELECTOR_LEN;
1095 count_pos = pos;
1096 pos += 2;
1097
1098 count = 0;
1099
1100 /*
1101 * AES-CCMP is the default Encryption preferred for TDLS, so
1102 * RSN IE is filled only with CCMP CIPHER
1103 * Note: TKIP is not used to encrypt TDLS link.
1104 *
1105 * Regardless of the cipher used on the AP connection, select CCMP
1106 * here.
1107 */
1108 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1109 pos += RSN_SELECTOR_LEN;
1110 count++;
1111
1112 WPA_PUT_LE16(count_pos, count);
1113
1114 WPA_PUT_LE16(pos, 1);
1115 pos += 2;
1116 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1117 pos += RSN_SELECTOR_LEN;
1118
1119 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1120 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1121#ifdef CONFIG_TDLS_TESTING
1122 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1123 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
1124 "testing");
1125 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1126 }
1127#endif /* CONFIG_TDLS_TESTING */
1128 WPA_PUT_LE16(pos, rsn_capab);
1129 pos += 2;
1130#ifdef CONFIG_TDLS_TESTING
1131 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1132 /* Number of PMKIDs */
1133 *pos++ = 0x00;
1134 *pos++ = 0x00;
1135 }
1136#endif /* CONFIG_TDLS_TESTING */
1137
1138 hdr->len = (pos - peer->rsnie_i) - 2;
1139 peer->rsnie_i_len = pos - peer->rsnie_i;
1140 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1141 peer->rsnie_i, peer->rsnie_i_len);
1142
1143skip_rsnie:
1144 buf_len = 0;
1145 if (wpa_tdls_get_privacy(sm))
1146 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1147 sizeof(struct wpa_tdls_timeoutie);
1148#ifdef CONFIG_TDLS_TESTING
1149 if (wpa_tdls_get_privacy(sm) &&
1150 (tdls_testing & TDLS_TESTING_LONG_FRAME))
1151 buf_len += 170;
1152 if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
1153 buf_len += sizeof(struct wpa_tdls_lnkid);
1154#endif /* CONFIG_TDLS_TESTING */
1155 rbuf = os_zalloc(buf_len + 1);
1156 if (rbuf == NULL) {
1157 wpa_tdls_peer_free(sm, peer);
Hai Shalom60840252021-02-19 19:02:11 -08001158 return -2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001159 }
1160 pos = rbuf;
1161
1162 if (!wpa_tdls_get_privacy(sm))
1163 goto skip_ies;
1164
1165 /* Initiator RSN IE */
1166 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1167
1168 ftie = (struct wpa_tdls_ftie *) pos;
1169 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1170 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1171
1172 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1173 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1174 "TDLS: Failed to get random data for initiator Nonce");
1175 os_free(rbuf);
1176 wpa_tdls_peer_free(sm, peer);
Hai Shalom60840252021-02-19 19:02:11 -08001177 return -2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001178 }
Jouni Malinenc580b552017-09-22 11:03:15 +03001179 peer->tk_set = 0; /* A new nonce results in a new TK */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001180 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1181 peer->inonce, WPA_NONCE_LEN);
1182 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1183
1184 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1185 (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1186
1187 pos = (u8 *) (ftie + 1);
1188
1189#ifdef CONFIG_TDLS_TESTING
1190 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1191 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1192 "FTIE");
1193 ftie->ie_len += 170;
1194 *pos++ = 255; /* FTIE subelem */
1195 *pos++ = 168; /* FTIE subelem length */
1196 pos += 168;
1197 }
1198#endif /* CONFIG_TDLS_TESTING */
1199
1200 /* Lifetime */
1201 peer->lifetime = TPK_LIFETIME;
1202#ifdef CONFIG_TDLS_TESTING
1203 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1204 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1205 "lifetime");
1206 peer->lifetime = 301;
1207 }
1208 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1209 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1210 "lifetime");
1211 peer->lifetime = 0xffffffff;
1212 }
1213#endif /* CONFIG_TDLS_TESTING */
1214 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1215 sizeof(timeoutie), peer->lifetime);
1216 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1217
1218skip_ies:
1219
1220#ifdef CONFIG_TDLS_TESTING
1221 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
Paul Stewart092955c2017-02-06 09:13:09 -08001222 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1223
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001224 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1225 "Link Identifier");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001226 wpa_tdls_linkid(sm, peer, l);
1227 l->bssid[5] ^= 0x01;
1228 pos += sizeof(*l);
1229 }
1230#endif /* CONFIG_TDLS_TESTING */
1231
1232 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1233 "Handshake Message 1 (peer " MACSTR ")",
1234 MAC2STR(peer->addr));
1235
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001236 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001237 1, 0, 0, peer->initiator, rbuf, pos - rbuf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001238 os_free(rbuf);
1239
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001240 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001241}
1242
1243
1244static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1245 const unsigned char *src_addr, u8 dtoken,
1246 struct wpa_tdls_lnkid *lnkid,
1247 const struct wpa_tdls_peer *peer)
1248{
1249 u8 *rbuf, *pos;
1250 size_t buf_len;
1251 u32 lifetime;
1252 struct wpa_tdls_timeoutie timeoutie;
1253 struct wpa_tdls_ftie *ftie;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001254 int status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001255
1256 buf_len = 0;
1257 if (wpa_tdls_get_privacy(sm)) {
1258 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1259 * Lifetime */
1260 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1261 sizeof(struct wpa_tdls_timeoutie);
1262#ifdef CONFIG_TDLS_TESTING
1263 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1264 buf_len += 170;
1265#endif /* CONFIG_TDLS_TESTING */
1266 }
1267
1268 rbuf = os_zalloc(buf_len + 1);
1269 if (rbuf == NULL)
1270 return -1;
1271 pos = rbuf;
1272
1273 if (!wpa_tdls_get_privacy(sm))
1274 goto skip_ies;
1275
1276 /* Peer RSN IE */
1277 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1278
1279 ftie = (struct wpa_tdls_ftie *) pos;
1280 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1281 /* TODO: ftie->mic_control to set 2-RESPONSE */
1282 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1283 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1284 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1285 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1286 (u8 *) ftie, sizeof(*ftie));
1287
1288 pos = (u8 *) (ftie + 1);
1289
1290#ifdef CONFIG_TDLS_TESTING
1291 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1292 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1293 "FTIE");
1294 ftie->ie_len += 170;
1295 *pos++ = 255; /* FTIE subelem */
1296 *pos++ = 168; /* FTIE subelem length */
1297 pos += 168;
1298 }
1299#endif /* CONFIG_TDLS_TESTING */
1300
1301 /* Lifetime */
1302 lifetime = peer->lifetime;
1303#ifdef CONFIG_TDLS_TESTING
1304 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1305 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1306 "lifetime in response");
1307 lifetime++;
1308 }
1309#endif /* CONFIG_TDLS_TESTING */
1310 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1311 sizeof(timeoutie), lifetime);
1312 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1313 lifetime);
1314
1315 /* compute MIC before sending */
1316 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,
1317 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
Dmitry Shmidt21de2142014-04-08 10:50:52 -07001318#ifdef CONFIG_TDLS_TESTING
1319 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1320 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1321 ftie->mic[0] ^= 0x01;
1322 }
1323#endif /* CONFIG_TDLS_TESTING */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001324
1325skip_ies:
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001326 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001327 dtoken, 0, 0, peer->initiator, rbuf,
1328 pos - rbuf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001329 os_free(rbuf);
1330
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001331 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001332}
1333
1334
1335static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1336 const unsigned char *src_addr, u8 dtoken,
1337 struct wpa_tdls_lnkid *lnkid,
1338 const struct wpa_tdls_peer *peer)
1339{
1340 u8 *rbuf, *pos;
1341 size_t buf_len;
1342 struct wpa_tdls_ftie *ftie;
1343 struct wpa_tdls_timeoutie timeoutie;
1344 u32 lifetime;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001345 int status;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001346 u32 peer_capab = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001347
1348 buf_len = 0;
1349 if (wpa_tdls_get_privacy(sm)) {
1350 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1351 * Lifetime */
1352 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1353 sizeof(struct wpa_tdls_timeoutie);
1354#ifdef CONFIG_TDLS_TESTING
1355 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1356 buf_len += 170;
1357#endif /* CONFIG_TDLS_TESTING */
1358 }
1359
1360 rbuf = os_zalloc(buf_len + 1);
1361 if (rbuf == NULL)
1362 return -1;
1363 pos = rbuf;
1364
1365 if (!wpa_tdls_get_privacy(sm))
1366 goto skip_ies;
1367
1368 /* Peer RSN IE */
1369 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1370
1371 ftie = (struct wpa_tdls_ftie *) pos;
1372 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1373 /*TODO: ftie->mic_control to set 3-CONFIRM */
1374 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1375 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1376 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1377
1378 pos = (u8 *) (ftie + 1);
1379
1380#ifdef CONFIG_TDLS_TESTING
1381 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1382 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1383 "FTIE");
1384 ftie->ie_len += 170;
1385 *pos++ = 255; /* FTIE subelem */
1386 *pos++ = 168; /* FTIE subelem length */
1387 pos += 168;
1388 }
1389#endif /* CONFIG_TDLS_TESTING */
1390
1391 /* Lifetime */
1392 lifetime = peer->lifetime;
1393#ifdef CONFIG_TDLS_TESTING
1394 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1395 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1396 "lifetime in confirm");
1397 lifetime++;
1398 }
1399#endif /* CONFIG_TDLS_TESTING */
1400 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1401 sizeof(timeoutie), lifetime);
1402 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1403 lifetime);
1404
1405 /* compute MIC before sending */
1406 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,
1407 (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
Dmitry Shmidt21de2142014-04-08 10:50:52 -07001408#ifdef CONFIG_TDLS_TESTING
1409 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1410 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1411 ftie->mic[0] ^= 0x01;
1412 }
1413#endif /* CONFIG_TDLS_TESTING */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001414
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001415skip_ies:
1416
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001417 if (peer->vht_capabilities)
1418 peer_capab |= TDLS_PEER_VHT;
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001419 if (peer->ht_capabilities)
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001420 peer_capab |= TDLS_PEER_HT;
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001421 if (peer->wmm_capable)
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001422 peer_capab |= TDLS_PEER_WMM;
1423
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001424 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001425 dtoken, 0, peer_capab, peer->initiator,
1426 rbuf, pos - rbuf);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001427 os_free(rbuf);
1428
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001429 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001430}
1431
1432
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001433static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1434 struct wpa_tdls_peer *peer,
1435 u8 dialog_token)
1436{
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001437 size_t buf_len = 0;
1438 struct wpa_tdls_timeoutie timeoutie;
1439 u16 rsn_capab;
1440 u8 *rbuf, *pos, *count_pos;
1441 u16 count;
1442 struct rsn_ie_hdr *hdr;
1443 int status;
1444
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001445 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1446 "(peer " MACSTR ")", MAC2STR(peer->addr));
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001447 if (!wpa_tdls_get_privacy(sm))
1448 goto skip_rsn_ies;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001449
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001450 /* Filling RSN IE */
1451 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1452 hdr->elem_id = WLAN_EID_RSN;
1453 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1454 pos = (u8 *) (hdr + 1);
1455 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1456 pos += RSN_SELECTOR_LEN;
1457 count_pos = pos;
1458 pos += 2;
1459 count = 0;
1460
1461 /*
1462 * AES-CCMP is the default encryption preferred for TDLS, so
1463 * RSN IE is filled only with CCMP cipher suite.
1464 * Note: TKIP is not used to encrypt TDLS link.
1465 *
1466 * Regardless of the cipher used on the AP connection, select CCMP
1467 * here.
1468 */
1469 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1470 pos += RSN_SELECTOR_LEN;
1471 count++;
1472 WPA_PUT_LE16(count_pos, count);
1473 WPA_PUT_LE16(pos, 1);
1474 pos += 2;
1475 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1476 pos += RSN_SELECTOR_LEN;
1477
1478 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1479 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1480 WPA_PUT_LE16(pos, rsn_capab);
1481 pos += 2;
1482 hdr->len = (pos - (u8 *) hdr) - 2;
1483 peer->rsnie_i_len = pos - peer->rsnie_i;
1484
1485 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for Discovery Response",
1486 (u8 *) hdr, hdr->len + 2);
1487skip_rsn_ies:
1488 buf_len = 0;
1489 if (wpa_tdls_get_privacy(sm)) {
1490 /* Peer RSN IE, Lifetime */
1491 buf_len += peer->rsnie_i_len +
1492 sizeof(struct wpa_tdls_timeoutie);
1493 }
1494 rbuf = os_zalloc(buf_len + 1);
1495 if (rbuf == NULL) {
1496 wpa_tdls_peer_free(sm, peer);
1497 return -1;
1498 }
1499 pos = rbuf;
1500
1501 if (!wpa_tdls_get_privacy(sm))
1502 goto skip_ies;
1503 /* Initiator RSN IE */
1504 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1505 /* Lifetime */
1506 peer->lifetime = TPK_LIFETIME;
1507 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1508 sizeof(timeoutie), peer->lifetime);
1509 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1510skip_ies:
1511 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001512 dialog_token, 0, 0, 0, rbuf, pos - rbuf);
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001513 os_free(rbuf);
1514
1515 return status;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001516}
1517
1518
1519static int
1520wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1521 const u8 *buf, size_t len)
1522{
1523 struct wpa_eapol_ie_parse kde;
1524 const struct wpa_tdls_lnkid *lnkid;
1525 struct wpa_tdls_peer *peer;
1526 size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1527 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1528 u8 dialog_token;
1529
1530 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1531 MAC2STR(addr));
1532
1533 if (len < min_req_len) {
1534 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1535 "%d", (int) len);
1536 return -1;
1537 }
1538
1539 dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1540
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07001541 /*
1542 * Some APs will tack on a weird IE to the end of a TDLS
1543 * discovery request packet. This needn't fail the response,
1544 * since the required IE are verified separately.
1545 */
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001546 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1547 len - (sizeof(struct wpa_tdls_frame) + 1),
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07001548 &kde) < 0) {
1549 wpa_printf(MSG_DEBUG,
1550 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround");
1551 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001552
1553 if (!kde.lnkid) {
1554 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1555 "Request");
1556 return -1;
1557 }
1558
1559 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1560
1561 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1562 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different "
1563 " BSS " MACSTR, MAC2STR(lnkid->bssid));
1564 return -1;
1565 }
1566
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001567 peer = wpa_tdls_add_peer(sm, addr, NULL);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001568 if (peer == NULL)
1569 return -1;
1570
1571 return wpa_tdls_send_discovery_response(sm, peer, dialog_token);
1572}
1573
1574
1575int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1576{
1577 if (sm->tdls_disabled || !sm->tdls_supported)
1578 return -1;
1579
1580 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1581 MACSTR, MAC2STR(addr));
1582 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001583 1, 0, 0, 1, NULL, 0);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001584}
1585
1586
1587static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1588 struct wpa_tdls_peer *peer)
1589{
1590 if (!kde->supp_rates) {
1591 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1592 return -1;
1593 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001594 peer->supp_rates_len = merge_byte_arrays(
1595 peer->supp_rates, sizeof(peer->supp_rates),
1596 kde->supp_rates + 2, kde->supp_rates_len - 2,
Dmitry Shmidt34af3062013-07-11 10:46:32 -07001597 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
Hai Shalom021b0b52019-04-10 11:17:58 -07001598 kde->ext_supp_rates ? kde->ext_supp_rates_len - 2 : 0);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001599 return 0;
1600}
1601
1602
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001603static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde,
1604 struct wpa_tdls_peer *peer)
1605{
Dmitry Shmidt9d9e6022015-04-23 10:34:55 -07001606 if (!kde->ht_capabilities) {
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001607 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities "
1608 "received");
1609 return 0;
1610 }
1611
1612 if (!peer->ht_capabilities) {
1613 peer->ht_capabilities =
1614 os_zalloc(sizeof(struct ieee80211_ht_capabilities));
1615 if (peer->ht_capabilities == NULL)
1616 return -1;
1617 }
1618
1619 os_memcpy(peer->ht_capabilities, kde->ht_capabilities,
1620 sizeof(struct ieee80211_ht_capabilities));
1621 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities",
1622 (u8 *) peer->ht_capabilities,
1623 sizeof(struct ieee80211_ht_capabilities));
1624
1625 return 0;
1626}
1627
1628
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08001629static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde,
1630 struct wpa_tdls_peer *peer)
1631{
Dmitry Shmidt9d9e6022015-04-23 10:34:55 -07001632 if (!kde->vht_capabilities) {
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08001633 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities "
1634 "received");
1635 return 0;
1636 }
1637
1638 if (!peer->vht_capabilities) {
1639 peer->vht_capabilities =
1640 os_zalloc(sizeof(struct ieee80211_vht_capabilities));
1641 if (peer->vht_capabilities == NULL)
1642 return -1;
1643 }
1644
1645 os_memcpy(peer->vht_capabilities, kde->vht_capabilities,
1646 sizeof(struct ieee80211_vht_capabilities));
1647 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities",
1648 (u8 *) peer->vht_capabilities,
1649 sizeof(struct ieee80211_vht_capabilities));
1650
1651 return 0;
1652}
1653
1654
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001655static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde,
1656 struct wpa_tdls_peer *peer)
1657{
1658 if (!kde->ext_capab) {
1659 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities "
1660 "received");
1661 return 0;
1662 }
1663
1664 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {
1665 /* Need to allocate buffer to fit the new information */
1666 os_free(peer->ext_capab);
1667 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);
1668 if (peer->ext_capab == NULL)
1669 return -1;
1670 }
1671
1672 peer->ext_capab_len = kde->ext_capab_len - 2;
1673 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);
1674
1675 return 0;
1676}
1677
1678
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001679static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde,
1680 struct wpa_tdls_peer *peer)
1681{
1682 struct wmm_information_element *wmm;
1683
1684 if (!kde->wmm) {
1685 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received");
1686 return 0;
1687 }
1688
1689 if (kde->wmm_len < sizeof(struct wmm_information_element)) {
1690 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received");
1691 return -1;
1692 }
1693
1694 wmm = (struct wmm_information_element *) kde->wmm;
1695 peer->qos_info = wmm->qos_info;
1696
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001697 peer->wmm_capable = 1;
1698
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001699 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info);
1700 return 0;
1701}
1702
1703
Dmitry Shmidt344abd32014-01-14 13:17:00 -08001704static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde,
1705 struct wpa_tdls_peer *peer)
1706{
1707 if (!kde->supp_channels) {
1708 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received");
1709 return 0;
1710 }
1711
1712 if (!peer->supp_channels ||
1713 peer->supp_channels_len < kde->supp_channels_len) {
1714 os_free(peer->supp_channels);
1715 peer->supp_channels = os_zalloc(kde->supp_channels_len);
1716 if (peer->supp_channels == NULL)
1717 return -1;
1718 }
1719
1720 peer->supp_channels_len = kde->supp_channels_len;
1721
1722 os_memcpy(peer->supp_channels, kde->supp_channels,
1723 peer->supp_channels_len);
1724 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels",
1725 (u8 *) peer->supp_channels, peer->supp_channels_len);
1726 return 0;
1727}
1728
1729
1730static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde,
1731 struct wpa_tdls_peer *peer)
1732{
1733 if (!kde->supp_oper_classes) {
1734 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received");
1735 return 0;
1736 }
1737
1738 if (!peer->supp_oper_classes ||
1739 peer->supp_oper_classes_len < kde->supp_oper_classes_len) {
1740 os_free(peer->supp_oper_classes);
1741 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len);
1742 if (peer->supp_oper_classes == NULL)
1743 return -1;
1744 }
1745
1746 peer->supp_oper_classes_len = kde->supp_oper_classes_len;
1747 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes,
1748 peer->supp_oper_classes_len);
1749 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes",
1750 (u8 *) peer->supp_oper_classes,
1751 peer->supp_oper_classes_len);
1752 return 0;
1753}
1754
1755
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001756static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
1757 int add)
1758{
1759 return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid,
1760 peer->capability,
1761 peer->supp_rates, peer->supp_rates_len,
1762 peer->ht_capabilities,
1763 peer->vht_capabilities,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001764 peer->qos_info, peer->wmm_capable,
1765 peer->ext_capab, peer->ext_capab_len,
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001766 peer->supp_channels,
1767 peer->supp_channels_len,
1768 peer->supp_oper_classes,
1769 peer->supp_oper_classes_len);
1770}
1771
1772
Jouni Malinenc580b552017-09-22 11:03:15 +03001773static int tdls_nonce_set(const u8 *nonce)
1774{
1775 int i;
1776
1777 for (i = 0; i < WPA_NONCE_LEN; i++) {
1778 if (nonce[i])
1779 return 1;
1780 }
1781
1782 return 0;
1783}
1784
1785
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001786static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1787 const u8 *buf, size_t len)
1788{
1789 struct wpa_tdls_peer *peer;
1790 struct wpa_eapol_ie_parse kde;
1791 struct wpa_ie_data ie;
1792 int cipher;
1793 const u8 *cpos;
1794 struct wpa_tdls_ftie *ftie = NULL;
1795 struct wpa_tdls_timeoutie *timeoutie;
1796 struct wpa_tdls_lnkid *lnkid;
1797 u32 lifetime = 0;
1798#if 0
1799 struct rsn_ie_hdr *hdr;
1800 u8 *pos;
1801 u16 rsn_capab;
1802 u16 rsn_ver;
1803#endif
1804 u8 dtoken;
1805 u16 ielen;
1806 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1807 int tdls_prohibited = sm->tdls_prohibited;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001808 int existing_peer = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001809
1810 if (len < 3 + 3)
1811 return -1;
1812
1813 cpos = buf;
1814 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1815
1816 /* driver had already verified the frame format */
1817 dtoken = *cpos++; /* dialog token */
1818
1819 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1820
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001821 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);
1822 if (peer == NULL)
1823 goto error;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001824
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07001825 /* If found, use existing entry instead of adding a new one;
1826 * how to handle the case where both ends initiate at the
1827 * same time? */
1828 if (existing_peer) {
1829 if (peer->tpk_success) {
1830 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1831 "direct link is enabled - tear down the "
1832 "old link first");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001833 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
1834 wpa_tdls_peer_clear(sm, peer);
1835 } else if (peer->initiator) {
1836 /*
1837 * An entry is already present, so check if we already
1838 * sent a TDLS Setup Request. If so, compare MAC
1839 * addresses and let the STA with the lower MAC address
1840 * continue as the initiator. The other negotiation is
1841 * terminated.
1842 */
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07001843 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
1844 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
1845 "from peer with higher address "
1846 MACSTR, MAC2STR(src_addr));
1847 return -1;
1848 } else {
1849 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
1850 "from peer with lower address "
1851 MACSTR " (terminate previously "
1852 "initiated negotiation",
1853 MAC2STR(src_addr));
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001854 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
1855 peer->addr);
1856 wpa_tdls_peer_clear(sm, peer);
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07001857 }
1858 }
1859 }
1860
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001861 /* capability information */
1862 peer->capability = WPA_GET_LE16(cpos);
1863 cpos += 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001864
1865 ielen = len - (cpos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -08001866
1867 /*
1868 * Don't reject the message if failing to parse IEs. The IEs we need are
1869 * explicitly checked below. Some APs may add arbitrary padding to the
1870 * end of short TDLS frames and that would look like invalid IEs.
1871 */
1872 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0)
1873 wpa_printf(MSG_DEBUG,
1874 "TDLS: Failed to parse IEs in TPK M1 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001875
1876 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1877 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1878 "TPK M1");
1879 goto error;
1880 }
1881 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
1882 kde.lnkid, kde.lnkid_len);
1883 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1884 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1885 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS");
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001886 status = WLAN_STATUS_REQUEST_DECLINED;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001887 goto error;
1888 }
1889
1890 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
1891 MAC2STR(src_addr));
1892
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001893 if (copy_supp_rates(&kde, peer) < 0)
1894 goto error;
1895
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001896 if (copy_peer_ht_capab(&kde, peer) < 0)
1897 goto error;
1898
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08001899 if (copy_peer_vht_capab(&kde, peer) < 0)
1900 goto error;
1901
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001902 if (copy_peer_ext_capab(&kde, peer) < 0)
1903 goto error;
1904
Dmitry Shmidt344abd32014-01-14 13:17:00 -08001905 if (copy_peer_supp_channels(&kde, peer) < 0)
1906 goto error;
1907
1908 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
1909 goto error;
1910
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001911 peer->qos_info = kde.qosinfo;
1912
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001913 /* Overwrite with the qos_info obtained in WMM IE */
1914 if (copy_peer_wmm_capab(&kde, peer) < 0)
1915 goto error;
1916
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -07001917 peer->aid = kde.aid;
1918
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001919#ifdef CONFIG_TDLS_TESTING
1920 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001921 peer = wpa_tdls_add_peer(sm, src_addr, NULL);
1922 if (peer == NULL)
1923 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001924 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
1925 "TDLS setup - send own request");
1926 peer->initiator = 1;
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001927 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
1928 NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0);
Hai Shalom60840252021-02-19 19:02:11 -08001929 if (wpa_tdls_send_tpk_m1(sm, peer) == -2) {
1930 peer = NULL;
1931 goto error;
1932 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001933 }
1934
1935 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
1936 tdls_prohibited) {
1937 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
1938 "on TDLS");
1939 tdls_prohibited = 0;
1940 }
1941#endif /* CONFIG_TDLS_TESTING */
1942
1943 if (tdls_prohibited) {
1944 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
1945 status = WLAN_STATUS_REQUEST_DECLINED;
1946 goto error;
1947 }
1948
1949 if (!wpa_tdls_get_privacy(sm)) {
1950 if (kde.rsn_ie) {
1951 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
1952 "security is disabled");
1953 status = WLAN_STATUS_SECURITY_DISABLED;
1954 goto error;
1955 }
1956 goto skip_rsn;
1957 }
1958
1959 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1960 kde.rsn_ie == NULL) {
1961 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
1962 status = WLAN_STATUS_INVALID_PARAMETERS;
1963 goto error;
1964 }
1965
1966 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
1967 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
1968 "TPK M1");
1969 status = WLAN_STATUS_INVALID_RSNIE;
1970 goto error;
1971 }
1972
1973 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1974 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
1975 status = WLAN_STATUS_INVALID_RSNIE;
1976 goto error;
1977 }
1978
1979 cipher = ie.pairwise_cipher;
1980 if (cipher & WPA_CIPHER_CCMP) {
1981 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1982 cipher = WPA_CIPHER_CCMP;
1983 } else {
1984 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
1985 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1986 goto error;
1987 }
1988
1989 if ((ie.capabilities &
1990 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
1991 WPA_CAPABILITY_PEERKEY_ENABLED) {
1992 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
1993 "TPK M1");
1994 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
1995 goto error;
1996 }
1997
1998 /* Lifetime */
1999 if (kde.key_lifetime == NULL) {
2000 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
2001 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2002 goto error;
2003 }
2004 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2005 lifetime = WPA_GET_LE32(timeoutie->value);
2006 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
2007 if (lifetime < 300) {
2008 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
2009 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2010 goto error;
2011 }
2012
2013skip_rsn:
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002014#ifdef CONFIG_TDLS_TESTING
2015 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
2016 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {
2017 /*
2018 * The request frame from us is going to win, so do not
2019 * replace information based on this request frame from
2020 * the peer.
2021 */
2022 goto skip_rsn_check;
2023 }
2024 }
2025#endif /* CONFIG_TDLS_TESTING */
2026
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002027 peer->initiator = 0; /* Need to check */
2028 peer->dtoken = dtoken;
2029
2030 if (!wpa_tdls_get_privacy(sm)) {
2031 peer->rsnie_i_len = 0;
2032 peer->rsnie_p_len = 0;
2033 peer->cipher = WPA_CIPHER_NONE;
2034 goto skip_rsn_check;
2035 }
2036
2037 ftie = (struct wpa_tdls_ftie *) kde.ftie;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002038 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
2039 peer->rsnie_i_len = kde.rsn_ie_len;
2040 peer->cipher = cipher;
2041
Jouni Malinenc580b552017-09-22 11:03:15 +03002042 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
2043 !tdls_nonce_set(peer->inonce)) {
Sunil Dutt61024722013-09-15 12:09:40 -07002044 /*
2045 * There is no point in updating the RNonce for every obtained
2046 * TPK M1 frame (e.g., retransmission due to timeout) with the
2047 * same INonce (SNonce in FTIE). However, if the TPK M1 is
2048 * retransmitted with a different INonce, update the RNonce
2049 * since this is for a new TDLS session.
2050 */
2051 wpa_printf(MSG_DEBUG,
2052 "TDLS: New TPK M1 INonce - generate new RNonce");
2053 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
2054 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
2055 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2056 "TDLS: Failed to get random data for responder nonce");
Sunil Dutt61024722013-09-15 12:09:40 -07002057 goto error;
2058 }
Jouni Malinenc580b552017-09-22 11:03:15 +03002059 peer->tk_set = 0; /* A new nonce results in a new TK */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002060 }
2061
2062#if 0
2063 /* get version info from RSNIE received from Peer */
2064 hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
2065 rsn_ver = WPA_GET_LE16(hdr->version);
2066
2067 /* use min(peer's version, out version) */
2068 if (rsn_ver > RSN_VERSION)
2069 rsn_ver = RSN_VERSION;
2070
2071 hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
2072
2073 hdr->elem_id = WLAN_EID_RSN;
2074 WPA_PUT_LE16(hdr->version, rsn_ver);
2075 pos = (u8 *) (hdr + 1);
2076
2077 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
2078 pos += RSN_SELECTOR_LEN;
2079 /* Include only the selected cipher in pairwise cipher suite */
2080 WPA_PUT_LE16(pos, 1);
2081 pos += 2;
2082 if (cipher == WPA_CIPHER_CCMP)
2083 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2084 pos += RSN_SELECTOR_LEN;
2085
2086 WPA_PUT_LE16(pos, 1);
2087 pos += 2;
2088 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
2089 pos += RSN_SELECTOR_LEN;
2090
2091 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
2092 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
2093 WPA_PUT_LE16(pos, rsn_capab);
2094 pos += 2;
2095
2096 hdr->len = (pos - peer->rsnie_p) - 2;
2097 peer->rsnie_p_len = pos - peer->rsnie_p;
2098#endif
2099
2100 /* temp fix: validation of RSNIE later */
2101 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
2102 peer->rsnie_p_len = peer->rsnie_i_len;
2103
2104 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
2105 peer->rsnie_p, peer->rsnie_p_len);
2106
2107 peer->lifetime = lifetime;
2108
2109 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
2110
2111skip_rsn_check:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002112#ifdef CONFIG_TDLS_TESTING
2113 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT)
2114 goto skip_add_peer;
2115#endif /* CONFIG_TDLS_TESTING */
2116
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002117 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2118 if (wpa_tdls_addset_peer(sm, peer, 1) < 0)
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002119 goto error;
2120
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002121#ifdef CONFIG_TDLS_TESTING
2122skip_add_peer:
2123#endif /* CONFIG_TDLS_TESTING */
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002124 peer->tpk_in_progress = 1;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002125
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002126 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002127 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002128 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002129 goto error;
2130 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002131
Roshan Pius3a1667e2018-07-03 15:17:14 -07002132#ifdef CONFIG_TDLS_TESTING
2133 if (tdls_testing & TDLS_TESTING_DOUBLE_TPK_M2) {
2134 wpa_printf(MSG_INFO, "TDLS: Testing - Send another TPK M2");
2135 wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer);
2136 }
2137#endif /* CONFIG_TDLS_TESTING */
2138
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002139 return 0;
2140
2141error:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002142 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002143 status);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002144 if (peer)
2145 wpa_tdls_peer_free(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002146 return -1;
2147}
2148
2149
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002150static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002151{
2152 peer->tpk_success = 1;
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002153 peer->tpk_in_progress = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002154 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2155 if (wpa_tdls_get_privacy(sm)) {
2156 u32 lifetime = peer->lifetime;
2157 /*
2158 * Start the initiator process a bit earlier to avoid race
2159 * condition with the responder sending teardown request.
2160 */
2161 if (lifetime > 3 && peer->initiator)
2162 lifetime -= 3;
2163 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
2164 sm, peer);
2165#ifdef CONFIG_TDLS_TESTING
Hai Shalom74f70d42019-02-11 14:42:39 -08002166 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
2167 wpa_printf(MSG_DEBUG,
2168 "TDLS: Testing - disable TPK expiration");
2169 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2170 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002171#endif /* CONFIG_TDLS_TESTING */
2172 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002173
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002174 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {
2175 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the "
2176 "driver");
2177 return -1;
2178 }
2179 peer->reconfig_key = 0;
2180
2181 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002182}
2183
2184
2185static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
2186 const u8 *buf, size_t len)
2187{
2188 struct wpa_tdls_peer *peer;
2189 struct wpa_eapol_ie_parse kde;
2190 struct wpa_ie_data ie;
2191 int cipher;
2192 struct wpa_tdls_ftie *ftie;
2193 struct wpa_tdls_timeoutie *timeoutie;
2194 struct wpa_tdls_lnkid *lnkid;
2195 u32 lifetime;
2196 u8 dtoken;
2197 int ielen;
2198 u16 status;
2199 const u8 *pos;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002200 int ret = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002201
2202 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
2203 "(Peer " MACSTR ")", MAC2STR(src_addr));
2204 for (peer = sm->tdls; peer; peer = peer->next) {
2205 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
2206 break;
2207 }
2208 if (peer == NULL) {
2209 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2210 "TPK M2: " MACSTR, MAC2STR(src_addr));
2211 return -1;
2212 }
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07002213 if (!peer->initiator) {
2214 /*
2215 * This may happen if both devices try to initiate TDLS at the
2216 * same time and we accept the TPK M1 from the peer in
2217 * wpa_tdls_process_tpk_m1() and clear our previous state.
2218 */
2219 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so "
2220 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr));
2221 return -1;
2222 }
Dmitry Shmidt7d56b752015-12-22 10:59:44 -08002223
2224 if (peer->tpk_success) {
2225 wpa_printf(MSG_INFO, "TDLS: Ignore incoming TPK M2 retry, from "
2226 MACSTR " as TPK M3 was already sent",
2227 MAC2STR(src_addr));
2228 return 0;
2229 }
2230
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002231 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
2232
Sunil Duttadce9cf2013-09-15 11:51:00 -07002233 if (len < 3 + 2 + 1) {
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002234 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002235 return -1;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002236 }
2237
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002238 pos = buf;
2239 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2240 status = WPA_GET_LE16(pos);
2241 pos += 2 /* status code */;
2242
2243 if (status != WLAN_STATUS_SUCCESS) {
2244 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
2245 status);
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002246 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002247 return -1;
2248 }
2249
2250 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
2251
2252 /* TODO: need to verify dialog token matches here or in kernel */
2253 dtoken = *pos++; /* dialog token */
2254
2255 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
2256
Sunil Duttadce9cf2013-09-15 11:51:00 -07002257 if (len < 3 + 2 + 1 + 2) {
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002258 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002259 return -1;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002260 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002261
2262 /* capability information */
2263 peer->capability = WPA_GET_LE16(pos);
2264 pos += 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002265
2266 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -08002267
2268 /*
2269 * Don't reject the message if failing to parse IEs. The IEs we need are
2270 * explicitly checked below. Some APs may add arbitrary padding to the
2271 * end of short TDLS frames and that would look like invalid IEs.
2272 */
2273 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0)
2274 wpa_printf(MSG_DEBUG,
2275 "TDLS: Failed to parse IEs in TPK M2 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002276
2277#ifdef CONFIG_TDLS_TESTING
2278 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
2279 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
2280 status = WLAN_STATUS_REQUEST_DECLINED;
2281 goto error;
2282 }
2283#endif /* CONFIG_TDLS_TESTING */
2284
2285 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2286 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2287 "TPK M2");
2288 goto error;
2289 }
2290 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
2291 kde.lnkid, kde.lnkid_len);
2292 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2293
2294 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
2295 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
2296 status = WLAN_STATUS_NOT_IN_SAME_BSS;
2297 goto error;
2298 }
2299
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002300 if (copy_supp_rates(&kde, peer) < 0)
2301 goto error;
2302
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002303 if (copy_peer_ht_capab(&kde, peer) < 0)
2304 goto error;
2305
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08002306 if (copy_peer_vht_capab(&kde, peer) < 0)
2307 goto error;
2308
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002309 if (copy_peer_ext_capab(&kde, peer) < 0)
2310 goto error;
2311
Dmitry Shmidt344abd32014-01-14 13:17:00 -08002312 if (copy_peer_supp_channels(&kde, peer) < 0)
2313 goto error;
2314
2315 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2316 goto error;
2317
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002318 peer->qos_info = kde.qosinfo;
2319
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07002320 /* Overwrite with the qos_info obtained in WMM IE */
2321 if (copy_peer_wmm_capab(&kde, peer) < 0)
2322 goto error;
2323
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -07002324 peer->aid = kde.aid;
2325
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002326 if (!wpa_tdls_get_privacy(sm)) {
2327 peer->rsnie_p_len = 0;
2328 peer->cipher = WPA_CIPHER_NONE;
2329 goto skip_rsn;
2330 }
2331
2332 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2333 kde.rsn_ie == NULL) {
2334 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
2335 status = WLAN_STATUS_INVALID_PARAMETERS;
2336 goto error;
2337 }
2338 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2339 kde.rsn_ie, kde.rsn_ie_len);
2340
Dmitry Shmidt09f57ba2014-06-10 16:07:13 -07002341 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2342 wpa_printf(MSG_INFO,
2343 "TDLS: Too long Responder RSN IE in TPK M2");
2344 status = WLAN_STATUS_INVALID_RSNIE;
2345 goto error;
2346 }
2347
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002348 /*
2349 * FIX: bitwise comparison of RSN IE is not the correct way of
2350 * validation this. It can be different, but certain fields must
2351 * match. Since we list only a single pairwise cipher in TPK M1, the
2352 * memcmp is likely to work in most cases, though.
2353 */
2354 if (kde.rsn_ie_len != peer->rsnie_i_len ||
2355 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
2356 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
2357 "not match with RSN IE used in TPK M1");
2358 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
2359 peer->rsnie_i, peer->rsnie_i_len);
2360 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2361 kde.rsn_ie, kde.rsn_ie_len);
2362 status = WLAN_STATUS_INVALID_RSNIE;
2363 goto error;
2364 }
2365
2366 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2367 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
2368 status = WLAN_STATUS_INVALID_RSNIE;
2369 goto error;
2370 }
2371
2372 cipher = ie.pairwise_cipher;
2373 if (cipher == WPA_CIPHER_CCMP) {
2374 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2375 cipher = WPA_CIPHER_CCMP;
2376 } else {
2377 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
2378 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
2379 goto error;
2380 }
2381
2382 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
2383 kde.ftie, sizeof(*ftie));
2384 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2385
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002386 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002387 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
2388 "not match with FTIE SNonce used in TPK M1");
2389 /* Silently discard the frame */
2390 return -1;
2391 }
2392
2393 /* Responder Nonce and RSN IE */
2394 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
2395 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
2396 peer->rsnie_p_len = kde.rsn_ie_len;
2397 peer->cipher = cipher;
2398
2399 /* Lifetime */
2400 if (kde.key_lifetime == NULL) {
2401 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
2402 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2403 goto error;
2404 }
2405 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2406 lifetime = WPA_GET_LE32(timeoutie->value);
2407 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
2408 lifetime);
2409 if (lifetime != peer->lifetime) {
2410 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2411 "TPK M2 (expected %u)", lifetime, peer->lifetime);
2412 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2413 goto error;
2414 }
2415
2416 wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
2417
2418 /* Process MIC check to see if TPK M2 is right */
2419 if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,
2420 (u8 *) timeoutie, ftie) < 0) {
2421 /* Discard the frame */
2422 wpa_tdls_del_key(sm, peer);
Sunil Dutt38ffd882013-09-30 17:23:23 +03002423 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002424 return -1;
2425 }
2426
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002427 if (wpa_tdls_set_key(sm, peer) < 0) {
2428 /*
2429 * Some drivers may not be able to config the key prior to full
2430 * STA entry having been configured.
2431 */
2432 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2433 "STA entry is complete");
2434 peer->reconfig_key = 1;
2435 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002436
2437skip_rsn:
2438 peer->dtoken = dtoken;
2439
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002440 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2441 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2442 goto error;
2443
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002444 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
2445 "TPK Handshake Message 3");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002446 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0)
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002447 goto error_no_msg;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002448
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002449 if (!peer->tpk_success) {
2450 /*
2451 * Enable Link only when tpk_success is 0, signifying that this
2452 * processing of TPK M2 frame is not because of a retransmission
2453 * during TDLS setup handshake.
2454 */
2455 ret = wpa_tdls_enable_link(sm, peer);
2456 if (ret < 0) {
2457 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2458 wpa_tdls_do_teardown(
2459 sm, peer,
2460 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2461 }
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002462 }
2463 return ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002464
2465error:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002466 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 1,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002467 status);
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002468error_no_msg:
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002469 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002470 return -1;
2471}
2472
2473
2474static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
2475 const u8 *buf, size_t len)
2476{
2477 struct wpa_tdls_peer *peer;
2478 struct wpa_eapol_ie_parse kde;
2479 struct wpa_tdls_ftie *ftie;
2480 struct wpa_tdls_timeoutie *timeoutie;
2481 struct wpa_tdls_lnkid *lnkid;
2482 int ielen;
2483 u16 status;
2484 const u8 *pos;
2485 u32 lifetime;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002486 int ret = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002487
2488 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
2489 "(Peer " MACSTR ")", MAC2STR(src_addr));
2490 for (peer = sm->tdls; peer; peer = peer->next) {
2491 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
2492 break;
2493 }
2494 if (peer == NULL) {
2495 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2496 "TPK M3: " MACSTR, MAC2STR(src_addr));
2497 return -1;
2498 }
2499 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
2500
2501 if (len < 3 + 3)
Sunil Duttadce9cf2013-09-15 11:51:00 -07002502 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002503 pos = buf;
2504 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2505
2506 status = WPA_GET_LE16(pos);
2507
2508 if (status != 0) {
2509 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
2510 status);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002511 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002512 }
2513 pos += 2 /* status code */ + 1 /* dialog token */;
2514
2515 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002516
2517 /*
2518 * Don't reject the message if failing to parse IEs. The IEs we need are
2519 * explicitly checked below. Some APs piggy-back broken IEs to the end
2520 * of a TDLS Confirm packet, which will fail the link if we don't ignore
2521 * this error.
2522 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002523 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002524 wpa_printf(MSG_DEBUG,
2525 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002526 }
2527
2528 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2529 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002530 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002531 }
2532 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
2533 (u8 *) kde.lnkid, kde.lnkid_len);
2534 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2535
2536 if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
2537 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002538 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002539 }
2540
2541 if (!wpa_tdls_get_privacy(sm))
2542 goto skip_rsn;
2543
2544 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
2545 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002546 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002547 }
2548 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
2549 kde.ftie, sizeof(*ftie));
2550 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2551
2552 if (kde.rsn_ie == NULL) {
2553 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002554 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002555 }
2556 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
2557 kde.rsn_ie, kde.rsn_ie_len);
2558 if (kde.rsn_ie_len != peer->rsnie_p_len ||
2559 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
2560 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
2561 "with the one sent in TPK M2");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002562 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002563 }
2564
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002565 if (os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002566 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
2567 "not match with FTIE ANonce used in TPK M2");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002568 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002569 }
2570
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002571 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002572 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
2573 "match with FTIE SNonce used in TPK M1");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002574 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002575 }
2576
2577 if (kde.key_lifetime == NULL) {
2578 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002579 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002580 }
2581 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2582 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
2583 (u8 *) timeoutie, sizeof(*timeoutie));
2584 lifetime = WPA_GET_LE32(timeoutie->value);
2585 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
2586 lifetime);
2587 if (lifetime != peer->lifetime) {
2588 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2589 "TPK M3 (expected %u)", lifetime, peer->lifetime);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002590 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002591 }
2592
2593 if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,
2594 (u8 *) timeoutie, ftie) < 0) {
2595 wpa_tdls_del_key(sm, peer);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002596 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002597 }
2598
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002599 if (wpa_tdls_set_key(sm, peer) < 0) {
2600 /*
2601 * Some drivers may not be able to config the key prior to full
2602 * STA entry having been configured.
2603 */
2604 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2605 "STA entry is complete");
2606 peer->reconfig_key = 1;
2607 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002608
2609skip_rsn:
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002610 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2611 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2612 goto error;
2613
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002614 if (!peer->tpk_success) {
2615 /*
2616 * Enable Link only when tpk_success is 0, signifying that this
2617 * processing of TPK M3 frame is not because of a retransmission
2618 * during TDLS setup handshake.
2619 */
2620 ret = wpa_tdls_enable_link(sm, peer);
2621 if (ret < 0) {
2622 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002623 goto error;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002624 }
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002625 }
2626 return ret;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002627error:
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002628 wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002629 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002630}
2631
2632
2633static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
2634{
2635 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
2636
2637 os_memset(lifetime, 0, ie_len);
2638 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2639 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2640 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2641 WPA_PUT_LE32(lifetime->value, tsecs);
2642 os_memcpy(pos, ie, ie_len);
2643 return pos + ie_len;
2644}
2645
2646
2647/**
2648 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2649 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2650 * @peer: MAC address of the peer STA
2651 * Returns: 0 on success, or -1 on failure
2652 *
2653 * Send TPK Handshake Message 1 info to driver to start TDLS
2654 * handshake with the peer.
2655 */
2656int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2657{
2658 struct wpa_tdls_peer *peer;
2659 int tdls_prohibited = sm->tdls_prohibited;
Hai Shalom60840252021-02-19 19:02:11 -08002660 int res;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002661
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002662 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002663 return -1;
2664
2665#ifdef CONFIG_TDLS_TESTING
2666 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2667 tdls_prohibited) {
2668 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2669 "on TDLS");
2670 tdls_prohibited = 0;
2671 }
2672#endif /* CONFIG_TDLS_TESTING */
2673
2674 if (tdls_prohibited) {
2675 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2676 "reject request to start setup");
2677 return -1;
2678 }
2679
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002680 peer = wpa_tdls_add_peer(sm, addr, NULL);
2681 if (peer == NULL)
2682 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002683
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002684 if (peer->tpk_in_progress) {
2685 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer");
2686 return 0;
2687 }
2688
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002689 peer->initiator = 1;
2690
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002691 /* add the peer to the driver as a "setup in progress" peer */
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002692 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002693 NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0)) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002694 wpa_tdls_disable_peer_link(sm, peer);
2695 return -1;
2696 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002697
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002698 peer->tpk_in_progress = 1;
2699
Hai Shalom60840252021-02-19 19:02:11 -08002700 res = wpa_tdls_send_tpk_m1(sm, peer);
2701 if (res < 0) {
2702 if (res != -2)
2703 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002704 return -1;
2705 }
2706
2707 return 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002708}
2709
2710
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002711void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002712{
2713 struct wpa_tdls_peer *peer;
2714
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002715 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002716 return;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002717
2718 for (peer = sm->tdls; peer; peer = peer->next) {
2719 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2720 break;
2721 }
2722
2723 if (peer == NULL || !peer->tpk_success)
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002724 return;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002725
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002726 if (sm->tdls_external_setup) {
2727 /*
2728 * Disable previous link to allow renegotiation to be completed
2729 * on AP path.
2730 */
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07002731 wpa_tdls_do_teardown(sm, peer,
2732 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002733 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002734}
2735
2736
2737/**
2738 * wpa_supplicant_rx_tdls - Receive TDLS data frame
2739 *
2740 * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2741 */
2742static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2743 const u8 *buf, size_t len)
2744{
2745 struct wpa_sm *sm = ctx;
2746 struct wpa_tdls_frame *tf;
2747
2748 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2749 buf, len);
2750
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002751 if (sm->tdls_disabled || !sm->tdls_supported) {
2752 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2753 "or unsupported by driver");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002754 return;
2755 }
2756
2757 if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) {
2758 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2759 return;
2760 }
2761
2762 if (len < sizeof(*tf)) {
2763 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2764 return;
2765 }
2766
2767 /* Check to make sure its a valid encapsulated TDLS frame */
2768 tf = (struct wpa_tdls_frame *) buf;
2769 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2770 tf->category != WLAN_ACTION_TDLS) {
2771 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2772 "category=%u action=%u",
2773 tf->payloadtype, tf->category, tf->action);
2774 return;
2775 }
2776
2777 switch (tf->action) {
2778 case WLAN_TDLS_SETUP_REQUEST:
2779 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2780 break;
2781 case WLAN_TDLS_SETUP_RESPONSE:
2782 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2783 break;
2784 case WLAN_TDLS_SETUP_CONFIRM:
2785 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2786 break;
2787 case WLAN_TDLS_TEARDOWN:
2788 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2789 break;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002790 case WLAN_TDLS_DISCOVERY_REQUEST:
2791 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2792 break;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002793 default:
2794 /* Kernel code will process remaining frames */
2795 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2796 tf->action);
2797 break;
2798 }
2799}
2800
2801
2802/**
2803 * wpa_tdls_init - Initialize driver interface parameters for TDLS
2804 * @wpa_s: Pointer to wpa_supplicant data
2805 * Returns: 0 on success, -1 on failure
2806 *
2807 * This function is called to initialize driver interface parameters for TDLS.
2808 * wpa_drv_init() must have been called before this function to initialize the
2809 * driver interface.
2810 */
2811int wpa_tdls_init(struct wpa_sm *sm)
2812{
2813 if (sm == NULL)
2814 return -1;
2815
Hai Shalom899fcc72020-10-19 14:38:18 -07002816 if (sm->l2_tdls) {
2817 l2_packet_deinit(sm->l2_tdls);
2818 sm->l2_tdls = NULL;
2819 }
2820
Dmitry Shmidt04949592012-07-19 12:16:46 -07002821 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname :
2822 sm->ifname,
2823 sm->own_addr,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002824 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
2825 sm, 0);
2826 if (sm->l2_tdls == NULL) {
2827 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
2828 "connection");
2829 return -1;
2830 }
2831
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002832 /*
2833 * Drivers that support TDLS but don't implement the get_capa callback
2834 * are assumed to perform everything internally
2835 */
2836 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002837 &sm->tdls_external_setup,
2838 &sm->tdls_chan_switch) < 0) {
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002839 sm->tdls_supported = 1;
2840 sm->tdls_external_setup = 0;
2841 }
2842
2843 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
2844 "driver", sm->tdls_supported ? "" : " not");
2845 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
2846 sm->tdls_external_setup ? "external" : "internal");
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002847 wpa_printf(MSG_DEBUG, "TDLS: Driver %s TDLS channel switching",
2848 sm->tdls_chan_switch ? "supports" : "does not support");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002849
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002850 return 0;
2851}
2852
2853
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002854void wpa_tdls_teardown_peers(struct wpa_sm *sm)
2855{
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002856 struct wpa_tdls_peer *peer, *tmp;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002857
Dmitry Shmidtff787d52015-01-12 13:01:47 -08002858 if (!sm)
2859 return;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002860 peer = sm->tdls;
2861
2862 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers");
2863
2864 while (peer) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002865 tmp = peer->next;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002866 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR,
2867 MAC2STR(peer->addr));
2868 if (sm->tdls_external_setup)
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07002869 wpa_tdls_do_teardown(sm, peer,
2870 WLAN_REASON_DEAUTH_LEAVING);
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002871 else
2872 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
2873
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002874 peer = tmp;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002875 }
2876}
2877
2878
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002879static void wpa_tdls_remove_peers(struct wpa_sm *sm)
2880{
2881 struct wpa_tdls_peer *peer, *tmp;
2882
2883 peer = sm->tdls;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002884
2885 while (peer) {
2886 int res;
2887 tmp = peer->next;
2888 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2889 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
2890 MAC2STR(peer->addr), res);
2891 wpa_tdls_peer_free(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002892 peer = tmp;
2893 }
2894}
2895
2896
2897/**
2898 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
2899 *
2900 * This function is called to recover driver interface parameters for TDLS
2901 * and frees resources allocated for it.
2902 */
2903void wpa_tdls_deinit(struct wpa_sm *sm)
2904{
2905 if (sm == NULL)
2906 return;
2907
2908 if (sm->l2_tdls)
2909 l2_packet_deinit(sm->l2_tdls);
2910 sm->l2_tdls = NULL;
2911
2912 wpa_tdls_remove_peers(sm);
2913}
2914
2915
2916void wpa_tdls_assoc(struct wpa_sm *sm)
2917{
2918 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
2919 wpa_tdls_remove_peers(sm);
2920}
2921
2922
2923void wpa_tdls_disassoc(struct wpa_sm *sm)
2924{
2925 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
2926 wpa_tdls_remove_peers(sm);
2927}
2928
2929
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002930static int wpa_tdls_prohibited(struct ieee802_11_elems *elems)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002931{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002932 /* bit 38 - TDLS Prohibited */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002933 return !!(elems->ext_capab[4] & 0x40);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002934}
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002935
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002936
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002937static int wpa_tdls_chan_switch_prohibited(struct ieee802_11_elems *elems)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002938{
2939 /* bit 39 - TDLS Channel Switch Prohibited */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002940 return !!(elems->ext_capab[4] & 0x80);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002941}
2942
2943
2944void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2945{
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002946 struct ieee802_11_elems elems;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002947
2948 sm->tdls_prohibited = 0;
2949 sm->tdls_chan_switch_prohibited = 0;
2950
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002951 if (ies == NULL ||
2952 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002953 elems.ext_capab == NULL || elems.ext_capab_len < 5)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002954 return;
2955
2956 sm->tdls_prohibited = wpa_tdls_prohibited(&elems);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002957 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
2958 sm->tdls_prohibited ? "prohibited" : "allowed");
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002959 sm->tdls_chan_switch_prohibited =
2960 wpa_tdls_chan_switch_prohibited(&elems);
2961 wpa_printf(MSG_DEBUG, "TDLS: TDLS channel switch %s in the target BSS",
2962 sm->tdls_chan_switch_prohibited ? "prohibited" : "allowed");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002963}
2964
2965
2966void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2967{
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002968 struct ieee802_11_elems elems;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002969
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002970 if (ies == NULL ||
2971 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08002972 elems.ext_capab == NULL || elems.ext_capab_len < 5)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002973 return;
2974
2975 if (!sm->tdls_prohibited && wpa_tdls_prohibited(&elems)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002976 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
2977 "(Re)Association Response IEs");
2978 sm->tdls_prohibited = 1;
2979 }
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08002980
2981 if (!sm->tdls_chan_switch_prohibited &&
2982 wpa_tdls_chan_switch_prohibited(&elems)) {
2983 wpa_printf(MSG_DEBUG,
2984 "TDLS: TDLS channel switch prohibited based on (Re)Association Response IEs");
2985 sm->tdls_chan_switch_prohibited = 1;
2986 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002987}
2988
2989
2990void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
2991{
2992 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
2993 sm->tdls_disabled = !enabled;
2994}
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002995
2996
2997int wpa_tdls_is_external_setup(struct wpa_sm *sm)
2998{
2999 return sm->tdls_external_setup;
3000}
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003001
3002
3003int wpa_tdls_enable_chan_switch(struct wpa_sm *sm, const u8 *addr,
3004 u8 oper_class,
3005 struct hostapd_freq_params *freq_params)
3006{
3007 struct wpa_tdls_peer *peer;
3008 int ret;
3009
3010 if (sm->tdls_disabled || !sm->tdls_supported)
3011 return -1;
3012
3013 if (!sm->tdls_chan_switch) {
3014 wpa_printf(MSG_DEBUG,
3015 "TDLS: Channel switching not supported by the driver");
3016 return -1;
3017 }
3018
3019 if (sm->tdls_chan_switch_prohibited) {
3020 wpa_printf(MSG_DEBUG,
3021 "TDLS: Channel switching is prohibited in this BSS - reject request to switch channel");
3022 return -1;
3023 }
3024
3025 for (peer = sm->tdls; peer; peer = peer->next) {
3026 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
3027 break;
3028 }
3029
3030 if (peer == NULL || !peer->tpk_success) {
3031 wpa_printf(MSG_ERROR, "TDLS: Peer " MACSTR
3032 " not found for channel switching", MAC2STR(addr));
3033 return -1;
3034 }
3035
3036 if (peer->chan_switch_enabled) {
3037 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
3038 " already has channel switching enabled",
3039 MAC2STR(addr));
3040 return 0;
3041 }
3042
3043 ret = wpa_sm_tdls_enable_channel_switch(sm, peer->addr,
3044 oper_class, freq_params);
3045 if (!ret)
3046 peer->chan_switch_enabled = 1;
3047
3048 return ret;
3049}
3050
3051
3052int wpa_tdls_disable_chan_switch(struct wpa_sm *sm, const u8 *addr)
3053{
3054 struct wpa_tdls_peer *peer;
3055
3056 if (sm->tdls_disabled || !sm->tdls_supported)
3057 return -1;
3058
3059 for (peer = sm->tdls; peer; peer = peer->next) {
3060 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
3061 break;
3062 }
3063
3064 if (!peer || !peer->chan_switch_enabled) {
3065 wpa_printf(MSG_ERROR, "TDLS: Channel switching not enabled for "
3066 MACSTR, MAC2STR(addr));
3067 return -1;
3068 }
3069
3070 /* ignore the return value */
3071 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
3072
3073 peer->chan_switch_enabled = 0;
3074 return 0;
3075}