blob: 65960b7bcdf2dde50ebdff3e9729a8cca2b8815a [file] [log] [blame]
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001/*
2 * wpa_supplicant - TDLS
3 * Copyright (c) 2010-2011, Atheros Communications
4 *
Dmitry Shmidtc5ec7f52012-03-06 16:33:24 -08005 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07007 */
8
9#include "utils/includes.h"
10
11#include "utils/common.h"
12#include "utils/eloop.h"
13#include "utils/os.h"
14#include "common/ieee802_11_defs.h"
Dmitry Shmidtd80a4012015-11-05 16:35:40 -080015#include "common/ieee802_11_common.h"
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070016#include "crypto/sha256.h"
17#include "crypto/crypto.h"
18#include "crypto/aes_wrap.h"
19#include "rsn_supp/wpa.h"
20#include "rsn_supp/wpa_ie.h"
21#include "rsn_supp/wpa_i.h"
22#include "drivers/driver.h"
23#include "l2_packet/l2_packet.h"
24
25#ifdef CONFIG_TDLS_TESTING
26#define TDLS_TESTING_LONG_FRAME BIT(0)
27#define TDLS_TESTING_ALT_RSN_IE BIT(1)
28#define TDLS_TESTING_DIFF_BSSID BIT(2)
29#define TDLS_TESTING_SHORT_LIFETIME BIT(3)
30#define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
31#define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
32#define TDLS_TESTING_LONG_LIFETIME BIT(6)
33#define TDLS_TESTING_CONCURRENT_INIT BIT(7)
34#define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
35#define TDLS_TESTING_DECLINE_RESP BIT(9)
36#define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
Dmitry Shmidt21de2142014-04-08 10:50:52 -070037#define TDLS_TESTING_WRONG_MIC BIT(11)
Roshan Pius3a1667e2018-07-03 15:17:14 -070038#define TDLS_TESTING_DOUBLE_TPK_M2 BIT(12)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070039unsigned int tdls_testing = 0;
40#endif /* CONFIG_TDLS_TESTING */
41
42#define TPK_LIFETIME 43200 /* 12 hours */
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -070043#define TPK_M1_RETRY_COUNT 3
44#define TPK_M1_TIMEOUT 5000 /* in milliseconds */
45#define TPK_M2_RETRY_COUNT 10
46#define TPK_M2_TIMEOUT 500 /* in milliseconds */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070047
48#define TDLS_MIC_LEN 16
49
50#define TDLS_TIMEOUT_LEN 4
51
52struct wpa_tdls_ftie {
53 u8 ie_type; /* FTIE */
54 u8 ie_len;
55 u8 mic_ctrl[2];
56 u8 mic[TDLS_MIC_LEN];
57 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
58 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
59 /* followed by optional elements */
60} STRUCT_PACKED;
61
62struct wpa_tdls_timeoutie {
63 u8 ie_type; /* Timeout IE */
64 u8 ie_len;
65 u8 interval_type;
66 u8 value[TDLS_TIMEOUT_LEN];
67} STRUCT_PACKED;
68
69struct wpa_tdls_lnkid {
70 u8 ie_type; /* Link Identifier IE */
71 u8 ie_len;
72 u8 bssid[ETH_ALEN];
73 u8 init_sta[ETH_ALEN];
74 u8 resp_sta[ETH_ALEN];
75} STRUCT_PACKED;
76
77/* TDLS frame headers as per IEEE Std 802.11z-2010 */
78struct wpa_tdls_frame {
79 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
80 u8 category; /* Category */
81 u8 action; /* Action (enum tdls_frame_type) */
82} STRUCT_PACKED;
83
84static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
85static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
86static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
Sunil Duttd0ef38b2013-09-30 17:34:13 +030087static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
88 struct wpa_tdls_peer *peer);
Dmitry Shmidtb58836e2014-04-29 14:35:56 -070089static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
90 u16 reason_code);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070091
92
93#define TDLS_MAX_IE_LEN 80
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -080094#define IEEE80211_MAX_SUPP_RATES 32
95
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070096struct wpa_tdls_peer {
97 struct wpa_tdls_peer *next;
Dmitry Shmidt8da800a2013-04-24 12:57:01 -070098 unsigned int reconfig_key:1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -070099 int initiator; /* whether this end was initiator for TDLS setup */
100 u8 addr[ETH_ALEN]; /* other end MAC address */
101 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
102 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
103 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
104 size_t rsnie_i_len;
105 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
106 size_t rsnie_p_len;
107 u32 lifetime;
108 int cipher; /* Selected cipher (WPA_CIPHER_*) */
109 u8 dtoken;
110
111 struct tpk {
112 u8 kck[16]; /* TPK-KCK */
113 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
114 } tpk;
115 int tpk_set;
Jouni Malinenc580b552017-09-22 11:03:15 +0300116 int tk_set; /* TPK-TK configured to the driver */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700117 int tpk_success;
Sunil Dutt73b28cc2013-09-30 17:38:41 +0300118 int tpk_in_progress;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700119
120 struct tpk_timer {
121 u8 dest[ETH_ALEN];
122 int count; /* Retry Count */
123 int timer; /* Timeout in milliseconds */
124 u8 action_code; /* TDLS frame type */
125 u8 dialog_token;
126 u16 status_code;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700127 u32 peer_capab;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700128 int buf_len; /* length of TPK message for retransmission */
129 u8 *buf; /* buffer for TPK message */
130 } sm_tmr;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800131
132 u16 capability;
133
134 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
135 size_t supp_rates_len;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800136
137 struct ieee80211_ht_capabilities *ht_capabilities;
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800138 struct ieee80211_vht_capabilities *vht_capabilities;
Hai Shaloma20dcd72022-02-04 13:43:00 -0800139 struct ieee80211_he_capabilities *he_capabilities;
140 size_t he_capab_len;
141 struct ieee80211_he_6ghz_band_cap *he_6ghz_band_capabilities;
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000142 struct ieee80211_eht_capabilities *eht_capabilities;
143 size_t eht_capab_len;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800144
145 u8 qos_info;
146
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700147 u16 aid;
148
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800149 u8 *ext_capab;
150 size_t ext_capab_len;
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800151
152 u8 *supp_channels;
153 size_t supp_channels_len;
154
155 u8 *supp_oper_classes;
156 size_t supp_oper_classes_len;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700157
158 u8 wmm_capable;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800159
160 /* channel switch currently enabled */
161 int chan_switch_enabled;
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000162
163 int mld_link_id;
Sunil Ravi99c035e2024-07-12 01:42:03 +0000164 bool disc_resp_rcvd;
165 bool setup_req_rcvd;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700166};
167
168
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000169static const u8 * wpa_tdls_get_link_bssid(struct wpa_sm *sm, int link_id)
170{
171 if (link_id >= 0)
172 return sm->mlo.links[link_id].bssid;
173 return sm->bssid;
174}
175
176
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700177static int wpa_tdls_get_privacy(struct wpa_sm *sm)
178{
179 /*
180 * Get info needed from supplicant to check if the current BSS supports
181 * security. Other than OPEN mode, rest are considered secured
182 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
183 */
184 return sm->pairwise_cipher != WPA_CIPHER_NONE;
185}
186
187
188static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
189{
190 os_memcpy(pos, ie, ie_len);
191 return pos + ie_len;
192}
193
194
195static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
196{
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000197 if (wpa_sm_set_key(sm, -1, WPA_ALG_NONE, peer->addr,
Hai Shalomfdcde762020-04-02 11:19:20 -0700198 0, 0, NULL, 0, NULL, 0, KEY_FLAG_PAIRWISE) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700199 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
200 "the driver");
201 return -1;
202 }
203
204 return 0;
205}
206
207
208static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
209{
210 u8 key_len;
211 u8 rsc[6];
212 enum wpa_alg alg;
213
Jouni Malinenc580b552017-09-22 11:03:15 +0300214 if (peer->tk_set) {
215 /*
216 * This same TPK-TK has already been configured to the driver
217 * and this new configuration attempt (likely due to an
218 * unexpected retransmitted frame) would result in clearing
219 * the TX/RX sequence number which can break security, so must
220 * not allow that to happen.
221 */
222 wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
223 " has already been configured to the driver - do not reconfigure",
224 MAC2STR(peer->addr));
225 return -1;
226 }
227
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700228 os_memset(rsc, 0, 6);
229
230 switch (peer->cipher) {
231 case WPA_CIPHER_CCMP:
232 alg = WPA_ALG_CCMP;
233 key_len = 16;
234 break;
235 case WPA_CIPHER_NONE:
236 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
237 "NONE - do not use pairwise keys");
238 return -1;
239 default:
240 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
241 sm->pairwise_cipher);
242 return -1;
243 }
244
Jouni Malinenc580b552017-09-22 11:03:15 +0300245 wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
246 MAC2STR(peer->addr));
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000247 if (wpa_sm_set_key(sm, -1, alg, peer->addr, 0, 1, rsc, sizeof(rsc),
Hai Shalomfdcde762020-04-02 11:19:20 -0700248 peer->tpk.tk, key_len,
249 KEY_FLAG_PAIRWISE_RX_TX) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700250 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
251 "driver");
252 return -1;
253 }
Jouni Malinenc580b552017-09-22 11:03:15 +0300254 peer->tk_set = 1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700255 return 0;
256}
257
258
259static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
260 u8 action_code, u8 dialog_token,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700261 u16 status_code, u32 peer_capab,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000262 int initiator, const u8 *buf, size_t len,
263 int link_id)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700264{
265 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700266 status_code, peer_capab, initiator, buf,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000267 len, link_id);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700268}
269
270
271static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700272 u8 dialog_token, u16 status_code, u32 peer_capab,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000273 int initiator, const u8 *msg, size_t msg_len,
274 int link_id)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700275{
276 struct wpa_tdls_peer *peer;
277
278 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700279 "dialog_token=%u status_code=%u peer_capab=%u initiator=%d "
280 "msg_len=%u",
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700281 MAC2STR(dest), action_code, dialog_token, status_code,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700282 peer_capab, initiator, (unsigned int) msg_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700283
284 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700285 status_code, peer_capab, initiator, msg,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000286 msg_len, link_id)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700287 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
288 "(action_code=%u)", action_code);
289 return -1;
290 }
291
292 if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800293 action_code == WLAN_TDLS_TEARDOWN ||
294 action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
295 action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700296 return 0; /* No retries */
297
298 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000299 if (ether_addr_equal(peer->addr, dest))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700300 break;
301 }
302
303 if (peer == NULL) {
304 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
305 "retry " MACSTR, MAC2STR(dest));
306 return 0;
307 }
308
309 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
310
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700311 if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
312 peer->sm_tmr.count = TPK_M2_RETRY_COUNT;
313 peer->sm_tmr.timer = TPK_M2_TIMEOUT;
314 } else {
315 peer->sm_tmr.count = TPK_M1_RETRY_COUNT;
316 peer->sm_tmr.timer = TPK_M1_TIMEOUT;
317 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700318
319 /* Copy message to resend on timeout */
320 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
321 peer->sm_tmr.action_code = action_code;
322 peer->sm_tmr.dialog_token = dialog_token;
323 peer->sm_tmr.status_code = status_code;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700324 peer->sm_tmr.peer_capab = peer_capab;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700325 peer->sm_tmr.buf_len = msg_len;
326 os_free(peer->sm_tmr.buf);
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700327 peer->sm_tmr.buf = os_memdup(msg, msg_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700328 if (peer->sm_tmr.buf == NULL)
329 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700330
331 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
332 "(action_code=%u)", action_code);
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700333 eloop_register_timeout(peer->sm_tmr.timer / 1000,
334 (peer->sm_tmr.timer % 1000) * 1000,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700335 wpa_tdls_tpk_retry_timeout, sm, peer);
336 return 0;
337}
338
339
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800340static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300341 u16 reason_code)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800342{
343 int ret;
344
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300345 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
346 /* disable the link after teardown was sent */
Sunil Duttd0ef38b2013-09-30 17:34:13 +0300347 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800348
349 return ret;
350}
351
352
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700353static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
354{
355
356 struct wpa_sm *sm = eloop_ctx;
357 struct wpa_tdls_peer *peer = timeout_ctx;
358
359 if (peer->sm_tmr.count) {
360 peer->sm_tmr.count--;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700361
362 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
363 "(action_code=%u)",
364 peer->sm_tmr.action_code);
365
366 if (peer->sm_tmr.buf == NULL) {
367 wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
368 "for action_code=%u",
369 peer->sm_tmr.action_code);
370 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
371 peer);
372 return;
373 }
374
375 /* resend TPK Handshake Message to Peer */
376 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
377 peer->sm_tmr.action_code,
378 peer->sm_tmr.dialog_token,
379 peer->sm_tmr.status_code,
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700380 peer->sm_tmr.peer_capab,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -0700381 peer->initiator,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700382 peer->sm_tmr.buf,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000383 peer->sm_tmr.buf_len, -1)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700384 wpa_printf(MSG_INFO, "TDLS: Failed to retry "
385 "transmission");
386 }
387
388 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
Dmitry Shmidtf7e0a992013-05-23 11:03:10 -0700389 eloop_register_timeout(peer->sm_tmr.timer / 1000,
390 (peer->sm_tmr.timer % 1000) * 1000,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700391 wpa_tdls_tpk_retry_timeout, sm, peer);
392 } else {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700393 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
394
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800395 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
396 wpa_tdls_do_teardown(sm, peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300397 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700398 }
399}
400
401
402static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
403 struct wpa_tdls_peer *peer,
404 u8 action_code)
405{
406 if (action_code == peer->sm_tmr.action_code) {
407 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
408 "action_code=%u", action_code);
409
410 /* Cancel Timeout registered */
411 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
412
413 /* free all resources meant for retry */
414 os_free(peer->sm_tmr.buf);
415 peer->sm_tmr.buf = NULL;
416
417 peer->sm_tmr.count = 0;
418 peer->sm_tmr.timer = 0;
419 peer->sm_tmr.buf_len = 0;
420 peer->sm_tmr.action_code = 0xff;
421 } else {
422 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
423 "(Unknown action_code=%u)", action_code);
424 }
425}
426
427
428static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
429 const u8 *own_addr, const u8 *bssid)
430{
431 u8 key_input[SHA256_MAC_LEN];
432 const u8 *nonce[2];
433 size_t len[2];
434 u8 data[3 * ETH_ALEN];
435
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700436 /* IEEE Std 802.11-2016 12.7.9.2:
437 * TPK-Key-Input = Hash(min(SNonce, ANonce) || max(SNonce, ANonce))
438 * Hash = SHA-256 for TDLS
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700439 */
440 len[0] = WPA_NONCE_LEN;
441 len[1] = WPA_NONCE_LEN;
442 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
443 nonce[0] = peer->inonce;
444 nonce[1] = peer->rnonce;
445 } else {
446 nonce[0] = peer->rnonce;
447 nonce[1] = peer->inonce;
448 }
449 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
450 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
451 sha256_vector(2, nonce, len, key_input);
452 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
453 key_input, SHA256_MAC_LEN);
454
455 /*
Dmitry Shmidtd2986c22017-10-23 14:22:09 -0700456 * TPK = KDF-Hash-Length(TPK-Key-Input, "TDLS PMK",
457 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700458 */
459
460 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
461 os_memcpy(data, own_addr, ETH_ALEN);
462 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
463 } else {
464 os_memcpy(data, peer->addr, ETH_ALEN);
465 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
466 }
467 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
468 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
469
470 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
471 (u8 *) &peer->tpk, sizeof(peer->tpk));
472 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
473 peer->tpk.kck, sizeof(peer->tpk.kck));
474 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
475 peer->tpk.tk, sizeof(peer->tpk.tk));
476 peer->tpk_set = 1;
477}
478
479
480/**
481 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
482 * @kck: TPK-KCK
483 * @lnkid: Pointer to the beginning of Link Identifier IE
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000484 * @rsne: Pointer to the beginning of RSNE used for handshake
485 * @rsne_len: Length of RSNE in octets
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700486 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000487 * @fte: Pointer to the beginning of FTE
488 * @fre_len: Length of FTE in octets
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700489 * @mic: Pointer for writing MIC
490 *
491 * Calculate MIC for TDLS frame.
492 */
493static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000494 const u8 *rsne, size_t rsne_len,
495 const u8 *timeoutie,
496 const u8 *fte, size_t fte_len, u8 *mic)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700497{
498 u8 *buf, *pos;
499 struct wpa_tdls_ftie *_ftie;
500 const struct wpa_tdls_lnkid *_lnkid;
501 int ret;
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000502 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + rsne_len +
503 2 + timeoutie[1] + fte_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700504 buf = os_zalloc(len);
505 if (!buf) {
506 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
507 return -1;
508 }
509
510 pos = buf;
511 _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
512 /* 1) TDLS initiator STA MAC address */
513 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
514 pos += ETH_ALEN;
515 /* 2) TDLS responder STA MAC address */
516 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
517 pos += ETH_ALEN;
518 /* 3) Transaction Sequence number */
519 *pos++ = trans_seq;
520 /* 4) Link Identifier IE */
521 os_memcpy(pos, lnkid, 2 + lnkid[1]);
522 pos += 2 + lnkid[1];
523 /* 5) RSN IE */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000524 os_memcpy(pos, rsne, rsne_len);
525 pos += rsne_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700526 /* 6) Timeout Interval IE */
527 os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
528 pos += 2 + timeoutie[1];
529 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000530 os_memcpy(pos, fte, fte_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700531 _ftie = (struct wpa_tdls_ftie *) pos;
532 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000533 pos += fte_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700534
535 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
536 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
537 ret = omac1_aes_128(kck, buf, pos - buf, mic);
538 os_free(buf);
539 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
540 return ret;
541}
542
543
544/**
545 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
546 * @kck: TPK-KCK
547 * @trans_seq: Transaction Sequence Number (4 - Teardown)
548 * @rcode: Reason code for Teardown
549 * @dtoken: Dialog Token used for that particular link
550 * @lnkid: Pointer to the beginning of Link Identifier IE
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000551 * @fte: Pointer to the beginning of FTE
552 * @fre_len: Length of FTE in octets
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700553 * @mic: Pointer for writing MIC
554 *
555 * Calculate MIC for TDLS frame.
556 */
557static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
558 u8 dtoken, const u8 *lnkid,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000559 const u8 *fte, size_t fte_len, u8 *mic)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700560{
561 u8 *buf, *pos;
562 struct wpa_tdls_ftie *_ftie;
563 int ret;
564 int len;
565
566 if (lnkid == NULL)
567 return -1;
568
569 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000570 sizeof(trans_seq) + fte_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700571
572 buf = os_zalloc(len);
573 if (!buf) {
574 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
575 return -1;
576 }
577
578 pos = buf;
579 /* 1) Link Identifier IE */
580 os_memcpy(pos, lnkid, 2 + lnkid[1]);
581 pos += 2 + lnkid[1];
582 /* 2) Reason Code */
583 WPA_PUT_LE16(pos, rcode);
584 pos += sizeof(rcode);
585 /* 3) Dialog token */
586 *pos++ = dtoken;
587 /* 4) Transaction Sequence number */
588 *pos++ = trans_seq;
589 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000590 os_memcpy(pos, fte, fte_len);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700591 _ftie = (struct wpa_tdls_ftie *) pos;
592 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000593 pos += fte_len;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700594
595 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
596 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
597 ret = omac1_aes_128(kck, buf, pos - buf, mic);
598 os_free(buf);
599 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
600 return ret;
601}
602
603
604static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
605 struct wpa_tdls_peer *peer,
606 const u8 *lnkid, const u8 *timeoutie,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000607 const struct wpa_tdls_ftie *ftie,
608 size_t fte_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700609{
610 u8 mic[16];
611
612 if (peer->tpk_set) {
613 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000614 peer->rsnie_p, peer->rsnie_p_len, timeoutie,
615 (const u8 *) ftie, fte_len, mic);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700616 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700617 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
618 "dropping packet");
619 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
620 ftie->mic, 16);
621 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
622 mic, 16);
623 return -1;
624 }
625 } else {
626 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
627 "TPK not set - dropping packet");
628 return -1;
629 }
630 return 0;
631}
632
633
634static int wpa_supplicant_verify_tdls_mic_teardown(
635 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000636 const u8 *lnkid, const struct wpa_tdls_ftie *ftie, size_t fte_len)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700637{
638 u8 mic[16];
639
640 if (peer->tpk_set) {
641 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000642 dtoken, lnkid, (const u8 *) ftie,
643 fte_len, mic);
Dmitry Shmidtc2817022014-07-02 10:32:10 -0700644 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700645 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
646 "dropping packet");
647 return -1;
648 }
649 } else {
650 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
651 "MIC, TPK not set - dropping packet");
652 return -1;
653 }
654 return 0;
655}
656
657
658static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
659{
660 struct wpa_sm *sm = eloop_ctx;
661 struct wpa_tdls_peer *peer = timeout_ctx;
662
663 /*
664 * On TPK lifetime expiration, we have an option of either tearing down
665 * the direct link or trying to re-initiate it. The selection of what
666 * to do is not strictly speaking controlled by our role in the expired
667 * link, but for now, use that to select whether to renew or tear down
668 * the link.
669 */
670
671 if (peer->initiator) {
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800672 u8 addr[ETH_ALEN];
673
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700674 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
675 " - try to renew", MAC2STR(peer->addr));
Dmitry Shmidtd80a4012015-11-05 16:35:40 -0800676 /* cache the peer address before do_teardown */
677 os_memcpy(addr, peer->addr, ETH_ALEN);
678 wpa_tdls_do_teardown(sm, peer,
679 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
680 wpa_tdls_start(sm, addr);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700681 } else {
682 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
683 " - tear down", MAC2STR(peer->addr));
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800684 wpa_tdls_do_teardown(sm, peer,
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300685 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700686 }
687}
688
689
Dmitry Shmidtd30ac602014-06-30 09:54:22 -0700690static void wpa_tdls_peer_remove_from_list(struct wpa_sm *sm,
691 struct wpa_tdls_peer *peer)
692{
693 struct wpa_tdls_peer *cur, *prev;
694
695 cur = sm->tdls;
696 prev = NULL;
697 while (cur && cur != peer) {
698 prev = cur;
699 cur = cur->next;
700 }
701
702 if (cur != peer) {
703 wpa_printf(MSG_ERROR, "TDLS: Could not find peer " MACSTR
704 " to remove it from the list",
705 MAC2STR(peer->addr));
706 return;
707 }
708
709 if (prev)
710 prev->next = peer->next;
711 else
712 sm->tdls = peer->next;
713}
714
715
716static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700717{
718 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
719 MAC2STR(peer->addr));
720 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
721 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
Dmitry Shmidt8da800a2013-04-24 12:57:01 -0700722 peer->reconfig_key = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700723 peer->initiator = 0;
Sunil Dutt73b28cc2013-09-30 17:38:41 +0300724 peer->tpk_in_progress = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700725 os_free(peer->sm_tmr.buf);
726 peer->sm_tmr.buf = NULL;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800727 os_free(peer->ht_capabilities);
728 peer->ht_capabilities = NULL;
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -0800729 os_free(peer->vht_capabilities);
730 peer->vht_capabilities = NULL;
Hai Shaloma20dcd72022-02-04 13:43:00 -0800731 os_free(peer->he_capabilities);
732 peer->he_capabilities = NULL;
733 os_free(peer->he_6ghz_band_capabilities);
734 peer->he_6ghz_band_capabilities = NULL;
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000735 os_free(peer->eht_capabilities);
736 peer->eht_capabilities = NULL;
Dmitry Shmidtf8623282013-02-20 14:34:59 -0800737 os_free(peer->ext_capab);
738 peer->ext_capab = NULL;
Dmitry Shmidt344abd32014-01-14 13:17:00 -0800739 os_free(peer->supp_channels);
740 peer->supp_channels = NULL;
741 os_free(peer->supp_oper_classes);
742 peer->supp_oper_classes = NULL;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700743 peer->rsnie_i_len = peer->rsnie_p_len = 0;
744 peer->cipher = 0;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -0700745 peer->qos_info = 0;
746 peer->wmm_capable = 0;
Jouni Malinenc580b552017-09-22 11:03:15 +0300747 peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800748 peer->chan_switch_enabled = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700749 os_memset(&peer->tpk, 0, sizeof(peer->tpk));
750 os_memset(peer->inonce, 0, WPA_NONCE_LEN);
751 os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000752 peer->mld_link_id = -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700753}
754
755
Dmitry Shmidtd30ac602014-06-30 09:54:22 -0700756static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
757{
758 wpa_tdls_peer_clear(sm, peer);
759 wpa_tdls_peer_remove_from_list(sm, peer);
760 os_free(peer);
761}
762
763
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700764static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
765 struct wpa_tdls_lnkid *lnkid)
766{
767 lnkid->ie_type = WLAN_EID_LINK_ID;
768 lnkid->ie_len = 3 * ETH_ALEN;
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000769 os_memcpy(lnkid->bssid, wpa_tdls_get_link_bssid(sm, peer->mld_link_id),
770 ETH_ALEN);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700771 if (peer->initiator) {
772 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
773 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
774 } else {
775 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
776 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
777 }
778}
779
780
Dmitry Shmidtb58836e2014-04-29 14:35:56 -0700781static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
782 u16 reason_code)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700783{
784 struct wpa_tdls_peer *peer;
785 struct wpa_tdls_ftie *ftie;
786 struct wpa_tdls_lnkid lnkid;
787 u8 dialog_token;
788 u8 *rbuf, *pos;
789 int ielen;
790
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800791 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700792 return -1;
793
794 /* Find the node and free from the list */
795 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000796 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700797 break;
798 }
799
800 if (peer == NULL) {
801 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
802 "Teardown " MACSTR, MAC2STR(addr));
803 return 0;
804 }
805
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800806 /* Cancel active channel switch before teardown */
807 if (peer->chan_switch_enabled) {
808 wpa_printf(MSG_DEBUG, "TDLS: First returning link with " MACSTR
809 " to base channel", MAC2STR(addr));
810 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
811 }
812
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700813 dialog_token = peer->dtoken;
814
815 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
816 MAC2STR(addr));
817
818 ielen = 0;
819 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
820 /* To add FTIE for Teardown request and compute MIC */
821 ielen += sizeof(*ftie);
822#ifdef CONFIG_TDLS_TESTING
823 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
824 ielen += 170;
825#endif /* CONFIG_TDLS_TESTING */
826 }
827
828 rbuf = os_zalloc(ielen + 1);
829 if (rbuf == NULL)
830 return -1;
831 pos = rbuf;
832
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -0700833 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700834 goto skip_ies;
835
836 ftie = (struct wpa_tdls_ftie *) pos;
837 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
838 /* Using the recent nonce which should be for CONFIRM frame */
839 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
840 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
841 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
842 pos = (u8 *) (ftie + 1);
843#ifdef CONFIG_TDLS_TESTING
844 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
845 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
846 "FTIE");
847 ftie->ie_len += 170;
848 *pos++ = 255; /* FTIE subelem */
849 *pos++ = 168; /* FTIE subelem length */
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800850 pos += 168;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700851 }
852#endif /* CONFIG_TDLS_TESTING */
853 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800854 (u8 *) ftie, pos - (u8 *) ftie);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700855
856 /* compute MIC before sending */
857 wpa_tdls_linkid(sm, peer, &lnkid);
858 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +0000859 dialog_token, (const u8 *) &lnkid,
860 (const u8 *) ftie, 2 + ftie->ie_len,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700861 ftie->mic);
862
863skip_ies:
864 /* TODO: register for a Timeout handler, if Teardown is not received at
865 * the other end, then try again another time */
866
867 /* request driver to send Teardown using this FTIE */
868 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
Sunil Ravi2a14cf12023-11-21 00:54:38 +0000869 reason_code, 0, peer->initiator, rbuf, pos - rbuf,
870 -1);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700871 os_free(rbuf);
872
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700873 return 0;
874}
875
876
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800877int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
878{
879 struct wpa_tdls_peer *peer;
880
881 if (sm->tdls_disabled || !sm->tdls_supported)
882 return -1;
883
884 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000885 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800886 break;
887 }
888
889 if (peer == NULL) {
890 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
891 " for link Teardown", MAC2STR(addr));
892 return -1;
893 }
894
895 if (!peer->tpk_success) {
896 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
897 " not connected - cannot Teardown link", MAC2STR(addr));
898 return -1;
899 }
900
Sunil Dutt6a9f5222013-09-30 17:10:18 +0300901 return wpa_tdls_do_teardown(sm, peer, reason_code);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800902}
903
904
Sunil Dutt38ffd882013-09-30 17:23:23 +0300905static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
906 struct wpa_tdls_peer *peer)
907{
908 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
909 wpa_tdls_peer_free(sm, peer);
910}
911
912
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700913void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800914{
915 struct wpa_tdls_peer *peer;
916
917 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000918 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800919 break;
920 }
921
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700922 if (!peer || !peer->tpk_success) {
923 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
924 " not connected - cannot teardown unreachable link",
925 MAC2STR(addr));
926 return;
927 }
928
929 if (wpa_tdls_is_external_setup(sm)) {
930 /*
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800931 * Get us on the base channel, disable the link, send a
932 * teardown packet through the AP, and then reset link data.
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700933 */
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -0800934 if (peer->chan_switch_enabled)
935 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700936 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
937 wpa_tdls_send_teardown(sm, addr,
938 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE);
939 wpa_tdls_peer_free(sm, peer);
940 } else {
Sunil Dutt38ffd882013-09-30 17:23:23 +0300941 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -0700942 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -0800943}
944
945
Dmitry Shmidte0e48dc2013-11-18 12:00:06 -0800946const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr)
947{
948 struct wpa_tdls_peer *peer;
949
950 if (sm->tdls_disabled || !sm->tdls_supported)
951 return "disabled";
952
953 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000954 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidte0e48dc2013-11-18 12:00:06 -0800955 break;
956 }
957
958 if (peer == NULL)
959 return "peer does not exist";
960
961 if (!peer->tpk_success)
962 return "peer not connected";
963
964 return "connected";
965}
966
967
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700968static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
969 const u8 *buf, size_t len)
970{
971 struct wpa_tdls_peer *peer = NULL;
972 struct wpa_tdls_ftie *ftie;
973 struct wpa_tdls_lnkid *lnkid;
974 struct wpa_eapol_ie_parse kde;
975 u16 reason_code;
976 const u8 *pos;
977 int ielen;
978
979 /* Find the node and free from the list */
980 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +0000981 if (ether_addr_equal(peer->addr, src_addr))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -0700982 break;
983 }
984
985 if (peer == NULL) {
986 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
987 "Teardown " MACSTR, MAC2STR(src_addr));
988 return 0;
989 }
990
991 pos = buf;
992 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
993
994 reason_code = WPA_GET_LE16(pos);
995 pos += 2;
996
997 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
998 " (reason code %u)", MAC2STR(src_addr), reason_code);
999
1000 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -08001001
1002 /*
1003 * Don't reject the message if failing to parse IEs. The IEs we need are
1004 * explicitly checked below. Some APs may add arbitrary padding to the
1005 * end of short TDLS frames and that would look like invalid IEs.
1006 */
1007 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0)
1008 wpa_printf(MSG_DEBUG,
1009 "TDLS: Failed to parse IEs in Teardown - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001010
1011 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1012 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
1013 "Teardown");
1014 return -1;
1015 }
1016 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1017
1018 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
1019 goto skip_ftie;
1020
1021 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
1022 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
1023 return -1;
1024 }
1025
1026 ftie = (struct wpa_tdls_ftie *) kde.ftie;
1027
1028 /* Process MIC check to see if TDLS Teardown is right */
1029 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
1030 peer->dtoken, peer,
Sunil Ravi38ad1ed2023-01-17 23:58:31 +00001031 (const u8 *) lnkid,
1032 ftie, kde.ftie_len) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001033 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
1034 "Teardown Request from " MACSTR, MAC2STR(src_addr));
1035 return -1;
1036 }
1037
1038skip_ftie:
1039 /*
1040 * Request the driver to disable the direct link and clear associated
1041 * keys.
1042 */
Sunil Dutt38ffd882013-09-30 17:23:23 +03001043 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001044 return 0;
1045}
1046
1047
1048/**
1049 * wpa_tdls_send_error - To send suitable TDLS status response with
1050 * appropriate status code mentioning reason for error/failure.
1051 * @dst - MAC addr of Peer station
1052 * @tdls_action - TDLS frame type for which error code is sent
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001053 * @initiator - was this end the initiator of the connection
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001054 * @status - status code mentioning reason
1055 */
1056
1057static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001058 u8 tdls_action, u8 dialog_token, int initiator,
1059 u16 status)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001060{
1061 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
1062 " (action=%u status=%u)",
1063 MAC2STR(dst), tdls_action, status);
1064 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001065 0, initiator, NULL, 0, -1);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001066}
1067
1068
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001069static struct wpa_tdls_peer *
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001070wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001071{
1072 struct wpa_tdls_peer *peer;
1073
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001074 if (existing)
1075 *existing = 0;
1076 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00001077 if (ether_addr_equal(peer->addr, addr)) {
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001078 if (existing)
1079 *existing = 1;
1080 return peer; /* re-use existing entry */
1081 }
1082 }
1083
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001084 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
1085 MAC2STR(addr));
1086
1087 peer = os_zalloc(sizeof(*peer));
1088 if (peer == NULL)
1089 return NULL;
1090
1091 os_memcpy(peer->addr, addr, ETH_ALEN);
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001092 peer->mld_link_id = -1;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001093 peer->next = sm->tdls;
1094 sm->tdls = peer;
1095
1096 return peer;
1097}
1098
1099
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001100static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
1101 struct wpa_tdls_peer *peer)
1102{
1103 size_t buf_len;
1104 struct wpa_tdls_timeoutie timeoutie;
1105 u16 rsn_capab;
1106 struct wpa_tdls_ftie *ftie;
1107 u8 *rbuf, *pos, *count_pos;
1108 u16 count;
1109 struct rsn_ie_hdr *hdr;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001110 int status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001111
1112 if (!wpa_tdls_get_privacy(sm)) {
1113 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
1114 peer->rsnie_i_len = 0;
1115 goto skip_rsnie;
1116 }
1117
1118 /*
1119 * TPK Handshake Message 1:
1120 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
1121 * Timeout Interval IE))
1122 */
1123
1124 /* Filling RSN IE */
1125 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1126 hdr->elem_id = WLAN_EID_RSN;
1127 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1128
1129 pos = (u8 *) (hdr + 1);
1130 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1131 pos += RSN_SELECTOR_LEN;
1132 count_pos = pos;
1133 pos += 2;
1134
1135 count = 0;
1136
1137 /*
1138 * AES-CCMP is the default Encryption preferred for TDLS, so
1139 * RSN IE is filled only with CCMP CIPHER
1140 * Note: TKIP is not used to encrypt TDLS link.
1141 *
1142 * Regardless of the cipher used on the AP connection, select CCMP
1143 * here.
1144 */
1145 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1146 pos += RSN_SELECTOR_LEN;
1147 count++;
1148
1149 WPA_PUT_LE16(count_pos, count);
1150
1151 WPA_PUT_LE16(pos, 1);
1152 pos += 2;
1153 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1154 pos += RSN_SELECTOR_LEN;
1155
1156 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1157 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1158#ifdef CONFIG_TDLS_TESTING
1159 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1160 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
1161 "testing");
1162 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1163 }
1164#endif /* CONFIG_TDLS_TESTING */
1165 WPA_PUT_LE16(pos, rsn_capab);
1166 pos += 2;
1167#ifdef CONFIG_TDLS_TESTING
1168 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1169 /* Number of PMKIDs */
1170 *pos++ = 0x00;
1171 *pos++ = 0x00;
1172 }
1173#endif /* CONFIG_TDLS_TESTING */
1174
1175 hdr->len = (pos - peer->rsnie_i) - 2;
1176 peer->rsnie_i_len = pos - peer->rsnie_i;
1177 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1178 peer->rsnie_i, peer->rsnie_i_len);
1179
1180skip_rsnie:
1181 buf_len = 0;
1182 if (wpa_tdls_get_privacy(sm))
1183 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1184 sizeof(struct wpa_tdls_timeoutie);
1185#ifdef CONFIG_TDLS_TESTING
1186 if (wpa_tdls_get_privacy(sm) &&
1187 (tdls_testing & TDLS_TESTING_LONG_FRAME))
1188 buf_len += 170;
1189 if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
1190 buf_len += sizeof(struct wpa_tdls_lnkid);
1191#endif /* CONFIG_TDLS_TESTING */
1192 rbuf = os_zalloc(buf_len + 1);
1193 if (rbuf == NULL) {
1194 wpa_tdls_peer_free(sm, peer);
Hai Shalom60840252021-02-19 19:02:11 -08001195 return -2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001196 }
1197 pos = rbuf;
1198
1199 if (!wpa_tdls_get_privacy(sm))
1200 goto skip_ies;
1201
1202 /* Initiator RSN IE */
1203 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1204
1205 ftie = (struct wpa_tdls_ftie *) pos;
1206 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1207 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1208
1209 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1210 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1211 "TDLS: Failed to get random data for initiator Nonce");
1212 os_free(rbuf);
1213 wpa_tdls_peer_free(sm, peer);
Hai Shalom60840252021-02-19 19:02:11 -08001214 return -2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001215 }
Jouni Malinenc580b552017-09-22 11:03:15 +03001216 peer->tk_set = 0; /* A new nonce results in a new TK */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001217 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1218 peer->inonce, WPA_NONCE_LEN);
1219 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1220
1221 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1222 (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1223
1224 pos = (u8 *) (ftie + 1);
1225
1226#ifdef CONFIG_TDLS_TESTING
1227 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1228 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1229 "FTIE");
1230 ftie->ie_len += 170;
1231 *pos++ = 255; /* FTIE subelem */
1232 *pos++ = 168; /* FTIE subelem length */
1233 pos += 168;
1234 }
1235#endif /* CONFIG_TDLS_TESTING */
1236
1237 /* Lifetime */
1238 peer->lifetime = TPK_LIFETIME;
1239#ifdef CONFIG_TDLS_TESTING
1240 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1241 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1242 "lifetime");
1243 peer->lifetime = 301;
1244 }
1245 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1246 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1247 "lifetime");
1248 peer->lifetime = 0xffffffff;
1249 }
1250#endif /* CONFIG_TDLS_TESTING */
1251 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1252 sizeof(timeoutie), peer->lifetime);
1253 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1254
1255skip_ies:
1256
1257#ifdef CONFIG_TDLS_TESTING
1258 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
Paul Stewart092955c2017-02-06 09:13:09 -08001259 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1260
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001261 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1262 "Link Identifier");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001263 wpa_tdls_linkid(sm, peer, l);
1264 l->bssid[5] ^= 0x01;
1265 pos += sizeof(*l);
1266 }
1267#endif /* CONFIG_TDLS_TESTING */
1268
1269 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1270 "Handshake Message 1 (peer " MACSTR ")",
1271 MAC2STR(peer->addr));
1272
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001273 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001274 1, 0, 0, peer->initiator, rbuf, pos - rbuf,
1275 -1);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001276 os_free(rbuf);
1277
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001278 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001279}
1280
1281
1282static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1283 const unsigned char *src_addr, u8 dtoken,
1284 struct wpa_tdls_lnkid *lnkid,
1285 const struct wpa_tdls_peer *peer)
1286{
1287 u8 *rbuf, *pos;
1288 size_t buf_len;
1289 u32 lifetime;
1290 struct wpa_tdls_timeoutie timeoutie;
1291 struct wpa_tdls_ftie *ftie;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001292 int status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001293
1294 buf_len = 0;
1295 if (wpa_tdls_get_privacy(sm)) {
1296 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1297 * Lifetime */
1298 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1299 sizeof(struct wpa_tdls_timeoutie);
1300#ifdef CONFIG_TDLS_TESTING
1301 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1302 buf_len += 170;
1303#endif /* CONFIG_TDLS_TESTING */
1304 }
1305
1306 rbuf = os_zalloc(buf_len + 1);
1307 if (rbuf == NULL)
1308 return -1;
1309 pos = rbuf;
1310
1311 if (!wpa_tdls_get_privacy(sm))
1312 goto skip_ies;
1313
1314 /* Peer RSN IE */
1315 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1316
1317 ftie = (struct wpa_tdls_ftie *) pos;
1318 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1319 /* TODO: ftie->mic_control to set 2-RESPONSE */
1320 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1321 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1322 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1323 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1324 (u8 *) ftie, sizeof(*ftie));
1325
1326 pos = (u8 *) (ftie + 1);
1327
1328#ifdef CONFIG_TDLS_TESTING
1329 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1330 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1331 "FTIE");
1332 ftie->ie_len += 170;
1333 *pos++ = 255; /* FTIE subelem */
1334 *pos++ = 168; /* FTIE subelem length */
1335 pos += 168;
1336 }
1337#endif /* CONFIG_TDLS_TESTING */
1338
1339 /* Lifetime */
1340 lifetime = peer->lifetime;
1341#ifdef CONFIG_TDLS_TESTING
1342 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1343 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1344 "lifetime in response");
1345 lifetime++;
1346 }
1347#endif /* CONFIG_TDLS_TESTING */
1348 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1349 sizeof(timeoutie), lifetime);
1350 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1351 lifetime);
1352
1353 /* compute MIC before sending */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +00001354 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (const u8 *) lnkid, peer->rsnie_p,
1355 peer->rsnie_p_len, (const u8 *) &timeoutie,
1356 (const u8 *) ftie, 2 + ftie->ie_len, ftie->mic);
Dmitry Shmidt21de2142014-04-08 10:50:52 -07001357#ifdef CONFIG_TDLS_TESTING
1358 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1359 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1360 ftie->mic[0] ^= 0x01;
1361 }
1362#endif /* CONFIG_TDLS_TESTING */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001363
1364skip_ies:
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001365 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001366 dtoken, 0, 0, peer->initiator, rbuf,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001367 pos - rbuf, -1);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001368 os_free(rbuf);
1369
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001370 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001371}
1372
1373
1374static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1375 const unsigned char *src_addr, u8 dtoken,
1376 struct wpa_tdls_lnkid *lnkid,
1377 const struct wpa_tdls_peer *peer)
1378{
1379 u8 *rbuf, *pos;
1380 size_t buf_len;
1381 struct wpa_tdls_ftie *ftie;
1382 struct wpa_tdls_timeoutie timeoutie;
1383 u32 lifetime;
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001384 int status;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001385 u32 peer_capab = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001386
1387 buf_len = 0;
1388 if (wpa_tdls_get_privacy(sm)) {
1389 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1390 * Lifetime */
1391 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1392 sizeof(struct wpa_tdls_timeoutie);
1393#ifdef CONFIG_TDLS_TESTING
1394 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1395 buf_len += 170;
1396#endif /* CONFIG_TDLS_TESTING */
1397 }
1398
1399 rbuf = os_zalloc(buf_len + 1);
1400 if (rbuf == NULL)
1401 return -1;
1402 pos = rbuf;
1403
1404 if (!wpa_tdls_get_privacy(sm))
1405 goto skip_ies;
1406
1407 /* Peer RSN IE */
1408 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1409
1410 ftie = (struct wpa_tdls_ftie *) pos;
1411 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1412 /*TODO: ftie->mic_control to set 3-CONFIRM */
1413 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1414 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1415 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1416
1417 pos = (u8 *) (ftie + 1);
1418
1419#ifdef CONFIG_TDLS_TESTING
1420 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1421 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1422 "FTIE");
1423 ftie->ie_len += 170;
1424 *pos++ = 255; /* FTIE subelem */
1425 *pos++ = 168; /* FTIE subelem length */
1426 pos += 168;
1427 }
1428#endif /* CONFIG_TDLS_TESTING */
1429
1430 /* Lifetime */
1431 lifetime = peer->lifetime;
1432#ifdef CONFIG_TDLS_TESTING
1433 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1434 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1435 "lifetime in confirm");
1436 lifetime++;
1437 }
1438#endif /* CONFIG_TDLS_TESTING */
1439 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1440 sizeof(timeoutie), lifetime);
1441 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1442 lifetime);
1443
1444 /* compute MIC before sending */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +00001445 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (const u8 *) lnkid, peer->rsnie_p,
1446 peer->rsnie_p_len, (const u8 *) &timeoutie,
1447 (const u8 *) ftie, 2 + ftie->ie_len, ftie->mic);
Dmitry Shmidt21de2142014-04-08 10:50:52 -07001448#ifdef CONFIG_TDLS_TESTING
1449 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1450 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1451 ftie->mic[0] ^= 0x01;
1452 }
1453#endif /* CONFIG_TDLS_TESTING */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001454
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001455skip_ies:
1456
Hai Shaloma20dcd72022-02-04 13:43:00 -08001457 if (peer->he_capabilities)
1458 peer_capab |= TDLS_PEER_HE;
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001459 if (peer->vht_capabilities)
1460 peer_capab |= TDLS_PEER_VHT;
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001461 if (peer->ht_capabilities)
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001462 peer_capab |= TDLS_PEER_HT;
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07001463 if (peer->wmm_capable)
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001464 peer_capab |= TDLS_PEER_WMM;
1465
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001466 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001467 dtoken, 0, peer_capab, peer->initiator,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001468 rbuf, pos - rbuf, -1);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001469 os_free(rbuf);
1470
Dmitry Shmidtd5c075b2013-08-05 14:36:10 -07001471 return status;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001472}
1473
1474
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001475static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1476 struct wpa_tdls_peer *peer,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001477 u8 dialog_token, int link_id)
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001478{
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001479 size_t buf_len = 0;
1480 struct wpa_tdls_timeoutie timeoutie;
1481 u16 rsn_capab;
1482 u8 *rbuf, *pos, *count_pos;
1483 u16 count;
1484 struct rsn_ie_hdr *hdr;
1485 int status;
1486
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001487 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1488 "(peer " MACSTR ")", MAC2STR(peer->addr));
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001489 if (!wpa_tdls_get_privacy(sm))
1490 goto skip_rsn_ies;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001491
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001492 /* Filling RSN IE */
1493 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1494 hdr->elem_id = WLAN_EID_RSN;
1495 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1496 pos = (u8 *) (hdr + 1);
1497 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1498 pos += RSN_SELECTOR_LEN;
1499 count_pos = pos;
1500 pos += 2;
1501 count = 0;
1502
1503 /*
1504 * AES-CCMP is the default encryption preferred for TDLS, so
1505 * RSN IE is filled only with CCMP cipher suite.
1506 * Note: TKIP is not used to encrypt TDLS link.
1507 *
1508 * Regardless of the cipher used on the AP connection, select CCMP
1509 * here.
1510 */
1511 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1512 pos += RSN_SELECTOR_LEN;
1513 count++;
1514 WPA_PUT_LE16(count_pos, count);
1515 WPA_PUT_LE16(pos, 1);
1516 pos += 2;
1517 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1518 pos += RSN_SELECTOR_LEN;
1519
1520 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1521 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1522 WPA_PUT_LE16(pos, rsn_capab);
1523 pos += 2;
1524 hdr->len = (pos - (u8 *) hdr) - 2;
1525 peer->rsnie_i_len = pos - peer->rsnie_i;
1526
1527 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for Discovery Response",
1528 (u8 *) hdr, hdr->len + 2);
1529skip_rsn_ies:
1530 buf_len = 0;
1531 if (wpa_tdls_get_privacy(sm)) {
1532 /* Peer RSN IE, Lifetime */
1533 buf_len += peer->rsnie_i_len +
1534 sizeof(struct wpa_tdls_timeoutie);
1535 }
1536 rbuf = os_zalloc(buf_len + 1);
1537 if (rbuf == NULL) {
1538 wpa_tdls_peer_free(sm, peer);
1539 return -1;
1540 }
1541 pos = rbuf;
1542
1543 if (!wpa_tdls_get_privacy(sm))
1544 goto skip_ies;
1545 /* Initiator RSN IE */
1546 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1547 /* Lifetime */
1548 peer->lifetime = TPK_LIFETIME;
1549 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1550 sizeof(timeoutie), peer->lifetime);
1551 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1552skip_ies:
1553 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001554 dialog_token, 0, 0, 0, rbuf, pos - rbuf,
1555 link_id);
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07001556 os_free(rbuf);
1557
1558 return status;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001559}
1560
1561
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001562static bool wpa_tdls_is_lnkid_bss_valid(struct wpa_sm *sm,
1563 const struct wpa_tdls_lnkid *lnkid,
1564 int *link_id)
1565{
1566 *link_id = -1;
1567
1568 if (!sm->mlo.valid_links) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00001569 if (!ether_addr_equal(sm->bssid, lnkid->bssid))
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001570 return false;
1571 } else {
1572 int i;
1573
Sunil Ravi99c035e2024-07-12 01:42:03 +00001574 for_each_link(sm->mlo.valid_links, i) {
1575 if (ether_addr_equal(lnkid->bssid,
Sunil Ravib0ac25f2024-07-12 01:42:03 +00001576 sm->mlo.links[i].bssid)) {
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001577 *link_id = i;
1578 break;
1579 }
1580 }
1581 if (*link_id < 0) {
1582 wpa_printf(MSG_DEBUG,
1583 "TDLS: MLD link not found for linkid BSS "
1584 MACSTR, MAC2STR(lnkid->bssid));
1585 return false;
1586 }
1587 }
1588
1589 return true;
1590}
1591
1592
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001593static int
1594wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1595 const u8 *buf, size_t len)
1596{
1597 struct wpa_eapol_ie_parse kde;
1598 const struct wpa_tdls_lnkid *lnkid;
1599 struct wpa_tdls_peer *peer;
1600 size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1601 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1602 u8 dialog_token;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001603 int link_id = -1;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001604
1605 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1606 MAC2STR(addr));
1607
1608 if (len < min_req_len) {
1609 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1610 "%d", (int) len);
1611 return -1;
1612 }
1613
1614 dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1615
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07001616 /*
1617 * Some APs will tack on a weird IE to the end of a TDLS
1618 * discovery request packet. This needn't fail the response,
1619 * since the required IE are verified separately.
1620 */
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001621 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1622 len - (sizeof(struct wpa_tdls_frame) + 1),
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07001623 &kde) < 0) {
1624 wpa_printf(MSG_DEBUG,
1625 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround");
1626 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001627
1628 if (!kde.lnkid) {
1629 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1630 "Request");
1631 return -1;
1632 }
1633
1634 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1635
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001636 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
1637 wpa_printf(MSG_DEBUG,
1638 "TDLS: Discovery Request from different BSS "
1639 MACSTR, MAC2STR(lnkid->bssid));
1640 return -1;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001641 }
1642
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001643 peer = wpa_tdls_add_peer(sm, addr, NULL);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001644 if (peer == NULL)
1645 return -1;
1646
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001647 return wpa_tdls_send_discovery_response(sm, peer, dialog_token,
1648 link_id);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001649}
1650
1651
1652int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1653{
1654 if (sm->tdls_disabled || !sm->tdls_supported)
1655 return -1;
1656
1657 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1658 MACSTR, MAC2STR(addr));
1659 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001660 1, 0, 0, 1, NULL, 0, -1);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001661}
1662
1663
1664static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1665 struct wpa_tdls_peer *peer)
1666{
1667 if (!kde->supp_rates) {
1668 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1669 return -1;
1670 }
Dmitry Shmidta54fa5f2013-01-15 13:53:35 -08001671 peer->supp_rates_len = merge_byte_arrays(
1672 peer->supp_rates, sizeof(peer->supp_rates),
1673 kde->supp_rates + 2, kde->supp_rates_len - 2,
Dmitry Shmidt34af3062013-07-11 10:46:32 -07001674 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
Hai Shalom021b0b52019-04-10 11:17:58 -07001675 kde->ext_supp_rates ? kde->ext_supp_rates_len - 2 : 0);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001676 return 0;
1677}
1678
1679
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001680static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde,
1681 struct wpa_tdls_peer *peer)
1682{
Dmitry Shmidt9d9e6022015-04-23 10:34:55 -07001683 if (!kde->ht_capabilities) {
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001684 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities "
1685 "received");
1686 return 0;
1687 }
1688
1689 if (!peer->ht_capabilities) {
1690 peer->ht_capabilities =
1691 os_zalloc(sizeof(struct ieee80211_ht_capabilities));
1692 if (peer->ht_capabilities == NULL)
1693 return -1;
1694 }
1695
1696 os_memcpy(peer->ht_capabilities, kde->ht_capabilities,
1697 sizeof(struct ieee80211_ht_capabilities));
1698 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities",
1699 (u8 *) peer->ht_capabilities,
1700 sizeof(struct ieee80211_ht_capabilities));
1701
1702 return 0;
1703}
1704
1705
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08001706static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde,
1707 struct wpa_tdls_peer *peer)
1708{
Dmitry Shmidt9d9e6022015-04-23 10:34:55 -07001709 if (!kde->vht_capabilities) {
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08001710 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities "
1711 "received");
1712 return 0;
1713 }
1714
1715 if (!peer->vht_capabilities) {
1716 peer->vht_capabilities =
1717 os_zalloc(sizeof(struct ieee80211_vht_capabilities));
1718 if (peer->vht_capabilities == NULL)
1719 return -1;
1720 }
1721
1722 os_memcpy(peer->vht_capabilities, kde->vht_capabilities,
1723 sizeof(struct ieee80211_vht_capabilities));
1724 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities",
1725 (u8 *) peer->vht_capabilities,
1726 sizeof(struct ieee80211_vht_capabilities));
1727
1728 return 0;
1729}
1730
1731
Hai Shaloma20dcd72022-02-04 13:43:00 -08001732static int copy_peer_he_capab(const struct wpa_eapol_ie_parse *kde,
1733 struct wpa_tdls_peer *peer)
1734{
1735 if (!kde->he_capabilities) {
1736 wpa_printf(MSG_DEBUG, "TDLS: No HE capabilities received");
1737 return 0;
1738 }
1739
1740 os_free(peer->he_capabilities);
1741 peer->he_capab_len = 0;
1742 peer->he_capabilities = os_memdup(kde->he_capabilities,
1743 kde->he_capab_len);
1744 if (!peer->he_capabilities)
1745 return -1;
1746
1747 peer->he_capab_len = kde->he_capab_len;
1748 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HE capabilities",
1749 peer->he_capabilities, peer->he_capab_len);
1750
1751 return 0;
1752}
1753
1754
1755static int copy_peer_he_6ghz_band_capab(const struct wpa_eapol_ie_parse *kde,
1756 struct wpa_tdls_peer *peer)
1757{
1758 if (!kde->he_6ghz_capabilities) {
1759 wpa_printf(MSG_DEBUG,
1760 "TDLS: No HE 6 GHz band capabilities received");
1761 return 0;
1762 }
1763
1764 if (!peer->he_6ghz_band_capabilities) {
1765 peer->he_6ghz_band_capabilities =
1766 os_zalloc(sizeof(struct ieee80211_he_6ghz_band_cap));
1767 if (peer->he_6ghz_band_capabilities == NULL)
1768 return -1;
1769 }
1770
1771 os_memcpy(peer->he_6ghz_band_capabilities, kde->he_6ghz_capabilities,
1772 sizeof(struct ieee80211_he_6ghz_band_cap));
1773
1774 wpa_hexdump(MSG_DEBUG, "TDLS: Peer 6 GHz band HE capabilities",
1775 peer->he_6ghz_band_capabilities,
1776 sizeof(struct ieee80211_he_6ghz_band_cap));
1777
1778 return 0;
1779}
1780
1781
Dmitry Shmidtf8623282013-02-20 14:34:59 -08001782static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde,
1783 struct wpa_tdls_peer *peer)
1784{
1785 if (!kde->ext_capab) {
1786 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities "
1787 "received");
1788 return 0;
1789 }
1790
1791 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {
1792 /* Need to allocate buffer to fit the new information */
1793 os_free(peer->ext_capab);
1794 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);
1795 if (peer->ext_capab == NULL)
1796 return -1;
1797 }
1798
1799 peer->ext_capab_len = kde->ext_capab_len - 2;
1800 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);
1801
1802 return 0;
1803}
1804
1805
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001806static int copy_peer_eht_capab(const struct wpa_eapol_ie_parse *kde,
1807 struct wpa_tdls_peer *peer)
1808{
1809 if (!kde->eht_capabilities) {
1810 wpa_printf(MSG_DEBUG, "TDLS: No EHT capabilities received");
1811 return 0;
1812 }
1813
1814 os_free(peer->eht_capabilities);
1815 peer->eht_capab_len = 0;
1816 peer->eht_capabilities = os_memdup(kde->eht_capabilities,
1817 kde->eht_capab_len);
1818 if (!peer->eht_capabilities)
1819 return -1;
1820
1821 peer->eht_capab_len = kde->eht_capab_len;
1822 wpa_hexdump(MSG_DEBUG, "TDLS: Peer EHT capabilities",
1823 peer->eht_capabilities, peer->eht_capab_len);
1824
1825 return 0;
1826}
1827
1828
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001829static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde,
1830 struct wpa_tdls_peer *peer)
1831{
1832 struct wmm_information_element *wmm;
1833
1834 if (!kde->wmm) {
1835 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received");
1836 return 0;
1837 }
1838
1839 if (kde->wmm_len < sizeof(struct wmm_information_element)) {
1840 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received");
1841 return -1;
1842 }
1843
1844 wmm = (struct wmm_information_element *) kde->wmm;
1845 peer->qos_info = wmm->qos_info;
1846
Dmitry Shmidtdf5a7e42014-04-02 12:59:59 -07001847 peer->wmm_capable = 1;
1848
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07001849 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info);
1850 return 0;
1851}
1852
1853
Dmitry Shmidt344abd32014-01-14 13:17:00 -08001854static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde,
1855 struct wpa_tdls_peer *peer)
1856{
1857 if (!kde->supp_channels) {
1858 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received");
1859 return 0;
1860 }
1861
1862 if (!peer->supp_channels ||
1863 peer->supp_channels_len < kde->supp_channels_len) {
1864 os_free(peer->supp_channels);
1865 peer->supp_channels = os_zalloc(kde->supp_channels_len);
1866 if (peer->supp_channels == NULL)
1867 return -1;
1868 }
1869
1870 peer->supp_channels_len = kde->supp_channels_len;
1871
1872 os_memcpy(peer->supp_channels, kde->supp_channels,
1873 peer->supp_channels_len);
1874 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels",
1875 (u8 *) peer->supp_channels, peer->supp_channels_len);
1876 return 0;
1877}
1878
1879
1880static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde,
1881 struct wpa_tdls_peer *peer)
1882{
1883 if (!kde->supp_oper_classes) {
1884 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received");
1885 return 0;
1886 }
1887
1888 if (!peer->supp_oper_classes ||
1889 peer->supp_oper_classes_len < kde->supp_oper_classes_len) {
1890 os_free(peer->supp_oper_classes);
1891 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len);
1892 if (peer->supp_oper_classes == NULL)
1893 return -1;
1894 }
1895
1896 peer->supp_oper_classes_len = kde->supp_oper_classes_len;
1897 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes,
1898 peer->supp_oper_classes_len);
1899 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes",
1900 (u8 *) peer->supp_oper_classes,
1901 peer->supp_oper_classes_len);
1902 return 0;
1903}
1904
1905
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001906static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
1907 int add)
1908{
1909 return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid,
1910 peer->capability,
1911 peer->supp_rates, peer->supp_rates_len,
1912 peer->ht_capabilities,
1913 peer->vht_capabilities,
Hai Shaloma20dcd72022-02-04 13:43:00 -08001914 peer->he_capabilities,
1915 peer->he_capab_len,
1916 peer->he_6ghz_band_capabilities,
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07001917 peer->qos_info, peer->wmm_capable,
1918 peer->ext_capab, peer->ext_capab_len,
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001919 peer->supp_channels,
1920 peer->supp_channels_len,
1921 peer->supp_oper_classes,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001922 peer->supp_oper_classes_len,
1923 peer->eht_capabilities,
1924 peer->eht_capab_len,
1925 peer->mld_link_id);
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001926}
1927
1928
Jouni Malinenc580b552017-09-22 11:03:15 +03001929static int tdls_nonce_set(const u8 *nonce)
1930{
1931 int i;
1932
1933 for (i = 0; i < WPA_NONCE_LEN; i++) {
1934 if (nonce[i])
1935 return 1;
1936 }
1937
1938 return 0;
1939}
1940
1941
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001942static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1943 const u8 *buf, size_t len)
1944{
1945 struct wpa_tdls_peer *peer;
1946 struct wpa_eapol_ie_parse kde;
1947 struct wpa_ie_data ie;
1948 int cipher;
1949 const u8 *cpos;
1950 struct wpa_tdls_ftie *ftie = NULL;
1951 struct wpa_tdls_timeoutie *timeoutie;
1952 struct wpa_tdls_lnkid *lnkid;
1953 u32 lifetime = 0;
1954#if 0
1955 struct rsn_ie_hdr *hdr;
1956 u8 *pos;
1957 u16 rsn_capab;
1958 u16 rsn_ver;
1959#endif
1960 u8 dtoken;
1961 u16 ielen;
1962 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1963 int tdls_prohibited = sm->tdls_prohibited;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001964 int existing_peer = 0;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00001965 int link_id = -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07001966
1967 if (len < 3 + 3)
1968 return -1;
1969
1970 cpos = buf;
1971 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1972
1973 /* driver had already verified the frame format */
1974 dtoken = *cpos++; /* dialog token */
1975
1976 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1977
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08001978 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);
1979 if (peer == NULL)
1980 goto error;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08001981
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07001982 /* If found, use existing entry instead of adding a new one;
1983 * how to handle the case where both ends initiate at the
1984 * same time? */
1985 if (existing_peer) {
1986 if (peer->tpk_success) {
1987 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1988 "direct link is enabled - tear down the "
1989 "old link first");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07001990 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
1991 wpa_tdls_peer_clear(sm, peer);
1992 } else if (peer->initiator) {
1993 /*
1994 * An entry is already present, so check if we already
1995 * sent a TDLS Setup Request. If so, compare MAC
1996 * addresses and let the STA with the lower MAC address
1997 * continue as the initiator. The other negotiation is
1998 * terminated.
1999 */
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07002000 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
2001 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
2002 "from peer with higher address "
2003 MACSTR, MAC2STR(src_addr));
2004 return -1;
2005 } else {
2006 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
2007 "from peer with lower address "
2008 MACSTR " (terminate previously "
2009 "initiated negotiation",
2010 MAC2STR(src_addr));
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002011 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
2012 peer->addr);
2013 wpa_tdls_peer_clear(sm, peer);
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07002014 }
2015 }
2016 }
2017
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002018 /* capability information */
2019 peer->capability = WPA_GET_LE16(cpos);
2020 cpos += 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002021
2022 ielen = len - (cpos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -08002023
2024 /*
2025 * Don't reject the message if failing to parse IEs. The IEs we need are
2026 * explicitly checked below. Some APs may add arbitrary padding to the
2027 * end of short TDLS frames and that would look like invalid IEs.
2028 */
2029 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0)
2030 wpa_printf(MSG_DEBUG,
2031 "TDLS: Failed to parse IEs in TPK M1 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002032
2033 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2034 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2035 "TPK M1");
2036 goto error;
2037 }
2038 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
2039 kde.lnkid, kde.lnkid_len);
2040 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002041
2042 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
2043 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS "
2044 MACSTR, MAC2STR(lnkid->bssid));
Dmitry Shmidt661b4f72014-09-29 14:58:27 -07002045 status = WLAN_STATUS_REQUEST_DECLINED;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002046 goto error;
2047 }
2048
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002049 peer->mld_link_id = link_id;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002050 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
2051 MAC2STR(src_addr));
2052
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002053 if (copy_supp_rates(&kde, peer) < 0)
2054 goto error;
2055
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002056 if (copy_peer_ht_capab(&kde, peer) < 0)
2057 goto error;
2058
Hai Shaloma20dcd72022-02-04 13:43:00 -08002059 if (copy_peer_vht_capab(&kde, peer) < 0 ||
2060 copy_peer_he_capab(&kde, peer) < 0 ||
2061 copy_peer_he_6ghz_band_capab(&kde, peer) < 0)
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08002062 goto error;
2063
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002064 if (copy_peer_eht_capab(&kde, peer) < 0)
2065 goto error;
2066
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002067 if (copy_peer_ext_capab(&kde, peer) < 0)
2068 goto error;
2069
Dmitry Shmidt344abd32014-01-14 13:17:00 -08002070 if (copy_peer_supp_channels(&kde, peer) < 0)
2071 goto error;
2072
2073 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2074 goto error;
2075
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002076 peer->qos_info = kde.qosinfo;
2077
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07002078 /* Overwrite with the qos_info obtained in WMM IE */
2079 if (copy_peer_wmm_capab(&kde, peer) < 0)
2080 goto error;
2081
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -07002082 peer->aid = kde.aid;
2083
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002084#ifdef CONFIG_TDLS_TESTING
2085 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002086 peer = wpa_tdls_add_peer(sm, src_addr, NULL);
2087 if (peer == NULL)
2088 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002089 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
2090 "TDLS setup - send own request");
2091 peer->initiator = 1;
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002092 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
Hai Shaloma20dcd72022-02-04 13:43:00 -08002093 NULL, NULL, 0, NULL, 0, 0, NULL, 0,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002094 NULL, 0, NULL, 0, NULL, 0, link_id);
Hai Shalom60840252021-02-19 19:02:11 -08002095 if (wpa_tdls_send_tpk_m1(sm, peer) == -2) {
2096 peer = NULL;
2097 goto error;
2098 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002099 }
2100
2101 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2102 tdls_prohibited) {
2103 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2104 "on TDLS");
2105 tdls_prohibited = 0;
2106 }
2107#endif /* CONFIG_TDLS_TESTING */
2108
2109 if (tdls_prohibited) {
2110 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
2111 status = WLAN_STATUS_REQUEST_DECLINED;
2112 goto error;
2113 }
2114
2115 if (!wpa_tdls_get_privacy(sm)) {
2116 if (kde.rsn_ie) {
2117 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
2118 "security is disabled");
2119 status = WLAN_STATUS_SECURITY_DISABLED;
2120 goto error;
2121 }
2122 goto skip_rsn;
2123 }
2124
2125 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2126 kde.rsn_ie == NULL) {
2127 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
2128 status = WLAN_STATUS_INVALID_PARAMETERS;
2129 goto error;
2130 }
2131
2132 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2133 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
2134 "TPK M1");
2135 status = WLAN_STATUS_INVALID_RSNIE;
2136 goto error;
2137 }
2138
2139 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2140 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
2141 status = WLAN_STATUS_INVALID_RSNIE;
2142 goto error;
2143 }
2144
2145 cipher = ie.pairwise_cipher;
2146 if (cipher & WPA_CIPHER_CCMP) {
2147 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2148 cipher = WPA_CIPHER_CCMP;
2149 } else {
2150 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
2151 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
2152 goto error;
2153 }
2154
2155 if ((ie.capabilities &
2156 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
2157 WPA_CAPABILITY_PEERKEY_ENABLED) {
2158 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
2159 "TPK M1");
2160 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
2161 goto error;
2162 }
2163
2164 /* Lifetime */
2165 if (kde.key_lifetime == NULL) {
2166 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
2167 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2168 goto error;
2169 }
2170 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2171 lifetime = WPA_GET_LE32(timeoutie->value);
2172 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
2173 if (lifetime < 300) {
2174 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
2175 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2176 goto error;
2177 }
2178
2179skip_rsn:
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002180#ifdef CONFIG_TDLS_TESTING
2181 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
2182 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {
2183 /*
2184 * The request frame from us is going to win, so do not
2185 * replace information based on this request frame from
2186 * the peer.
2187 */
2188 goto skip_rsn_check;
2189 }
2190 }
2191#endif /* CONFIG_TDLS_TESTING */
2192
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002193 peer->initiator = 0; /* Need to check */
2194 peer->dtoken = dtoken;
2195
2196 if (!wpa_tdls_get_privacy(sm)) {
2197 peer->rsnie_i_len = 0;
2198 peer->rsnie_p_len = 0;
2199 peer->cipher = WPA_CIPHER_NONE;
2200 goto skip_rsn_check;
2201 }
2202
2203 ftie = (struct wpa_tdls_ftie *) kde.ftie;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002204 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
2205 peer->rsnie_i_len = kde.rsn_ie_len;
2206 peer->cipher = cipher;
2207
Jouni Malinenc580b552017-09-22 11:03:15 +03002208 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
2209 !tdls_nonce_set(peer->inonce)) {
Sunil Dutt61024722013-09-15 12:09:40 -07002210 /*
2211 * There is no point in updating the RNonce for every obtained
2212 * TPK M1 frame (e.g., retransmission due to timeout) with the
2213 * same INonce (SNonce in FTIE). However, if the TPK M1 is
2214 * retransmitted with a different INonce, update the RNonce
2215 * since this is for a new TDLS session.
2216 */
2217 wpa_printf(MSG_DEBUG,
2218 "TDLS: New TPK M1 INonce - generate new RNonce");
2219 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
2220 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
2221 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2222 "TDLS: Failed to get random data for responder nonce");
Sunil Dutt61024722013-09-15 12:09:40 -07002223 goto error;
2224 }
Jouni Malinenc580b552017-09-22 11:03:15 +03002225 peer->tk_set = 0; /* A new nonce results in a new TK */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002226 }
2227
2228#if 0
2229 /* get version info from RSNIE received from Peer */
2230 hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
2231 rsn_ver = WPA_GET_LE16(hdr->version);
2232
2233 /* use min(peer's version, out version) */
2234 if (rsn_ver > RSN_VERSION)
2235 rsn_ver = RSN_VERSION;
2236
2237 hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
2238
2239 hdr->elem_id = WLAN_EID_RSN;
2240 WPA_PUT_LE16(hdr->version, rsn_ver);
2241 pos = (u8 *) (hdr + 1);
2242
2243 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
2244 pos += RSN_SELECTOR_LEN;
2245 /* Include only the selected cipher in pairwise cipher suite */
2246 WPA_PUT_LE16(pos, 1);
2247 pos += 2;
2248 if (cipher == WPA_CIPHER_CCMP)
2249 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2250 pos += RSN_SELECTOR_LEN;
2251
2252 WPA_PUT_LE16(pos, 1);
2253 pos += 2;
2254 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
2255 pos += RSN_SELECTOR_LEN;
2256
2257 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
2258 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
2259 WPA_PUT_LE16(pos, rsn_capab);
2260 pos += 2;
2261
2262 hdr->len = (pos - peer->rsnie_p) - 2;
2263 peer->rsnie_p_len = pos - peer->rsnie_p;
2264#endif
2265
2266 /* temp fix: validation of RSNIE later */
2267 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
2268 peer->rsnie_p_len = peer->rsnie_i_len;
2269
2270 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
2271 peer->rsnie_p, peer->rsnie_p_len);
2272
2273 peer->lifetime = lifetime;
2274
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002275 if (peer->mld_link_id >= 0)
2276 wpa_printf(MSG_DEBUG, "TDLS: Use link ID %u for TPK derivation",
2277 peer->mld_link_id);
2278 wpa_tdls_generate_tpk(peer, sm->own_addr,
2279 wpa_tdls_get_link_bssid(sm, peer->mld_link_id));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002280
2281skip_rsn_check:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002282#ifdef CONFIG_TDLS_TESTING
2283 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT)
2284 goto skip_add_peer;
2285#endif /* CONFIG_TDLS_TESTING */
2286
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002287 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2288 if (wpa_tdls_addset_peer(sm, peer, 1) < 0)
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002289 goto error;
2290
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002291#ifdef CONFIG_TDLS_TESTING
2292skip_add_peer:
2293#endif /* CONFIG_TDLS_TESTING */
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002294 peer->tpk_in_progress = 1;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002295
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002296 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002297 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002298 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002299 goto error;
2300 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002301
Roshan Pius3a1667e2018-07-03 15:17:14 -07002302#ifdef CONFIG_TDLS_TESTING
2303 if (tdls_testing & TDLS_TESTING_DOUBLE_TPK_M2) {
2304 wpa_printf(MSG_INFO, "TDLS: Testing - Send another TPK M2");
2305 wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer);
2306 }
2307#endif /* CONFIG_TDLS_TESTING */
2308
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002309 return 0;
2310
2311error:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002312 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002313 status);
Dmitry Shmidt43cb5782014-06-16 16:23:22 -07002314 if (peer)
2315 wpa_tdls_peer_free(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002316 return -1;
2317}
2318
2319
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002320static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002321{
2322 peer->tpk_success = 1;
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002323 peer->tpk_in_progress = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002324 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2325 if (wpa_tdls_get_privacy(sm)) {
2326 u32 lifetime = peer->lifetime;
2327 /*
2328 * Start the initiator process a bit earlier to avoid race
2329 * condition with the responder sending teardown request.
2330 */
2331 if (lifetime > 3 && peer->initiator)
2332 lifetime -= 3;
2333 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
2334 sm, peer);
2335#ifdef CONFIG_TDLS_TESTING
Hai Shalom74f70d42019-02-11 14:42:39 -08002336 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
2337 wpa_printf(MSG_DEBUG,
2338 "TDLS: Testing - disable TPK expiration");
2339 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2340 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002341#endif /* CONFIG_TDLS_TESTING */
2342 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002343
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002344 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {
2345 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the "
2346 "driver");
2347 return -1;
2348 }
2349 peer->reconfig_key = 0;
2350
2351 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002352}
2353
2354
2355static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
2356 const u8 *buf, size_t len)
2357{
2358 struct wpa_tdls_peer *peer;
2359 struct wpa_eapol_ie_parse kde;
2360 struct wpa_ie_data ie;
2361 int cipher;
2362 struct wpa_tdls_ftie *ftie;
2363 struct wpa_tdls_timeoutie *timeoutie;
2364 struct wpa_tdls_lnkid *lnkid;
2365 u32 lifetime;
2366 u8 dtoken;
2367 int ielen;
2368 u16 status;
2369 const u8 *pos;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002370 int ret = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002371
2372 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
2373 "(Peer " MACSTR ")", MAC2STR(src_addr));
2374 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002375 if (ether_addr_equal(peer->addr, src_addr))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002376 break;
2377 }
2378 if (peer == NULL) {
2379 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2380 "TPK M2: " MACSTR, MAC2STR(src_addr));
2381 return -1;
2382 }
Dmitry Shmidt0ccb66e2013-03-29 16:41:28 -07002383 if (!peer->initiator) {
2384 /*
2385 * This may happen if both devices try to initiate TDLS at the
2386 * same time and we accept the TPK M1 from the peer in
2387 * wpa_tdls_process_tpk_m1() and clear our previous state.
2388 */
2389 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so "
2390 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr));
2391 return -1;
2392 }
Dmitry Shmidt7d56b752015-12-22 10:59:44 -08002393
2394 if (peer->tpk_success) {
2395 wpa_printf(MSG_INFO, "TDLS: Ignore incoming TPK M2 retry, from "
2396 MACSTR " as TPK M3 was already sent",
2397 MAC2STR(src_addr));
2398 return 0;
2399 }
2400
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002401 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
2402
Sunil Duttadce9cf2013-09-15 11:51:00 -07002403 if (len < 3 + 2 + 1) {
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002404 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002405 return -1;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002406 }
2407
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002408 pos = buf;
2409 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2410 status = WPA_GET_LE16(pos);
2411 pos += 2 /* status code */;
2412
2413 if (status != WLAN_STATUS_SUCCESS) {
2414 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
2415 status);
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002416 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002417 return -1;
2418 }
2419
2420 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
2421
2422 /* TODO: need to verify dialog token matches here or in kernel */
2423 dtoken = *pos++; /* dialog token */
2424
2425 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
2426
Sunil Duttadce9cf2013-09-15 11:51:00 -07002427 if (len < 3 + 2 + 1 + 2) {
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002428 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002429 return -1;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002430 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002431
2432 /* capability information */
2433 peer->capability = WPA_GET_LE16(pos);
2434 pos += 2;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002435
2436 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt7f656022015-02-25 14:36:37 -08002437
2438 /*
2439 * Don't reject the message if failing to parse IEs. The IEs we need are
2440 * explicitly checked below. Some APs may add arbitrary padding to the
2441 * end of short TDLS frames and that would look like invalid IEs.
2442 */
2443 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0)
2444 wpa_printf(MSG_DEBUG,
2445 "TDLS: Failed to parse IEs in TPK M2 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002446
2447#ifdef CONFIG_TDLS_TESTING
2448 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
2449 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
2450 status = WLAN_STATUS_REQUEST_DECLINED;
2451 goto error;
2452 }
2453#endif /* CONFIG_TDLS_TESTING */
2454
2455 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2456 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2457 "TPK M2");
2458 goto error;
2459 }
2460 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
2461 kde.lnkid, kde.lnkid_len);
2462 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2463
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002464 if (!ether_addr_equal(sm->bssid,
2465 wpa_tdls_get_link_bssid(sm, peer->mld_link_id))) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002466 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
2467 status = WLAN_STATUS_NOT_IN_SAME_BSS;
2468 goto error;
2469 }
2470
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002471 if (copy_supp_rates(&kde, peer) < 0)
2472 goto error;
2473
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002474 if (copy_peer_ht_capab(&kde, peer) < 0)
2475 goto error;
2476
Hai Shaloma20dcd72022-02-04 13:43:00 -08002477 if (copy_peer_vht_capab(&kde, peer) < 0 ||
2478 copy_peer_he_capab(&kde, peer) < 0 ||
2479 copy_peer_he_6ghz_band_capab(&kde, peer) < 0)
Dmitry Shmidt33e38bf2013-02-27 12:56:00 -08002480 goto error;
2481
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002482 if (copy_peer_eht_capab(&kde, peer) < 0)
2483 goto error;
2484
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002485 if (copy_peer_ext_capab(&kde, peer) < 0)
2486 goto error;
2487
Dmitry Shmidt344abd32014-01-14 13:17:00 -08002488 if (copy_peer_supp_channels(&kde, peer) < 0)
2489 goto error;
2490
2491 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2492 goto error;
2493
Dmitry Shmidtf8623282013-02-20 14:34:59 -08002494 peer->qos_info = kde.qosinfo;
2495
Dmitry Shmidtb36ed7c2014-03-17 10:57:26 -07002496 /* Overwrite with the qos_info obtained in WMM IE */
2497 if (copy_peer_wmm_capab(&kde, peer) < 0)
2498 goto error;
2499
Dmitry Shmidt51b6ea82013-05-08 10:42:09 -07002500 peer->aid = kde.aid;
2501
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002502 if (!wpa_tdls_get_privacy(sm)) {
2503 peer->rsnie_p_len = 0;
2504 peer->cipher = WPA_CIPHER_NONE;
2505 goto skip_rsn;
2506 }
2507
2508 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2509 kde.rsn_ie == NULL) {
2510 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
2511 status = WLAN_STATUS_INVALID_PARAMETERS;
2512 goto error;
2513 }
2514 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2515 kde.rsn_ie, kde.rsn_ie_len);
2516
Dmitry Shmidt09f57ba2014-06-10 16:07:13 -07002517 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2518 wpa_printf(MSG_INFO,
2519 "TDLS: Too long Responder RSN IE in TPK M2");
2520 status = WLAN_STATUS_INVALID_RSNIE;
2521 goto error;
2522 }
2523
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002524 /*
2525 * FIX: bitwise comparison of RSN IE is not the correct way of
2526 * validation this. It can be different, but certain fields must
2527 * match. Since we list only a single pairwise cipher in TPK M1, the
2528 * memcmp is likely to work in most cases, though.
2529 */
2530 if (kde.rsn_ie_len != peer->rsnie_i_len ||
2531 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
2532 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
2533 "not match with RSN IE used in TPK M1");
2534 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
2535 peer->rsnie_i, peer->rsnie_i_len);
2536 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2537 kde.rsn_ie, kde.rsn_ie_len);
2538 status = WLAN_STATUS_INVALID_RSNIE;
2539 goto error;
2540 }
2541
2542 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2543 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
2544 status = WLAN_STATUS_INVALID_RSNIE;
2545 goto error;
2546 }
2547
2548 cipher = ie.pairwise_cipher;
2549 if (cipher == WPA_CIPHER_CCMP) {
2550 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2551 cipher = WPA_CIPHER_CCMP;
2552 } else {
2553 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
2554 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
2555 goto error;
2556 }
2557
2558 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
2559 kde.ftie, sizeof(*ftie));
2560 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2561
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002562 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002563 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
2564 "not match with FTIE SNonce used in TPK M1");
2565 /* Silently discard the frame */
2566 return -1;
2567 }
2568
2569 /* Responder Nonce and RSN IE */
2570 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
2571 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
2572 peer->rsnie_p_len = kde.rsn_ie_len;
2573 peer->cipher = cipher;
2574
2575 /* Lifetime */
2576 if (kde.key_lifetime == NULL) {
2577 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
2578 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2579 goto error;
2580 }
2581 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2582 lifetime = WPA_GET_LE32(timeoutie->value);
2583 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
2584 lifetime);
2585 if (lifetime != peer->lifetime) {
2586 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2587 "TPK M2 (expected %u)", lifetime, peer->lifetime);
2588 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2589 goto error;
2590 }
2591
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002592 if (peer->mld_link_id >= 0)
2593 wpa_printf(MSG_DEBUG, "TDLS: Use link ID %u for TPK derivation",
2594 peer->mld_link_id);
2595 wpa_tdls_generate_tpk(peer, sm->own_addr,
2596 wpa_tdls_get_link_bssid(sm, peer->mld_link_id));
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002597
2598 /* Process MIC check to see if TPK M2 is right */
Sunil Ravi38ad1ed2023-01-17 23:58:31 +00002599 if (wpa_supplicant_verify_tdls_mic(2, peer, (const u8 *) lnkid,
2600 (const u8 *) timeoutie, ftie,
2601 kde.ftie_len) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002602 /* Discard the frame */
2603 wpa_tdls_del_key(sm, peer);
Sunil Dutt38ffd882013-09-30 17:23:23 +03002604 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002605 return -1;
2606 }
2607
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002608 if (wpa_tdls_set_key(sm, peer) < 0) {
2609 /*
2610 * Some drivers may not be able to config the key prior to full
2611 * STA entry having been configured.
2612 */
2613 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2614 "STA entry is complete");
2615 peer->reconfig_key = 1;
2616 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002617
2618skip_rsn:
2619 peer->dtoken = dtoken;
2620
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002621 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2622 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2623 goto error;
2624
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002625 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
2626 "TPK Handshake Message 3");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002627 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0)
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002628 goto error_no_msg;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002629
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002630 if (!peer->tpk_success) {
2631 /*
2632 * Enable Link only when tpk_success is 0, signifying that this
2633 * processing of TPK M2 frame is not because of a retransmission
2634 * during TDLS setup handshake.
2635 */
2636 ret = wpa_tdls_enable_link(sm, peer);
2637 if (ret < 0) {
2638 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2639 wpa_tdls_do_teardown(
2640 sm, peer,
2641 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2642 }
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002643 }
2644 return ret;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002645
2646error:
Dmitry Shmidt9ead16e2014-10-07 13:15:23 -07002647 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 1,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002648 status);
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08002649error_no_msg:
Sunil Duttd0ef38b2013-09-30 17:34:13 +03002650 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002651 return -1;
2652}
2653
2654
2655static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
2656 const u8 *buf, size_t len)
2657{
2658 struct wpa_tdls_peer *peer;
2659 struct wpa_eapol_ie_parse kde;
2660 struct wpa_tdls_ftie *ftie;
2661 struct wpa_tdls_timeoutie *timeoutie;
2662 struct wpa_tdls_lnkid *lnkid;
2663 int ielen;
2664 u16 status;
2665 const u8 *pos;
2666 u32 lifetime;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002667 int ret = 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002668
2669 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
2670 "(Peer " MACSTR ")", MAC2STR(src_addr));
2671 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002672 if (ether_addr_equal(peer->addr, src_addr))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002673 break;
2674 }
2675 if (peer == NULL) {
2676 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2677 "TPK M3: " MACSTR, MAC2STR(src_addr));
2678 return -1;
2679 }
2680 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
2681
2682 if (len < 3 + 3)
Sunil Duttadce9cf2013-09-15 11:51:00 -07002683 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002684 pos = buf;
2685 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2686
2687 status = WPA_GET_LE16(pos);
2688
2689 if (status != 0) {
2690 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
2691 status);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002692 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002693 }
2694 pos += 2 /* status code */ + 1 /* dialog token */;
2695
2696 ielen = len - (pos - buf); /* start of IE in buf */
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002697
2698 /*
2699 * Don't reject the message if failing to parse IEs. The IEs we need are
2700 * explicitly checked below. Some APs piggy-back broken IEs to the end
2701 * of a TDLS Confirm packet, which will fail the link if we don't ignore
2702 * this error.
2703 */
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002704 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
Dmitry Shmidt0c08fdc2014-06-20 10:16:40 -07002705 wpa_printf(MSG_DEBUG,
2706 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002707 }
2708
2709 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2710 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002711 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002712 }
2713 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
2714 (u8 *) kde.lnkid, kde.lnkid_len);
2715 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2716
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002717 if (!ether_addr_equal(wpa_tdls_get_link_bssid(sm, peer->mld_link_id),
2718 lnkid->bssid)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002719 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002720 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002721 }
2722
2723 if (!wpa_tdls_get_privacy(sm))
2724 goto skip_rsn;
2725
2726 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
2727 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002728 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002729 }
2730 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
2731 kde.ftie, sizeof(*ftie));
2732 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2733
2734 if (kde.rsn_ie == NULL) {
2735 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002736 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002737 }
2738 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
2739 kde.rsn_ie, kde.rsn_ie_len);
2740 if (kde.rsn_ie_len != peer->rsnie_p_len ||
2741 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
2742 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
2743 "with the one sent in TPK M2");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002744 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002745 }
2746
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002747 if (os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002748 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
2749 "not match with FTIE ANonce used in TPK M2");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002750 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002751 }
2752
Dmitry Shmidt57c2d392016-02-23 13:40:19 -08002753 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002754 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
2755 "match with FTIE SNonce used in TPK M1");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002756 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002757 }
2758
2759 if (kde.key_lifetime == NULL) {
2760 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
Sunil Duttadce9cf2013-09-15 11:51:00 -07002761 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002762 }
2763 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2764 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
2765 (u8 *) timeoutie, sizeof(*timeoutie));
2766 lifetime = WPA_GET_LE32(timeoutie->value);
2767 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
2768 lifetime);
2769 if (lifetime != peer->lifetime) {
2770 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2771 "TPK M3 (expected %u)", lifetime, peer->lifetime);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002772 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002773 }
2774
Sunil Ravi38ad1ed2023-01-17 23:58:31 +00002775 if (wpa_supplicant_verify_tdls_mic(3, peer, (const u8 *) lnkid,
2776 (const u8 *) timeoutie, ftie,
2777 kde.ftie_len) < 0) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002778 wpa_tdls_del_key(sm, peer);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002779 goto error;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002780 }
2781
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002782 if (wpa_tdls_set_key(sm, peer) < 0) {
2783 /*
2784 * Some drivers may not be able to config the key prior to full
2785 * STA entry having been configured.
2786 */
2787 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2788 "STA entry is complete");
2789 peer->reconfig_key = 1;
2790 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002791
2792skip_rsn:
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002793 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2794 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2795 goto error;
2796
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002797 if (!peer->tpk_success) {
2798 /*
2799 * Enable Link only when tpk_success is 0, signifying that this
2800 * processing of TPK M3 frame is not because of a retransmission
2801 * during TDLS setup handshake.
2802 */
2803 ret = wpa_tdls_enable_link(sm, peer);
2804 if (ret < 0) {
2805 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002806 goto error;
Dmitry Shmidt292b0c32013-11-22 12:54:42 -08002807 }
Dmitry Shmidt8da800a2013-04-24 12:57:01 -07002808 }
2809 return ret;
Sunil Duttadce9cf2013-09-15 11:51:00 -07002810error:
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002811 wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Sunil Duttadce9cf2013-09-15 11:51:00 -07002812 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002813}
2814
2815
2816static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
2817{
2818 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
2819
2820 os_memset(lifetime, 0, ie_len);
2821 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2822 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2823 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2824 WPA_PUT_LE32(lifetime->value, tsecs);
2825 os_memcpy(pos, ie, ie_len);
2826 return pos + ie_len;
2827}
2828
2829
2830/**
2831 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2832 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2833 * @peer: MAC address of the peer STA
2834 * Returns: 0 on success, or -1 on failure
2835 *
2836 * Send TPK Handshake Message 1 info to driver to start TDLS
2837 * handshake with the peer.
2838 */
2839int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2840{
2841 struct wpa_tdls_peer *peer;
2842 int tdls_prohibited = sm->tdls_prohibited;
Hai Shalom60840252021-02-19 19:02:11 -08002843 int res;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002844
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002845 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002846 return -1;
2847
2848#ifdef CONFIG_TDLS_TESTING
2849 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2850 tdls_prohibited) {
2851 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2852 "on TDLS");
2853 tdls_prohibited = 0;
2854 }
2855#endif /* CONFIG_TDLS_TESTING */
2856
2857 if (tdls_prohibited) {
2858 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2859 "reject request to start setup");
2860 return -1;
2861 }
2862
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002863 peer = wpa_tdls_add_peer(sm, addr, NULL);
2864 if (peer == NULL)
2865 return -1;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002866
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002867 if (peer->tpk_in_progress) {
2868 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer");
2869 return 0;
2870 }
2871
Sunil Ravi99c035e2024-07-12 01:42:03 +00002872 if (sm->mlo.valid_links && !peer->disc_resp_rcvd) {
2873 wpa_printf(MSG_DEBUG,
2874 "TDLS: MLO STA connection - defer the setup request since Discovery Resp not yet received");
2875 peer->setup_req_rcvd = true;
2876 return 0;
2877 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002878 peer->initiator = 1;
2879
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002880 /* add the peer to the driver as a "setup in progress" peer */
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002881 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
Hai Shaloma20dcd72022-02-04 13:43:00 -08002882 NULL, NULL, 0, NULL, 0, 0, NULL, 0, NULL, 0,
Sunil Ravi2a14cf12023-11-21 00:54:38 +00002883 NULL, 0, NULL, 0, peer->mld_link_id)) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07002884 wpa_tdls_disable_peer_link(sm, peer);
2885 return -1;
2886 }
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002887
Sunil Dutt73b28cc2013-09-30 17:38:41 +03002888 peer->tpk_in_progress = 1;
2889
Hai Shalom60840252021-02-19 19:02:11 -08002890 res = wpa_tdls_send_tpk_m1(sm, peer);
2891 if (res < 0) {
2892 if (res != -2)
2893 wpa_tdls_disable_peer_link(sm, peer);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002894 return -1;
2895 }
2896
2897 return 0;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002898}
2899
2900
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002901void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002902{
2903 struct wpa_tdls_peer *peer;
2904
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002905 if (sm->tdls_disabled || !sm->tdls_supported)
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002906 return;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002907
2908 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002909 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002910 break;
2911 }
2912
2913 if (peer == NULL || !peer->tpk_success)
Dmitry Shmidt4b9d52f2013-02-05 17:44:43 -08002914 return;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002915
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002916 if (sm->tdls_external_setup) {
2917 /*
2918 * Disable previous link to allow renegotiation to be completed
2919 * on AP path.
2920 */
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07002921 wpa_tdls_do_teardown(sm, peer,
2922 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002923 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002924}
2925
2926
2927/**
2928 * wpa_supplicant_rx_tdls - Receive TDLS data frame
2929 *
2930 * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2931 */
2932static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2933 const u8 *buf, size_t len)
2934{
2935 struct wpa_sm *sm = ctx;
2936 struct wpa_tdls_frame *tf;
2937
2938 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2939 buf, len);
2940
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002941 if (sm->tdls_disabled || !sm->tdls_supported) {
2942 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2943 "or unsupported by driver");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002944 return;
2945 }
2946
Sunil Ravib0ac25f2024-07-12 01:42:03 +00002947 if (ether_addr_equal(src_addr, sm->own_addr)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002948 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2949 return;
2950 }
2951
2952 if (len < sizeof(*tf)) {
2953 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2954 return;
2955 }
2956
2957 /* Check to make sure its a valid encapsulated TDLS frame */
2958 tf = (struct wpa_tdls_frame *) buf;
2959 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2960 tf->category != WLAN_ACTION_TDLS) {
2961 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2962 "category=%u action=%u",
2963 tf->payloadtype, tf->category, tf->action);
2964 return;
2965 }
2966
2967 switch (tf->action) {
2968 case WLAN_TDLS_SETUP_REQUEST:
2969 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2970 break;
2971 case WLAN_TDLS_SETUP_RESPONSE:
2972 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2973 break;
2974 case WLAN_TDLS_SETUP_CONFIRM:
2975 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2976 break;
2977 case WLAN_TDLS_TEARDOWN:
2978 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2979 break;
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08002980 case WLAN_TDLS_DISCOVERY_REQUEST:
2981 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2982 break;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07002983 default:
2984 /* Kernel code will process remaining frames */
2985 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2986 tf->action);
2987 break;
2988 }
2989}
2990
2991
2992/**
2993 * wpa_tdls_init - Initialize driver interface parameters for TDLS
2994 * @wpa_s: Pointer to wpa_supplicant data
2995 * Returns: 0 on success, -1 on failure
2996 *
2997 * This function is called to initialize driver interface parameters for TDLS.
2998 * wpa_drv_init() must have been called before this function to initialize the
2999 * driver interface.
3000 */
3001int wpa_tdls_init(struct wpa_sm *sm)
3002{
3003 if (sm == NULL)
3004 return -1;
3005
Hai Shalom899fcc72020-10-19 14:38:18 -07003006 if (sm->l2_tdls) {
3007 l2_packet_deinit(sm->l2_tdls);
3008 sm->l2_tdls = NULL;
3009 }
3010
Dmitry Shmidt04949592012-07-19 12:16:46 -07003011 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname :
3012 sm->ifname,
3013 sm->own_addr,
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003014 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
3015 sm, 0);
3016 if (sm->l2_tdls == NULL) {
3017 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
3018 "connection");
3019 return -1;
3020 }
3021
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003022 /*
3023 * Drivers that support TDLS but don't implement the get_capa callback
3024 * are assumed to perform everything internally
3025 */
3026 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003027 &sm->tdls_external_setup,
3028 &sm->tdls_chan_switch) < 0) {
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003029 sm->tdls_supported = 1;
3030 sm->tdls_external_setup = 0;
3031 }
3032
3033 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
3034 "driver", sm->tdls_supported ? "" : " not");
3035 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
3036 sm->tdls_external_setup ? "external" : "internal");
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003037 wpa_printf(MSG_DEBUG, "TDLS: Driver %s TDLS channel switching",
3038 sm->tdls_chan_switch ? "supports" : "does not support");
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003039
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003040 return 0;
3041}
3042
3043
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003044void wpa_tdls_teardown_peers(struct wpa_sm *sm)
3045{
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07003046 struct wpa_tdls_peer *peer, *tmp;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003047
Dmitry Shmidtff787d52015-01-12 13:01:47 -08003048 if (!sm)
3049 return;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003050 peer = sm->tdls;
3051
3052 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers");
3053
3054 while (peer) {
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07003055 tmp = peer->next;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003056 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR,
3057 MAC2STR(peer->addr));
3058 if (sm->tdls_external_setup)
Dmitry Shmidtb58836e2014-04-29 14:35:56 -07003059 wpa_tdls_do_teardown(sm, peer,
3060 WLAN_REASON_DEAUTH_LEAVING);
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003061 else
3062 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
3063
Dmitry Shmidtd30ac602014-06-30 09:54:22 -07003064 peer = tmp;
Dmitry Shmidtf8623282013-02-20 14:34:59 -08003065 }
3066}
3067
3068
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003069static void wpa_tdls_remove_peers(struct wpa_sm *sm)
3070{
3071 struct wpa_tdls_peer *peer, *tmp;
3072
3073 peer = sm->tdls;
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003074
3075 while (peer) {
3076 int res;
3077 tmp = peer->next;
3078 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
3079 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
3080 MAC2STR(peer->addr), res);
3081 wpa_tdls_peer_free(sm, peer);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003082 peer = tmp;
3083 }
3084}
3085
3086
3087/**
3088 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
3089 *
3090 * This function is called to recover driver interface parameters for TDLS
3091 * and frees resources allocated for it.
3092 */
3093void wpa_tdls_deinit(struct wpa_sm *sm)
3094{
3095 if (sm == NULL)
3096 return;
3097
3098 if (sm->l2_tdls)
3099 l2_packet_deinit(sm->l2_tdls);
3100 sm->l2_tdls = NULL;
3101
3102 wpa_tdls_remove_peers(sm);
3103}
3104
3105
3106void wpa_tdls_assoc(struct wpa_sm *sm)
3107{
3108 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
3109 wpa_tdls_remove_peers(sm);
3110}
3111
3112
3113void wpa_tdls_disassoc(struct wpa_sm *sm)
3114{
3115 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
3116 wpa_tdls_remove_peers(sm);
3117}
3118
3119
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003120static int wpa_tdls_prohibited(struct ieee802_11_elems *elems)
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003121{
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003122 /* bit 38 - TDLS Prohibited */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003123 return !!(elems->ext_capab[4] & 0x40);
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003124}
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003125
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003126
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003127static int wpa_tdls_chan_switch_prohibited(struct ieee802_11_elems *elems)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003128{
3129 /* bit 39 - TDLS Channel Switch Prohibited */
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003130 return !!(elems->ext_capab[4] & 0x80);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003131}
3132
3133
3134void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
3135{
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003136 struct ieee802_11_elems elems;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003137
3138 sm->tdls_prohibited = 0;
3139 sm->tdls_chan_switch_prohibited = 0;
3140
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003141 if (ies == NULL ||
3142 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003143 elems.ext_capab == NULL || elems.ext_capab_len < 5)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003144 return;
3145
3146 sm->tdls_prohibited = wpa_tdls_prohibited(&elems);
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003147 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
3148 sm->tdls_prohibited ? "prohibited" : "allowed");
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003149 sm->tdls_chan_switch_prohibited =
3150 wpa_tdls_chan_switch_prohibited(&elems);
3151 wpa_printf(MSG_DEBUG, "TDLS: TDLS channel switch %s in the target BSS",
3152 sm->tdls_chan_switch_prohibited ? "prohibited" : "allowed");
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003153}
3154
3155
3156void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
3157{
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003158 struct ieee802_11_elems elems;
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003159
Dmitry Shmidtd80a4012015-11-05 16:35:40 -08003160 if (ies == NULL ||
3161 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
Dmitry Shmidt9839ecd2016-11-07 11:05:47 -08003162 elems.ext_capab == NULL || elems.ext_capab_len < 5)
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003163 return;
3164
3165 if (!sm->tdls_prohibited && wpa_tdls_prohibited(&elems)) {
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003166 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
3167 "(Re)Association Response IEs");
3168 sm->tdls_prohibited = 1;
3169 }
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003170
3171 if (!sm->tdls_chan_switch_prohibited &&
3172 wpa_tdls_chan_switch_prohibited(&elems)) {
3173 wpa_printf(MSG_DEBUG,
3174 "TDLS: TDLS channel switch prohibited based on (Re)Association Response IEs");
3175 sm->tdls_chan_switch_prohibited = 1;
3176 }
Dmitry Shmidt8d520ff2011-05-09 14:06:53 -07003177}
3178
3179
3180void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
3181{
3182 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
3183 sm->tdls_disabled = !enabled;
3184}
Dmitry Shmidt1f69aa52012-01-24 16:10:04 -08003185
3186
3187int wpa_tdls_is_external_setup(struct wpa_sm *sm)
3188{
3189 return sm->tdls_external_setup;
3190}
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003191
3192
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003193int wpa_tdls_process_discovery_response(struct wpa_sm *sm, const u8 *addr,
3194 const u8 *buf, size_t len)
3195{
3196 struct ieee802_11_elems elems;
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003197 const struct wpa_tdls_lnkid *lnkid;
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003198 struct wpa_tdls_peer *peer;
3199 size_t min_req_len = 1 /* Dialog Token */ + 2 /* Capability */ +
3200 sizeof(struct wpa_tdls_lnkid);
3201 int link_id = -1;
3202
3203 wpa_printf(MSG_DEBUG, "TDLS: Process Discovery Response from " MACSTR,
3204 MAC2STR(addr));
3205
3206 if (len < min_req_len) {
3207 wpa_printf(MSG_DEBUG, "TDLS Discovery Resp is too short: %zu",
3208 len);
3209 return -1;
3210 }
3211
3212 /* Elements start after the three octets of fixed field (one octet for
3213 * the Dialog Token field and two octets for the Capability field. */
3214 if (ieee802_11_parse_elems(buf + 3, len - 3, &elems, 1) ==
3215 ParseFailed) {
3216 wpa_printf(MSG_DEBUG,
3217 "TDLS: Failed to parse IEs in Discovery Response");
3218 return -1;
3219 }
3220
3221 if (!elems.link_id) {
3222 wpa_printf(MSG_DEBUG,
3223 "TDLS: Link Identifier element not found in Discovery Response");
3224 return -1;
3225 }
3226
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003227 lnkid = (const struct wpa_tdls_lnkid *) (elems.link_id - 2);
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003228
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003229 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003230 wpa_printf(MSG_DEBUG,
3231 "TDLS: Discovery Response from different BSS "
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003232 MACSTR, MAC2STR(lnkid->bssid));
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003233 return -1;
3234 }
3235
3236 peer = wpa_tdls_add_peer(sm, addr, NULL);
3237 if (!peer) {
3238 wpa_printf(MSG_DEBUG, "TDLS: Could not add peer entry");
3239 return -1;
3240 }
3241
3242 peer->mld_link_id = link_id;
3243 wpa_printf(MSG_DEBUG, "TDLS: Link identifier BSS: " MACSTR
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003244 " , link id: %u", MAC2STR(lnkid->bssid), link_id);
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003245
Sunil Ravi99c035e2024-07-12 01:42:03 +00003246 peer->disc_resp_rcvd = true;
3247 if (peer->setup_req_rcvd) {
3248 peer->setup_req_rcvd = false;
3249 wpa_printf(MSG_DEBUG, "TDLS: Process the deferred TDLS start");
3250 return wpa_tdls_start(sm, addr);
3251 }
3252
Sunil Ravi2a14cf12023-11-21 00:54:38 +00003253 return 0;
3254}
3255
3256
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003257int wpa_tdls_enable_chan_switch(struct wpa_sm *sm, const u8 *addr,
3258 u8 oper_class,
3259 struct hostapd_freq_params *freq_params)
3260{
3261 struct wpa_tdls_peer *peer;
3262 int ret;
3263
3264 if (sm->tdls_disabled || !sm->tdls_supported)
3265 return -1;
3266
3267 if (!sm->tdls_chan_switch) {
3268 wpa_printf(MSG_DEBUG,
3269 "TDLS: Channel switching not supported by the driver");
3270 return -1;
3271 }
3272
3273 if (sm->tdls_chan_switch_prohibited) {
3274 wpa_printf(MSG_DEBUG,
3275 "TDLS: Channel switching is prohibited in this BSS - reject request to switch channel");
3276 return -1;
3277 }
3278
3279 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003280 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003281 break;
3282 }
3283
3284 if (peer == NULL || !peer->tpk_success) {
3285 wpa_printf(MSG_ERROR, "TDLS: Peer " MACSTR
3286 " not found for channel switching", MAC2STR(addr));
3287 return -1;
3288 }
3289
3290 if (peer->chan_switch_enabled) {
3291 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
3292 " already has channel switching enabled",
3293 MAC2STR(addr));
3294 return 0;
3295 }
3296
3297 ret = wpa_sm_tdls_enable_channel_switch(sm, peer->addr,
3298 oper_class, freq_params);
3299 if (!ret)
3300 peer->chan_switch_enabled = 1;
3301
3302 return ret;
3303}
3304
3305
3306int wpa_tdls_disable_chan_switch(struct wpa_sm *sm, const u8 *addr)
3307{
3308 struct wpa_tdls_peer *peer;
3309
3310 if (sm->tdls_disabled || !sm->tdls_supported)
3311 return -1;
3312
3313 for (peer = sm->tdls; peer; peer = peer->next) {
Sunil Ravib0ac25f2024-07-12 01:42:03 +00003314 if (ether_addr_equal(peer->addr, addr))
Dmitry Shmidt6c0da2b2015-01-05 13:08:17 -08003315 break;
3316 }
3317
3318 if (!peer || !peer->chan_switch_enabled) {
3319 wpa_printf(MSG_ERROR, "TDLS: Channel switching not enabled for "
3320 MACSTR, MAC2STR(addr));
3321 return -1;
3322 }
3323
3324 /* ignore the return value */
3325 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
3326
3327 peer->chan_switch_enabled = 0;
3328 return 0;
3329}