1 /*
2 * Proxmity Ranging
3 * Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "includes.h"
10
11 #include "utils/common.h"
12 #include "common/ieee802_11_defs.h"
13 #include "common/ieee802_11_common.h"
14 #include "crypto/sha256.h"
15 #include "pasn/pasn_common.h"
16 #include "proximity_ranging.h"
17
18
valid_country_ch(char c)19 static bool valid_country_ch(char c)
20 {
21 return c >= 'A' && c <= 'Z';
22 }
23
24
pr_device_free(struct pr_data * pr,struct pr_device * dev)25 static void pr_device_free(struct pr_data *pr, struct pr_device *dev)
26 {
27 #ifdef CONFIG_PASN
28 wpabuf_free(dev->ranging_wrapper);
29 if (dev->pasn) {
30 wpa_pasn_reset(dev->pasn);
31 pasn_data_deinit(dev->pasn);
32 }
33 #endif /* CONFIG_PASN */
34 os_free(dev);
35 }
36
37
pr_get_device(struct pr_data * pr,const u8 * addr)38 static struct pr_device * pr_get_device(struct pr_data *pr, const u8 *addr)
39 {
40 struct pr_device *dev;
41
42 dl_list_for_each(dev, &pr->devices, struct pr_device, list) {
43 if (ether_addr_equal(dev->pr_device_addr, addr))
44 return dev;
45 }
46 return NULL;
47 }
48
49
pr_create_device(struct pr_data * pr,const u8 * addr)50 static struct pr_device * pr_create_device(struct pr_data *pr, const u8 *addr)
51 {
52 struct pr_device *dev, *oldest = NULL;
53 size_t count = 0;
54
55 dev = pr_get_device(pr, addr);
56 if (dev)
57 return dev;
58
59 dl_list_for_each(dev, &pr->devices, struct pr_device, list) {
60 count++;
61 if (!oldest ||
62 os_reltime_before(&dev->last_seen, &oldest->last_seen))
63 oldest = dev;
64 }
65 if (count + 1 > PR_MAX_PEER && oldest) {
66 wpa_printf(MSG_DEBUG,
67 "PR: Remove oldest peer entry to make room for a new peer "
68 MACSTR, MAC2STR(oldest->pr_device_addr));
69 dl_list_del(&oldest->list);
70 pr_device_free(pr, oldest);
71 }
72
73 dev = os_zalloc(sizeof(*dev));
74 if (!dev)
75 return NULL;
76
77 dl_list_add(&pr->devices, &dev->list);
78 os_memcpy(dev->pr_device_addr, addr, ETH_ALEN);
79 wpa_printf(MSG_DEBUG, "PR: New Proximity Ranging device " MACSTR
80 " added to list", MAC2STR(addr));
81
82 return dev;
83 }
84
85
pr_init(const struct pr_config * cfg)86 struct pr_data * pr_init(const struct pr_config *cfg)
87 {
88 struct pr_data *pr;
89
90 pr = os_zalloc(sizeof(*pr) + sizeof(*cfg));
91 if (!pr)
92 return NULL;
93
94 pr->cfg = (struct pr_config *) (pr + 1);
95 os_memcpy(pr->cfg, cfg, sizeof(*cfg));
96 if (cfg->dev_name)
97 pr->cfg->dev_name = os_strdup(cfg->dev_name);
98 else
99 pr->cfg->dev_name = NULL;
100
101 dl_list_init(&pr->devices);
102 dl_list_init(&pr->dev_iks);
103
104 #ifdef CONFIG_PASN
105 pr->initiator_pmksa = pasn_initiator_pmksa_cache_init();
106 pr->responder_pmksa = pasn_responder_pmksa_cache_init();
107 #endif /* CONFIG_PASN */
108
109 return pr;
110 }
111
112
pr_deinit_dev_iks(struct pr_data * pr)113 static void pr_deinit_dev_iks(struct pr_data *pr)
114 {
115 struct pr_dev_ik *dev_ik, *prev_dev_ik;
116
117 dl_list_for_each_safe(dev_ik, prev_dev_ik, &pr->dev_iks,
118 struct pr_dev_ik, list) {
119 dl_list_del(&dev_ik->list);
120 os_free(dev_ik);
121 }
122 }
123
124
pr_flush(struct pr_data * pr)125 void pr_flush(struct pr_data *pr)
126 {
127 #ifdef CONFIG_PASN
128 if (pr->initiator_pmksa)
129 pasn_initiator_pmksa_cache_flush(pr->initiator_pmksa);
130 if (pr->responder_pmksa)
131 pasn_responder_pmksa_cache_flush(pr->responder_pmksa);
132 #endif /* CONFIG_PASN */
133 }
134
pr_deinit(struct pr_data * pr)135 void pr_deinit(struct pr_data *pr)
136 {
137 struct pr_device *dev, *prev;
138
139 if (!pr)
140 return;
141
142 os_free(pr->cfg->dev_name);
143
144 dl_list_for_each_safe(dev, prev, &pr->devices, struct pr_device, list) {
145 dl_list_del(&dev->list);
146 pr_device_free(pr, dev);
147 }
148
149 pr_deinit_dev_iks(pr);
150
151 #ifdef CONFIG_PASN
152 os_free(pr->pr_pasn_params);
153 pr->pr_pasn_params = NULL;
154 pr->ranging_final_received = false;
155
156 pasn_initiator_pmksa_cache_deinit(pr->initiator_pmksa);
157 pasn_responder_pmksa_cache_deinit(pr->responder_pmksa);
158 #endif /* CONFIG_PASN */
159
160 os_free(pr);
161 wpa_printf(MSG_DEBUG, "PR: Deinit done");
162 }
163
164
pr_set_dev_addr(struct pr_data * pr,const u8 * addr)165 void pr_set_dev_addr(struct pr_data *pr, const u8 *addr)
166 {
167 if (pr && addr)
168 os_memcpy(pr->cfg->dev_addr, addr, ETH_ALEN);
169 }
170
171
pr_clear_dev_iks(struct pr_data * pr)172 void pr_clear_dev_iks(struct pr_data *pr)
173 {
174 struct pr_device *dev;
175
176 pr->cfg->dik_len = 0;
177 os_memset(pr->cfg->dik_data, 0, DEVICE_IDENTITY_KEY_LEN);
178 pr->cfg->global_password_valid = false;
179 os_memset(pr->cfg->global_password, 0,
180 sizeof(pr->cfg->global_password));
181
182 dl_list_for_each(dev, &pr->devices, struct pr_device, list) {
183 dev->password_valid = false;
184 os_memset(dev->password, 0, sizeof(dev->password));
185 dev->dik_valid = false;
186 os_memset(dev->dik, 0, DEVICE_IDENTITY_KEY_LEN);
187 }
188
189 pr_deinit_dev_iks(pr);
190 }
191
192
pr_add_dev_ik(struct pr_data * pr,const u8 * dik,const char * password,const u8 * pmk,size_t pmk_len,bool own)193 void pr_add_dev_ik(struct pr_data *pr, const u8 *dik, const char *password,
194 const u8 *pmk, size_t pmk_len, bool own)
195 {
196 struct pr_dev_ik *dev_ik;
197
198 if (own) {
199 os_memcpy(pr->cfg->dik_data, dik, DEVICE_IDENTITY_KEY_LEN);
200 pr->cfg->dik_len = DEVICE_IDENTITY_KEY_LEN;
201 if (password) {
202 os_strlcpy(pr->cfg->global_password, password,
203 sizeof(pr->cfg->global_password));
204 pr->cfg->global_password_valid = true;
205 }
206 return;
207 }
208
209 if (pmk && (pmk_len != 32 && pmk_len != 48 && pmk_len != 64)) {
210 wpa_printf(MSG_INFO, "PR: Unexpected PMK length %zu", pmk_len);
211 return;
212 }
213
214 dl_list_for_each(dev_ik, &pr->dev_iks, struct pr_dev_ik, list) {
215 if (os_memcmp(dik, dev_ik->dik, DEVICE_IDENTITY_KEY_LEN) == 0) {
216 dl_list_del(&dev_ik->list);
217 os_free(dev_ik);
218 break;
219 }
220 }
221
222 dev_ik = os_zalloc(sizeof(*dev_ik));
223 if (!dev_ik)
224 return;
225
226 dl_list_add(&pr->dev_iks, &dev_ik->list);
227 os_memcpy(dev_ik->dik, dik, DEVICE_IDENTITY_KEY_LEN);
228 if (password) {
229 os_strlcpy(dev_ik->password, password,
230 sizeof(dev_ik->password));
231 dev_ik->password_valid = true;
232 }
233 if (pmk) {
234 os_memcpy(dev_ik->pmk, pmk, pmk_len);
235 dev_ik->pmk_len = pmk_len;
236 dev_ik->pmk_valid = true;
237 }
238
239 wpa_printf(MSG_DEBUG, "PR: New Device Identity added to list");
240 }
241
242
pr_set_peer_credentials(struct pr_data * pr,const u8 * addr,const u8 * pmk,size_t pmk_len,const char * password)243 int pr_set_peer_credentials(struct pr_data *pr, const u8 *addr,
244 const u8 *pmk, size_t pmk_len,
245 const char *password)
246 {
247 struct pr_device *dev;
248
249 if (!pr || !addr)
250 return -1;
251
252 dev = pr_get_device(pr, addr);
253 if (!dev) {
254 wpa_printf(MSG_DEBUG, "PR: set_peer_credentials: " MACSTR
255 " not found", MAC2STR(addr));
256 return -1;
257 }
258
259 if (pmk && pmk_len) {
260 if (pmk_len > PMK_LEN_MAX)
261 return -1;
262 os_memcpy(dev->pmk, pmk, pmk_len);
263 dev->pmk_len = pmk_len;
264 dev->pmk_valid = true;
265 wpa_printf(MSG_DEBUG, "PR: PMK set for " MACSTR, MAC2STR(addr));
266 }
267
268 if (password) {
269 if (os_strlen(password) >= sizeof(dev->password))
270 return -1;
271 os_strlcpy(dev->password, password, sizeof(dev->password));
272 dev->password_valid = true;
273 wpa_printf(MSG_DEBUG, "PR: password set for " MACSTR,
274 MAC2STR(addr));
275 }
276
277 return 0;
278 }
279
280
pr_encaps_elem(const struct wpabuf * subelems,u32 ie_type)281 static struct wpabuf * pr_encaps_elem(const struct wpabuf *subelems,
282 u32 ie_type)
283 {
284 struct wpabuf *ie = NULL;
285 const u8 *pos, *end;
286 size_t len = 0;
287
288 if (!subelems)
289 return NULL;
290
291 len = wpabuf_len(subelems) + 1000;
292 ie = wpabuf_alloc(len);
293 if (!ie)
294 return NULL;
295
296 pos = wpabuf_head(subelems);
297 end = pos + wpabuf_len(subelems);
298
299 while (end > pos) {
300 size_t frag_len = end - pos;
301
302 if (frag_len > 251)
303 frag_len = 251;
304 wpabuf_put_u8(ie, WLAN_EID_VENDOR_SPECIFIC);
305 wpabuf_put_u8(ie, 4 + frag_len);
306 wpabuf_put_be32(ie, ie_type);
307 wpabuf_put_data(ie, pos, frag_len);
308 pos += frag_len;
309 }
310 return ie;
311 }
312
313
pr_get_ranging_capabilities(struct pr_data * pr,struct pr_capabilities * capab)314 static void pr_get_ranging_capabilities(struct pr_data *pr,
315 struct pr_capabilities *capab)
316 {
317 os_memset(capab, 0, sizeof(struct pr_capabilities));
318
319 if (pr->cfg->dev_name)
320 os_strlcpy(capab->device_name, pr->cfg->dev_name,
321 sizeof(capab->device_name));
322
323 if (pr->cfg->edca_ista_support || pr->cfg->edca_rsta_support)
324 capab->edca_support = true;
325
326 if (pr->cfg->ntb_ista_support || pr->cfg->ntb_rsta_support)
327 capab->ntb_support = true;
328
329 capab->secure_he_ltf = pr->cfg->secure_he_ltf;
330 capab->pasn_type = pr->cfg->pasn_type;
331 capab->support_6ghz = pr->cfg->support_6ghz;
332 }
333
334
pr_get_edca_capabilities(struct pr_data * pr,struct edca_capabilities * capab)335 static void pr_get_edca_capabilities(struct pr_data *pr,
336 struct edca_capabilities *capab)
337 {
338 u16 edca_hw_caps = 0;
339
340 os_memset(capab, 0, sizeof(struct edca_capabilities));
341 capab->ista_support = pr->cfg->edca_ista_support;
342 capab->rsta_support = pr->cfg->edca_rsta_support;
343 os_memcpy(capab->country, pr->cfg->country, 3);
344
345 edca_hw_caps |= (pr->cfg->edca_format_and_bw & EDCA_FORMAT_AND_BW_MASK)
346 << EDCA_FORMAT_AND_BW;
347 edca_hw_caps |= (pr->cfg->max_tx_antenna & EDCA_MAX_TX_ANTENNA_MASK) <<
348 EDCA_MAX_TX_ANTENNA;
349 edca_hw_caps |= (pr->cfg->max_rx_antenna & EDCA_MAX_RX_ANTENNA_MASK) <<
350 EDCA_MAX_RX_ANTENNA;
351
352 capab->edca_hw_caps = edca_hw_caps;
353 os_memcpy(&capab->channels, &pr->cfg->edca_channels,
354 sizeof(struct pr_channels));
355 }
356
357
pr_get_ntb_capabilities(struct pr_data * pr,struct ntb_capabilities * capab)358 static void pr_get_ntb_capabilities(struct pr_data *pr,
359 struct ntb_capabilities *capab)
360 {
361 u32 ntb_hw_caps = 0;
362
363 os_memset(capab, 0, sizeof(struct ntb_capabilities));
364 capab->ista_support = pr->cfg->ntb_ista_support;
365 capab->rsta_support = pr->cfg->ntb_rsta_support;
366 os_memcpy(capab->country, pr->cfg->country, 3);
367 capab->secure_he_ltf = pr->cfg->secure_he_ltf;
368
369 ntb_hw_caps |= (pr->cfg->ntb_format_and_bw & NTB_FORMAT_AND_BW_MASK) <<
370 NTB_FORMAT_AND_BW;
371 ntb_hw_caps |= (pr->cfg->max_tx_ltf_repetations &
372 MAX_TX_LTF_REPETATIONS_MASK) << MAX_TX_LTF_REPETATIONS;
373 ntb_hw_caps |= (pr->cfg->max_rx_ltf_repetations &
374 MAX_RX_LTF_REPETATIONS_MASK) << MAX_RX_LTF_REPETATIONS;
375
376 ntb_hw_caps |= (pr->cfg->max_rx_ltf_total & MAX_RX_LTF_TOTAL_MASK) <<
377 MAX_RX_LTF_TOTAL;
378 ntb_hw_caps |= (pr->cfg->max_tx_ltf_total & MAX_TX_LTF_TOTAL_MASK) <<
379 MAX_TX_LTF_TOTAL;
380
381 ntb_hw_caps |= (pr->cfg->max_rx_sts_le_80 & MAX_RX_STS_LE_80_MASK) <<
382 MAX_RX_STS_LE_80;
383 ntb_hw_caps |= (pr->cfg->max_rx_sts_gt_80 & MAX_RX_STS_GT_80_MASK) <<
384 MAX_RX_STS_GT_80;
385
386 ntb_hw_caps |= (pr->cfg->max_tx_sts_le_80 & MAX_TX_STS_LE_80_MASK) <<
387 MAX_TX_STS_LE_80;
388 ntb_hw_caps |= (pr->cfg->max_tx_sts_gt_80 & MAX_TX_STS_GT_80_MASK) <<
389 MAX_TX_STS_GT_80;
390
391 capab->ntb_hw_caps = ntb_hw_caps;
392 os_memcpy(&capab->channels, &pr->cfg->ntb_channels,
393 sizeof(struct pr_channels));
394 }
395
396
pr_derive_dira(struct pr_data * pr,const u8 * src_addr,struct pr_dira * dira)397 static int pr_derive_dira(struct pr_data *pr, const u8 *src_addr,
398 struct pr_dira *dira)
399 {
400 u8 nonce[DEVICE_IDENTITY_NONCE_LEN];
401 u8 tag[DEVICE_MAX_HASH_LEN];
402 u8 data[DIR_STR_LEN + ETH_ALEN + DEVICE_IDENTITY_NONCE_LEN];
403
404 if (pr->cfg->dik_cipher != DIRA_CIPHER_VERSION_128) {
405 wpa_printf(MSG_INFO, "PR: Unsupported DIRA Cipher version %d",
406 pr->cfg->dik_cipher);
407 return -1;
408 }
409
410 if (pr->cfg->dik_len != DEVICE_IDENTITY_KEY_LEN) {
411 wpa_printf(MSG_INFO, "PR: Invalid DIK length %zu",
412 pr->cfg->dik_len);
413 return -1;
414 }
415
416 os_memset(data, 0, sizeof(data));
417
418 if (os_get_random(nonce, DEVICE_IDENTITY_NONCE_LEN) < 0) {
419 wpa_printf(MSG_INFO, "PR: Failed to generate DIRA nonce");
420 return -1;
421 }
422
423 /* Tag = Truncate-64(HMAC-SHA-256(DevIK, "DIR" || PR Device Address ||
424 * Nonce))
425 */
426 os_memcpy(data, "DIR", DIR_STR_LEN);
427 os_memcpy(&data[DIR_STR_LEN], src_addr, ETH_ALEN);
428 os_memcpy(&data[DIR_STR_LEN + ETH_ALEN], nonce,
429 DEVICE_IDENTITY_NONCE_LEN);
430
431 if (hmac_sha256(pr->cfg->dik_data, pr->cfg->dik_len, data, sizeof(data),
432 tag) < 0) {
433 wpa_printf(MSG_ERROR, "PR: Could not derive DIRA tag");
434 return -1;
435 }
436
437 os_memset(dira, 0, sizeof(struct pr_dira));
438 dira->cipher_version = pr->cfg->dik_cipher;
439 dira->nonce_len = DEVICE_IDENTITY_NONCE_LEN;
440 os_memcpy(dira->nonce, nonce, DEVICE_IDENTITY_NONCE_LEN);
441 dira->tag_len = DEVICE_IDENTITY_TAG_LEN;
442 os_memcpy(dira->tag, tag, DEVICE_IDENTITY_TAG_LEN);
443
444 wpa_hexdump_key(MSG_DEBUG, "PR: DIK", pr->cfg->dik_data,
445 pr->cfg->dik_len);
446 wpa_hexdump(MSG_DEBUG, "PR: DIRA-NONCE", dira->nonce, dira->nonce_len);
447 wpa_hexdump(MSG_DEBUG, "PR: DIRA-TAG", dira->tag, dira->tag_len);
448
449 return 0;
450 }
451
452
pr_validate_dira(struct pr_data * pr,struct pr_device * dev,const u8 * dira,u16 dira_len)453 static int pr_validate_dira(struct pr_data *pr, struct pr_device *dev,
454 const u8 *dira, u16 dira_len)
455 {
456 int ret;
457 size_t len[3];
458 const u8 *addr[3];
459 struct pr_dev_ik *dev_ik;
460 u8 tag[DEVICE_MAX_HASH_LEN];
461 const char *label = "DIR";
462 const u8 *dira_nonce, *dira_tag;
463
464 /* Reset DevIK state - set only if DIRA verification succeeds */
465 os_memset(dev->dik, 0, DEVICE_IDENTITY_KEY_LEN);
466 dev->dik_valid = false;
467
468 if (dira_len < 1 + DEVICE_IDENTITY_NONCE_LEN + DEVICE_IDENTITY_TAG_LEN)
469 {
470 wpa_printf(MSG_DEBUG, "PR: Truncated DIRA (length %u)",
471 dira_len);
472 return -1;
473 }
474
475 /* Cipher Version */
476 if (dira[0] != DIRA_CIPHER_VERSION_128) {
477 wpa_printf(MSG_DEBUG, "PR: Unsupported DIRA cipher version %d",
478 dira[0]);
479 return -1;
480 }
481
482 /* Nonce */
483 dira_nonce = &dira[1];
484
485 /* Tag */
486 dira_tag = &dira[1 + DEVICE_IDENTITY_NONCE_LEN];
487
488 /* Tag = Truncate-64(HMAC-SHA-256(DevIK, "DIR" || Device Address ||
489 * Nonce)) */
490 addr[0] = (const u8 *) label;
491 len[0] = DIR_STR_LEN;
492 addr[1] = dev->pr_device_addr;
493 len[1] = ETH_ALEN;
494 addr[2] = dira_nonce;
495 len[2] = DEVICE_IDENTITY_NONCE_LEN;
496
497 dl_list_for_each(dev_ik, &pr->dev_iks, struct pr_dev_ik, list) {
498 ret = hmac_sha256_vector(dev_ik->dik, DEVICE_IDENTITY_KEY_LEN,
499 3, addr, len, tag);
500 if (ret < 0) {
501 wpa_printf(MSG_INFO,
502 "PR: Failed to derive DIRA Tag");
503 return -1;
504 }
505
506 if (os_memcmp(tag, dira_tag, DEVICE_IDENTITY_TAG_LEN) == 0) {
507 wpa_printf(MSG_DEBUG, "PR: DIRA Tag matched");
508 if (dev_ik->password_valid) {
509 os_strlcpy(dev->password, dev_ik->password,
510 sizeof(dev->password));
511 dev->password_valid = true;
512 }
513 if (dev_ik->pmk_valid) {
514 os_memcpy(dev->pmk, dev_ik->pmk,
515 dev_ik->pmk_len);
516 dev->pmk_len = dev_ik->pmk_len;
517 dev->pmk_valid = true;
518 }
519 os_memcpy(dev->dik, dev_ik->dik,
520 DEVICE_IDENTITY_KEY_LEN);
521 dev->dik_valid = true;
522 return 0;
523 }
524 }
525
526 return -1;
527 }
528
529
530 #ifdef CONFIG_PASN
531
pr_copy_channels(struct pr_channels * dst,const struct pr_channels * src,bool allow_6ghz)532 static void pr_copy_channels(struct pr_channels *dst,
533 const struct pr_channels *src, bool allow_6ghz)
534 {
535 size_t i, j;
536
537 if (allow_6ghz) {
538 os_memcpy(dst, src, sizeof(struct pr_channels));
539 return;
540 }
541
542 for (i = 0, j = 0; i < src->op_classes; i++) {
543 if (is_6ghz_op_class(src->op_class[i].op_class))
544 continue;
545 os_memcpy(&dst->op_class[j], &src->op_class[i],
546 sizeof(struct pr_op_class));
547 j++;
548 }
549 dst->op_classes = j;
550 }
551
552
pr_op_class_intersect(const struct pr_op_class * a,const struct pr_op_class * b,struct pr_op_class * res)553 static void pr_op_class_intersect(const struct pr_op_class *a,
554 const struct pr_op_class *b,
555 struct pr_op_class *res)
556 {
557 size_t i, j;
558
559 res->op_class = a->op_class;
560 for (i = 0; i < a->channels; i++) {
561 for (j = 0; j < b->channels; j++) {
562 if (a->channel[i] != b->channel[j])
563 continue;
564 res->channel[res->channels] = a->channel[i];
565 res->channels++;
566 if (res->channels == PR_MAX_OP_CLASS_CHANNELS)
567 return;
568 }
569 }
570 }
571
572
573 /**
574 * pr_channels_intersect - Intersection of supported channel lists
575 * @a: First set of supported channels
576 * @b: Second set of supported channels
577 * @res: Data structure for returning the intersection of supported channels
578 *
579 * This function can be used to find a common set of supported channels. Both
580 * input channel sets are assumed to use the global operating classes or the
581 * same country code. If different country codes are used without using the
582 * global operating classes, the operating class numbers may not be matched
583 * correctly and results are undefined.
584 */
pr_channels_intersect(const struct pr_channels * a,const struct pr_channels * b,struct pr_channels * res)585 static void pr_channels_intersect(const struct pr_channels *a,
586 const struct pr_channels *b,
587 struct pr_channels *res)
588 {
589 size_t i, j;
590 const struct pr_op_class *a_op;
591 const struct pr_op_class *b_op;
592
593 os_memset(res, 0, sizeof(*res));
594
595 for (i = 0; i < a->op_classes; i++) {
596 a_op = &a->op_class[i];
597 for (j = 0; j < b->op_classes; j++) {
598 b_op = &b->op_class[j];
599 if (a_op->op_class != b_op->op_class)
600 continue;
601 pr_op_class_intersect(a_op, b_op,
602 &res->op_class[res->op_classes]);
603 if (res->op_class[res->op_classes].channels) {
604 res->op_classes++;
605 if (res->op_classes == PR_MAX_OP_CLASSES)
606 return;
607 }
608 }
609 }
610 }
611
612 #endif /* CONFIG_PASN */
613
614
pr_buf_add_channel_list(struct wpabuf * buf,const char * country,const struct pr_channels * chan)615 static void pr_buf_add_channel_list(struct wpabuf *buf, const char *country,
616 const struct pr_channels *chan)
617 {
618 size_t i;
619
620 wpabuf_put_data(buf, country, 3); /* Country String */
621 wpabuf_put_u8(buf, chan->op_classes); /* Number of Channel Entries */
622
623 /* Channel Entry List */
624 for (i = 0; i < chan->op_classes; i++) {
625 const struct pr_op_class *c = &chan->op_class[i];
626
627 wpabuf_put_u8(buf, c->op_class);
628 wpabuf_put_u8(buf, c->channels);
629 wpabuf_put_data(buf, c->channel, c->channels);
630 }
631 }
632
633
pr_buf_add_ranging_capa_info(struct wpabuf * buf,const struct pr_capabilities * capab)634 static void pr_buf_add_ranging_capa_info(struct wpabuf *buf,
635 const struct pr_capabilities *capab)
636 {
637 u8 *len;
638 u8 capa_6g = 0;
639 u8 protocol_type = 0;
640 size_t _len;
641
642 /* Proximity Ranging Capability Attribute */
643 wpabuf_put_u8(buf, PR_ATTR_RANGING_CAPABILITY);
644 len = wpabuf_put(buf, 2); /* Attribute length to be filled */
645
646 /* Ranging Protocol Type */
647 if (capab->edca_support)
648 protocol_type |= PR_EDCA_BASED_RANGING;
649 if (capab->ntb_support && capab->secure_he_ltf)
650 protocol_type |= PR_NTB_SECURE_LTF_BASED_RANGING;
651 if (capab->ntb_support)
652 protocol_type |= PR_NTB_OPEN_BASED_RANGING;
653 wpabuf_put_u8(buf, protocol_type);
654
655 /* PASN Type */
656 wpabuf_put_u8(buf, capab->pasn_type);
657
658 /* 6GHz band */
659 if (capab->support_6ghz)
660 capa_6g |= BIT(0);
661
662 wpabuf_put_u8(buf, capa_6g);
663
664 /* Device Name */
665 wpabuf_put_data(buf, capab->device_name, WPS_DEV_NAME_MAX_LEN);
666 wpa_printf(MSG_DEBUG, "PR: Device name: %s", capab->device_name);
667
668 _len = (u8 *) wpabuf_put(buf, 0) - len - 2;
669 WPA_PUT_LE16(len, _len);
670 wpa_hexdump(MSG_DEBUG, "PR: * Capability Attribute", len + 2, _len);
671 }
672
673
pr_buf_add_edca_capa_info(struct wpabuf * buf,const struct edca_capabilities * edca_data)674 static void pr_buf_add_edca_capa_info(struct wpabuf *buf,
675 const struct edca_capabilities *edca_data)
676 {
677 u8 *len;
678 u8 ranging_role = 0;
679 size_t _len;
680
681 /* Proximity Ranging EDCA Capability Attribute */
682 wpabuf_put_u8(buf, PR_ATTR_EDCA_CAPABILITY);
683 len = wpabuf_put(buf, 2); /* Attribute length to be filled */
684
685 /* Ranging Role */
686 if (edca_data->ista_support)
687 ranging_role |= PR_ISTA_SUPPORT;
688 if (edca_data->rsta_support)
689 ranging_role |= PR_RSTA_SUPPORT;
690 wpabuf_put_u8(buf, ranging_role);
691
692 /* Ranging Parameters */
693 wpabuf_put_le16(buf, edca_data->edca_hw_caps);
694
695 pr_buf_add_channel_list(buf, edca_data->country, &edca_data->channels);
696
697 _len = (u8 *) wpabuf_put(buf, 0) - len - 2;
698 WPA_PUT_LE16(len, _len);
699 wpa_hexdump(MSG_DEBUG, "PR: * EDCA Capability Attribute",
700 len + 2, _len);
701 }
702
703
pr_buf_add_ntb_capa_info(struct wpabuf * buf,const struct ntb_capabilities * ntb_data)704 static void pr_buf_add_ntb_capa_info(struct wpabuf *buf,
705 const struct ntb_capabilities *ntb_data)
706 {
707 u8 *len;
708 u8 ranging_role = 0;
709 size_t _len;
710
711 /* Proximity Ranging 11az NTB Capability Attribute */
712 wpabuf_put_u8(buf, PR_ATTR_NTB_CAPABILITY);
713 len = wpabuf_put(buf, 2);
714
715 /* Ranging Role */
716 if (ntb_data->ista_support)
717 ranging_role |= PR_ISTA_SUPPORT;
718 if (ntb_data->rsta_support)
719 ranging_role |= PR_RSTA_SUPPORT;
720 wpabuf_put_u8(buf, ranging_role);
721
722 /* Ranging Parameter */
723 wpabuf_put_le32(buf, ntb_data->ntb_hw_caps);
724
725 pr_buf_add_channel_list(buf, ntb_data->country, &ntb_data->channels);
726
727 _len = (u8 *) wpabuf_put(buf, 0) - len - 2;
728 WPA_PUT_LE16(len, _len);
729 wpa_hexdump(MSG_DEBUG, "PR: * NTB Capability Attribute", len + 2, _len);
730 }
731
732
pr_buf_add_dira(struct wpabuf * buf,const struct pr_dira * dira)733 static void pr_buf_add_dira(struct wpabuf *buf, const struct pr_dira *dira)
734 {
735 u8 *len;
736 size_t _len;
737
738 /* Proximity Ranging Device Identity Resolution attribute */
739 wpabuf_put_u8(buf, PR_ATTR_DEVICE_IDENTITY_RESOLUTION);
740
741 /* Length to be filled */
742 len = wpabuf_put(buf, 2);
743
744 wpabuf_put_u8(buf, dira->cipher_version);
745 wpabuf_put_data(buf, dira->nonce, dira->nonce_len);
746 wpabuf_put_data(buf, dira->tag, dira->tag_len);
747
748 /* Update attribute length */
749 _len = (u8 *) wpabuf_put(buf, 0) - len - 2;
750 WPA_PUT_LE16(len, _len);
751
752 wpa_printf(MSG_DEBUG, "PR: * DIRA");
753 }
754
755
pr_prepare_usd_elems(struct pr_data * pr,const u8 * src_addr)756 struct wpabuf * pr_prepare_usd_elems(struct pr_data *pr, const u8 *src_addr)
757 {
758 u32 ie_type;
759 struct wpabuf *buf, *buf2;
760 struct pr_capabilities pr_caps;
761 struct pr_dira dira;
762
763 buf = wpabuf_alloc(1000);
764 if (!buf)
765 return NULL;
766
767 pr_get_ranging_capabilities(pr, &pr_caps);
768 pr_buf_add_ranging_capa_info(buf, &pr_caps);
769
770 if (pr->cfg->edca_ista_support || pr->cfg->edca_rsta_support) {
771 struct edca_capabilities edca_caps;
772
773 pr_get_edca_capabilities(pr, &edca_caps);
774 pr_buf_add_edca_capa_info(buf, &edca_caps);
775 }
776
777 if (pr->cfg->ntb_ista_support || pr->cfg->ntb_rsta_support) {
778 struct ntb_capabilities ntb_caps;
779
780 pr_get_ntb_capabilities(pr, &ntb_caps);
781 pr_buf_add_ntb_capa_info(buf, &ntb_caps);
782 }
783
784 if (!pr_derive_dira(pr, src_addr, &dira))
785 pr_buf_add_dira(buf, &dira);
786
787 ie_type = (OUI_WFA << 8) | PR_OUI_TYPE;
788 buf2 = pr_encaps_elem(buf, ie_type);
789 wpabuf_free(buf);
790
791 return buf2;
792 }
793
794
pr_parse_attribute(u8 id,const u8 * data,u16 len,struct pr_message * msg)795 static int pr_parse_attribute(u8 id, const u8 *data, u16 len,
796 struct pr_message *msg)
797 {
798 switch (id) {
799 case PR_ATTR_STATUS:
800 if (len < 1) {
801 wpa_printf(MSG_INFO,
802 "PR: Invalid Proximity Ranging Status Attribute (length %d)",
803 len);
804 return -1;
805 }
806 msg->status_ie = data;
807 msg->status_ie_len = len;
808 wpa_printf(MSG_DEBUG, "PR: Status Code %u", data[0]);
809 break;
810 case PR_ATTR_RANGING_CAPABILITY:
811 if (len < 35) {
812 wpa_printf(MSG_INFO,
813 "PR: Too short Proximity Ranging Capability Attribute (length %d)",
814 len);
815 return -1;
816 }
817 msg->pr_capability = data;
818 msg->pr_capability_len = len;
819 wpa_printf(MSG_DEBUG,
820 "PR: Ranging Protocol Type: %02x PASN Type: %02x",
821 data[0], data[1]);
822 break;
823 case PR_ATTR_EDCA_CAPABILITY:
824 if (len < 10) {
825 wpa_printf(MSG_INFO,
826 "PR: Too short Proximity Ranging EDCA Capability Attribute (length %d)",
827 len);
828 return -1;
829 }
830 msg->edca_capability = data;
831 msg->edca_capability_len = len;
832 wpa_printf(MSG_DEBUG,
833 "PR: EDCA Ranging Role %02x, Ranging Parameters %04x",
834 data[0], WPA_GET_LE16(data + 1));
835 break;
836 case PR_ATTR_NTB_CAPABILITY:
837 if (len < 12) {
838 wpa_printf(MSG_INFO,
839 "PR: Too short Proximity Ranging 11az NTB Capability Attribute (length %d)",
840 len);
841 return -1;
842 }
843 msg->ntb_capability = data;
844 msg->ntb_capability_len = len;
845 wpa_printf(MSG_DEBUG,
846 "PR: NTB Ranging Role %02x, Ranging Parameter %04x",
847 data[0], WPA_GET_LE32(data + 1));
848 break;
849 case PR_ATTR_OPERATION_MODE:
850 if (len < 9) {
851 wpa_printf(MSG_INFO,
852 "PR: Invalid Proximity Ranging Operation Mode Attribute (length %d)",
853 len);
854 return -1;
855 }
856 msg->op_mode = data;
857 msg->op_mode_len = len;
858 break;
859 case PR_ATTR_DEVICE_IDENTITY_RESOLUTION:
860 if (len < 1 + DEVICE_IDENTITY_NONCE_LEN +
861 DEVICE_IDENTITY_TAG_LEN) {
862 wpa_printf(MSG_INFO, "PR: Too short DIRA (length %d)",
863 len);
864 return -1;
865 }
866 msg->dira = data;
867 msg->dira_len = len;
868 wpa_printf(MSG_DEBUG, "PR: DIRA cipher version %u", data[0]);
869 break;
870 default:
871 wpa_printf(MSG_DEBUG,
872 "PR: Skipped unknown attribute %d (length %d)",
873 id, len);
874 break;
875 }
876
877 return 0;
878 }
879
880
881 /**
882 * pr_parse_proximity_ranging_element - Parse Proximity Ranging element
883 * @buf: Concatenated PR element(s) payload
884 * @msg: Buffer for returning parsed attributes
885 * Returns: 0 on success, -1 on failure
886 *
887 * Note: The caller is responsible for clearing the msg data structure before
888 * calling this function.
889 */
pr_parse_proximity_ranging_element(const struct wpabuf * buf,struct pr_message * msg)890 static int pr_parse_proximity_ranging_element(const struct wpabuf *buf,
891 struct pr_message *msg)
892 {
893 const u8 *pos = wpabuf_head_u8(buf);
894 const u8 *end = pos + wpabuf_len(buf);
895
896 wpa_printf(MSG_DEBUG, "PR: Parsing Proximity Ranging element");
897
898 while (pos < end) {
899 u16 attr_len;
900 u8 id;
901
902 if (end - pos < 3) {
903 wpa_printf(MSG_DEBUG, "PR: Invalid PR attribute");
904 return -1;
905 }
906 id = *pos++;
907 attr_len = WPA_GET_LE16(pos);
908 pos += 2;
909 wpa_printf(MSG_DEBUG, "PR: Attribute %d length %u",
910 id, attr_len);
911 if (attr_len > end - pos) {
912 wpa_printf(MSG_DEBUG,
913 "PR: Attribute underflow (len=%u left=%d)",
914 attr_len, (int) (end - pos));
915 wpa_hexdump(MSG_MSGDUMP, "PR: Data", pos, end - pos);
916 return -1;
917 }
918 if (pr_parse_attribute(id, pos, attr_len, msg))
919 return -1;
920 pos += attr_len;
921 }
922
923 return 0;
924 }
925
926
pr_parse_free(struct pr_message * msg)927 static void pr_parse_free(struct pr_message *msg)
928 {
929 wpabuf_free(msg->pr_attributes);
930 msg->pr_attributes = NULL;
931 }
932
933
934 /**
935 * pr_parse_elements - Parse Proximity Ranging element(s)
936 * @data: Elements from the message
937 * @len: Length of data buffer in octets
938 * @msg: Buffer for returning parsed attributes
939 * Returns: 0 on success, -1 on failure
940 *
941 * Note: The caller is responsible for clearing the msg data structure before
942 * calling this function.
943 *
944 * Note: The caller must free temporary memory allocations by calling
945 * pr_parse_free() when the parsed data is not needed anymore.
946 */
pr_parse_elements(const u8 * data,size_t len,struct pr_message * msg)947 static int pr_parse_elements(const u8 *data, size_t len, struct pr_message *msg)
948 {
949 struct ieee802_11_elems elems;
950
951 if (ieee802_11_parse_elems(data, len, &elems, true) == ParseFailed)
952 return -1;
953
954 msg->pr_attributes = ieee802_11_vendor_ie_concat(data, len,
955 PR_IE_VENDOR_TYPE);
956 if (msg->pr_attributes &&
957 pr_parse_proximity_ranging_element(msg->pr_attributes, msg)) {
958 wpa_printf(MSG_INFO,
959 "PR: Failed to parse Proximity Ranging element data");
960 if (msg->pr_attributes)
961 wpa_hexdump_buf(MSG_MSGDUMP,
962 "PR: Proximity Ranging element payload",
963 msg->pr_attributes);
964 pr_parse_free(msg);
965 return -1;
966 }
967 return 0;
968 }
969
970
pr_process_channels(const u8 * channel_list,size_t channel_list_len,struct pr_channels * ch)971 static int pr_process_channels(const u8 *channel_list, size_t channel_list_len,
972 struct pr_channels *ch)
973 {
974 u8 channels;
975 const u8 *pos, *end;
976 u8 op_class_count;
977
978 if (channel_list_len < 1)
979 return -1;
980
981 pos = channel_list;
982 end = channel_list + channel_list_len;
983
984 /* Number of Channel Entries */
985 /* Get total count of the operational classes */
986 op_class_count = pos[0];
987 wpa_printf(MSG_DEBUG, "PR: Total operational classes: %u",
988 op_class_count);
989 pos++;
990
991 /* Channel Entry List */
992 ch->op_classes = 0;
993 while (end - pos > 2 && (ch->op_classes <= op_class_count)) {
994 struct pr_op_class *cl = &ch->op_class[ch->op_classes];
995
996 cl->op_class = *pos++; /* Operating Class */
997 channels = *pos++; /* Number of Channels */
998
999 /* Channel List */
1000 if (channels > end - pos) {
1001 wpa_printf(MSG_INFO,
1002 "PR: Invalid channel list channel %d, size: %ld",
1003 channels, end - pos);
1004 return -1;
1005 }
1006 cl->channels = channels > PR_MAX_OP_CLASS_CHANNELS ?
1007 PR_MAX_OP_CLASS_CHANNELS : channels;
1008 os_memcpy(cl->channel, pos, cl->channels);
1009 pos += channels;
1010 ch->op_classes++;
1011 if (ch->op_classes == PR_MAX_OP_CLASSES)
1012 break;
1013 }
1014
1015 if (ch->op_classes != op_class_count &&
1016 ch->op_classes < PR_MAX_OP_CLASSES) {
1017 wpa_printf(MSG_INFO,
1018 "PR: Channel list count mismatch %lu != %d",
1019 ch->op_classes, op_class_count);
1020 return -1;
1021 }
1022
1023 return 0;
1024 }
1025
1026
pr_process_ranging_capabilities(const u8 * caps,size_t caps_len,struct pr_capabilities * pr_caps)1027 static void pr_process_ranging_capabilities(const u8 *caps, size_t caps_len,
1028 struct pr_capabilities *pr_caps)
1029 {
1030 const u8 *pos;
1031
1032 if (!caps || caps_len < 3 + WPS_DEV_NAME_MAX_LEN) {
1033 wpa_printf(MSG_INFO,
1034 "PR: Invalid Proximity Ranging Capability Attribute");
1035 return;
1036 }
1037
1038 pos = caps;
1039
1040 /* Ranging Protocol Type */
1041 if (*pos & PR_EDCA_BASED_RANGING)
1042 pr_caps->edca_support = true;
1043 if (*pos & PR_NTB_SECURE_LTF_BASED_RANGING) {
1044 pr_caps->secure_he_ltf = true;
1045 pr_caps->ntb_support = true;
1046 }
1047 if (*pos & PR_NTB_OPEN_BASED_RANGING)
1048 pr_caps->ntb_support = true;
1049
1050 pos++;
1051 /* PASN Type */
1052 pr_caps->pasn_type = *pos;
1053
1054 pos++;
1055 /* 6GHz band */
1056 pr_caps->support_6ghz = *pos & BIT(0);
1057
1058 pos++;
1059 /* Device Name */
1060 os_memset(pr_caps->device_name, 0, WPS_DEV_NAME_MAX_LEN + 1);
1061 os_memcpy(pr_caps->device_name, pos, WPS_DEV_NAME_MAX_LEN);
1062
1063 wpa_printf(MSG_DEBUG,
1064 "PR: Device name=%s, edca capability=%x, ntb capability=%x, secure LTF capability=%u, 6GHz=%u",
1065 pr_caps->device_name, pr_caps->edca_support,
1066 pr_caps->ntb_support, pr_caps->secure_he_ltf,
1067 pr_caps->support_6ghz);
1068 }
1069
1070
pr_process_edca_capabilities(const u8 * caps,size_t caps_len,struct edca_capabilities * edca_caps)1071 static void pr_process_edca_capabilities(const u8 *caps, size_t caps_len,
1072 struct edca_capabilities *edca_caps)
1073 {
1074 const u8 *pos, *end;
1075
1076 if (caps_len < 7)
1077 return;
1078
1079 pos = caps;
1080 end = caps + caps_len;
1081
1082 /* Ranging Role */
1083 if (*pos & PR_ISTA_SUPPORT)
1084 edca_caps->ista_support = true;
1085 if (*pos & PR_RSTA_SUPPORT)
1086 edca_caps->rsta_support = true;
1087 pos++;
1088
1089 /* Ranging Parameters */
1090 edca_caps->edca_hw_caps = WPA_GET_LE16(pos);
1091 pos += 2;
1092
1093 /* Country String */
1094 os_memcpy(edca_caps->country, pos, 3);
1095 pos += 3;
1096
1097 pr_process_channels(pos, end - pos, &edca_caps->channels);
1098
1099 wpa_printf(MSG_DEBUG,
1100 "PR: EDCA ISTA support=%u, EDCA RSTA support=%u, op classes count=%lu, country=%c%c",
1101 edca_caps->ista_support, edca_caps->rsta_support,
1102 edca_caps->channels.op_classes,
1103 valid_country_ch(edca_caps->country[0]) ?
1104 edca_caps->country[0] : '_',
1105 valid_country_ch(edca_caps->country[1]) ?
1106 edca_caps->country[1] : '_');
1107 }
1108
1109
pr_process_ntb_capabilities(const u8 * caps,size_t caps_len,struct ntb_capabilities * ntb_caps,bool secure_ltf)1110 static void pr_process_ntb_capabilities(const u8 *caps, size_t caps_len,
1111 struct ntb_capabilities *ntb_caps,
1112 bool secure_ltf)
1113 {
1114 const u8 *pos, *end;
1115
1116 if (caps_len < 9)
1117 return;
1118
1119 pos = caps;
1120 end = caps + caps_len;
1121
1122 /* Ranging Role */
1123 if (*pos & PR_ISTA_SUPPORT)
1124 ntb_caps->ista_support = true;
1125 if (*pos & PR_RSTA_SUPPORT)
1126 ntb_caps->rsta_support = true;
1127 if (secure_ltf)
1128 ntb_caps->secure_he_ltf = true;
1129 pos++;
1130
1131 /* Ranging Parameter */
1132 ntb_caps->ntb_hw_caps = WPA_GET_LE32(pos);
1133 pos += 4;
1134
1135 /* Country String */
1136 os_memcpy(ntb_caps->country, pos, 3);
1137 pos += 3;
1138
1139 pr_process_channels(pos, end - pos, &ntb_caps->channels);
1140
1141 wpa_printf(MSG_DEBUG,
1142 "PR: NTB ISTA support=%u, NTB RSTA support=%u, op classes count=%lu, secure HE-LTF=%u, country=%c%c",
1143 ntb_caps->ista_support, ntb_caps->rsta_support,
1144 ntb_caps->channels.op_classes,
1145 ntb_caps->secure_he_ltf,
1146 valid_country_ch(ntb_caps->country[0]) ?
1147 ntb_caps->country[0] : '_',
1148 valid_country_ch(ntb_caps->country[1]) ?
1149 ntb_caps->country[1] : '_');
1150 }
1151
1152
pr_process_usd_elems(struct pr_data * pr,const u8 * ies,u16 ies_len,const u8 * peer_addr,unsigned int freq)1153 void pr_process_usd_elems(struct pr_data *pr, const u8 *ies, u16 ies_len,
1154 const u8 *peer_addr, unsigned int freq)
1155 {
1156 struct pr_device *dev;
1157 struct pr_message msg;
1158
1159 os_memset(&msg, 0, sizeof(msg));
1160 os_memcpy(msg.pr_device_addr, peer_addr, ETH_ALEN);
1161
1162 if (pr_parse_elements(ies, ies_len, &msg)) {
1163 wpa_printf(MSG_INFO,
1164 "PR: Failed to parse Proximity Ranging element(s)");
1165 pr_parse_free(&msg);
1166 return;
1167 }
1168
1169 if (!msg.pr_capability) {
1170 wpa_printf(MSG_DEBUG,
1171 "PR: Ranging caps not present, ignoring proximity device "
1172 MACSTR, MAC2STR(peer_addr));
1173 pr_parse_free(&msg);
1174 return;
1175 }
1176
1177 if (!msg.edca_capability && !msg.ntb_capability) {
1178 wpa_printf(MSG_DEBUG,
1179 "PR: Neither EDCA nor NTB capabilities are present, ignoring proximity device "
1180 MACSTR, MAC2STR(peer_addr));
1181 pr_parse_free(&msg);
1182 return;
1183 }
1184
1185 dev = pr_create_device(pr, peer_addr);
1186 if (!dev) {
1187 pr_parse_free(&msg);
1188 wpa_printf(MSG_INFO, "PR: Failed to create a device");
1189 return;
1190 }
1191
1192 os_get_reltime(&dev->last_seen);
1193 dev->listen_freq = freq;
1194 dev->discovery_type = PR_DISCOVERY_TYPE_USD;
1195
1196 pr_process_ranging_capabilities(msg.pr_capability,
1197 msg.pr_capability_len, &dev->pr_caps);
1198
1199 if (dev->pr_caps.edca_support && msg.edca_capability)
1200 pr_process_edca_capabilities(msg.edca_capability,
1201 msg.edca_capability_len,
1202 &dev->edca_caps);
1203
1204 if (dev->pr_caps.ntb_support && msg.ntb_capability)
1205 pr_process_ntb_capabilities(msg.ntb_capability,
1206 msg.ntb_capability_len,
1207 &dev->ntb_caps,
1208 dev->pr_caps.secure_he_ltf);
1209
1210 if (msg.dira && msg.dira_len)
1211 pr_validate_dira(pr, dev, msg.dira, msg.dira_len);
1212
1213 if (pr->cfg->device_found)
1214 pr->cfg->device_found(pr->cfg->cb_ctx, dev);
1215
1216 pr_parse_free(&msg);
1217 }
1218
1219
1220 /**
1221 * pr_ensure_oob_peer - Add a minimal OOB peer entry if not already present
1222 */
pr_ensure_oob_peer(struct pr_data * pr,const u8 * addr,int freq)1223 int pr_ensure_oob_peer(struct pr_data *pr, const u8 *addr, int freq)
1224 {
1225 struct pr_device *dev;
1226
1227 if (!pr || !addr)
1228 return -1;
1229
1230 dev = pr_get_device(pr, addr);
1231 if (dev)
1232 return 0;
1233
1234 dev = pr_create_device(pr, addr);
1235 if (!dev) {
1236 wpa_printf(MSG_INFO, "PR: Failed to create OOB peer " MACSTR,
1237 MAC2STR(addr));
1238 return -1;
1239 }
1240
1241 dev->discovery_type = PR_DISCOVERY_TYPE_OOB;
1242 if (freq)
1243 dev->listen_freq = freq;
1244
1245 wpa_printf(MSG_DEBUG, "PR: OOB peer " MACSTR " created at PASN_START",
1246 MAC2STR(addr));
1247 return 0;
1248 }
1249
1250
1251 #ifdef CONFIG_PASN
1252
pr_eq_ranging_capa_params(const struct pr_device * dev,const struct pr_capabilities * caps)1253 static bool pr_eq_ranging_capa_params(const struct pr_device *dev,
1254 const struct pr_capabilities *caps)
1255 {
1256 if (dev->discovery_type == PR_DISCOVERY_TYPE_OOB)
1257 return true;
1258
1259 return dev->pr_caps.edca_support == caps->edca_support &&
1260 dev->pr_caps.ntb_support == caps->ntb_support &&
1261 dev->pr_caps.pasn_type == caps->pasn_type &&
1262 dev->pr_caps.secure_he_ltf == caps->secure_he_ltf &&
1263 dev->pr_caps.support_6ghz == caps->support_6ghz &&
1264 os_strcmp(dev->pr_caps.device_name, caps->device_name) == 0;
1265 }
1266
1267
pr_eq_edca_params(const struct pr_device * dev,const struct edca_capabilities * edca_caps)1268 static bool pr_eq_edca_params(const struct pr_device *dev,
1269 const struct edca_capabilities *edca_caps)
1270 {
1271 if (dev->discovery_type == PR_DISCOVERY_TYPE_OOB)
1272 return true;
1273
1274 return dev->edca_caps.ista_support == edca_caps->ista_support &&
1275 dev->edca_caps.rsta_support == edca_caps->rsta_support &&
1276 dev->edca_caps.edca_hw_caps == edca_caps->edca_hw_caps &&
1277 os_memcmp(dev->edca_caps.country, edca_caps->country, 3) == 0;
1278 }
1279
1280
pr_eq_ntb_params(const struct pr_device * dev,const struct ntb_capabilities * ntb_caps)1281 static bool pr_eq_ntb_params(const struct pr_device *dev,
1282 const struct ntb_capabilities *ntb_caps)
1283 {
1284 if (dev->discovery_type == PR_DISCOVERY_TYPE_OOB)
1285 return true;
1286
1287 return dev->ntb_caps.ista_support == ntb_caps->ista_support &&
1288 dev->ntb_caps.rsta_support == ntb_caps->rsta_support &&
1289 dev->ntb_caps.ntb_hw_caps == ntb_caps->ntb_hw_caps &&
1290 os_memcmp(dev->ntb_caps.country, ntb_caps->country, 3) == 0;
1291 }
1292
1293
pr_buf_add_operation_mode(struct wpabuf * buf,struct operation_mode * mode)1294 static void pr_buf_add_operation_mode(struct wpabuf *buf,
1295 struct operation_mode *mode)
1296 {
1297 u8 *len;
1298 size_t _len;
1299
1300 /* Proximity Ranging Operation Mode Attribute */
1301 wpabuf_put_u8(buf, PR_ATTR_OPERATION_MODE);
1302 /* Length to be filled */
1303 len = wpabuf_put(buf, 2);
1304
1305 /* Ranging Protocol Type */
1306 wpabuf_put_u8(buf, mode->protocol_type);
1307
1308 /* Ranging Role */
1309 wpabuf_put_u8(buf, mode->role);
1310
1311 pr_buf_add_channel_list(buf, mode->country, &mode->channels);
1312
1313 /* Update attribute length */
1314 _len = (u8 *) wpabuf_put(buf, 0) - len - 2;
1315 WPA_PUT_LE16(len, _len);
1316 wpa_hexdump(MSG_DEBUG, "PR: * Operation Mode", len + 2, _len);
1317 }
1318
1319
pr_buf_add_ranging_neg_status(struct wpabuf * buf,u8 status)1320 static void pr_buf_add_ranging_neg_status(struct wpabuf *buf, u8 status)
1321 {
1322 /* Proximity Ranging Status Attribute */
1323 wpabuf_put_u8(buf, PR_ATTR_STATUS);
1324 wpabuf_put_le16(buf, 1);
1325 wpabuf_put_u8(buf, status);
1326 wpa_printf(MSG_DEBUG, "PR: * Role negotiation status %u", status);
1327 }
1328
1329
pr_process_op_mode(const u8 * caps,size_t caps_len,struct operation_mode * op_mode)1330 static void pr_process_op_mode(const u8 *caps, size_t caps_len,
1331 struct operation_mode *op_mode)
1332 {
1333 const u8 *pos, *end;
1334
1335 if (!caps || caps_len < 6)
1336 return;
1337
1338 pos = caps;
1339 end = caps + caps_len;
1340
1341 /* Ranging Protocol Type */
1342 op_mode->protocol_type = *pos;
1343 pos++;
1344
1345 /* Ranging Role */
1346 op_mode->role = *pos;
1347 pos++;
1348
1349 /* Country String */
1350 os_memcpy(op_mode->country, pos, 3);
1351 pos += 3;
1352
1353 pr_process_channels(pos, end - pos, &op_mode->channels);
1354
1355 wpa_printf(MSG_DEBUG,
1356 "PR: protocol type=%u, role type=%u, country=%c%c, channel size=%lu",
1357 op_mode->protocol_type, op_mode->role,
1358 valid_country_ch(op_mode->country[0]) ?
1359 op_mode->country[0] : '_',
1360 valid_country_ch(op_mode->country[1]) ?
1361 op_mode->country[1] : '_',
1362 op_mode->channels.op_classes);
1363 }
1364
1365
pr_choose_best_channel(struct pr_channels * common_channel,u8 * op_class,u8 * op_channel)1366 static void pr_choose_best_channel(struct pr_channels *common_channel,
1367 u8 *op_class, u8 *op_channel)
1368 {
1369 int bw;
1370 int max_bw = 0;
1371 const struct oper_class_map *map;
1372 size_t i;
1373
1374 if (!common_channel || !common_channel->op_classes ||
1375 !common_channel->op_class[0].channels) {
1376 wpa_printf(MSG_INFO,
1377 "PR: Empty channel list, cannot get best channel");
1378 *op_class = 0;
1379 *op_channel = 0;
1380 return;
1381 }
1382
1383 for (i = 0; i < common_channel->op_classes; i++) {
1384 map = get_oper_class(NULL,
1385 common_channel->op_class[i].op_class);
1386 if (!map)
1387 continue;
1388 bw = oper_class_bw_to_int(map);
1389 if (bw > max_bw) {
1390 *op_class = common_channel->op_class[i].op_class;
1391 *op_channel = common_channel->op_class[i].channel[0];
1392 max_bw = bw;
1393 }
1394 }
1395
1396 wpa_printf(MSG_DEBUG,
1397 "PR: Choose the operating class: %u, operating channel: %u",
1398 *op_class, *op_channel);
1399 }
1400
1401
pr_pasn_get_best_op_mode(struct pr_data * pr,u8 peer_supp_roles,struct operation_mode * op_mode,struct operation_mode * res_op_mode)1402 static u8 pr_pasn_get_best_op_mode(struct pr_data *pr, u8 peer_supp_roles,
1403 struct operation_mode *op_mode,
1404 struct operation_mode *res_op_mode)
1405 {
1406 u8 ranging_type = 0;
1407 struct pr_channels common_chan;
1408 struct pr_channels *own_channels = NULL;
1409 int status = PR_NEGOTIATION_FAIL;
1410 u8 op_class = 0, op_channel = 0;
1411 bool own_ista_support = false, own_rsta_support = false;
1412
1413 if (op_mode->protocol_type &
1414 (PR_NTB_SECURE_LTF_BASED_RANGING | PR_NTB_OPEN_BASED_RANGING)) {
1415 if (op_mode->protocol_type == PR_NTB_SECURE_LTF_BASED_RANGING &&
1416 !pr->cfg->secure_he_ltf) {
1417 wpa_printf(MSG_INFO,
1418 "PR PASN: Secure HE-LTF not supported");
1419 return PR_NEGOTIATION_FAIL;
1420 }
1421
1422 if ((op_mode->protocol_type &
1423 PR_NTB_SECURE_LTF_BASED_RANGING) && pr->cfg->secure_he_ltf)
1424 ranging_type = PR_NTB_SECURE_LTF_BASED_RANGING;
1425 else
1426 ranging_type = PR_NTB_OPEN_BASED_RANGING;
1427
1428 own_ista_support = pr->cfg->ntb_ista_support;
1429 own_rsta_support = pr->cfg->ntb_rsta_support;
1430 own_channels = &pr->cfg->ntb_channels;
1431 wpa_printf(MSG_DEBUG, "PR PASN: Choose NTB Ranging Protocol");
1432 } else if (op_mode->protocol_type & PR_EDCA_BASED_RANGING) {
1433 ranging_type = PR_EDCA_BASED_RANGING;
1434
1435 own_ista_support = pr->cfg->edca_ista_support;
1436 own_rsta_support = pr->cfg->edca_rsta_support;
1437 own_channels = &pr->cfg->edca_channels;
1438 wpa_printf(MSG_DEBUG, "PR PASN: Choose EDCA Ranging Protocol");
1439 } else {
1440 wpa_printf(MSG_DEBUG,
1441 "PR PASN: Invalid Ranging Protocol, proposed type 0x%x",
1442 op_mode->protocol_type);
1443 return PR_NEGOTIATION_FAIL;
1444 }
1445
1446 if (!own_ista_support && !own_rsta_support) {
1447 wpa_printf(MSG_DEBUG,
1448 "PR PASN: Device can't fulfill any requested Ranging Role");
1449 return PR_NEGOTIATION_FAIL;
1450 }
1451
1452 if (own_channels == NULL || !own_channels->op_classes) {
1453 wpa_printf(MSG_DEBUG,
1454 "PR PASN: Invalid or empty channel list to negotiate");
1455 return PR_NEGOTIATION_FAIL;
1456 }
1457
1458 pr_channels_intersect(own_channels, &op_mode->channels, &common_chan);
1459 if (!common_chan.op_classes) {
1460 wpa_printf(MSG_DEBUG,
1461 "PR PASN: No common channels to perform ranging");
1462 return PR_NEGOTIATION_FAIL;
1463 }
1464
1465 if (op_mode->role == PR_ISTA_SUPPORT && !own_rsta_support &&
1466 !(peer_supp_roles & PR_RSTA_SUPPORT)) {
1467 wpa_printf(MSG_DEBUG,
1468 "PR PASN: Device cannot act as RSTA and cannot update role");
1469 return PR_NEGOTIATION_FAIL;
1470 }
1471
1472 if (op_mode->role == PR_RSTA_SUPPORT && !own_ista_support &&
1473 !(peer_supp_roles & PR_ISTA_SUPPORT)) {
1474 wpa_printf(MSG_DEBUG,
1475 "PR PASN: Device cannot act as ISTA and cannot update role");
1476 return PR_NEGOTIATION_FAIL;
1477 }
1478
1479 if (op_mode->role == PR_ISTA_SUPPORT && own_rsta_support) {
1480 res_op_mode->role = PR_RSTA_SUPPORT;
1481 status = PR_NEGOTIATION_SUCCESS;
1482 } else if (op_mode->role == PR_RSTA_SUPPORT && own_ista_support) {
1483 res_op_mode->role = PR_ISTA_SUPPORT;
1484 status = PR_NEGOTIATION_SUCCESS;
1485 } else if ((op_mode->role == PR_ISTA_SUPPORT && !own_rsta_support) &&
1486 ((peer_supp_roles & PR_RSTA_SUPPORT) && own_ista_support)) {
1487 res_op_mode->role = PR_ISTA_SUPPORT;
1488 status = PR_NEGOTIATION_UPDATE;
1489 } else if ((op_mode->role == PR_RSTA_SUPPORT && !own_ista_support) &&
1490 ((peer_supp_roles & PR_ISTA_SUPPORT) && own_rsta_support)) {
1491 res_op_mode->role = PR_RSTA_SUPPORT;
1492 status = PR_NEGOTIATION_UPDATE;
1493 } else if (op_mode->role == (PR_RSTA_SUPPORT | PR_ISTA_SUPPORT)) {
1494 if ((pr->cfg->preferred_ranging_role || !own_ista_support) &&
1495 own_rsta_support) {
1496 res_op_mode->role = PR_RSTA_SUPPORT;
1497 status = PR_NEGOTIATION_SUCCESS;
1498 wpa_printf(MSG_DEBUG, "PR PASN: Choose RSTA role");
1499 } else if ((!pr->cfg->preferred_ranging_role ||
1500 !own_rsta_support) && own_ista_support) {
1501 res_op_mode->role = PR_ISTA_SUPPORT;
1502 status = PR_NEGOTIATION_SUCCESS;
1503 wpa_printf(MSG_DEBUG, "PR PASN: Choose ISTA role");
1504 }
1505 } else {
1506 wpa_printf(MSG_DEBUG, "PR PASN: Failed to choose device role");
1507 return PR_NEGOTIATION_FAIL;
1508 }
1509
1510 res_op_mode->protocol_type = ranging_type;
1511 os_memcpy(res_op_mode->country, pr->cfg->country, 3);
1512
1513 if (res_op_mode->role == PR_RSTA_SUPPORT) {
1514 pr_copy_channels(&res_op_mode->channels, &common_chan,
1515 pr->cfg->support_6ghz);
1516 } else {
1517 pr_choose_best_channel(&common_chan, &op_class, &op_channel);
1518 if (!op_class || !op_channel) {
1519 wpa_printf(MSG_DEBUG,
1520 "PR: Couldn't choose a common channel for ranging in ISTA role");
1521 return PR_NEGOTIATION_FAIL;
1522 }
1523 res_op_mode->channels.op_classes = 1;
1524 res_op_mode->channels.op_class[0].channels = 1;
1525 res_op_mode->channels.op_class[0].channel[0] = op_channel;
1526 res_op_mode->channels.op_class[0].op_class = op_class;
1527 wpa_printf(MSG_DEBUG,
1528 "PR: Choose operating class %u, channel %u",
1529 op_class, op_channel);
1530 }
1531
1532 wpa_printf(MSG_DEBUG,
1533 "PR PASN: Ranging Protocol=%u, Role=%u, country=%c%c, status=%d, op class size=%lu",
1534 res_op_mode->protocol_type, res_op_mode->role,
1535 valid_country_ch(res_op_mode->country[0]) ?
1536 res_op_mode->country[0] : '_',
1537 valid_country_ch(res_op_mode->country[1]) ?
1538 res_op_mode->country[1] : '_',
1539 status, res_op_mode->channels.op_classes);
1540
1541 return status;
1542 }
1543
1544
pr_pasn_get_final_op_mode(struct pr_data * pr,u8 supp_roles,struct operation_mode * op_mode,struct operation_mode * res_op_mode)1545 static u8 pr_pasn_get_final_op_mode(struct pr_data *pr, u8 supp_roles,
1546 struct operation_mode *op_mode,
1547 struct operation_mode *res_op_mode)
1548 {
1549 u8 ranging_type = 0;
1550 struct pr_channels common_chan;
1551 struct pr_channels *own_channels = NULL;
1552 int status = PR_NEGOTIATION_FAIL;
1553 u8 op_class = 0, op_channel = 0;
1554 bool own_ista_support = false, own_rsta_support = false;
1555
1556 if (op_mode->protocol_type &
1557 (PR_NTB_SECURE_LTF_BASED_RANGING | PR_NTB_OPEN_BASED_RANGING)) {
1558 if (op_mode->protocol_type == PR_NTB_SECURE_LTF_BASED_RANGING &&
1559 !pr->cfg->secure_he_ltf) {
1560 wpa_printf(MSG_INFO,
1561 "PR PASN: Secure HE-LTF not supported");
1562 return PR_NEGOTIATION_FAIL;
1563 }
1564
1565 if ((op_mode->protocol_type &
1566 PR_NTB_SECURE_LTF_BASED_RANGING) && pr->cfg->secure_he_ltf)
1567 ranging_type = PR_NTB_SECURE_LTF_BASED_RANGING;
1568 else
1569 ranging_type = PR_NTB_OPEN_BASED_RANGING;
1570
1571 own_ista_support = pr->cfg->ntb_ista_support;
1572 own_rsta_support = pr->cfg->ntb_rsta_support;
1573 own_channels = &pr->cfg->ntb_channels;
1574 wpa_printf(MSG_DEBUG, "PR PASN: Choose NTB Ranging Protocol");
1575 } else if (op_mode->protocol_type & PR_EDCA_BASED_RANGING) {
1576 ranging_type = PR_EDCA_BASED_RANGING;
1577
1578 own_ista_support = pr->cfg->edca_ista_support;
1579 own_rsta_support = pr->cfg->edca_rsta_support;
1580 own_channels = &pr->cfg->edca_channels;
1581 wpa_printf(MSG_DEBUG, "PR PASN: Choose EDCA Ranging Protocol");
1582 } else {
1583 wpa_printf(MSG_INFO,
1584 "PR PASN: Invalid Ranging Protocol, proposed type 0x%x",
1585 op_mode->protocol_type);
1586 return PR_NEGOTIATION_FAIL;
1587 }
1588
1589 if (op_mode->role == PR_ISTA_SUPPORT && !own_rsta_support) {
1590 wpa_printf(MSG_INFO, "PR: Device cannot act as RSTA");
1591 return PR_NEGOTIATION_FAIL;
1592 }
1593
1594 if (op_mode->role == PR_RSTA_SUPPORT && !own_ista_support) {
1595 wpa_printf(MSG_INFO, "PR: Device cannot act as ISTA");
1596 return PR_NEGOTIATION_FAIL;
1597 }
1598
1599 if (op_mode->role == PR_ISTA_SUPPORT) {
1600 res_op_mode->role = PR_RSTA_SUPPORT;
1601 status = PR_NEGOTIATION_SUCCESS;
1602 } else if (op_mode->role == PR_RSTA_SUPPORT) {
1603 res_op_mode->role = PR_ISTA_SUPPORT;
1604 status = PR_NEGOTIATION_SUCCESS;
1605 } else {
1606 wpa_printf(MSG_INFO, "PR: Invalid Ranging Role proposed");
1607 return PR_NEGOTIATION_FAIL;
1608 }
1609
1610 pr_channels_intersect(own_channels, &op_mode->channels, &common_chan);
1611 if (!common_chan.op_classes) {
1612 wpa_printf(MSG_INFO,
1613 "PR: No common channels to perform ranging");
1614 return PR_NEGOTIATION_FAIL;
1615 }
1616
1617 pr_choose_best_channel(&common_chan, &op_class, &op_channel);
1618 if (!op_class || !op_channel) {
1619 wpa_printf(MSG_INFO,
1620 "PR: Couldn't choose a common channel for ranging");
1621 return PR_NEGOTIATION_FAIL;
1622 }
1623
1624 res_op_mode->protocol_type = ranging_type;
1625 os_memcpy(res_op_mode->country, pr->cfg->country, 3);
1626 res_op_mode->channels.op_classes = 1;
1627 res_op_mode->channels.op_class[0].channels = 1;
1628 res_op_mode->channels.op_class[0].channel[0] = op_channel;
1629 res_op_mode->channels.op_class[0].op_class = op_class;
1630 wpa_printf(MSG_DEBUG, "PR: Choose operating class %u, channel %u",
1631 op_class, op_channel);
1632
1633 return status;
1634 }
1635
1636
pr_prepare_pasn_pr_elem(struct pr_data * pr,struct wpabuf * extra_ies,bool add_dira,u8 ranging_role,u8 ranging_type,int forced_pr_freq)1637 static int pr_prepare_pasn_pr_elem(struct pr_data *pr, struct wpabuf *extra_ies,
1638 bool add_dira, u8 ranging_role,
1639 u8 ranging_type, int forced_pr_freq)
1640 {
1641 u32 ie_type;
1642 struct wpabuf *buf, *buf2;
1643 struct pr_dira dira;
1644 struct pr_capabilities pr_caps;
1645 struct edca_capabilities edca_caps;
1646 struct ntb_capabilities ntb_caps;
1647 struct operation_mode op_mode;
1648 struct pr_channels op_channels;
1649 u8 forced_op_class = 0, forced_op_channel = 0;
1650 enum hostapd_hw_mode hw_mode;
1651
1652 buf = wpabuf_alloc(1000);
1653 if (!buf)
1654 return -1;
1655
1656 pr_get_ranging_capabilities(pr, &pr_caps);
1657 pr_buf_add_ranging_capa_info(buf, &pr_caps);
1658
1659 if (ranging_type & PR_EDCA_BASED_RANGING) {
1660 pr_get_edca_capabilities(pr, &edca_caps);
1661 pr_buf_add_edca_capa_info(buf, &edca_caps);
1662 pr_copy_channels(&op_channels, &edca_caps.channels,
1663 pr->cfg->support_6ghz);
1664 } else if (ranging_type & PR_NTB_OPEN_BASED_RANGING ||
1665 ranging_type & PR_NTB_SECURE_LTF_BASED_RANGING) {
1666 pr_get_ntb_capabilities(pr, &ntb_caps);
1667 pr_buf_add_ntb_capa_info(buf, &ntb_caps);
1668 pr_copy_channels(&op_channels, &ntb_caps.channels,
1669 pr->cfg->support_6ghz);
1670 } else {
1671 wpa_printf(MSG_INFO, "PR: Unsupported ranging_type 0x%x",
1672 ranging_type);
1673 wpabuf_free(buf);
1674 return -1;
1675 }
1676
1677 os_memset(&op_mode, 0, sizeof(struct operation_mode));
1678 op_mode.role = ranging_role;
1679 op_mode.protocol_type = ranging_type;
1680 os_memcpy(op_mode.country, pr->cfg->country, 3);
1681
1682 if (forced_pr_freq) {
1683 hw_mode = ieee80211_freq_to_channel_ext(forced_pr_freq, 0, 0,
1684 &forced_op_class,
1685 &forced_op_channel);
1686 if (hw_mode == NUM_HOSTAPD_MODES) {
1687 wpa_printf(MSG_INFO, "PR: Invalid forced_pr_freq");
1688 wpabuf_free(buf);
1689 return -1;
1690 }
1691
1692 op_mode.channels.op_classes = 1;
1693 op_mode.channels.op_class[0].channels = 1;
1694 op_mode.channels.op_class[0].channel[0] = forced_op_channel;
1695 op_mode.channels.op_class[0].op_class = forced_op_class;
1696 } else {
1697 pr_copy_channels(&op_mode.channels, &op_channels,
1698 pr->cfg->support_6ghz);
1699 }
1700
1701 pr_buf_add_operation_mode(buf, &op_mode);
1702
1703 /* PR Device Identity Resolution attribute */
1704 if (!pr_derive_dira(pr, pr->cfg->dev_addr, &dira))
1705 pr_buf_add_dira(buf, &dira);
1706
1707 ie_type = (OUI_WFA << 8) | PR_OUI_TYPE;
1708 buf2 = pr_encaps_elem(buf, ie_type);
1709 wpabuf_free(buf);
1710
1711 if (wpabuf_tailroom(extra_ies) < wpabuf_len(buf2)) {
1712 wpa_printf(MSG_INFO,
1713 "PR: Not enough room for PR element in PASN Frame");
1714 wpabuf_free(buf2);
1715 return -1;
1716 }
1717 wpabuf_put_buf(extra_ies, buf2);
1718 wpabuf_free(buf2);
1719
1720 return 0;
1721 }
1722
1723
pr_pasn_generate_rsnxe(struct pr_data * pr,int akmp)1724 static struct wpabuf * pr_pasn_generate_rsnxe(struct pr_data *pr, int akmp)
1725 {
1726 u32 capab;
1727 size_t flen = 0;
1728 struct wpabuf *buf;
1729
1730 capab = BIT(WLAN_RSNX_CAPAB_KEK_IN_PASN);
1731
1732 if (wpa_key_mgmt_sae(akmp))
1733 capab |= BIT(WLAN_RSNX_CAPAB_SAE_H2E);
1734 if (pr->cfg->secure_he_ltf)
1735 capab |= BIT(WLAN_RSNX_CAPAB_SECURE_LTF);
1736
1737 while (capab >> flen * 8)
1738 flen++;
1739
1740 buf = wpabuf_alloc(2 + flen);
1741 if (!buf)
1742 return NULL;
1743
1744 capab |= flen - 1; /* bit 0-3 = Field length (n - 1) */
1745
1746 wpa_printf(MSG_DEBUG, "PR: RSNXE capabilities: %04x", capab);
1747 wpabuf_put_u8(buf, WLAN_EID_RSNX);
1748 wpabuf_put_u8(buf, flen);
1749 while (flen--) {
1750 wpabuf_put_u8(buf, capab & 0xff);
1751 capab = capab >> 8;
1752 }
1753
1754 return buf;
1755 }
1756
1757
1758 /* SSID used for deriving SAE pt for PR security */
1759 #define PR_PASN_SSID "516F9A010000"
1760
pr_pasn_set_password(struct pasn_data * pasn,u8 pasn_type,const char * passphrase)1761 static void pr_pasn_set_password(struct pasn_data *pasn, u8 pasn_type,
1762 const char *passphrase)
1763 {
1764 int pasn_groups[4] = { 0, 0, 0, 0 };
1765 size_t len;
1766
1767 if (!passphrase)
1768 return;
1769
1770 len = os_strlen(passphrase);
1771
1772 if ((pasn_type & (PR_PASN_DH20_UNAUTH | PR_PASN_DH20_AUTH)) &&
1773 (pasn_type & (PR_PASN_DH19_UNAUTH | PR_PASN_DH19_AUTH))) {
1774 pasn_groups[0] = 20;
1775 pasn_groups[1] = 19;
1776 } else if (pasn_type & (PR_PASN_DH20_UNAUTH | PR_PASN_DH20_AUTH)) {
1777 pasn_groups[0] = 20;
1778 } else {
1779 pasn_groups[0] = 19;
1780 }
1781 pasn->pt = sae_derive_pt(pasn_groups, (const u8 *) PR_PASN_SSID,
1782 os_strlen(PR_PASN_SSID),
1783 (const u8 *) passphrase, len, NULL, 0);
1784 }
1785
1786
pr_pasn_initialize(struct pr_data * pr,struct pr_device * dev,const u8 * addr,u8 auth_mode,int freq,u8 ranging_type,const u8 * pmkid)1787 static int pr_pasn_initialize(struct pr_data *pr, struct pr_device *dev,
1788 const u8 *addr, u8 auth_mode, int freq,
1789 u8 ranging_type, const u8 *pmkid)
1790 {
1791 struct wpabuf *rsnxe;
1792 struct pasn_data *pasn;
1793
1794 if (dev->pasn) {
1795 wpa_pasn_reset(dev->pasn);
1796 } else {
1797 dev->pasn = pasn_data_init();
1798 if (!dev->pasn)
1799 return -1;
1800 }
1801
1802 pasn = dev->pasn;
1803 os_memcpy(pasn->own_addr, pr->cfg->dev_addr, ETH_ALEN);
1804 os_memcpy(pasn->peer_addr, addr, ETH_ALEN);
1805
1806 if (dev->pasn_role == PR_ROLE_PASN_INITIATOR) {
1807 pasn->pmksa = pr->initiator_pmksa;
1808 os_memcpy(pasn->bssid, pasn->peer_addr, ETH_ALEN);
1809 } else {
1810 pasn->pmksa = pr->responder_pmksa;
1811 os_memcpy(pasn->bssid, pasn->own_addr, ETH_ALEN);
1812 }
1813
1814 pasn->noauth = 1;
1815
1816 /* As specified in Proximity Ranging Implementation Considerations for
1817 * P2P Operation D1.8, unauthenticated mode PASN with DH group 19
1818 * should be supported by all P2P proximity ranging devices. Skip
1819 * this check for OOB peers whose capabilities are not known.
1820 */
1821 if (dev->discovery_type != PR_DISCOVERY_TYPE_OOB &&
1822 (!(pr->cfg->pasn_type & BIT(0)) ||
1823 !(dev->pr_caps.pasn_type & BIT(0)))) {
1824 wpa_printf(MSG_DEBUG,
1825 "PR PASN: Unauthenticated DH group 19 NOT supported, PASN type of self 0x%x, peer 0x%x",
1826 pr->cfg->pasn_type, dev->pr_caps.pasn_type);
1827 return -1;
1828 }
1829
1830 /* As specified in Proximity Ranging Implementation Considerations for
1831 * P2P Operation D1.8, EDCA based ranging is only supported with
1832 * unauthenticated mode PASN with DH group 19. */
1833 if (((pr->cfg->pasn_type & 0xc) && (dev->pr_caps.pasn_type & 0xc)) &&
1834 ranging_type != PR_EDCA_BASED_RANGING) {
1835 pasn->group = 20;
1836 pasn->cipher = WPA_CIPHER_GCMP_256;
1837 } else {
1838 pasn->group = 19;
1839 pasn->cipher = WPA_CIPHER_CCMP;
1840 }
1841
1842 if (pr->cfg->secure_he_ltf &&
1843 ranging_type == PR_NTB_SECURE_LTF_BASED_RANGING) {
1844 pasn->secure_ltf = true;
1845 pasn_enable_kdk_derivation(pasn);
1846 } else {
1847 pasn_disable_kdk_derivation(pasn);
1848 }
1849 wpa_printf(MSG_DEBUG, "PASN: kdk_len=%zu", pasn->kdk_len);
1850
1851 if (auth_mode == PR_PASN_AUTH_MODE_SAE) {
1852 pasn->akmp = WPA_KEY_MGMT_SAE;
1853 if (dev->password_valid) {
1854 pr_pasn_set_password(pasn, pr->cfg->pasn_type,
1855 dev->password);
1856 } else if (pr->cfg->global_password_valid) {
1857 pr_pasn_set_password(pasn, pr->cfg->pasn_type,
1858 pr->cfg->global_password);
1859 } else {
1860 wpa_printf(MSG_INFO, "PR PASN: Password not available");
1861 return -1;
1862 }
1863 } else if (auth_mode == PR_PASN_AUTH_MODE_PMK && dev->pmk_valid) {
1864 if (!dev->pmk_valid) {
1865 wpa_printf(MSG_INFO, "PR PASN: PMK not available");
1866 return -1;
1867 }
1868 if (dev->pasn_role == PR_ROLE_PASN_INITIATOR)
1869 pasn_initiator_pmksa_cache_add(pr->initiator_pmksa,
1870 pasn->own_addr,
1871 pasn->peer_addr,
1872 dev->pmk,
1873 dev->pmk_len,
1874 pmkid,
1875 WPA_KEY_MGMT_SAE);
1876 else
1877 pasn_responder_pmksa_cache_add(pr->responder_pmksa,
1878 pasn->own_addr,
1879 pasn->peer_addr,
1880 dev->pmk,
1881 dev->pmk_len,
1882 pmkid,
1883 WPA_KEY_MGMT_SAE);
1884 pasn->akmp = WPA_KEY_MGMT_SAE;
1885 } else {
1886 pasn->akmp = WPA_KEY_MGMT_PASN;
1887 }
1888
1889 pasn->rsn_pairwise = pasn->cipher;
1890 pasn->wpa_key_mgmt = pasn->akmp;
1891
1892 rsnxe = pr_pasn_generate_rsnxe(pr, pasn->akmp);
1893 if (rsnxe) {
1894 os_free(pasn->rsnxe_ie);
1895 pasn->rsnxe_ie = os_memdup(wpabuf_head_u8(rsnxe),
1896 wpabuf_len(rsnxe));
1897 wpabuf_free(rsnxe);
1898 if (!pasn->rsnxe_ie)
1899 return -1;
1900 }
1901
1902 pasn->cb_ctx = pr->cfg->cb_ctx;
1903 pasn->send_mgmt = pr->cfg->pasn_send_mgmt;
1904 pasn->freq = freq;
1905 return 0;
1906 }
1907
1908
pr_validate_pasn_request(struct pr_data * pr,struct pr_device * dev,u8 auth_mode,u8 ranging_role,u8 ranging_type)1909 static int pr_validate_pasn_request(struct pr_data *pr, struct pr_device *dev,
1910 u8 auth_mode, u8 ranging_role,
1911 u8 ranging_type)
1912 {
1913 if (!ranging_role || !ranging_type)
1914 return -1;
1915
1916 if (auth_mode == PR_PASN_AUTH_MODE_PASN) {
1917 if (!(pr->cfg->pasn_type &
1918 (PR_PASN_DH19_UNAUTH | PR_PASN_DH20_UNAUTH)) ||
1919 !(dev->pr_caps.pasn_type &
1920 (PR_PASN_DH19_UNAUTH | PR_PASN_DH20_UNAUTH))) {
1921 wpa_printf(MSG_INFO,
1922 "PR: Dev/Peer doesn't support PASN-UNAUTH");
1923 return -1;
1924 }
1925 } else if (auth_mode == PR_PASN_AUTH_MODE_PMK ||
1926 auth_mode == PR_PASN_AUTH_MODE_SAE) {
1927 if (!(pr->cfg->pasn_type &
1928 (PR_PASN_DH19_AUTH | PR_PASN_DH20_AUTH)) ||
1929 !(dev->pr_caps.pasn_type &
1930 (PR_PASN_DH19_AUTH | PR_PASN_DH20_AUTH))) {
1931 wpa_printf(MSG_INFO, "PR: Dev/Peer doesn't support PASN-SAE/PMK");
1932 return -1;
1933 }
1934 }
1935
1936 if (ranging_type == PR_NTB_SECURE_LTF_BASED_RANGING ||
1937 ranging_type == PR_NTB_OPEN_BASED_RANGING) {
1938 if (ranging_type == PR_NTB_SECURE_LTF_BASED_RANGING &&
1939 (!pr->cfg->secure_he_ltf || !dev->ntb_caps.secure_he_ltf)) {
1940 wpa_printf(MSG_INFO,
1941 "PR: Dev/Peer doesn't support HE-LTF");
1942 return -1;
1943 }
1944
1945 if (ranging_role == PR_ISTA_SUPPORT &&
1946 !pr->cfg->ntb_ista_support) {
1947 wpa_printf(MSG_INFO,
1948 "PR: Device doesn't support NTB ISTA role");
1949 return -1;
1950 }
1951
1952 if (ranging_role == PR_RSTA_SUPPORT &&
1953 !pr->cfg->ntb_rsta_support) {
1954 wpa_printf(MSG_INFO,
1955 "PR: Device doesn't support NTB RSTA role");
1956 return -1;
1957 }
1958
1959 if (ranging_role == PR_ISTA_SUPPORT &&
1960 !dev->ntb_caps.rsta_support &&
1961 !pr->cfg->ntb_rsta_support) {
1962 wpa_printf(MSG_INFO,
1963 "PR: Device and Peer doesn't support NTB RSTA role, no possiblity for negotiation update");
1964 return -1;
1965 }
1966
1967 if (ranging_role == PR_RSTA_SUPPORT &&
1968 !dev->ntb_caps.ista_support &&
1969 !pr->cfg->ntb_ista_support) {
1970 wpa_printf(MSG_INFO,
1971 "PR: Device and Peer doesn't support NTB ISTA role, no possiblity for negotiation update");
1972 return -1;
1973 }
1974 } else if (ranging_type == PR_EDCA_BASED_RANGING) {
1975 if (ranging_role == PR_ISTA_SUPPORT &&
1976 !pr->cfg->edca_ista_support) {
1977 wpa_printf(MSG_INFO,
1978 "PR: Device doesn't support EDCA ISTA role");
1979 return -1;
1980 }
1981
1982 if (ranging_role == PR_RSTA_SUPPORT &&
1983 !pr->cfg->edca_rsta_support) {
1984 wpa_printf(MSG_INFO,
1985 "PR: Device doesn't support EDCA RSTA role");
1986 return -1;
1987 }
1988
1989 if (ranging_role == PR_ISTA_SUPPORT &&
1990 !dev->edca_caps.rsta_support &&
1991 !pr->cfg->edca_rsta_support) {
1992 wpa_printf(MSG_INFO,
1993 "PR: Device and Peer doesn't support EDCA RSTA role, no possiblity for negotiation update");
1994 return -1;
1995 }
1996
1997 if (ranging_role == PR_RSTA_SUPPORT &&
1998 !dev->edca_caps.ista_support &&
1999 !pr->cfg->edca_ista_support) {
2000 wpa_printf(MSG_INFO,
2001 "PR: Device and Peer doesn't support EDCA ISTA role, no possiblity for negotiation update");
2002 return -1;
2003 }
2004 }
2005
2006 return 0;
2007 }
2008
2009
pr_initiate_pasn_auth(struct pr_data * pr,const u8 * addr,int freq,u8 auth_mode,u8 ranging_role,u8 ranging_type,int forced_pr_freq)2010 int pr_initiate_pasn_auth(struct pr_data *pr, const u8 *addr, int freq,
2011 u8 auth_mode, u8 ranging_role, u8 ranging_type,
2012 int forced_pr_freq)
2013 {
2014 int ret = 0;
2015 struct pasn_data *pasn;
2016 struct pr_device *dev;
2017 u8 pmkid[PMKID_LEN];
2018 struct wpabuf *extra_ies;
2019
2020 if (!addr) {
2021 wpa_printf(MSG_DEBUG, "PR PASN: Peer address NULL");
2022 return -1;
2023 }
2024
2025 dev = pr_get_device(pr, addr);
2026 if (!dev) {
2027 wpa_printf(MSG_DEBUG, "PR PASN: Peer not known");
2028 return -1;
2029 }
2030
2031 if (dev->discovery_type != PR_DISCOVERY_TYPE_OOB &&
2032 pr_validate_pasn_request(pr, dev, auth_mode, ranging_role,
2033 ranging_type) < 0) {
2034 wpa_printf(MSG_INFO,
2035 "PR PASN: Invalid parameters to initiate authentication");
2036 return -1;
2037 }
2038
2039 if (freq == 0)
2040 freq = dev->listen_freq;
2041
2042 dev->pasn_role = PR_ROLE_PASN_INITIATOR;
2043
2044 if (auth_mode == PR_PASN_AUTH_MODE_PMK && dev->pmk_valid &&
2045 os_get_random(pmkid, PMKID_LEN) < 0)
2046 return -1;
2047
2048 if (pr_pasn_initialize(pr, dev, addr, auth_mode, freq, ranging_type,
2049 pmkid)) {
2050 wpa_printf(MSG_INFO, "PR PASN: Initialization failed");
2051 return -1;
2052 }
2053 pasn = dev->pasn;
2054
2055 extra_ies = wpabuf_alloc(1500);
2056 if (!extra_ies)
2057 return -1;
2058
2059 if (pr_prepare_pasn_pr_elem(pr, extra_ies, false, ranging_role,
2060 ranging_type, forced_pr_freq)) {
2061 wpa_printf(MSG_INFO,
2062 "PR PASN: Failed to prepare extra elements");
2063 ret = -1;
2064 goto out;
2065 }
2066
2067 pasn_set_extra_ies(dev->pasn, wpabuf_head_u8(extra_ies),
2068 wpabuf_len(extra_ies));
2069
2070 if (auth_mode == PR_PASN_AUTH_MODE_PMK) {
2071 ret = wpa_pasn_verify(pasn, pasn->own_addr, pasn->peer_addr,
2072 pasn->bssid, pasn->akmp, pasn->cipher,
2073 pasn->group, pasn->freq, NULL, 0, NULL, 0,
2074 NULL);
2075 } else {
2076 ret = wpas_pasn_start(pasn, pasn->own_addr, pasn->peer_addr,
2077 pasn->bssid, pasn->akmp, pasn->cipher,
2078 pasn->group, pasn->freq, NULL, 0, NULL, 0,
2079 NULL);
2080 }
2081 if (ret) {
2082 wpa_printf(MSG_INFO, "PR PASN: Failed to start PASN");
2083 } else {
2084 /* M1 sent successfully - notify that negotiation has started */
2085 if (pr->cfg->negotiation_started)
2086 pr->cfg->negotiation_started(pr->cfg->cb_ctx, addr,
2087 ranging_role,
2088 ranging_type);
2089 }
2090
2091 out:
2092 wpabuf_free(extra_ies);
2093 return ret;
2094 }
2095
2096
pr_pasn_auth_tx_status(struct pr_data * pr,const u8 * data,size_t data_len,bool acked)2097 int pr_pasn_auth_tx_status(struct pr_data *pr, const u8 *data, size_t data_len,
2098 bool acked)
2099 {
2100 int ret = 0;
2101 struct pr_device *dev;
2102 struct pasn_data *pasn;
2103 const struct ieee80211_mgmt *mgmt =
2104 (const struct ieee80211_mgmt *) data;
2105 u8 self_format_bw, peer_format_bw;
2106
2107 if (!pr)
2108 return -1;
2109
2110 dev = pr_get_device(pr, mgmt->da);
2111 if (!dev || !dev->pasn) {
2112 wpa_printf(MSG_INFO, "PR PASN: Peer not found " MACSTR,
2113 MAC2STR(mgmt->da));
2114 return -1;
2115 }
2116
2117 pasn = dev->pasn;
2118 wpa_printf(MSG_DEBUG, "PR PASN: TX status from " MACSTR " ack=%d",
2119 MAC2STR(mgmt->da), acked);
2120
2121 ret = wpa_pasn_auth_tx_status(pasn, data, data_len, acked);
2122
2123 /*
2124 * Authentication frame 1 was not acked; return to caller to schedule a
2125 * retransmission. Preserve pasn->frame for the retry.
2126 */
2127 if (ret == 2)
2128 return ret;
2129
2130 if (ret == 1 && acked && pr->cfg->pasn_result)
2131 pr->cfg->pasn_result(pr->cfg->cb_ctx, dev->ranging_role,
2132 dev->protocol_type, dev->final_op_class,
2133 dev->final_op_channel, pr->cfg->country);
2134
2135 if (ret == 1 && acked && pr->cfg->get_ranging_params) {
2136 if (dev->protocol_type & PR_EDCA_BASED_RANGING) {
2137 self_format_bw = pr->cfg->edca_format_and_bw;
2138 peer_format_bw = dev->edca_caps.edca_hw_caps &
2139 EDCA_FORMAT_AND_BW_MASK;
2140 } else if ((dev->protocol_type &
2141 PR_NTB_SECURE_LTF_BASED_RANGING) ||
2142 (dev->protocol_type & PR_NTB_OPEN_BASED_RANGING)) {
2143 self_format_bw = pr->cfg->ntb_format_and_bw;
2144 peer_format_bw = dev->ntb_caps.ntb_hw_caps &
2145 NTB_FORMAT_AND_BW_MASK;
2146 } else {
2147 wpa_printf(MSG_INFO,
2148 "PR PASN: Invalid protocol type: %u",
2149 dev->protocol_type);
2150 goto out;
2151 }
2152
2153 pr->cfg->get_ranging_params(pr->cfg->cb_ctx, pr->cfg->dev_addr,
2154 dev->pr_device_addr,
2155 dev->ranging_role,
2156 dev->protocol_type,
2157 dev->final_op_class,
2158 dev->final_op_channel,
2159 self_format_bw,
2160 peer_format_bw);
2161 pr_flush(pr);
2162 }
2163
2164 out:
2165 wpabuf_free(pasn->frame);
2166 pasn->frame = NULL;
2167
2168 return ret;
2169 }
2170
2171
pr_pasn_auth_retransmit(struct pr_data * pr,const u8 * addr)2172 int pr_pasn_auth_retransmit(struct pr_data *pr, const u8 *addr)
2173 {
2174 struct pr_device *dev;
2175 struct pasn_data *pasn;
2176
2177 dev = pr_get_device(pr, addr);
2178 if (!dev || !dev->pasn || !dev->pasn->frame)
2179 return -1;
2180
2181 pasn = dev->pasn;
2182 wpa_printf(MSG_DEBUG, "PR PASN: retransmit Authentication frame 1 to "
2183 MACSTR, MAC2STR(addr));
2184 return pasn->send_mgmt(pasn->cb_ctx, wpabuf_head(pasn->frame),
2185 wpabuf_len(pasn->frame), 0, pasn->freq, 1000);
2186 }
2187
2188
pr_process_pasn_ranging_wrapper(struct pr_data * pr,struct pr_device * dev,const struct ieee80211_mgmt * mgmt,size_t len,int trans_seq)2189 static int pr_process_pasn_ranging_wrapper(struct pr_data *pr,
2190 struct pr_device *dev,
2191 const struct ieee80211_mgmt *mgmt,
2192 size_t len, int trans_seq)
2193 {
2194 u32 ie_type;
2195 const u8 *ies;
2196 size_t ies_len;
2197 u8 status = PR_NEGOTIATION_FAIL;
2198 bool success = false;
2199 struct wpabuf *buf, *buf2;
2200 struct pr_message msg;
2201 struct pr_capabilities caps;
2202 struct edca_capabilities edca;
2203 struct ntb_capabilities ntb;
2204 struct operation_mode op_mode;
2205 u8 supp_ranging_role = 0;
2206 struct operation_mode res_op_mode;
2207 bool ntb_caps_valid = false, edca_caps_valid = false;
2208
2209 buf = wpabuf_alloc(1000);
2210 if (!buf) {
2211 wpa_printf(MSG_INFO, "PR: Memory allocation failed");
2212 return -1;
2213 }
2214
2215 os_memset(&msg, 0, sizeof(msg));
2216 ies = mgmt->u.auth.variable;
2217 if (offsetof(struct ieee80211_mgmt, u.auth.variable) > len)
2218 return -1;
2219 ies_len = len - offsetof(struct ieee80211_mgmt, u.auth.variable);
2220
2221 if (pr_parse_elements(ies, ies_len, &msg) || !msg.op_mode) {
2222 wpa_printf(MSG_INFO,
2223 "PR PASN: Failed to parse PR element in Auth1");
2224 goto end;
2225 }
2226
2227 if (trans_seq == WLAN_AUTH_TR_SEQ_PASN_AUTH2) {
2228 if (!msg.status_ie || !msg.status_ie_len) {
2229 wpa_printf(MSG_DEBUG, "PR INFO: * No status attribute");
2230 wpabuf_free(buf);
2231 pr_parse_free(&msg);
2232 return -1;
2233 }
2234 if (*msg.status_ie == PR_NEGOTIATION_FAIL) {
2235 wpa_printf(MSG_INFO,
2236 "PR PASN: * Ranging Negotiation status fail");
2237 wpabuf_free(buf);
2238 pr_parse_free(&msg);
2239 return -1;
2240 }
2241 }
2242
2243 if (!msg.op_mode || !msg.op_mode_len ||
2244 !msg.pr_capability || !msg.pr_capability_len ||
2245 ((!msg.edca_capability || !msg.edca_capability_len) &&
2246 (!msg.ntb_capability || !msg.ntb_capability_len)))
2247 goto end;
2248
2249 if (msg.dira && msg.dira_len)
2250 pr_validate_dira(pr, dev, msg.dira, msg.dira_len);
2251
2252 pr_process_op_mode(msg.op_mode, msg.op_mode_len, &op_mode);
2253 if (!op_mode.channels.op_classes) {
2254 wpa_printf(MSG_INFO, "PR: Received empty channel list");
2255 goto end;
2256 }
2257
2258 os_memset(&caps, 0, sizeof(struct pr_capabilities));
2259 pr_process_ranging_capabilities(msg.pr_capability,
2260 msg.pr_capability_len, &caps);
2261 if (!pr_eq_ranging_capa_params(dev, &caps)) {
2262 wpa_printf(MSG_INFO, "PR: Ranging capabilities not matching");
2263 goto end;
2264 }
2265
2266 pr_get_ranging_capabilities(pr, &caps);
2267
2268 if ((op_mode.protocol_type & PR_EDCA_BASED_RANGING) &&
2269 (!msg.edca_capability || !msg.edca_capability_len))
2270 goto end;
2271 if ((op_mode.protocol_type & PR_NTB_OPEN_BASED_RANGING) &&
2272 (!msg.ntb_capability || !msg.ntb_capability_len))
2273 goto end;
2274 if ((op_mode.protocol_type & PR_NTB_SECURE_LTF_BASED_RANGING) &&
2275 (!msg.ntb_capability || !msg.ntb_capability_len))
2276 goto end;
2277
2278 if (op_mode.protocol_type &
2279 (PR_NTB_SECURE_LTF_BASED_RANGING | PR_NTB_OPEN_BASED_RANGING)) {
2280 pr_process_ntb_capabilities(msg.ntb_capability,
2281 msg.ntb_capability_len, &ntb,
2282 caps.secure_he_ltf);
2283
2284 if (!pr_eq_ntb_params(dev, &ntb)) {
2285 wpa_printf(MSG_INFO,
2286 "PR: NTB capabilities not matching");
2287 goto end;
2288 }
2289
2290 if (dev->ntb_caps.ista_support)
2291 supp_ranging_role |= PR_ISTA_SUPPORT;
2292 if (dev->ntb_caps.rsta_support)
2293 supp_ranging_role |= PR_RSTA_SUPPORT;
2294
2295 pr_get_ntb_capabilities(pr, &ntb);
2296 ntb_caps_valid = true;
2297 } else if (op_mode.protocol_type & PR_EDCA_BASED_RANGING) {
2298 pr_process_edca_capabilities(msg.edca_capability,
2299 msg.edca_capability_len, &edca);
2300 if (!pr_eq_edca_params(dev, &edca)) {
2301 wpa_printf(MSG_INFO,
2302 "PR: EDCA capabilities not matching");
2303 goto end;
2304 }
2305
2306 if (dev->edca_caps.ista_support)
2307 supp_ranging_role |= PR_ISTA_SUPPORT;
2308 if (dev->edca_caps.rsta_support)
2309 supp_ranging_role |= PR_RSTA_SUPPORT;
2310
2311 pr_get_edca_capabilities(pr, &edca);
2312 edca_caps_valid = true;
2313 }
2314
2315 if (trans_seq == WLAN_AUTH_TR_SEQ_PASN_AUTH1)
2316 status = pr_pasn_get_best_op_mode(pr, supp_ranging_role,
2317 &op_mode, &res_op_mode);
2318 else if (trans_seq == WLAN_AUTH_TR_SEQ_PASN_AUTH2)
2319 status = pr_pasn_get_final_op_mode(pr, supp_ranging_role,
2320 &op_mode, &res_op_mode);
2321
2322 if (status != PR_NEGOTIATION_SUCCESS &&
2323 status != PR_NEGOTIATION_UPDATE) {
2324 wpa_printf(MSG_DEBUG,
2325 "PR: Couldn't derive suitable operation mode");
2326 goto end;
2327 }
2328
2329 if (trans_seq == WLAN_AUTH_TR_SEQ_PASN_AUTH1) {
2330 pr_buf_add_ranging_capa_info(buf, &caps);
2331 if (edca_caps_valid)
2332 pr_buf_add_edca_capa_info(buf, &edca);
2333 if (ntb_caps_valid)
2334 pr_buf_add_ntb_capa_info(buf, &ntb);
2335 }
2336
2337 pr_buf_add_ranging_neg_status(buf, status);
2338 pr_buf_add_operation_mode(buf, &res_op_mode);
2339
2340 dev->ranging_role = res_op_mode.role;
2341 dev->protocol_type = res_op_mode.protocol_type;
2342
2343 if (trans_seq == WLAN_AUTH_TR_SEQ_PASN_AUTH2) {
2344 dev->final_op_channel =
2345 res_op_mode.channels.op_class[0].channel[0];
2346 dev->final_op_class = res_op_mode.channels.op_class[0].op_class;
2347 }
2348
2349 success = true;
2350 end:
2351 if (!success)
2352 pr_buf_add_ranging_neg_status(buf, PR_NEGOTIATION_FAIL);
2353
2354 ie_type = (OUI_WFA << 8) | PR_OUI_TYPE;
2355 buf2 = pr_encaps_elem(buf, ie_type);
2356 wpabuf_free(buf);
2357
2358 wpabuf_free(dev->ranging_wrapper);
2359 dev->ranging_wrapper = buf2;
2360 pr_parse_free(&msg);
2361
2362 return 0;
2363 }
2364
2365
2366 static int
pr_process_pasn_ranging_wrapper_result(struct pr_data * pr,struct pr_device * dev,const struct ieee80211_mgmt * mgmt,size_t len)2367 pr_process_pasn_ranging_wrapper_result(struct pr_data *pr,
2368 struct pr_device *dev,
2369 const struct ieee80211_mgmt *mgmt,
2370 size_t len)
2371 {
2372 int ret = -1;
2373 const u8 *ies;
2374 size_t ies_len;
2375 struct pr_message msg;
2376 struct operation_mode op_mode;
2377 struct pr_channels common_chan;
2378
2379 os_memset(&msg, 0, sizeof(msg));
2380 ies = mgmt->u.auth.variable;
2381 ies_len = len - offsetof(struct ieee80211_mgmt, u.auth.variable);
2382
2383 if (pr_parse_elements(ies, ies_len, &msg) || !msg.op_mode) {
2384 wpa_printf(MSG_INFO,
2385 "PR PASN: Failed to parse PR element in Auth3");
2386 goto fail;
2387 }
2388
2389 if (!msg.status_ie || !msg.status_ie_len) {
2390 wpa_printf(MSG_INFO, "PR PASN: * No status attribute");
2391 goto fail;
2392 }
2393
2394 if (*msg.status_ie == PR_NEGOTIATION_FAIL) {
2395 wpa_printf(MSG_INFO,
2396 "PR PASN: * Ranging Negotiation status fail");
2397 goto fail;
2398 }
2399
2400 if (!msg.op_mode || !msg.op_mode_len)
2401 goto fail;
2402
2403 pr_process_op_mode(msg.op_mode, msg.op_mode_len, &op_mode);
2404 if (op_mode.channels.op_classes != 1) {
2405 wpa_printf(MSG_INFO, "PR: PASN received invalid channel list");
2406 goto fail;
2407 }
2408
2409 wpa_printf(MSG_DEBUG,
2410 "PR PASN: Frame 3: Operating mode data: Role=%u, protocol type=%u, operating class=%u, channel= %u",
2411 op_mode.role, op_mode.protocol_type,
2412 op_mode.channels.op_class[0].op_class,
2413 op_mode.channels.op_class[0].channel[0]);
2414
2415 if (op_mode.protocol_type &
2416 (PR_NTB_SECURE_LTF_BASED_RANGING | PR_NTB_OPEN_BASED_RANGING)) {
2417 if ((op_mode.role & PR_ISTA_SUPPORT) &&
2418 !pr->cfg->ntb_rsta_support)
2419 goto fail;
2420
2421 if ((op_mode.role & PR_RSTA_SUPPORT) &&
2422 !pr->cfg->ntb_ista_support)
2423 goto fail;
2424
2425 if ((op_mode.protocol_type & PR_NTB_SECURE_LTF_BASED_RANGING) &&
2426 !pr->cfg->secure_he_ltf)
2427 goto fail;
2428
2429 pr_channels_intersect(&pr->cfg->ntb_channels, &op_mode.channels,
2430 &common_chan);
2431 if (common_chan.op_classes == 0) {
2432 wpa_printf(MSG_INFO, "PR PASN: No common channel");
2433 goto fail;
2434 }
2435 } else if (op_mode.protocol_type & PR_EDCA_BASED_RANGING) {
2436 if ((op_mode.role & PR_ISTA_SUPPORT) &&
2437 !pr->cfg->edca_rsta_support)
2438 goto fail;
2439
2440 if ((op_mode.role & PR_RSTA_SUPPORT) &&
2441 !pr->cfg->edca_ista_support)
2442 goto fail;
2443
2444 pr_channels_intersect(&pr->cfg->edca_channels,
2445 &op_mode.channels, &common_chan);
2446 if (common_chan.op_classes == 0)
2447 goto fail;
2448 }
2449
2450 if (op_mode.role & PR_RSTA_SUPPORT)
2451 dev->ranging_role = PR_ISTA_SUPPORT;
2452 else
2453 dev->ranging_role = PR_RSTA_SUPPORT;
2454 dev->protocol_type = op_mode.protocol_type;
2455 dev->final_op_channel = op_mode.channels.op_class[0].channel[0];
2456 dev->final_op_class = op_mode.channels.op_class[0].op_class;
2457 ret = 0;
2458
2459 fail:
2460 pr_parse_free(&msg);
2461 return ret;
2462 }
2463
2464
pr_pasn_handle_auth_1(struct pr_data * pr,struct pr_device * dev,const struct ieee80211_mgmt * mgmt,size_t len,int freq)2465 static int pr_pasn_handle_auth_1(struct pr_data *pr, struct pr_device *dev,
2466 const struct ieee80211_mgmt *mgmt, size_t len,
2467 int freq)
2468 {
2469 int ret = -1;
2470 u8 pasn_type;
2471 u8 auth_mode = 0;
2472 int pasn_groups[4] = { 0 };
2473 struct wpa_ie_data rsn_data;
2474 struct ieee802_11_elems elems;
2475
2476 pasn_type = pr->cfg->pasn_type;
2477 if (pasn_type & (PR_PASN_DH20_UNAUTH | PR_PASN_DH20_AUTH) &&
2478 pasn_type & (PR_PASN_DH19_UNAUTH | PR_PASN_DH19_AUTH)) {
2479 pasn_groups[0] = 20;
2480 pasn_groups[1] = 19;
2481 } else if (pasn_type & (PR_PASN_DH20_UNAUTH | PR_PASN_DH20_AUTH)) {
2482 pasn_groups[0] = 20;
2483 } else {
2484 pasn_groups[0] = 19;
2485 }
2486
2487 if (pr_process_pasn_ranging_wrapper(pr, dev, mgmt, len, 1)) {
2488 wpa_printf(MSG_INFO,
2489 "PR PASN: Failed to handle Auth1 action wrapper");
2490 return -1;
2491 }
2492
2493 if (ieee802_11_parse_elems(mgmt->u.auth.variable,
2494 len - offsetof(struct ieee80211_mgmt,
2495 u.auth.variable),
2496 &elems, 0) == ParseFailed) {
2497 wpa_printf(MSG_DEBUG,
2498 "PR PASN: Failed parsing elements in Auth1 frame");
2499 goto fail;
2500 }
2501
2502 if (wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2, elems.rsn_ie_len + 2,
2503 &rsn_data) == 0) {
2504 if (rsn_data.key_mgmt == WPA_KEY_MGMT_SAE && rsn_data.num_pmkid)
2505 auth_mode = PR_PASN_AUTH_MODE_PMK;
2506 else if (rsn_data.key_mgmt == WPA_KEY_MGMT_SAE)
2507 auth_mode = PR_PASN_AUTH_MODE_SAE;
2508 else
2509 auth_mode = PR_PASN_AUTH_MODE_PASN;
2510 }
2511
2512 dev->pasn_role = PR_ROLE_PASN_RESPONDER;
2513 if (pr_pasn_initialize(pr, dev, mgmt->sa, auth_mode, freq,
2514 dev->protocol_type, rsn_data.pmkid)) {
2515 wpa_printf(MSG_INFO, "PR PASN: Initialize failed");
2516 goto fail;
2517 }
2518
2519 pasn_set_extra_ies(dev->pasn, wpabuf_head_u8(dev->ranging_wrapper),
2520 wpabuf_len(dev->ranging_wrapper));
2521 os_free(dev->pasn->pasn_groups);
2522 dev->pasn->pasn_groups = int_array_dup(pasn_groups);
2523 if (handle_auth_pasn_1(dev->pasn, pr->cfg->dev_addr, mgmt->sa, mgmt,
2524 len, false) < 0) {
2525 wpa_printf(MSG_INFO, "PR PASN: Handle Auth1 failed");
2526 goto fail;
2527 }
2528
2529 if (!(dev->protocol_type & PR_EDCA_BASED_RANGING) &&
2530 pr->cfg->set_keys &&
2531 pr->cfg->set_keys(pr->cfg->cb_ctx, pr->cfg->dev_addr,
2532 dev->pr_device_addr, dev->pasn->cipher,
2533 dev->pasn->akmp, &dev->pasn->ptk) < 0) {
2534 wpa_printf(MSG_INFO, "PR PASN: Key configuration failed");
2535 goto fail;
2536 }
2537
2538 /* M1 received and M2 sent - notify that negotiation has started */
2539 if (pr->cfg->negotiation_started)
2540 pr->cfg->negotiation_started(pr->cfg->cb_ctx, mgmt->sa,
2541 dev->ranging_role,
2542 dev->protocol_type);
2543 ret = 0;
2544
2545 fail:
2546 wpabuf_free(dev->ranging_wrapper);
2547 dev->ranging_wrapper = NULL;
2548 return ret;
2549 }
2550
2551
pr_pasn_handle_auth_2(struct pr_data * pr,struct pr_device * dev,const struct ieee80211_mgmt * mgmt,size_t len)2552 static int pr_pasn_handle_auth_2(struct pr_data *pr, struct pr_device *dev,
2553 const struct ieee80211_mgmt *mgmt, size_t len)
2554 {
2555 int ret = -1;
2556 struct wpa_pasn_params_data pasn_data;
2557
2558 if (dev->pasn_role != PR_ROLE_PASN_INITIATOR) {
2559 wpa_printf(MSG_INFO,
2560 "PR PASN: Auth2 not expected on responder");
2561 return -1;
2562 }
2563
2564 if (!dev->pasn)
2565 return -1;
2566
2567 if (pr_process_pasn_ranging_wrapper(pr, dev, mgmt, len, 2)) {
2568 wpa_printf(MSG_INFO,
2569 "PR PASN: Failed to handle Auth2 action wrapper");
2570 return -1;
2571 }
2572 pasn_set_extra_ies(dev->pasn, wpabuf_head_u8(dev->ranging_wrapper),
2573 wpabuf_len(dev->ranging_wrapper));
2574
2575 if (wpa_pasn_auth_rx(dev->pasn, (const u8 *) mgmt, len,
2576 &pasn_data) < 0) {
2577 wpa_printf(MSG_INFO, "PR PASN: wpa_pasn_auth_rx() failed");
2578 dev->pasn_role = PR_ROLE_IDLE;
2579 goto fail;
2580 }
2581
2582 if (!(dev->protocol_type & PR_EDCA_BASED_RANGING) &&
2583 pr->cfg->set_keys &&
2584 pr->cfg->set_keys(pr->cfg->cb_ctx, pr->cfg->dev_addr,
2585 dev->pr_device_addr, dev->pasn->cipher,
2586 dev->pasn->akmp, &dev->pasn->ptk) < 0) {
2587 wpa_printf(MSG_INFO, "PR PASN: Key configuration failed");
2588 goto fail;
2589 }
2590 ret = 0;
2591
2592 fail:
2593 wpabuf_free(dev->ranging_wrapper);
2594 dev->ranging_wrapper = NULL;
2595 return ret;
2596 }
2597
2598
pr_pasn_handle_auth_3(struct pr_data * pr,struct pr_device * dev,const struct ieee80211_mgmt * mgmt,size_t len)2599 static int pr_pasn_handle_auth_3(struct pr_data *pr, struct pr_device *dev,
2600 const struct ieee80211_mgmt *mgmt, size_t len)
2601 {
2602 u8 self_format_bw, peer_format_bw;
2603
2604 if (dev->pasn_role != PR_ROLE_PASN_RESPONDER) {
2605 wpa_printf(MSG_INFO,
2606 "PR PASN: Auth3 not expected on initiator");
2607 return -1;
2608 }
2609
2610 if (!dev->pasn)
2611 return -1;
2612
2613 if (pr_process_pasn_ranging_wrapper_result(pr, dev, mgmt, len)) {
2614 wpa_printf(MSG_INFO,
2615 "PR PASN: Failed to handle Auth3 action wrapper");
2616 goto fail;
2617 }
2618
2619 if (handle_auth_pasn_3(dev->pasn, pr->cfg->dev_addr, mgmt->sa, mgmt,
2620 len) < 0) {
2621 wpa_printf(MSG_INFO, "PR PASN: Failed to handle Auth3");
2622 goto fail;
2623 }
2624
2625 if (pr->cfg->pasn_result)
2626 pr->cfg->pasn_result(pr->cfg->cb_ctx, dev->ranging_role,
2627 dev->protocol_type, dev->final_op_class,
2628 dev->final_op_channel, pr->cfg->country);
2629
2630 if (dev->protocol_type & PR_EDCA_BASED_RANGING) {
2631 self_format_bw = pr->cfg->edca_format_and_bw;
2632 peer_format_bw = dev->edca_caps.edca_hw_caps &
2633 EDCA_FORMAT_AND_BW_MASK;
2634
2635 } else if ((dev->protocol_type & PR_NTB_SECURE_LTF_BASED_RANGING) ||
2636 (dev->protocol_type & PR_NTB_OPEN_BASED_RANGING)) {
2637 self_format_bw = pr->cfg->ntb_format_and_bw;
2638 peer_format_bw = dev->ntb_caps.ntb_hw_caps &
2639 NTB_FORMAT_AND_BW_MASK;
2640 } else {
2641 wpa_printf(MSG_INFO, "PR PASN: Invalid protocol type: %u",
2642 dev->protocol_type);
2643 goto fail;
2644 }
2645
2646 if (pr->cfg->get_ranging_params)
2647 pr->cfg->get_ranging_params(pr->cfg->cb_ctx, pr->cfg->dev_addr,
2648 dev->pr_device_addr,
2649 dev->ranging_role,
2650 dev->protocol_type,
2651 dev->final_op_class,
2652 dev->final_op_channel,
2653 self_format_bw,
2654 peer_format_bw);
2655 pr_flush(pr);
2656 return 0;
2657
2658 fail:
2659 /* Clear the keys as M3 processing failed */
2660 if (pr->cfg->clear_keys)
2661 pr->cfg->clear_keys(pr->cfg->cb_ctx, pr->cfg->dev_addr,
2662 dev->pr_device_addr);
2663 return -1;
2664 }
2665
2666
pr_pasn_auth_rx(struct pr_data * pr,const struct ieee80211_mgmt * mgmt,size_t len,int freq)2667 int pr_pasn_auth_rx(struct pr_data *pr, const struct ieee80211_mgmt *mgmt,
2668 size_t len, int freq)
2669 {
2670 struct pr_device *dev;
2671 u16 auth_alg, auth_transaction;
2672
2673 dev = pr_get_device(pr, mgmt->sa);
2674 if (!dev) {
2675 wpa_printf(MSG_INFO, "PR: Peer not found " MACSTR,
2676 MAC2STR(mgmt->sa));
2677 return -1;
2678 }
2679
2680 if (!ether_addr_equal(mgmt->da, pr->cfg->dev_addr)) {
2681 wpa_printf(MSG_INFO, "PR PASN: Not our frame");
2682 return -1;
2683 }
2684
2685 if (len < offsetof(struct ieee80211_mgmt, u.auth.variable))
2686 return -1;
2687
2688 auth_alg = le_to_host16(mgmt->u.auth.auth_alg);
2689 if (auth_alg != WLAN_AUTH_PASN) {
2690 wpa_printf(MSG_INFO,
2691 "PR: Unexpected Authentication frame, auth_alg=%d",
2692 auth_alg);
2693 return -1;
2694 }
2695
2696 auth_transaction = le_to_host16(mgmt->u.auth.auth_transaction);
2697 if (auth_transaction == WLAN_AUTH_TR_SEQ_PASN_AUTH1)
2698 return pr_pasn_handle_auth_1(pr, dev, mgmt, len, freq);
2699 if (auth_transaction == WLAN_AUTH_TR_SEQ_PASN_AUTH2)
2700 return pr_pasn_handle_auth_2(pr, dev, mgmt, len);
2701 if (auth_transaction == WLAN_AUTH_TR_SEQ_PASN_AUTH3)
2702 return pr_pasn_handle_auth_3(pr, dev, mgmt, len);
2703
2704 return -1;
2705 }
2706
2707 #endif /* CONFIG_PASN */
2708