1 /*
2 * wpa_supplicant - TDLS
3 * Copyright (c) 2010-2011, Atheros Communications
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "utils/os.h"
14 #include "common/ieee802_11_defs.h"
15 #include "common/ieee802_11_common.h"
16 #include "crypto/sha256.h"
17 #include "crypto/crypto.h"
18 #include "crypto/aes_wrap.h"
19 #include "rsn_supp/wpa.h"
20 #include "rsn_supp/wpa_ie.h"
21 #include "rsn_supp/wpa_i.h"
22 #include "drivers/driver.h"
23 #include "l2_packet/l2_packet.h"
24
25 #ifdef CONFIG_TDLS_TESTING
26 #define TDLS_TESTING_LONG_FRAME BIT(0)
27 #define TDLS_TESTING_ALT_RSN_IE BIT(1)
28 #define TDLS_TESTING_DIFF_BSSID BIT(2)
29 #define TDLS_TESTING_SHORT_LIFETIME BIT(3)
30 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
31 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
32 #define TDLS_TESTING_LONG_LIFETIME BIT(6)
33 #define TDLS_TESTING_CONCURRENT_INIT BIT(7)
34 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
35 #define TDLS_TESTING_DECLINE_RESP BIT(9)
36 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
37 #define TDLS_TESTING_WRONG_MIC BIT(11)
38 #define TDLS_TESTING_DOUBLE_TPK_M2 BIT(12)
39 unsigned int tdls_testing = 0;
40 #endif /* CONFIG_TDLS_TESTING */
41
42 #define TPK_LIFETIME 43200 /* 12 hours */
43 #define TPK_M1_RETRY_COUNT 3
44 #define TPK_M1_TIMEOUT 5000 /* in milliseconds */
45 #define TPK_M2_RETRY_COUNT 10
46 #define TPK_M2_TIMEOUT 500 /* in milliseconds */
47
48 #define TDLS_MIC_LEN 16
49
50 #define TDLS_TIMEOUT_LEN 4
51
52 struct wpa_tdls_ftie {
53 u8 ie_type; /* FTIE */
54 u8 ie_len;
55 u8 mic_ctrl[2];
56 u8 mic[TDLS_MIC_LEN];
57 u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
58 u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
59 /* followed by optional elements */
60 } STRUCT_PACKED;
61
62 struct wpa_tdls_timeoutie {
63 u8 ie_type; /* Timeout IE */
64 u8 ie_len;
65 u8 interval_type;
66 u8 value[TDLS_TIMEOUT_LEN];
67 } STRUCT_PACKED;
68
69 struct wpa_tdls_lnkid {
70 u8 ie_type; /* Link Identifier IE */
71 u8 ie_len;
72 u8 bssid[ETH_ALEN];
73 u8 init_sta[ETH_ALEN];
74 u8 resp_sta[ETH_ALEN];
75 } STRUCT_PACKED;
76
77 /* TDLS frame headers as per IEEE Std 802.11z-2010 */
78 struct wpa_tdls_frame {
79 u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
80 u8 category; /* Category */
81 u8 action; /* Action (enum tdls_frame_type) */
82 } STRUCT_PACKED;
83
84 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
85 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
86 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
87 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
88 struct wpa_tdls_peer *peer);
89 static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
90 u16 reason_code);
91
92
93 #define TDLS_MAX_IE_LEN 80
94 #define IEEE80211_MAX_SUPP_RATES 32
95
96 struct wpa_tdls_peer {
97 struct wpa_tdls_peer *next;
98 unsigned int reconfig_key:1;
99 int initiator; /* whether this end was initiator for TDLS setup */
100 u8 addr[ETH_ALEN]; /* other end MAC address */
101 u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
102 u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
103 u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
104 size_t rsnie_i_len;
105 u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
106 size_t rsnie_p_len;
107 u32 lifetime;
108 int cipher; /* Selected cipher (WPA_CIPHER_*) */
109 u8 dtoken;
110
111 struct tpk {
112 u8 kck[16]; /* TPK-KCK */
113 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
114 } tpk;
115 int tpk_set;
116 int tk_set; /* TPK-TK configured to the driver */
117 int tpk_success;
118 int tpk_in_progress;
119
120 struct tpk_timer {
121 u8 dest[ETH_ALEN];
122 int count; /* Retry Count */
123 int timer; /* Timeout in milliseconds */
124 u8 action_code; /* TDLS frame type */
125 u8 dialog_token;
126 u16 status_code;
127 u32 peer_capab;
128 int buf_len; /* length of TPK message for retransmission */
129 u8 *buf; /* buffer for TPK message */
130 } sm_tmr;
131
132 u16 capability;
133
134 u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
135 size_t supp_rates_len;
136
137 struct ieee80211_ht_capabilities *ht_capabilities;
138 struct ieee80211_vht_capabilities *vht_capabilities;
139 struct ieee80211_he_capabilities *he_capabilities;
140 size_t he_capab_len;
141 struct ieee80211_he_6ghz_band_cap *he_6ghz_band_capabilities;
142 struct ieee80211_eht_capabilities *eht_capabilities;
143 size_t eht_capab_len;
144
145 u8 qos_info;
146
147 u16 aid;
148
149 u8 *ext_capab;
150 size_t ext_capab_len;
151
152 u8 *supp_channels;
153 size_t supp_channels_len;
154
155 u8 *supp_oper_classes;
156 size_t supp_oper_classes_len;
157
158 u8 wmm_capable;
159
160 /* channel switch currently enabled */
161 int chan_switch_enabled;
162
163 int mld_link_id;
164 bool disc_resp_rcvd;
165 bool setup_req_rcvd;
166 };
167
168
wpa_tdls_get_link_bssid(struct wpa_sm * sm,int link_id)169 static const u8 * wpa_tdls_get_link_bssid(struct wpa_sm *sm, int link_id)
170 {
171 if (link_id >= 0)
172 return sm->mlo.links[link_id].bssid;
173 return sm->bssid;
174 }
175
176
wpa_tdls_get_privacy(struct wpa_sm * sm)177 static int wpa_tdls_get_privacy(struct wpa_sm *sm)
178 {
179 /*
180 * Get info needed from supplicant to check if the current BSS supports
181 * security. Other than OPEN mode, rest are considered secured
182 * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
183 */
184 return sm->pairwise_cipher != WPA_CIPHER_NONE;
185 }
186
187
wpa_add_ie(u8 * pos,const u8 * ie,size_t ie_len)188 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
189 {
190 os_memcpy(pos, ie, ie_len);
191 return pos + ie_len;
192 }
193
194
wpa_tdls_del_key(struct wpa_sm * sm,struct wpa_tdls_peer * peer)195 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
196 {
197 if (wpa_sm_set_key(sm, -1, WPA_ALG_NONE, peer->addr,
198 0, 0, NULL, 0, NULL, 0, KEY_FLAG_PAIRWISE) < 0) {
199 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
200 "the driver");
201 return -1;
202 }
203
204 return 0;
205 }
206
207
wpa_tdls_set_key(struct wpa_sm * sm,struct wpa_tdls_peer * peer)208 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
209 {
210 u8 key_len;
211 u8 rsc[6];
212 enum wpa_alg alg;
213
214 if (peer->tk_set) {
215 /*
216 * This same TPK-TK has already been configured to the driver
217 * and this new configuration attempt (likely due to an
218 * unexpected retransmitted frame) would result in clearing
219 * the TX/RX sequence number which can break security, so must
220 * not allow that to happen.
221 */
222 wpa_printf(MSG_INFO, "TDLS: TPK-TK for the peer " MACSTR
223 " has already been configured to the driver - do not reconfigure",
224 MAC2STR(peer->addr));
225 return -1;
226 }
227
228 os_memset(rsc, 0, 6);
229
230 switch (peer->cipher) {
231 case WPA_CIPHER_CCMP:
232 alg = WPA_ALG_CCMP;
233 key_len = 16;
234 break;
235 case WPA_CIPHER_NONE:
236 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
237 "NONE - do not use pairwise keys");
238 return -1;
239 default:
240 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
241 sm->pairwise_cipher);
242 return -1;
243 }
244
245 wpa_printf(MSG_DEBUG, "TDLS: Configure pairwise key for peer " MACSTR,
246 MAC2STR(peer->addr));
247 if (wpa_sm_set_key(sm, -1, alg, peer->addr, 0, 1, rsc, sizeof(rsc),
248 peer->tpk.tk, key_len,
249 KEY_FLAG_PAIRWISE_RX_TX) < 0) {
250 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
251 "driver");
252 return -1;
253 }
254 peer->tk_set = 1;
255 return 0;
256 }
257
258
wpa_tdls_send_tpk_msg(struct wpa_sm * sm,const u8 * dst,u8 action_code,u8 dialog_token,u16 status_code,u32 peer_capab,int initiator,const u8 * buf,size_t len,int link_id)259 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
260 u8 action_code, u8 dialog_token,
261 u16 status_code, u32 peer_capab,
262 int initiator, const u8 *buf, size_t len,
263 int link_id)
264 {
265 return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
266 status_code, peer_capab, initiator, buf,
267 len, link_id);
268 }
269
270
wpa_tdls_tpk_send(struct wpa_sm * sm,const u8 * dest,u8 action_code,u8 dialog_token,u16 status_code,u32 peer_capab,int initiator,const u8 * msg,size_t msg_len,int link_id)271 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
272 u8 dialog_token, u16 status_code, u32 peer_capab,
273 int initiator, const u8 *msg, size_t msg_len,
274 int link_id)
275 {
276 struct wpa_tdls_peer *peer;
277
278 wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
279 "dialog_token=%u status_code=%u peer_capab=%u initiator=%d "
280 "msg_len=%u",
281 MAC2STR(dest), action_code, dialog_token, status_code,
282 peer_capab, initiator, (unsigned int) msg_len);
283
284 if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
285 status_code, peer_capab, initiator, msg,
286 msg_len, link_id)) {
287 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
288 "(action_code=%u)", action_code);
289 return -1;
290 }
291
292 if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
293 action_code == WLAN_TDLS_TEARDOWN ||
294 action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
295 action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
296 return 0; /* No retries */
297
298 for (peer = sm->tdls; peer; peer = peer->next) {
299 if (ether_addr_equal(peer->addr, dest))
300 break;
301 }
302
303 if (peer == NULL) {
304 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
305 "retry " MACSTR, MAC2STR(dest));
306 return 0;
307 }
308
309 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
310
311 if (action_code == WLAN_TDLS_SETUP_RESPONSE) {
312 peer->sm_tmr.count = TPK_M2_RETRY_COUNT;
313 peer->sm_tmr.timer = TPK_M2_TIMEOUT;
314 } else {
315 peer->sm_tmr.count = TPK_M1_RETRY_COUNT;
316 peer->sm_tmr.timer = TPK_M1_TIMEOUT;
317 }
318
319 /* Copy message to resend on timeout */
320 os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
321 peer->sm_tmr.action_code = action_code;
322 peer->sm_tmr.dialog_token = dialog_token;
323 peer->sm_tmr.status_code = status_code;
324 peer->sm_tmr.peer_capab = peer_capab;
325 peer->sm_tmr.buf_len = msg_len;
326 os_free(peer->sm_tmr.buf);
327 peer->sm_tmr.buf = os_memdup(msg, msg_len);
328 if (peer->sm_tmr.buf == NULL)
329 return -1;
330
331 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
332 "(action_code=%u)", action_code);
333 eloop_register_timeout(peer->sm_tmr.timer / 1000,
334 (peer->sm_tmr.timer % 1000) * 1000,
335 wpa_tdls_tpk_retry_timeout, sm, peer);
336 return 0;
337 }
338
339
wpa_tdls_do_teardown(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u16 reason_code)340 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
341 u16 reason_code)
342 {
343 int ret;
344
345 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
346 /* disable the link after teardown was sent */
347 wpa_tdls_disable_peer_link(sm, peer);
348
349 return ret;
350 }
351
352
wpa_tdls_tpk_retry_timeout(void * eloop_ctx,void * timeout_ctx)353 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
354 {
355
356 struct wpa_sm *sm = eloop_ctx;
357 struct wpa_tdls_peer *peer = timeout_ctx;
358
359 if (peer->sm_tmr.count) {
360 peer->sm_tmr.count--;
361
362 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
363 "(action_code=%u)",
364 peer->sm_tmr.action_code);
365
366 if (peer->sm_tmr.buf == NULL) {
367 wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
368 "for action_code=%u",
369 peer->sm_tmr.action_code);
370 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
371 peer);
372 return;
373 }
374
375 /* resend TPK Handshake Message to Peer */
376 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
377 peer->sm_tmr.action_code,
378 peer->sm_tmr.dialog_token,
379 peer->sm_tmr.status_code,
380 peer->sm_tmr.peer_capab,
381 peer->initiator,
382 peer->sm_tmr.buf,
383 peer->sm_tmr.buf_len, -1)) {
384 wpa_printf(MSG_INFO, "TDLS: Failed to retry "
385 "transmission");
386 }
387
388 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
389 eloop_register_timeout(peer->sm_tmr.timer / 1000,
390 (peer->sm_tmr.timer % 1000) * 1000,
391 wpa_tdls_tpk_retry_timeout, sm, peer);
392 } else {
393 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
394
395 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
396 wpa_tdls_do_teardown(sm, peer,
397 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
398 }
399 }
400
401
wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u8 action_code)402 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
403 struct wpa_tdls_peer *peer,
404 u8 action_code)
405 {
406 if (action_code == peer->sm_tmr.action_code) {
407 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
408 "action_code=%u", action_code);
409
410 /* Cancel Timeout registered */
411 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
412
413 /* free all resources meant for retry */
414 os_free(peer->sm_tmr.buf);
415 peer->sm_tmr.buf = NULL;
416
417 peer->sm_tmr.count = 0;
418 peer->sm_tmr.timer = 0;
419 peer->sm_tmr.buf_len = 0;
420 peer->sm_tmr.action_code = 0xff;
421 } else {
422 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
423 "(Unknown action_code=%u)", action_code);
424 }
425 }
426
427
wpa_tdls_generate_tpk(struct wpa_tdls_peer * peer,const u8 * own_addr,const u8 * bssid)428 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
429 const u8 *own_addr, const u8 *bssid)
430 {
431 u8 key_input[SHA256_MAC_LEN];
432 const u8 *nonce[2];
433 size_t len[2];
434 u8 data[3 * ETH_ALEN];
435
436 /* IEEE Std 802.11-2016 12.7.9.2:
437 * TPK-Key-Input = Hash(min(SNonce, ANonce) || max(SNonce, ANonce))
438 * Hash = SHA-256 for TDLS
439 */
440 len[0] = WPA_NONCE_LEN;
441 len[1] = WPA_NONCE_LEN;
442 if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
443 nonce[0] = peer->inonce;
444 nonce[1] = peer->rnonce;
445 } else {
446 nonce[0] = peer->rnonce;
447 nonce[1] = peer->inonce;
448 }
449 wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
450 wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
451 sha256_vector(2, nonce, len, key_input);
452 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
453 key_input, SHA256_MAC_LEN);
454
455 /*
456 * TPK = KDF-Hash-Length(TPK-Key-Input, "TDLS PMK",
457 * min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID)
458 */
459
460 if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
461 os_memcpy(data, own_addr, ETH_ALEN);
462 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
463 } else {
464 os_memcpy(data, peer->addr, ETH_ALEN);
465 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
466 }
467 os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
468 wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
469
470 sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
471 (u8 *) &peer->tpk, sizeof(peer->tpk));
472 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
473 peer->tpk.kck, sizeof(peer->tpk.kck));
474 wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
475 peer->tpk.tk, sizeof(peer->tpk.tk));
476 peer->tpk_set = 1;
477 }
478
479
480 /**
481 * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
482 * @kck: TPK-KCK
483 * @lnkid: Pointer to the beginning of Link Identifier IE
484 * @rsne: Pointer to the beginning of RSNE used for handshake
485 * @rsne_len: Length of RSNE in octets
486 * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
487 * @fte: Pointer to the beginning of FTE
488 * @fre_len: Length of FTE in octets
489 * @mic: Pointer for writing MIC
490 *
491 * Calculate MIC for TDLS frame.
492 */
wpa_tdls_ftie_mic(const u8 * kck,u8 trans_seq,const u8 * lnkid,const u8 * rsne,size_t rsne_len,const u8 * timeoutie,const u8 * fte,size_t fte_len,u8 * mic)493 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
494 const u8 *rsne, size_t rsne_len,
495 const u8 *timeoutie,
496 const u8 *fte, size_t fte_len, u8 *mic)
497 {
498 u8 *buf, *pos;
499 struct wpa_tdls_ftie *_ftie;
500 const struct wpa_tdls_lnkid *_lnkid;
501 int ret;
502 int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + rsne_len +
503 2 + timeoutie[1] + fte_len;
504 buf = os_zalloc(len);
505 if (!buf) {
506 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
507 return -1;
508 }
509
510 pos = buf;
511 _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
512 /* 1) TDLS initiator STA MAC address */
513 os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
514 pos += ETH_ALEN;
515 /* 2) TDLS responder STA MAC address */
516 os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
517 pos += ETH_ALEN;
518 /* 3) Transaction Sequence number */
519 *pos++ = trans_seq;
520 /* 4) Link Identifier IE */
521 os_memcpy(pos, lnkid, 2 + lnkid[1]);
522 pos += 2 + lnkid[1];
523 /* 5) RSN IE */
524 os_memcpy(pos, rsne, rsne_len);
525 pos += rsne_len;
526 /* 6) Timeout Interval IE */
527 os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
528 pos += 2 + timeoutie[1];
529 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
530 os_memcpy(pos, fte, fte_len);
531 _ftie = (struct wpa_tdls_ftie *) pos;
532 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
533 pos += fte_len;
534
535 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
536 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
537 ret = omac1_aes_128(kck, buf, pos - buf, mic);
538 os_free(buf);
539 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
540 return ret;
541 }
542
543
544 /**
545 * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
546 * @kck: TPK-KCK
547 * @trans_seq: Transaction Sequence Number (4 - Teardown)
548 * @rcode: Reason code for Teardown
549 * @dtoken: Dialog Token used for that particular link
550 * @lnkid: Pointer to the beginning of Link Identifier IE
551 * @fte: Pointer to the beginning of FTE
552 * @fre_len: Length of FTE in octets
553 * @mic: Pointer for writing MIC
554 *
555 * Calculate MIC for TDLS frame.
556 */
wpa_tdls_key_mic_teardown(const u8 * kck,u8 trans_seq,u16 rcode,u8 dtoken,const u8 * lnkid,const u8 * fte,size_t fte_len,u8 * mic)557 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
558 u8 dtoken, const u8 *lnkid,
559 const u8 *fte, size_t fte_len, u8 *mic)
560 {
561 u8 *buf, *pos;
562 struct wpa_tdls_ftie *_ftie;
563 int ret;
564 int len;
565
566 if (lnkid == NULL)
567 return -1;
568
569 len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
570 sizeof(trans_seq) + fte_len;
571
572 buf = os_zalloc(len);
573 if (!buf) {
574 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
575 return -1;
576 }
577
578 pos = buf;
579 /* 1) Link Identifier IE */
580 os_memcpy(pos, lnkid, 2 + lnkid[1]);
581 pos += 2 + lnkid[1];
582 /* 2) Reason Code */
583 WPA_PUT_LE16(pos, rcode);
584 pos += sizeof(rcode);
585 /* 3) Dialog token */
586 *pos++ = dtoken;
587 /* 4) Transaction Sequence number */
588 *pos++ = trans_seq;
589 /* 7) FTIE, with the MIC field of the FTIE set to 0 */
590 os_memcpy(pos, fte, fte_len);
591 _ftie = (struct wpa_tdls_ftie *) pos;
592 os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
593 pos += fte_len;
594
595 wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
596 wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
597 ret = omac1_aes_128(kck, buf, pos - buf, mic);
598 os_free(buf);
599 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
600 return ret;
601 }
602
603
wpa_supplicant_verify_tdls_mic(u8 trans_seq,struct wpa_tdls_peer * peer,const u8 * lnkid,const u8 * timeoutie,const struct wpa_tdls_ftie * ftie,size_t fte_len)604 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
605 struct wpa_tdls_peer *peer,
606 const u8 *lnkid, const u8 *timeoutie,
607 const struct wpa_tdls_ftie *ftie,
608 size_t fte_len)
609 {
610 u8 mic[16];
611
612 if (peer->tpk_set) {
613 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
614 peer->rsnie_p, peer->rsnie_p_len, timeoutie,
615 (const u8 *) ftie, fte_len, mic);
616 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
617 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
618 "dropping packet");
619 wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
620 ftie->mic, 16);
621 wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
622 mic, 16);
623 return -1;
624 }
625 } else {
626 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
627 "TPK not set - dropping packet");
628 return -1;
629 }
630 return 0;
631 }
632
633
wpa_supplicant_verify_tdls_mic_teardown(u8 trans_seq,u16 rcode,u8 dtoken,struct wpa_tdls_peer * peer,const u8 * lnkid,const struct wpa_tdls_ftie * ftie,size_t fte_len)634 static int wpa_supplicant_verify_tdls_mic_teardown(
635 u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
636 const u8 *lnkid, const struct wpa_tdls_ftie *ftie, size_t fte_len)
637 {
638 u8 mic[16];
639
640 if (peer->tpk_set) {
641 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
642 dtoken, lnkid, (const u8 *) ftie,
643 fte_len, mic);
644 if (os_memcmp_const(mic, ftie->mic, 16) != 0) {
645 wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
646 "dropping packet");
647 return -1;
648 }
649 } else {
650 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
651 "MIC, TPK not set - dropping packet");
652 return -1;
653 }
654 return 0;
655 }
656
657
wpa_tdls_tpk_timeout(void * eloop_ctx,void * timeout_ctx)658 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
659 {
660 struct wpa_sm *sm = eloop_ctx;
661 struct wpa_tdls_peer *peer = timeout_ctx;
662
663 /*
664 * On TPK lifetime expiration, we have an option of either tearing down
665 * the direct link or trying to re-initiate it. The selection of what
666 * to do is not strictly speaking controlled by our role in the expired
667 * link, but for now, use that to select whether to renew or tear down
668 * the link.
669 */
670
671 if (peer->initiator) {
672 u8 addr[ETH_ALEN];
673
674 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
675 " - try to renew", MAC2STR(peer->addr));
676 /* cache the peer address before do_teardown */
677 os_memcpy(addr, peer->addr, ETH_ALEN);
678 wpa_tdls_do_teardown(sm, peer,
679 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
680 wpa_tdls_start(sm, addr);
681 } else {
682 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
683 " - tear down", MAC2STR(peer->addr));
684 wpa_tdls_do_teardown(sm, peer,
685 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
686 }
687 }
688
689
wpa_tdls_peer_remove_from_list(struct wpa_sm * sm,struct wpa_tdls_peer * peer)690 static void wpa_tdls_peer_remove_from_list(struct wpa_sm *sm,
691 struct wpa_tdls_peer *peer)
692 {
693 struct wpa_tdls_peer *cur, *prev;
694
695 cur = sm->tdls;
696 prev = NULL;
697 while (cur && cur != peer) {
698 prev = cur;
699 cur = cur->next;
700 }
701
702 if (cur != peer) {
703 wpa_printf(MSG_ERROR, "TDLS: Could not find peer " MACSTR
704 " to remove it from the list",
705 MAC2STR(peer->addr));
706 return;
707 }
708
709 if (prev)
710 prev->next = peer->next;
711 else
712 sm->tdls = peer->next;
713 }
714
715
wpa_tdls_peer_clear(struct wpa_sm * sm,struct wpa_tdls_peer * peer)716 static void wpa_tdls_peer_clear(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
717 {
718 wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
719 MAC2STR(peer->addr));
720 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
721 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
722 peer->reconfig_key = 0;
723 peer->initiator = 0;
724 peer->tpk_in_progress = 0;
725 os_free(peer->sm_tmr.buf);
726 peer->sm_tmr.buf = NULL;
727 os_free(peer->ht_capabilities);
728 peer->ht_capabilities = NULL;
729 os_free(peer->vht_capabilities);
730 peer->vht_capabilities = NULL;
731 os_free(peer->he_capabilities);
732 peer->he_capabilities = NULL;
733 os_free(peer->he_6ghz_band_capabilities);
734 peer->he_6ghz_band_capabilities = NULL;
735 os_free(peer->eht_capabilities);
736 peer->eht_capabilities = NULL;
737 os_free(peer->ext_capab);
738 peer->ext_capab = NULL;
739 os_free(peer->supp_channels);
740 peer->supp_channels = NULL;
741 os_free(peer->supp_oper_classes);
742 peer->supp_oper_classes = NULL;
743 peer->rsnie_i_len = peer->rsnie_p_len = 0;
744 peer->cipher = 0;
745 peer->qos_info = 0;
746 peer->wmm_capable = 0;
747 peer->tk_set = peer->tpk_set = peer->tpk_success = 0;
748 peer->chan_switch_enabled = 0;
749 os_memset(&peer->tpk, 0, sizeof(peer->tpk));
750 os_memset(peer->inonce, 0, WPA_NONCE_LEN);
751 os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
752 peer->mld_link_id = -1;
753 }
754
755
wpa_tdls_peer_free(struct wpa_sm * sm,struct wpa_tdls_peer * peer)756 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
757 {
758 wpa_tdls_peer_clear(sm, peer);
759 wpa_tdls_peer_remove_from_list(sm, peer);
760 os_free(peer);
761 }
762
763
wpa_tdls_linkid(struct wpa_sm * sm,struct wpa_tdls_peer * peer,struct wpa_tdls_lnkid * lnkid)764 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
765 struct wpa_tdls_lnkid *lnkid)
766 {
767 lnkid->ie_type = WLAN_EID_LINK_ID;
768 lnkid->ie_len = 3 * ETH_ALEN;
769 os_memcpy(lnkid->bssid, wpa_tdls_get_link_bssid(sm, peer->mld_link_id),
770 ETH_ALEN);
771 if (peer->initiator) {
772 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
773 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
774 } else {
775 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
776 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
777 }
778 }
779
780
wpa_tdls_send_teardown(struct wpa_sm * sm,const u8 * addr,u16 reason_code)781 static int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr,
782 u16 reason_code)
783 {
784 struct wpa_tdls_peer *peer;
785 struct wpa_tdls_ftie *ftie;
786 struct wpa_tdls_lnkid lnkid;
787 u8 dialog_token;
788 u8 *rbuf, *pos;
789 int ielen;
790
791 if (sm->tdls_disabled || !sm->tdls_supported)
792 return -1;
793
794 /* Find the node and free from the list */
795 for (peer = sm->tdls; peer; peer = peer->next) {
796 if (ether_addr_equal(peer->addr, addr))
797 break;
798 }
799
800 if (peer == NULL) {
801 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
802 "Teardown " MACSTR, MAC2STR(addr));
803 return 0;
804 }
805
806 /* Cancel active channel switch before teardown */
807 if (peer->chan_switch_enabled) {
808 wpa_printf(MSG_DEBUG, "TDLS: First returning link with " MACSTR
809 " to base channel", MAC2STR(addr));
810 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
811 }
812
813 dialog_token = peer->dtoken;
814
815 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
816 MAC2STR(addr));
817
818 ielen = 0;
819 if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
820 /* To add FTIE for Teardown request and compute MIC */
821 ielen += sizeof(*ftie);
822 #ifdef CONFIG_TDLS_TESTING
823 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
824 ielen += 170;
825 #endif /* CONFIG_TDLS_TESTING */
826 }
827
828 rbuf = os_zalloc(ielen + 1);
829 if (rbuf == NULL)
830 return -1;
831 pos = rbuf;
832
833 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
834 goto skip_ies;
835
836 ftie = (struct wpa_tdls_ftie *) pos;
837 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
838 /* Using the recent nonce which should be for CONFIRM frame */
839 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
840 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
841 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
842 pos = (u8 *) (ftie + 1);
843 #ifdef CONFIG_TDLS_TESTING
844 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
845 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
846 "FTIE");
847 ftie->ie_len += 170;
848 *pos++ = 255; /* FTIE subelem */
849 *pos++ = 168; /* FTIE subelem length */
850 pos += 168;
851 }
852 #endif /* CONFIG_TDLS_TESTING */
853 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
854 (u8 *) ftie, pos - (u8 *) ftie);
855
856 /* compute MIC before sending */
857 wpa_tdls_linkid(sm, peer, &lnkid);
858 wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
859 dialog_token, (const u8 *) &lnkid,
860 (const u8 *) ftie, 2 + ftie->ie_len,
861 ftie->mic);
862
863 skip_ies:
864 /* TODO: register for a Timeout handler, if Teardown is not received at
865 * the other end, then try again another time */
866
867 /* request driver to send Teardown using this FTIE */
868 wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
869 reason_code, 0, peer->initiator, rbuf, pos - rbuf,
870 -1);
871 os_free(rbuf);
872
873 return 0;
874 }
875
876
wpa_tdls_teardown_link(struct wpa_sm * sm,const u8 * addr,u16 reason_code)877 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
878 {
879 struct wpa_tdls_peer *peer;
880
881 if (sm->tdls_disabled || !sm->tdls_supported)
882 return -1;
883
884 for (peer = sm->tdls; peer; peer = peer->next) {
885 if (ether_addr_equal(peer->addr, addr))
886 break;
887 }
888
889 if (peer == NULL) {
890 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
891 " for link Teardown", MAC2STR(addr));
892 return -1;
893 }
894
895 if (!peer->tpk_success) {
896 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
897 " not connected - cannot Teardown link", MAC2STR(addr));
898 return -1;
899 }
900
901 return wpa_tdls_do_teardown(sm, peer, reason_code);
902 }
903
904
wpa_tdls_disable_peer_link(struct wpa_sm * sm,struct wpa_tdls_peer * peer)905 static void wpa_tdls_disable_peer_link(struct wpa_sm *sm,
906 struct wpa_tdls_peer *peer)
907 {
908 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
909 wpa_tdls_peer_free(sm, peer);
910 }
911
912
wpa_tdls_disable_unreachable_link(struct wpa_sm * sm,const u8 * addr)913 void wpa_tdls_disable_unreachable_link(struct wpa_sm *sm, const u8 *addr)
914 {
915 struct wpa_tdls_peer *peer;
916
917 for (peer = sm->tdls; peer; peer = peer->next) {
918 if (ether_addr_equal(peer->addr, addr))
919 break;
920 }
921
922 if (!peer || !peer->tpk_success) {
923 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
924 " not connected - cannot teardown unreachable link",
925 MAC2STR(addr));
926 return;
927 }
928
929 if (wpa_tdls_is_external_setup(sm)) {
930 /*
931 * Get us on the base channel, disable the link, send a
932 * teardown packet through the AP, and then reset link data.
933 */
934 if (peer->chan_switch_enabled)
935 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
936 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
937 wpa_tdls_send_teardown(sm, addr,
938 WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE);
939 wpa_tdls_peer_free(sm, peer);
940 } else {
941 wpa_tdls_disable_peer_link(sm, peer);
942 }
943 }
944
945
wpa_tdls_get_link_status(struct wpa_sm * sm,const u8 * addr)946 const char * wpa_tdls_get_link_status(struct wpa_sm *sm, const u8 *addr)
947 {
948 struct wpa_tdls_peer *peer;
949
950 if (sm->tdls_disabled || !sm->tdls_supported)
951 return "disabled";
952
953 for (peer = sm->tdls; peer; peer = peer->next) {
954 if (ether_addr_equal(peer->addr, addr))
955 break;
956 }
957
958 if (peer == NULL)
959 return "peer does not exist";
960
961 if (!peer->tpk_success)
962 return "peer not connected";
963
964 return "connected";
965 }
966
967
wpa_tdls_recv_teardown(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)968 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
969 const u8 *buf, size_t len)
970 {
971 struct wpa_tdls_peer *peer = NULL;
972 struct wpa_tdls_ftie *ftie;
973 struct wpa_tdls_lnkid *lnkid;
974 struct wpa_eapol_ie_parse kde;
975 u16 reason_code;
976 const u8 *pos;
977 int ielen;
978
979 /* Find the node and free from the list */
980 for (peer = sm->tdls; peer; peer = peer->next) {
981 if (ether_addr_equal(peer->addr, src_addr))
982 break;
983 }
984
985 if (peer == NULL) {
986 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
987 "Teardown " MACSTR, MAC2STR(src_addr));
988 return 0;
989 }
990
991 if (len < sizeof(struct wpa_tdls_frame) + 2 /* Reason Code */) {
992 wpa_printf(MSG_INFO, "TDLS: Too short Teardown frame (len=%zu)",
993 len);
994 return -1;
995 }
996
997 pos = buf;
998 pos += sizeof(struct wpa_tdls_frame);
999
1000 reason_code = WPA_GET_LE16(pos);
1001 pos += 2;
1002
1003 wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
1004 " (reason code %u)", MAC2STR(src_addr), reason_code);
1005
1006 ielen = len - (pos - buf); /* start of IE in buf */
1007
1008 /*
1009 * Don't reject the message if failing to parse IEs. The IEs we need are
1010 * explicitly checked below. Some APs may add arbitrary padding to the
1011 * end of short TDLS frames and that would look like invalid IEs.
1012 */
1013 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0)
1014 wpa_printf(MSG_DEBUG,
1015 "TDLS: Failed to parse IEs in Teardown - ignore as an interop workaround");
1016
1017 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1018 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
1019 "Teardown");
1020 return -1;
1021 }
1022 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1023
1024 if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
1025 goto skip_ftie;
1026
1027 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
1028 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
1029 return -1;
1030 }
1031
1032 ftie = (struct wpa_tdls_ftie *) kde.ftie;
1033
1034 /* Process MIC check to see if TDLS Teardown is right */
1035 if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
1036 peer->dtoken, peer,
1037 (const u8 *) lnkid,
1038 ftie, kde.ftie_len) < 0) {
1039 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
1040 "Teardown Request from " MACSTR, MAC2STR(src_addr));
1041 return -1;
1042 }
1043
1044 skip_ftie:
1045 /*
1046 * Request the driver to disable the direct link and clear associated
1047 * keys.
1048 */
1049 wpa_tdls_disable_peer_link(sm, peer);
1050 return 0;
1051 }
1052
1053
1054 /**
1055 * wpa_tdls_send_error - To send suitable TDLS status response with
1056 * appropriate status code mentioning reason for error/failure.
1057 * @dst - MAC addr of Peer station
1058 * @tdls_action - TDLS frame type for which error code is sent
1059 * @initiator - was this end the initiator of the connection
1060 * @status - status code mentioning reason
1061 */
1062
wpa_tdls_send_error(struct wpa_sm * sm,const u8 * dst,u8 tdls_action,u8 dialog_token,int initiator,u16 status)1063 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
1064 u8 tdls_action, u8 dialog_token, int initiator,
1065 u16 status)
1066 {
1067 wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
1068 " (action=%u status=%u)",
1069 MAC2STR(dst), tdls_action, status);
1070 return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
1071 0, initiator, NULL, 0, -1);
1072 }
1073
1074
1075 static struct wpa_tdls_peer *
wpa_tdls_add_peer(struct wpa_sm * sm,const u8 * addr,int * existing)1076 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr, int *existing)
1077 {
1078 struct wpa_tdls_peer *peer;
1079
1080 if (existing)
1081 *existing = 0;
1082 for (peer = sm->tdls; peer; peer = peer->next) {
1083 if (ether_addr_equal(peer->addr, addr)) {
1084 if (existing)
1085 *existing = 1;
1086 return peer; /* re-use existing entry */
1087 }
1088 }
1089
1090 wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
1091 MAC2STR(addr));
1092
1093 peer = os_zalloc(sizeof(*peer));
1094 if (peer == NULL)
1095 return NULL;
1096
1097 os_memcpy(peer->addr, addr, ETH_ALEN);
1098 peer->mld_link_id = -1;
1099 peer->next = sm->tdls;
1100 sm->tdls = peer;
1101
1102 return peer;
1103 }
1104
1105
wpa_tdls_send_tpk_m1(struct wpa_sm * sm,struct wpa_tdls_peer * peer)1106 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
1107 struct wpa_tdls_peer *peer)
1108 {
1109 size_t buf_len;
1110 struct wpa_tdls_timeoutie timeoutie;
1111 u16 rsn_capab;
1112 struct wpa_tdls_ftie *ftie;
1113 u8 *rbuf, *pos, *count_pos;
1114 u16 count;
1115 struct rsn_ie_hdr *hdr;
1116 int status;
1117
1118 if (!wpa_tdls_get_privacy(sm)) {
1119 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
1120 peer->rsnie_i_len = 0;
1121 goto skip_rsnie;
1122 }
1123
1124 /*
1125 * TPK Handshake Message 1:
1126 * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
1127 * Timeout Interval IE))
1128 */
1129
1130 /* Filling RSN IE */
1131 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1132 hdr->elem_id = WLAN_EID_RSN;
1133 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1134
1135 pos = (u8 *) (hdr + 1);
1136 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1137 pos += RSN_SELECTOR_LEN;
1138 count_pos = pos;
1139 pos += 2;
1140
1141 count = 0;
1142
1143 /*
1144 * AES-CCMP is the default Encryption preferred for TDLS, so
1145 * RSN IE is filled only with CCMP CIPHER
1146 * Note: TKIP is not used to encrypt TDLS link.
1147 *
1148 * Regardless of the cipher used on the AP connection, select CCMP
1149 * here.
1150 */
1151 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1152 pos += RSN_SELECTOR_LEN;
1153 count++;
1154
1155 WPA_PUT_LE16(count_pos, count);
1156
1157 WPA_PUT_LE16(pos, 1);
1158 pos += 2;
1159 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1160 pos += RSN_SELECTOR_LEN;
1161
1162 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1163 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1164 #ifdef CONFIG_TDLS_TESTING
1165 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1166 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
1167 "testing");
1168 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1169 }
1170 #endif /* CONFIG_TDLS_TESTING */
1171 WPA_PUT_LE16(pos, rsn_capab);
1172 pos += 2;
1173 #ifdef CONFIG_TDLS_TESTING
1174 if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
1175 /* Number of PMKIDs */
1176 *pos++ = 0x00;
1177 *pos++ = 0x00;
1178 }
1179 #endif /* CONFIG_TDLS_TESTING */
1180
1181 hdr->len = (pos - peer->rsnie_i) - 2;
1182 peer->rsnie_i_len = pos - peer->rsnie_i;
1183 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1184 peer->rsnie_i, peer->rsnie_i_len);
1185
1186 skip_rsnie:
1187 buf_len = 0;
1188 if (wpa_tdls_get_privacy(sm))
1189 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1190 sizeof(struct wpa_tdls_timeoutie);
1191 #ifdef CONFIG_TDLS_TESTING
1192 if (wpa_tdls_get_privacy(sm) &&
1193 (tdls_testing & TDLS_TESTING_LONG_FRAME))
1194 buf_len += 170;
1195 if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
1196 buf_len += sizeof(struct wpa_tdls_lnkid);
1197 #endif /* CONFIG_TDLS_TESTING */
1198 rbuf = os_zalloc(buf_len + 1);
1199 if (rbuf == NULL) {
1200 wpa_tdls_peer_free(sm, peer);
1201 return -2;
1202 }
1203 pos = rbuf;
1204
1205 if (!wpa_tdls_get_privacy(sm))
1206 goto skip_ies;
1207
1208 /* Initiator RSN IE */
1209 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1210
1211 ftie = (struct wpa_tdls_ftie *) pos;
1212 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1213 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1214
1215 if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1216 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1217 "TDLS: Failed to get random data for initiator Nonce");
1218 os_free(rbuf);
1219 wpa_tdls_peer_free(sm, peer);
1220 return -2;
1221 }
1222 peer->tk_set = 0; /* A new nonce results in a new TK */
1223 wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1224 peer->inonce, WPA_NONCE_LEN);
1225 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1226
1227 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1228 (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1229
1230 pos = (u8 *) (ftie + 1);
1231
1232 #ifdef CONFIG_TDLS_TESTING
1233 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1234 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1235 "FTIE");
1236 ftie->ie_len += 170;
1237 *pos++ = 255; /* FTIE subelem */
1238 *pos++ = 168; /* FTIE subelem length */
1239 pos += 168;
1240 }
1241 #endif /* CONFIG_TDLS_TESTING */
1242
1243 /* Lifetime */
1244 peer->lifetime = TPK_LIFETIME;
1245 #ifdef CONFIG_TDLS_TESTING
1246 if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1247 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1248 "lifetime");
1249 peer->lifetime = 301;
1250 }
1251 if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1252 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1253 "lifetime");
1254 peer->lifetime = 0xffffffff;
1255 }
1256 #endif /* CONFIG_TDLS_TESTING */
1257 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1258 sizeof(timeoutie), peer->lifetime);
1259 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1260
1261 skip_ies:
1262
1263 #ifdef CONFIG_TDLS_TESTING
1264 if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
1265 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1266
1267 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1268 "Link Identifier");
1269 wpa_tdls_linkid(sm, peer, l);
1270 l->bssid[5] ^= 0x01;
1271 pos += sizeof(*l);
1272 }
1273 #endif /* CONFIG_TDLS_TESTING */
1274
1275 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1276 "Handshake Message 1 (peer " MACSTR ")",
1277 MAC2STR(peer->addr));
1278
1279 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST,
1280 1, 0, 0, peer->initiator, rbuf, pos - rbuf,
1281 -1);
1282 os_free(rbuf);
1283
1284 return status;
1285 }
1286
1287
wpa_tdls_send_tpk_m2(struct wpa_sm * sm,const unsigned char * src_addr,u8 dtoken,struct wpa_tdls_lnkid * lnkid,const struct wpa_tdls_peer * peer)1288 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1289 const unsigned char *src_addr, u8 dtoken,
1290 struct wpa_tdls_lnkid *lnkid,
1291 const struct wpa_tdls_peer *peer)
1292 {
1293 u8 *rbuf, *pos;
1294 size_t buf_len;
1295 u32 lifetime;
1296 struct wpa_tdls_timeoutie timeoutie;
1297 struct wpa_tdls_ftie *ftie;
1298 int status;
1299
1300 buf_len = 0;
1301 if (wpa_tdls_get_privacy(sm)) {
1302 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1303 * Lifetime */
1304 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1305 sizeof(struct wpa_tdls_timeoutie);
1306 #ifdef CONFIG_TDLS_TESTING
1307 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1308 buf_len += 170;
1309 #endif /* CONFIG_TDLS_TESTING */
1310 }
1311
1312 rbuf = os_zalloc(buf_len + 1);
1313 if (rbuf == NULL)
1314 return -1;
1315 pos = rbuf;
1316
1317 if (!wpa_tdls_get_privacy(sm))
1318 goto skip_ies;
1319
1320 /* Peer RSN IE */
1321 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1322
1323 ftie = (struct wpa_tdls_ftie *) pos;
1324 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1325 /* TODO: ftie->mic_control to set 2-RESPONSE */
1326 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1327 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1328 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1329 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1330 (u8 *) ftie, sizeof(*ftie));
1331
1332 pos = (u8 *) (ftie + 1);
1333
1334 #ifdef CONFIG_TDLS_TESTING
1335 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1336 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1337 "FTIE");
1338 ftie->ie_len += 170;
1339 *pos++ = 255; /* FTIE subelem */
1340 *pos++ = 168; /* FTIE subelem length */
1341 pos += 168;
1342 }
1343 #endif /* CONFIG_TDLS_TESTING */
1344
1345 /* Lifetime */
1346 lifetime = peer->lifetime;
1347 #ifdef CONFIG_TDLS_TESTING
1348 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1349 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1350 "lifetime in response");
1351 lifetime++;
1352 }
1353 #endif /* CONFIG_TDLS_TESTING */
1354 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1355 sizeof(timeoutie), lifetime);
1356 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1357 lifetime);
1358
1359 /* compute MIC before sending */
1360 wpa_tdls_ftie_mic(peer->tpk.kck, 2, (const u8 *) lnkid, peer->rsnie_p,
1361 peer->rsnie_p_len, (const u8 *) &timeoutie,
1362 (const u8 *) ftie, 2 + ftie->ie_len, ftie->mic);
1363 #ifdef CONFIG_TDLS_TESTING
1364 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1365 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1366 ftie->mic[0] ^= 0x01;
1367 }
1368 #endif /* CONFIG_TDLS_TESTING */
1369
1370 skip_ies:
1371 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE,
1372 dtoken, 0, 0, peer->initiator, rbuf,
1373 pos - rbuf, -1);
1374 os_free(rbuf);
1375
1376 return status;
1377 }
1378
1379
wpa_tdls_send_tpk_m3(struct wpa_sm * sm,const unsigned char * src_addr,u8 dtoken,struct wpa_tdls_lnkid * lnkid,const struct wpa_tdls_peer * peer)1380 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1381 const unsigned char *src_addr, u8 dtoken,
1382 struct wpa_tdls_lnkid *lnkid,
1383 const struct wpa_tdls_peer *peer)
1384 {
1385 u8 *rbuf, *pos;
1386 size_t buf_len;
1387 struct wpa_tdls_ftie *ftie;
1388 struct wpa_tdls_timeoutie timeoutie;
1389 u32 lifetime;
1390 int status;
1391 u32 peer_capab = 0;
1392
1393 buf_len = 0;
1394 if (wpa_tdls_get_privacy(sm)) {
1395 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1396 * Lifetime */
1397 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1398 sizeof(struct wpa_tdls_timeoutie);
1399 #ifdef CONFIG_TDLS_TESTING
1400 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1401 buf_len += 170;
1402 #endif /* CONFIG_TDLS_TESTING */
1403 }
1404
1405 rbuf = os_zalloc(buf_len + 1);
1406 if (rbuf == NULL)
1407 return -1;
1408 pos = rbuf;
1409
1410 if (!wpa_tdls_get_privacy(sm))
1411 goto skip_ies;
1412
1413 /* Peer RSN IE */
1414 pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1415
1416 ftie = (struct wpa_tdls_ftie *) pos;
1417 ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1418 /*TODO: ftie->mic_control to set 3-CONFIRM */
1419 os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1420 os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1421 ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1422
1423 pos = (u8 *) (ftie + 1);
1424
1425 #ifdef CONFIG_TDLS_TESTING
1426 if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1427 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1428 "FTIE");
1429 ftie->ie_len += 170;
1430 *pos++ = 255; /* FTIE subelem */
1431 *pos++ = 168; /* FTIE subelem length */
1432 pos += 168;
1433 }
1434 #endif /* CONFIG_TDLS_TESTING */
1435
1436 /* Lifetime */
1437 lifetime = peer->lifetime;
1438 #ifdef CONFIG_TDLS_TESTING
1439 if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1440 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1441 "lifetime in confirm");
1442 lifetime++;
1443 }
1444 #endif /* CONFIG_TDLS_TESTING */
1445 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1446 sizeof(timeoutie), lifetime);
1447 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1448 lifetime);
1449
1450 /* compute MIC before sending */
1451 wpa_tdls_ftie_mic(peer->tpk.kck, 3, (const u8 *) lnkid, peer->rsnie_p,
1452 peer->rsnie_p_len, (const u8 *) &timeoutie,
1453 (const u8 *) ftie, 2 + ftie->ie_len, ftie->mic);
1454 #ifdef CONFIG_TDLS_TESTING
1455 if (tdls_testing & TDLS_TESTING_WRONG_MIC) {
1456 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong MIC");
1457 ftie->mic[0] ^= 0x01;
1458 }
1459 #endif /* CONFIG_TDLS_TESTING */
1460
1461 skip_ies:
1462
1463 if (peer->he_capabilities)
1464 peer_capab |= TDLS_PEER_HE;
1465 if (peer->vht_capabilities)
1466 peer_capab |= TDLS_PEER_VHT;
1467 if (peer->ht_capabilities)
1468 peer_capab |= TDLS_PEER_HT;
1469 if (peer->wmm_capable)
1470 peer_capab |= TDLS_PEER_WMM;
1471
1472 status = wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM,
1473 dtoken, 0, peer_capab, peer->initiator,
1474 rbuf, pos - rbuf, -1);
1475 os_free(rbuf);
1476
1477 return status;
1478 }
1479
1480
wpa_tdls_send_discovery_response(struct wpa_sm * sm,struct wpa_tdls_peer * peer,u8 dialog_token,int link_id)1481 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1482 struct wpa_tdls_peer *peer,
1483 u8 dialog_token, int link_id)
1484 {
1485 size_t buf_len = 0;
1486 struct wpa_tdls_timeoutie timeoutie;
1487 u16 rsn_capab;
1488 u8 *rbuf, *pos, *count_pos;
1489 u16 count;
1490 struct rsn_ie_hdr *hdr;
1491 int status;
1492
1493 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1494 "(peer " MACSTR ")", MAC2STR(peer->addr));
1495 if (!wpa_tdls_get_privacy(sm))
1496 goto skip_rsn_ies;
1497
1498 /* Filling RSN IE */
1499 hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
1500 hdr->elem_id = WLAN_EID_RSN;
1501 WPA_PUT_LE16(hdr->version, RSN_VERSION);
1502 pos = (u8 *) (hdr + 1);
1503 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1504 pos += RSN_SELECTOR_LEN;
1505 count_pos = pos;
1506 pos += 2;
1507 count = 0;
1508
1509 /*
1510 * AES-CCMP is the default encryption preferred for TDLS, so
1511 * RSN IE is filled only with CCMP cipher suite.
1512 * Note: TKIP is not used to encrypt TDLS link.
1513 *
1514 * Regardless of the cipher used on the AP connection, select CCMP
1515 * here.
1516 */
1517 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1518 pos += RSN_SELECTOR_LEN;
1519 count++;
1520 WPA_PUT_LE16(count_pos, count);
1521 WPA_PUT_LE16(pos, 1);
1522 pos += 2;
1523 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1524 pos += RSN_SELECTOR_LEN;
1525
1526 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1527 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1528 WPA_PUT_LE16(pos, rsn_capab);
1529 pos += 2;
1530 hdr->len = (pos - (u8 *) hdr) - 2;
1531 peer->rsnie_i_len = pos - peer->rsnie_i;
1532
1533 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for Discovery Response",
1534 (u8 *) hdr, hdr->len + 2);
1535 skip_rsn_ies:
1536 buf_len = 0;
1537 if (wpa_tdls_get_privacy(sm)) {
1538 /* Peer RSN IE, Lifetime */
1539 buf_len += peer->rsnie_i_len +
1540 sizeof(struct wpa_tdls_timeoutie);
1541 }
1542 rbuf = os_zalloc(buf_len + 1);
1543 if (rbuf == NULL) {
1544 wpa_tdls_peer_free(sm, peer);
1545 return -1;
1546 }
1547 pos = rbuf;
1548
1549 if (!wpa_tdls_get_privacy(sm))
1550 goto skip_ies;
1551 /* Initiator RSN IE */
1552 pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
1553 /* Lifetime */
1554 peer->lifetime = TPK_LIFETIME;
1555 pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1556 sizeof(timeoutie), peer->lifetime);
1557 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1558 skip_ies:
1559 status = wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
1560 dialog_token, 0, 0, 0, rbuf, pos - rbuf,
1561 link_id);
1562 os_free(rbuf);
1563
1564 return status;
1565 }
1566
1567
wpa_tdls_is_lnkid_bss_valid(struct wpa_sm * sm,const struct wpa_tdls_lnkid * lnkid,int * link_id)1568 static bool wpa_tdls_is_lnkid_bss_valid(struct wpa_sm *sm,
1569 const struct wpa_tdls_lnkid *lnkid,
1570 int *link_id)
1571 {
1572 *link_id = -1;
1573
1574 if (!sm->mlo.valid_links) {
1575 if (!ether_addr_equal(sm->bssid, lnkid->bssid))
1576 return false;
1577 } else {
1578 int i;
1579
1580 for_each_link(sm->mlo.valid_links, i) {
1581 if (ether_addr_equal(lnkid->bssid,
1582 sm->mlo.links[i].bssid)) {
1583 *link_id = i;
1584 break;
1585 }
1586 }
1587 if (*link_id < 0) {
1588 wpa_printf(MSG_DEBUG,
1589 "TDLS: MLD link not found for linkid BSS "
1590 MACSTR, MAC2STR(lnkid->bssid));
1591 return false;
1592 }
1593 }
1594
1595 return true;
1596 }
1597
1598
1599 static int
wpa_tdls_process_discovery_request(struct wpa_sm * sm,const u8 * addr,const u8 * buf,size_t len)1600 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1601 const u8 *buf, size_t len)
1602 {
1603 struct wpa_eapol_ie_parse kde;
1604 const struct wpa_tdls_lnkid *lnkid;
1605 struct wpa_tdls_peer *peer;
1606 size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1607 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1608 u8 dialog_token;
1609 int link_id = -1;
1610
1611 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1612 MAC2STR(addr));
1613
1614 if (len < min_req_len) {
1615 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1616 "%d", (int) len);
1617 return -1;
1618 }
1619
1620 dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1621
1622 /*
1623 * Some APs will tack on a weird IE to the end of a TDLS
1624 * discovery request packet. This needn't fail the response,
1625 * since the required IE are verified separately.
1626 */
1627 if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1628 len - (sizeof(struct wpa_tdls_frame) + 1),
1629 &kde) < 0) {
1630 wpa_printf(MSG_DEBUG,
1631 "TDLS: Failed to parse IEs in Discovery Request - ignore as an interop workaround");
1632 }
1633
1634 if (!kde.lnkid) {
1635 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1636 "Request");
1637 return -1;
1638 }
1639
1640 lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1641
1642 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
1643 wpa_printf(MSG_DEBUG,
1644 "TDLS: Discovery Request from different BSS "
1645 MACSTR, MAC2STR(lnkid->bssid));
1646 return -1;
1647 }
1648
1649 peer = wpa_tdls_add_peer(sm, addr, NULL);
1650 if (peer == NULL)
1651 return -1;
1652
1653 return wpa_tdls_send_discovery_response(sm, peer, dialog_token,
1654 link_id);
1655 }
1656
1657
wpa_tdls_send_discovery_request(struct wpa_sm * sm,const u8 * addr)1658 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1659 {
1660 if (sm->tdls_disabled || !sm->tdls_supported)
1661 return -1;
1662
1663 wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1664 MACSTR, MAC2STR(addr));
1665 return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
1666 1, 0, 0, 1, NULL, 0, -1);
1667 }
1668
1669
copy_supp_rates(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1670 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1671 struct wpa_tdls_peer *peer)
1672 {
1673 if (!kde->supp_rates) {
1674 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1675 return -1;
1676 }
1677 peer->supp_rates_len = merge_byte_arrays(
1678 peer->supp_rates, sizeof(peer->supp_rates),
1679 kde->supp_rates + 2, kde->supp_rates_len - 2,
1680 kde->ext_supp_rates ? kde->ext_supp_rates + 2 : NULL,
1681 kde->ext_supp_rates ? kde->ext_supp_rates_len - 2 : 0);
1682 return 0;
1683 }
1684
1685
copy_peer_ht_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1686 static int copy_peer_ht_capab(const struct wpa_eapol_ie_parse *kde,
1687 struct wpa_tdls_peer *peer)
1688 {
1689 if (!kde->ht_capabilities) {
1690 wpa_printf(MSG_DEBUG, "TDLS: No supported ht capabilities "
1691 "received");
1692 return 0;
1693 }
1694
1695 if (!peer->ht_capabilities) {
1696 peer->ht_capabilities =
1697 os_zalloc(sizeof(struct ieee80211_ht_capabilities));
1698 if (peer->ht_capabilities == NULL)
1699 return -1;
1700 }
1701
1702 os_memcpy(peer->ht_capabilities, kde->ht_capabilities,
1703 sizeof(struct ieee80211_ht_capabilities));
1704 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HT capabilities",
1705 (u8 *) peer->ht_capabilities,
1706 sizeof(struct ieee80211_ht_capabilities));
1707
1708 return 0;
1709 }
1710
1711
copy_peer_vht_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1712 static int copy_peer_vht_capab(const struct wpa_eapol_ie_parse *kde,
1713 struct wpa_tdls_peer *peer)
1714 {
1715 if (!kde->vht_capabilities) {
1716 wpa_printf(MSG_DEBUG, "TDLS: No supported vht capabilities "
1717 "received");
1718 return 0;
1719 }
1720
1721 if (!peer->vht_capabilities) {
1722 peer->vht_capabilities =
1723 os_zalloc(sizeof(struct ieee80211_vht_capabilities));
1724 if (peer->vht_capabilities == NULL)
1725 return -1;
1726 }
1727
1728 os_memcpy(peer->vht_capabilities, kde->vht_capabilities,
1729 sizeof(struct ieee80211_vht_capabilities));
1730 wpa_hexdump(MSG_DEBUG, "TDLS: Peer VHT capabilities",
1731 (u8 *) peer->vht_capabilities,
1732 sizeof(struct ieee80211_vht_capabilities));
1733
1734 return 0;
1735 }
1736
1737
copy_peer_he_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1738 static int copy_peer_he_capab(const struct wpa_eapol_ie_parse *kde,
1739 struct wpa_tdls_peer *peer)
1740 {
1741 if (!kde->he_capabilities) {
1742 wpa_printf(MSG_DEBUG, "TDLS: No HE capabilities received");
1743 return 0;
1744 }
1745
1746 os_free(peer->he_capabilities);
1747 peer->he_capab_len = 0;
1748 peer->he_capabilities = os_memdup(kde->he_capabilities,
1749 kde->he_capab_len);
1750 if (!peer->he_capabilities)
1751 return -1;
1752
1753 peer->he_capab_len = kde->he_capab_len;
1754 wpa_hexdump(MSG_DEBUG, "TDLS: Peer HE capabilities",
1755 peer->he_capabilities, peer->he_capab_len);
1756
1757 return 0;
1758 }
1759
1760
copy_peer_he_6ghz_band_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1761 static int copy_peer_he_6ghz_band_capab(const struct wpa_eapol_ie_parse *kde,
1762 struct wpa_tdls_peer *peer)
1763 {
1764 if (!kde->he_6ghz_capabilities) {
1765 wpa_printf(MSG_DEBUG,
1766 "TDLS: No HE 6 GHz band capabilities received");
1767 return 0;
1768 }
1769
1770 if (!peer->he_6ghz_band_capabilities) {
1771 peer->he_6ghz_band_capabilities =
1772 os_zalloc(sizeof(struct ieee80211_he_6ghz_band_cap));
1773 if (peer->he_6ghz_band_capabilities == NULL)
1774 return -1;
1775 }
1776
1777 os_memcpy(peer->he_6ghz_band_capabilities, kde->he_6ghz_capabilities,
1778 sizeof(struct ieee80211_he_6ghz_band_cap));
1779
1780 wpa_hexdump(MSG_DEBUG, "TDLS: Peer 6 GHz band HE capabilities",
1781 peer->he_6ghz_band_capabilities,
1782 sizeof(struct ieee80211_he_6ghz_band_cap));
1783
1784 return 0;
1785 }
1786
1787
copy_peer_ext_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1788 static int copy_peer_ext_capab(const struct wpa_eapol_ie_parse *kde,
1789 struct wpa_tdls_peer *peer)
1790 {
1791 if (!kde->ext_capab) {
1792 wpa_printf(MSG_DEBUG, "TDLS: No extended capabilities "
1793 "received");
1794 return 0;
1795 }
1796
1797 if (!peer->ext_capab || peer->ext_capab_len < kde->ext_capab_len - 2) {
1798 /* Need to allocate buffer to fit the new information */
1799 os_free(peer->ext_capab);
1800 peer->ext_capab = os_zalloc(kde->ext_capab_len - 2);
1801 if (peer->ext_capab == NULL)
1802 return -1;
1803 }
1804
1805 peer->ext_capab_len = kde->ext_capab_len - 2;
1806 os_memcpy(peer->ext_capab, kde->ext_capab + 2, peer->ext_capab_len);
1807
1808 return 0;
1809 }
1810
1811
copy_peer_eht_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1812 static int copy_peer_eht_capab(const struct wpa_eapol_ie_parse *kde,
1813 struct wpa_tdls_peer *peer)
1814 {
1815 if (!kde->eht_capabilities) {
1816 wpa_printf(MSG_DEBUG, "TDLS: No EHT capabilities received");
1817 return 0;
1818 }
1819
1820 os_free(peer->eht_capabilities);
1821 peer->eht_capab_len = 0;
1822 peer->eht_capabilities = os_memdup(kde->eht_capabilities,
1823 kde->eht_capab_len);
1824 if (!peer->eht_capabilities)
1825 return -1;
1826
1827 peer->eht_capab_len = kde->eht_capab_len;
1828 wpa_hexdump(MSG_DEBUG, "TDLS: Peer EHT capabilities",
1829 peer->eht_capabilities, peer->eht_capab_len);
1830
1831 return 0;
1832 }
1833
1834
copy_peer_wmm_capab(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1835 static int copy_peer_wmm_capab(const struct wpa_eapol_ie_parse *kde,
1836 struct wpa_tdls_peer *peer)
1837 {
1838 struct wmm_information_element *wmm;
1839
1840 if (!kde->wmm) {
1841 wpa_printf(MSG_DEBUG, "TDLS: No supported WMM capabilities received");
1842 return 0;
1843 }
1844
1845 if (kde->wmm_len < sizeof(struct wmm_information_element)) {
1846 wpa_printf(MSG_DEBUG, "TDLS: Invalid supported WMM capabilities received");
1847 return -1;
1848 }
1849
1850 wmm = (struct wmm_information_element *) kde->wmm;
1851 peer->qos_info = wmm->qos_info;
1852
1853 peer->wmm_capable = 1;
1854
1855 wpa_printf(MSG_DEBUG, "TDLS: Peer WMM QOS Info 0x%x", peer->qos_info);
1856 return 0;
1857 }
1858
1859
copy_peer_supp_channels(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1860 static int copy_peer_supp_channels(const struct wpa_eapol_ie_parse *kde,
1861 struct wpa_tdls_peer *peer)
1862 {
1863 if (!kde->supp_channels) {
1864 wpa_printf(MSG_DEBUG, "TDLS: No supported channels received");
1865 return 0;
1866 }
1867
1868 if (!peer->supp_channels ||
1869 peer->supp_channels_len < kde->supp_channels_len) {
1870 os_free(peer->supp_channels);
1871 peer->supp_channels = os_zalloc(kde->supp_channels_len);
1872 if (peer->supp_channels == NULL)
1873 return -1;
1874 }
1875
1876 peer->supp_channels_len = kde->supp_channels_len;
1877
1878 os_memcpy(peer->supp_channels, kde->supp_channels,
1879 peer->supp_channels_len);
1880 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Channels",
1881 (u8 *) peer->supp_channels, peer->supp_channels_len);
1882 return 0;
1883 }
1884
1885
copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse * kde,struct wpa_tdls_peer * peer)1886 static int copy_peer_supp_oper_classes(const struct wpa_eapol_ie_parse *kde,
1887 struct wpa_tdls_peer *peer)
1888 {
1889 if (!kde->supp_oper_classes) {
1890 wpa_printf(MSG_DEBUG, "TDLS: No supported operating classes received");
1891 return 0;
1892 }
1893
1894 if (!peer->supp_oper_classes ||
1895 peer->supp_oper_classes_len < kde->supp_oper_classes_len) {
1896 os_free(peer->supp_oper_classes);
1897 peer->supp_oper_classes = os_zalloc(kde->supp_oper_classes_len);
1898 if (peer->supp_oper_classes == NULL)
1899 return -1;
1900 }
1901
1902 peer->supp_oper_classes_len = kde->supp_oper_classes_len;
1903 os_memcpy(peer->supp_oper_classes, kde->supp_oper_classes,
1904 peer->supp_oper_classes_len);
1905 wpa_hexdump(MSG_DEBUG, "TDLS: Peer Supported Operating Classes",
1906 (u8 *) peer->supp_oper_classes,
1907 peer->supp_oper_classes_len);
1908 return 0;
1909 }
1910
1911
wpa_tdls_addset_peer(struct wpa_sm * sm,struct wpa_tdls_peer * peer,int add)1912 static int wpa_tdls_addset_peer(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
1913 int add)
1914 {
1915 return wpa_sm_tdls_peer_addset(sm, peer->addr, add, peer->aid,
1916 peer->capability,
1917 peer->supp_rates, peer->supp_rates_len,
1918 peer->ht_capabilities,
1919 peer->vht_capabilities,
1920 peer->he_capabilities,
1921 peer->he_capab_len,
1922 peer->he_6ghz_band_capabilities,
1923 peer->qos_info, peer->wmm_capable,
1924 peer->ext_capab, peer->ext_capab_len,
1925 peer->supp_channels,
1926 peer->supp_channels_len,
1927 peer->supp_oper_classes,
1928 peer->supp_oper_classes_len,
1929 peer->eht_capabilities,
1930 peer->eht_capab_len,
1931 peer->mld_link_id);
1932 }
1933
1934
tdls_nonce_set(const u8 * nonce)1935 static int tdls_nonce_set(const u8 *nonce)
1936 {
1937 int i;
1938
1939 for (i = 0; i < WPA_NONCE_LEN; i++) {
1940 if (nonce[i])
1941 return 1;
1942 }
1943
1944 return 0;
1945 }
1946
1947
wpa_tdls_process_tpk_m1(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)1948 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1949 const u8 *buf, size_t len)
1950 {
1951 struct wpa_tdls_peer *peer;
1952 struct wpa_eapol_ie_parse kde;
1953 struct wpa_ie_data ie;
1954 int cipher;
1955 const u8 *cpos;
1956 struct wpa_tdls_ftie *ftie = NULL;
1957 struct wpa_tdls_timeoutie *timeoutie;
1958 struct wpa_tdls_lnkid *lnkid;
1959 u32 lifetime = 0;
1960 #if 0
1961 struct rsn_ie_hdr *hdr;
1962 u8 *pos;
1963 u16 rsn_capab;
1964 u16 rsn_ver;
1965 #endif
1966 u8 dtoken;
1967 u16 ielen;
1968 u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1969 int tdls_prohibited = sm->tdls_prohibited;
1970 int existing_peer = 0;
1971 int link_id = -1;
1972
1973 if (len < 3 + 3)
1974 return -1;
1975
1976 cpos = buf;
1977 cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1978
1979 /* driver had already verified the frame format */
1980 dtoken = *cpos++; /* dialog token */
1981
1982 wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1983
1984 peer = wpa_tdls_add_peer(sm, src_addr, &existing_peer);
1985 if (peer == NULL)
1986 goto error;
1987
1988 /* If found, use existing entry instead of adding a new one;
1989 * how to handle the case where both ends initiate at the
1990 * same time? */
1991 if (existing_peer) {
1992 if (peer->tpk_success) {
1993 wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1994 "direct link is enabled - tear down the "
1995 "old link first");
1996 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
1997 wpa_tdls_peer_clear(sm, peer);
1998 } else if (peer->initiator) {
1999 /*
2000 * An entry is already present, so check if we already
2001 * sent a TDLS Setup Request. If so, compare MAC
2002 * addresses and let the STA with the lower MAC address
2003 * continue as the initiator. The other negotiation is
2004 * terminated.
2005 */
2006 if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
2007 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
2008 "from peer with higher address "
2009 MACSTR, MAC2STR(src_addr));
2010 return -1;
2011 } else {
2012 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
2013 "from peer with lower address "
2014 MACSTR " (terminate previously "
2015 "initiated negotiation",
2016 MAC2STR(src_addr));
2017 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK,
2018 peer->addr);
2019 wpa_tdls_peer_clear(sm, peer);
2020 }
2021 }
2022 }
2023
2024 /* capability information */
2025 peer->capability = WPA_GET_LE16(cpos);
2026 cpos += 2;
2027
2028 ielen = len - (cpos - buf); /* start of IE in buf */
2029
2030 /*
2031 * Don't reject the message if failing to parse IEs. The IEs we need are
2032 * explicitly checked below. Some APs may add arbitrary padding to the
2033 * end of short TDLS frames and that would look like invalid IEs.
2034 */
2035 if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0)
2036 wpa_printf(MSG_DEBUG,
2037 "TDLS: Failed to parse IEs in TPK M1 - ignore as an interop workaround");
2038
2039 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2040 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2041 "TPK M1");
2042 goto error;
2043 }
2044 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
2045 kde.lnkid, kde.lnkid_len);
2046 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2047
2048 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
2049 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS "
2050 MACSTR, MAC2STR(lnkid->bssid));
2051 status = WLAN_STATUS_REQUEST_DECLINED;
2052 goto error;
2053 }
2054
2055 peer->mld_link_id = link_id;
2056 wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
2057 MAC2STR(src_addr));
2058
2059 if (copy_supp_rates(&kde, peer) < 0)
2060 goto error;
2061
2062 if (copy_peer_ht_capab(&kde, peer) < 0)
2063 goto error;
2064
2065 if (copy_peer_vht_capab(&kde, peer) < 0 ||
2066 copy_peer_he_capab(&kde, peer) < 0 ||
2067 copy_peer_he_6ghz_band_capab(&kde, peer) < 0)
2068 goto error;
2069
2070 if (copy_peer_eht_capab(&kde, peer) < 0)
2071 goto error;
2072
2073 if (copy_peer_ext_capab(&kde, peer) < 0)
2074 goto error;
2075
2076 if (copy_peer_supp_channels(&kde, peer) < 0)
2077 goto error;
2078
2079 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2080 goto error;
2081
2082 peer->qos_info = kde.qosinfo;
2083
2084 /* Overwrite with the qos_info obtained in WMM IE */
2085 if (copy_peer_wmm_capab(&kde, peer) < 0)
2086 goto error;
2087
2088 peer->aid = kde.aid;
2089
2090 #ifdef CONFIG_TDLS_TESTING
2091 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
2092 peer = wpa_tdls_add_peer(sm, src_addr, NULL);
2093 if (peer == NULL)
2094 goto error;
2095 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
2096 "TDLS setup - send own request");
2097 peer->initiator = 1;
2098 wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
2099 NULL, NULL, 0, NULL, 0, 0, NULL, 0,
2100 NULL, 0, NULL, 0, NULL, 0, link_id);
2101 if (wpa_tdls_send_tpk_m1(sm, peer) == -2) {
2102 peer = NULL;
2103 goto error;
2104 }
2105 }
2106
2107 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2108 tdls_prohibited) {
2109 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2110 "on TDLS");
2111 tdls_prohibited = 0;
2112 }
2113 #endif /* CONFIG_TDLS_TESTING */
2114
2115 if (tdls_prohibited) {
2116 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
2117 status = WLAN_STATUS_REQUEST_DECLINED;
2118 goto error;
2119 }
2120
2121 if (!wpa_tdls_get_privacy(sm)) {
2122 if (kde.rsn_ie) {
2123 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
2124 "security is disabled");
2125 status = WLAN_STATUS_SECURITY_DISABLED;
2126 goto error;
2127 }
2128 goto skip_rsn;
2129 }
2130
2131 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2132 kde.rsn_ie == NULL) {
2133 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
2134 status = WLAN_STATUS_INVALID_PARAMETERS;
2135 goto error;
2136 }
2137
2138 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2139 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
2140 "TPK M1");
2141 status = WLAN_STATUS_INVALID_RSNE;
2142 goto error;
2143 }
2144
2145 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2146 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
2147 status = WLAN_STATUS_INVALID_RSNE;
2148 goto error;
2149 }
2150
2151 cipher = ie.pairwise_cipher;
2152 if (cipher & WPA_CIPHER_CCMP) {
2153 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2154 cipher = WPA_CIPHER_CCMP;
2155 } else {
2156 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
2157 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
2158 goto error;
2159 }
2160
2161 if ((ie.capabilities &
2162 (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
2163 WPA_CAPABILITY_PEERKEY_ENABLED) {
2164 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
2165 "TPK M1");
2166 status = WLAN_STATUS_INVALID_RSNE_CAPABILITIES;
2167 goto error;
2168 }
2169
2170 /* Lifetime */
2171 if (kde.key_lifetime == NULL) {
2172 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
2173 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2174 goto error;
2175 }
2176 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2177 lifetime = WPA_GET_LE32(timeoutie->value);
2178 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
2179 if (lifetime < 300) {
2180 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
2181 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2182 goto error;
2183 }
2184
2185 skip_rsn:
2186 #ifdef CONFIG_TDLS_TESTING
2187 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
2188 if (os_memcmp(sm->own_addr, peer->addr, ETH_ALEN) < 0) {
2189 /*
2190 * The request frame from us is going to win, so do not
2191 * replace information based on this request frame from
2192 * the peer.
2193 */
2194 goto skip_rsn_check;
2195 }
2196 }
2197 #endif /* CONFIG_TDLS_TESTING */
2198
2199 peer->initiator = 0; /* Need to check */
2200 peer->dtoken = dtoken;
2201
2202 if (!wpa_tdls_get_privacy(sm)) {
2203 peer->rsnie_i_len = 0;
2204 peer->rsnie_p_len = 0;
2205 peer->cipher = WPA_CIPHER_NONE;
2206 goto skip_rsn_check;
2207 }
2208
2209 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2210 os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
2211 peer->rsnie_i_len = kde.rsn_ie_len;
2212 peer->cipher = cipher;
2213
2214 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0 ||
2215 !tdls_nonce_set(peer->inonce)) {
2216 /*
2217 * There is no point in updating the RNonce for every obtained
2218 * TPK M1 frame (e.g., retransmission due to timeout) with the
2219 * same INonce (SNonce in FTIE). However, if the TPK M1 is
2220 * retransmitted with a different INonce, update the RNonce
2221 * since this is for a new TDLS session.
2222 */
2223 wpa_printf(MSG_DEBUG,
2224 "TDLS: New TPK M1 INonce - generate new RNonce");
2225 os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
2226 if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
2227 wpa_msg(sm->ctx->ctx, MSG_WARNING,
2228 "TDLS: Failed to get random data for responder nonce");
2229 goto error;
2230 }
2231 peer->tk_set = 0; /* A new nonce results in a new TK */
2232 }
2233
2234 #if 0
2235 /* get version info from RSNIE received from Peer */
2236 hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
2237 rsn_ver = WPA_GET_LE16(hdr->version);
2238
2239 /* use min(peer's version, out version) */
2240 if (rsn_ver > RSN_VERSION)
2241 rsn_ver = RSN_VERSION;
2242
2243 hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
2244
2245 hdr->elem_id = WLAN_EID_RSN;
2246 WPA_PUT_LE16(hdr->version, rsn_ver);
2247 pos = (u8 *) (hdr + 1);
2248
2249 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
2250 pos += RSN_SELECTOR_LEN;
2251 /* Include only the selected cipher in pairwise cipher suite */
2252 WPA_PUT_LE16(pos, 1);
2253 pos += 2;
2254 if (cipher == WPA_CIPHER_CCMP)
2255 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
2256 pos += RSN_SELECTOR_LEN;
2257
2258 WPA_PUT_LE16(pos, 1);
2259 pos += 2;
2260 RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
2261 pos += RSN_SELECTOR_LEN;
2262
2263 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
2264 rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
2265 WPA_PUT_LE16(pos, rsn_capab);
2266 pos += 2;
2267
2268 hdr->len = (pos - peer->rsnie_p) - 2;
2269 peer->rsnie_p_len = pos - peer->rsnie_p;
2270 #endif
2271
2272 /* temp fix: validation of RSNIE later */
2273 os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
2274 peer->rsnie_p_len = peer->rsnie_i_len;
2275
2276 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
2277 peer->rsnie_p, peer->rsnie_p_len);
2278
2279 peer->lifetime = lifetime;
2280
2281 if (peer->mld_link_id >= 0)
2282 wpa_printf(MSG_DEBUG, "TDLS: Use link ID %u for TPK derivation",
2283 peer->mld_link_id);
2284 wpa_tdls_generate_tpk(peer, sm->own_addr,
2285 wpa_tdls_get_link_bssid(sm, peer->mld_link_id));
2286
2287 skip_rsn_check:
2288 #ifdef CONFIG_TDLS_TESTING
2289 if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT)
2290 goto skip_add_peer;
2291 #endif /* CONFIG_TDLS_TESTING */
2292
2293 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2294 if (wpa_tdls_addset_peer(sm, peer, 1) < 0)
2295 goto error;
2296
2297 #ifdef CONFIG_TDLS_TESTING
2298 skip_add_peer:
2299 #endif /* CONFIG_TDLS_TESTING */
2300 peer->tpk_in_progress = 1;
2301
2302 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
2303 if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
2304 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2305 goto error;
2306 }
2307
2308 #ifdef CONFIG_TDLS_TESTING
2309 if (tdls_testing & TDLS_TESTING_DOUBLE_TPK_M2) {
2310 wpa_printf(MSG_INFO, "TDLS: Testing - Send another TPK M2");
2311 wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer);
2312 }
2313 #endif /* CONFIG_TDLS_TESTING */
2314
2315 return 0;
2316
2317 error:
2318 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
2319 status);
2320 if (peer)
2321 wpa_tdls_peer_free(sm, peer);
2322 return -1;
2323 }
2324
2325
wpa_tdls_enable_link(struct wpa_sm * sm,struct wpa_tdls_peer * peer)2326 static int wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
2327 {
2328 peer->tpk_success = 1;
2329 peer->tpk_in_progress = 0;
2330 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2331 if (wpa_tdls_get_privacy(sm)) {
2332 u32 lifetime = peer->lifetime;
2333 /*
2334 * Start the initiator process a bit earlier to avoid race
2335 * condition with the responder sending teardown request.
2336 */
2337 if (lifetime > 3 && peer->initiator)
2338 lifetime -= 3;
2339 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
2340 sm, peer);
2341 #ifdef CONFIG_TDLS_TESTING
2342 if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
2343 wpa_printf(MSG_DEBUG,
2344 "TDLS: Testing - disable TPK expiration");
2345 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
2346 }
2347 #endif /* CONFIG_TDLS_TESTING */
2348 }
2349
2350 if (peer->reconfig_key && wpa_tdls_set_key(sm, peer) < 0) {
2351 wpa_printf(MSG_INFO, "TDLS: Could not configure key to the "
2352 "driver");
2353 return -1;
2354 }
2355 peer->reconfig_key = 0;
2356
2357 return wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
2358 }
2359
2360
wpa_tdls_process_tpk_m2(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)2361 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
2362 const u8 *buf, size_t len)
2363 {
2364 struct wpa_tdls_peer *peer;
2365 struct wpa_eapol_ie_parse kde;
2366 struct wpa_ie_data ie;
2367 int cipher;
2368 struct wpa_tdls_ftie *ftie;
2369 struct wpa_tdls_timeoutie *timeoutie;
2370 struct wpa_tdls_lnkid *lnkid;
2371 u32 lifetime;
2372 u8 dtoken;
2373 int ielen;
2374 u16 status;
2375 const u8 *pos;
2376 int ret = 0;
2377
2378 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
2379 "(Peer " MACSTR ")", MAC2STR(src_addr));
2380 for (peer = sm->tdls; peer; peer = peer->next) {
2381 if (ether_addr_equal(peer->addr, src_addr))
2382 break;
2383 }
2384 if (peer == NULL) {
2385 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2386 "TPK M2: " MACSTR, MAC2STR(src_addr));
2387 return -1;
2388 }
2389 if (!peer->initiator) {
2390 /*
2391 * This may happen if both devices try to initiate TDLS at the
2392 * same time and we accept the TPK M1 from the peer in
2393 * wpa_tdls_process_tpk_m1() and clear our previous state.
2394 */
2395 wpa_printf(MSG_INFO, "TDLS: We were not the initiator, so "
2396 "ignore TPK M2 from " MACSTR, MAC2STR(src_addr));
2397 return -1;
2398 }
2399
2400 if (peer->tpk_success) {
2401 wpa_printf(MSG_INFO, "TDLS: Ignore incoming TPK M2 retry, from "
2402 MACSTR " as TPK M3 was already sent",
2403 MAC2STR(src_addr));
2404 return 0;
2405 }
2406
2407 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
2408
2409 if (len < 3 + 2 + 1) {
2410 wpa_tdls_disable_peer_link(sm, peer);
2411 return -1;
2412 }
2413
2414 pos = buf;
2415 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2416 status = WPA_GET_LE16(pos);
2417 pos += 2 /* status code */;
2418
2419 if (status != WLAN_STATUS_SUCCESS) {
2420 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
2421 status);
2422 wpa_tdls_disable_peer_link(sm, peer);
2423 return -1;
2424 }
2425
2426 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
2427
2428 /* TODO: need to verify dialog token matches here or in kernel */
2429 dtoken = *pos++; /* dialog token */
2430
2431 wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
2432
2433 if (len < 3 + 2 + 1 + 2) {
2434 wpa_tdls_disable_peer_link(sm, peer);
2435 return -1;
2436 }
2437
2438 /* capability information */
2439 peer->capability = WPA_GET_LE16(pos);
2440 pos += 2;
2441
2442 ielen = len - (pos - buf); /* start of IE in buf */
2443
2444 /*
2445 * Don't reject the message if failing to parse IEs. The IEs we need are
2446 * explicitly checked below. Some APs may add arbitrary padding to the
2447 * end of short TDLS frames and that would look like invalid IEs.
2448 */
2449 if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0)
2450 wpa_printf(MSG_DEBUG,
2451 "TDLS: Failed to parse IEs in TPK M2 - ignore as an interop workaround");
2452
2453 #ifdef CONFIG_TDLS_TESTING
2454 if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
2455 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
2456 status = WLAN_STATUS_REQUEST_DECLINED;
2457 goto error;
2458 }
2459 #endif /* CONFIG_TDLS_TESTING */
2460
2461 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2462 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
2463 "TPK M2");
2464 goto error;
2465 }
2466 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
2467 kde.lnkid, kde.lnkid_len);
2468 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2469
2470 if (!ether_addr_equal(wpa_tdls_get_link_bssid(sm, peer->mld_link_id),
2471 lnkid->bssid)) {
2472 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
2473 status = WLAN_STATUS_NOT_IN_SAME_BSS;
2474 goto error;
2475 }
2476
2477 if (copy_supp_rates(&kde, peer) < 0)
2478 goto error;
2479
2480 if (copy_peer_ht_capab(&kde, peer) < 0)
2481 goto error;
2482
2483 if (copy_peer_vht_capab(&kde, peer) < 0 ||
2484 copy_peer_he_capab(&kde, peer) < 0 ||
2485 copy_peer_he_6ghz_band_capab(&kde, peer) < 0)
2486 goto error;
2487
2488 if (copy_peer_eht_capab(&kde, peer) < 0)
2489 goto error;
2490
2491 if (copy_peer_ext_capab(&kde, peer) < 0)
2492 goto error;
2493
2494 if (copy_peer_supp_channels(&kde, peer) < 0)
2495 goto error;
2496
2497 if (copy_peer_supp_oper_classes(&kde, peer) < 0)
2498 goto error;
2499
2500 peer->qos_info = kde.qosinfo;
2501
2502 /* Overwrite with the qos_info obtained in WMM IE */
2503 if (copy_peer_wmm_capab(&kde, peer) < 0)
2504 goto error;
2505
2506 peer->aid = kde.aid;
2507
2508 if (!wpa_tdls_get_privacy(sm)) {
2509 peer->rsnie_p_len = 0;
2510 peer->cipher = WPA_CIPHER_NONE;
2511 goto skip_rsn;
2512 }
2513
2514 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
2515 kde.rsn_ie == NULL) {
2516 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
2517 status = WLAN_STATUS_INVALID_PARAMETERS;
2518 goto error;
2519 }
2520 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2521 kde.rsn_ie, kde.rsn_ie_len);
2522
2523 if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
2524 wpa_printf(MSG_INFO,
2525 "TDLS: Too long Responder RSN IE in TPK M2");
2526 status = WLAN_STATUS_INVALID_RSNE;
2527 goto error;
2528 }
2529
2530 /*
2531 * FIX: bitwise comparison of RSN IE is not the correct way of
2532 * validation this. It can be different, but certain fields must
2533 * match. Since we list only a single pairwise cipher in TPK M1, the
2534 * memcmp is likely to work in most cases, though.
2535 */
2536 if (kde.rsn_ie_len != peer->rsnie_i_len ||
2537 os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
2538 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
2539 "not match with RSN IE used in TPK M1");
2540 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
2541 peer->rsnie_i, peer->rsnie_i_len);
2542 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
2543 kde.rsn_ie, kde.rsn_ie_len);
2544 status = WLAN_STATUS_INVALID_RSNE;
2545 goto error;
2546 }
2547
2548 if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
2549 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
2550 status = WLAN_STATUS_INVALID_RSNE;
2551 goto error;
2552 }
2553
2554 cipher = ie.pairwise_cipher;
2555 if (cipher == WPA_CIPHER_CCMP) {
2556 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
2557 cipher = WPA_CIPHER_CCMP;
2558 } else {
2559 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
2560 status = WLAN_STATUS_INVALID_PAIRWISE_CIPHER;
2561 goto error;
2562 }
2563
2564 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
2565 kde.ftie, sizeof(*ftie));
2566 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2567
2568 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
2569 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
2570 "not match with FTIE SNonce used in TPK M1");
2571 /* Silently discard the frame */
2572 return -1;
2573 }
2574
2575 /* Responder Nonce and RSN IE */
2576 os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
2577 os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
2578 peer->rsnie_p_len = kde.rsn_ie_len;
2579 peer->cipher = cipher;
2580
2581 /* Lifetime */
2582 if (kde.key_lifetime == NULL) {
2583 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
2584 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2585 goto error;
2586 }
2587 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2588 lifetime = WPA_GET_LE32(timeoutie->value);
2589 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
2590 lifetime);
2591 if (lifetime != peer->lifetime) {
2592 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2593 "TPK M2 (expected %u)", lifetime, peer->lifetime);
2594 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
2595 goto error;
2596 }
2597
2598 if (peer->mld_link_id >= 0)
2599 wpa_printf(MSG_DEBUG, "TDLS: Use link ID %u for TPK derivation",
2600 peer->mld_link_id);
2601 wpa_tdls_generate_tpk(peer, sm->own_addr,
2602 wpa_tdls_get_link_bssid(sm, peer->mld_link_id));
2603
2604 /* Process MIC check to see if TPK M2 is right */
2605 if (wpa_supplicant_verify_tdls_mic(2, peer, (const u8 *) lnkid,
2606 (const u8 *) timeoutie, ftie,
2607 kde.ftie_len) < 0) {
2608 /* Discard the frame */
2609 wpa_tdls_del_key(sm, peer);
2610 wpa_tdls_disable_peer_link(sm, peer);
2611 return -1;
2612 }
2613
2614 if (wpa_tdls_set_key(sm, peer) < 0) {
2615 /*
2616 * Some drivers may not be able to config the key prior to full
2617 * STA entry having been configured.
2618 */
2619 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2620 "STA entry is complete");
2621 peer->reconfig_key = 1;
2622 }
2623
2624 skip_rsn:
2625 peer->dtoken = dtoken;
2626
2627 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2628 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2629 goto error;
2630
2631 wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
2632 "TPK Handshake Message 3");
2633 if (wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer) < 0)
2634 goto error_no_msg;
2635
2636 if (!peer->tpk_success) {
2637 /*
2638 * Enable Link only when tpk_success is 0, signifying that this
2639 * processing of TPK M2 frame is not because of a retransmission
2640 * during TDLS setup handshake.
2641 */
2642 ret = wpa_tdls_enable_link(sm, peer);
2643 if (ret < 0) {
2644 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2645 wpa_tdls_do_teardown(
2646 sm, peer,
2647 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2648 }
2649 }
2650 return ret;
2651
2652 error:
2653 wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 1,
2654 status);
2655 error_no_msg:
2656 wpa_tdls_disable_peer_link(sm, peer);
2657 return -1;
2658 }
2659
2660
wpa_tdls_process_tpk_m3(struct wpa_sm * sm,const u8 * src_addr,const u8 * buf,size_t len)2661 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
2662 const u8 *buf, size_t len)
2663 {
2664 struct wpa_tdls_peer *peer;
2665 struct wpa_eapol_ie_parse kde;
2666 struct wpa_tdls_ftie *ftie;
2667 struct wpa_tdls_timeoutie *timeoutie;
2668 struct wpa_tdls_lnkid *lnkid;
2669 int ielen;
2670 u16 status;
2671 const u8 *pos;
2672 u32 lifetime;
2673 int ret = 0;
2674
2675 wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
2676 "(Peer " MACSTR ")", MAC2STR(src_addr));
2677 for (peer = sm->tdls; peer; peer = peer->next) {
2678 if (ether_addr_equal(peer->addr, src_addr))
2679 break;
2680 }
2681 if (peer == NULL) {
2682 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
2683 "TPK M3: " MACSTR, MAC2STR(src_addr));
2684 return -1;
2685 }
2686 wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
2687
2688 if (len < 3 + 3)
2689 goto error;
2690 pos = buf;
2691 pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
2692
2693 status = WPA_GET_LE16(pos);
2694
2695 if (status != 0) {
2696 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
2697 status);
2698 goto error;
2699 }
2700 pos += 2 /* status code */ + 1 /* dialog token */;
2701
2702 ielen = len - (pos - buf); /* start of IE in buf */
2703
2704 /*
2705 * Don't reject the message if failing to parse IEs. The IEs we need are
2706 * explicitly checked below. Some APs piggy-back broken IEs to the end
2707 * of a TDLS Confirm packet, which will fail the link if we don't ignore
2708 * this error.
2709 */
2710 if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
2711 wpa_printf(MSG_DEBUG,
2712 "TDLS: Failed to parse KDEs in TPK M3 - ignore as an interop workaround");
2713 }
2714
2715 if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
2716 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
2717 goto error;
2718 }
2719 wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
2720 (u8 *) kde.lnkid, kde.lnkid_len);
2721 lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
2722
2723 if (!ether_addr_equal(wpa_tdls_get_link_bssid(sm, peer->mld_link_id),
2724 lnkid->bssid)) {
2725 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
2726 goto error;
2727 }
2728
2729 if (!wpa_tdls_get_privacy(sm))
2730 goto skip_rsn;
2731
2732 if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
2733 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
2734 goto error;
2735 }
2736 wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
2737 kde.ftie, sizeof(*ftie));
2738 ftie = (struct wpa_tdls_ftie *) kde.ftie;
2739
2740 if (kde.rsn_ie == NULL) {
2741 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
2742 goto error;
2743 }
2744 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
2745 kde.rsn_ie, kde.rsn_ie_len);
2746 if (kde.rsn_ie_len != peer->rsnie_p_len ||
2747 os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
2748 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
2749 "with the one sent in TPK M2");
2750 goto error;
2751 }
2752
2753 if (os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) != 0) {
2754 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
2755 "not match with FTIE ANonce used in TPK M2");
2756 goto error;
2757 }
2758
2759 if (os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) != 0) {
2760 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
2761 "match with FTIE SNonce used in TPK M1");
2762 goto error;
2763 }
2764
2765 if (kde.key_lifetime == NULL) {
2766 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
2767 goto error;
2768 }
2769 timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
2770 wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
2771 (u8 *) timeoutie, sizeof(*timeoutie));
2772 lifetime = WPA_GET_LE32(timeoutie->value);
2773 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
2774 lifetime);
2775 if (lifetime != peer->lifetime) {
2776 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
2777 "TPK M3 (expected %u)", lifetime, peer->lifetime);
2778 goto error;
2779 }
2780
2781 if (wpa_supplicant_verify_tdls_mic(3, peer, (const u8 *) lnkid,
2782 (const u8 *) timeoutie, ftie,
2783 kde.ftie_len) < 0) {
2784 wpa_tdls_del_key(sm, peer);
2785 goto error;
2786 }
2787
2788 if (wpa_tdls_set_key(sm, peer) < 0) {
2789 /*
2790 * Some drivers may not be able to config the key prior to full
2791 * STA entry having been configured.
2792 */
2793 wpa_printf(MSG_DEBUG, "TDLS: Try to configure TPK again after "
2794 "STA entry is complete");
2795 peer->reconfig_key = 1;
2796 }
2797
2798 skip_rsn:
2799 /* add supported rates, capabilities, and qos_info to the TDLS peer */
2800 if (wpa_tdls_addset_peer(sm, peer, 0) < 0)
2801 goto error;
2802
2803 if (!peer->tpk_success) {
2804 /*
2805 * Enable Link only when tpk_success is 0, signifying that this
2806 * processing of TPK M3 frame is not because of a retransmission
2807 * during TDLS setup handshake.
2808 */
2809 ret = wpa_tdls_enable_link(sm, peer);
2810 if (ret < 0) {
2811 wpa_printf(MSG_DEBUG, "TDLS: Could not enable link");
2812 goto error;
2813 }
2814 }
2815 return ret;
2816 error:
2817 wpa_tdls_do_teardown(sm, peer, WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2818 return -1;
2819 }
2820
2821
wpa_add_tdls_timeoutie(u8 * pos,u8 * ie,size_t ie_len,u32 tsecs)2822 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
2823 {
2824 struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
2825
2826 os_memset(lifetime, 0, ie_len);
2827 lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2828 lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2829 lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2830 WPA_PUT_LE32(lifetime->value, tsecs);
2831 os_memcpy(pos, ie, ie_len);
2832 return pos + ie_len;
2833 }
2834
2835
2836 /**
2837 * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2838 * @sm: Pointer to WPA state machine data from wpa_sm_init()
2839 * @peer: MAC address of the peer STA
2840 * Returns: 0 on success, or -1 on failure
2841 *
2842 * Send TPK Handshake Message 1 info to driver to start TDLS
2843 * handshake with the peer.
2844 */
wpa_tdls_start(struct wpa_sm * sm,const u8 * addr)2845 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2846 {
2847 struct wpa_tdls_peer *peer;
2848 int tdls_prohibited = sm->tdls_prohibited;
2849 int res;
2850
2851 if (sm->tdls_disabled || !sm->tdls_supported)
2852 return -1;
2853
2854 #ifdef CONFIG_TDLS_TESTING
2855 if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2856 tdls_prohibited) {
2857 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2858 "on TDLS");
2859 tdls_prohibited = 0;
2860 }
2861 #endif /* CONFIG_TDLS_TESTING */
2862
2863 if (tdls_prohibited) {
2864 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2865 "reject request to start setup");
2866 return -1;
2867 }
2868
2869 peer = wpa_tdls_add_peer(sm, addr, NULL);
2870 if (peer == NULL)
2871 return -1;
2872
2873 if (peer->tpk_in_progress) {
2874 wpa_printf(MSG_DEBUG, "TDLS: Setup is already in progress with the peer");
2875 return 0;
2876 }
2877
2878 if (sm->mlo.valid_links && !peer->disc_resp_rcvd) {
2879 wpa_printf(MSG_DEBUG,
2880 "TDLS: MLO STA connection - defer the setup request since Discovery Resp not yet received");
2881 peer->setup_req_rcvd = true;
2882 return 0;
2883 }
2884 peer->initiator = 1;
2885
2886 /* add the peer to the driver as a "setup in progress" peer */
2887 if (wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
2888 NULL, NULL, 0, NULL, 0, 0, NULL, 0, NULL, 0,
2889 NULL, 0, NULL, 0, peer->mld_link_id)) {
2890 wpa_tdls_disable_peer_link(sm, peer);
2891 return -1;
2892 }
2893
2894 peer->tpk_in_progress = 1;
2895
2896 res = wpa_tdls_send_tpk_m1(sm, peer);
2897 if (res < 0) {
2898 if (res != -2)
2899 wpa_tdls_disable_peer_link(sm, peer);
2900 return -1;
2901 }
2902
2903 return 0;
2904 }
2905
2906
wpa_tdls_remove(struct wpa_sm * sm,const u8 * addr)2907 void wpa_tdls_remove(struct wpa_sm *sm, const u8 *addr)
2908 {
2909 struct wpa_tdls_peer *peer;
2910
2911 if (sm->tdls_disabled || !sm->tdls_supported)
2912 return;
2913
2914 for (peer = sm->tdls; peer; peer = peer->next) {
2915 if (ether_addr_equal(peer->addr, addr))
2916 break;
2917 }
2918
2919 if (peer == NULL || !peer->tpk_success)
2920 return;
2921
2922 if (sm->tdls_external_setup) {
2923 /*
2924 * Disable previous link to allow renegotiation to be completed
2925 * on AP path.
2926 */
2927 wpa_tdls_do_teardown(sm, peer,
2928 WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
2929 }
2930 }
2931
2932
2933 /**
2934 * wpa_supplicant_rx_tdls - Receive TDLS data frame
2935 *
2936 * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2937 */
wpa_supplicant_rx_tdls(void * ctx,const u8 * src_addr,const u8 * buf,size_t len)2938 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2939 const u8 *buf, size_t len)
2940 {
2941 struct wpa_sm *sm = ctx;
2942 struct wpa_tdls_frame *tf;
2943
2944 wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2945 buf, len);
2946
2947 if (sm->tdls_disabled || !sm->tdls_supported) {
2948 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2949 "or unsupported by driver");
2950 return;
2951 }
2952
2953 if (ether_addr_equal(src_addr, sm->own_addr)) {
2954 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2955 return;
2956 }
2957
2958 if (len < sizeof(*tf)) {
2959 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2960 return;
2961 }
2962
2963 /* Check to make sure its a valid encapsulated TDLS frame */
2964 tf = (struct wpa_tdls_frame *) buf;
2965 if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2966 tf->category != WLAN_ACTION_TDLS) {
2967 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2968 "category=%u action=%u",
2969 tf->payloadtype, tf->category, tf->action);
2970 return;
2971 }
2972
2973 switch (tf->action) {
2974 case WLAN_TDLS_SETUP_REQUEST:
2975 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2976 break;
2977 case WLAN_TDLS_SETUP_RESPONSE:
2978 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2979 break;
2980 case WLAN_TDLS_SETUP_CONFIRM:
2981 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2982 break;
2983 case WLAN_TDLS_TEARDOWN:
2984 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2985 break;
2986 case WLAN_TDLS_DISCOVERY_REQUEST:
2987 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2988 break;
2989 default:
2990 /* Kernel code will process remaining frames */
2991 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2992 tf->action);
2993 break;
2994 }
2995 }
2996
2997
2998 /**
2999 * wpa_tdls_init - Initialize driver interface parameters for TDLS
3000 * @wpa_s: Pointer to wpa_supplicant data
3001 * Returns: 0 on success, -1 on failure
3002 *
3003 * This function is called to initialize driver interface parameters for TDLS.
3004 * wpa_drv_init() must have been called before this function to initialize the
3005 * driver interface.
3006 */
wpa_tdls_init(struct wpa_sm * sm)3007 int wpa_tdls_init(struct wpa_sm *sm)
3008 {
3009 if (sm == NULL)
3010 return -1;
3011
3012 if (sm->l2_tdls) {
3013 l2_packet_deinit(sm->l2_tdls);
3014 sm->l2_tdls = NULL;
3015 }
3016
3017 sm->l2_tdls = l2_packet_init(sm->bridge_ifname ? sm->bridge_ifname :
3018 sm->ifname,
3019 sm->own_addr,
3020 ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
3021 sm, 0);
3022 if (sm->l2_tdls == NULL) {
3023 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
3024 "connection");
3025 return -1;
3026 }
3027
3028 /*
3029 * Drivers that support TDLS but don't implement the get_capa callback
3030 * are assumed to perform everything internally
3031 */
3032 if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
3033 &sm->tdls_external_setup,
3034 &sm->tdls_chan_switch) < 0) {
3035 sm->tdls_supported = 1;
3036 sm->tdls_external_setup = 0;
3037 }
3038
3039 wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
3040 "driver", sm->tdls_supported ? "" : " not");
3041 wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
3042 sm->tdls_external_setup ? "external" : "internal");
3043 wpa_printf(MSG_DEBUG, "TDLS: Driver %s TDLS channel switching",
3044 sm->tdls_chan_switch ? "supports" : "does not support");
3045
3046 return 0;
3047 }
3048
3049
wpa_tdls_teardown_peers(struct wpa_sm * sm)3050 void wpa_tdls_teardown_peers(struct wpa_sm *sm)
3051 {
3052 struct wpa_tdls_peer *peer, *tmp;
3053
3054 if (!sm)
3055 return;
3056 peer = sm->tdls;
3057
3058 wpa_printf(MSG_DEBUG, "TDLS: Tear down peers");
3059
3060 while (peer) {
3061 tmp = peer->next;
3062 wpa_printf(MSG_DEBUG, "TDLS: Tear down peer " MACSTR,
3063 MAC2STR(peer->addr));
3064 if (sm->tdls_external_setup)
3065 wpa_tdls_do_teardown(sm, peer,
3066 WLAN_REASON_DEAUTH_LEAVING);
3067 else
3068 wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
3069
3070 peer = tmp;
3071 }
3072 }
3073
3074
wpa_tdls_remove_peers(struct wpa_sm * sm)3075 static void wpa_tdls_remove_peers(struct wpa_sm *sm)
3076 {
3077 struct wpa_tdls_peer *peer, *tmp;
3078
3079 peer = sm->tdls;
3080
3081 while (peer) {
3082 int res;
3083 tmp = peer->next;
3084 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
3085 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
3086 MAC2STR(peer->addr), res);
3087 wpa_tdls_peer_free(sm, peer);
3088 peer = tmp;
3089 }
3090 }
3091
3092
3093 /**
3094 * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
3095 *
3096 * This function is called to recover driver interface parameters for TDLS
3097 * and frees resources allocated for it.
3098 */
wpa_tdls_deinit(struct wpa_sm * sm)3099 void wpa_tdls_deinit(struct wpa_sm *sm)
3100 {
3101 if (sm == NULL)
3102 return;
3103
3104 if (sm->l2_tdls)
3105 l2_packet_deinit(sm->l2_tdls);
3106 sm->l2_tdls = NULL;
3107
3108 wpa_tdls_remove_peers(sm);
3109 }
3110
3111
wpa_tdls_assoc(struct wpa_sm * sm)3112 void wpa_tdls_assoc(struct wpa_sm *sm)
3113 {
3114 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
3115 wpa_tdls_remove_peers(sm);
3116 }
3117
3118
wpa_tdls_disassoc(struct wpa_sm * sm)3119 void wpa_tdls_disassoc(struct wpa_sm *sm)
3120 {
3121 wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
3122 wpa_tdls_remove_peers(sm);
3123 }
3124
3125
wpa_tdls_prohibited(struct ieee802_11_elems * elems)3126 static int wpa_tdls_prohibited(struct ieee802_11_elems *elems)
3127 {
3128 /* bit 38 - TDLS Prohibited */
3129 return !!(elems->ext_capab[4] & 0x40);
3130 }
3131
3132
wpa_tdls_chan_switch_prohibited(struct ieee802_11_elems * elems)3133 static int wpa_tdls_chan_switch_prohibited(struct ieee802_11_elems *elems)
3134 {
3135 /* bit 39 - TDLS Channel Switch Prohibited */
3136 return !!(elems->ext_capab[4] & 0x80);
3137 }
3138
3139
wpa_tdls_ap_ies(struct wpa_sm * sm,const u8 * ies,size_t len)3140 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
3141 {
3142 struct ieee802_11_elems elems;
3143
3144 sm->tdls_prohibited = 0;
3145 sm->tdls_chan_switch_prohibited = 0;
3146
3147 if (ies == NULL ||
3148 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
3149 elems.ext_capab == NULL || elems.ext_capab_len < 5)
3150 return;
3151
3152 sm->tdls_prohibited = wpa_tdls_prohibited(&elems);
3153 wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
3154 sm->tdls_prohibited ? "prohibited" : "allowed");
3155 sm->tdls_chan_switch_prohibited =
3156 wpa_tdls_chan_switch_prohibited(&elems);
3157 wpa_printf(MSG_DEBUG, "TDLS: TDLS channel switch %s in the target BSS",
3158 sm->tdls_chan_switch_prohibited ? "prohibited" : "allowed");
3159 }
3160
3161
wpa_tdls_assoc_resp_ies(struct wpa_sm * sm,const u8 * ies,size_t len)3162 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
3163 {
3164 struct ieee802_11_elems elems;
3165
3166 if (ies == NULL ||
3167 ieee802_11_parse_elems(ies, len, &elems, 0) == ParseFailed ||
3168 elems.ext_capab == NULL || elems.ext_capab_len < 5)
3169 return;
3170
3171 if (!sm->tdls_prohibited && wpa_tdls_prohibited(&elems)) {
3172 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
3173 "(Re)Association Response IEs");
3174 sm->tdls_prohibited = 1;
3175 }
3176
3177 if (!sm->tdls_chan_switch_prohibited &&
3178 wpa_tdls_chan_switch_prohibited(&elems)) {
3179 wpa_printf(MSG_DEBUG,
3180 "TDLS: TDLS channel switch prohibited based on (Re)Association Response IEs");
3181 sm->tdls_chan_switch_prohibited = 1;
3182 }
3183 }
3184
3185
wpa_tdls_enable(struct wpa_sm * sm,int enabled)3186 void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
3187 {
3188 wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
3189 sm->tdls_disabled = !enabled;
3190 }
3191
3192
wpa_tdls_is_external_setup(struct wpa_sm * sm)3193 int wpa_tdls_is_external_setup(struct wpa_sm *sm)
3194 {
3195 return sm->tdls_external_setup;
3196 }
3197
3198
wpa_tdls_process_discovery_response(struct wpa_sm * sm,const u8 * addr,const u8 * buf,size_t len)3199 int wpa_tdls_process_discovery_response(struct wpa_sm *sm, const u8 *addr,
3200 const u8 *buf, size_t len)
3201 {
3202 struct ieee802_11_elems elems;
3203 const struct wpa_tdls_lnkid *lnkid;
3204 struct wpa_tdls_peer *peer;
3205 size_t min_req_len = 1 /* Dialog Token */ + 2 /* Capability */ +
3206 sizeof(struct wpa_tdls_lnkid);
3207 int link_id = -1;
3208
3209 wpa_printf(MSG_DEBUG, "TDLS: Process Discovery Response from " MACSTR,
3210 MAC2STR(addr));
3211
3212 if (len < min_req_len) {
3213 wpa_printf(MSG_DEBUG, "TDLS Discovery Resp is too short: %zu",
3214 len);
3215 return -1;
3216 }
3217
3218 /* Elements start after the three octets of fixed field (one octet for
3219 * the Dialog Token field and two octets for the Capability field. */
3220 if (ieee802_11_parse_elems(buf + 3, len - 3, &elems, 1) ==
3221 ParseFailed) {
3222 wpa_printf(MSG_DEBUG,
3223 "TDLS: Failed to parse IEs in Discovery Response");
3224 return -1;
3225 }
3226
3227 if (!elems.link_id) {
3228 wpa_printf(MSG_DEBUG,
3229 "TDLS: Link Identifier element not found in Discovery Response");
3230 return -1;
3231 }
3232
3233 lnkid = (const struct wpa_tdls_lnkid *) (elems.link_id - 2);
3234
3235 if (!wpa_tdls_is_lnkid_bss_valid(sm, lnkid, &link_id)) {
3236 wpa_printf(MSG_DEBUG,
3237 "TDLS: Discovery Response from different BSS "
3238 MACSTR, MAC2STR(lnkid->bssid));
3239 return -1;
3240 }
3241
3242 peer = wpa_tdls_add_peer(sm, addr, NULL);
3243 if (!peer) {
3244 wpa_printf(MSG_DEBUG, "TDLS: Could not add peer entry");
3245 return -1;
3246 }
3247
3248 peer->mld_link_id = link_id;
3249 wpa_printf(MSG_DEBUG, "TDLS: Link identifier BSS: " MACSTR
3250 " , link id: %u", MAC2STR(lnkid->bssid), link_id);
3251
3252 peer->disc_resp_rcvd = true;
3253 if (peer->setup_req_rcvd) {
3254 peer->setup_req_rcvd = false;
3255 wpa_printf(MSG_DEBUG, "TDLS: Process the deferred TDLS start");
3256 return wpa_tdls_start(sm, addr);
3257 }
3258
3259 return 0;
3260 }
3261
3262
wpa_tdls_enable_chan_switch(struct wpa_sm * sm,const u8 * addr,u8 oper_class,struct hostapd_freq_params * freq_params)3263 int wpa_tdls_enable_chan_switch(struct wpa_sm *sm, const u8 *addr,
3264 u8 oper_class,
3265 struct hostapd_freq_params *freq_params)
3266 {
3267 struct wpa_tdls_peer *peer;
3268 int ret;
3269
3270 if (sm->tdls_disabled || !sm->tdls_supported)
3271 return -1;
3272
3273 if (!sm->tdls_chan_switch) {
3274 wpa_printf(MSG_DEBUG,
3275 "TDLS: Channel switching not supported by the driver");
3276 return -1;
3277 }
3278
3279 if (sm->tdls_chan_switch_prohibited) {
3280 wpa_printf(MSG_DEBUG,
3281 "TDLS: Channel switching is prohibited in this BSS - reject request to switch channel");
3282 return -1;
3283 }
3284
3285 for (peer = sm->tdls; peer; peer = peer->next) {
3286 if (ether_addr_equal(peer->addr, addr))
3287 break;
3288 }
3289
3290 if (peer == NULL || !peer->tpk_success) {
3291 wpa_printf(MSG_ERROR, "TDLS: Peer " MACSTR
3292 " not found for channel switching", MAC2STR(addr));
3293 return -1;
3294 }
3295
3296 if (peer->chan_switch_enabled) {
3297 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
3298 " already has channel switching enabled",
3299 MAC2STR(addr));
3300 return 0;
3301 }
3302
3303 ret = wpa_sm_tdls_enable_channel_switch(sm, peer->addr,
3304 oper_class, freq_params);
3305 if (!ret)
3306 peer->chan_switch_enabled = 1;
3307
3308 return ret;
3309 }
3310
3311
wpa_tdls_disable_chan_switch(struct wpa_sm * sm,const u8 * addr)3312 int wpa_tdls_disable_chan_switch(struct wpa_sm *sm, const u8 *addr)
3313 {
3314 struct wpa_tdls_peer *peer;
3315
3316 if (sm->tdls_disabled || !sm->tdls_supported)
3317 return -1;
3318
3319 for (peer = sm->tdls; peer; peer = peer->next) {
3320 if (ether_addr_equal(peer->addr, addr))
3321 break;
3322 }
3323
3324 if (!peer || !peer->chan_switch_enabled) {
3325 wpa_printf(MSG_ERROR, "TDLS: Channel switching not enabled for "
3326 MACSTR, MAC2STR(addr));
3327 return -1;
3328 }
3329
3330 /* ignore the return value */
3331 wpa_sm_tdls_disable_channel_switch(sm, peer->addr);
3332
3333 peer->chan_switch_enabled = 0;
3334 return 0;
3335 }
3336