src/rsn_supp/tdls.c

   1 /*
   2  * wpa_supplicant - TDLS
   3  * Copyright (c) 2010-2011, Atheros Communications
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "utils/includes.h"
  16
  17 #include "utils/common.h"
  18 #include "utils/eloop.h"
  19 #include "utils/os.h"
  20 #include "common/ieee802_11_defs.h"
  21 #include "crypto/sha256.h"
  22 #include "crypto/crypto.h"
  23 #include "crypto/aes_wrap.h"
  24 #include "rsn_supp/wpa.h"
  25 #include "rsn_supp/wpa_ie.h"
  26 #include "rsn_supp/wpa_i.h"
  27 #include "drivers/driver.h"
  28 #include "l2_packet/l2_packet.h"
  29
  30 #ifdef CONFIG_TDLS_TESTING
  31 #define TDLS_TESTING_LONG_FRAME BIT(0)
  32 #define TDLS_TESTING_ALT_RSN_IE BIT(1)
  33 #define TDLS_TESTING_DIFF_BSSID BIT(2)
  34 #define TDLS_TESTING_SHORT_LIFETIME BIT(3)
  35 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
  36 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
  37 #define TDLS_TESTING_LONG_LIFETIME BIT(6)
  38 #define TDLS_TESTING_CONCURRENT_INIT BIT(7)
  39 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
  40 #define TDLS_TESTING_DECLINE_RESP BIT(9)
  41 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
  42 unsigned int tdls_testing = 0;
  43 #endif /* CONFIG_TDLS_TESTING */
  44
  45 #define TPK_LIFETIME 43200 /* 12 hours */
  46 #define TPK_RETRY_COUNT 3
  47 #define TPK_TIMEOUT 5000 /* in milliseconds */
  48
  49 #define TDLS_MIC_LEN            16
  50
  51 #define TDLS_TIMEOUT_LEN        4
  52
  53 struct wpa_tdls_ftie {
  54         u8 ie_type; /* FTIE */
  55         u8 ie_len;
  56         u8 mic_ctrl[2];
  57         u8 mic[TDLS_MIC_LEN];
  58         u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
  59         u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
  60         /* followed by optional elements */
  61 } STRUCT_PACKED;
  62
  63 struct wpa_tdls_timeoutie {
  64         u8 ie_type; /* Timeout IE */
  65         u8 ie_len;
  66         u8 interval_type;
  67         u8 value[TDLS_TIMEOUT_LEN];
  68 } STRUCT_PACKED;
  69
  70 struct wpa_tdls_lnkid {
  71         u8 ie_type; /* Link Identifier IE */
  72         u8 ie_len;
  73         u8 bssid[ETH_ALEN];
  74         u8 init_sta[ETH_ALEN];
  75         u8 resp_sta[ETH_ALEN];
  76 } STRUCT_PACKED;
  77
  78 /* TDLS frame headers as per IEEE Std 802.11z-2010 */
  79 struct wpa_tdls_frame {
  80         u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
  81         u8 category; /* Category */
  82         u8 action; /* Action (enum tdls_frame_type) */
  83 } STRUCT_PACKED;
  84
  85 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
  86 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
  87 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
  88
  89
  90 #define TDLS_MAX_IE_LEN 80
  91 #define IEEE80211_MAX_SUPP_RATES 32
  92
  93 struct wpa_tdls_peer {
  94         struct wpa_tdls_peer *next;
  95         int initiator; /* whether this end was initiator for TDLS setup */
  96         u8 addr[ETH_ALEN]; /* other end MAC address */
  97         u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
  98         u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
  99         u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
 100         size_t rsnie_i_len;
 101         u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
 102         size_t rsnie_p_len;
 103         u32 lifetime;
 104         int cipher; /* Selected cipher (WPA_CIPHER_*) */
 105         u8 dtoken;
 106
 107         struct tpk {
 108                 u8 kck[16]; /* TPK-KCK */
 109                 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
 110         } tpk;
 111         int tpk_set;
 112         int tpk_success;
 113
 114         struct tpk_timer {
 115                 u8 dest[ETH_ALEN];
 116                 int count;      /* Retry Count */
 117                 int timer;      /* Timeout in milliseconds */
 118                 u8 action_code; /* TDLS frame type */
 119                 u8 dialog_token;
 120                 u16 status_code;
 121                 int buf_len;    /* length of TPK message for retransmission */
 122                 u8 *buf;        /* buffer for TPK message */
 123         } sm_tmr;
 124
 125         u16 capability;
 126
 127         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 128         size_t supp_rates_len;
 129 };
 130
 131
 132 static int wpa_tdls_get_privacy(struct wpa_sm *sm)
 133 {
 134         /*
 135          * Get info needed from supplicant to check if the current BSS supports
 136          * security. Other than OPEN mode, rest are considered secured
 137          * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
 138          */
 139         return sm->pairwise_cipher != WPA_CIPHER_NONE;
 140 }
 141
 142
 143 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
 144 {
 145         os_memcpy(pos, ie, ie_len);
 146         return pos + ie_len;
 147 }
 148
 149
 150 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 151 {
 152         if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,
 153                            0, 0, NULL, 0, NULL, 0) < 0) {
 154                 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
 155                            "the driver");
 156                 return -1;
 157         }
 158
 159         return 0;
 160 }
 161
 162
 163 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 164 {
 165         u8 key_len;
 166         u8 rsc[6];
 167         enum wpa_alg alg;
 168
 169         os_memset(rsc, 0, 6);
 170
 171         switch (peer->cipher) {
 172         case WPA_CIPHER_CCMP:
 173                 alg = WPA_ALG_CCMP;
 174                 key_len = 16;
 175                 break;
 176         case WPA_CIPHER_NONE:
 177                 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
 178                            "NONE - do not use pairwise keys");
 179                 return -1;
 180         default:
 181                 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
 182                            sm->pairwise_cipher);
 183                 return -1;
 184         }
 185
 186         if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
 187                            rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
 188                 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
 189                            "driver");
 190                 return -1;
 191         }
 192         return 0;
 193 }
 194
 195
 196 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
 197                                  u8 action_code, u8 dialog_token,
 198                                  u16 status_code, const u8 *buf, size_t len)
 199 {
 200         return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
 201                                      status_code, buf, len);
 202 }
 203
 204
 205 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
 206                              u8 dialog_token, u16 status_code,
 207                              const u8 *msg, size_t msg_len)
 208 {
 209         struct wpa_tdls_peer *peer;
 210
 211         wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
 212                    "dialog_token=%u status_code=%u msg_len=%u",
 213                    MAC2STR(dest), action_code, dialog_token, status_code,
 214                    (unsigned int) msg_len);
 215
 216         if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
 217                                   status_code, msg, msg_len)) {
 218                 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
 219                            "(action_code=%u)", action_code);
 220                 return -1;
 221         }
 222
 223         if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
 224             action_code == WLAN_TDLS_TEARDOWN ||
 225             action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
 226             action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
 227                 return 0; /* No retries */
 228
 229         for (peer = sm->tdls; peer; peer = peer->next) {
 230                 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)
 231                         break;
 232         }
 233
 234         if (peer == NULL) {
 235                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 236                            "retry " MACSTR, MAC2STR(dest));
 237                 return 0;
 238         }
 239
 240         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 241
 242         peer->sm_tmr.count = TPK_RETRY_COUNT;
 243         peer->sm_tmr.timer = TPK_TIMEOUT;
 244
 245         /* Copy message to resend on timeout */
 246         os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
 247         peer->sm_tmr.action_code = action_code;
 248         peer->sm_tmr.dialog_token = dialog_token;
 249         peer->sm_tmr.status_code = status_code;
 250         peer->sm_tmr.buf_len = msg_len;
 251         os_free(peer->sm_tmr.buf);
 252         peer->sm_tmr.buf = os_malloc(msg_len);
 253         if (peer->sm_tmr.buf == NULL)
 254                 return -1;
 255         os_memcpy(peer->sm_tmr.buf, msg, msg_len);
 256
 257         wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
 258                    "(action_code=%u)", action_code);
 259         eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
 260                                wpa_tdls_tpk_retry_timeout, sm, peer);
 261         return 0;
 262 }
 263
 264
 265 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
 266                                 u16 reason_code)
 267 {
 268         int ret;
 269
 270         if (sm->tdls_external_setup) {
 271                 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
 272
 273                 /* disable the link after teardown was sent */
 274                 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
 275         } else {
 276                 ret = wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
 277         }
 278
 279         wpa_tdls_peer_free(sm, peer);
 280
 281         return ret;
 282 }
 283
 284
 285 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
 286 {
 287
 288         struct wpa_sm *sm = eloop_ctx;
 289         struct wpa_tdls_peer *peer = timeout_ctx;
 290
 291         if (peer->sm_tmr.count) {
 292                 peer->sm_tmr.count--;
 293                 peer->sm_tmr.timer = TPK_TIMEOUT;
 294
 295                 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
 296                            "(action_code=%u)",
 297                            peer->sm_tmr.action_code);
 298
 299                 if (peer->sm_tmr.buf == NULL) {
 300                         wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
 301                                    "for action_code=%u",
 302                                    peer->sm_tmr.action_code);
 303                         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
 304                                              peer);
 305                         return;
 306                 }
 307
 308                 /* resend TPK Handshake Message to Peer */
 309                 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
 310                                           peer->sm_tmr.action_code,
 311                                           peer->sm_tmr.dialog_token,
 312                                           peer->sm_tmr.status_code,
 313                                           peer->sm_tmr.buf,
 314                                           peer->sm_tmr.buf_len)) {
 315                         wpa_printf(MSG_INFO, "TDLS: Failed to retry "
 316                                    "transmission");
 317                 }
 318
 319                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 320                 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
 321                                        wpa_tdls_tpk_retry_timeout, sm, peer);
 322         } else {
 323                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 324
 325                 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
 326                 wpa_tdls_do_teardown(sm, peer,
 327                                      WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 328         }
 329 }
 330
 331
 332 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
 333                                               struct wpa_tdls_peer *peer,
 334                                               u8 action_code)
 335 {
 336         if (action_code == peer->sm_tmr.action_code) {
 337                 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
 338                            "action_code=%u", action_code);
 339
 340                 /* Cancel Timeout registered */
 341                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 342
 343                 /* free all resources meant for retry */
 344                 os_free(peer->sm_tmr.buf);
 345                 peer->sm_tmr.buf = NULL;
 346
 347                 peer->sm_tmr.count = 0;
 348                 peer->sm_tmr.timer = 0;
 349                 peer->sm_tmr.buf_len = 0;
 350                 peer->sm_tmr.action_code = 0xff;
 351         } else {
 352                 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
 353                            "(Unknown action_code=%u)", action_code);
 354         }
 355 }
 356
 357
 358 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
 359                                   const u8 *own_addr, const u8 *bssid)
 360 {
 361         u8 key_input[SHA256_MAC_LEN];
 362         const u8 *nonce[2];
 363         size_t len[2];
 364         u8 data[3 * ETH_ALEN];
 365
 366         /* IEEE Std 802.11z-2010 8.5.9.1:
 367          * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
 368          */
 369         len[0] = WPA_NONCE_LEN;
 370         len[1] = WPA_NONCE_LEN;
 371         if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
 372                 nonce[0] = peer->inonce;
 373                 nonce[1] = peer->rnonce;
 374         } else {
 375                 nonce[0] = peer->rnonce;
 376                 nonce[1] = peer->inonce;
 377         }
 378         wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
 379         wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
 380         sha256_vector(2, nonce, len, key_input);
 381         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
 382                         key_input, SHA256_MAC_LEN);
 383
 384         /*
 385          * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
 386          *      min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
 387          * TODO: is N_KEY really included in KDF Context and if so, in which
 388          * presentation format (little endian 16-bit?) is it used? It gets
 389          * added by the KDF anyway..
 390          */
 391
 392         if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
 393                 os_memcpy(data, own_addr, ETH_ALEN);
 394                 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
 395         } else {
 396                 os_memcpy(data, peer->addr, ETH_ALEN);
 397                 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
 398         }
 399         os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
 400         wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
 401
 402         sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
 403                    (u8 *) &peer->tpk, sizeof(peer->tpk));
 404         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
 405                         peer->tpk.kck, sizeof(peer->tpk.kck));
 406         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
 407                         peer->tpk.tk, sizeof(peer->tpk.tk));
 408         peer->tpk_set = 1;
 409 }
 410
 411
 412 /**
 413  * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
 414  * @kck: TPK-KCK
 415  * @lnkid: Pointer to the beginning of Link Identifier IE
 416  * @rsnie: Pointer to the beginning of RSN IE used for handshake
 417  * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
 418  * @ftie: Pointer to the beginning of FT IE
 419  * @mic: Pointer for writing MIC
 420  *
 421  * Calculate MIC for TDLS frame.
 422  */
 423 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
 424                              const u8 *rsnie, const u8 *timeoutie,
 425                              const u8 *ftie, u8 *mic)
 426 {
 427         u8 *buf, *pos;
 428         struct wpa_tdls_ftie *_ftie;
 429         const struct wpa_tdls_lnkid *_lnkid;
 430         int ret;
 431         int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
 432                 2 + timeoutie[1] + 2 + ftie[1];
 433         buf = os_zalloc(len);
 434         if (!buf) {
 435                 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
 436                 return -1;
 437         }
 438
 439         pos = buf;
 440         _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
 441         /* 1) TDLS initiator STA MAC address */
 442         os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
 443         pos += ETH_ALEN;
 444         /* 2) TDLS responder STA MAC address */
 445         os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
 446         pos += ETH_ALEN;
 447         /* 3) Transaction Sequence number */
 448         *pos++ = trans_seq;
 449         /* 4) Link Identifier IE */
 450         os_memcpy(pos, lnkid, 2 + lnkid[1]);
 451         pos += 2 + lnkid[1];
 452         /* 5) RSN IE */
 453         os_memcpy(pos, rsnie, 2 + rsnie[1]);
 454         pos += 2 + rsnie[1];
 455         /* 6) Timeout Interval IE */
 456         os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
 457         pos += 2 + timeoutie[1];
 458         /* 7) FTIE, with the MIC field of the FTIE set to 0 */
 459         os_memcpy(pos, ftie, 2 + ftie[1]);
 460         _ftie = (struct wpa_tdls_ftie *) pos;
 461         os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
 462         pos += 2 + ftie[1];
 463
 464         wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
 465         wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
 466         ret = omac1_aes_128(kck, buf, pos - buf, mic);
 467         os_free(buf);
 468         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
 469         return ret;
 470 }
 471
 472
 473 /**
 474  * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
 475  * @kck: TPK-KCK
 476  * @trans_seq: Transaction Sequence Number (4 - Teardown)
 477  * @rcode: Reason code for Teardown
 478  * @dtoken: Dialog Token used for that particular link
 479  * @lnkid: Pointer to the beginning of Link Identifier IE
 480  * @ftie: Pointer to the beginning of FT IE
 481  * @mic: Pointer for writing MIC
 482  *
 483  * Calculate MIC for TDLS frame.
 484  */
 485 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
 486                                      u8 dtoken, const u8 *lnkid,
 487                                      const u8 *ftie, u8 *mic)
 488 {
 489         u8 *buf, *pos;
 490         struct wpa_tdls_ftie *_ftie;
 491         int ret;
 492         int len;
 493
 494         if (lnkid == NULL)
 495                 return -1;
 496
 497         len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
 498                 sizeof(trans_seq) + 2 + ftie[1];
 499
 500         buf = os_zalloc(len);
 501         if (!buf) {
 502                 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
 503                 return -1;
 504         }
 505
 506         pos = buf;
 507         /* 1) Link Identifier IE */
 508         os_memcpy(pos, lnkid, 2 + lnkid[1]);
 509         pos += 2 + lnkid[1];
 510         /* 2) Reason Code */
 511         WPA_PUT_LE16(pos, rcode);
 512         pos += sizeof(rcode);
 513         /* 3) Dialog token */
 514         *pos++ = dtoken;
 515         /* 4) Transaction Sequence number */
 516         *pos++ = trans_seq;
 517         /* 7) FTIE, with the MIC field of the FTIE set to 0 */
 518         os_memcpy(pos, ftie, 2 + ftie[1]);
 519         _ftie = (struct wpa_tdls_ftie *) pos;
 520         os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
 521         pos += 2 + ftie[1];
 522
 523         wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
 524         wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
 525         ret = omac1_aes_128(kck, buf, pos - buf, mic);
 526         os_free(buf);
 527         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
 528         return ret;
 529 }
 530
 531
 532 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
 533                                           struct wpa_tdls_peer *peer,
 534                                           const u8 *lnkid, const u8 *timeoutie,
 535                                           const struct wpa_tdls_ftie *ftie)
 536 {
 537         u8 mic[16];
 538
 539         if (peer->tpk_set) {
 540                 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
 541                                   peer->rsnie_p, timeoutie, (u8 *) ftie,
 542                                   mic);
 543                 if (os_memcmp(mic, ftie->mic, 16) != 0) {
 544                         wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
 545                                    "dropping packet");
 546                         wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
 547                                     ftie->mic, 16);
 548                         wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
 549                                     mic, 16);
 550                         return -1;
 551                 }
 552         } else {
 553                 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
 554                            "TPK not set - dropping packet");
 555                 return -1;
 556         }
 557         return 0;
 558 }
 559
 560
 561 static int wpa_supplicant_verify_tdls_mic_teardown(
 562         u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
 563         const u8 *lnkid, const struct wpa_tdls_ftie *ftie)
 564 {
 565         u8 mic[16];
 566
 567         if (peer->tpk_set) {
 568                 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
 569                                           dtoken, lnkid, (u8 *) ftie, mic);
 570                 if (os_memcmp(mic, ftie->mic, 16) != 0) {
 571                         wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
 572                                    "dropping packet");
 573                         return -1;
 574                 }
 575         } else {
 576                 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
 577                            "MIC, TPK not set - dropping packet");
 578                 return -1;
 579         }
 580         return 0;
 581 }
 582
 583
 584 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
 585 {
 586         struct wpa_sm *sm = eloop_ctx;
 587         struct wpa_tdls_peer *peer = timeout_ctx;
 588
 589         /*
 590          * On TPK lifetime expiration, we have an option of either tearing down
 591          * the direct link or trying to re-initiate it. The selection of what
 592          * to do is not strictly speaking controlled by our role in the expired
 593          * link, but for now, use that to select whether to renew or tear down
 594          * the link.
 595          */
 596
 597         if (peer->initiator) {
 598                 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
 599                            " - try to renew", MAC2STR(peer->addr));
 600                 wpa_tdls_start(sm, peer->addr);
 601         } else {
 602                 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
 603                            " - tear down", MAC2STR(peer->addr));
 604                 wpa_tdls_do_teardown(sm, peer,
 605                                      WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 606         }
 607 }
 608
 609
 610 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 611 {
 612         wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
 613                    MAC2STR(peer->addr));
 614         eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
 615         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 616         peer->initiator = 0;
 617         os_free(peer->sm_tmr.buf);
 618         peer->sm_tmr.buf = NULL;
 619         peer->rsnie_i_len = peer->rsnie_p_len = 0;
 620         peer->cipher = 0;
 621         peer->tpk_set = peer->tpk_success = 0;
 622         os_memset(&peer->tpk, 0, sizeof(peer->tpk));
 623         os_memset(peer->inonce, 0, WPA_NONCE_LEN);
 624         os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
 625 }
 626
 627
 628 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
 629                             struct wpa_tdls_lnkid *lnkid)
 630 {
 631         lnkid->ie_type = WLAN_EID_LINK_ID;
 632         lnkid->ie_len = 3 * ETH_ALEN;
 633         os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN);
 634         if (peer->initiator) {
 635                 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
 636                 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
 637         } else {
 638                 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
 639                 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
 640         }
 641 }
 642
 643
 644 int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
 645 {
 646         struct wpa_tdls_peer *peer;
 647         struct wpa_tdls_ftie *ftie;
 648         struct wpa_tdls_lnkid lnkid;
 649         u8 dialog_token;
 650         u8 *rbuf, *pos;
 651         int ielen;
 652
 653         if (sm->tdls_disabled || !sm->tdls_supported)
 654                 return -1;
 655
 656         /* Find the node and free from the list */
 657         for (peer = sm->tdls; peer; peer = peer->next) {
 658                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 659                         break;
 660         }
 661
 662         if (peer == NULL) {
 663                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 664                            "Teardown " MACSTR, MAC2STR(addr));
 665                 return 0;
 666         }
 667
 668         dialog_token = peer->dtoken;
 669
 670         wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
 671                    MAC2STR(addr));
 672
 673         ielen = 0;
 674         if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
 675                 /* To add FTIE for Teardown request and compute MIC */
 676                 ielen += sizeof(*ftie);
 677 #ifdef CONFIG_TDLS_TESTING
 678                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
 679                         ielen += 170;
 680 #endif /* CONFIG_TDLS_TESTING */
 681         }
 682
 683         rbuf = os_zalloc(ielen + 1);
 684         if (rbuf == NULL)
 685                 return -1;
 686         pos = rbuf;
 687
 688         if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
 689                 goto skip_ies;
 690
 691         ftie = (struct wpa_tdls_ftie *) pos;
 692         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
 693         /* Using the recent nonce which should be for CONFIRM frame */
 694         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
 695         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
 696         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
 697         pos = (u8 *) (ftie + 1);
 698 #ifdef CONFIG_TDLS_TESTING
 699         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
 700                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
 701                            "FTIE");
 702                 ftie->ie_len += 170;
 703                 *pos++ = 255; /* FTIE subelem */
 704                 *pos++ = 168; /* FTIE subelem length */
 705         }
 706 #endif /* CONFIG_TDLS_TESTING */
 707         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
 708                     (u8 *) ftie, sizeof(*ftie));
 709
 710         /* compute MIC before sending */
 711         wpa_tdls_linkid(sm, peer, &lnkid);
 712         wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
 713                                   dialog_token, (u8 *) &lnkid, (u8 *) ftie,
 714                                   ftie->mic);
 715
 716 skip_ies:
 717         /* TODO: register for a Timeout handler, if Teardown is not received at
 718          * the other end, then try again another time */
 719
 720         /* request driver to send Teardown using this FTIE */
 721         wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
 722                           WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, rbuf,
 723                           pos - rbuf);
 724         os_free(rbuf);
 725
 726         /* clear the Peerkey statemachine */
 727         wpa_tdls_peer_free(sm, peer);
 728
 729         return 0;
 730 }
 731
 732
 733 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
 734 {
 735         struct wpa_tdls_peer *peer;
 736
 737         if (sm->tdls_disabled || !sm->tdls_supported)
 738                 return -1;
 739
 740         for (peer = sm->tdls; peer; peer = peer->next) {
 741                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 742                         break;
 743         }
 744
 745         if (peer == NULL) {
 746                 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
 747                    " for link Teardown", MAC2STR(addr));
 748                 return -1;
 749         }
 750
 751         if (!peer->tpk_success) {
 752                 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
 753                    " not connected - cannot Teardown link", MAC2STR(addr));
 754                 return -1;
 755         }
 756
 757         return wpa_tdls_do_teardown(sm, peer, reason_code);
 758 }
 759
 760
 761 void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr)
 762 {
 763         struct wpa_tdls_peer *peer;
 764
 765         for (peer = sm->tdls; peer; peer = peer->next) {
 766                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 767                         break;
 768         }
 769
 770         if (peer) {
 771                 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
 772                 wpa_tdls_peer_free(sm, peer);
 773         }
 774 }
 775
 776
 777 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
 778                                   const u8 *buf, size_t len)
 779 {
 780         struct wpa_tdls_peer *peer = NULL;
 781         struct wpa_tdls_ftie *ftie;
 782         struct wpa_tdls_lnkid *lnkid;
 783         struct wpa_eapol_ie_parse kde;
 784         u16 reason_code;
 785         const u8 *pos;
 786         int ielen;
 787
 788         /* Find the node and free from the list */
 789         for (peer = sm->tdls; peer; peer = peer->next) {
 790                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
 791                         break;
 792         }
 793
 794         if (peer == NULL) {
 795                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 796                            "Teardown " MACSTR, MAC2STR(src_addr));
 797                 return 0;
 798         }
 799
 800         pos = buf;
 801         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
 802
 803         reason_code = WPA_GET_LE16(pos);
 804         pos += 2;
 805
 806         wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
 807                    " (reason code %u)", MAC2STR(src_addr), reason_code);
 808
 809         ielen = len - (pos - buf); /* start of IE in buf */
 810         if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
 811                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown");
 812                 return -1;
 813         }
 814
 815         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
 816                 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
 817                            "Teardown");
 818                 return -1;
 819         }
 820         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
 821
 822         if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
 823                 goto skip_ftie;
 824
 825         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
 826                 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
 827                 return -1;
 828         }
 829
 830         ftie = (struct wpa_tdls_ftie *) kde.ftie;
 831
 832         /* Process MIC check to see if TDLS Teardown is right */
 833         if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
 834                                                     peer->dtoken, peer,
 835                                                     (u8 *) lnkid, ftie) < 0) {
 836                 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
 837                            "Teardown Request from " MACSTR, MAC2STR(src_addr));
 838                 return -1;
 839         }
 840
 841 skip_ftie:
 842         /*
 843          * Request the driver to disable the direct link and clear associated
 844          * keys.
 845          */
 846         wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
 847
 848         /* clear the Peerkey statemachine */
 849         wpa_tdls_peer_free(sm, peer);
 850
 851         return 0;
 852 }
 853
 854
 855 /**
 856  * wpa_tdls_send_error - To send suitable TDLS status response with
 857  *      appropriate status code mentioning reason for error/failure.
 858  * @dst         - MAC addr of Peer station
 859  * @tdls_action - TDLS frame type for which error code is sent
 860  * @status      - status code mentioning reason
 861  */
 862
 863 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
 864                                u8 tdls_action, u8 dialog_token, u16 status)
 865 {
 866         wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
 867                    " (action=%u status=%u)",
 868                    MAC2STR(dst), tdls_action, status);
 869         return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
 870                                  NULL, 0);
 871 }
 872
 873
 874 static struct wpa_tdls_peer *
 875 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr)
 876 {
 877         struct wpa_tdls_peer *peer;
 878
 879         wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
 880                    MAC2STR(addr));
 881
 882         peer = os_zalloc(sizeof(*peer));
 883         if (peer == NULL)
 884                 return NULL;
 885
 886         os_memcpy(peer->addr, addr, ETH_ALEN);
 887         peer->next = sm->tdls;
 888         sm->tdls = peer;
 889
 890         return peer;
 891 }
 892
 893
 894 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
 895                                 struct wpa_tdls_peer *peer)
 896 {
 897         size_t buf_len;
 898         struct wpa_tdls_timeoutie timeoutie;
 899         u16 rsn_capab;
 900         struct wpa_tdls_ftie *ftie;
 901         u8 *rbuf, *pos, *count_pos;
 902         u16 count;
 903         struct rsn_ie_hdr *hdr;
 904
 905         if (!wpa_tdls_get_privacy(sm)) {
 906                 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
 907                 peer->rsnie_i_len = 0;
 908                 goto skip_rsnie;
 909         }
 910
 911         /*
 912          * TPK Handshake Message 1:
 913          * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
 914          * Timeout Interval IE))
 915          */
 916
 917         /* Filling RSN IE */
 918         hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
 919         hdr->elem_id = WLAN_EID_RSN;
 920         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 921
 922         pos = (u8 *) (hdr + 1);
 923         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
 924         pos += RSN_SELECTOR_LEN;
 925         count_pos = pos;
 926         pos += 2;
 927
 928         count = 0;
 929
 930         /*
 931          * AES-CCMP is the default Encryption preferred for TDLS, so
 932          * RSN IE is filled only with CCMP CIPHER
 933          * Note: TKIP is not used to encrypt TDLS link.
 934          *
 935          * Regardless of the cipher used on the AP connection, select CCMP
 936          * here.
 937          */
 938         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 939         pos += RSN_SELECTOR_LEN;
 940         count++;
 941
 942         WPA_PUT_LE16(count_pos, count);
 943
 944         WPA_PUT_LE16(pos, 1);
 945         pos += 2;
 946         RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
 947         pos += RSN_SELECTOR_LEN;
 948
 949         rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
 950         rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
 951 #ifdef CONFIG_TDLS_TESTING
 952         if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
 953                 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
 954                            "testing");
 955                 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
 956         }
 957 #endif /* CONFIG_TDLS_TESTING */
 958         WPA_PUT_LE16(pos, rsn_capab);
 959         pos += 2;
 960 #ifdef CONFIG_TDLS_TESTING
 961         if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
 962                 /* Number of PMKIDs */
 963                 *pos++ = 0x00;
 964                 *pos++ = 0x00;
 965         }
 966 #endif /* CONFIG_TDLS_TESTING */
 967
 968         hdr->len = (pos - peer->rsnie_i) - 2;
 969         peer->rsnie_i_len = pos - peer->rsnie_i;
 970         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
 971                     peer->rsnie_i, peer->rsnie_i_len);
 972
 973 skip_rsnie:
 974         buf_len = 0;
 975         if (wpa_tdls_get_privacy(sm))
 976                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
 977                         sizeof(struct wpa_tdls_timeoutie);
 978 #ifdef CONFIG_TDLS_TESTING
 979         if (wpa_tdls_get_privacy(sm) &&
 980             (tdls_testing & TDLS_TESTING_LONG_FRAME))
 981                 buf_len += 170;
 982         if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
 983                 buf_len += sizeof(struct wpa_tdls_lnkid);
 984 #endif /* CONFIG_TDLS_TESTING */
 985         rbuf = os_zalloc(buf_len + 1);
 986         if (rbuf == NULL) {
 987                 wpa_tdls_peer_free(sm, peer);
 988                 return -1;
 989         }
 990         pos = rbuf;
 991
 992         if (!wpa_tdls_get_privacy(sm))
 993                 goto skip_ies;
 994
 995         /* Initiator RSN IE */
 996         pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
 997
 998         ftie = (struct wpa_tdls_ftie *) pos;
 999         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1000         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1001
1002         if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1003                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1004                         "TDLS: Failed to get random data for initiator Nonce");
1005                 os_free(rbuf);
1006                 wpa_tdls_peer_free(sm, peer);
1007                 return -1;
1008         }
1009         wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1010                     peer->inonce, WPA_NONCE_LEN);
1011         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1012
1013         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1014                     (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1015
1016         pos = (u8 *) (ftie + 1);
1017
1018 #ifdef CONFIG_TDLS_TESTING
1019         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1020                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1021                            "FTIE");
1022                 ftie->ie_len += 170;
1023                 *pos++ = 255; /* FTIE subelem */
1024                 *pos++ = 168; /* FTIE subelem length */
1025                 pos += 168;
1026         }
1027 #endif /* CONFIG_TDLS_TESTING */
1028
1029         /* Lifetime */
1030         peer->lifetime = TPK_LIFETIME;
1031 #ifdef CONFIG_TDLS_TESTING
1032         if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1033                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1034                            "lifetime");
1035                 peer->lifetime = 301;
1036         }
1037         if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1038                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1039                            "lifetime");
1040                 peer->lifetime = 0xffffffff;
1041         }
1042 #endif /* CONFIG_TDLS_TESTING */
1043         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1044                                      sizeof(timeoutie), peer->lifetime);
1045         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1046
1047 skip_ies:
1048
1049 #ifdef CONFIG_TDLS_TESTING
1050         if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
1051                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1052                            "Link Identifier");
1053                 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1054                 wpa_tdls_linkid(sm, peer, l);
1055                 l->bssid[5] ^= 0x01;
1056                 pos += sizeof(*l);
1057         }
1058 #endif /* CONFIG_TDLS_TESTING */
1059
1060         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1061                    "Handshake Message 1 (peer " MACSTR ")",
1062                    MAC2STR(peer->addr));
1063
1064         wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1, 0,
1065                           rbuf, pos - rbuf);
1066         os_free(rbuf);
1067
1068         return 0;
1069 }
1070
1071
1072 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1073                                 const unsigned char *src_addr, u8 dtoken,
1074                                 struct wpa_tdls_lnkid *lnkid,
1075                                 const struct wpa_tdls_peer *peer)
1076 {
1077         u8 *rbuf, *pos;
1078         size_t buf_len;
1079         u32 lifetime;
1080         struct wpa_tdls_timeoutie timeoutie;
1081         struct wpa_tdls_ftie *ftie;
1082
1083         buf_len = 0;
1084         if (wpa_tdls_get_privacy(sm)) {
1085                 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1086                  * Lifetime */
1087                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1088                         sizeof(struct wpa_tdls_timeoutie);
1089 #ifdef CONFIG_TDLS_TESTING
1090                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1091                         buf_len += 170;
1092 #endif /* CONFIG_TDLS_TESTING */
1093         }
1094
1095         rbuf = os_zalloc(buf_len + 1);
1096         if (rbuf == NULL)
1097                 return -1;
1098         pos = rbuf;
1099
1100         if (!wpa_tdls_get_privacy(sm))
1101                 goto skip_ies;
1102
1103         /* Peer RSN IE */
1104         pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1105
1106         ftie = (struct wpa_tdls_ftie *) pos;
1107         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1108         /* TODO: ftie->mic_control to set 2-RESPONSE */
1109         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1110         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1111         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1112         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1113                     (u8 *) ftie, sizeof(*ftie));
1114
1115         pos = (u8 *) (ftie + 1);
1116
1117 #ifdef CONFIG_TDLS_TESTING
1118         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1119                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1120                            "FTIE");
1121                 ftie->ie_len += 170;
1122                 *pos++ = 255; /* FTIE subelem */
1123                 *pos++ = 168; /* FTIE subelem length */
1124                 pos += 168;
1125         }
1126 #endif /* CONFIG_TDLS_TESTING */
1127
1128         /* Lifetime */
1129         lifetime = peer->lifetime;
1130 #ifdef CONFIG_TDLS_TESTING
1131         if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1132                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1133                            "lifetime in response");
1134                 lifetime++;
1135         }
1136 #endif /* CONFIG_TDLS_TESTING */
1137         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1138                                      sizeof(timeoutie), lifetime);
1139         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1140                    lifetime);
1141
1142         /* compute MIC before sending */
1143         wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,
1144                           (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1145
1146 skip_ies:
1147         wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
1148                           rbuf, pos - rbuf);
1149         os_free(rbuf);
1150
1151         return 0;
1152 }
1153
1154
1155 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1156                                 const unsigned char *src_addr, u8 dtoken,
1157                                 struct wpa_tdls_lnkid *lnkid,
1158                                 const struct wpa_tdls_peer *peer)
1159 {
1160         u8 *rbuf, *pos;
1161         size_t buf_len;
1162         struct wpa_tdls_ftie *ftie;
1163         struct wpa_tdls_timeoutie timeoutie;
1164         u32 lifetime;
1165
1166         buf_len = 0;
1167         if (wpa_tdls_get_privacy(sm)) {
1168                 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1169                  * Lifetime */
1170                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1171                         sizeof(struct wpa_tdls_timeoutie);
1172 #ifdef CONFIG_TDLS_TESTING
1173                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1174                         buf_len += 170;
1175 #endif /* CONFIG_TDLS_TESTING */
1176         }
1177
1178         rbuf = os_zalloc(buf_len + 1);
1179         if (rbuf == NULL)
1180                 return -1;
1181         pos = rbuf;
1182
1183         if (!wpa_tdls_get_privacy(sm))
1184                 goto skip_ies;
1185
1186         /* Peer RSN IE */
1187         pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1188
1189         ftie = (struct wpa_tdls_ftie *) pos;
1190         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1191         /*TODO: ftie->mic_control to set 3-CONFIRM */
1192         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1193         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1194         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1195
1196         pos = (u8 *) (ftie + 1);
1197
1198 #ifdef CONFIG_TDLS_TESTING
1199         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1200                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1201                            "FTIE");
1202                 ftie->ie_len += 170;
1203                 *pos++ = 255; /* FTIE subelem */
1204                 *pos++ = 168; /* FTIE subelem length */
1205                 pos += 168;
1206         }
1207 #endif /* CONFIG_TDLS_TESTING */
1208
1209         /* Lifetime */
1210         lifetime = peer->lifetime;
1211 #ifdef CONFIG_TDLS_TESTING
1212         if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1213                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1214                            "lifetime in confirm");
1215                 lifetime++;
1216         }
1217 #endif /* CONFIG_TDLS_TESTING */
1218         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1219                                      sizeof(timeoutie), lifetime);
1220         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1221                    lifetime);
1222
1223         /* compute MIC before sending */
1224         wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,
1225                           (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1226
1227 skip_ies:
1228         wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 0,
1229                           rbuf, pos - rbuf);
1230         os_free(rbuf);
1231
1232         return 0;
1233 }
1234
1235
1236 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1237                                             struct wpa_tdls_peer *peer,
1238                                             u8 dialog_token)
1239 {
1240         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1241                    "(peer " MACSTR ")", MAC2STR(peer->addr));
1242
1243         return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
1244                                  dialog_token, 0, NULL, 0);
1245 }
1246
1247
1248 static int
1249 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1250                                    const u8 *buf, size_t len)
1251 {
1252         struct wpa_eapol_ie_parse kde;
1253         const struct wpa_tdls_lnkid *lnkid;
1254         struct wpa_tdls_peer *peer;
1255         size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1256                 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1257         u8 dialog_token;
1258
1259         wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1260                    MAC2STR(addr));
1261
1262         if (len < min_req_len) {
1263                 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1264                            "%d", (int) len);
1265                 return -1;
1266         }
1267
1268         dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1269
1270         if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1271                                      len - (sizeof(struct wpa_tdls_frame) + 1),
1272                                      &kde) < 0)
1273                 return -1;
1274
1275         if (!kde.lnkid) {
1276                 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1277                            "Request");
1278                 return -1;
1279         }
1280
1281         lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1282
1283         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1284                 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different "
1285                            " BSS " MACSTR, MAC2STR(lnkid->bssid));
1286                 return -1;
1287         }
1288
1289         peer = wpa_tdls_add_peer(sm, addr);
1290         if (peer == NULL)
1291                 return -1;
1292
1293         return wpa_tdls_send_discovery_response(sm, peer, dialog_token);
1294 }
1295
1296
1297 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1298 {
1299         if (sm->tdls_disabled || !sm->tdls_supported)
1300                 return -1;
1301
1302         wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1303                    MACSTR, MAC2STR(addr));
1304         return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
1305                                  1, 0, NULL, 0);
1306 }
1307
1308
1309 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1310                            struct wpa_tdls_peer *peer)
1311 {
1312         if (!kde->supp_rates) {
1313                 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1314                 return -1;
1315         }
1316
1317         peer->supp_rates_len = kde->supp_rates_len - 2;
1318         if (peer->supp_rates_len > IEEE80211_MAX_SUPP_RATES)
1319                 peer->supp_rates_len = IEEE80211_MAX_SUPP_RATES;
1320         os_memcpy(peer->supp_rates, kde->supp_rates + 2, peer->supp_rates_len);
1321
1322         if (kde->ext_supp_rates) {
1323                 int clen = kde->ext_supp_rates_len - 2;
1324                 if (peer->supp_rates_len + clen > IEEE80211_MAX_SUPP_RATES)
1325                         clen = IEEE80211_MAX_SUPP_RATES - peer->supp_rates_len;
1326                 os_memcpy(peer->supp_rates + peer->supp_rates_len,
1327                           kde->ext_supp_rates + 2, clen);
1328                 peer->supp_rates_len += clen;
1329         }
1330
1331         return 0;
1332 }
1333
1334
1335 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1336                                    const u8 *buf, size_t len)
1337 {
1338         struct wpa_tdls_peer *peer;
1339         struct wpa_eapol_ie_parse kde;
1340         struct wpa_ie_data ie;
1341         int cipher;
1342         const u8 *cpos;
1343         struct wpa_tdls_ftie *ftie = NULL;
1344         struct wpa_tdls_timeoutie *timeoutie;
1345         struct wpa_tdls_lnkid *lnkid;
1346         u32 lifetime = 0;
1347 #if 0
1348         struct rsn_ie_hdr *hdr;
1349         u8 *pos;
1350         u16 rsn_capab;
1351         u16 rsn_ver;
1352 #endif
1353         u8 dtoken;
1354         u16 ielen;
1355         u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1356         int tdls_prohibited = sm->tdls_prohibited;
1357         int existing_peer = 0;
1358
1359         if (len < 3 + 3)
1360                 return -1;
1361
1362         cpos = buf;
1363         cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1364
1365         /* driver had already verified the frame format */
1366         dtoken = *cpos++; /* dialog token */
1367
1368         wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1369
1370         for (peer = sm->tdls; peer; peer = peer->next) {
1371                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) {
1372                         existing_peer = 1;
1373                         break;
1374                 }
1375         }
1376
1377         if (peer == NULL) {
1378                 peer = wpa_tdls_add_peer(sm, src_addr);
1379                 if (peer == NULL)
1380                         goto error;
1381         }
1382
1383         /* capability information */
1384         peer->capability = WPA_GET_LE16(cpos);
1385         cpos += 2;
1386
1387         ielen = len - (cpos - buf); /* start of IE in buf */
1388         if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) {
1389                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1");
1390                 goto error;
1391         }
1392
1393         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1394                 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1395                            "TPK M1");
1396                 goto error;
1397         }
1398         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
1399                     kde.lnkid, kde.lnkid_len);
1400         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1401         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1402                 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS");
1403                 status = WLAN_STATUS_NOT_IN_SAME_BSS;
1404                 goto error;
1405         }
1406
1407         wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
1408                    MAC2STR(src_addr));
1409
1410         if (copy_supp_rates(&kde, peer) < 0)
1411                 goto error;
1412
1413 #ifdef CONFIG_TDLS_TESTING
1414         if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
1415                 for (peer = sm->tdls; peer; peer = peer->next) {
1416                         if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1417                                 break;
1418                 }
1419                 if (peer == NULL) {
1420                         peer = wpa_tdls_add_peer(sm, src_addr);
1421                         if (peer == NULL)
1422                                 goto error;
1423                 }
1424                 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
1425                            "TDLS setup - send own request");
1426                 peer->initiator = 1;
1427                 wpa_tdls_send_tpk_m1(sm, peer);
1428         }
1429
1430         if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
1431             tdls_prohibited) {
1432                 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
1433                            "on TDLS");
1434                 tdls_prohibited = 0;
1435         }
1436 #endif /* CONFIG_TDLS_TESTING */
1437
1438         if (tdls_prohibited) {
1439                 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
1440                 status = WLAN_STATUS_REQUEST_DECLINED;
1441                 goto error;
1442         }
1443
1444         if (!wpa_tdls_get_privacy(sm)) {
1445                 if (kde.rsn_ie) {
1446                         wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
1447                                    "security is disabled");
1448                         status = WLAN_STATUS_SECURITY_DISABLED;
1449                         goto error;
1450                 }
1451                 goto skip_rsn;
1452         }
1453
1454         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1455             kde.rsn_ie == NULL) {
1456                 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
1457                 status = WLAN_STATUS_INVALID_PARAMETERS;
1458                 goto error;
1459         }
1460
1461         if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
1462                 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
1463                            "TPK M1");
1464                 status = WLAN_STATUS_INVALID_RSNIE;
1465                 goto error;
1466         }
1467
1468         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1469                 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
1470                 status = WLAN_STATUS_INVALID_RSNIE;
1471                 goto error;
1472         }
1473
1474         cipher = ie.pairwise_cipher;
1475         if (cipher & WPA_CIPHER_CCMP) {
1476                 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1477                 cipher = WPA_CIPHER_CCMP;
1478         } else {
1479                 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
1480                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1481                 goto error;
1482         }
1483
1484         if ((ie.capabilities &
1485              (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
1486             WPA_CAPABILITY_PEERKEY_ENABLED) {
1487                 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
1488                            "TPK M1");
1489                 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
1490                 goto error;
1491         }
1492
1493         /* Lifetime */
1494         if (kde.key_lifetime == NULL) {
1495                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
1496                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1497                 goto error;
1498         }
1499         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1500         lifetime = WPA_GET_LE32(timeoutie->value);
1501         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
1502         if (lifetime < 300) {
1503                 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
1504                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1505                 goto error;
1506         }
1507
1508 skip_rsn:
1509         /* If found, use existing entry instead of adding a new one;
1510          * how to handle the case where both ends initiate at the
1511          * same time? */
1512         if (existing_peer) {
1513                 if (peer->tpk_success) {
1514                         wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1515                                    "direct link is enabled - tear down the "
1516                                    "old link first");
1517 #if 0
1518                         /* TODO: Disabling the link would be more proper
1519                          * operation here, but it seems to trigger a race with
1520                          * some drivers handling the new request frame. */
1521                         wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
1522 #else
1523                         wpa_tdls_del_key(sm, peer);
1524 #endif
1525                         wpa_tdls_peer_free(sm, peer);
1526                 }
1527
1528                 /*
1529                  * An entry is already present, so check if we already sent a
1530                  * TDLS Setup Request. If so, compare MAC addresses and let the
1531                  * STA with the lower MAC address continue as the initiator.
1532                  * The other negotiation is terminated.
1533                  */
1534                 if (peer->initiator) {
1535                         if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
1536                                 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
1537                                            "from peer with higher address "
1538                                            MACSTR, MAC2STR(src_addr));
1539                                 return -1;
1540                         } else {
1541                                 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
1542                                            "from peer with lower address "
1543                                            MACSTR " (terminate previously "
1544                                            "initiated negotiation",
1545                                            MAC2STR(src_addr));
1546                                 wpa_tdls_peer_free(sm, peer);
1547                         }
1548                 }
1549         }
1550
1551         peer->initiator = 0; /* Need to check */
1552         peer->dtoken = dtoken;
1553
1554         if (!wpa_tdls_get_privacy(sm)) {
1555                 peer->rsnie_i_len = 0;
1556                 peer->rsnie_p_len = 0;
1557                 peer->cipher = WPA_CIPHER_NONE;
1558                 goto skip_rsn_check;
1559         }
1560
1561         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1562         os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
1563         os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
1564         peer->rsnie_i_len = kde.rsn_ie_len;
1565         peer->cipher = cipher;
1566
1567         if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
1568                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
1569                         "TDLS: Failed to get random data for responder nonce");
1570                 wpa_tdls_peer_free(sm, peer);
1571                 goto error;
1572         }
1573
1574 #if 0
1575         /* get version info from RSNIE received from Peer */
1576         hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
1577         rsn_ver = WPA_GET_LE16(hdr->version);
1578
1579         /* use min(peer's version, out version) */
1580         if (rsn_ver > RSN_VERSION)
1581                 rsn_ver = RSN_VERSION;
1582
1583         hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
1584
1585         hdr->elem_id = WLAN_EID_RSN;
1586         WPA_PUT_LE16(hdr->version, rsn_ver);
1587         pos = (u8 *) (hdr + 1);
1588
1589         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1590         pos += RSN_SELECTOR_LEN;
1591         /* Include only the selected cipher in pairwise cipher suite */
1592         WPA_PUT_LE16(pos, 1);
1593         pos += 2;
1594         if (cipher == WPA_CIPHER_CCMP)
1595                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1596         pos += RSN_SELECTOR_LEN;
1597
1598         WPA_PUT_LE16(pos, 1);
1599         pos += 2;
1600         RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1601         pos += RSN_SELECTOR_LEN;
1602
1603         rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1604         rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1605         WPA_PUT_LE16(pos, rsn_capab);
1606         pos += 2;
1607
1608         hdr->len = (pos - peer->rsnie_p) - 2;
1609         peer->rsnie_p_len = pos - peer->rsnie_p;
1610 #endif
1611
1612         /* temp fix: validation of RSNIE later */
1613         os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
1614         peer->rsnie_p_len = peer->rsnie_i_len;
1615
1616         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1617                     peer->rsnie_p, peer->rsnie_p_len);
1618
1619         peer->lifetime = lifetime;
1620
1621         wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
1622
1623 skip_rsn_check:
1624         /* add the peer to the driver as a "setup in progress" peer */
1625         wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0);
1626
1627         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
1628         if (wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer) < 0) {
1629                 wpa_tdls_disable_link(sm, peer->addr);
1630                 goto error;
1631         }
1632
1633         return 0;
1634
1635 error:
1636         wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken,
1637                             status);
1638         return -1;
1639 }
1640
1641
1642 static void wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
1643 {
1644         peer->tpk_success = 1;
1645         eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
1646         if (wpa_tdls_get_privacy(sm)) {
1647                 u32 lifetime = peer->lifetime;
1648                 /*
1649                  * Start the initiator process a bit earlier to avoid race
1650                  * condition with the responder sending teardown request.
1651                  */
1652                 if (lifetime > 3 && peer->initiator)
1653                         lifetime -= 3;
1654                 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
1655                                        sm, peer);
1656 #ifdef CONFIG_TDLS_TESTING
1657         if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
1658                 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK "
1659                            "expiration");
1660                 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
1661         }
1662 #endif /* CONFIG_TDLS_TESTING */
1663         }
1664
1665         /* add supported rates and capabilities to the TDLS peer */
1666         wpa_sm_tdls_peer_addset(sm, peer->addr, 0, peer->capability,
1667                                 peer->supp_rates, peer->supp_rates_len);
1668
1669         wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
1670 }
1671
1672
1673 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
1674                                    const u8 *buf, size_t len)
1675 {
1676         struct wpa_tdls_peer *peer;
1677         struct wpa_eapol_ie_parse kde;
1678         struct wpa_ie_data ie;
1679         int cipher;
1680         struct wpa_tdls_ftie *ftie;
1681         struct wpa_tdls_timeoutie *timeoutie;
1682         struct wpa_tdls_lnkid *lnkid;
1683         u32 lifetime;
1684         u8 dtoken;
1685         int ielen;
1686         u16 status;
1687         const u8 *pos;
1688
1689         wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
1690                    "(Peer " MACSTR ")", MAC2STR(src_addr));
1691         for (peer = sm->tdls; peer; peer = peer->next) {
1692                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1693                         break;
1694         }
1695         if (peer == NULL) {
1696                 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
1697                            "TPK M2: " MACSTR, MAC2STR(src_addr));
1698                 return -1;
1699         }
1700         wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
1701
1702         if (len < 3 + 2 + 1)
1703                 return -1;
1704         pos = buf;
1705         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1706         status = WPA_GET_LE16(pos);
1707         pos += 2 /* status code */;
1708
1709         if (status != WLAN_STATUS_SUCCESS) {
1710                 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
1711                            status);
1712                 return -1;
1713         }
1714
1715         status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1716
1717         /* TODO: need to verify dialog token matches here or in kernel */
1718         dtoken = *pos++; /* dialog token */
1719
1720         wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
1721
1722         if (len < 3 + 2 + 1 + 2)
1723                 return -1;
1724
1725         /* capability information */
1726         peer->capability = WPA_GET_LE16(pos);
1727         pos += 2;
1728
1729         ielen = len - (pos - buf); /* start of IE in buf */
1730         if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) {
1731                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2");
1732                 goto error;
1733         }
1734
1735 #ifdef CONFIG_TDLS_TESTING
1736         if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
1737                 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
1738                 status = WLAN_STATUS_REQUEST_DECLINED;
1739                 goto error;
1740         }
1741 #endif /* CONFIG_TDLS_TESTING */
1742
1743         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1744                 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1745                            "TPK M2");
1746                 goto error;
1747         }
1748         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
1749                     kde.lnkid, kde.lnkid_len);
1750         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1751
1752         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1753                 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
1754                 status = WLAN_STATUS_NOT_IN_SAME_BSS;
1755                 goto error;
1756         }
1757
1758         if (copy_supp_rates(&kde, peer) < 0)
1759                 goto error;
1760
1761         if (!wpa_tdls_get_privacy(sm)) {
1762                 peer->rsnie_p_len = 0;
1763                 peer->cipher = WPA_CIPHER_NONE;
1764                 goto skip_rsn;
1765         }
1766
1767         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1768             kde.rsn_ie == NULL) {
1769                 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
1770                 status = WLAN_STATUS_INVALID_PARAMETERS;
1771                 goto error;
1772         }
1773         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
1774                     kde.rsn_ie, kde.rsn_ie_len);
1775
1776         /*
1777          * FIX: bitwise comparison of RSN IE is not the correct way of
1778          * validation this. It can be different, but certain fields must
1779          * match. Since we list only a single pairwise cipher in TPK M1, the
1780          * memcmp is likely to work in most cases, though.
1781          */
1782         if (kde.rsn_ie_len != peer->rsnie_i_len ||
1783             os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
1784                 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
1785                            "not match with RSN IE used in TPK M1");
1786                 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
1787                             peer->rsnie_i, peer->rsnie_i_len);
1788                 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
1789                             kde.rsn_ie, kde.rsn_ie_len);
1790                 status = WLAN_STATUS_INVALID_RSNIE;
1791                 goto error;
1792         }
1793
1794         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1795                 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
1796                 status = WLAN_STATUS_INVALID_RSNIE;
1797                 goto error;
1798         }
1799
1800         cipher = ie.pairwise_cipher;
1801         if (cipher == WPA_CIPHER_CCMP) {
1802                 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1803                 cipher = WPA_CIPHER_CCMP;
1804         } else {
1805                 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
1806                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1807                 goto error;
1808         }
1809
1810         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
1811                     kde.ftie, sizeof(*ftie));
1812         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1813
1814         if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
1815                 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
1816                            "not match with FTIE SNonce used in TPK M1");
1817                 /* Silently discard the frame */
1818                 return -1;
1819         }
1820
1821         /* Responder Nonce and RSN IE */
1822         os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
1823         os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
1824         peer->rsnie_p_len = kde.rsn_ie_len;
1825         peer->cipher = cipher;
1826
1827         /* Lifetime */
1828         if (kde.key_lifetime == NULL) {
1829                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
1830                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1831                 goto error;
1832         }
1833         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1834         lifetime = WPA_GET_LE32(timeoutie->value);
1835         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
1836                    lifetime);
1837         if (lifetime != peer->lifetime) {
1838                 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
1839                            "TPK M2 (expected %u)", lifetime, peer->lifetime);
1840                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1841                 goto error;
1842         }
1843
1844         wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
1845
1846         /* Process MIC check to see if TPK M2 is right */
1847         if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,
1848                                            (u8 *) timeoutie, ftie) < 0) {
1849                 /* Discard the frame */
1850                 wpa_tdls_del_key(sm, peer);
1851                 wpa_tdls_peer_free(sm, peer);
1852                 return -1;
1853         }
1854
1855         wpa_tdls_set_key(sm, peer);
1856
1857 skip_rsn:
1858         peer->dtoken = dtoken;
1859
1860         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
1861                    "TPK Handshake Message 3");
1862         wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer);
1863
1864         wpa_tdls_enable_link(sm, peer);
1865
1866         return 0;
1867
1868 error:
1869         wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken,
1870                             status);
1871         return -1;
1872 }
1873
1874
1875 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
1876                                    const u8 *buf, size_t len)
1877 {
1878         struct wpa_tdls_peer *peer;
1879         struct wpa_eapol_ie_parse kde;
1880         struct wpa_tdls_ftie *ftie;
1881         struct wpa_tdls_timeoutie *timeoutie;
1882         struct wpa_tdls_lnkid *lnkid;
1883         int ielen;
1884         u16 status;
1885         const u8 *pos;
1886         u32 lifetime;
1887
1888         wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
1889                    "(Peer " MACSTR ")", MAC2STR(src_addr));
1890         for (peer = sm->tdls; peer; peer = peer->next) {
1891                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1892                         break;
1893         }
1894         if (peer == NULL) {
1895                 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
1896                            "TPK M3: " MACSTR, MAC2STR(src_addr));
1897                 return -1;
1898         }
1899         wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
1900
1901         if (len < 3 + 3)
1902                 return -1;
1903         pos = buf;
1904         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1905
1906         status = WPA_GET_LE16(pos);
1907
1908         if (status != 0) {
1909                 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
1910                            status);
1911                 return -1;
1912         }
1913         pos += 2 /* status code */ + 1 /* dialog token */;
1914
1915         ielen = len - (pos - buf); /* start of IE in buf */
1916         if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
1917                 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3");
1918                 return -1;
1919         }
1920
1921         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1922                 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
1923                 return -1;
1924         }
1925         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
1926                     (u8 *) kde.lnkid, kde.lnkid_len);
1927         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1928
1929         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1930                 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
1931                 return -1;
1932         }
1933
1934         if (!wpa_tdls_get_privacy(sm))
1935                 goto skip_rsn;
1936
1937         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
1938                 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
1939                 return -1;
1940         }
1941         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
1942                     kde.ftie, sizeof(*ftie));
1943         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1944
1945         if (kde.rsn_ie == NULL) {
1946                 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
1947                 return -1;
1948         }
1949         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
1950                     kde.rsn_ie, kde.rsn_ie_len);
1951         if (kde.rsn_ie_len != peer->rsnie_p_len ||
1952             os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
1953                 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
1954                            "with the one sent in TPK M2");
1955                 return -1;
1956         }
1957
1958         if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) {
1959                 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
1960                            "not match with FTIE ANonce used in TPK M2");
1961                 return -1;
1962         }
1963
1964         if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
1965                 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
1966                            "match with FTIE SNonce used in TPK M1");
1967                 return -1;
1968         }
1969
1970         if (kde.key_lifetime == NULL) {
1971                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
1972                 return -1;
1973         }
1974         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1975         wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
1976                     (u8 *) timeoutie, sizeof(*timeoutie));
1977         lifetime = WPA_GET_LE32(timeoutie->value);
1978         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
1979                    lifetime);
1980         if (lifetime != peer->lifetime) {
1981                 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
1982                            "TPK M3 (expected %u)", lifetime, peer->lifetime);
1983                 return -1;
1984         }
1985
1986         if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,
1987                                            (u8 *) timeoutie, ftie) < 0) {
1988                 wpa_tdls_del_key(sm, peer);
1989                 wpa_tdls_peer_free(sm, peer);
1990                 return -1;
1991         }
1992
1993         if (wpa_tdls_set_key(sm, peer) < 0)
1994                 return -1;
1995
1996 skip_rsn:
1997         wpa_tdls_enable_link(sm, peer);
1998
1999         return 0;
2000 }
2001
2002
2003 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
2004 {
2005         struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
2006
2007         os_memset(lifetime, 0, ie_len);
2008         lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2009         lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2010         lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2011         WPA_PUT_LE32(lifetime->value, tsecs);
2012         os_memcpy(pos, ie, ie_len);
2013         return pos + ie_len;
2014 }
2015
2016
2017 /**
2018  * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2019  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2020  * @peer: MAC address of the peer STA
2021  * Returns: 0 on success, or -1 on failure
2022  *
2023  * Send TPK Handshake Message 1 info to driver to start TDLS
2024  * handshake with the peer.
2025  */
2026 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2027 {
2028         struct wpa_tdls_peer *peer;
2029         int tdls_prohibited = sm->tdls_prohibited;
2030
2031         if (sm->tdls_disabled || !sm->tdls_supported)
2032                 return -1;
2033
2034 #ifdef CONFIG_TDLS_TESTING
2035         if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2036             tdls_prohibited) {
2037                 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2038                            "on TDLS");
2039                 tdls_prohibited = 0;
2040         }
2041 #endif /* CONFIG_TDLS_TESTING */
2042
2043         if (tdls_prohibited) {
2044                 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2045                            "reject request to start setup");
2046                 return -1;
2047         }
2048
2049         /* Find existing entry and if found, use that instead of adding
2050          * a new one */
2051         for (peer = sm->tdls; peer; peer = peer->next) {
2052                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2053                         break;
2054         }
2055
2056         if (peer == NULL) {
2057                 peer = wpa_tdls_add_peer(sm, addr);
2058                 if (peer == NULL)
2059                         return -1;
2060         }
2061
2062         peer->initiator = 1;
2063
2064         /* add the peer to the driver as a "setup in progress" peer */
2065         wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, NULL, 0);
2066
2067         if (wpa_tdls_send_tpk_m1(sm, peer) < 0) {
2068                 wpa_tdls_disable_link(sm, peer->addr);
2069                 return -1;
2070         }
2071
2072         return 0;
2073 }
2074
2075
2076 int wpa_tdls_reneg(struct wpa_sm *sm, const u8 *addr)
2077 {
2078         struct wpa_tdls_peer *peer;
2079
2080         if (sm->tdls_disabled || !sm->tdls_supported)
2081                 return -1;
2082
2083         for (peer = sm->tdls; peer; peer = peer->next) {
2084                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2085                         break;
2086         }
2087
2088         if (peer == NULL || !peer->tpk_success)
2089                 return -1;
2090
2091         return wpa_tdls_start(sm, addr);
2092 }
2093
2094
2095 /**
2096  * wpa_supplicant_rx_tdls - Receive TDLS data frame
2097  *
2098  * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2099  */
2100 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2101                                    const u8 *buf, size_t len)
2102 {
2103         struct wpa_sm *sm = ctx;
2104         struct wpa_tdls_frame *tf;
2105
2106         wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2107                     buf, len);
2108
2109         if (sm->tdls_disabled || !sm->tdls_supported) {
2110                 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2111                            "or unsupported by driver");
2112                 return;
2113         }
2114
2115         if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) {
2116                 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2117                 return;
2118         }
2119
2120         if (len < sizeof(*tf)) {
2121                 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2122                 return;
2123         }
2124
2125         /* Check to make sure its a valid encapsulated TDLS frame */
2126         tf = (struct wpa_tdls_frame *) buf;
2127         if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2128             tf->category != WLAN_ACTION_TDLS) {
2129                 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2130                            "category=%u action=%u",
2131                            tf->payloadtype, tf->category, tf->action);
2132                 return;
2133         }
2134
2135         switch (tf->action) {
2136         case WLAN_TDLS_SETUP_REQUEST:
2137                 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2138                 break;
2139         case WLAN_TDLS_SETUP_RESPONSE:
2140                 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2141                 break;
2142         case WLAN_TDLS_SETUP_CONFIRM:
2143                 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2144                 break;
2145         case WLAN_TDLS_TEARDOWN:
2146                 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2147                 break;
2148         case WLAN_TDLS_DISCOVERY_REQUEST:
2149                 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2150                 break;
2151         default:
2152                 /* Kernel code will process remaining frames */
2153                 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2154                            tf->action);
2155                 break;
2156         }
2157 }
2158
2159
2160 /**
2161  * wpa_tdls_init - Initialize driver interface parameters for TDLS
2162  * @wpa_s: Pointer to wpa_supplicant data
2163  * Returns: 0 on success, -1 on failure
2164  *
2165  * This function is called to initialize driver interface parameters for TDLS.
2166  * wpa_drv_init() must have been called before this function to initialize the
2167  * driver interface.
2168  */
2169 int wpa_tdls_init(struct wpa_sm *sm)
2170 {
2171         if (sm == NULL)
2172                 return -1;
2173
2174         sm->l2_tdls = l2_packet_init(sm->ifname, sm->own_addr,
2175                                      ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
2176                                      sm, 0);
2177         if (sm->l2_tdls == NULL) {
2178                 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
2179                            "connection");
2180                 return -1;
2181         }
2182
2183         /*
2184          * Drivers that support TDLS but don't implement the get_capa callback
2185          * are assumed to perform everything internally
2186          */
2187         if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
2188                                  &sm->tdls_external_setup) < 0) {
2189                 sm->tdls_supported = 1;
2190                 sm->tdls_external_setup = 0;
2191         }
2192
2193         wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
2194                    "driver", sm->tdls_supported ? "" : " not");
2195         wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
2196                    sm->tdls_external_setup ? "external" : "internal");
2197
2198         return 0;
2199 }
2200
2201
2202 static void wpa_tdls_remove_peers(struct wpa_sm *sm)
2203 {
2204         struct wpa_tdls_peer *peer, *tmp;
2205
2206         peer = sm->tdls;
2207         sm->tdls = NULL;
2208
2209         while (peer) {
2210                 int res;
2211                 tmp = peer->next;
2212                 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2213                 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
2214                            MAC2STR(peer->addr), res);
2215                 wpa_tdls_peer_free(sm, peer);
2216                 os_free(peer);
2217                 peer = tmp;
2218         }
2219 }
2220
2221
2222 /**
2223  * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
2224  *
2225  * This function is called to recover driver interface parameters for TDLS
2226  * and frees resources allocated for it.
2227  */
2228 void wpa_tdls_deinit(struct wpa_sm *sm)
2229 {
2230         if (sm == NULL)
2231                 return;
2232
2233         if (sm->l2_tdls)
2234                 l2_packet_deinit(sm->l2_tdls);
2235         sm->l2_tdls = NULL;
2236
2237         wpa_tdls_remove_peers(sm);
2238 }
2239
2240
2241 void wpa_tdls_assoc(struct wpa_sm *sm)
2242 {
2243         wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
2244         wpa_tdls_remove_peers(sm);
2245 }
2246
2247
2248 void wpa_tdls_disassoc(struct wpa_sm *sm)
2249 {
2250         wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
2251         wpa_tdls_remove_peers(sm);
2252 }
2253
2254
2255 static int wpa_tdls_prohibited(const u8 *ies, size_t len)
2256 {
2257         struct wpa_eapol_ie_parse elems;
2258
2259         if (ies == NULL)
2260                 return 0;
2261
2262         if (wpa_supplicant_parse_ies(ies, len, &elems) < 0)
2263                 return 0;
2264
2265         if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5)
2266                 return 0;
2267
2268          /* bit 38 - TDLS Prohibited */
2269         return !!(elems.ext_capab[2 + 4] & 0x40);
2270 }
2271
2272
2273 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2274 {
2275         sm->tdls_prohibited = wpa_tdls_prohibited(ies, len);
2276         wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
2277                    sm->tdls_prohibited ? "prohibited" : "allowed");
2278 }
2279
2280
2281 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2282 {
2283         if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) {
2284                 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
2285                            "(Re)Association Response IEs");
2286                 sm->tdls_prohibited = 1;
2287         }
2288 }
2289
2290
2291 void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
2292 {
2293         wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
2294         sm->tdls_disabled = !enabled;
2295 }
2296
2297
2298 int wpa_tdls_is_external_setup(struct wpa_sm *sm)
2299 {
2300         return sm->tdls_external_setup;
2301 }