src/rsn_supp/tdls.c

   1 /*
   2  * wpa_supplicant - TDLS
   3  * Copyright (c) 2010-2011, Atheros Communications
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License version 2 as
   7  * published by the Free Software Foundation.
   8  *
   9  * Alternatively, this software may be distributed under the terms of BSD
  10  * license.
  11  *
  12  * See README and COPYING for more details.
  13  */
  14
  15 #include "utils/includes.h"
  16
  17 #include "utils/common.h"
  18 #include "utils/eloop.h"
  19 #include "utils/os.h"
  20 #include "common/ieee802_11_defs.h"
  21 #include "crypto/sha256.h"
  22 #include "crypto/crypto.h"
  23 #include "crypto/aes_wrap.h"
  24 #include "rsn_supp/wpa.h"
  25 #include "rsn_supp/wpa_ie.h"
  26 #include "rsn_supp/wpa_i.h"
  27 #include "drivers/driver.h"
  28 #include "l2_packet/l2_packet.h"
  29
  30 #ifdef CONFIG_TDLS_TESTING
  31 #define TDLS_TESTING_LONG_FRAME BIT(0)
  32 #define TDLS_TESTING_ALT_RSN_IE BIT(1)
  33 #define TDLS_TESTING_DIFF_BSSID BIT(2)
  34 #define TDLS_TESTING_SHORT_LIFETIME BIT(3)
  35 #define TDLS_TESTING_WRONG_LIFETIME_RESP BIT(4)
  36 #define TDLS_TESTING_WRONG_LIFETIME_CONF BIT(5)
  37 #define TDLS_TESTING_LONG_LIFETIME BIT(6)
  38 #define TDLS_TESTING_CONCURRENT_INIT BIT(7)
  39 #define TDLS_TESTING_NO_TPK_EXPIRATION BIT(8)
  40 #define TDLS_TESTING_DECLINE_RESP BIT(9)
  41 #define TDLS_TESTING_IGNORE_AP_PROHIBIT BIT(10)
  42 unsigned int tdls_testing = 0;
  43 #endif /* CONFIG_TDLS_TESTING */
  44
  45 #define TPK_LIFETIME 43200 /* 12 hours */
  46 #define TPK_RETRY_COUNT 3
  47 #define TPK_TIMEOUT 5000 /* in milliseconds */
  48
  49 #define TDLS_MIC_LEN            16
  50
  51 #define TDLS_TIMEOUT_LEN        4
  52
  53 struct wpa_tdls_ftie {
  54         u8 ie_type; /* FTIE */
  55         u8 ie_len;
  56         u8 mic_ctrl[2];
  57         u8 mic[TDLS_MIC_LEN];
  58         u8 Anonce[WPA_NONCE_LEN]; /* Responder Nonce in TDLS */
  59         u8 Snonce[WPA_NONCE_LEN]; /* Initiator Nonce in TDLS */
  60         /* followed by optional elements */
  61 } STRUCT_PACKED;
  62
  63 struct wpa_tdls_timeoutie {
  64         u8 ie_type; /* Timeout IE */
  65         u8 ie_len;
  66         u8 interval_type;
  67         u8 value[TDLS_TIMEOUT_LEN];
  68 } STRUCT_PACKED;
  69
  70 struct wpa_tdls_lnkid {
  71         u8 ie_type; /* Link Identifier IE */
  72         u8 ie_len;
  73         u8 bssid[ETH_ALEN];
  74         u8 init_sta[ETH_ALEN];
  75         u8 resp_sta[ETH_ALEN];
  76 } STRUCT_PACKED;
  77
  78 /* TDLS frame headers as per IEEE Std 802.11z-2010 */
  79 struct wpa_tdls_frame {
  80         u8 payloadtype; /* IEEE80211_TDLS_RFTYPE */
  81         u8 category; /* Category */
  82         u8 action; /* Action (enum tdls_frame_type) */
  83 } STRUCT_PACKED;
  84
  85 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs);
  86 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx);
  87 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer);
  88
  89
  90 #define TDLS_MAX_IE_LEN 80
  91 #define IEEE80211_MAX_SUPP_RATES 32
  92
  93 struct wpa_tdls_peer {
  94         struct wpa_tdls_peer *next;
  95         int initiator; /* whether this end was initiator for TDLS setup */
  96         u8 addr[ETH_ALEN]; /* other end MAC address */
  97         u8 inonce[WPA_NONCE_LEN]; /* Initiator Nonce */
  98         u8 rnonce[WPA_NONCE_LEN]; /* Responder Nonce */
  99         u8 rsnie_i[TDLS_MAX_IE_LEN]; /* Initiator RSN IE */
 100         size_t rsnie_i_len;
 101         u8 rsnie_p[TDLS_MAX_IE_LEN]; /* Peer RSN IE */
 102         size_t rsnie_p_len;
 103         u32 lifetime;
 104         int cipher; /* Selected cipher (WPA_CIPHER_*) */
 105         u8 dtoken;
 106
 107         struct tpk {
 108                 u8 kck[16]; /* TPK-KCK */
 109                 u8 tk[16]; /* TPK-TK; assuming only CCMP will be used */
 110         } tpk;
 111         int tpk_set;
 112         int tpk_success;
 113
 114         struct tpk_timer {
 115                 u8 dest[ETH_ALEN];
 116                 int count;      /* Retry Count */
 117                 int timer;      /* Timeout in milliseconds */
 118                 u8 action_code; /* TDLS frame type */
 119                 u8 dialog_token;
 120                 u16 status_code;
 121                 int buf_len;    /* length of TPK message for retransmission */
 122                 u8 *buf;        /* buffer for TPK message */
 123         } sm_tmr;
 124
 125         u16 capability;
 126
 127         u8 supp_rates[IEEE80211_MAX_SUPP_RATES];
 128         size_t supp_rates_len;
 129 };
 130
 131
 132 static int wpa_tdls_get_privacy(struct wpa_sm *sm)
 133 {
 134         /*
 135          * Get info needed from supplicant to check if the current BSS supports
 136          * security. Other than OPEN mode, rest are considered secured
 137          * WEP/WPA/WPA2 hence TDLS frames are processed for TPK handshake.
 138          */
 139         return sm->pairwise_cipher != WPA_CIPHER_NONE;
 140 }
 141
 142
 143 static u8 * wpa_add_ie(u8 *pos, const u8 *ie, size_t ie_len)
 144 {
 145         os_memcpy(pos, ie, ie_len);
 146         return pos + ie_len;
 147 }
 148
 149
 150 static int wpa_tdls_del_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 151 {
 152         if (wpa_sm_set_key(sm, WPA_ALG_NONE, peer->addr,
 153                            0, 0, NULL, 0, NULL, 0) < 0) {
 154                 wpa_printf(MSG_WARNING, "TDLS: Failed to delete TPK-TK from "
 155                            "the driver");
 156                 return -1;
 157         }
 158
 159         return 0;
 160 }
 161
 162
 163 static int wpa_tdls_set_key(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 164 {
 165         u8 key_len;
 166         u8 rsc[6];
 167         enum wpa_alg alg;
 168
 169         os_memset(rsc, 0, 6);
 170
 171         switch (peer->cipher) {
 172         case WPA_CIPHER_CCMP:
 173                 alg = WPA_ALG_CCMP;
 174                 key_len = 16;
 175                 break;
 176         case WPA_CIPHER_NONE:
 177                 wpa_printf(MSG_DEBUG, "TDLS: Pairwise Cipher Suite: "
 178                            "NONE - do not use pairwise keys");
 179                 return -1;
 180         default:
 181                 wpa_printf(MSG_WARNING, "TDLS: Unsupported pairwise cipher %d",
 182                            sm->pairwise_cipher);
 183                 return -1;
 184         }
 185
 186         if (wpa_sm_set_key(sm, alg, peer->addr, -1, 1,
 187                            rsc, sizeof(rsc), peer->tpk.tk, key_len) < 0) {
 188                 wpa_printf(MSG_WARNING, "TDLS: Failed to set TPK to the "
 189                            "driver");
 190                 return -1;
 191         }
 192         return 0;
 193 }
 194
 195
 196 static int wpa_tdls_send_tpk_msg(struct wpa_sm *sm, const u8 *dst,
 197                                  u8 action_code, u8 dialog_token,
 198                                  u16 status_code, const u8 *buf, size_t len)
 199 {
 200         return wpa_sm_send_tdls_mgmt(sm, dst, action_code, dialog_token,
 201                                      status_code, buf, len);
 202 }
 203
 204
 205 static int wpa_tdls_tpk_send(struct wpa_sm *sm, const u8 *dest, u8 action_code,
 206                              u8 dialog_token, u16 status_code,
 207                              const u8 *msg, size_t msg_len)
 208 {
 209         struct wpa_tdls_peer *peer;
 210
 211         wpa_printf(MSG_DEBUG, "TDLS: TPK send dest=" MACSTR " action_code=%u "
 212                    "dialog_token=%u status_code=%u msg_len=%u",
 213                    MAC2STR(dest), action_code, dialog_token, status_code,
 214                    (unsigned int) msg_len);
 215
 216         if (wpa_tdls_send_tpk_msg(sm, dest, action_code, dialog_token,
 217                                   status_code, msg, msg_len)) {
 218                 wpa_printf(MSG_INFO, "TDLS: Failed to send message "
 219                            "(action_code=%u)", action_code);
 220                 return -1;
 221         }
 222
 223         if (action_code == WLAN_TDLS_SETUP_CONFIRM ||
 224             action_code == WLAN_TDLS_TEARDOWN ||
 225             action_code == WLAN_TDLS_DISCOVERY_REQUEST ||
 226             action_code == WLAN_TDLS_DISCOVERY_RESPONSE)
 227                 return 0; /* No retries */
 228
 229         for (peer = sm->tdls; peer; peer = peer->next) {
 230                 if (os_memcmp(peer->addr, dest, ETH_ALEN) == 0)
 231                         break;
 232         }
 233
 234         if (peer == NULL) {
 235                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 236                            "retry " MACSTR, MAC2STR(dest));
 237                 return 0;
 238         }
 239
 240         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 241
 242         peer->sm_tmr.count = TPK_RETRY_COUNT;
 243         peer->sm_tmr.timer = TPK_TIMEOUT;
 244
 245         /* Copy message to resend on timeout */
 246         os_memcpy(peer->sm_tmr.dest, dest, ETH_ALEN);
 247         peer->sm_tmr.action_code = action_code;
 248         peer->sm_tmr.dialog_token = dialog_token;
 249         peer->sm_tmr.status_code = status_code;
 250         peer->sm_tmr.buf_len = msg_len;
 251         os_free(peer->sm_tmr.buf);
 252         peer->sm_tmr.buf = os_malloc(msg_len);
 253         if (peer->sm_tmr.buf == NULL)
 254                 return -1;
 255         os_memcpy(peer->sm_tmr.buf, msg, msg_len);
 256
 257         wpa_printf(MSG_DEBUG, "TDLS: Retry timeout registered "
 258                    "(action_code=%u)", action_code);
 259         eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
 260                                wpa_tdls_tpk_retry_timeout, sm, peer);
 261         return 0;
 262 }
 263
 264
 265 static int wpa_tdls_do_teardown(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
 266                                 u16 reason_code)
 267 {
 268         int ret;
 269
 270         if (sm->tdls_external_setup) {
 271                 ret = wpa_tdls_send_teardown(sm, peer->addr, reason_code);
 272
 273                 /* disable the link after teardown was sent */
 274                 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
 275         } else {
 276                 ret = wpa_sm_tdls_oper(sm, TDLS_TEARDOWN, peer->addr);
 277         }
 278
 279         wpa_tdls_peer_free(sm, peer);
 280
 281         return ret;
 282 }
 283
 284
 285 static void wpa_tdls_tpk_retry_timeout(void *eloop_ctx, void *timeout_ctx)
 286 {
 287
 288         struct wpa_sm *sm = eloop_ctx;
 289         struct wpa_tdls_peer *peer = timeout_ctx;
 290
 291         if (peer->sm_tmr.count) {
 292                 peer->sm_tmr.count--;
 293                 peer->sm_tmr.timer = TPK_TIMEOUT;
 294
 295                 wpa_printf(MSG_INFO, "TDLS: Retrying sending of message "
 296                            "(action_code=%u)",
 297                            peer->sm_tmr.action_code);
 298
 299                 if (peer->sm_tmr.buf == NULL) {
 300                         wpa_printf(MSG_INFO, "TDLS: No retry buffer available "
 301                                    "for action_code=%u",
 302                                    peer->sm_tmr.action_code);
 303                         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm,
 304                                              peer);
 305                         return;
 306                 }
 307
 308                 /* resend TPK Handshake Message to Peer */
 309                 if (wpa_tdls_send_tpk_msg(sm, peer->sm_tmr.dest,
 310                                           peer->sm_tmr.action_code,
 311                                           peer->sm_tmr.dialog_token,
 312                                           peer->sm_tmr.status_code,
 313                                           peer->sm_tmr.buf,
 314                                           peer->sm_tmr.buf_len)) {
 315                         wpa_printf(MSG_INFO, "TDLS: Failed to retry "
 316                                    "transmission");
 317                 }
 318
 319                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 320                 eloop_register_timeout(peer->sm_tmr.timer / 1000, 0,
 321                                        wpa_tdls_tpk_retry_timeout, sm, peer);
 322         } else {
 323                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 324
 325                 wpa_printf(MSG_DEBUG, "TDLS: Sending Teardown Request");
 326                 wpa_tdls_do_teardown(sm, peer,
 327                                      WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 328         }
 329 }
 330
 331
 332 static void wpa_tdls_tpk_retry_timeout_cancel(struct wpa_sm *sm,
 333                                               struct wpa_tdls_peer *peer,
 334                                               u8 action_code)
 335 {
 336         if (action_code == peer->sm_tmr.action_code) {
 337                 wpa_printf(MSG_DEBUG, "TDLS: Retry timeout cancelled for "
 338                            "action_code=%u", action_code);
 339
 340                 /* Cancel Timeout registered */
 341                 eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 342
 343                 /* free all resources meant for retry */
 344                 os_free(peer->sm_tmr.buf);
 345                 peer->sm_tmr.buf = NULL;
 346
 347                 peer->sm_tmr.count = 0;
 348                 peer->sm_tmr.timer = 0;
 349                 peer->sm_tmr.buf_len = 0;
 350                 peer->sm_tmr.action_code = 0xff;
 351         } else {
 352                 wpa_printf(MSG_INFO, "TDLS: Error in cancelling retry timeout "
 353                            "(Unknown action_code=%u)", action_code);
 354         }
 355 }
 356
 357
 358 static void wpa_tdls_generate_tpk(struct wpa_tdls_peer *peer,
 359                                   const u8 *own_addr, const u8 *bssid)
 360 {
 361         u8 key_input[SHA256_MAC_LEN];
 362         const u8 *nonce[2];
 363         size_t len[2];
 364         u8 data[3 * ETH_ALEN];
 365
 366         /* IEEE Std 802.11z-2010 8.5.9.1:
 367          * TPK-Key-Input = SHA-256(min(SNonce, ANonce) || max(SNonce, ANonce))
 368          */
 369         len[0] = WPA_NONCE_LEN;
 370         len[1] = WPA_NONCE_LEN;
 371         if (os_memcmp(peer->inonce, peer->rnonce, WPA_NONCE_LEN) < 0) {
 372                 nonce[0] = peer->inonce;
 373                 nonce[1] = peer->rnonce;
 374         } else {
 375                 nonce[0] = peer->rnonce;
 376                 nonce[1] = peer->inonce;
 377         }
 378         wpa_hexdump(MSG_DEBUG, "TDLS: min(Nonce)", nonce[0], WPA_NONCE_LEN);
 379         wpa_hexdump(MSG_DEBUG, "TDLS: max(Nonce)", nonce[1], WPA_NONCE_LEN);
 380         sha256_vector(2, nonce, len, key_input);
 381         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-Key-Input",
 382                         key_input, SHA256_MAC_LEN);
 383
 384         /*
 385          * TPK-Key-Data = KDF-N_KEY(TPK-Key-Input, "TDLS PMK",
 386          *      min(MAC_I, MAC_R) || max(MAC_I, MAC_R) || BSSID || N_KEY)
 387          * TODO: is N_KEY really included in KDF Context and if so, in which
 388          * presentation format (little endian 16-bit?) is it used? It gets
 389          * added by the KDF anyway..
 390          */
 391
 392         if (os_memcmp(own_addr, peer->addr, ETH_ALEN) < 0) {
 393                 os_memcpy(data, own_addr, ETH_ALEN);
 394                 os_memcpy(data + ETH_ALEN, peer->addr, ETH_ALEN);
 395         } else {
 396                 os_memcpy(data, peer->addr, ETH_ALEN);
 397                 os_memcpy(data + ETH_ALEN, own_addr, ETH_ALEN);
 398         }
 399         os_memcpy(data + 2 * ETH_ALEN, bssid, ETH_ALEN);
 400         wpa_hexdump(MSG_DEBUG, "TDLS: KDF Context", data, sizeof(data));
 401
 402         sha256_prf(key_input, SHA256_MAC_LEN, "TDLS PMK", data, sizeof(data),
 403                    (u8 *) &peer->tpk, sizeof(peer->tpk));
 404         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-KCK",
 405                         peer->tpk.kck, sizeof(peer->tpk.kck));
 406         wpa_hexdump_key(MSG_DEBUG, "TDLS: TPK-TK",
 407                         peer->tpk.tk, sizeof(peer->tpk.tk));
 408         peer->tpk_set = 1;
 409 }
 410
 411
 412 /**
 413  * wpa_tdls_ftie_mic - Calculate TDLS FTIE MIC
 414  * @kck: TPK-KCK
 415  * @lnkid: Pointer to the beginning of Link Identifier IE
 416  * @rsnie: Pointer to the beginning of RSN IE used for handshake
 417  * @timeoutie: Pointer to the beginning of Timeout IE used for handshake
 418  * @ftie: Pointer to the beginning of FT IE
 419  * @mic: Pointer for writing MIC
 420  *
 421  * Calculate MIC for TDLS frame.
 422  */
 423 static int wpa_tdls_ftie_mic(const u8 *kck, u8 trans_seq, const u8 *lnkid,
 424                              const u8 *rsnie, const u8 *timeoutie,
 425                              const u8 *ftie, u8 *mic)
 426 {
 427         u8 *buf, *pos;
 428         struct wpa_tdls_ftie *_ftie;
 429         const struct wpa_tdls_lnkid *_lnkid;
 430         int ret;
 431         int len = 2 * ETH_ALEN + 1 + 2 + lnkid[1] + 2 + rsnie[1] +
 432                 2 + timeoutie[1] + 2 + ftie[1];
 433         buf = os_zalloc(len);
 434         if (!buf) {
 435                 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
 436                 return -1;
 437         }
 438
 439         pos = buf;
 440         _lnkid = (const struct wpa_tdls_lnkid *) lnkid;
 441         /* 1) TDLS initiator STA MAC address */
 442         os_memcpy(pos, _lnkid->init_sta, ETH_ALEN);
 443         pos += ETH_ALEN;
 444         /* 2) TDLS responder STA MAC address */
 445         os_memcpy(pos, _lnkid->resp_sta, ETH_ALEN);
 446         pos += ETH_ALEN;
 447         /* 3) Transaction Sequence number */
 448         *pos++ = trans_seq;
 449         /* 4) Link Identifier IE */
 450         os_memcpy(pos, lnkid, 2 + lnkid[1]);
 451         pos += 2 + lnkid[1];
 452         /* 5) RSN IE */
 453         os_memcpy(pos, rsnie, 2 + rsnie[1]);
 454         pos += 2 + rsnie[1];
 455         /* 6) Timeout Interval IE */
 456         os_memcpy(pos, timeoutie, 2 + timeoutie[1]);
 457         pos += 2 + timeoutie[1];
 458         /* 7) FTIE, with the MIC field of the FTIE set to 0 */
 459         os_memcpy(pos, ftie, 2 + ftie[1]);
 460         _ftie = (struct wpa_tdls_ftie *) pos;
 461         os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
 462         pos += 2 + ftie[1];
 463
 464         wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
 465         wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
 466         ret = omac1_aes_128(kck, buf, pos - buf, mic);
 467         os_free(buf);
 468         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
 469         return ret;
 470 }
 471
 472
 473 /**
 474  * wpa_tdls_key_mic_teardown - Calculate TDLS FTIE MIC for Teardown frame
 475  * @kck: TPK-KCK
 476  * @trans_seq: Transaction Sequence Number (4 - Teardown)
 477  * @rcode: Reason code for Teardown
 478  * @dtoken: Dialog Token used for that particular link
 479  * @lnkid: Pointer to the beginning of Link Identifier IE
 480  * @ftie: Pointer to the beginning of FT IE
 481  * @mic: Pointer for writing MIC
 482  *
 483  * Calculate MIC for TDLS frame.
 484  */
 485 static int wpa_tdls_key_mic_teardown(const u8 *kck, u8 trans_seq, u16 rcode,
 486                                      u8 dtoken, const u8 *lnkid,
 487                                      const u8 *ftie, u8 *mic)
 488 {
 489         u8 *buf, *pos;
 490         struct wpa_tdls_ftie *_ftie;
 491         int ret;
 492         int len;
 493
 494         if (lnkid == NULL)
 495                 return -1;
 496
 497         len = 2 + lnkid[1] + sizeof(rcode) + sizeof(dtoken) +
 498                 sizeof(trans_seq) + 2 + ftie[1];
 499
 500         buf = os_zalloc(len);
 501         if (!buf) {
 502                 wpa_printf(MSG_WARNING, "TDLS: No memory for MIC calculation");
 503                 return -1;
 504         }
 505
 506         pos = buf;
 507         /* 1) Link Identifier IE */
 508         os_memcpy(pos, lnkid, 2 + lnkid[1]);
 509         pos += 2 + lnkid[1];
 510         /* 2) Reason Code */
 511         WPA_PUT_LE16(pos, rcode);
 512         pos += sizeof(rcode);
 513         /* 3) Dialog token */
 514         *pos++ = dtoken;
 515         /* 4) Transaction Sequence number */
 516         *pos++ = trans_seq;
 517         /* 7) FTIE, with the MIC field of the FTIE set to 0 */
 518         os_memcpy(pos, ftie, 2 + ftie[1]);
 519         _ftie = (struct wpa_tdls_ftie *) pos;
 520         os_memset(_ftie->mic, 0, TDLS_MIC_LEN);
 521         pos += 2 + ftie[1];
 522
 523         wpa_hexdump(MSG_DEBUG, "TDLS: Data for FTIE MIC", buf, pos - buf);
 524         wpa_hexdump_key(MSG_DEBUG, "TDLS: KCK", kck, 16);
 525         ret = omac1_aes_128(kck, buf, pos - buf, mic);
 526         os_free(buf);
 527         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE MIC", mic, 16);
 528         return ret;
 529 }
 530
 531
 532 static int wpa_supplicant_verify_tdls_mic(u8 trans_seq,
 533                                           struct wpa_tdls_peer *peer,
 534                                           const u8 *lnkid, const u8 *timeoutie,
 535                                           const struct wpa_tdls_ftie *ftie)
 536 {
 537         u8 mic[16];
 538
 539         if (peer->tpk_set) {
 540                 wpa_tdls_ftie_mic(peer->tpk.kck, trans_seq, lnkid,
 541                                   peer->rsnie_p, timeoutie, (u8 *) ftie,
 542                                   mic);
 543                 if (os_memcmp(mic, ftie->mic, 16) != 0) {
 544                         wpa_printf(MSG_INFO, "TDLS: Invalid MIC in FTIE - "
 545                                    "dropping packet");
 546                         wpa_hexdump(MSG_DEBUG, "TDLS: Received MIC",
 547                                     ftie->mic, 16);
 548                         wpa_hexdump(MSG_DEBUG, "TDLS: Calculated MIC",
 549                                     mic, 16);
 550                         return -1;
 551                 }
 552         } else {
 553                 wpa_printf(MSG_WARNING, "TDLS: Could not verify TDLS MIC, "
 554                            "TPK not set - dropping packet");
 555                 return -1;
 556         }
 557         return 0;
 558 }
 559
 560
 561 static int wpa_supplicant_verify_tdls_mic_teardown(
 562         u8 trans_seq, u16 rcode, u8 dtoken, struct wpa_tdls_peer *peer,
 563         const u8 *lnkid, const struct wpa_tdls_ftie *ftie)
 564 {
 565         u8 mic[16];
 566
 567         if (peer->tpk_set) {
 568                 wpa_tdls_key_mic_teardown(peer->tpk.kck, trans_seq, rcode,
 569                                           dtoken, lnkid, (u8 *) ftie, mic);
 570                 if (os_memcmp(mic, ftie->mic, 16) != 0) {
 571                         wpa_printf(MSG_INFO, "TDLS: Invalid MIC in Teardown - "
 572                                    "dropping packet");
 573                         return -1;
 574                 }
 575         } else {
 576                 wpa_printf(MSG_INFO, "TDLS: Could not verify TDLS Teardown "
 577                            "MIC, TPK not set - dropping packet");
 578                 return -1;
 579         }
 580         return 0;
 581 }
 582
 583
 584 static void wpa_tdls_tpk_timeout(void *eloop_ctx, void *timeout_ctx)
 585 {
 586         struct wpa_sm *sm = eloop_ctx;
 587         struct wpa_tdls_peer *peer = timeout_ctx;
 588
 589         /*
 590          * On TPK lifetime expiration, we have an option of either tearing down
 591          * the direct link or trying to re-initiate it. The selection of what
 592          * to do is not strictly speaking controlled by our role in the expired
 593          * link, but for now, use that to select whether to renew or tear down
 594          * the link.
 595          */
 596
 597         if (peer->initiator) {
 598                 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
 599                            " - try to renew", MAC2STR(peer->addr));
 600                 wpa_tdls_start(sm, peer->addr);
 601         } else {
 602                 wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime expired for " MACSTR
 603                            " - tear down", MAC2STR(peer->addr));
 604                 wpa_tdls_do_teardown(sm, peer,
 605                                      WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED);
 606         }
 607 }
 608
 609
 610 static void wpa_tdls_peer_free(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
 611 {
 612         wpa_printf(MSG_DEBUG, "TDLS: Clear state for peer " MACSTR,
 613                    MAC2STR(peer->addr));
 614         eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
 615         eloop_cancel_timeout(wpa_tdls_tpk_retry_timeout, sm, peer);
 616         peer->initiator = 0;
 617         os_free(peer->sm_tmr.buf);
 618         peer->sm_tmr.buf = NULL;
 619         peer->rsnie_i_len = peer->rsnie_p_len = 0;
 620         peer->cipher = 0;
 621         peer->tpk_set = peer->tpk_success = 0;
 622         os_memset(&peer->tpk, 0, sizeof(peer->tpk));
 623         os_memset(peer->inonce, 0, WPA_NONCE_LEN);
 624         os_memset(peer->rnonce, 0, WPA_NONCE_LEN);
 625 }
 626
 627
 628 static void wpa_tdls_linkid(struct wpa_sm *sm, struct wpa_tdls_peer *peer,
 629                             struct wpa_tdls_lnkid *lnkid)
 630 {
 631         lnkid->ie_type = WLAN_EID_LINK_ID;
 632         lnkid->ie_len = 3 * ETH_ALEN;
 633         os_memcpy(lnkid->bssid, sm->bssid, ETH_ALEN);
 634         if (peer->initiator) {
 635                 os_memcpy(lnkid->init_sta, sm->own_addr, ETH_ALEN);
 636                 os_memcpy(lnkid->resp_sta, peer->addr, ETH_ALEN);
 637         } else {
 638                 os_memcpy(lnkid->init_sta, peer->addr, ETH_ALEN);
 639                 os_memcpy(lnkid->resp_sta, sm->own_addr, ETH_ALEN);
 640         }
 641 }
 642
 643
 644 int wpa_tdls_send_teardown(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
 645 {
 646         struct wpa_tdls_peer *peer;
 647         struct wpa_tdls_ftie *ftie;
 648         struct wpa_tdls_lnkid lnkid;
 649         u8 dialog_token;
 650         u8 *rbuf, *pos;
 651         int ielen;
 652
 653         if (sm->tdls_disabled || !sm->tdls_supported)
 654                 return -1;
 655
 656         /* Find the node and free from the list */
 657         for (peer = sm->tdls; peer; peer = peer->next) {
 658                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 659                         break;
 660         }
 661
 662         if (peer == NULL) {
 663                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 664                            "Teardown " MACSTR, MAC2STR(addr));
 665                 return 0;
 666         }
 667
 668         dialog_token = peer->dtoken;
 669
 670         wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown for " MACSTR,
 671                    MAC2STR(addr));
 672
 673         ielen = 0;
 674         if (wpa_tdls_get_privacy(sm) && peer->tpk_set && peer->tpk_success) {
 675                 /* To add FTIE for Teardown request and compute MIC */
 676                 ielen += sizeof(*ftie);
 677 #ifdef CONFIG_TDLS_TESTING
 678                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
 679                         ielen += 170;
 680 #endif /* CONFIG_TDLS_TESTING */
 681         }
 682
 683         rbuf = os_zalloc(ielen + 1);
 684         if (rbuf == NULL)
 685                 return -1;
 686         pos = rbuf;
 687
 688         if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
 689                 goto skip_ies;
 690
 691         ftie = (struct wpa_tdls_ftie *) pos;
 692         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
 693         /* Using the recent nonce which should be for CONFIRM frame */
 694         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
 695         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
 696         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
 697         pos = (u8 *) (ftie + 1);
 698 #ifdef CONFIG_TDLS_TESTING
 699         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
 700                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
 701                            "FTIE");
 702                 ftie->ie_len += 170;
 703                 *pos++ = 255; /* FTIE subelem */
 704                 *pos++ = 168; /* FTIE subelem length */
 705         }
 706 #endif /* CONFIG_TDLS_TESTING */
 707         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TDLS Teardown handshake",
 708                     (u8 *) ftie, sizeof(*ftie));
 709
 710         /* compute MIC before sending */
 711         wpa_tdls_linkid(sm, peer, &lnkid);
 712         wpa_tdls_key_mic_teardown(peer->tpk.kck, 4, reason_code,
 713                                   dialog_token, (u8 *) &lnkid, (u8 *) ftie,
 714                                   ftie->mic);
 715
 716 skip_ies:
 717         /* TODO: register for a Timeout handler, if Teardown is not received at
 718          * the other end, then try again another time */
 719
 720         /* request driver to send Teardown using this FTIE */
 721         wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_TEARDOWN, 0,
 722                           WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED, rbuf,
 723                           pos - rbuf);
 724         os_free(rbuf);
 725
 726         /* clear the Peerkey statemachine */
 727         wpa_tdls_peer_free(sm, peer);
 728
 729         return 0;
 730 }
 731
 732
 733 int wpa_tdls_teardown_link(struct wpa_sm *sm, const u8 *addr, u16 reason_code)
 734 {
 735         struct wpa_tdls_peer *peer;
 736
 737         if (sm->tdls_disabled || !sm->tdls_supported)
 738                 return -1;
 739
 740         for (peer = sm->tdls; peer; peer = peer->next) {
 741                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 742                         break;
 743         }
 744
 745         if (peer == NULL) {
 746                 wpa_printf(MSG_DEBUG, "TDLS: Could not find peer " MACSTR
 747                    " for link Teardown", MAC2STR(addr));
 748                 return -1;
 749         }
 750
 751         if (!peer->tpk_success) {
 752                 wpa_printf(MSG_DEBUG, "TDLS: Peer " MACSTR
 753                    " not connected - cannot Teardown link", MAC2STR(addr));
 754                 return -1;
 755         }
 756
 757         return wpa_tdls_do_teardown(sm, peer, reason_code);
 758 }
 759
 760
 761 void wpa_tdls_disable_link(struct wpa_sm *sm, const u8 *addr)
 762 {
 763         struct wpa_tdls_peer *peer;
 764
 765         for (peer = sm->tdls; peer; peer = peer->next) {
 766                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
 767                         break;
 768         }
 769
 770         if (peer) {
 771                 wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, addr);
 772                 wpa_tdls_peer_free(sm, peer);
 773         }
 774 }
 775
 776
 777 static int wpa_tdls_recv_teardown(struct wpa_sm *sm, const u8 *src_addr,
 778                                   const u8 *buf, size_t len)
 779 {
 780         struct wpa_tdls_peer *peer = NULL;
 781         struct wpa_tdls_ftie *ftie;
 782         struct wpa_tdls_lnkid *lnkid;
 783         struct wpa_eapol_ie_parse kde;
 784         u16 reason_code;
 785         const u8 *pos;
 786         int ielen;
 787
 788         /* Find the node and free from the list */
 789         for (peer = sm->tdls; peer; peer = peer->next) {
 790                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
 791                         break;
 792         }
 793
 794         if (peer == NULL) {
 795                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
 796                            "Teardown " MACSTR, MAC2STR(src_addr));
 797                 return 0;
 798         }
 799
 800         pos = buf;
 801         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
 802
 803         reason_code = WPA_GET_LE16(pos);
 804         pos += 2;
 805
 806         wpa_printf(MSG_DEBUG, "TDLS: TDLS Teardown Request from " MACSTR
 807                    " (reason code %u)", MAC2STR(src_addr), reason_code);
 808
 809         ielen = len - (pos - buf); /* start of IE in buf */
 810         if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
 811                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in Teardown");
 812                 return -1;
 813         }
 814
 815         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
 816                 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TDLS "
 817                            "Teardown");
 818                 return -1;
 819         }
 820         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
 821
 822         if (!wpa_tdls_get_privacy(sm) || !peer->tpk_set || !peer->tpk_success)
 823                 goto skip_ftie;
 824
 825         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
 826                 wpa_printf(MSG_INFO, "TDLS: No FTIE in TDLS Teardown");
 827                 return -1;
 828         }
 829
 830         ftie = (struct wpa_tdls_ftie *) kde.ftie;
 831
 832         /* Process MIC check to see if TDLS Teardown is right */
 833         if (wpa_supplicant_verify_tdls_mic_teardown(4, reason_code,
 834                                                     peer->dtoken, peer,
 835                                                     (u8 *) lnkid, ftie) < 0) {
 836                 wpa_printf(MSG_DEBUG, "TDLS: MIC failure for TDLS "
 837                            "Teardown Request from " MACSTR, MAC2STR(src_addr));
 838                 return -1;
 839         }
 840
 841 skip_ftie:
 842         /*
 843          * Request the driver to disable the direct link and clear associated
 844          * keys.
 845          */
 846         wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
 847
 848         /* clear the Peerkey statemachine */
 849         wpa_tdls_peer_free(sm, peer);
 850
 851         return 0;
 852 }
 853
 854
 855 /**
 856  * wpa_tdls_send_error - To send suitable TDLS status response with
 857  *      appropriate status code mentioning reason for error/failure.
 858  * @dst         - MAC addr of Peer station
 859  * @tdls_action - TDLS frame type for which error code is sent
 860  * @status      - status code mentioning reason
 861  */
 862
 863 static int wpa_tdls_send_error(struct wpa_sm *sm, const u8 *dst,
 864                                u8 tdls_action, u8 dialog_token, u16 status)
 865 {
 866         wpa_printf(MSG_DEBUG, "TDLS: Sending error to " MACSTR
 867                    " (action=%u status=%u)",
 868                    MAC2STR(dst), tdls_action, status);
 869         return wpa_tdls_tpk_send(sm, dst, tdls_action, dialog_token, status,
 870                                  NULL, 0);
 871 }
 872
 873
 874 static struct wpa_tdls_peer *
 875 wpa_tdls_add_peer(struct wpa_sm *sm, const u8 *addr)
 876 {
 877         struct wpa_tdls_peer *peer;
 878
 879         wpa_printf(MSG_INFO, "TDLS: Creating peer entry for " MACSTR,
 880                    MAC2STR(addr));
 881
 882         peer = os_zalloc(sizeof(*peer));
 883         if (peer == NULL)
 884                 return NULL;
 885
 886         os_memcpy(peer->addr, addr, ETH_ALEN);
 887         peer->next = sm->tdls;
 888         sm->tdls = peer;
 889
 890         return peer;
 891 }
 892
 893
 894 static int wpa_tdls_send_tpk_m1(struct wpa_sm *sm,
 895                                 struct wpa_tdls_peer *peer)
 896 {
 897         size_t buf_len;
 898         struct wpa_tdls_timeoutie timeoutie;
 899         u16 rsn_capab;
 900         struct wpa_tdls_ftie *ftie;
 901         u8 *rbuf, *pos, *count_pos;
 902         u16 count;
 903         struct rsn_ie_hdr *hdr;
 904
 905         if (!wpa_tdls_get_privacy(sm)) {
 906                 wpa_printf(MSG_DEBUG, "TDLS: No security used on the link");
 907                 peer->rsnie_i_len = 0;
 908                 goto skip_rsnie;
 909         }
 910
 911         /*
 912          * TPK Handshake Message 1:
 913          * FTIE: ANonce=0, SNonce=initiator nonce MIC=0, DataKDs=(RSNIE_I,
 914          * Timeout Interval IE))
 915          */
 916
 917         /* Filling RSN IE */
 918         hdr = (struct rsn_ie_hdr *) peer->rsnie_i;
 919         hdr->elem_id = WLAN_EID_RSN;
 920         WPA_PUT_LE16(hdr->version, RSN_VERSION);
 921
 922         pos = (u8 *) (hdr + 1);
 923         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
 924         pos += RSN_SELECTOR_LEN;
 925         count_pos = pos;
 926         pos += 2;
 927
 928         count = 0;
 929
 930         /*
 931          * AES-CCMP is the default Encryption preferred for TDLS, so
 932          * RSN IE is filled only with CCMP CIPHER
 933          * Note: TKIP is not used to encrypt TDLS link.
 934          *
 935          * Regardless of the cipher used on the AP connection, select CCMP
 936          * here.
 937          */
 938         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
 939         pos += RSN_SELECTOR_LEN;
 940         count++;
 941
 942         WPA_PUT_LE16(count_pos, count);
 943
 944         WPA_PUT_LE16(pos, 1);
 945         pos += 2;
 946         RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
 947         pos += RSN_SELECTOR_LEN;
 948
 949         rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
 950         rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
 951 #ifdef CONFIG_TDLS_TESTING
 952         if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
 953                 wpa_printf(MSG_DEBUG, "TDLS: Use alternative RSN IE for "
 954                            "testing");
 955                 rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
 956         }
 957 #endif /* CONFIG_TDLS_TESTING */
 958         WPA_PUT_LE16(pos, rsn_capab);
 959         pos += 2;
 960 #ifdef CONFIG_TDLS_TESTING
 961         if (tdls_testing & TDLS_TESTING_ALT_RSN_IE) {
 962                 /* Number of PMKIDs */
 963                 *pos++ = 0x00;
 964                 *pos++ = 0x00;
 965         }
 966 #endif /* CONFIG_TDLS_TESTING */
 967
 968         hdr->len = (pos - peer->rsnie_i) - 2;
 969         peer->rsnie_i_len = pos - peer->rsnie_i;
 970         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
 971                     peer->rsnie_i, peer->rsnie_i_len);
 972
 973 skip_rsnie:
 974         buf_len = 0;
 975         if (wpa_tdls_get_privacy(sm))
 976                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
 977                         sizeof(struct wpa_tdls_timeoutie);
 978 #ifdef CONFIG_TDLS_TESTING
 979         if (wpa_tdls_get_privacy(sm) &&
 980             (tdls_testing & TDLS_TESTING_LONG_FRAME))
 981                 buf_len += 170;
 982         if (tdls_testing & TDLS_TESTING_DIFF_BSSID)
 983                 buf_len += sizeof(struct wpa_tdls_lnkid);
 984 #endif /* CONFIG_TDLS_TESTING */
 985         rbuf = os_zalloc(buf_len + 1);
 986         if (rbuf == NULL) {
 987                 wpa_tdls_peer_free(sm, peer);
 988                 return -1;
 989         }
 990         pos = rbuf;
 991
 992         if (!wpa_tdls_get_privacy(sm))
 993                 goto skip_ies;
 994
 995         /* Initiator RSN IE */
 996         pos = wpa_add_ie(pos, peer->rsnie_i, peer->rsnie_i_len);
 997
 998         ftie = (struct wpa_tdls_ftie *) pos;
 999         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1000         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1001
1002         if (os_get_random(peer->inonce, WPA_NONCE_LEN)) {
1003                 wpa_msg(sm->ctx->msg_ctx, MSG_WARNING,
1004                         "TDLS: Failed to get random data for initiator Nonce");
1005                 os_free(rbuf);
1006                 wpa_tdls_peer_free(sm, peer);
1007                 return -1;
1008         }
1009         wpa_hexdump(MSG_DEBUG, "TDLS: Initiator Nonce for TPK handshake",
1010                     peer->inonce, WPA_NONCE_LEN);
1011         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1012
1013         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK Handshake M1",
1014                     (u8 *) ftie, sizeof(struct wpa_tdls_ftie));
1015
1016         pos = (u8 *) (ftie + 1);
1017
1018 #ifdef CONFIG_TDLS_TESTING
1019         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1020                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1021                            "FTIE");
1022                 ftie->ie_len += 170;
1023                 *pos++ = 255; /* FTIE subelem */
1024                 *pos++ = 168; /* FTIE subelem length */
1025                 pos += 168;
1026         }
1027 #endif /* CONFIG_TDLS_TESTING */
1028
1029         /* Lifetime */
1030         peer->lifetime = TPK_LIFETIME;
1031 #ifdef CONFIG_TDLS_TESTING
1032         if (tdls_testing & TDLS_TESTING_SHORT_LIFETIME) {
1033                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use short TPK "
1034                            "lifetime");
1035                 peer->lifetime = 301;
1036         }
1037         if (tdls_testing & TDLS_TESTING_LONG_LIFETIME) {
1038                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use long TPK "
1039                            "lifetime");
1040                 peer->lifetime = 0xffffffff;
1041         }
1042 #endif /* CONFIG_TDLS_TESTING */
1043         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1044                                      sizeof(timeoutie), peer->lifetime);
1045         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", peer->lifetime);
1046
1047 skip_ies:
1048
1049 #ifdef CONFIG_TDLS_TESTING
1050         if (tdls_testing & TDLS_TESTING_DIFF_BSSID) {
1051                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use incorrect BSSID in "
1052                            "Link Identifier");
1053                 struct wpa_tdls_lnkid *l = (struct wpa_tdls_lnkid *) pos;
1054                 wpa_tdls_linkid(sm, peer, l);
1055                 l->bssid[5] ^= 0x01;
1056                 pos += sizeof(*l);
1057         }
1058 #endif /* CONFIG_TDLS_TESTING */
1059
1060         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Request / TPK "
1061                    "Handshake Message 1 (peer " MACSTR ")",
1062                    MAC2STR(peer->addr));
1063
1064         wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_SETUP_REQUEST, 1, 0,
1065                           rbuf, pos - rbuf);
1066         os_free(rbuf);
1067
1068         return 0;
1069 }
1070
1071
1072 static int wpa_tdls_send_tpk_m2(struct wpa_sm *sm,
1073                                 const unsigned char *src_addr, u8 dtoken,
1074                                 struct wpa_tdls_lnkid *lnkid,
1075                                 const struct wpa_tdls_peer *peer)
1076 {
1077         u8 *rbuf, *pos;
1078         size_t buf_len;
1079         u32 lifetime;
1080         struct wpa_tdls_timeoutie timeoutie;
1081         struct wpa_tdls_ftie *ftie;
1082
1083         buf_len = 0;
1084         if (wpa_tdls_get_privacy(sm)) {
1085                 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1086                  * Lifetime */
1087                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1088                         sizeof(struct wpa_tdls_timeoutie);
1089 #ifdef CONFIG_TDLS_TESTING
1090                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1091                         buf_len += 170;
1092 #endif /* CONFIG_TDLS_TESTING */
1093         }
1094
1095         rbuf = os_zalloc(buf_len + 1);
1096         if (rbuf == NULL)
1097                 return -1;
1098         pos = rbuf;
1099
1100         if (!wpa_tdls_get_privacy(sm))
1101                 goto skip_ies;
1102
1103         /* Peer RSN IE */
1104         pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1105
1106         ftie = (struct wpa_tdls_ftie *) pos;
1107         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1108         /* TODO: ftie->mic_control to set 2-RESPONSE */
1109         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1110         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1111         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1112         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE for TPK M2",
1113                     (u8 *) ftie, sizeof(*ftie));
1114
1115         pos = (u8 *) (ftie + 1);
1116
1117 #ifdef CONFIG_TDLS_TESTING
1118         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1119                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1120                            "FTIE");
1121                 ftie->ie_len += 170;
1122                 *pos++ = 255; /* FTIE subelem */
1123                 *pos++ = 168; /* FTIE subelem length */
1124                 pos += 168;
1125         }
1126 #endif /* CONFIG_TDLS_TESTING */
1127
1128         /* Lifetime */
1129         lifetime = peer->lifetime;
1130 #ifdef CONFIG_TDLS_TESTING
1131         if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_RESP) {
1132                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1133                            "lifetime in response");
1134                 lifetime++;
1135         }
1136 #endif /* CONFIG_TDLS_TESTING */
1137         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1138                                      sizeof(timeoutie), lifetime);
1139         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds from initiator",
1140                    lifetime);
1141
1142         /* compute MIC before sending */
1143         wpa_tdls_ftie_mic(peer->tpk.kck, 2, (u8 *) lnkid, peer->rsnie_p,
1144                           (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1145
1146 skip_ies:
1147         wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken, 0,
1148                           rbuf, pos - rbuf);
1149         os_free(rbuf);
1150
1151         return 0;
1152 }
1153
1154
1155 static int wpa_tdls_send_tpk_m3(struct wpa_sm *sm,
1156                                 const unsigned char *src_addr, u8 dtoken,
1157                                 struct wpa_tdls_lnkid *lnkid,
1158                                 const struct wpa_tdls_peer *peer)
1159 {
1160         u8 *rbuf, *pos;
1161         size_t buf_len;
1162         struct wpa_tdls_ftie *ftie;
1163         struct wpa_tdls_timeoutie timeoutie;
1164         u32 lifetime;
1165
1166         buf_len = 0;
1167         if (wpa_tdls_get_privacy(sm)) {
1168                 /* Peer RSN IE, FTIE(Initiator Nonce, Responder Nonce),
1169                  * Lifetime */
1170                 buf_len += peer->rsnie_i_len + sizeof(struct wpa_tdls_ftie) +
1171                         sizeof(struct wpa_tdls_timeoutie);
1172 #ifdef CONFIG_TDLS_TESTING
1173                 if (tdls_testing & TDLS_TESTING_LONG_FRAME)
1174                         buf_len += 170;
1175 #endif /* CONFIG_TDLS_TESTING */
1176         }
1177
1178         rbuf = os_zalloc(buf_len + 1);
1179         if (rbuf == NULL)
1180                 return -1;
1181         pos = rbuf;
1182
1183         if (!wpa_tdls_get_privacy(sm))
1184                 goto skip_ies;
1185
1186         /* Peer RSN IE */
1187         pos = wpa_add_ie(pos, peer->rsnie_p, peer->rsnie_p_len);
1188
1189         ftie = (struct wpa_tdls_ftie *) pos;
1190         ftie->ie_type = WLAN_EID_FAST_BSS_TRANSITION;
1191         /*TODO: ftie->mic_control to set 3-CONFIRM */
1192         os_memcpy(ftie->Anonce, peer->rnonce, WPA_NONCE_LEN);
1193         os_memcpy(ftie->Snonce, peer->inonce, WPA_NONCE_LEN);
1194         ftie->ie_len = sizeof(struct wpa_tdls_ftie) - 2;
1195
1196         pos = (u8 *) (ftie + 1);
1197
1198 #ifdef CONFIG_TDLS_TESTING
1199         if (tdls_testing & TDLS_TESTING_LONG_FRAME) {
1200                 wpa_printf(MSG_DEBUG, "TDLS: Testing - add extra subelem to "
1201                            "FTIE");
1202                 ftie->ie_len += 170;
1203                 *pos++ = 255; /* FTIE subelem */
1204                 *pos++ = 168; /* FTIE subelem length */
1205                 pos += 168;
1206         }
1207 #endif /* CONFIG_TDLS_TESTING */
1208
1209         /* Lifetime */
1210         lifetime = peer->lifetime;
1211 #ifdef CONFIG_TDLS_TESTING
1212         if (tdls_testing & TDLS_TESTING_WRONG_LIFETIME_CONF) {
1213                 wpa_printf(MSG_DEBUG, "TDLS: Testing - use wrong TPK "
1214                            "lifetime in confirm");
1215                 lifetime++;
1216         }
1217 #endif /* CONFIG_TDLS_TESTING */
1218         pos = wpa_add_tdls_timeoutie(pos, (u8 *) &timeoutie,
1219                                      sizeof(timeoutie), lifetime);
1220         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds",
1221                    lifetime);
1222
1223         /* compute MIC before sending */
1224         wpa_tdls_ftie_mic(peer->tpk.kck, 3, (u8 *) lnkid, peer->rsnie_p,
1225                           (u8 *) &timeoutie, (u8 *) ftie, ftie->mic);
1226
1227 skip_ies:
1228         wpa_tdls_tpk_send(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken, 0,
1229                           rbuf, pos - rbuf);
1230         os_free(rbuf);
1231
1232         return 0;
1233 }
1234
1235
1236 static int wpa_tdls_send_discovery_response(struct wpa_sm *sm,
1237                                             struct wpa_tdls_peer *peer,
1238                                             u8 dialog_token)
1239 {
1240         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Discovery Response "
1241                    "(peer " MACSTR ")", MAC2STR(peer->addr));
1242
1243         return wpa_tdls_tpk_send(sm, peer->addr, WLAN_TDLS_DISCOVERY_RESPONSE,
1244                                  dialog_token, 0, NULL, 0);
1245 }
1246
1247
1248 static int
1249 wpa_tdls_process_discovery_request(struct wpa_sm *sm, const u8 *addr,
1250                                    const u8 *buf, size_t len)
1251 {
1252         struct wpa_eapol_ie_parse kde;
1253         const struct wpa_tdls_lnkid *lnkid;
1254         struct wpa_tdls_peer *peer;
1255         size_t min_req_len = sizeof(struct wpa_tdls_frame) +
1256                 1 /* dialog token */ + sizeof(struct wpa_tdls_lnkid);
1257         u8 dialog_token;
1258
1259         wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from " MACSTR,
1260                    MAC2STR(addr));
1261
1262         if (len < min_req_len) {
1263                 wpa_printf(MSG_DEBUG, "TDLS Discovery Request is too short: "
1264                            "%d", (int) len);
1265                 return -1;
1266         }
1267
1268         dialog_token = buf[sizeof(struct wpa_tdls_frame)];
1269
1270         if (wpa_supplicant_parse_ies(buf + sizeof(struct wpa_tdls_frame) + 1,
1271                                      len - (sizeof(struct wpa_tdls_frame) + 1),
1272                                      &kde) < 0)
1273                 return -1;
1274
1275         if (!kde.lnkid) {
1276                 wpa_printf(MSG_DEBUG, "TDLS: Link ID not found in Discovery "
1277                            "Request");
1278                 return -1;
1279         }
1280
1281         lnkid = (const struct wpa_tdls_lnkid *) kde.lnkid;
1282
1283         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1284                 wpa_printf(MSG_DEBUG, "TDLS: Discovery Request from different "
1285                            " BSS " MACSTR, MAC2STR(lnkid->bssid));
1286                 return -1;
1287         }
1288
1289         peer = wpa_tdls_add_peer(sm, addr);
1290         if (peer == NULL)
1291                 return -1;
1292
1293         return wpa_tdls_send_discovery_response(sm, peer, dialog_token);
1294 }
1295
1296
1297 int wpa_tdls_send_discovery_request(struct wpa_sm *sm, const u8 *addr)
1298 {
1299         if (sm->tdls_disabled || !sm->tdls_supported)
1300                 return -1;
1301
1302         wpa_printf(MSG_DEBUG, "TDLS: Sending Discovery Request to peer "
1303                    MACSTR, MAC2STR(addr));
1304         return wpa_tdls_tpk_send(sm, addr, WLAN_TDLS_DISCOVERY_REQUEST,
1305                                  1, 0, NULL, 0);
1306 }
1307
1308
1309 static int copy_supp_rates(const struct wpa_eapol_ie_parse *kde,
1310                            struct wpa_tdls_peer *peer)
1311 {
1312         if (!kde->supp_rates) {
1313                 wpa_printf(MSG_DEBUG, "TDLS: No supported rates received");
1314                 return -1;
1315         }
1316
1317         peer->supp_rates_len = kde->supp_rates_len - 2;
1318         if (peer->supp_rates_len > IEEE80211_MAX_SUPP_RATES)
1319                 peer->supp_rates_len = IEEE80211_MAX_SUPP_RATES;
1320         os_memcpy(peer->supp_rates, kde->supp_rates + 2, peer->supp_rates_len);
1321
1322         if (kde->ext_supp_rates) {
1323                 int clen = kde->ext_supp_rates_len - 2;
1324                 if (peer->supp_rates_len + clen > IEEE80211_MAX_SUPP_RATES)
1325                         clen = IEEE80211_MAX_SUPP_RATES - peer->supp_rates_len;
1326                 os_memcpy(peer->supp_rates + peer->supp_rates_len,
1327                           kde->ext_supp_rates + 2, clen);
1328                 peer->supp_rates_len += clen;
1329         }
1330
1331         return 0;
1332 }
1333
1334
1335 static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
1336                                    const u8 *buf, size_t len)
1337 {
1338         struct wpa_tdls_peer *peer;
1339         struct wpa_eapol_ie_parse kde;
1340         struct wpa_ie_data ie;
1341         int cipher;
1342         const u8 *cpos;
1343         struct wpa_tdls_ftie *ftie = NULL;
1344         struct wpa_tdls_timeoutie *timeoutie;
1345         struct wpa_tdls_lnkid *lnkid;
1346         u32 lifetime = 0;
1347 #if 0
1348         struct rsn_ie_hdr *hdr;
1349         u8 *pos;
1350         u16 rsn_capab;
1351         u16 rsn_ver;
1352 #endif
1353         u8 dtoken;
1354         u16 ielen;
1355         u16 status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1356         int tdls_prohibited = sm->tdls_prohibited;
1357         int existing_peer = 0;
1358
1359         if (len < 3 + 3)
1360                 return -1;
1361
1362         cpos = buf;
1363         cpos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1364
1365         /* driver had already verified the frame format */
1366         dtoken = *cpos++; /* dialog token */
1367
1368         wpa_printf(MSG_INFO, "TDLS: Dialog Token in TPK M1 %d", dtoken);
1369
1370         for (peer = sm->tdls; peer; peer = peer->next) {
1371                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0) {
1372                         existing_peer = 1;
1373                         break;
1374                 }
1375         }
1376
1377         if (peer == NULL) {
1378                 peer = wpa_tdls_add_peer(sm, src_addr);
1379                 if (peer == NULL)
1380                         goto error;
1381         }
1382
1383         /* capability information */
1384         peer->capability = WPA_GET_LE16(cpos);
1385         cpos += 2;
1386
1387         ielen = len - (cpos - buf); /* start of IE in buf */
1388         if (wpa_supplicant_parse_ies(cpos, ielen, &kde) < 0) {
1389                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M1");
1390                 goto error;
1391         }
1392
1393         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1394                 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1395                            "TPK M1");
1396                 goto error;
1397         }
1398         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M1",
1399                     kde.lnkid, kde.lnkid_len);
1400         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1401         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1402                 wpa_printf(MSG_INFO, "TDLS: TPK M1 from diff BSS");
1403                 status = WLAN_STATUS_NOT_IN_SAME_BSS;
1404                 goto error;
1405         }
1406
1407         wpa_printf(MSG_DEBUG, "TDLS: TPK M1 - TPK initiator " MACSTR,
1408                    MAC2STR(src_addr));
1409
1410         if (copy_supp_rates(&kde, peer) < 0)
1411                 goto error;
1412
1413 #ifdef CONFIG_TDLS_TESTING
1414         if (tdls_testing & TDLS_TESTING_CONCURRENT_INIT) {
1415                 for (peer = sm->tdls; peer; peer = peer->next) {
1416                         if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1417                                 break;
1418                 }
1419                 if (peer == NULL) {
1420                         peer = os_zalloc(sizeof(*peer));
1421                         if (peer == NULL)
1422                                 goto error;
1423                         os_memcpy(peer->addr, src_addr, ETH_ALEN);
1424                         peer->next = sm->tdls;
1425                         sm->tdls = peer;
1426                 }
1427                 wpa_printf(MSG_DEBUG, "TDLS: Testing concurrent initiation of "
1428                            "TDLS setup - send own request");
1429                 peer->initiator = 1;
1430                 wpa_tdls_send_tpk_m1(sm, peer);
1431         }
1432
1433         if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
1434             tdls_prohibited) {
1435                 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
1436                            "on TDLS");
1437                 tdls_prohibited = 0;
1438         }
1439 #endif /* CONFIG_TDLS_TESTING */
1440
1441         if (tdls_prohibited) {
1442                 wpa_printf(MSG_INFO, "TDLS: TDLS prohibited in this BSS");
1443                 status = WLAN_STATUS_REQUEST_DECLINED;
1444                 goto error;
1445         }
1446
1447         if (!wpa_tdls_get_privacy(sm)) {
1448                 if (kde.rsn_ie) {
1449                         wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M1 while "
1450                                    "security is disabled");
1451                         status = WLAN_STATUS_SECURITY_DISABLED;
1452                         goto error;
1453                 }
1454                 goto skip_rsn;
1455         }
1456
1457         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1458             kde.rsn_ie == NULL) {
1459                 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M1");
1460                 status = WLAN_STATUS_INVALID_PARAMETERS;
1461                 goto error;
1462         }
1463
1464         if (kde.rsn_ie_len > TDLS_MAX_IE_LEN) {
1465                 wpa_printf(MSG_INFO, "TDLS: Too long Initiator RSN IE in "
1466                            "TPK M1");
1467                 status = WLAN_STATUS_INVALID_RSNIE;
1468                 goto error;
1469         }
1470
1471         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1472                 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M1");
1473                 status = WLAN_STATUS_INVALID_RSNIE;
1474                 goto error;
1475         }
1476
1477         cipher = ie.pairwise_cipher;
1478         if (cipher & WPA_CIPHER_CCMP) {
1479                 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1480                 cipher = WPA_CIPHER_CCMP;
1481         } else {
1482                 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M1");
1483                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1484                 goto error;
1485         }
1486
1487         if ((ie.capabilities &
1488              (WPA_CAPABILITY_NO_PAIRWISE | WPA_CAPABILITY_PEERKEY_ENABLED)) !=
1489             WPA_CAPABILITY_PEERKEY_ENABLED) {
1490                 wpa_printf(MSG_INFO, "TDLS: Invalid RSN Capabilities in "
1491                            "TPK M1");
1492                 status = WLAN_STATUS_INVALID_RSN_IE_CAPAB;
1493                 goto error;
1494         }
1495
1496         /* Lifetime */
1497         if (kde.key_lifetime == NULL) {
1498                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M1");
1499                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1500                 goto error;
1501         }
1502         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1503         lifetime = WPA_GET_LE32(timeoutie->value);
1504         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds", lifetime);
1505         if (lifetime < 300) {
1506                 wpa_printf(MSG_INFO, "TDLS: Too short TPK lifetime");
1507                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1508                 goto error;
1509         }
1510
1511 skip_rsn:
1512         /* If found, use existing entry instead of adding a new one;
1513          * how to handle the case where both ends initiate at the
1514          * same time? */
1515         if (existing_peer) {
1516                 if (peer->tpk_success) {
1517                         wpa_printf(MSG_DEBUG, "TDLS: TDLS Setup Request while "
1518                                    "direct link is enabled - tear down the "
1519                                    "old link first");
1520 #if 0
1521                         /* TODO: Disabling the link would be more proper
1522                          * operation here, but it seems to trigger a race with
1523                          * some drivers handling the new request frame. */
1524                         wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, src_addr);
1525 #else
1526                         wpa_tdls_del_key(sm, peer);
1527 #endif
1528                         wpa_tdls_peer_free(sm, peer);
1529                 }
1530
1531                 /*
1532                  * An entry is already present, so check if we already sent a
1533                  * TDLS Setup Request. If so, compare MAC addresses and let the
1534                  * STA with the lower MAC address continue as the initiator.
1535                  * The other negotiation is terminated.
1536                  */
1537                 if (peer->initiator) {
1538                         if (os_memcmp(sm->own_addr, src_addr, ETH_ALEN) < 0) {
1539                                 wpa_printf(MSG_DEBUG, "TDLS: Discard request "
1540                                            "from peer with higher address "
1541                                            MACSTR, MAC2STR(src_addr));
1542                                 return -1;
1543                         } else {
1544                                 wpa_printf(MSG_DEBUG, "TDLS: Accept request "
1545                                            "from peer with lower address "
1546                                            MACSTR " (terminate previously "
1547                                            "initiated negotiation",
1548                                            MAC2STR(src_addr));
1549                                 wpa_tdls_peer_free(sm, peer);
1550                         }
1551                 }
1552         }
1553
1554         peer->initiator = 0; /* Need to check */
1555         peer->dtoken = dtoken;
1556
1557         if (!wpa_tdls_get_privacy(sm)) {
1558                 peer->rsnie_i_len = 0;
1559                 peer->rsnie_p_len = 0;
1560                 peer->cipher = WPA_CIPHER_NONE;
1561                 goto skip_rsn_check;
1562         }
1563
1564         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1565         os_memcpy(peer->inonce, ftie->Snonce, WPA_NONCE_LEN);
1566         os_memcpy(peer->rsnie_i, kde.rsn_ie, kde.rsn_ie_len);
1567         peer->rsnie_i_len = kde.rsn_ie_len;
1568         peer->cipher = cipher;
1569
1570         if (os_get_random(peer->rnonce, WPA_NONCE_LEN)) {
1571                 wpa_msg(sm->ctx->ctx, MSG_WARNING,
1572                         "TDLS: Failed to get random data for responder nonce");
1573                 wpa_tdls_peer_free(sm, peer);
1574                 goto error;
1575         }
1576
1577 #if 0
1578         /* get version info from RSNIE received from Peer */
1579         hdr = (struct rsn_ie_hdr *) kde.rsn_ie;
1580         rsn_ver = WPA_GET_LE16(hdr->version);
1581
1582         /* use min(peer's version, out version) */
1583         if (rsn_ver > RSN_VERSION)
1584                 rsn_ver = RSN_VERSION;
1585
1586         hdr = (struct rsn_ie_hdr *) peer->rsnie_p;
1587
1588         hdr->elem_id = WLAN_EID_RSN;
1589         WPA_PUT_LE16(hdr->version, rsn_ver);
1590         pos = (u8 *) (hdr + 1);
1591
1592         RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED);
1593         pos += RSN_SELECTOR_LEN;
1594         /* Include only the selected cipher in pairwise cipher suite */
1595         WPA_PUT_LE16(pos, 1);
1596         pos += 2;
1597         if (cipher == WPA_CIPHER_CCMP)
1598                 RSN_SELECTOR_PUT(pos, RSN_CIPHER_SUITE_CCMP);
1599         pos += RSN_SELECTOR_LEN;
1600
1601         WPA_PUT_LE16(pos, 1);
1602         pos += 2;
1603         RSN_SELECTOR_PUT(pos, RSN_AUTH_KEY_MGMT_TPK_HANDSHAKE);
1604         pos += RSN_SELECTOR_LEN;
1605
1606         rsn_capab = WPA_CAPABILITY_PEERKEY_ENABLED;
1607         rsn_capab |= RSN_NUM_REPLAY_COUNTERS_16 << 2;
1608         WPA_PUT_LE16(pos, rsn_capab);
1609         pos += 2;
1610
1611         hdr->len = (pos - peer->rsnie_p) - 2;
1612         peer->rsnie_p_len = pos - peer->rsnie_p;
1613 #endif
1614
1615         /* temp fix: validation of RSNIE later */
1616         os_memcpy(peer->rsnie_p, peer->rsnie_i, peer->rsnie_i_len);
1617         peer->rsnie_p_len = peer->rsnie_i_len;
1618
1619         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE for TPK handshake",
1620                     peer->rsnie_p, peer->rsnie_p_len);
1621
1622         peer->lifetime = lifetime;
1623
1624         wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
1625
1626 skip_rsn_check:
1627         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Response / TPK M2");
1628         wpa_tdls_send_tpk_m2(sm, src_addr, dtoken, lnkid, peer);
1629
1630         return 0;
1631
1632 error:
1633         wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_RESPONSE, dtoken,
1634                             status);
1635         return -1;
1636 }
1637
1638
1639 static void wpa_tdls_enable_link(struct wpa_sm *sm, struct wpa_tdls_peer *peer)
1640 {
1641         peer->tpk_success = 1;
1642         eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
1643         if (wpa_tdls_get_privacy(sm)) {
1644                 u32 lifetime = peer->lifetime;
1645                 /*
1646                  * Start the initiator process a bit earlier to avoid race
1647                  * condition with the responder sending teardown request.
1648                  */
1649                 if (lifetime > 3 && peer->initiator)
1650                         lifetime -= 3;
1651                 eloop_register_timeout(lifetime, 0, wpa_tdls_tpk_timeout,
1652                                        sm, peer);
1653 #ifdef CONFIG_TDLS_TESTING
1654         if (tdls_testing & TDLS_TESTING_NO_TPK_EXPIRATION) {
1655                 wpa_printf(MSG_DEBUG, "TDLS: Testing - disable TPK "
1656                            "expiration");
1657                 eloop_cancel_timeout(wpa_tdls_tpk_timeout, sm, peer);
1658         }
1659 #endif /* CONFIG_TDLS_TESTING */
1660         }
1661         wpa_sm_tdls_oper(sm, TDLS_ENABLE_LINK, peer->addr);
1662 }
1663
1664
1665 static int wpa_tdls_process_tpk_m2(struct wpa_sm *sm, const u8 *src_addr,
1666                                    const u8 *buf, size_t len)
1667 {
1668         struct wpa_tdls_peer *peer;
1669         struct wpa_eapol_ie_parse kde;
1670         struct wpa_ie_data ie;
1671         int cipher;
1672         struct wpa_tdls_ftie *ftie;
1673         struct wpa_tdls_timeoutie *timeoutie;
1674         struct wpa_tdls_lnkid *lnkid;
1675         u32 lifetime;
1676         u8 dtoken;
1677         int ielen;
1678         u16 status;
1679         const u8 *pos;
1680
1681         wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Response / TPK M2 "
1682                    "(Peer " MACSTR ")", MAC2STR(src_addr));
1683         for (peer = sm->tdls; peer; peer = peer->next) {
1684                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1685                         break;
1686         }
1687         if (peer == NULL) {
1688                 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
1689                            "TPK M2: " MACSTR, MAC2STR(src_addr));
1690                 return -1;
1691         }
1692         wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_REQUEST);
1693
1694         if (len < 3 + 2 + 1)
1695                 return -1;
1696         pos = buf;
1697         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1698         status = WPA_GET_LE16(pos);
1699         pos += 2 /* status code */;
1700
1701         if (status != WLAN_STATUS_SUCCESS) {
1702                 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M2: %u",
1703                            status);
1704                 return -1;
1705         }
1706
1707         status = WLAN_STATUS_UNSPECIFIED_FAILURE;
1708
1709         /* TODO: need to verify dialog token matches here or in kernel */
1710         dtoken = *pos++; /* dialog token */
1711
1712         wpa_printf(MSG_DEBUG, "TDLS: Dialog Token in TPK M2 %d", dtoken);
1713
1714         if (len < 3 + 2 + 1 + 2)
1715                 return -1;
1716
1717         /* capability information */
1718         peer->capability = WPA_GET_LE16(pos);
1719         pos += 2;
1720
1721         ielen = len - (pos - buf); /* start of IE in buf */
1722         if (wpa_supplicant_parse_ies(pos, ielen, &kde) < 0) {
1723                 wpa_printf(MSG_INFO, "TDLS: Failed to parse IEs in TPK M2");
1724                 goto error;
1725         }
1726
1727 #ifdef CONFIG_TDLS_TESTING
1728         if (tdls_testing & TDLS_TESTING_DECLINE_RESP) {
1729                 wpa_printf(MSG_DEBUG, "TDLS: Testing - decline response");
1730                 status = WLAN_STATUS_REQUEST_DECLINED;
1731                 goto error;
1732         }
1733 #endif /* CONFIG_TDLS_TESTING */
1734
1735         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1736                 wpa_printf(MSG_INFO, "TDLS: No valid Link Identifier IE in "
1737                            "TPK M2");
1738                 goto error;
1739         }
1740         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M2",
1741                     kde.lnkid, kde.lnkid_len);
1742         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1743
1744         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1745                 wpa_printf(MSG_INFO, "TDLS: TPK M2 from different BSS");
1746                 status = WLAN_STATUS_NOT_IN_SAME_BSS;
1747                 goto error;
1748         }
1749
1750         if (copy_supp_rates(&kde, peer) < 0)
1751                 goto error;
1752
1753         if (!wpa_tdls_get_privacy(sm)) {
1754                 peer->rsnie_p_len = 0;
1755                 peer->cipher = WPA_CIPHER_NONE;
1756                 goto skip_rsn;
1757         }
1758
1759         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie) ||
1760             kde.rsn_ie == NULL) {
1761                 wpa_printf(MSG_INFO, "TDLS: No FTIE or RSN IE in TPK M2");
1762                 status = WLAN_STATUS_INVALID_PARAMETERS;
1763                 goto error;
1764         }
1765         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
1766                     kde.rsn_ie, kde.rsn_ie_len);
1767
1768         /*
1769          * FIX: bitwise comparison of RSN IE is not the correct way of
1770          * validation this. It can be different, but certain fields must
1771          * match. Since we list only a single pairwise cipher in TPK M1, the
1772          * memcmp is likely to work in most cases, though.
1773          */
1774         if (kde.rsn_ie_len != peer->rsnie_i_len ||
1775             os_memcmp(peer->rsnie_i, kde.rsn_ie, peer->rsnie_i_len) != 0) {
1776                 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M2 does "
1777                            "not match with RSN IE used in TPK M1");
1778                 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Sent in TPK M1",
1779                             peer->rsnie_i, peer->rsnie_i_len);
1780                 wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M2",
1781                             kde.rsn_ie, kde.rsn_ie_len);
1782                 status = WLAN_STATUS_INVALID_RSNIE;
1783                 goto error;
1784         }
1785
1786         if (wpa_parse_wpa_ie_rsn(kde.rsn_ie, kde.rsn_ie_len, &ie) < 0) {
1787                 wpa_printf(MSG_INFO, "TDLS: Failed to parse RSN IE in TPK M2");
1788                 status = WLAN_STATUS_INVALID_RSNIE;
1789                 goto error;
1790         }
1791
1792         cipher = ie.pairwise_cipher;
1793         if (cipher == WPA_CIPHER_CCMP) {
1794                 wpa_printf(MSG_DEBUG, "TDLS: Using CCMP for direct link");
1795                 cipher = WPA_CIPHER_CCMP;
1796         } else {
1797                 wpa_printf(MSG_INFO, "TDLS: No acceptable cipher in TPK M2");
1798                 status = WLAN_STATUS_PAIRWISE_CIPHER_NOT_VALID;
1799                 goto error;
1800         }
1801
1802         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M2",
1803                     kde.ftie, sizeof(*ftie));
1804         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1805
1806         if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
1807                 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M2 does "
1808                            "not match with FTIE SNonce used in TPK M1");
1809                 /* Silently discard the frame */
1810                 return -1;
1811         }
1812
1813         /* Responder Nonce and RSN IE */
1814         os_memcpy(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN);
1815         os_memcpy(peer->rsnie_p, kde.rsn_ie, kde.rsn_ie_len);
1816         peer->rsnie_p_len = kde.rsn_ie_len;
1817         peer->cipher = cipher;
1818
1819         /* Lifetime */
1820         if (kde.key_lifetime == NULL) {
1821                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M2");
1822                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1823                 goto error;
1824         }
1825         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1826         lifetime = WPA_GET_LE32(timeoutie->value);
1827         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M2",
1828                    lifetime);
1829         if (lifetime != peer->lifetime) {
1830                 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
1831                            "TPK M2 (expected %u)", lifetime, peer->lifetime);
1832                 status = WLAN_STATUS_UNACCEPTABLE_LIFETIME;
1833                 goto error;
1834         }
1835
1836         wpa_tdls_generate_tpk(peer, sm->own_addr, sm->bssid);
1837
1838         /* Process MIC check to see if TPK M2 is right */
1839         if (wpa_supplicant_verify_tdls_mic(2, peer, (u8 *) lnkid,
1840                                            (u8 *) timeoutie, ftie) < 0) {
1841                 /* Discard the frame */
1842                 wpa_tdls_del_key(sm, peer);
1843                 wpa_tdls_peer_free(sm, peer);
1844                 return -1;
1845         }
1846
1847         wpa_tdls_set_key(sm, peer);
1848
1849 skip_rsn:
1850         peer->dtoken = dtoken;
1851
1852         wpa_printf(MSG_DEBUG, "TDLS: Sending TDLS Setup Confirm / "
1853                    "TPK Handshake Message 3");
1854         wpa_tdls_send_tpk_m3(sm, src_addr, dtoken, lnkid, peer);
1855
1856         wpa_tdls_enable_link(sm, peer);
1857
1858         return 0;
1859
1860 error:
1861         wpa_tdls_send_error(sm, src_addr, WLAN_TDLS_SETUP_CONFIRM, dtoken,
1862                             status);
1863         return -1;
1864 }
1865
1866
1867 static int wpa_tdls_process_tpk_m3(struct wpa_sm *sm, const u8 *src_addr,
1868                                    const u8 *buf, size_t len)
1869 {
1870         struct wpa_tdls_peer *peer;
1871         struct wpa_eapol_ie_parse kde;
1872         struct wpa_tdls_ftie *ftie;
1873         struct wpa_tdls_timeoutie *timeoutie;
1874         struct wpa_tdls_lnkid *lnkid;
1875         int ielen;
1876         u16 status;
1877         const u8 *pos;
1878         u32 lifetime;
1879
1880         wpa_printf(MSG_DEBUG, "TDLS: Received TDLS Setup Confirm / TPK M3 "
1881                    "(Peer " MACSTR ")", MAC2STR(src_addr));
1882         for (peer = sm->tdls; peer; peer = peer->next) {
1883                 if (os_memcmp(peer->addr, src_addr, ETH_ALEN) == 0)
1884                         break;
1885         }
1886         if (peer == NULL) {
1887                 wpa_printf(MSG_INFO, "TDLS: No matching peer found for "
1888                            "TPK M3: " MACSTR, MAC2STR(src_addr));
1889                 return -1;
1890         }
1891         wpa_tdls_tpk_retry_timeout_cancel(sm, peer, WLAN_TDLS_SETUP_RESPONSE);
1892
1893         if (len < 3 + 3)
1894                 return -1;
1895         pos = buf;
1896         pos += 1 /* pkt_type */ + 1 /* Category */ + 1 /* Action */;
1897
1898         status = WPA_GET_LE16(pos);
1899
1900         if (status != 0) {
1901                 wpa_printf(MSG_INFO, "TDLS: Status code in TPK M3: %u",
1902                            status);
1903                 return -1;
1904         }
1905         pos += 2 /* status code */ + 1 /* dialog token */;
1906
1907         ielen = len - (pos - buf); /* start of IE in buf */
1908         if (wpa_supplicant_parse_ies((const u8 *) pos, ielen, &kde) < 0) {
1909                 wpa_printf(MSG_INFO, "TDLS: Failed to parse KDEs in TPK M3");
1910                 return -1;
1911         }
1912
1913         if (kde.lnkid == NULL || kde.lnkid_len < 3 * ETH_ALEN) {
1914                 wpa_printf(MSG_INFO, "TDLS: No Link Identifier IE in TPK M3");
1915                 return -1;
1916         }
1917         wpa_hexdump(MSG_DEBUG, "TDLS: Link ID Received from TPK M3",
1918                     (u8 *) kde.lnkid, kde.lnkid_len);
1919         lnkid = (struct wpa_tdls_lnkid *) kde.lnkid;
1920
1921         if (os_memcmp(sm->bssid, lnkid->bssid, ETH_ALEN) != 0) {
1922                 wpa_printf(MSG_INFO, "TDLS: TPK M3 from diff BSS");
1923                 return -1;
1924         }
1925
1926         if (!wpa_tdls_get_privacy(sm))
1927                 goto skip_rsn;
1928
1929         if (kde.ftie == NULL || kde.ftie_len < sizeof(*ftie)) {
1930                 wpa_printf(MSG_INFO, "TDLS: No FTIE in TPK M3");
1931                 return -1;
1932         }
1933         wpa_hexdump(MSG_DEBUG, "TDLS: FTIE Received from TPK M3",
1934                     kde.ftie, sizeof(*ftie));
1935         ftie = (struct wpa_tdls_ftie *) kde.ftie;
1936
1937         if (kde.rsn_ie == NULL) {
1938                 wpa_printf(MSG_INFO, "TDLS: No RSN IE in TPK M3");
1939                 return -1;
1940         }
1941         wpa_hexdump(MSG_DEBUG, "TDLS: RSN IE Received from TPK M3",
1942                     kde.rsn_ie, kde.rsn_ie_len);
1943         if (kde.rsn_ie_len != peer->rsnie_p_len ||
1944             os_memcmp(kde.rsn_ie, peer->rsnie_p, peer->rsnie_p_len) != 0) {
1945                 wpa_printf(MSG_INFO, "TDLS: RSN IE in TPK M3 does not match "
1946                            "with the one sent in TPK M2");
1947                 return -1;
1948         }
1949
1950         if (!os_memcmp(peer->rnonce, ftie->Anonce, WPA_NONCE_LEN) == 0) {
1951                 wpa_printf(MSG_INFO, "TDLS: FTIE ANonce in TPK M3 does "
1952                            "not match with FTIE ANonce used in TPK M2");
1953                 return -1;
1954         }
1955
1956         if (!os_memcmp(peer->inonce, ftie->Snonce, WPA_NONCE_LEN) == 0) {
1957                 wpa_printf(MSG_INFO, "TDLS: FTIE SNonce in TPK M3 does not "
1958                            "match with FTIE SNonce used in TPK M1");
1959                 return -1;
1960         }
1961
1962         if (kde.key_lifetime == NULL) {
1963                 wpa_printf(MSG_INFO, "TDLS: No Key Lifetime IE in TPK M3");
1964                 return -1;
1965         }
1966         timeoutie = (struct wpa_tdls_timeoutie *) kde.key_lifetime;
1967         wpa_hexdump(MSG_DEBUG, "TDLS: Timeout IE Received from TPK M3",
1968                     (u8 *) timeoutie, sizeof(*timeoutie));
1969         lifetime = WPA_GET_LE32(timeoutie->value);
1970         wpa_printf(MSG_DEBUG, "TDLS: TPK lifetime %u seconds in TPK M3",
1971                    lifetime);
1972         if (lifetime != peer->lifetime) {
1973                 wpa_printf(MSG_INFO, "TDLS: Unexpected TPK lifetime %u in "
1974                            "TPK M3 (expected %u)", lifetime, peer->lifetime);
1975                 return -1;
1976         }
1977
1978         if (wpa_supplicant_verify_tdls_mic(3, peer, (u8 *) lnkid,
1979                                            (u8 *) timeoutie, ftie) < 0) {
1980                 wpa_tdls_del_key(sm, peer);
1981                 wpa_tdls_peer_free(sm, peer);
1982                 return -1;
1983         }
1984
1985         if (wpa_tdls_set_key(sm, peer) < 0)
1986                 return -1;
1987
1988 skip_rsn:
1989         wpa_tdls_enable_link(sm, peer);
1990
1991         return 0;
1992 }
1993
1994
1995 static u8 * wpa_add_tdls_timeoutie(u8 *pos, u8 *ie, size_t ie_len, u32 tsecs)
1996 {
1997         struct wpa_tdls_timeoutie *lifetime = (struct wpa_tdls_timeoutie *) ie;
1998
1999         os_memset(lifetime, 0, ie_len);
2000         lifetime->ie_type = WLAN_EID_TIMEOUT_INTERVAL;
2001         lifetime->ie_len = sizeof(struct wpa_tdls_timeoutie) - 2;
2002         lifetime->interval_type = WLAN_TIMEOUT_KEY_LIFETIME;
2003         WPA_PUT_LE32(lifetime->value, tsecs);
2004         os_memcpy(pos, ie, ie_len);
2005         return pos + ie_len;
2006 }
2007
2008
2009 /**
2010  * wpa_tdls_start - Initiate TDLS handshake (send TPK Handshake Message 1)
2011  * @sm: Pointer to WPA state machine data from wpa_sm_init()
2012  * @peer: MAC address of the peer STA
2013  * Returns: 0 on success, or -1 on failure
2014  *
2015  * Send TPK Handshake Message 1 info to driver to start TDLS
2016  * handshake with the peer.
2017  */
2018 int wpa_tdls_start(struct wpa_sm *sm, const u8 *addr)
2019 {
2020         struct wpa_tdls_peer *peer;
2021         int tdls_prohibited = sm->tdls_prohibited;
2022
2023         if (sm->tdls_disabled || !sm->tdls_supported)
2024                 return -1;
2025
2026 #ifdef CONFIG_TDLS_TESTING
2027         if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&
2028             tdls_prohibited) {
2029                 wpa_printf(MSG_DEBUG, "TDLS: Testing - ignore AP prohibition "
2030                            "on TDLS");
2031                 tdls_prohibited = 0;
2032         }
2033 #endif /* CONFIG_TDLS_TESTING */
2034
2035         if (tdls_prohibited) {
2036                 wpa_printf(MSG_DEBUG, "TDLS: TDLS is prohibited in this BSS - "
2037                            "reject request to start setup");
2038                 return -1;
2039         }
2040
2041         /* Find existing entry and if found, use that instead of adding
2042          * a new one */
2043         for (peer = sm->tdls; peer; peer = peer->next) {
2044                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2045                         break;
2046         }
2047
2048         if (peer == NULL) {
2049                 wpa_printf(MSG_INFO, "TDLS: No matching entry found for "
2050                            "peer, creating one for " MACSTR, MAC2STR(addr));
2051                 peer = os_malloc(sizeof(*peer));
2052                 if (peer == NULL)
2053                         return -1;
2054                 os_memset(peer, 0, sizeof(*peer));
2055                 os_memcpy(peer->addr, addr, ETH_ALEN);
2056                 peer->next = sm->tdls;
2057                 sm->tdls = peer;
2058         }
2059
2060         peer->initiator = 1;
2061
2062         return wpa_tdls_send_tpk_m1(sm, peer);
2063 }
2064
2065
2066 int wpa_tdls_reneg(struct wpa_sm *sm, const u8 *addr)
2067 {
2068         struct wpa_tdls_peer *peer;
2069
2070         if (sm->tdls_disabled || !sm->tdls_supported)
2071                 return -1;
2072
2073         for (peer = sm->tdls; peer; peer = peer->next) {
2074                 if (os_memcmp(peer->addr, addr, ETH_ALEN) == 0)
2075                         break;
2076         }
2077
2078         if (peer == NULL || !peer->tpk_success)
2079                 return -1;
2080
2081         return wpa_tdls_start(sm, addr);
2082 }
2083
2084
2085 /**
2086  * wpa_supplicant_rx_tdls - Receive TDLS data frame
2087  *
2088  * This function is called to receive TDLS (ethertype = 0x890d) data frames.
2089  */
2090 static void wpa_supplicant_rx_tdls(void *ctx, const u8 *src_addr,
2091                                    const u8 *buf, size_t len)
2092 {
2093         struct wpa_sm *sm = ctx;
2094         struct wpa_tdls_frame *tf;
2095
2096         wpa_hexdump(MSG_DEBUG, "TDLS: Received Data frame encapsulation",
2097                     buf, len);
2098
2099         if (sm->tdls_disabled || !sm->tdls_supported) {
2100                 wpa_printf(MSG_DEBUG, "TDLS: Discard message - TDLS disabled "
2101                            "or unsupported by driver");
2102                 return;
2103         }
2104
2105         if (os_memcmp(src_addr, sm->own_addr, ETH_ALEN) == 0) {
2106                 wpa_printf(MSG_DEBUG, "TDLS: Discard copy of own message");
2107                 return;
2108         }
2109
2110         if (len < sizeof(*tf)) {
2111                 wpa_printf(MSG_INFO, "TDLS: Drop too short frame");
2112                 return;
2113         }
2114
2115         /* Check to make sure its a valid encapsulated TDLS frame */
2116         tf = (struct wpa_tdls_frame *) buf;
2117         if (tf->payloadtype != 2 /* TDLS_RFTYPE */ ||
2118             tf->category != WLAN_ACTION_TDLS) {
2119                 wpa_printf(MSG_INFO, "TDLS: Invalid frame - payloadtype=%u "
2120                            "category=%u action=%u",
2121                            tf->payloadtype, tf->category, tf->action);
2122                 return;
2123         }
2124
2125         switch (tf->action) {
2126         case WLAN_TDLS_SETUP_REQUEST:
2127                 wpa_tdls_process_tpk_m1(sm, src_addr, buf, len);
2128                 break;
2129         case WLAN_TDLS_SETUP_RESPONSE:
2130                 wpa_tdls_process_tpk_m2(sm, src_addr, buf, len);
2131                 break;
2132         case WLAN_TDLS_SETUP_CONFIRM:
2133                 wpa_tdls_process_tpk_m3(sm, src_addr, buf, len);
2134                 break;
2135         case WLAN_TDLS_TEARDOWN:
2136                 wpa_tdls_recv_teardown(sm, src_addr, buf, len);
2137                 break;
2138         case WLAN_TDLS_DISCOVERY_REQUEST:
2139                 wpa_tdls_process_discovery_request(sm, src_addr, buf, len);
2140                 break;
2141         default:
2142                 /* Kernel code will process remaining frames */
2143                 wpa_printf(MSG_DEBUG, "TDLS: Ignore TDLS frame action code %u",
2144                            tf->action);
2145                 break;
2146         }
2147 }
2148
2149
2150 /**
2151  * wpa_tdls_init - Initialize driver interface parameters for TDLS
2152  * @wpa_s: Pointer to wpa_supplicant data
2153  * Returns: 0 on success, -1 on failure
2154  *
2155  * This function is called to initialize driver interface parameters for TDLS.
2156  * wpa_drv_init() must have been called before this function to initialize the
2157  * driver interface.
2158  */
2159 int wpa_tdls_init(struct wpa_sm *sm)
2160 {
2161         if (sm == NULL)
2162                 return -1;
2163
2164         sm->l2_tdls = l2_packet_init(sm->ifname, sm->own_addr,
2165                                      ETH_P_80211_ENCAP, wpa_supplicant_rx_tdls,
2166                                      sm, 0);
2167         if (sm->l2_tdls == NULL) {
2168                 wpa_printf(MSG_ERROR, "TDLS: Failed to open l2_packet "
2169                            "connection");
2170                 return -1;
2171         }
2172
2173         /*
2174          * Drivers that support TDLS but don't implement the get_capa callback
2175          * are assumed to perform everything internally
2176          */
2177         if (wpa_sm_tdls_get_capa(sm, &sm->tdls_supported,
2178                                  &sm->tdls_external_setup) < 0) {
2179                 sm->tdls_supported = 1;
2180                 sm->tdls_external_setup = 0;
2181         }
2182
2183         wpa_printf(MSG_DEBUG, "TDLS: TDLS operation%s supported by "
2184                    "driver", sm->tdls_supported ? "" : " not");
2185         wpa_printf(MSG_DEBUG, "TDLS: Driver uses %s link setup",
2186                    sm->tdls_external_setup ? "external" : "internal");
2187
2188         return 0;
2189 }
2190
2191
2192 static void wpa_tdls_remove_peers(struct wpa_sm *sm)
2193 {
2194         struct wpa_tdls_peer *peer, *tmp;
2195
2196         peer = sm->tdls;
2197         sm->tdls = NULL;
2198
2199         while (peer) {
2200                 int res;
2201                 tmp = peer->next;
2202                 res = wpa_sm_tdls_oper(sm, TDLS_DISABLE_LINK, peer->addr);
2203                 wpa_printf(MSG_DEBUG, "TDLS: Remove peer " MACSTR " (res=%d)",
2204                            MAC2STR(peer->addr), res);
2205                 wpa_tdls_peer_free(sm, peer);
2206                 os_free(peer);
2207                 peer = tmp;
2208         }
2209 }
2210
2211
2212 /**
2213  * wpa_tdls_deinit - Deinitialize driver interface parameters for TDLS
2214  *
2215  * This function is called to recover driver interface parameters for TDLS
2216  * and frees resources allocated for it.
2217  */
2218 void wpa_tdls_deinit(struct wpa_sm *sm)
2219 {
2220         if (sm == NULL)
2221                 return;
2222
2223         if (sm->l2_tdls)
2224                 l2_packet_deinit(sm->l2_tdls);
2225         sm->l2_tdls = NULL;
2226
2227         wpa_tdls_remove_peers(sm);
2228 }
2229
2230
2231 void wpa_tdls_assoc(struct wpa_sm *sm)
2232 {
2233         wpa_printf(MSG_DEBUG, "TDLS: Remove peers on association");
2234         wpa_tdls_remove_peers(sm);
2235 }
2236
2237
2238 void wpa_tdls_disassoc(struct wpa_sm *sm)
2239 {
2240         wpa_printf(MSG_DEBUG, "TDLS: Remove peers on disassociation");
2241         wpa_tdls_remove_peers(sm);
2242 }
2243
2244
2245 static int wpa_tdls_prohibited(const u8 *ies, size_t len)
2246 {
2247         struct wpa_eapol_ie_parse elems;
2248
2249         if (ies == NULL)
2250                 return 0;
2251
2252         if (wpa_supplicant_parse_ies(ies, len, &elems) < 0)
2253                 return 0;
2254
2255         if (elems.ext_capab == NULL || elems.ext_capab_len < 2 + 5)
2256                 return 0;
2257
2258          /* bit 38 - TDLS Prohibited */
2259         return !!(elems.ext_capab[2 + 4] & 0x40);
2260 }
2261
2262
2263 void wpa_tdls_ap_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2264 {
2265         sm->tdls_prohibited = wpa_tdls_prohibited(ies, len);
2266         wpa_printf(MSG_DEBUG, "TDLS: TDLS is %s in the target BSS",
2267                    sm->tdls_prohibited ? "prohibited" : "allowed");
2268 }
2269
2270
2271 void wpa_tdls_assoc_resp_ies(struct wpa_sm *sm, const u8 *ies, size_t len)
2272 {
2273         if (!sm->tdls_prohibited && wpa_tdls_prohibited(ies, len)) {
2274                 wpa_printf(MSG_DEBUG, "TDLS: TDLS prohibited based on "
2275                            "(Re)Association Response IEs");
2276                 sm->tdls_prohibited = 1;
2277         }
2278 }
2279
2280
2281 void wpa_tdls_enable(struct wpa_sm *sm, int enabled)
2282 {
2283         wpa_printf(MSG_DEBUG, "TDLS: %s", enabled ? "enabled" : "disabled");
2284         sm->tdls_disabled = !enabled;
2285 }