wnm_sta.c 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423
  1. /*
  2. * wpa_supplicant - WNM
  3. * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
  4. *
  5. * This software may be distributed under the terms of the BSD license.
  6. * See README for more details.
  7. */
  8. #include "utils/includes.h"
  9. #include "utils/common.h"
  10. #include "common/ieee802_11_defs.h"
  11. #include "rsn_supp/wpa.h"
  12. #include "wpa_supplicant_i.h"
  13. #include "driver_i.h"
  14. #include "scan.h"
  15. #define MAX_TFS_IE_LEN 1024
  16. /* get the TFS IE from driver */
  17. static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
  18. u16 *buf_len, enum wnm_oper oper)
  19. {
  20. wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
  21. return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
  22. }
  23. /* set the TFS IE to driver */
  24. static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
  25. const u8 *addr, u8 *buf, u16 *buf_len,
  26. enum wnm_oper oper)
  27. {
  28. wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
  29. return wpa_drv_wnm_oper(wpa_s, oper, addr, buf, buf_len);
  30. }
  31. /* MLME-SLEEPMODE.request */
  32. int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
  33. u8 action, u16 intval, struct wpabuf *tfs_req)
  34. {
  35. struct ieee80211_mgmt *mgmt;
  36. int res;
  37. size_t len;
  38. struct wnm_sleep_element *wnmsleep_ie;
  39. u8 *wnmtfs_ie;
  40. u8 wnmsleep_ie_len;
  41. u16 wnmtfs_ie_len; /* possibly multiple IE(s) */
  42. enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
  43. WNM_SLEEP_TFS_REQ_IE_NONE;
  44. wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
  45. "action=%s to " MACSTR,
  46. action == 0 ? "enter" : "exit",
  47. MAC2STR(wpa_s->bssid));
  48. /* WNM-Sleep Mode IE */
  49. wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
  50. wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
  51. if (wnmsleep_ie == NULL)
  52. return -1;
  53. wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
  54. wnmsleep_ie->len = wnmsleep_ie_len - 2;
  55. wnmsleep_ie->action_type = action;
  56. wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
  57. wnmsleep_ie->intval = host_to_le16(intval);
  58. wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
  59. (u8 *) wnmsleep_ie, wnmsleep_ie_len);
  60. /* TFS IE(s) */
  61. if (tfs_req) {
  62. wnmtfs_ie_len = wpabuf_len(tfs_req);
  63. wnmtfs_ie = os_malloc(wnmtfs_ie_len);
  64. if (wnmtfs_ie == NULL) {
  65. os_free(wnmsleep_ie);
  66. return -1;
  67. }
  68. os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
  69. } else {
  70. wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
  71. if (wnmtfs_ie == NULL) {
  72. os_free(wnmsleep_ie);
  73. return -1;
  74. }
  75. if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
  76. tfs_oper)) {
  77. wnmtfs_ie_len = 0;
  78. os_free(wnmtfs_ie);
  79. wnmtfs_ie = NULL;
  80. }
  81. }
  82. wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
  83. (u8 *) wnmtfs_ie, wnmtfs_ie_len);
  84. mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
  85. if (mgmt == NULL) {
  86. wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
  87. "WNM-Sleep Request action frame");
  88. os_free(wnmsleep_ie);
  89. os_free(wnmtfs_ie);
  90. return -1;
  91. }
  92. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  93. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  94. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  95. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  96. WLAN_FC_STYPE_ACTION);
  97. mgmt->u.action.category = WLAN_ACTION_WNM;
  98. mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
  99. mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
  100. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
  101. wnmsleep_ie_len);
  102. /* copy TFS IE here */
  103. if (wnmtfs_ie_len > 0) {
  104. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
  105. wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
  106. }
  107. len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
  108. wnmtfs_ie_len;
  109. res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  110. wpa_s->own_addr, wpa_s->bssid,
  111. &mgmt->u.action.category, len, 0);
  112. if (res < 0)
  113. wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
  114. "(action=%d, intval=%d)", action, intval);
  115. os_free(wnmsleep_ie);
  116. os_free(wnmtfs_ie);
  117. os_free(mgmt);
  118. return res;
  119. }
  120. static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
  121. u8 *tfsresp_ie_start,
  122. u8 *tfsresp_ie_end)
  123. {
  124. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
  125. wpa_s->bssid, NULL, NULL);
  126. /* remove GTK/IGTK ?? */
  127. /* set the TFS Resp IE(s) */
  128. if (tfsresp_ie_start && tfsresp_ie_end &&
  129. tfsresp_ie_end - tfsresp_ie_start >= 0) {
  130. u16 tfsresp_ie_len;
  131. tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
  132. tfsresp_ie_start;
  133. wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
  134. /* pass the TFS Resp IE(s) to driver for processing */
  135. if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
  136. tfsresp_ie_start,
  137. &tfsresp_ie_len,
  138. WNM_SLEEP_TFS_RESP_IE_SET))
  139. wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
  140. }
  141. }
  142. static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
  143. const u8 *frm, u16 key_len_total)
  144. {
  145. u8 *ptr, *end;
  146. u8 gtk_len;
  147. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM, wpa_s->bssid,
  148. NULL, NULL);
  149. /* Install GTK/IGTK */
  150. /* point to key data field */
  151. ptr = (u8 *) frm + 1 + 1 + 2;
  152. end = ptr + key_len_total;
  153. wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
  154. while (ptr + 1 < end) {
  155. if (ptr + 2 + ptr[1] > end) {
  156. wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
  157. "length");
  158. if (end > ptr) {
  159. wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
  160. ptr, end - ptr);
  161. }
  162. break;
  163. }
  164. if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
  165. if (ptr[1] < 11 + 5) {
  166. wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
  167. "subelem");
  168. break;
  169. }
  170. gtk_len = *(ptr + 4);
  171. if (ptr[1] < 11 + gtk_len ||
  172. gtk_len < 5 || gtk_len > 32) {
  173. wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
  174. "subelem");
  175. break;
  176. }
  177. wpa_wnmsleep_install_key(
  178. wpa_s->wpa,
  179. WNM_SLEEP_SUBELEM_GTK,
  180. ptr);
  181. ptr += 13 + gtk_len;
  182. #ifdef CONFIG_IEEE80211W
  183. } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
  184. if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
  185. wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
  186. "subelem");
  187. break;
  188. }
  189. wpa_wnmsleep_install_key(wpa_s->wpa,
  190. WNM_SLEEP_SUBELEM_IGTK, ptr);
  191. ptr += 10 + WPA_IGTK_LEN;
  192. #endif /* CONFIG_IEEE80211W */
  193. } else
  194. break; /* skip the loop */
  195. }
  196. }
  197. static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
  198. const u8 *frm, int len)
  199. {
  200. /*
  201. * Action [1] | Diaglog Token [1] | Key Data Len [2] | Key Data |
  202. * WNM-Sleep Mode IE | TFS Response IE
  203. */
  204. u8 *pos = (u8 *) frm; /* point to action field */
  205. u16 key_len_total = le_to_host16(*((u16 *)(frm+2)));
  206. struct wnm_sleep_element *wnmsleep_ie = NULL;
  207. /* multiple TFS Resp IE (assuming consecutive) */
  208. u8 *tfsresp_ie_start = NULL;
  209. u8 *tfsresp_ie_end = NULL;
  210. wpa_printf(MSG_DEBUG, "action=%d token = %d key_len_total = %d",
  211. frm[0], frm[1], key_len_total);
  212. pos += 4 + key_len_total;
  213. if (pos > frm + len) {
  214. wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
  215. return;
  216. }
  217. while (pos - frm < len) {
  218. u8 ie_len = *(pos + 1);
  219. if (pos + 2 + ie_len > frm + len) {
  220. wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
  221. break;
  222. }
  223. wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
  224. if (*pos == WLAN_EID_WNMSLEEP)
  225. wnmsleep_ie = (struct wnm_sleep_element *) pos;
  226. else if (*pos == WLAN_EID_TFS_RESP) {
  227. if (!tfsresp_ie_start)
  228. tfsresp_ie_start = pos;
  229. tfsresp_ie_end = pos;
  230. } else
  231. wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
  232. pos += ie_len + 2;
  233. }
  234. if (!wnmsleep_ie) {
  235. wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
  236. return;
  237. }
  238. if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
  239. wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
  240. wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
  241. "frame (action=%d, intval=%d)",
  242. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  243. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
  244. wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
  245. tfsresp_ie_end);
  246. } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
  247. wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
  248. }
  249. } else {
  250. wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
  251. "(action=%d, intval=%d)",
  252. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  253. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
  254. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
  255. wpa_s->bssid, NULL, NULL);
  256. else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
  257. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
  258. wpa_s->bssid, NULL, NULL);
  259. }
  260. }
  261. static void wnm_send_bss_transition_mgmt_resp(struct wpa_supplicant *wpa_s,
  262. u8 dialog_token, u8 status,
  263. u8 delay, const u8 *target_bssid)
  264. {
  265. u8 buf[1000], *pos;
  266. struct ieee80211_mgmt *mgmt;
  267. size_t len;
  268. wpa_printf(MSG_DEBUG, "WNM: Send BSS Transition Management Response "
  269. "to " MACSTR " dialog_token=%u status=%u delay=%d",
  270. MAC2STR(wpa_s->bssid), dialog_token, status, delay);
  271. mgmt = (struct ieee80211_mgmt *) buf;
  272. os_memset(&buf, 0, sizeof(buf));
  273. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  274. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  275. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  276. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  277. WLAN_FC_STYPE_ACTION);
  278. mgmt->u.action.category = WLAN_ACTION_WNM;
  279. mgmt->u.action.u.bss_tm_resp.action = WNM_BSS_TRANS_MGMT_RESP;
  280. mgmt->u.action.u.bss_tm_resp.dialog_token = dialog_token;
  281. mgmt->u.action.u.bss_tm_resp.status_code = status;
  282. mgmt->u.action.u.bss_tm_resp.bss_termination_delay = delay;
  283. pos = mgmt->u.action.u.bss_tm_resp.variable;
  284. if (target_bssid) {
  285. os_memcpy(pos, target_bssid, ETH_ALEN);
  286. pos += ETH_ALEN;
  287. }
  288. len = pos - (u8 *) &mgmt->u.action.category;
  289. wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  290. wpa_s->own_addr, wpa_s->bssid,
  291. &mgmt->u.action.category, len, 0);
  292. }
  293. static void ieee802_11_rx_bss_trans_mgmt_req(struct wpa_supplicant *wpa_s,
  294. const u8 *pos, const u8 *end,
  295. int reply)
  296. {
  297. u8 dialog_token;
  298. u8 mode;
  299. u16 disassoc_timer;
  300. if (pos + 5 > end)
  301. return;
  302. dialog_token = pos[0];
  303. mode = pos[1];
  304. disassoc_timer = WPA_GET_LE16(pos + 2);
  305. wpa_printf(MSG_DEBUG, "WNM: BSS Transition Management Request: "
  306. "dialog_token=%u request_mode=0x%x "
  307. "disassoc_timer=%u validity_interval=%u",
  308. dialog_token, mode, disassoc_timer, pos[4]);
  309. pos += 5;
  310. if (mode & 0x08)
  311. pos += 12; /* BSS Termination Duration */
  312. if (mode & 0x10) {
  313. char url[256];
  314. if (pos + 1 > end || pos + 1 + pos[0] > end) {
  315. wpa_printf(MSG_DEBUG, "WNM: Invalid BSS Transition "
  316. "Management Request (URL)");
  317. return;
  318. }
  319. os_memcpy(url, pos + 1, pos[0]);
  320. url[pos[0]] = '\0';
  321. wpa_msg(wpa_s, MSG_INFO, "WNM: ESS Disassociation Imminent - "
  322. "session_info_url=%s", url);
  323. }
  324. if (mode & 0x04) {
  325. wpa_msg(wpa_s, MSG_INFO, "WNM: Disassociation Imminent - "
  326. "Disassociation Timer %u", disassoc_timer);
  327. if (disassoc_timer && !wpa_s->scanning) {
  328. /* TODO: mark current BSS less preferred for
  329. * selection */
  330. wpa_printf(MSG_DEBUG, "Trying to find another BSS");
  331. wpa_supplicant_req_scan(wpa_s, 0, 0);
  332. }
  333. }
  334. if (reply) {
  335. /* TODO: add support for reporting Accept */
  336. wnm_send_bss_transition_mgmt_resp(wpa_s, dialog_token,
  337. 1 /* Reject - unspecified */,
  338. 0, NULL);
  339. }
  340. }
  341. void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
  342. struct rx_action *action)
  343. {
  344. const u8 *pos, *end;
  345. u8 act;
  346. if (action->data == NULL || action->len == 0)
  347. return;
  348. pos = action->data;
  349. end = pos + action->len;
  350. act = *pos++;
  351. wpa_printf(MSG_DEBUG, "WNM: RX action %u from " MACSTR,
  352. act, MAC2STR(action->sa));
  353. if (wpa_s->wpa_state < WPA_ASSOCIATED ||
  354. os_memcmp(action->sa, wpa_s->bssid, ETH_ALEN) != 0) {
  355. wpa_printf(MSG_DEBUG, "WNM: Ignore unexpected WNM Action "
  356. "frame");
  357. return;
  358. }
  359. switch (act) {
  360. case WNM_BSS_TRANS_MGMT_REQ:
  361. ieee802_11_rx_bss_trans_mgmt_req(wpa_s, pos, end,
  362. !(action->da[0] & 0x01));
  363. break;
  364. case WNM_SLEEP_MODE_RESP:
  365. ieee802_11_rx_wnmsleep_resp(wpa_s, action->data, action->len);
  366. break;
  367. default:
  368. break;
  369. }
  370. }