wnm_sta.c 8.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310
  1. /*
  2. * wpa_supplicant - WNM
  3. * Copyright (c) 2011-2012, Qualcomm Atheros, Inc.
  4. *
  5. * This software may be distributed under the terms of the BSD license.
  6. * See README for more details.
  7. */
  8. #include "utils/includes.h"
  9. #include "utils/common.h"
  10. #include "common/ieee802_11_defs.h"
  11. #include "rsn_supp/wpa.h"
  12. #include "wpa_supplicant_i.h"
  13. #include "driver_i.h"
  14. #define MAX_TFS_IE_LEN 1024
  15. /* get the TFS IE from driver */
  16. static int ieee80211_11_get_tfs_ie(struct wpa_supplicant *wpa_s, u8 *buf,
  17. u16 *buf_len, enum wnm_oper oper)
  18. {
  19. wpa_printf(MSG_DEBUG, "%s: TFS get operation %d", __func__, oper);
  20. return wpa_drv_wnm_oper(wpa_s, oper, wpa_s->bssid, buf, buf_len);
  21. }
  22. /* set the TFS IE to driver */
  23. static int ieee80211_11_set_tfs_ie(struct wpa_supplicant *wpa_s,
  24. const u8 *addr, u8 *buf, u16 *buf_len,
  25. enum wnm_oper oper)
  26. {
  27. wpa_printf(MSG_DEBUG, "%s: TFS set operation %d", __func__, oper);
  28. return wpa_drv_wnm_oper(wpa_s, oper, addr, buf, buf_len);
  29. }
  30. /* MLME-SLEEPMODE.request */
  31. int ieee802_11_send_wnmsleep_req(struct wpa_supplicant *wpa_s,
  32. u8 action, u16 intval, struct wpabuf *tfs_req)
  33. {
  34. struct ieee80211_mgmt *mgmt;
  35. int res;
  36. size_t len;
  37. struct wnm_sleep_element *wnmsleep_ie;
  38. u8 *wnmtfs_ie;
  39. u8 wnmsleep_ie_len;
  40. u16 wnmtfs_ie_len; /* possibly multiple IE(s) */
  41. enum wnm_oper tfs_oper = action == 0 ? WNM_SLEEP_TFS_REQ_IE_ADD :
  42. WNM_SLEEP_TFS_REQ_IE_NONE;
  43. wpa_printf(MSG_DEBUG, "WNM: Request to send WNM-Sleep Mode Request "
  44. "action=%s to " MACSTR,
  45. action == 0 ? "enter" : "exit",
  46. MAC2STR(wpa_s->bssid));
  47. /* WNM-Sleep Mode IE */
  48. wnmsleep_ie_len = sizeof(struct wnm_sleep_element);
  49. wnmsleep_ie = os_zalloc(sizeof(struct wnm_sleep_element));
  50. if (wnmsleep_ie == NULL)
  51. return -1;
  52. wnmsleep_ie->eid = WLAN_EID_WNMSLEEP;
  53. wnmsleep_ie->len = wnmsleep_ie_len - 2;
  54. wnmsleep_ie->action_type = action;
  55. wnmsleep_ie->status = WNM_STATUS_SLEEP_ACCEPT;
  56. wnmsleep_ie->intval = host_to_le16(intval);
  57. wpa_hexdump(MSG_DEBUG, "WNM: WNM-Sleep Mode element",
  58. (u8 *) wnmsleep_ie, wnmsleep_ie_len);
  59. /* TFS IE(s) */
  60. if (tfs_req) {
  61. wnmtfs_ie_len = wpabuf_len(tfs_req);
  62. wnmtfs_ie = os_malloc(wnmtfs_ie_len);
  63. if (wnmtfs_ie == NULL) {
  64. os_free(wnmsleep_ie);
  65. return -1;
  66. }
  67. os_memcpy(wnmtfs_ie, wpabuf_head(tfs_req), wnmtfs_ie_len);
  68. } else {
  69. wnmtfs_ie = os_zalloc(MAX_TFS_IE_LEN);
  70. if (wnmtfs_ie == NULL) {
  71. os_free(wnmsleep_ie);
  72. return -1;
  73. }
  74. if (ieee80211_11_get_tfs_ie(wpa_s, wnmtfs_ie, &wnmtfs_ie_len,
  75. tfs_oper)) {
  76. wnmtfs_ie_len = 0;
  77. os_free(wnmtfs_ie);
  78. wnmtfs_ie = NULL;
  79. }
  80. }
  81. wpa_hexdump(MSG_DEBUG, "WNM: TFS Request element",
  82. (u8 *) wnmtfs_ie, wnmtfs_ie_len);
  83. mgmt = os_zalloc(sizeof(*mgmt) + wnmsleep_ie_len + wnmtfs_ie_len);
  84. if (mgmt == NULL) {
  85. wpa_printf(MSG_DEBUG, "MLME: Failed to allocate buffer for "
  86. "WNM-Sleep Request action frame");
  87. os_free(wnmsleep_ie);
  88. os_free(wnmtfs_ie);
  89. return -1;
  90. }
  91. os_memcpy(mgmt->da, wpa_s->bssid, ETH_ALEN);
  92. os_memcpy(mgmt->sa, wpa_s->own_addr, ETH_ALEN);
  93. os_memcpy(mgmt->bssid, wpa_s->bssid, ETH_ALEN);
  94. mgmt->frame_control = IEEE80211_FC(WLAN_FC_TYPE_MGMT,
  95. WLAN_FC_STYPE_ACTION);
  96. mgmt->u.action.category = WLAN_ACTION_WNM;
  97. mgmt->u.action.u.wnm_sleep_req.action = WNM_SLEEP_MODE_REQ;
  98. mgmt->u.action.u.wnm_sleep_req.dialogtoken = 1;
  99. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable, wnmsleep_ie,
  100. wnmsleep_ie_len);
  101. /* copy TFS IE here */
  102. if (wnmtfs_ie_len > 0) {
  103. os_memcpy(mgmt->u.action.u.wnm_sleep_req.variable +
  104. wnmsleep_ie_len, wnmtfs_ie, wnmtfs_ie_len);
  105. }
  106. len = 1 + sizeof(mgmt->u.action.u.wnm_sleep_req) + wnmsleep_ie_len +
  107. wnmtfs_ie_len;
  108. res = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
  109. wpa_s->own_addr, wpa_s->bssid,
  110. &mgmt->u.action.category, len, 0);
  111. if (res < 0)
  112. wpa_printf(MSG_DEBUG, "Failed to send WNM-Sleep Request "
  113. "(action=%d, intval=%d)", action, intval);
  114. os_free(wnmsleep_ie);
  115. os_free(wnmtfs_ie);
  116. os_free(mgmt);
  117. return res;
  118. }
  119. static void wnm_sleep_mode_enter_success(struct wpa_supplicant *wpa_s,
  120. u8 *tfsresp_ie_start,
  121. u8 *tfsresp_ie_end)
  122. {
  123. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_CONFIRM,
  124. wpa_s->bssid, NULL, NULL);
  125. /* remove GTK/IGTK ?? */
  126. /* set the TFS Resp IE(s) */
  127. if (tfsresp_ie_start && tfsresp_ie_end &&
  128. tfsresp_ie_end - tfsresp_ie_start >= 0) {
  129. u16 tfsresp_ie_len;
  130. tfsresp_ie_len = (tfsresp_ie_end + tfsresp_ie_end[1] + 2) -
  131. tfsresp_ie_start;
  132. wpa_printf(MSG_DEBUG, "TFS Resp IE(s) found");
  133. /* pass the TFS Resp IE(s) to driver for processing */
  134. if (ieee80211_11_set_tfs_ie(wpa_s, wpa_s->bssid,
  135. tfsresp_ie_start,
  136. &tfsresp_ie_len,
  137. WNM_SLEEP_TFS_RESP_IE_SET))
  138. wpa_printf(MSG_DEBUG, "WNM: Fail to set TFS Resp IE");
  139. }
  140. }
  141. static void wnm_sleep_mode_exit_success(struct wpa_supplicant *wpa_s,
  142. const u8 *frm, u16 key_len_total)
  143. {
  144. u8 *ptr, *end;
  145. u8 gtk_len;
  146. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_CONFIRM, wpa_s->bssid,
  147. NULL, NULL);
  148. /* Install GTK/IGTK */
  149. /* point to key data field */
  150. ptr = (u8 *) frm + 1 + 1 + 2;
  151. end = ptr + key_len_total;
  152. wpa_hexdump_key(MSG_DEBUG, "WNM: Key Data", ptr, key_len_total);
  153. while (ptr + 1 < end) {
  154. if (ptr + 2 + ptr[1] > end) {
  155. wpa_printf(MSG_DEBUG, "WNM: Invalid Key Data element "
  156. "length");
  157. if (end > ptr) {
  158. wpa_hexdump(MSG_DEBUG, "WNM: Remaining data",
  159. ptr, end - ptr);
  160. }
  161. break;
  162. }
  163. if (*ptr == WNM_SLEEP_SUBELEM_GTK) {
  164. if (ptr[1] < 11 + 5) {
  165. wpa_printf(MSG_DEBUG, "WNM: Too short GTK "
  166. "subelem");
  167. break;
  168. }
  169. gtk_len = *(ptr + 4);
  170. if (ptr[1] < 11 + gtk_len ||
  171. gtk_len < 5 || gtk_len > 32) {
  172. wpa_printf(MSG_DEBUG, "WNM: Invalid GTK "
  173. "subelem");
  174. break;
  175. }
  176. wpa_wnmsleep_install_key(
  177. wpa_s->wpa,
  178. WNM_SLEEP_SUBELEM_GTK,
  179. ptr);
  180. ptr += 13 + gtk_len;
  181. #ifdef CONFIG_IEEE80211W
  182. } else if (*ptr == WNM_SLEEP_SUBELEM_IGTK) {
  183. if (ptr[1] < 2 + 6 + WPA_IGTK_LEN) {
  184. wpa_printf(MSG_DEBUG, "WNM: Too short IGTK "
  185. "subelem");
  186. break;
  187. }
  188. wpa_wnmsleep_install_key(wpa_s->wpa,
  189. WNM_SLEEP_SUBELEM_IGTK, ptr);
  190. ptr += 10 + WPA_IGTK_LEN;
  191. #endif /* CONFIG_IEEE80211W */
  192. } else
  193. break; /* skip the loop */
  194. }
  195. }
  196. static void ieee802_11_rx_wnmsleep_resp(struct wpa_supplicant *wpa_s,
  197. const u8 *frm, int len)
  198. {
  199. /*
  200. * Action [1] | Diaglog Token [1] | Key Data Len [2] | Key Data |
  201. * WNM-Sleep Mode IE | TFS Response IE
  202. */
  203. u8 *pos = (u8 *) frm; /* point to action field */
  204. u16 key_len_total = le_to_host16(*((u16 *)(frm+2)));
  205. struct wnm_sleep_element *wnmsleep_ie = NULL;
  206. /* multiple TFS Resp IE (assuming consecutive) */
  207. u8 *tfsresp_ie_start = NULL;
  208. u8 *tfsresp_ie_end = NULL;
  209. wpa_printf(MSG_DEBUG, "action=%d token = %d key_len_total = %d",
  210. frm[0], frm[1], key_len_total);
  211. pos += 4 + key_len_total;
  212. if (pos > frm + len) {
  213. wpa_printf(MSG_INFO, "WNM: Too short frame for Key Data field");
  214. return;
  215. }
  216. while (pos - frm < len) {
  217. u8 ie_len = *(pos + 1);
  218. if (pos + 2 + ie_len > frm + len) {
  219. wpa_printf(MSG_INFO, "WNM: Invalid IE len %u", ie_len);
  220. break;
  221. }
  222. wpa_hexdump(MSG_DEBUG, "WNM: Element", pos, 2 + ie_len);
  223. if (*pos == WLAN_EID_WNMSLEEP)
  224. wnmsleep_ie = (struct wnm_sleep_element *) pos;
  225. else if (*pos == WLAN_EID_TFS_RESP) {
  226. if (!tfsresp_ie_start)
  227. tfsresp_ie_start = pos;
  228. tfsresp_ie_end = pos;
  229. } else
  230. wpa_printf(MSG_DEBUG, "EID %d not recognized", *pos);
  231. pos += ie_len + 2;
  232. }
  233. if (!wnmsleep_ie) {
  234. wpa_printf(MSG_DEBUG, "No WNM-Sleep IE found");
  235. return;
  236. }
  237. if (wnmsleep_ie->status == WNM_STATUS_SLEEP_ACCEPT ||
  238. wnmsleep_ie->status == WNM_STATUS_SLEEP_EXIT_ACCEPT_GTK_UPDATE) {
  239. wpa_printf(MSG_DEBUG, "Successfully recv WNM-Sleep Response "
  240. "frame (action=%d, intval=%d)",
  241. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  242. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER) {
  243. wnm_sleep_mode_enter_success(wpa_s, tfsresp_ie_start,
  244. tfsresp_ie_end);
  245. } else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT) {
  246. wnm_sleep_mode_exit_success(wpa_s, frm, key_len_total);
  247. }
  248. } else {
  249. wpa_printf(MSG_DEBUG, "Reject recv WNM-Sleep Response frame "
  250. "(action=%d, intval=%d)",
  251. wnmsleep_ie->action_type, wnmsleep_ie->intval);
  252. if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_ENTER)
  253. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_ENTER_FAIL,
  254. wpa_s->bssid, NULL, NULL);
  255. else if (wnmsleep_ie->action_type == WNM_SLEEP_MODE_EXIT)
  256. wpa_drv_wnm_oper(wpa_s, WNM_SLEEP_EXIT_FAIL,
  257. wpa_s->bssid, NULL, NULL);
  258. }
  259. }
  260. void ieee802_11_rx_wnm_action(struct wpa_supplicant *wpa_s,
  261. struct rx_action *action)
  262. {
  263. u8 *pos = (u8 *) action->data; /* point to action field */
  264. u8 act = *pos++;
  265. /* u8 dialog_token = *pos++; */
  266. switch (act) {
  267. case WNM_SLEEP_MODE_RESP:
  268. ieee802_11_rx_wnmsleep_resp(wpa_s, action->data, action->len);
  269. break;
  270. default:
  271. break;
  272. }
  273. }