1 /*
2 * WPA Supplicant - Basic mesh peer management
3 * Copyright (c) 2013-2014, cozybit, Inc. All rights reserved.
4 *
5 * This software may be distributed under the terms of the BSD license.
6 * See README for more details.
7 */
8
9 #include "utils/includes.h"
10
11 #include "utils/common.h"
12 #include "utils/eloop.h"
13 #include "common/ieee802_11_defs.h"
14 #include "common/hw_features_common.h"
15 #include "common/ocv.h"
16 #include "ap/hostapd.h"
17 #include "ap/sta_info.h"
18 #include "ap/ieee802_11.h"
19 #include "ap/wpa_auth.h"
20 #include "wpa_supplicant_i.h"
21 #include "driver_i.h"
22 #include "mesh_mpm.h"
23 #include "mesh_rsn.h"
24 #include "notify.h"
25
26 struct mesh_peer_mgmt_ie {
27 const u8 *proto_id; /* Mesh Peering Protocol Identifier (2 octets) */
28 const u8 *llid; /* Local Link ID (2 octets) */
29 const u8 *plid; /* Peer Link ID (conditional, 2 octets) */
30 const u8 *reason; /* Reason Code (conditional, 2 octets) */
31 const u8 *chosen_pmk; /* Chosen PMK (optional, 16 octets) */
32 };
33
34 static void plink_timer(void *eloop_ctx, void *user_data);
35
36
37 enum plink_event {
38 PLINK_UNDEFINED,
39 OPN_ACPT,
40 OPN_RJCT,
41 CNF_ACPT,
42 CNF_RJCT,
43 CLS_ACPT,
44 REQ_RJCT
45 };
46
47 static const char * const mplstate[] = {
48 [0] = "UNINITIALIZED",
49 [PLINK_IDLE] = "IDLE",
50 [PLINK_OPN_SNT] = "OPN_SNT",
51 [PLINK_OPN_RCVD] = "OPN_RCVD",
52 [PLINK_CNF_RCVD] = "CNF_RCVD",
53 [PLINK_ESTAB] = "ESTAB",
54 [PLINK_HOLDING] = "HOLDING",
55 [PLINK_BLOCKED] = "BLOCKED"
56 };
57
58 static const char * const mplevent[] = {
59 [PLINK_UNDEFINED] = "UNDEFINED",
60 [OPN_ACPT] = "OPN_ACPT",
61 [OPN_RJCT] = "OPN_RJCT",
62 [CNF_ACPT] = "CNF_ACPT",
63 [CNF_RJCT] = "CNF_RJCT",
64 [CLS_ACPT] = "CLS_ACPT",
65 [REQ_RJCT] = "REQ_RJCT",
66 };
67
68
mesh_mpm_parse_peer_mgmt(struct wpa_supplicant * wpa_s,u8 action_field,const u8 * ie,size_t len,struct mesh_peer_mgmt_ie * mpm_ie)69 static int mesh_mpm_parse_peer_mgmt(struct wpa_supplicant *wpa_s,
70 u8 action_field,
71 const u8 *ie, size_t len,
72 struct mesh_peer_mgmt_ie *mpm_ie)
73 {
74 os_memset(mpm_ie, 0, sizeof(*mpm_ie));
75
76 /* Remove optional Chosen PMK field at end */
77 if (len >= SAE_PMKID_LEN) {
78 mpm_ie->chosen_pmk = ie + len - SAE_PMKID_LEN;
79 len -= SAE_PMKID_LEN;
80 }
81
82 if ((action_field == PLINK_OPEN && len != 4) ||
83 (action_field == PLINK_CONFIRM && len != 6) ||
84 (action_field == PLINK_CLOSE && len != 6 && len != 8)) {
85 wpa_msg(wpa_s, MSG_DEBUG, "MPM: Invalid peer mgmt ie");
86 return -1;
87 }
88
89 /* required fields */
90 if (len < 4)
91 return -1;
92 mpm_ie->proto_id = ie;
93 mpm_ie->llid = ie + 2;
94 ie += 4;
95 len -= 4;
96
97 /* close reason is always present at end for close */
98 if (action_field == PLINK_CLOSE) {
99 if (len < 2)
100 return -1;
101 mpm_ie->reason = ie + len - 2;
102 len -= 2;
103 }
104
105 /* Peer Link ID, present for confirm, and possibly close */
106 if (len >= 2)
107 mpm_ie->plid = ie;
108
109 return 0;
110 }
111
112
plink_free_count(struct hostapd_data * hapd)113 static int plink_free_count(struct hostapd_data *hapd)
114 {
115 if (hapd->max_plinks > hapd->num_plinks)
116 return hapd->max_plinks - hapd->num_plinks;
117 return 0;
118 }
119
120
copy_supp_rates(struct wpa_supplicant * wpa_s,struct sta_info * sta,struct ieee802_11_elems * elems)121 static u16 copy_supp_rates(struct wpa_supplicant *wpa_s,
122 struct sta_info *sta,
123 struct ieee802_11_elems *elems)
124 {
125 if (!elems->supp_rates) {
126 wpa_msg(wpa_s, MSG_ERROR, "no supported rates from " MACSTR,
127 MAC2STR(sta->addr));
128 return WLAN_STATUS_UNSPECIFIED_FAILURE;
129 }
130
131 if (elems->supp_rates_len + elems->ext_supp_rates_len >
132 sizeof(sta->supported_rates)) {
133 wpa_msg(wpa_s, MSG_ERROR,
134 "Invalid supported rates element length " MACSTR
135 " %d+%d", MAC2STR(sta->addr), elems->supp_rates_len,
136 elems->ext_supp_rates_len);
137 return WLAN_STATUS_UNSPECIFIED_FAILURE;
138 }
139
140 sta->supported_rates_len = merge_byte_arrays(
141 sta->supported_rates, sizeof(sta->supported_rates),
142 elems->supp_rates, elems->supp_rates_len,
143 elems->ext_supp_rates, elems->ext_supp_rates_len);
144
145 return WLAN_STATUS_SUCCESS;
146 }
147
148
149 /* return true if elems from a neighbor match this MBSS */
matches_local(struct wpa_supplicant * wpa_s,struct ieee802_11_elems * elems)150 static bool matches_local(struct wpa_supplicant *wpa_s,
151 struct ieee802_11_elems *elems)
152 {
153 struct mesh_conf *mconf = wpa_s->ifmsh->mconf;
154
155 if (elems->mesh_config_len < 5)
156 return false;
157
158 return (mconf->meshid_len == elems->mesh_id_len &&
159 os_memcmp(mconf->meshid, elems->mesh_id,
160 elems->mesh_id_len) == 0 &&
161 mconf->mesh_pp_id == elems->mesh_config[0] &&
162 mconf->mesh_pm_id == elems->mesh_config[1] &&
163 mconf->mesh_cc_id == elems->mesh_config[2] &&
164 mconf->mesh_sp_id == elems->mesh_config[3] &&
165 mconf->mesh_auth_id == elems->mesh_config[4]);
166 }
167
168
169 /* check if local link id is already used with another peer */
llid_in_use(struct wpa_supplicant * wpa_s,u16 llid)170 static bool llid_in_use(struct wpa_supplicant *wpa_s, u16 llid)
171 {
172 struct sta_info *sta;
173 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
174
175 for (sta = hapd->sta_list; sta; sta = sta->next) {
176 if (sta->my_lid == llid)
177 return true;
178 }
179
180 return false;
181 }
182
183
184 /* generate an llid for a link and set to initial state */
mesh_mpm_init_link(struct wpa_supplicant * wpa_s,struct sta_info * sta)185 static void mesh_mpm_init_link(struct wpa_supplicant *wpa_s,
186 struct sta_info *sta)
187 {
188 u16 llid;
189
190 do {
191 if (os_get_random((u8 *) &llid, sizeof(llid)) < 0)
192 llid = 0; /* continue */
193 } while (!llid || llid_in_use(wpa_s, llid));
194
195 sta->my_lid = llid;
196 sta->peer_lid = 0;
197 sta->peer_aid = 0;
198
199 /*
200 * We do not use wpa_mesh_set_plink_state() here because there is no
201 * entry in kernel yet.
202 */
203 sta->plink_state = PLINK_IDLE;
204 }
205
206
mesh_mpm_send_plink_action(struct wpa_supplicant * wpa_s,struct sta_info * sta,enum plink_action_field type,u16 close_reason)207 static void mesh_mpm_send_plink_action(struct wpa_supplicant *wpa_s,
208 struct sta_info *sta,
209 enum plink_action_field type,
210 u16 close_reason)
211 {
212 struct wpabuf *buf;
213 struct hostapd_iface *ifmsh = wpa_s->ifmsh;
214 struct hostapd_data *bss = ifmsh->bss[0];
215 struct mesh_conf *conf = ifmsh->mconf;
216 u8 supp_rates[2 + 2 + 32];
217 u8 *pos, *cat;
218 u8 ie_len, add_plid = 0;
219 int ret;
220 int ampe = conf->security & MESH_CONF_SEC_AMPE;
221 size_t buf_len;
222
223 if (!sta)
224 return;
225
226 buf_len = 2 + /* Category and Action */
227 2 + /* capability info */
228 2 + /* AID */
229 2 + 8 + /* supported rates */
230 2 + (32 - 8) +
231 2 + 32 + /* mesh ID */
232 2 + 7 + /* mesh config */
233 2 + 24 + /* peering management */
234 2 + 96 + 32 + 32 + /* AMPE (96 + max GTKlen + max IGTKlen) */
235 2 + 16; /* MIC */
236 if (type != PLINK_CLOSE && wpa_s->mesh_ht_enabled) {
237 buf_len += 2 + 26 + /* HT capabilities */
238 2 + 22; /* HT operation */
239 }
240 #ifdef CONFIG_IEEE80211AC
241 if (type != PLINK_CLOSE && wpa_s->mesh_vht_enabled) {
242 buf_len += 2 + 12 + /* VHT Capabilities */
243 2 + 5; /* VHT Operation */
244 }
245 #endif /* CONFIG_IEEE80211AC */
246 #ifdef CONFIG_IEEE80211AX
247 if (type != PLINK_CLOSE && wpa_s->mesh_he_enabled) {
248 buf_len += 3 +
249 HE_MAX_MAC_CAPAB_SIZE +
250 HE_MAX_PHY_CAPAB_SIZE +
251 HE_MAX_MCS_CAPAB_SIZE +
252 HE_MAX_PPET_CAPAB_SIZE;
253 buf_len += 3 + sizeof(struct ieee80211_he_operation);
254 if (is_6ghz_op_class(bss->iconf->op_class))
255 buf_len += sizeof(struct ieee80211_he_6ghz_oper_info) +
256 3 + sizeof(struct ieee80211_he_6ghz_band_cap);
257 }
258 #endif /* CONFIG_IEEE80211AX */
259 if (type != PLINK_CLOSE)
260 buf_len += conf->rsn_ie_len; /* RSN IE */
261 #ifdef CONFIG_OCV
262 /* OCI is included even when the other STA doesn't support OCV */
263 if (type != PLINK_CLOSE && conf->ocv)
264 buf_len += OCV_OCI_EXTENDED_LEN;
265 #endif /* CONFIG_OCV */
266 #ifdef CONFIG_IEEE80211BE
267 if (type != PLINK_CLOSE && wpa_s->mesh_eht_enabled) {
268 buf_len += 3 + 2 + EHT_PHY_CAPAB_LEN + EHT_MCS_NSS_CAPAB_LEN +
269 EHT_PPE_THRESH_CAPAB_LEN;
270 buf_len += 3 + sizeof(struct ieee80211_eht_operation);
271 }
272 #endif /* CONFIG_IEEE80211BE */
273
274 buf = wpabuf_alloc(buf_len);
275 if (!buf)
276 return;
277
278 cat = wpabuf_mhead_u8(buf);
279 wpabuf_put_u8(buf, WLAN_ACTION_SELF_PROTECTED);
280 wpabuf_put_u8(buf, type);
281
282 if (type != PLINK_CLOSE) {
283 u8 info;
284
285 /* capability info */
286 wpabuf_put_le16(buf, ampe ? IEEE80211_CAP_PRIVACY : 0);
287
288 /* aid */
289 if (type == PLINK_CONFIRM)
290 wpabuf_put_le16(buf, sta->aid);
291
292 /* IE: supp + ext. supp rates */
293 pos = hostapd_eid_supp_rates(bss, supp_rates);
294 pos = hostapd_eid_ext_supp_rates(bss, pos);
295 wpabuf_put_data(buf, supp_rates, pos - supp_rates);
296
297 /* IE: RSN IE */
298 wpabuf_put_data(buf, conf->rsn_ie, conf->rsn_ie_len);
299
300 /* IE: Mesh ID */
301 wpabuf_put_u8(buf, WLAN_EID_MESH_ID);
302 wpabuf_put_u8(buf, conf->meshid_len);
303 wpabuf_put_data(buf, conf->meshid, conf->meshid_len);
304
305 /* IE: mesh conf */
306 wpabuf_put_u8(buf, WLAN_EID_MESH_CONFIG);
307 wpabuf_put_u8(buf, 7);
308 wpabuf_put_u8(buf, conf->mesh_pp_id);
309 wpabuf_put_u8(buf, conf->mesh_pm_id);
310 wpabuf_put_u8(buf, conf->mesh_cc_id);
311 wpabuf_put_u8(buf, conf->mesh_sp_id);
312 wpabuf_put_u8(buf, conf->mesh_auth_id);
313 info = (bss->num_plinks > 63 ? 63 : bss->num_plinks) << 1;
314 /* TODO: Add Connected to Mesh Gate/AS subfields */
315 wpabuf_put_u8(buf, info);
316 /* Set forwarding based on configuration and always accept
317 * plinks for now */
318 wpabuf_put_u8(buf, MESH_CAP_ACCEPT_ADDITIONAL_PEER |
319 (conf->mesh_fwding ? MESH_CAP_FORWARDING : 0));
320 } else { /* Peer closing frame */
321 /* IE: Mesh ID */
322 wpabuf_put_u8(buf, WLAN_EID_MESH_ID);
323 wpabuf_put_u8(buf, conf->meshid_len);
324 wpabuf_put_data(buf, conf->meshid, conf->meshid_len);
325 }
326
327 /* IE: Mesh Peering Management element */
328 ie_len = 4;
329 if (ampe)
330 ie_len += PMKID_LEN;
331 switch (type) {
332 case PLINK_OPEN:
333 break;
334 case PLINK_CONFIRM:
335 ie_len += 2;
336 add_plid = 1;
337 break;
338 case PLINK_CLOSE:
339 ie_len += 2;
340 add_plid = 1;
341 ie_len += 2; /* reason code */
342 break;
343 }
344
345 wpabuf_put_u8(buf, WLAN_EID_PEER_MGMT);
346 wpabuf_put_u8(buf, ie_len);
347 /* peering protocol */
348 if (ampe)
349 wpabuf_put_le16(buf, 1);
350 else
351 wpabuf_put_le16(buf, 0);
352 wpabuf_put_le16(buf, sta->my_lid);
353 if (add_plid)
354 wpabuf_put_le16(buf, sta->peer_lid);
355 if (type == PLINK_CLOSE)
356 wpabuf_put_le16(buf, close_reason);
357 if (ampe) {
358 if (sta->sae == NULL) {
359 wpa_msg(wpa_s, MSG_INFO, "Mesh MPM: no SAE session");
360 goto fail;
361 }
362 mesh_rsn_get_pmkid(wpa_s->mesh_rsn, sta,
363 wpabuf_put(buf, PMKID_LEN));
364 }
365
366 if (type != PLINK_CLOSE && wpa_s->mesh_ht_enabled) {
367 u8 ht_capa_oper[2 + 26 + 2 + 22];
368
369 pos = hostapd_eid_ht_capabilities(bss, ht_capa_oper);
370 pos = hostapd_eid_ht_operation(bss, pos);
371 wpabuf_put_data(buf, ht_capa_oper, pos - ht_capa_oper);
372 }
373 #ifdef CONFIG_IEEE80211AC
374 if (type != PLINK_CLOSE && wpa_s->mesh_vht_enabled) {
375 u8 vht_capa_oper[2 + 12 + 2 + 5];
376
377 pos = hostapd_eid_vht_capabilities(bss, vht_capa_oper, 0);
378 pos = hostapd_eid_vht_operation(bss, pos);
379 wpabuf_put_data(buf, vht_capa_oper, pos - vht_capa_oper);
380 }
381 #endif /* CONFIG_IEEE80211AC */
382 #ifdef CONFIG_IEEE80211AX
383 if (type != PLINK_CLOSE && wpa_s->mesh_he_enabled) {
384 u8 he_capa_oper[3 +
385 HE_MAX_MAC_CAPAB_SIZE +
386 HE_MAX_PHY_CAPAB_SIZE +
387 HE_MAX_MCS_CAPAB_SIZE +
388 HE_MAX_PPET_CAPAB_SIZE +
389 3 + sizeof(struct ieee80211_he_operation) +
390 sizeof(struct ieee80211_he_6ghz_oper_info) +
391 3 + sizeof(struct ieee80211_he_6ghz_band_cap)];
392
393 pos = hostapd_eid_he_capab(bss, he_capa_oper,
394 IEEE80211_MODE_MESH);
395 pos = hostapd_eid_he_operation(bss, pos);
396 pos = hostapd_eid_he_6ghz_band_cap(bss, pos);
397 wpabuf_put_data(buf, he_capa_oper, pos - he_capa_oper);
398 }
399 #endif /* CONFIG_IEEE80211AX */
400 #ifdef CONFIG_OCV
401 if (type != PLINK_CLOSE && conf->ocv) {
402 struct wpa_channel_info ci;
403
404 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
405 wpa_printf(MSG_WARNING,
406 "Mesh MPM: Failed to get channel info for OCI element");
407 goto fail;
408 }
409
410 pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
411 if (ocv_insert_extended_oci(&ci, pos) < 0)
412 goto fail;
413 }
414 #endif /* CONFIG_OCV */
415
416 #ifdef CONFIG_IEEE80211BE
417 if (type != PLINK_CLOSE && wpa_s->mesh_eht_enabled) {
418 u8 eht_capa_oper[3 +
419 2 +
420 EHT_PHY_CAPAB_LEN +
421 EHT_MCS_NSS_CAPAB_LEN +
422 EHT_PPE_THRESH_CAPAB_LEN +
423 3 + sizeof(struct ieee80211_eht_operation)];
424 pos = hostapd_eid_eht_capab(bss, eht_capa_oper,
425 IEEE80211_MODE_MESH);
426 pos = hostapd_eid_eht_operation(bss, pos);
427 wpabuf_put_data(buf, eht_capa_oper, pos - eht_capa_oper);
428 }
429 #endif /* CONFIG_IEEE80211BE */
430
431 if (ampe && mesh_rsn_protect_frame(wpa_s->mesh_rsn, sta, cat, buf)) {
432 wpa_msg(wpa_s, MSG_INFO,
433 "Mesh MPM: failed to add AMPE and MIC IE");
434 goto fail;
435 }
436
437 wpa_msg(wpa_s, MSG_DEBUG, "Mesh MPM: Sending peering frame type %d to "
438 MACSTR " (my_lid=0x%x peer_lid=0x%x)",
439 type, MAC2STR(sta->addr), sta->my_lid, sta->peer_lid);
440 ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0,
441 sta->addr, wpa_s->own_addr, wpa_s->own_addr,
442 wpabuf_head(buf), wpabuf_len(buf), 0);
443 if (ret < 0)
444 wpa_msg(wpa_s, MSG_INFO,
445 "Mesh MPM: failed to send peering frame");
446
447 fail:
448 wpabuf_free(buf);
449 }
450
451
452 /* configure peering state in ours and driver's station entry */
wpa_mesh_set_plink_state(struct wpa_supplicant * wpa_s,struct sta_info * sta,enum mesh_plink_state state)453 void wpa_mesh_set_plink_state(struct wpa_supplicant *wpa_s,
454 struct sta_info *sta,
455 enum mesh_plink_state state)
456 {
457 struct hostapd_sta_add_params params;
458 int ret;
459
460 wpa_msg(wpa_s, MSG_DEBUG, "MPM set " MACSTR " from %s into %s",
461 MAC2STR(sta->addr), mplstate[sta->plink_state],
462 mplstate[state]);
463 sta->plink_state = state;
464
465 os_memset(¶ms, 0, sizeof(params));
466 params.addr = sta->addr;
467 params.plink_state = state;
468 params.peer_aid = sta->peer_aid;
469 params.set = 1;
470
471 ret = wpa_drv_sta_add(wpa_s, ¶ms);
472 if (ret) {
473 wpa_msg(wpa_s, MSG_ERROR, "Driver failed to set " MACSTR
474 ": %d", MAC2STR(sta->addr), ret);
475 }
476 }
477
478
mesh_mpm_fsm_restart(struct wpa_supplicant * wpa_s,struct sta_info * sta)479 static void mesh_mpm_fsm_restart(struct wpa_supplicant *wpa_s,
480 struct sta_info *sta)
481 {
482 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
483
484 eloop_cancel_timeout(plink_timer, wpa_s, sta);
485
486 ap_free_sta(hapd, sta);
487 }
488
489
plink_timer(void * eloop_ctx,void * user_data)490 static void plink_timer(void *eloop_ctx, void *user_data)
491 {
492 struct wpa_supplicant *wpa_s = eloop_ctx;
493 struct sta_info *sta = user_data;
494 u16 reason = 0;
495 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
496 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
497
498 switch (sta->plink_state) {
499 case PLINK_OPN_RCVD:
500 case PLINK_OPN_SNT:
501 /* retry timer */
502 if (sta->mpm_retries < conf->dot11MeshMaxRetries) {
503 eloop_register_timeout(
504 conf->dot11MeshRetryTimeout / 1000,
505 (conf->dot11MeshRetryTimeout % 1000) * 1000,
506 plink_timer, wpa_s, sta);
507 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_OPEN, 0);
508 sta->mpm_retries++;
509 break;
510 }
511 reason = WLAN_REASON_MESH_MAX_RETRIES;
512 /* fall through */
513
514 case PLINK_CNF_RCVD:
515 /* confirm timer */
516 if (!reason)
517 reason = WLAN_REASON_MESH_CONFIRM_TIMEOUT;
518 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
519 eloop_register_timeout(conf->dot11MeshHoldingTimeout / 1000,
520 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
521 plink_timer, wpa_s, sta);
522 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CLOSE, reason);
523 break;
524 case PLINK_HOLDING:
525 /* holding timer */
526
527 if (sta->mesh_sae_pmksa_caching) {
528 wpa_printf(MSG_DEBUG, "MPM: Peer " MACSTR
529 " looks like it does not support mesh SAE PMKSA caching, so remove the cached entry for it",
530 MAC2STR(sta->addr));
531 wpa_auth_pmksa_remove(hapd->wpa_auth, sta->addr);
532 }
533 mesh_mpm_fsm_restart(wpa_s, sta);
534 break;
535 default:
536 break;
537 }
538 }
539
540
541 /* initiate peering with station */
542 static void
mesh_mpm_plink_open(struct wpa_supplicant * wpa_s,struct sta_info * sta,enum mesh_plink_state next_state)543 mesh_mpm_plink_open(struct wpa_supplicant *wpa_s, struct sta_info *sta,
544 enum mesh_plink_state next_state)
545 {
546 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
547
548 eloop_cancel_timeout(plink_timer, wpa_s, sta);
549 eloop_register_timeout(conf->dot11MeshRetryTimeout / 1000,
550 (conf->dot11MeshRetryTimeout % 1000) * 1000,
551 plink_timer, wpa_s, sta);
552 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_OPEN, 0);
553 wpa_mesh_set_plink_state(wpa_s, sta, next_state);
554 }
555
556
mesh_mpm_plink_close(struct hostapd_data * hapd,struct sta_info * sta,void * ctx)557 static int mesh_mpm_plink_close(struct hostapd_data *hapd, struct sta_info *sta,
558 void *ctx)
559 {
560 struct wpa_supplicant *wpa_s = ctx;
561 int reason = WLAN_REASON_MESH_PEERING_CANCELLED;
562
563 if (sta) {
564 if (sta->plink_state == PLINK_ESTAB)
565 hapd->num_plinks--;
566 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
567 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CLOSE, reason);
568 wpa_printf(MSG_DEBUG, "MPM closing plink sta=" MACSTR,
569 MAC2STR(sta->addr));
570 eloop_cancel_timeout(plink_timer, wpa_s, sta);
571 eloop_cancel_timeout(mesh_auth_timer, wpa_s, sta);
572 return 0;
573 }
574
575 return 1;
576 }
577
578
mesh_mpm_close_peer(struct wpa_supplicant * wpa_s,const u8 * addr)579 int mesh_mpm_close_peer(struct wpa_supplicant *wpa_s, const u8 *addr)
580 {
581 struct hostapd_data *hapd;
582 struct sta_info *sta;
583
584 if (!wpa_s->ifmsh) {
585 wpa_msg(wpa_s, MSG_INFO, "Mesh is not prepared yet");
586 return -1;
587 }
588
589 hapd = wpa_s->ifmsh->bss[0];
590 sta = ap_get_sta(hapd, addr);
591 if (!sta) {
592 wpa_msg(wpa_s, MSG_INFO, "No such mesh peer");
593 return -1;
594 }
595
596 return mesh_mpm_plink_close(hapd, sta, wpa_s) == 0 ? 0 : -1;
597 }
598
599
peer_add_timer(void * eloop_ctx,void * user_data)600 static void peer_add_timer(void *eloop_ctx, void *user_data)
601 {
602 struct wpa_supplicant *wpa_s = eloop_ctx;
603 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
604
605 os_memset(hapd->mesh_required_peer, 0, ETH_ALEN);
606 }
607
608
mesh_mpm_connect_peer(struct wpa_supplicant * wpa_s,const u8 * addr,int duration)609 int mesh_mpm_connect_peer(struct wpa_supplicant *wpa_s, const u8 *addr,
610 int duration)
611 {
612 struct wpa_ssid *ssid = wpa_s->current_ssid;
613 struct hostapd_data *hapd;
614 struct sta_info *sta;
615 struct mesh_conf *conf;
616
617 if (!wpa_s->ifmsh) {
618 wpa_msg(wpa_s, MSG_INFO, "Mesh is not prepared yet");
619 return -1;
620 }
621
622 if (!ssid || !ssid->no_auto_peer) {
623 wpa_msg(wpa_s, MSG_INFO,
624 "This command is available only with no_auto_peer mesh network");
625 return -1;
626 }
627
628 hapd = wpa_s->ifmsh->bss[0];
629 conf = wpa_s->ifmsh->mconf;
630
631 sta = ap_get_sta(hapd, addr);
632 if (!sta) {
633 wpa_msg(wpa_s, MSG_INFO, "No such mesh peer");
634 return -1;
635 }
636
637 if ((PLINK_OPN_SNT <= sta->plink_state &&
638 sta->plink_state <= PLINK_ESTAB) ||
639 (sta->sae && sta->sae->state > SAE_NOTHING)) {
640 wpa_msg(wpa_s, MSG_INFO,
641 "Specified peer is connecting/connected");
642 return -1;
643 }
644
645 if (conf->security == MESH_CONF_SEC_NONE) {
646 mesh_mpm_plink_open(wpa_s, sta, PLINK_OPN_SNT);
647 } else {
648 mesh_rsn_auth_sae_sta(wpa_s, sta);
649 os_memcpy(hapd->mesh_required_peer, addr, ETH_ALEN);
650 eloop_register_timeout(duration == -1 ? 10 : duration, 0,
651 peer_add_timer, wpa_s, NULL);
652 }
653
654 return 0;
655 }
656
657
mesh_mpm_deinit(struct wpa_supplicant * wpa_s,struct hostapd_iface * ifmsh)658 void mesh_mpm_deinit(struct wpa_supplicant *wpa_s, struct hostapd_iface *ifmsh)
659 {
660 struct hostapd_data *hapd = ifmsh->bss[0];
661
662 /* notify peers we're leaving */
663 ap_for_each_sta(hapd, mesh_mpm_plink_close, wpa_s);
664
665 hapd->num_plinks = 0;
666 hostapd_free_stas(hapd);
667 eloop_cancel_timeout(peer_add_timer, wpa_s, NULL);
668 }
669
670
671 /* for mesh_rsn to indicate this peer has completed authentication, and we're
672 * ready to start AMPE */
mesh_mpm_auth_peer(struct wpa_supplicant * wpa_s,const u8 * addr)673 void mesh_mpm_auth_peer(struct wpa_supplicant *wpa_s, const u8 *addr)
674 {
675 struct hostapd_data *data = wpa_s->ifmsh->bss[0];
676 struct hostapd_sta_add_params params;
677 struct sta_info *sta;
678 int ret;
679
680 sta = ap_get_sta(data, addr);
681 if (!sta) {
682 wpa_msg(wpa_s, MSG_DEBUG, "no such mesh peer");
683 return;
684 }
685
686 /* TODO: Should do nothing if this STA is already authenticated, but
687 * the AP code already sets this flag. */
688 sta->flags |= WLAN_STA_AUTH;
689
690 mesh_rsn_init_ampe_sta(wpa_s, sta);
691
692 os_memset(¶ms, 0, sizeof(params));
693 params.addr = sta->addr;
694 params.flags = WPA_STA_AUTHENTICATED | WPA_STA_AUTHORIZED;
695 params.set = 1;
696
697 wpa_msg(wpa_s, MSG_DEBUG, "MPM authenticating " MACSTR,
698 MAC2STR(sta->addr));
699 ret = wpa_drv_sta_add(wpa_s, ¶ms);
700 if (ret) {
701 wpa_msg(wpa_s, MSG_ERROR,
702 "Driver failed to set " MACSTR ": %d",
703 MAC2STR(sta->addr), ret);
704 }
705
706 if (!sta->my_lid)
707 mesh_mpm_init_link(wpa_s, sta);
708
709 mesh_mpm_plink_open(wpa_s, sta, PLINK_OPN_SNT);
710 }
711
712 /*
713 * Initialize a sta_info structure for a peer and upload it into the driver
714 * in preparation for beginning authentication or peering. This is done when a
715 * Beacon (secure or open mesh) or a peering open frame (for open mesh) is
716 * received from the peer for the first time.
717 */
mesh_mpm_add_peer(struct wpa_supplicant * wpa_s,const u8 * addr,struct ieee802_11_elems * elems)718 static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
719 const u8 *addr,
720 struct ieee802_11_elems *elems)
721 {
722 struct hostapd_sta_add_params params;
723 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
724 struct hostapd_data *data = wpa_s->ifmsh->bss[0];
725 struct sta_info *sta;
726 struct ieee80211_ht_operation *oper;
727 int ret;
728
729 if (elems->mesh_config_len >= 7 &&
730 !(elems->mesh_config[6] & MESH_CAP_ACCEPT_ADDITIONAL_PEER)) {
731 wpa_msg(wpa_s, MSG_DEBUG,
732 "mesh: Ignore a crowded peer " MACSTR,
733 MAC2STR(addr));
734 return NULL;
735 }
736
737 sta = ap_get_sta(data, addr);
738 if (sta)
739 return NULL;
740
741 sta = ap_sta_add(data, addr);
742 if (!sta)
743 return NULL;
744
745 /* Set WMM by default since Mesh STAs are QoS STAs */
746 sta->flags |= WLAN_STA_WMM;
747
748 /* initialize sta */
749 if (copy_supp_rates(wpa_s, sta, elems)) {
750 ap_free_sta(data, sta);
751 return NULL;
752 }
753
754 if (!sta->my_lid)
755 mesh_mpm_init_link(wpa_s, sta);
756
757 copy_sta_ht_capab(data, sta, elems->ht_capabilities);
758
759 oper = (struct ieee80211_ht_operation *) elems->ht_operation;
760 if (oper &&
761 !(oper->ht_param & HT_INFO_HT_PARAM_STA_CHNL_WIDTH) &&
762 sta->ht_capabilities) {
763 wpa_msg(wpa_s, MSG_DEBUG, MACSTR
764 " does not support 40 MHz bandwidth",
765 MAC2STR(sta->addr));
766 set_disable_ht40(sta->ht_capabilities, 1);
767 }
768
769 update_ht_state(data, sta);
770
771 #ifdef CONFIG_IEEE80211AC
772 copy_sta_vht_capab(data, sta, elems->vht_capabilities);
773 copy_sta_vht_oper(data, sta, elems->vht_operation);
774 set_sta_vht_opmode(data, sta, elems->opmode_notif);
775 #endif /* CONFIG_IEEE80211AC */
776
777 #ifdef CONFIG_IEEE80211AX
778 copy_sta_he_capab(data, sta, IEEE80211_MODE_MESH,
779 elems->he_capabilities, elems->he_capabilities_len);
780 copy_sta_he_6ghz_capab(data, sta, elems->he_6ghz_band_cap);
781 #endif /* CONFIG_IEEE80211AX */
782 #ifdef CONFIG_IEEE80211BE
783 copy_sta_eht_capab(data, sta, IEEE80211_MODE_MESH,
784 elems->he_capabilities,
785 elems->he_capabilities_len,
786 elems->eht_capabilities,
787 elems->eht_capabilities_len);
788 #endif /*CONFIG_IEEE80211BE */
789
790 if (hostapd_get_aid(data, sta) < 0) {
791 wpa_msg(wpa_s, MSG_ERROR, "No AIDs available");
792 ap_free_sta(data, sta);
793 return NULL;
794 }
795
796 /* insert into driver */
797 os_memset(¶ms, 0, sizeof(params));
798 params.supp_rates = sta->supported_rates;
799 params.supp_rates_len = sta->supported_rates_len;
800 params.addr = addr;
801 params.plink_state = sta->plink_state;
802 params.aid = sta->aid;
803 params.peer_aid = sta->peer_aid;
804 params.listen_interval = 100;
805 params.ht_capabilities = sta->ht_capabilities;
806 params.vht_capabilities = sta->vht_capabilities;
807 params.he_capab = sta->he_capab;
808 params.he_capab_len = sta->he_capab_len;
809 params.he_6ghz_capab = sta->he_6ghz_capab;
810 params.eht_capab = sta->eht_capab;
811 params.eht_capab_len = sta->eht_capab_len;
812 params.flags |= WPA_STA_WMM;
813 params.flags_mask |= WPA_STA_AUTHENTICATED;
814 if (conf->security == MESH_CONF_SEC_NONE) {
815 params.flags |= WPA_STA_AUTHORIZED;
816 params.flags |= WPA_STA_AUTHENTICATED;
817 } else {
818 sta->flags |= WLAN_STA_MFP;
819 params.flags |= WPA_STA_MFP;
820 }
821
822 ret = wpa_drv_sta_add(wpa_s, ¶ms);
823 if (ret) {
824 wpa_msg(wpa_s, MSG_ERROR,
825 "Driver failed to insert " MACSTR ": %d",
826 MAC2STR(addr), ret);
827 ap_free_sta(data, sta);
828 return NULL;
829 }
830
831 return sta;
832 }
833
834
wpa_mesh_new_mesh_peer(struct wpa_supplicant * wpa_s,const u8 * addr,struct ieee802_11_elems * elems)835 void wpa_mesh_new_mesh_peer(struct wpa_supplicant *wpa_s, const u8 *addr,
836 struct ieee802_11_elems *elems)
837 {
838 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
839 struct hostapd_data *data = wpa_s->ifmsh->bss[0];
840 struct sta_info *sta;
841 struct wpa_ssid *ssid = wpa_s->current_ssid;
842
843 sta = mesh_mpm_add_peer(wpa_s, addr, elems);
844 if (!sta)
845 return;
846
847 if (ssid && ssid->no_auto_peer &&
848 (is_zero_ether_addr(data->mesh_required_peer) ||
849 os_memcmp(data->mesh_required_peer, addr, ETH_ALEN) != 0)) {
850 wpa_msg(wpa_s, MSG_INFO, "will not initiate new peer link with "
851 MACSTR " because of no_auto_peer", MAC2STR(addr));
852 if (data->mesh_pending_auth) {
853 struct os_reltime age;
854 const struct ieee80211_mgmt *mgmt;
855 struct hostapd_frame_info fi;
856
857 mgmt = wpabuf_head(data->mesh_pending_auth);
858 os_reltime_age(&data->mesh_pending_auth_time, &age);
859 if (age.sec < 2 &&
860 os_memcmp(mgmt->sa, addr, ETH_ALEN) == 0) {
861 wpa_printf(MSG_DEBUG,
862 "mesh: Process pending Authentication frame from %u.%06u seconds ago",
863 (unsigned int) age.sec,
864 (unsigned int) age.usec);
865 os_memset(&fi, 0, sizeof(fi));
866 ieee802_11_mgmt(
867 data,
868 wpabuf_head(data->mesh_pending_auth),
869 wpabuf_len(data->mesh_pending_auth),
870 &fi);
871 }
872 wpabuf_free(data->mesh_pending_auth);
873 data->mesh_pending_auth = NULL;
874 }
875 return;
876 }
877
878 if (conf->security == MESH_CONF_SEC_NONE) {
879 if (sta->plink_state < PLINK_OPN_SNT ||
880 sta->plink_state > PLINK_ESTAB)
881 mesh_mpm_plink_open(wpa_s, sta, PLINK_OPN_SNT);
882 } else {
883 mesh_rsn_auth_sae_sta(wpa_s, sta);
884 }
885 }
886
887
mesh_mpm_mgmt_rx(struct wpa_supplicant * wpa_s,struct rx_mgmt * rx_mgmt)888 void mesh_mpm_mgmt_rx(struct wpa_supplicant *wpa_s, struct rx_mgmt *rx_mgmt)
889 {
890 struct hostapd_frame_info fi;
891
892 os_memset(&fi, 0, sizeof(fi));
893 fi.datarate = rx_mgmt->datarate;
894 fi.ssi_signal = rx_mgmt->ssi_signal;
895 ieee802_11_mgmt(wpa_s->ifmsh->bss[0], rx_mgmt->frame,
896 rx_mgmt->frame_len, &fi);
897 }
898
899
mesh_mpm_plink_estab(struct wpa_supplicant * wpa_s,struct sta_info * sta)900 static void mesh_mpm_plink_estab(struct wpa_supplicant *wpa_s,
901 struct sta_info *sta)
902 {
903 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
904 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
905 u8 seq[6] = {};
906
907 wpa_msg(wpa_s, MSG_INFO, "mesh plink with " MACSTR " established",
908 MAC2STR(sta->addr));
909
910 if (conf->security & MESH_CONF_SEC_AMPE) {
911 wpa_hexdump_key(MSG_DEBUG, "mesh: MTK", sta->mtk, sta->mtk_len);
912 wpa_drv_set_key(wpa_s, -1,
913 wpa_cipher_to_alg(conf->pairwise_cipher),
914 sta->addr, 0, 0, seq, sizeof(seq),
915 sta->mtk, sta->mtk_len,
916 KEY_FLAG_PAIRWISE_RX_TX);
917
918 wpa_hexdump_key(MSG_DEBUG, "mesh: RX MGTK Key RSC",
919 sta->mgtk_rsc, sizeof(sta->mgtk_rsc));
920 wpa_hexdump_key(MSG_DEBUG, "mesh: RX MGTK",
921 sta->mgtk, sta->mgtk_len);
922 wpa_drv_set_key(wpa_s, -1,
923 wpa_cipher_to_alg(conf->group_cipher),
924 sta->addr, sta->mgtk_key_id, 0,
925 sta->mgtk_rsc, sizeof(sta->mgtk_rsc),
926 sta->mgtk, sta->mgtk_len,
927 KEY_FLAG_GROUP_RX);
928
929 if (sta->igtk_len) {
930 wpa_hexdump_key(MSG_DEBUG, "mesh: RX IGTK Key RSC",
931 sta->igtk_rsc, sizeof(sta->igtk_rsc));
932 wpa_hexdump_key(MSG_DEBUG, "mesh: RX IGTK",
933 sta->igtk, sta->igtk_len);
934 wpa_drv_set_key(
935 wpa_s, -1,
936 wpa_cipher_to_alg(conf->mgmt_group_cipher),
937 sta->addr, sta->igtk_key_id, 0,
938 sta->igtk_rsc, sizeof(sta->igtk_rsc),
939 sta->igtk, sta->igtk_len,
940 KEY_FLAG_GROUP_RX);
941 }
942 }
943
944 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_ESTAB);
945 hapd->num_plinks++;
946
947 sta->flags |= WLAN_STA_ASSOC;
948 sta->mesh_sae_pmksa_caching = 0;
949
950 eloop_cancel_timeout(peer_add_timer, wpa_s, NULL);
951 peer_add_timer(wpa_s, NULL);
952 eloop_cancel_timeout(plink_timer, wpa_s, sta);
953
954 /* Send ctrl event */
955 wpa_msg(wpa_s, MSG_INFO, MESH_PEER_CONNECTED MACSTR,
956 MAC2STR(sta->addr));
957
958 /* Send D-Bus event */
959 wpas_notify_mesh_peer_connected(wpa_s, sta->addr);
960 }
961
962
mesh_mpm_fsm(struct wpa_supplicant * wpa_s,struct sta_info * sta,enum plink_event event,u16 reason)963 static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
964 enum plink_event event, u16 reason)
965 {
966 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
967 struct mesh_conf *conf = wpa_s->ifmsh->mconf;
968
969 wpa_msg(wpa_s, MSG_DEBUG, "MPM " MACSTR " state %s event %s",
970 MAC2STR(sta->addr), mplstate[sta->plink_state],
971 mplevent[event]);
972
973 switch (sta->plink_state) {
974 case PLINK_IDLE:
975 switch (event) {
976 case CLS_ACPT:
977 mesh_mpm_fsm_restart(wpa_s, sta);
978 break;
979 case OPN_ACPT:
980 mesh_mpm_plink_open(wpa_s, sta, PLINK_OPN_RCVD);
981 mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CONFIRM,
982 0);
983 break;
984 case REQ_RJCT:
985 mesh_mpm_send_plink_action(wpa_s, sta,
986 PLINK_CLOSE, reason);
987 break;
988 default:
989 break;
990 }
991 break;
992 case PLINK_OPN_SNT:
993 switch (event) {
994 case OPN_RJCT:
995 case CNF_RJCT:
996 if (!reason)
997 reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
998 /* fall-through */
999 case CLS_ACPT:
1000 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
1001 if (!reason)
1002 reason = WLAN_REASON_MESH_CLOSE_RCVD;
1003 eloop_register_timeout(
1004 conf->dot11MeshHoldingTimeout / 1000,
1005 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
1006 plink_timer, wpa_s, sta);
1007 mesh_mpm_send_plink_action(wpa_s, sta,
1008 PLINK_CLOSE, reason);
1009 break;
1010 case OPN_ACPT:
1011 /* retry timer is left untouched */
1012 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_OPN_RCVD);
1013 mesh_mpm_send_plink_action(wpa_s, sta,
1014 PLINK_CONFIRM, 0);
1015 break;
1016 case CNF_ACPT:
1017 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_CNF_RCVD);
1018 eloop_cancel_timeout(plink_timer, wpa_s, sta);
1019 eloop_register_timeout(
1020 conf->dot11MeshConfirmTimeout / 1000,
1021 (conf->dot11MeshConfirmTimeout % 1000) * 1000,
1022 plink_timer, wpa_s, sta);
1023 break;
1024 default:
1025 break;
1026 }
1027 break;
1028 case PLINK_OPN_RCVD:
1029 switch (event) {
1030 case OPN_RJCT:
1031 case CNF_RJCT:
1032 if (!reason)
1033 reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
1034 /* fall-through */
1035 case CLS_ACPT:
1036 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
1037 if (!reason)
1038 reason = WLAN_REASON_MESH_CLOSE_RCVD;
1039 eloop_register_timeout(
1040 conf->dot11MeshHoldingTimeout / 1000,
1041 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
1042 plink_timer, wpa_s, sta);
1043 sta->mpm_close_reason = reason;
1044 mesh_mpm_send_plink_action(wpa_s, sta,
1045 PLINK_CLOSE, reason);
1046 break;
1047 case OPN_ACPT:
1048 mesh_mpm_send_plink_action(wpa_s, sta,
1049 PLINK_CONFIRM, 0);
1050 break;
1051 case CNF_ACPT:
1052 if (conf->security & MESH_CONF_SEC_AMPE)
1053 mesh_rsn_derive_mtk(wpa_s, sta);
1054 mesh_mpm_plink_estab(wpa_s, sta);
1055 break;
1056 default:
1057 break;
1058 }
1059 break;
1060 case PLINK_CNF_RCVD:
1061 switch (event) {
1062 case OPN_RJCT:
1063 case CNF_RJCT:
1064 if (!reason)
1065 reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
1066 /* fall-through */
1067 case CLS_ACPT:
1068 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
1069 if (!reason)
1070 reason = WLAN_REASON_MESH_CLOSE_RCVD;
1071 eloop_register_timeout(
1072 conf->dot11MeshHoldingTimeout / 1000,
1073 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
1074 plink_timer, wpa_s, sta);
1075 sta->mpm_close_reason = reason;
1076 mesh_mpm_send_plink_action(wpa_s, sta,
1077 PLINK_CLOSE, reason);
1078 break;
1079 case OPN_ACPT:
1080 if (conf->security & MESH_CONF_SEC_AMPE)
1081 mesh_rsn_derive_mtk(wpa_s, sta);
1082 mesh_mpm_plink_estab(wpa_s, sta);
1083 mesh_mpm_send_plink_action(wpa_s, sta,
1084 PLINK_CONFIRM, 0);
1085 break;
1086 default:
1087 break;
1088 }
1089 break;
1090 case PLINK_ESTAB:
1091 switch (event) {
1092 case OPN_RJCT:
1093 case CNF_RJCT:
1094 case CLS_ACPT:
1095 wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
1096 if (!reason)
1097 reason = WLAN_REASON_MESH_CLOSE_RCVD;
1098
1099 eloop_register_timeout(
1100 conf->dot11MeshHoldingTimeout / 1000,
1101 (conf->dot11MeshHoldingTimeout % 1000) * 1000,
1102 plink_timer, wpa_s, sta);
1103 sta->mpm_close_reason = reason;
1104
1105 wpa_msg(wpa_s, MSG_INFO, "mesh plink with " MACSTR
1106 " closed with reason %d",
1107 MAC2STR(sta->addr), reason);
1108
1109 wpa_msg(wpa_s, MSG_INFO, MESH_PEER_DISCONNECTED MACSTR,
1110 MAC2STR(sta->addr));
1111
1112 /* Send D-Bus event */
1113 wpas_notify_mesh_peer_disconnected(wpa_s, sta->addr,
1114 reason);
1115
1116 hapd->num_plinks--;
1117
1118 mesh_mpm_send_plink_action(wpa_s, sta,
1119 PLINK_CLOSE, reason);
1120 break;
1121 case OPN_ACPT:
1122 mesh_mpm_send_plink_action(wpa_s, sta,
1123 PLINK_CONFIRM, 0);
1124 break;
1125 default:
1126 break;
1127 }
1128 break;
1129 case PLINK_HOLDING:
1130 switch (event) {
1131 case CLS_ACPT:
1132 mesh_mpm_fsm_restart(wpa_s, sta);
1133 break;
1134 case OPN_ACPT:
1135 case CNF_ACPT:
1136 case OPN_RJCT:
1137 case CNF_RJCT:
1138 reason = sta->mpm_close_reason;
1139 mesh_mpm_send_plink_action(wpa_s, sta,
1140 PLINK_CLOSE, reason);
1141 break;
1142 default:
1143 break;
1144 }
1145 break;
1146 default:
1147 wpa_msg(wpa_s, MSG_DEBUG,
1148 "Unsupported MPM event %s for state %s",
1149 mplevent[event], mplstate[sta->plink_state]);
1150 break;
1151 }
1152 }
1153
1154
mesh_mpm_action_rx(struct wpa_supplicant * wpa_s,const struct ieee80211_mgmt * mgmt,size_t len)1155 void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
1156 const struct ieee80211_mgmt *mgmt, size_t len)
1157 {
1158 u8 action_field;
1159 struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
1160 struct mesh_conf *mconf = wpa_s->ifmsh->mconf;
1161 struct sta_info *sta;
1162 u16 plid = 0, llid = 0, aid = 0;
1163 enum plink_event event;
1164 struct ieee802_11_elems elems;
1165 struct mesh_peer_mgmt_ie peer_mgmt_ie;
1166 const u8 *ies;
1167 size_t ie_len;
1168 int ret;
1169 u16 reason = 0;
1170
1171 if (mgmt->u.action.category != WLAN_ACTION_SELF_PROTECTED)
1172 return;
1173
1174 action_field = mgmt->u.action.u.slf_prot_action.action;
1175 if (action_field != PLINK_OPEN &&
1176 action_field != PLINK_CONFIRM &&
1177 action_field != PLINK_CLOSE)
1178 return;
1179
1180 ies = mgmt->u.action.u.slf_prot_action.variable;
1181 ie_len = (const u8 *) mgmt + len -
1182 mgmt->u.action.u.slf_prot_action.variable;
1183
1184 /* at least expect mesh id and peering mgmt */
1185 if (ie_len < 2 + 2) {
1186 wpa_printf(MSG_DEBUG,
1187 "MPM: Ignore too short action frame %u ie_len %u",
1188 action_field, (unsigned int) ie_len);
1189 return;
1190 }
1191 wpa_printf(MSG_DEBUG, "MPM: Received PLINK action %u", action_field);
1192
1193 if (action_field == PLINK_OPEN || action_field == PLINK_CONFIRM) {
1194 wpa_printf(MSG_DEBUG, "MPM: Capability 0x%x",
1195 WPA_GET_LE16(ies));
1196 ies += 2; /* capability */
1197 ie_len -= 2;
1198 }
1199 if (action_field == PLINK_CONFIRM) {
1200 aid = WPA_GET_LE16(ies);
1201 wpa_printf(MSG_DEBUG, "MPM: AID 0x%x", aid);
1202 ies += 2; /* aid */
1203 ie_len -= 2;
1204 }
1205
1206 /* check for mesh peering, mesh id and mesh config IEs */
1207 if (ieee802_11_parse_elems(ies, ie_len, &elems, 0) == ParseFailed) {
1208 wpa_printf(MSG_DEBUG, "MPM: Failed to parse PLINK IEs");
1209 return;
1210 }
1211 if (!elems.peer_mgmt) {
1212 wpa_printf(MSG_DEBUG,
1213 "MPM: No Mesh Peering Management element");
1214 return;
1215 }
1216 if (action_field != PLINK_CLOSE) {
1217 if (!elems.mesh_id || !elems.mesh_config) {
1218 wpa_printf(MSG_DEBUG,
1219 "MPM: No Mesh ID or Mesh Configuration element");
1220 return;
1221 }
1222
1223 if (!matches_local(wpa_s, &elems)) {
1224 wpa_printf(MSG_DEBUG,
1225 "MPM: Mesh ID or Mesh Configuration element do not match local MBSS");
1226 return;
1227 }
1228 }
1229
1230 ret = mesh_mpm_parse_peer_mgmt(wpa_s, action_field,
1231 elems.peer_mgmt,
1232 elems.peer_mgmt_len,
1233 &peer_mgmt_ie);
1234 if (ret) {
1235 wpa_printf(MSG_DEBUG, "MPM: Mesh parsing rejected frame");
1236 return;
1237 }
1238
1239 /* the sender's llid is our plid and vice-versa */
1240 plid = WPA_GET_LE16(peer_mgmt_ie.llid);
1241 if (peer_mgmt_ie.plid)
1242 llid = WPA_GET_LE16(peer_mgmt_ie.plid);
1243 wpa_printf(MSG_DEBUG, "MPM: plid=0x%x llid=0x%x", plid, llid);
1244
1245 if (action_field == PLINK_CLOSE)
1246 wpa_printf(MSG_DEBUG, "MPM: close reason=%u",
1247 WPA_GET_LE16(peer_mgmt_ie.reason));
1248
1249 sta = ap_get_sta(hapd, mgmt->sa);
1250
1251 /*
1252 * If this is an open frame from an unknown STA, and this is an
1253 * open mesh, then go ahead and add the peer before proceeding.
1254 */
1255 if (!sta && action_field == PLINK_OPEN &&
1256 (!(mconf->security & MESH_CONF_SEC_AMPE) ||
1257 wpa_auth_pmksa_get(hapd->wpa_auth, mgmt->sa, NULL)))
1258 sta = mesh_mpm_add_peer(wpa_s, mgmt->sa, &elems);
1259
1260 if (!sta) {
1261 wpa_printf(MSG_DEBUG, "MPM: No STA entry for peer");
1262 return;
1263 }
1264
1265 #ifdef CONFIG_SAE
1266 /* peer is in sae_accepted? */
1267 if (sta->sae && sta->sae->state != SAE_ACCEPTED) {
1268 wpa_printf(MSG_DEBUG, "MPM: SAE not yet accepted for peer");
1269 return;
1270 }
1271 #endif /* CONFIG_SAE */
1272
1273 if (!sta->my_lid)
1274 mesh_mpm_init_link(wpa_s, sta);
1275
1276 if (mconf->security & MESH_CONF_SEC_AMPE) {
1277 int res;
1278
1279 res = mesh_rsn_process_ampe(wpa_s, sta, &elems,
1280 &mgmt->u.action.category,
1281 peer_mgmt_ie.chosen_pmk,
1282 ies, ie_len);
1283 if (res) {
1284 wpa_printf(MSG_DEBUG,
1285 "MPM: RSN process rejected frame (res=%d)",
1286 res);
1287 if (action_field == PLINK_OPEN && res == -2) {
1288 /* AES-SIV decryption failed */
1289 mesh_mpm_fsm(wpa_s, sta, OPN_RJCT,
1290 WLAN_REASON_MESH_INVALID_GTK);
1291 }
1292 return;
1293 }
1294
1295 #ifdef CONFIG_OCV
1296 if (action_field == PLINK_OPEN && elems.rsn_ie) {
1297 struct wpa_state_machine *sm = sta->wpa_sm;
1298 struct wpa_ie_data data;
1299
1300 res = wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2,
1301 elems.rsn_ie_len + 2,
1302 &data);
1303 if (res) {
1304 wpa_printf(MSG_DEBUG,
1305 "Failed to parse RSN IE (res=%d)",
1306 res);
1307 wpa_hexdump(MSG_DEBUG, "RSN IE", elems.rsn_ie,
1308 elems.rsn_ie_len);
1309 return;
1310 }
1311
1312 wpa_auth_set_ocv(sm, mconf->ocv &&
1313 (data.capabilities &
1314 WPA_CAPABILITY_OCVC));
1315 }
1316
1317 if (action_field != PLINK_CLOSE &&
1318 wpa_auth_uses_ocv(sta->wpa_sm)) {
1319 struct wpa_channel_info ci;
1320 int tx_chanwidth;
1321 int tx_seg1_idx;
1322
1323 if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
1324 wpa_printf(MSG_WARNING,
1325 "MPM: Failed to get channel info to validate received OCI in MPM Confirm");
1326 return;
1327 }
1328
1329 if (get_tx_parameters(
1330 sta, channel_width_to_int(ci.chanwidth),
1331 ci.seg1_idx, &tx_chanwidth,
1332 &tx_seg1_idx) < 0)
1333 return;
1334
1335 if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
1336 tx_chanwidth, tx_seg1_idx) !=
1337 OCI_SUCCESS) {
1338 wpa_printf(MSG_WARNING, "MPM: OCV failed: %s",
1339 ocv_errorstr);
1340 return;
1341 }
1342 }
1343 #endif /* CONFIG_OCV */
1344 }
1345
1346 if (sta->plink_state == PLINK_BLOCKED) {
1347 wpa_printf(MSG_DEBUG, "MPM: PLINK_BLOCKED");
1348 return;
1349 }
1350
1351 /* Now we will figure out the appropriate event... */
1352 switch (action_field) {
1353 case PLINK_OPEN:
1354 if (plink_free_count(hapd) == 0) {
1355 event = REQ_RJCT;
1356 reason = WLAN_REASON_MESH_MAX_PEERS;
1357 wpa_printf(MSG_INFO,
1358 "MPM: Peer link num over quota(%d)",
1359 hapd->max_plinks);
1360 } else if (sta->peer_lid && sta->peer_lid != plid) {
1361 wpa_printf(MSG_DEBUG,
1362 "MPM: peer_lid mismatch: 0x%x != 0x%x",
1363 sta->peer_lid, plid);
1364 return; /* no FSM event */
1365 } else {
1366 sta->peer_lid = plid;
1367 event = OPN_ACPT;
1368 }
1369 break;
1370 case PLINK_CONFIRM:
1371 if (plink_free_count(hapd) == 0) {
1372 event = REQ_RJCT;
1373 reason = WLAN_REASON_MESH_MAX_PEERS;
1374 wpa_printf(MSG_INFO,
1375 "MPM: Peer link num over quota(%d)",
1376 hapd->max_plinks);
1377 } else if (sta->my_lid != llid ||
1378 (sta->peer_lid && sta->peer_lid != plid)) {
1379 wpa_printf(MSG_DEBUG,
1380 "MPM: lid mismatch: my_lid: 0x%x != 0x%x or peer_lid: 0x%x != 0x%x",
1381 sta->my_lid, llid, sta->peer_lid, plid);
1382 return; /* no FSM event */
1383 } else {
1384 if (!sta->peer_lid)
1385 sta->peer_lid = plid;
1386 sta->peer_aid = aid;
1387 event = CNF_ACPT;
1388 }
1389 break;
1390 case PLINK_CLOSE:
1391 if (sta->plink_state == PLINK_ESTAB)
1392 /* Do not check for llid or plid. This does not
1393 * follow the standard but since multiple plinks
1394 * per cand are not supported, it is necessary in
1395 * order to avoid a livelock when MP A sees an
1396 * establish peer link to MP B but MP B does not
1397 * see it. This can be caused by a timeout in
1398 * B's peer link establishment or B being
1399 * restarted.
1400 */
1401 event = CLS_ACPT;
1402 else if (sta->peer_lid != plid) {
1403 wpa_printf(MSG_DEBUG,
1404 "MPM: peer_lid mismatch: 0x%x != 0x%x",
1405 sta->peer_lid, plid);
1406 return; /* no FSM event */
1407 } else if (peer_mgmt_ie.plid && sta->my_lid != llid) {
1408 wpa_printf(MSG_DEBUG,
1409 "MPM: my_lid mismatch: 0x%x != 0x%x",
1410 sta->my_lid, llid);
1411 return; /* no FSM event */
1412 } else {
1413 event = CLS_ACPT;
1414 }
1415 break;
1416 default:
1417 /*
1418 * This cannot be hit due to the action_field check above, but
1419 * compilers may not be able to figure that out and can warn
1420 * about uninitialized event below.
1421 */
1422 return;
1423 }
1424 mesh_mpm_fsm(wpa_s, sta, event, reason);
1425 }
1426
1427
1428 /* called by ap_free_sta */
mesh_mpm_free_sta(struct hostapd_data * hapd,struct sta_info * sta)1429 void mesh_mpm_free_sta(struct hostapd_data *hapd, struct sta_info *sta)
1430 {
1431 if (sta->plink_state == PLINK_ESTAB)
1432 hapd->num_plinks--;
1433 eloop_cancel_timeout(plink_timer, ELOOP_ALL_CTX, sta);
1434 eloop_cancel_timeout(mesh_auth_timer, ELOOP_ALL_CTX, sta);
1435 }
1436