1 /*
2 * Generic advertisement service (GAS) query
3 * Copyright (c) 2009, Atheros Communications
4 * Copyright (c) 2011-2014, Qualcomm Atheros, Inc.
5 * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "includes.h"
12
13 #include "common.h"
14 #include "utils/eloop.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/gas.h"
17 #include "common/wpa_ctrl.h"
18 #include "rsn_supp/wpa.h"
19 #include "wpa_supplicant_i.h"
20 #include "config.h"
21 #include "driver_i.h"
22 #include "offchannel.h"
23 #include "gas_query.h"
24
25
26 /** GAS query timeout in seconds */
27 #define GAS_QUERY_TIMEOUT_PERIOD 2
28
29 /* GAS query wait-time / duration in ms */
30 #define GAS_QUERY_WAIT_TIME_INITIAL 1000
31 #define GAS_QUERY_WAIT_TIME_COMEBACK 150
32
33 /**
34 * struct gas_query_pending - Pending GAS query
35 */
36 struct gas_query_pending {
37 struct dl_list list;
38 struct gas_query *gas;
39 u8 addr[ETH_ALEN];
40 u8 dialog_token;
41 u8 next_frag_id;
42 unsigned int wait_comeback:1;
43 unsigned int offchannel_tx_started:1;
44 unsigned int retry:1;
45 int freq;
46 u16 status_code;
47 struct wpabuf *req;
48 struct wpabuf *adv_proto;
49 struct wpabuf *resp;
50 struct os_reltime last_oper;
51 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
52 enum gas_query_result result,
53 const struct wpabuf *adv_proto,
54 const struct wpabuf *resp, u16 status_code);
55 void *ctx;
56 u8 sa[ETH_ALEN];
57 };
58
59 /**
60 * struct gas_query - Internal GAS query data
61 */
62 struct gas_query {
63 struct wpa_supplicant *wpa_s;
64 struct dl_list pending; /* struct gas_query_pending */
65 struct gas_query_pending *current;
66 struct wpa_radio_work *work;
67 struct os_reltime last_mac_addr_rand;
68 int last_rand_sa_type;
69 u8 rand_addr[ETH_ALEN];
70 };
71
72
73 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx);
74 static void gas_query_timeout(void *eloop_data, void *user_ctx);
75 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx);
76 static void gas_query_tx_initial_req(struct gas_query *gas,
77 struct gas_query_pending *query);
78 static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst);
79
80
ms_from_time(struct os_reltime * last)81 static int ms_from_time(struct os_reltime *last)
82 {
83 struct os_reltime now, res;
84
85 os_get_reltime(&now);
86 os_reltime_sub(&now, last, &res);
87 return res.sec * 1000 + res.usec / 1000;
88 }
89
90
91 /**
92 * gas_query_init - Initialize GAS query component
93 * @wpa_s: Pointer to wpa_supplicant data
94 * Returns: Pointer to GAS query data or %NULL on failure
95 */
gas_query_init(struct wpa_supplicant * wpa_s)96 struct gas_query * gas_query_init(struct wpa_supplicant *wpa_s)
97 {
98 struct gas_query *gas;
99
100 gas = os_zalloc(sizeof(*gas));
101 if (gas == NULL)
102 return NULL;
103
104 gas->wpa_s = wpa_s;
105 dl_list_init(&gas->pending);
106
107 return gas;
108 }
109
110
gas_result_txt(enum gas_query_result result)111 static const char * gas_result_txt(enum gas_query_result result)
112 {
113 switch (result) {
114 case GAS_QUERY_SUCCESS:
115 return "SUCCESS";
116 case GAS_QUERY_FAILURE:
117 return "FAILURE";
118 case GAS_QUERY_TIMEOUT:
119 return "TIMEOUT";
120 case GAS_QUERY_PEER_ERROR:
121 return "PEER_ERROR";
122 case GAS_QUERY_INTERNAL_ERROR:
123 return "INTERNAL_ERROR";
124 case GAS_QUERY_DELETED_AT_DEINIT:
125 return "DELETED_AT_DEINIT";
126 }
127
128 return "N/A";
129 }
130
131
gas_query_free(struct gas_query_pending * query,int del_list)132 static void gas_query_free(struct gas_query_pending *query, int del_list)
133 {
134 struct gas_query *gas = query->gas;
135
136 if (del_list)
137 dl_list_del(&query->list);
138
139 if (gas->work && gas->work->ctx == query) {
140 radio_work_done(gas->work);
141 gas->work = NULL;
142 }
143
144 wpabuf_free(query->req);
145 wpabuf_free(query->adv_proto);
146 wpabuf_free(query->resp);
147 os_free(query);
148 }
149
150
gas_query_done(struct gas_query * gas,struct gas_query_pending * query,enum gas_query_result result)151 static void gas_query_done(struct gas_query *gas,
152 struct gas_query_pending *query,
153 enum gas_query_result result)
154 {
155 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR
156 " dialog_token=%u freq=%d status_code=%u result=%s",
157 MAC2STR(query->addr), query->dialog_token, query->freq,
158 query->status_code, gas_result_txt(result));
159 if (gas->current == query)
160 gas->current = NULL;
161 if (query->offchannel_tx_started)
162 offchannel_send_action_done(gas->wpa_s);
163 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
164 eloop_cancel_timeout(gas_query_timeout, gas, query);
165 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
166 dl_list_del(&query->list);
167 query->cb(query->ctx, query->addr, query->dialog_token, result,
168 query->adv_proto, query->resp, query->status_code);
169 gas_query_free(query, 0);
170 }
171
172
173 /**
174 * gas_query_deinit - Deinitialize GAS query component
175 * @gas: GAS query data from gas_query_init()
176 */
gas_query_deinit(struct gas_query * gas)177 void gas_query_deinit(struct gas_query *gas)
178 {
179 struct gas_query_pending *query, *next;
180
181 if (gas == NULL)
182 return;
183
184 dl_list_for_each_safe(query, next, &gas->pending,
185 struct gas_query_pending, list)
186 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT);
187
188 os_free(gas);
189 }
190
191
192 static struct gas_query_pending *
gas_query_get_pending(struct gas_query * gas,const u8 * addr,u8 dialog_token)193 gas_query_get_pending(struct gas_query *gas, const u8 *addr, u8 dialog_token)
194 {
195 struct gas_query_pending *q;
196 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
197 if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 &&
198 q->dialog_token == dialog_token)
199 return q;
200 }
201 return NULL;
202 }
203
204
gas_query_append(struct gas_query_pending * query,const u8 * data,size_t len)205 static int gas_query_append(struct gas_query_pending *query, const u8 *data,
206 size_t len)
207 {
208 if (wpabuf_resize(&query->resp, len) < 0) {
209 wpa_printf(MSG_DEBUG, "GAS: No memory to store the response");
210 return -1;
211 }
212 wpabuf_put_data(query->resp, data, len);
213 return 0;
214 }
215
216
gas_query_tx_status(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,enum offchannel_send_action_result result)217 static void gas_query_tx_status(struct wpa_supplicant *wpa_s,
218 unsigned int freq, const u8 *dst,
219 const u8 *src, const u8 *bssid,
220 const u8 *data, size_t data_len,
221 enum offchannel_send_action_result result)
222 {
223 struct gas_query_pending *query;
224 struct gas_query *gas = wpa_s->gas;
225 int dur;
226
227 if (gas->current == NULL) {
228 wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: freq=%u dst="
229 MACSTR " result=%d - no query in progress",
230 freq, MAC2STR(dst), result);
231 return;
232 }
233
234 query = gas->current;
235
236 dur = ms_from_time(&query->last_oper);
237 wpa_printf(MSG_DEBUG, "GAS: TX status: freq=%u dst=" MACSTR
238 " result=%d query=%p dialog_token=%u dur=%d ms",
239 freq, MAC2STR(dst), result, query, query->dialog_token, dur);
240 if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) {
241 wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination");
242 return;
243 }
244 os_get_reltime(&query->last_oper);
245
246 if (result == OFFCHANNEL_SEND_ACTION_SUCCESS) {
247 eloop_cancel_timeout(gas_query_timeout, gas, query);
248 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
249 gas_query_timeout, gas, query);
250 if (query->wait_comeback && !query->retry) {
251 eloop_cancel_timeout(gas_query_rx_comeback_timeout,
252 gas, query);
253 eloop_register_timeout(
254 0, (GAS_QUERY_WAIT_TIME_COMEBACK + 10) * 1000,
255 gas_query_rx_comeback_timeout, gas, query);
256 }
257 }
258 if (result == OFFCHANNEL_SEND_ACTION_FAILED) {
259 eloop_cancel_timeout(gas_query_timeout, gas, query);
260 eloop_register_timeout(0, 0, gas_query_timeout, gas, query);
261 }
262 }
263
264
pmf_in_use(struct wpa_supplicant * wpa_s,const u8 * addr)265 static int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr)
266 {
267 if (wpa_s->current_ssid == NULL ||
268 wpa_s->wpa_state < WPA_4WAY_HANDSHAKE ||
269 os_memcmp(addr, wpa_s->bssid, ETH_ALEN) != 0)
270 return 0;
271 return wpa_sm_pmf_enabled(wpa_s->wpa);
272 }
273
274
gas_query_tx(struct gas_query * gas,struct gas_query_pending * query,struct wpabuf * req,unsigned int wait_time)275 static int gas_query_tx(struct gas_query *gas, struct gas_query_pending *query,
276 struct wpabuf *req, unsigned int wait_time)
277 {
278 int res, prot = pmf_in_use(gas->wpa_s, query->addr);
279 const u8 *bssid;
280 const u8 wildcard_bssid[ETH_ALEN] = {
281 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
282 };
283
284 wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u "
285 "freq=%d prot=%d using src addr " MACSTR,
286 MAC2STR(query->addr), (unsigned int) wpabuf_len(req),
287 query->freq, prot, MAC2STR(query->sa));
288 if (prot) {
289 u8 *categ = wpabuf_mhead_u8(req);
290 *categ = WLAN_ACTION_PROTECTED_DUAL;
291 }
292 os_get_reltime(&query->last_oper);
293 if (gas->wpa_s->max_remain_on_chan &&
294 wait_time > gas->wpa_s->max_remain_on_chan)
295 wait_time = gas->wpa_s->max_remain_on_chan;
296 if (!gas->wpa_s->conf->gas_address3 ||
297 (gas->wpa_s->current_ssid &&
298 gas->wpa_s->wpa_state >= WPA_ASSOCIATED &&
299 os_memcmp(query->addr, gas->wpa_s->bssid, ETH_ALEN) == 0))
300 bssid = query->addr;
301 else
302 bssid = wildcard_bssid;
303
304 res = offchannel_send_action(gas->wpa_s, query->freq, query->addr,
305 query->sa, bssid, wpabuf_head(req),
306 wpabuf_len(req), wait_time,
307 gas_query_tx_status, 0);
308
309 if (res == 0)
310 query->offchannel_tx_started = 1;
311 return res;
312 }
313
314
gas_query_tx_comeback_req(struct gas_query * gas,struct gas_query_pending * query)315 static void gas_query_tx_comeback_req(struct gas_query *gas,
316 struct gas_query_pending *query)
317 {
318 struct wpabuf *req;
319 unsigned int wait_time;
320
321 req = gas_build_comeback_req(query->dialog_token);
322 if (req == NULL) {
323 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
324 return;
325 }
326
327 wait_time = (query->retry || !query->offchannel_tx_started) ?
328 GAS_QUERY_WAIT_TIME_INITIAL : GAS_QUERY_WAIT_TIME_COMEBACK;
329
330 if (gas_query_tx(gas, query, req, wait_time) < 0) {
331 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
332 MACSTR, MAC2STR(query->addr));
333 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
334 }
335
336 wpabuf_free(req);
337 }
338
339
gas_query_rx_comeback_timeout(void * eloop_data,void * user_ctx)340 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx)
341 {
342 struct gas_query *gas = eloop_data;
343 struct gas_query_pending *query = user_ctx;
344 int dialog_token;
345
346 wpa_printf(MSG_DEBUG,
347 "GAS: No response to comeback request received (retry=%u)",
348 query->retry);
349 if (gas->current != query || query->retry)
350 return;
351 dialog_token = gas_query_new_dialog_token(gas, query->addr);
352 if (dialog_token < 0)
353 return;
354 wpa_printf(MSG_DEBUG,
355 "GAS: Retry GAS query due to comeback response timeout");
356 query->retry = 1;
357 query->dialog_token = dialog_token;
358 *(wpabuf_mhead_u8(query->req) + 2) = dialog_token;
359 query->wait_comeback = 0;
360 query->next_frag_id = 0;
361 wpabuf_free(query->adv_proto);
362 query->adv_proto = NULL;
363 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
364 eloop_cancel_timeout(gas_query_timeout, gas, query);
365 gas_query_tx_initial_req(gas, query);
366 }
367
368
gas_query_tx_comeback_timeout(void * eloop_data,void * user_ctx)369 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx)
370 {
371 struct gas_query *gas = eloop_data;
372 struct gas_query_pending *query = user_ctx;
373
374 wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR,
375 MAC2STR(query->addr));
376 gas_query_tx_comeback_req(gas, query);
377 }
378
379
gas_query_tx_comeback_req_delay(struct gas_query * gas,struct gas_query_pending * query,u16 comeback_delay)380 static void gas_query_tx_comeback_req_delay(struct gas_query *gas,
381 struct gas_query_pending *query,
382 u16 comeback_delay)
383 {
384 unsigned int secs, usecs;
385
386 if (comeback_delay > 1 && query->offchannel_tx_started) {
387 offchannel_send_action_done(gas->wpa_s);
388 query->offchannel_tx_started = 0;
389 }
390
391 secs = (comeback_delay * 1024) / 1000000;
392 usecs = comeback_delay * 1024 - secs * 1000000;
393 wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR
394 " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs);
395 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
396 eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout,
397 gas, query);
398 }
399
400
gas_query_rx_initial(struct gas_query * gas,struct gas_query_pending * query,const u8 * adv_proto,const u8 * resp,size_t len,u16 comeback_delay)401 static void gas_query_rx_initial(struct gas_query *gas,
402 struct gas_query_pending *query,
403 const u8 *adv_proto, const u8 *resp,
404 size_t len, u16 comeback_delay)
405 {
406 wpa_printf(MSG_DEBUG, "GAS: Received initial response from "
407 MACSTR " (dialog_token=%u comeback_delay=%u)",
408 MAC2STR(query->addr), query->dialog_token, comeback_delay);
409
410 query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]);
411 if (query->adv_proto == NULL) {
412 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
413 return;
414 }
415
416 if (comeback_delay) {
417 eloop_cancel_timeout(gas_query_timeout, gas, query);
418 query->wait_comeback = 1;
419 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
420 return;
421 }
422
423 /* Query was completed without comeback mechanism */
424 if (gas_query_append(query, resp, len) < 0) {
425 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
426 return;
427 }
428
429 gas_query_done(gas, query, GAS_QUERY_SUCCESS);
430 }
431
432
gas_query_rx_comeback(struct gas_query * gas,struct gas_query_pending * query,const u8 * adv_proto,const u8 * resp,size_t len,u8 frag_id,u8 more_frags,u16 comeback_delay)433 static void gas_query_rx_comeback(struct gas_query *gas,
434 struct gas_query_pending *query,
435 const u8 *adv_proto, const u8 *resp,
436 size_t len, u8 frag_id, u8 more_frags,
437 u16 comeback_delay)
438 {
439 wpa_printf(MSG_DEBUG, "GAS: Received comeback response from "
440 MACSTR " (dialog_token=%u frag_id=%u more_frags=%u "
441 "comeback_delay=%u)",
442 MAC2STR(query->addr), query->dialog_token, frag_id,
443 more_frags, comeback_delay);
444 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
445
446 if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) ||
447 os_memcmp(adv_proto, wpabuf_head(query->adv_proto),
448 wpabuf_len(query->adv_proto)) != 0) {
449 wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed "
450 "between initial and comeback response from "
451 MACSTR, MAC2STR(query->addr));
452 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
453 return;
454 }
455
456 if (comeback_delay) {
457 if (frag_id) {
458 wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response "
459 "with non-zero frag_id and comeback_delay "
460 "from " MACSTR, MAC2STR(query->addr));
461 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
462 return;
463 }
464 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
465 return;
466 }
467
468 if (frag_id != query->next_frag_id) {
469 wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response "
470 "from " MACSTR, MAC2STR(query->addr));
471 if (frag_id + 1 == query->next_frag_id) {
472 wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible "
473 "retry of previous fragment");
474 return;
475 }
476 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
477 return;
478 }
479 query->next_frag_id++;
480
481 if (gas_query_append(query, resp, len) < 0) {
482 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
483 return;
484 }
485
486 if (more_frags) {
487 gas_query_tx_comeback_req(gas, query);
488 return;
489 }
490
491 gas_query_done(gas, query, GAS_QUERY_SUCCESS);
492 }
493
494
495 /**
496 * gas_query_rx - Indicate reception of a Public Action or Protected Dual frame
497 * @gas: GAS query data from gas_query_init()
498 * @da: Destination MAC address of the Action frame
499 * @sa: Source MAC address of the Action frame
500 * @bssid: BSSID of the Action frame
501 * @categ: Category of the Action frame
502 * @data: Payload of the Action frame
503 * @len: Length of @data
504 * @freq: Frequency (in MHz) on which the frame was received
505 * Returns: 0 if the Public Action frame was a GAS frame or -1 if not
506 */
gas_query_rx(struct gas_query * gas,const u8 * da,const u8 * sa,const u8 * bssid,u8 categ,const u8 * data,size_t len,int freq)507 int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa,
508 const u8 *bssid, u8 categ, const u8 *data, size_t len,
509 int freq)
510 {
511 struct gas_query_pending *query;
512 u8 action, dialog_token, frag_id = 0, more_frags = 0;
513 u16 comeback_delay, resp_len;
514 const u8 *pos, *adv_proto;
515 int prot, pmf;
516 unsigned int left;
517
518 if (gas == NULL || len < 4)
519 return -1;
520
521 pos = data;
522 action = *pos++;
523 dialog_token = *pos++;
524
525 if (action != WLAN_PA_GAS_INITIAL_RESP &&
526 action != WLAN_PA_GAS_COMEBACK_RESP)
527 return -1; /* Not a GAS response */
528
529 prot = categ == WLAN_ACTION_PROTECTED_DUAL;
530 pmf = pmf_in_use(gas->wpa_s, sa);
531 if (prot && !pmf) {
532 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled");
533 return 0;
534 }
535 if (!prot && pmf) {
536 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled");
537 return 0;
538 }
539
540 query = gas_query_get_pending(gas, sa, dialog_token);
541 if (query == NULL) {
542 wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR
543 " dialog token %u", MAC2STR(sa), dialog_token);
544 return -1;
545 }
546
547 wpa_printf(MSG_DEBUG, "GAS: Response in %d ms from " MACSTR,
548 ms_from_time(&query->last_oper), MAC2STR(sa));
549
550 if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) {
551 wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from "
552 MACSTR " dialog token %u when waiting for comeback "
553 "response", MAC2STR(sa), dialog_token);
554 return 0;
555 }
556
557 if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) {
558 wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from "
559 MACSTR " dialog token %u when waiting for initial "
560 "response", MAC2STR(sa), dialog_token);
561 return 0;
562 }
563
564 query->status_code = WPA_GET_LE16(pos);
565 pos += 2;
566
567 if (query->status_code == WLAN_STATUS_QUERY_RESP_OUTSTANDING &&
568 action == WLAN_PA_GAS_COMEBACK_RESP) {
569 wpa_printf(MSG_DEBUG, "GAS: Allow non-zero status for outstanding comeback response");
570 } else if (query->status_code != WLAN_STATUS_SUCCESS) {
571 wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token "
572 "%u failed - status code %u",
573 MAC2STR(sa), dialog_token, query->status_code);
574 gas_query_done(gas, query, GAS_QUERY_FAILURE);
575 return 0;
576 }
577
578 if (action == WLAN_PA_GAS_COMEBACK_RESP) {
579 if (pos + 1 > data + len)
580 return 0;
581 frag_id = *pos & 0x7f;
582 more_frags = (*pos & 0x80) >> 7;
583 pos++;
584 }
585
586 /* Comeback Delay */
587 if (pos + 2 > data + len)
588 return 0;
589 comeback_delay = WPA_GET_LE16(pos);
590 pos += 2;
591
592 /* Advertisement Protocol element */
593 if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) {
594 wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement "
595 "Protocol element in the response from " MACSTR,
596 MAC2STR(sa));
597 return 0;
598 }
599
600 if (*pos != WLAN_EID_ADV_PROTO) {
601 wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement "
602 "Protocol element ID %u in response from " MACSTR,
603 *pos, MAC2STR(sa));
604 return 0;
605 }
606
607 adv_proto = pos;
608 pos += 2 + pos[1];
609
610 /* Query Response Length */
611 if (pos + 2 > data + len) {
612 wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length");
613 return 0;
614 }
615 resp_len = WPA_GET_LE16(pos);
616 pos += 2;
617
618 left = data + len - pos;
619 if (resp_len > left) {
620 wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in "
621 "response from " MACSTR, MAC2STR(sa));
622 return 0;
623 }
624
625 if (resp_len < left) {
626 wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data "
627 "after Query Response from " MACSTR,
628 left - resp_len, MAC2STR(sa));
629 }
630
631 if (action == WLAN_PA_GAS_COMEBACK_RESP)
632 gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len,
633 frag_id, more_frags, comeback_delay);
634 else
635 gas_query_rx_initial(gas, query, adv_proto, pos, resp_len,
636 comeback_delay);
637
638 return 0;
639 }
640
641
gas_query_timeout(void * eloop_data,void * user_ctx)642 static void gas_query_timeout(void *eloop_data, void *user_ctx)
643 {
644 struct gas_query *gas = eloop_data;
645 struct gas_query_pending *query = user_ctx;
646
647 wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR
648 " dialog token %u",
649 MAC2STR(query->addr), query->dialog_token);
650 gas_query_done(gas, query, GAS_QUERY_TIMEOUT);
651 }
652
653
gas_query_dialog_token_available(struct gas_query * gas,const u8 * dst,u8 dialog_token)654 static int gas_query_dialog_token_available(struct gas_query *gas,
655 const u8 *dst, u8 dialog_token)
656 {
657 struct gas_query_pending *q;
658 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
659 if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 &&
660 dialog_token == q->dialog_token)
661 return 0;
662 }
663
664 return 1;
665 }
666
667
gas_query_start_cb(struct wpa_radio_work * work,int deinit)668 static void gas_query_start_cb(struct wpa_radio_work *work, int deinit)
669 {
670 struct gas_query_pending *query = work->ctx;
671 struct gas_query *gas = query->gas;
672 struct wpa_supplicant *wpa_s = gas->wpa_s;
673
674 if (deinit) {
675 if (work->started) {
676 gas->work = NULL;
677 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT);
678 return;
679 }
680
681 gas_query_free(query, 1);
682 return;
683 }
684
685 if (wpas_update_random_addr_disassoc(wpa_s) < 0) {
686 wpa_msg(wpa_s, MSG_INFO,
687 "Failed to assign random MAC address for GAS");
688 gas_query_free(query, 1);
689 radio_work_done(work);
690 return;
691 }
692
693 gas->work = work;
694 gas_query_tx_initial_req(gas, query);
695 }
696
697
gas_query_tx_initial_req(struct gas_query * gas,struct gas_query_pending * query)698 static void gas_query_tx_initial_req(struct gas_query *gas,
699 struct gas_query_pending *query)
700 {
701 if (gas_query_tx(gas, query, query->req,
702 GAS_QUERY_WAIT_TIME_INITIAL) < 0) {
703 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
704 MACSTR, MAC2STR(query->addr));
705 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
706 return;
707 }
708 gas->current = query;
709
710 wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u",
711 query->dialog_token);
712 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
713 gas_query_timeout, gas, query);
714 }
715
716
gas_query_new_dialog_token(struct gas_query * gas,const u8 * dst)717 static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst)
718 {
719 static int next_start = 0;
720 int dialog_token;
721
722 for (dialog_token = 0; dialog_token < 256; dialog_token++) {
723 if (gas_query_dialog_token_available(
724 gas, dst, (next_start + dialog_token) % 256))
725 break;
726 }
727 if (dialog_token == 256)
728 return -1; /* Too many pending queries */
729 dialog_token = (next_start + dialog_token) % 256;
730 next_start = (dialog_token + 1) % 256;
731 return dialog_token;
732 }
733
734
gas_query_set_sa(struct gas_query * gas,struct gas_query_pending * query)735 static int gas_query_set_sa(struct gas_query *gas,
736 struct gas_query_pending *query)
737 {
738 struct wpa_supplicant *wpa_s = gas->wpa_s;
739 struct os_reltime now;
740
741 if (!wpa_s->conf->gas_rand_mac_addr ||
742 !(wpa_s->current_bss ?
743 (wpa_s->drv_flags &
744 WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA_CONNECTED) :
745 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA))) {
746 /* Use own MAC address as the transmitter address */
747 os_memcpy(query->sa, wpa_s->own_addr, ETH_ALEN);
748 return 0;
749 }
750
751 os_get_reltime(&now);
752
753 if (wpa_s->conf->gas_rand_mac_addr == gas->last_rand_sa_type &&
754 gas->last_mac_addr_rand.sec != 0 &&
755 !os_reltime_expired(&now, &gas->last_mac_addr_rand,
756 wpa_s->conf->gas_rand_addr_lifetime)) {
757 wpa_printf(MSG_DEBUG,
758 "GAS: Use the previously selected random transmitter address "
759 MACSTR, MAC2STR(gas->rand_addr));
760 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN);
761 return 0;
762 }
763
764 if (wpa_s->conf->gas_rand_mac_addr == 1 &&
765 random_mac_addr(gas->rand_addr) < 0) {
766 wpa_printf(MSG_ERROR, "GAS: Failed to get random address");
767 return -1;
768 }
769
770 if (wpa_s->conf->gas_rand_mac_addr == 2 &&
771 random_mac_addr_keep_oui(gas->rand_addr) < 0) {
772 wpa_printf(MSG_ERROR,
773 "GAS: Failed to get random address with same OUI");
774 return -1;
775 }
776
777 wpa_printf(MSG_DEBUG, "GAS: Use a new random transmitter address "
778 MACSTR, MAC2STR(gas->rand_addr));
779 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN);
780 os_get_reltime(&gas->last_mac_addr_rand);
781 gas->last_rand_sa_type = wpa_s->conf->gas_rand_mac_addr;
782
783 return 0;
784 }
785
786
787 /**
788 * gas_query_req - Request a GAS query
789 * @gas: GAS query data from gas_query_init()
790 * @dst: Destination MAC address for the query
791 * @freq: Frequency (in MHz) for the channel on which to send the query
792 * @req: GAS query payload (to be freed by gas_query module in case of success
793 * return)
794 * @cb: Callback function for reporting GAS query result and response
795 * @ctx: Context pointer to use with the @cb call
796 * Returns: dialog token (>= 0) on success or -1 on failure
797 */
gas_query_req(struct gas_query * gas,const u8 * dst,int freq,struct wpabuf * req,void (* cb)(void * ctx,const u8 * dst,u8 dialog_token,enum gas_query_result result,const struct wpabuf * adv_proto,const struct wpabuf * resp,u16 status_code),void * ctx)798 int gas_query_req(struct gas_query *gas, const u8 *dst, int freq,
799 struct wpabuf *req,
800 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
801 enum gas_query_result result,
802 const struct wpabuf *adv_proto,
803 const struct wpabuf *resp, u16 status_code),
804 void *ctx)
805 {
806 struct gas_query_pending *query;
807 int dialog_token;
808
809 if (wpabuf_len(req) < 3)
810 return -1;
811
812 dialog_token = gas_query_new_dialog_token(gas, dst);
813 if (dialog_token < 0)
814 return -1;
815
816 query = os_zalloc(sizeof(*query));
817 if (query == NULL)
818 return -1;
819
820 query->gas = gas;
821 if (gas_query_set_sa(gas, query)) {
822 os_free(query);
823 return -1;
824 }
825 os_memcpy(query->addr, dst, ETH_ALEN);
826 query->dialog_token = dialog_token;
827 query->freq = freq;
828 query->cb = cb;
829 query->ctx = ctx;
830 query->req = req;
831 dl_list_add(&gas->pending, &query->list);
832
833 *(wpabuf_mhead_u8(req) + 2) = dialog_token;
834
835 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_START "addr=" MACSTR
836 " dialog_token=%u freq=%d",
837 MAC2STR(query->addr), query->dialog_token, query->freq);
838
839 if (radio_add_work(gas->wpa_s, freq, "gas-query", 0, gas_query_start_cb,
840 query) < 0) {
841 query->req = NULL; /* caller will free this in error case */
842 gas_query_free(query, 1);
843 return -1;
844 }
845
846 return dialog_token;
847 }
848