1 /*
2 * Generic advertisement service (GAS) query
3 * Copyright (c) 2009, Atheros Communications
4 * Copyright (c) 2011-2014, Qualcomm Atheros, Inc.
5 * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
6 *
7 * This software may be distributed under the terms of the BSD license.
8 * See README for more details.
9 */
10
11 #include "includes.h"
12
13 #include "common.h"
14 #include "utils/eloop.h"
15 #include "common/ieee802_11_defs.h"
16 #include "common/gas.h"
17 #include "common/wpa_ctrl.h"
18 #include "rsn_supp/wpa.h"
19 #include "wpa_supplicant_i.h"
20 #include "config.h"
21 #include "driver_i.h"
22 #include "offchannel.h"
23 #include "gas_query.h"
24
25
26 /** GAS query timeout in seconds */
27 #define GAS_QUERY_TIMEOUT_PERIOD 2
28
29 /* GAS query wait-time / duration in ms */
30 #define GAS_QUERY_WAIT_TIME_INITIAL 1000
31 #define GAS_QUERY_WAIT_TIME_COMEBACK 150
32
33 /**
34 * struct gas_query_pending - Pending GAS query
35 */
36 struct gas_query_pending {
37 struct dl_list list;
38 struct gas_query *gas;
39 u8 addr[ETH_ALEN];
40 u8 dialog_token;
41 u8 next_frag_id;
42 unsigned int wait_comeback:1;
43 unsigned int offchannel_tx_started:1;
44 unsigned int retry:1;
45 unsigned int wildcard_bssid:1;
46 unsigned int maintain_addr:1;
47 int freq;
48 u16 status_code;
49 struct wpabuf *req;
50 struct wpabuf *adv_proto;
51 struct wpabuf *resp;
52 struct os_reltime last_oper;
53 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
54 enum gas_query_result result,
55 const struct wpabuf *adv_proto,
56 const struct wpabuf *resp, u16 status_code);
57 void *ctx;
58 u8 sa[ETH_ALEN];
59 };
60
61 /**
62 * struct gas_query - Internal GAS query data
63 */
64 struct gas_query {
65 struct wpa_supplicant *wpa_s;
66 struct dl_list pending; /* struct gas_query_pending */
67 struct gas_query_pending *current;
68 struct wpa_radio_work *work;
69 struct os_reltime last_mac_addr_rand;
70 int last_rand_sa_type;
71 u8 rand_addr[ETH_ALEN];
72 };
73
74
75 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx);
76 static void gas_query_timeout(void *eloop_data, void *user_ctx);
77 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx);
78 static void gas_query_tx_initial_req(struct gas_query *gas,
79 struct gas_query_pending *query);
80 static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst);
81
82
ms_from_time(struct os_reltime * last)83 static int ms_from_time(struct os_reltime *last)
84 {
85 struct os_reltime now, res;
86
87 os_get_reltime(&now);
88 os_reltime_sub(&now, last, &res);
89 return res.sec * 1000 + res.usec / 1000;
90 }
91
92
93 /**
94 * gas_query_init - Initialize GAS query component
95 * @wpa_s: Pointer to wpa_supplicant data
96 * Returns: Pointer to GAS query data or %NULL on failure
97 */
gas_query_init(struct wpa_supplicant * wpa_s)98 struct gas_query * gas_query_init(struct wpa_supplicant *wpa_s)
99 {
100 struct gas_query *gas;
101
102 gas = os_zalloc(sizeof(*gas));
103 if (gas == NULL)
104 return NULL;
105
106 gas->wpa_s = wpa_s;
107 dl_list_init(&gas->pending);
108
109 return gas;
110 }
111
112
gas_result_txt(enum gas_query_result result)113 static const char * gas_result_txt(enum gas_query_result result)
114 {
115 switch (result) {
116 case GAS_QUERY_SUCCESS:
117 return "SUCCESS";
118 case GAS_QUERY_FAILURE:
119 return "FAILURE";
120 case GAS_QUERY_TIMEOUT:
121 return "TIMEOUT";
122 case GAS_QUERY_PEER_ERROR:
123 return "PEER_ERROR";
124 case GAS_QUERY_INTERNAL_ERROR:
125 return "INTERNAL_ERROR";
126 case GAS_QUERY_STOPPED:
127 return "STOPPED";
128 case GAS_QUERY_DELETED_AT_DEINIT:
129 return "DELETED_AT_DEINIT";
130 }
131
132 return "N/A";
133 }
134
135
gas_query_free(struct gas_query_pending * query,int del_list)136 static void gas_query_free(struct gas_query_pending *query, int del_list)
137 {
138 struct gas_query *gas = query->gas;
139
140 if (del_list)
141 dl_list_del(&query->list);
142
143 if (gas->work && gas->work->ctx == query) {
144 radio_work_done(gas->work);
145 gas->work = NULL;
146 }
147
148 wpabuf_free(query->req);
149 wpabuf_free(query->adv_proto);
150 wpabuf_free(query->resp);
151 os_free(query);
152 }
153
154
gas_query_done(struct gas_query * gas,struct gas_query_pending * query,enum gas_query_result result)155 static void gas_query_done(struct gas_query *gas,
156 struct gas_query_pending *query,
157 enum gas_query_result result)
158 {
159 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR
160 " dialog_token=%u freq=%d status_code=%u result=%s",
161 MAC2STR(query->addr), query->dialog_token, query->freq,
162 query->status_code, gas_result_txt(result));
163 if (gas->current == query)
164 gas->current = NULL;
165 if (query->offchannel_tx_started)
166 offchannel_send_action_done(gas->wpa_s);
167 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
168 eloop_cancel_timeout(gas_query_timeout, gas, query);
169 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
170 dl_list_del(&query->list);
171 query->cb(query->ctx, query->addr, query->dialog_token, result,
172 query->adv_proto, query->resp, query->status_code);
173 gas_query_free(query, 0);
174 }
175
176
177 /**
178 * gas_query_deinit - Deinitialize GAS query component
179 * @gas: GAS query data from gas_query_init()
180 */
gas_query_deinit(struct gas_query * gas)181 void gas_query_deinit(struct gas_query *gas)
182 {
183 struct gas_query_pending *query, *next;
184
185 if (gas == NULL)
186 return;
187
188 dl_list_for_each_safe(query, next, &gas->pending,
189 struct gas_query_pending, list)
190 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT);
191
192 os_free(gas);
193 }
194
195
196 static struct gas_query_pending *
gas_query_get_pending(struct gas_query * gas,const u8 * addr,u8 dialog_token)197 gas_query_get_pending(struct gas_query *gas, const u8 *addr, u8 dialog_token)
198 {
199 struct gas_query_pending *q;
200 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
201 if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 &&
202 q->dialog_token == dialog_token)
203 return q;
204 }
205 return NULL;
206 }
207
208
gas_query_append(struct gas_query_pending * query,const u8 * data,size_t len)209 static int gas_query_append(struct gas_query_pending *query, const u8 *data,
210 size_t len)
211 {
212 if (wpabuf_resize(&query->resp, len) < 0) {
213 wpa_printf(MSG_DEBUG, "GAS: No memory to store the response");
214 return -1;
215 }
216 wpabuf_put_data(query->resp, data, len);
217 return 0;
218 }
219
220
gas_query_tx_status(struct wpa_supplicant * wpa_s,unsigned int freq,const u8 * dst,const u8 * src,const u8 * bssid,const u8 * data,size_t data_len,enum offchannel_send_action_result result)221 static void gas_query_tx_status(struct wpa_supplicant *wpa_s,
222 unsigned int freq, const u8 *dst,
223 const u8 *src, const u8 *bssid,
224 const u8 *data, size_t data_len,
225 enum offchannel_send_action_result result)
226 {
227 struct gas_query_pending *query;
228 struct gas_query *gas = wpa_s->gas;
229 int dur;
230
231 if (gas->current == NULL) {
232 wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: freq=%u dst="
233 MACSTR " result=%d - no query in progress",
234 freq, MAC2STR(dst), result);
235 return;
236 }
237
238 query = gas->current;
239
240 dur = ms_from_time(&query->last_oper);
241 wpa_printf(MSG_DEBUG, "GAS: TX status: freq=%u dst=" MACSTR
242 " result=%d query=%p dialog_token=%u dur=%d ms",
243 freq, MAC2STR(dst), result, query, query->dialog_token, dur);
244 if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) {
245 wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination");
246 return;
247 }
248 os_get_reltime(&query->last_oper);
249
250 if (result == OFFCHANNEL_SEND_ACTION_SUCCESS ||
251 result == OFFCHANNEL_SEND_ACTION_NO_ACK) {
252 eloop_cancel_timeout(gas_query_timeout, gas, query);
253 if (result == OFFCHANNEL_SEND_ACTION_NO_ACK) {
254 wpa_printf(MSG_DEBUG, "GAS: No ACK to GAS request");
255 eloop_register_timeout(0, 250000,
256 gas_query_timeout, gas, query);
257 } else {
258 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
259 gas_query_timeout, gas, query);
260 }
261 if (query->wait_comeback && !query->retry) {
262 eloop_cancel_timeout(gas_query_rx_comeback_timeout,
263 gas, query);
264 eloop_register_timeout(
265 0, (GAS_QUERY_WAIT_TIME_COMEBACK + 10) * 1000,
266 gas_query_rx_comeback_timeout, gas, query);
267 }
268 }
269 if (result == OFFCHANNEL_SEND_ACTION_FAILED) {
270 eloop_cancel_timeout(gas_query_timeout, gas, query);
271 eloop_register_timeout(0, 0, gas_query_timeout, gas, query);
272 }
273 }
274
275
gas_query_tx(struct gas_query * gas,struct gas_query_pending * query,struct wpabuf * req,unsigned int wait_time)276 static int gas_query_tx(struct gas_query *gas, struct gas_query_pending *query,
277 struct wpabuf *req, unsigned int wait_time)
278 {
279 int res, prot = pmf_in_use(gas->wpa_s, query->addr);
280 const u8 *bssid;
281 const u8 wildcard_bssid[ETH_ALEN] = {
282 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
283 };
284
285 wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u "
286 "freq=%d prot=%d using src addr " MACSTR,
287 MAC2STR(query->addr), (unsigned int) wpabuf_len(req),
288 query->freq, prot, MAC2STR(query->sa));
289 if (prot) {
290 u8 *categ = wpabuf_mhead_u8(req);
291 *categ = WLAN_ACTION_PROTECTED_DUAL;
292 }
293 os_get_reltime(&query->last_oper);
294 if (gas->wpa_s->max_remain_on_chan &&
295 wait_time > gas->wpa_s->max_remain_on_chan)
296 wait_time = gas->wpa_s->max_remain_on_chan;
297 if (!query->wildcard_bssid &&
298 (!gas->wpa_s->conf->gas_address3 ||
299 (gas->wpa_s->current_ssid &&
300 gas->wpa_s->wpa_state >= WPA_ASSOCIATED &&
301 os_memcmp(query->addr, gas->wpa_s->bssid, ETH_ALEN) == 0)))
302 bssid = query->addr;
303 else
304 bssid = wildcard_bssid;
305
306 res = offchannel_send_action(gas->wpa_s, query->freq, query->addr,
307 query->sa, bssid, wpabuf_head(req),
308 wpabuf_len(req), wait_time,
309 gas_query_tx_status, 0);
310
311 if (res == 0)
312 query->offchannel_tx_started = 1;
313 return res;
314 }
315
316
gas_query_tx_comeback_req(struct gas_query * gas,struct gas_query_pending * query)317 static void gas_query_tx_comeback_req(struct gas_query *gas,
318 struct gas_query_pending *query)
319 {
320 struct wpabuf *req;
321 unsigned int wait_time;
322
323 req = gas_build_comeback_req(query->dialog_token);
324 if (req == NULL) {
325 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
326 return;
327 }
328
329 wait_time = (query->retry || !query->offchannel_tx_started) ?
330 GAS_QUERY_WAIT_TIME_INITIAL : GAS_QUERY_WAIT_TIME_COMEBACK;
331
332 if (gas_query_tx(gas, query, req, wait_time) < 0) {
333 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
334 MACSTR, MAC2STR(query->addr));
335 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
336 }
337
338 wpabuf_free(req);
339 }
340
341
gas_query_rx_comeback_timeout(void * eloop_data,void * user_ctx)342 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx)
343 {
344 struct gas_query *gas = eloop_data;
345 struct gas_query_pending *query = user_ctx;
346 int dialog_token;
347
348 wpa_printf(MSG_DEBUG,
349 "GAS: No response to comeback request received (retry=%u)",
350 query->retry);
351 if (gas->current != query || query->retry)
352 return;
353 dialog_token = gas_query_new_dialog_token(gas, query->addr);
354 if (dialog_token < 0)
355 return;
356 wpa_printf(MSG_DEBUG,
357 "GAS: Retry GAS query due to comeback response timeout");
358 query->retry = 1;
359 query->dialog_token = dialog_token;
360 *(wpabuf_mhead_u8(query->req) + 2) = dialog_token;
361 query->wait_comeback = 0;
362 query->next_frag_id = 0;
363 wpabuf_free(query->adv_proto);
364 query->adv_proto = NULL;
365 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
366 eloop_cancel_timeout(gas_query_timeout, gas, query);
367 gas_query_tx_initial_req(gas, query);
368 }
369
370
gas_query_tx_comeback_timeout(void * eloop_data,void * user_ctx)371 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx)
372 {
373 struct gas_query *gas = eloop_data;
374 struct gas_query_pending *query = user_ctx;
375
376 wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR,
377 MAC2STR(query->addr));
378 gas_query_tx_comeback_req(gas, query);
379 }
380
381
gas_query_tx_comeback_req_delay(struct gas_query * gas,struct gas_query_pending * query,u16 comeback_delay)382 static void gas_query_tx_comeback_req_delay(struct gas_query *gas,
383 struct gas_query_pending *query,
384 u16 comeback_delay)
385 {
386 unsigned int secs, usecs;
387
388 if (comeback_delay > 1 && query->offchannel_tx_started) {
389 offchannel_send_action_done(gas->wpa_s);
390 query->offchannel_tx_started = 0;
391 }
392
393 secs = (comeback_delay * 1024) / 1000000;
394 usecs = comeback_delay * 1024 - secs * 1000000;
395 wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR
396 " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs);
397 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
398 eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout,
399 gas, query);
400 }
401
402
gas_query_rx_initial(struct gas_query * gas,struct gas_query_pending * query,const u8 * adv_proto,const u8 * resp,size_t len,u16 comeback_delay)403 static void gas_query_rx_initial(struct gas_query *gas,
404 struct gas_query_pending *query,
405 const u8 *adv_proto, const u8 *resp,
406 size_t len, u16 comeback_delay)
407 {
408 wpa_printf(MSG_DEBUG, "GAS: Received initial response from "
409 MACSTR " (dialog_token=%u comeback_delay=%u)",
410 MAC2STR(query->addr), query->dialog_token, comeback_delay);
411
412 query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]);
413 if (query->adv_proto == NULL) {
414 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
415 return;
416 }
417
418 if (comeback_delay) {
419 eloop_cancel_timeout(gas_query_timeout, gas, query);
420 query->wait_comeback = 1;
421 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
422 return;
423 }
424
425 /* Query was completed without comeback mechanism */
426 if (gas_query_append(query, resp, len) < 0) {
427 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
428 return;
429 }
430
431 gas_query_done(gas, query, GAS_QUERY_SUCCESS);
432 }
433
434
gas_query_rx_comeback(struct gas_query * gas,struct gas_query_pending * query,const u8 * adv_proto,const u8 * resp,size_t len,u8 frag_id,u8 more_frags,u16 comeback_delay)435 static void gas_query_rx_comeback(struct gas_query *gas,
436 struct gas_query_pending *query,
437 const u8 *adv_proto, const u8 *resp,
438 size_t len, u8 frag_id, u8 more_frags,
439 u16 comeback_delay)
440 {
441 wpa_printf(MSG_DEBUG, "GAS: Received comeback response from "
442 MACSTR " (dialog_token=%u frag_id=%u more_frags=%u "
443 "comeback_delay=%u)",
444 MAC2STR(query->addr), query->dialog_token, frag_id,
445 more_frags, comeback_delay);
446 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
447
448 if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) ||
449 os_memcmp(adv_proto, wpabuf_head(query->adv_proto),
450 wpabuf_len(query->adv_proto)) != 0) {
451 wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed "
452 "between initial and comeback response from "
453 MACSTR, MAC2STR(query->addr));
454 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
455 return;
456 }
457
458 if (comeback_delay) {
459 if (frag_id) {
460 wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response "
461 "with non-zero frag_id and comeback_delay "
462 "from " MACSTR, MAC2STR(query->addr));
463 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
464 return;
465 }
466 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
467 return;
468 }
469
470 if (frag_id != query->next_frag_id) {
471 wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response "
472 "from " MACSTR, MAC2STR(query->addr));
473 if (frag_id + 1 == query->next_frag_id) {
474 wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible "
475 "retry of previous fragment");
476 return;
477 }
478 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR);
479 return;
480 }
481 query->next_frag_id++;
482
483 if (gas_query_append(query, resp, len) < 0) {
484 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
485 return;
486 }
487
488 if (more_frags) {
489 gas_query_tx_comeback_req(gas, query);
490 return;
491 }
492
493 gas_query_done(gas, query, GAS_QUERY_SUCCESS);
494 }
495
496
497 /**
498 * gas_query_rx - Indicate reception of a Public Action or Protected Dual frame
499 * @gas: GAS query data from gas_query_init()
500 * @da: Destination MAC address of the Action frame
501 * @sa: Source MAC address of the Action frame
502 * @bssid: BSSID of the Action frame
503 * @categ: Category of the Action frame
504 * @data: Payload of the Action frame
505 * @len: Length of @data
506 * @freq: Frequency (in MHz) on which the frame was received
507 * Returns: 0 if the Public Action frame was a GAS frame or -1 if not
508 */
gas_query_rx(struct gas_query * gas,const u8 * da,const u8 * sa,const u8 * bssid,u8 categ,const u8 * data,size_t len,int freq)509 int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa,
510 const u8 *bssid, u8 categ, const u8 *data, size_t len,
511 int freq)
512 {
513 struct gas_query_pending *query;
514 u8 action, dialog_token, frag_id = 0, more_frags = 0;
515 u16 comeback_delay, resp_len;
516 const u8 *pos, *adv_proto;
517 int prot, pmf;
518 unsigned int left;
519
520 if (gas == NULL || len < 4)
521 return -1;
522
523 pos = data;
524 action = *pos++;
525 dialog_token = *pos++;
526
527 if (action != WLAN_PA_GAS_INITIAL_RESP &&
528 action != WLAN_PA_GAS_COMEBACK_RESP)
529 return -1; /* Not a GAS response */
530
531 prot = categ == WLAN_ACTION_PROTECTED_DUAL;
532 pmf = pmf_in_use(gas->wpa_s, sa);
533 if (prot && !pmf) {
534 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled");
535 return 0;
536 }
537 if (!prot && pmf) {
538 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled");
539 return 0;
540 }
541
542 query = gas_query_get_pending(gas, sa, dialog_token);
543 if (query == NULL) {
544 wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR
545 " dialog token %u", MAC2STR(sa), dialog_token);
546 return -1;
547 }
548
549 wpa_printf(MSG_DEBUG, "GAS: Response in %d ms from " MACSTR,
550 ms_from_time(&query->last_oper), MAC2STR(sa));
551
552 if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) {
553 wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from "
554 MACSTR " dialog token %u when waiting for comeback "
555 "response", MAC2STR(sa), dialog_token);
556 return 0;
557 }
558
559 if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) {
560 wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from "
561 MACSTR " dialog token %u when waiting for initial "
562 "response", MAC2STR(sa), dialog_token);
563 return 0;
564 }
565
566 query->status_code = WPA_GET_LE16(pos);
567 pos += 2;
568
569 if (query->status_code == WLAN_STATUS_QUERY_RESP_OUTSTANDING &&
570 action == WLAN_PA_GAS_COMEBACK_RESP) {
571 wpa_printf(MSG_DEBUG, "GAS: Allow non-zero status for outstanding comeback response");
572 } else if (query->status_code != WLAN_STATUS_SUCCESS) {
573 wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token "
574 "%u failed - status code %u",
575 MAC2STR(sa), dialog_token, query->status_code);
576 gas_query_done(gas, query, GAS_QUERY_FAILURE);
577 return 0;
578 }
579
580 if (action == WLAN_PA_GAS_COMEBACK_RESP) {
581 if (pos + 1 > data + len)
582 return 0;
583 frag_id = *pos & 0x7f;
584 more_frags = (*pos & 0x80) >> 7;
585 pos++;
586 }
587
588 /* Comeback Delay */
589 if (pos + 2 > data + len)
590 return 0;
591 comeback_delay = WPA_GET_LE16(pos);
592 pos += 2;
593
594 /* Advertisement Protocol element */
595 if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) {
596 wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement "
597 "Protocol element in the response from " MACSTR,
598 MAC2STR(sa));
599 return 0;
600 }
601
602 if (*pos != WLAN_EID_ADV_PROTO) {
603 wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement "
604 "Protocol element ID %u in response from " MACSTR,
605 *pos, MAC2STR(sa));
606 return 0;
607 }
608
609 adv_proto = pos;
610 pos += 2 + pos[1];
611
612 /* Query Response Length */
613 if (pos + 2 > data + len) {
614 wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length");
615 return 0;
616 }
617 resp_len = WPA_GET_LE16(pos);
618 pos += 2;
619
620 left = data + len - pos;
621 if (resp_len > left) {
622 wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in "
623 "response from " MACSTR, MAC2STR(sa));
624 return 0;
625 }
626
627 if (resp_len < left) {
628 wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data "
629 "after Query Response from " MACSTR,
630 left - resp_len, MAC2STR(sa));
631 }
632
633 if (action == WLAN_PA_GAS_COMEBACK_RESP)
634 gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len,
635 frag_id, more_frags, comeback_delay);
636 else
637 gas_query_rx_initial(gas, query, adv_proto, pos, resp_len,
638 comeback_delay);
639
640 return 0;
641 }
642
643
gas_query_timeout(void * eloop_data,void * user_ctx)644 static void gas_query_timeout(void *eloop_data, void *user_ctx)
645 {
646 struct gas_query *gas = eloop_data;
647 struct gas_query_pending *query = user_ctx;
648
649 wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR
650 " dialog token %u",
651 MAC2STR(query->addr), query->dialog_token);
652 gas_query_done(gas, query, GAS_QUERY_TIMEOUT);
653 }
654
655
gas_query_dialog_token_available(struct gas_query * gas,const u8 * dst,u8 dialog_token)656 static int gas_query_dialog_token_available(struct gas_query *gas,
657 const u8 *dst, u8 dialog_token)
658 {
659 struct gas_query_pending *q;
660 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
661 if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 &&
662 dialog_token == q->dialog_token)
663 return 0;
664 }
665
666 return 1;
667 }
668
669
gas_query_start_cb(struct wpa_radio_work * work,int deinit)670 static void gas_query_start_cb(struct wpa_radio_work *work, int deinit)
671 {
672 struct gas_query_pending *query = work->ctx;
673 struct gas_query *gas = query->gas;
674 struct wpa_supplicant *wpa_s = gas->wpa_s;
675
676 if (deinit) {
677 if (work->started) {
678 gas->work = NULL;
679 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT);
680 return;
681 }
682
683 gas_query_free(query, 1);
684 return;
685 }
686
687 if (!query->maintain_addr && !wpa_s->conf->gas_rand_mac_addr) {
688 if (wpas_update_random_addr_disassoc(wpa_s) < 0) {
689 wpa_msg(wpa_s, MSG_INFO,
690 "Failed to assign random MAC address for GAS");
691 gas_query_free(query, 1);
692 radio_work_done(work);
693 return;
694 }
695 os_memcpy(query->sa, wpa_s->own_addr, ETH_ALEN);
696 }
697
698 gas->work = work;
699 gas_query_tx_initial_req(gas, query);
700 }
701
702
gas_query_tx_initial_req(struct gas_query * gas,struct gas_query_pending * query)703 static void gas_query_tx_initial_req(struct gas_query *gas,
704 struct gas_query_pending *query)
705 {
706 if (gas_query_tx(gas, query, query->req,
707 GAS_QUERY_WAIT_TIME_INITIAL) < 0) {
708 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
709 MACSTR, MAC2STR(query->addr));
710 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR);
711 return;
712 }
713 gas->current = query;
714
715 wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u",
716 query->dialog_token);
717 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
718 gas_query_timeout, gas, query);
719 }
720
721
gas_query_new_dialog_token(struct gas_query * gas,const u8 * dst)722 static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst)
723 {
724 u8 dialog_token;
725 int i;
726
727 /* There should never be more than couple active GAS queries in
728 * progress, so it should be very likely to find an available dialog
729 * token by checking random values. Use a limit on the number of
730 * iterations to handle the unexpected case of large number of pending
731 * queries cleanly. */
732 for (i = 0; i < 256; i++) {
733 /* Get a random number and check if the slot is available */
734 if (os_get_random(&dialog_token, sizeof(dialog_token)) < 0)
735 break;
736 if (gas_query_dialog_token_available(gas, dst, dialog_token))
737 return dialog_token;
738 }
739
740 /* No dialog token value available */
741 return -1;
742 }
743
744
gas_query_set_sa(struct gas_query * gas,struct gas_query_pending * query)745 static int gas_query_set_sa(struct gas_query *gas,
746 struct gas_query_pending *query)
747 {
748 struct wpa_supplicant *wpa_s = gas->wpa_s;
749 struct os_reltime now;
750
751 if (query->maintain_addr ||
752 !wpa_s->conf->gas_rand_mac_addr ||
753 !(wpa_s->current_bss ?
754 (wpa_s->drv_flags &
755 WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA_CONNECTED) :
756 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA))) {
757 /* Use own MAC address as the transmitter address */
758 wpa_printf(MSG_DEBUG,
759 "GAS: Use own MAC address as the transmitter address%s%s%s",
760 query->maintain_addr ? " (maintain_addr)" : "",
761 !wpa_s->conf->gas_rand_mac_addr ? " (no gas_rand_mac_adr set)" : "",
762 !(wpa_s->current_bss ?
763 (wpa_s->drv_flags &
764 WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA_CONNECTED) :
765 (wpa_s->drv_flags &
766 WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA)) ?
767 " (no driver rand capa" : "");
768 os_memcpy(query->sa, wpa_s->own_addr, ETH_ALEN);
769 return 0;
770 }
771
772 os_get_reltime(&now);
773
774 if (wpa_s->conf->gas_rand_mac_addr == gas->last_rand_sa_type &&
775 gas->last_mac_addr_rand.sec != 0 &&
776 !os_reltime_expired(&now, &gas->last_mac_addr_rand,
777 wpa_s->conf->gas_rand_addr_lifetime)) {
778 wpa_printf(MSG_DEBUG,
779 "GAS: Use the previously selected random transmitter address "
780 MACSTR, MAC2STR(gas->rand_addr));
781 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN);
782 return 0;
783 }
784
785 if (wpa_s->conf->gas_rand_mac_addr == 1 &&
786 random_mac_addr(gas->rand_addr) < 0) {
787 wpa_printf(MSG_ERROR, "GAS: Failed to get random address");
788 return -1;
789 }
790
791 if (wpa_s->conf->gas_rand_mac_addr == 2 &&
792 random_mac_addr_keep_oui(gas->rand_addr) < 0) {
793 wpa_printf(MSG_ERROR,
794 "GAS: Failed to get random address with same OUI");
795 return -1;
796 }
797
798 wpa_printf(MSG_DEBUG, "GAS: Use a new random transmitter address "
799 MACSTR, MAC2STR(gas->rand_addr));
800 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN);
801 os_get_reltime(&gas->last_mac_addr_rand);
802 gas->last_rand_sa_type = wpa_s->conf->gas_rand_mac_addr;
803
804 return 0;
805 }
806
807
808 /**
809 * gas_query_req - Request a GAS query
810 * @gas: GAS query data from gas_query_init()
811 * @dst: Destination MAC address for the query
812 * @freq: Frequency (in MHz) for the channel on which to send the query
813 * @wildcard_bssid: Force use of wildcard BSSID value
814 * @maintain_addr: Maintain own MAC address for exchange (i.e., ignore MAC
815 * address randomization rules)
816 * @req: GAS query payload (to be freed by gas_query module in case of success
817 * return)
818 * @cb: Callback function for reporting GAS query result and response
819 * @ctx: Context pointer to use with the @cb call
820 * Returns: dialog token (>= 0) on success or -1 on failure
821 */
gas_query_req(struct gas_query * gas,const u8 * dst,int freq,int wildcard_bssid,int maintain_addr,struct wpabuf * req,void (* cb)(void * ctx,const u8 * dst,u8 dialog_token,enum gas_query_result result,const struct wpabuf * adv_proto,const struct wpabuf * resp,u16 status_code),void * ctx)822 int gas_query_req(struct gas_query *gas, const u8 *dst, int freq,
823 int wildcard_bssid, int maintain_addr, struct wpabuf *req,
824 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
825 enum gas_query_result result,
826 const struct wpabuf *adv_proto,
827 const struct wpabuf *resp, u16 status_code),
828 void *ctx)
829 {
830 struct gas_query_pending *query;
831 int dialog_token;
832
833 if (wpabuf_len(req) < 3)
834 return -1;
835
836 dialog_token = gas_query_new_dialog_token(gas, dst);
837 if (dialog_token < 0)
838 return -1;
839
840 query = os_zalloc(sizeof(*query));
841 if (query == NULL)
842 return -1;
843
844 query->gas = gas;
845 query->maintain_addr = !!maintain_addr;
846 if (gas_query_set_sa(gas, query)) {
847 os_free(query);
848 return -1;
849 }
850 os_memcpy(query->addr, dst, ETH_ALEN);
851 query->dialog_token = dialog_token;
852 query->wildcard_bssid = !!wildcard_bssid;
853 query->freq = freq;
854 query->cb = cb;
855 query->ctx = ctx;
856 query->req = req;
857 dl_list_add(&gas->pending, &query->list);
858
859 *(wpabuf_mhead_u8(req) + 2) = dialog_token;
860
861 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_START "addr=" MACSTR
862 " dialog_token=%u freq=%d",
863 MAC2STR(query->addr), query->dialog_token, query->freq);
864
865 if (radio_add_work(gas->wpa_s, freq, "gas-query", 0, gas_query_start_cb,
866 query) < 0) {
867 query->req = NULL; /* caller will free this in error case */
868 gas_query_free(query, 1);
869 return -1;
870 }
871
872 return dialog_token;
873 }
874
875
gas_query_stop(struct gas_query * gas,u8 dialog_token)876 int gas_query_stop(struct gas_query *gas, u8 dialog_token)
877 {
878 struct gas_query_pending *query;
879
880 dl_list_for_each(query, &gas->pending, struct gas_query_pending, list) {
881 if (query->dialog_token == dialog_token) {
882 if (!gas->work) {
883 /* The pending radio work has not yet been
884 * started, but the pending entry has a
885 * reference to the soon to be freed query.
886 * Need to remove that radio work now to avoid
887 * leaving behind a reference to freed memory.
888 */
889 radio_remove_pending_work(gas->wpa_s, query);
890 }
891 gas_query_done(gas, query, GAS_QUERY_STOPPED);
892 return 0;
893 }
894 }
895
896 return -1;
897 }
898