1/* 2 * Generic advertisement service (GAS) query 3 * Copyright (c) 2009, Atheros Communications 4 * Copyright (c) 2011-2014, Qualcomm Atheros, Inc. 5 * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi> 6 * 7 * This software may be distributed under the terms of the BSD license. 8 * See README for more details. 9 */ 10 11#include "includes.h" 12 13#include "common.h" 14#include "utils/eloop.h" 15#include "common/ieee802_11_defs.h" 16#include "common/gas.h" 17#include "common/wpa_ctrl.h" 18#include "rsn_supp/wpa.h" 19#include "wpa_supplicant_i.h" 20#include "config.h" 21#include "driver_i.h" 22#include "offchannel.h" 23#include "gas_query.h" 24 25 26/** GAS query timeout in seconds */ 27#define GAS_QUERY_TIMEOUT_PERIOD 2 28 29/* GAS query wait-time / duration in ms */ 30#define GAS_QUERY_WAIT_TIME_INITIAL 1000 31#define GAS_QUERY_WAIT_TIME_COMEBACK 150 32 33/** 34 * struct gas_query_pending - Pending GAS query 35 */ 36struct gas_query_pending { 37 struct dl_list list; 38 struct gas_query *gas; 39 u8 addr[ETH_ALEN]; 40 u8 dialog_token; 41 u8 next_frag_id; 42 unsigned int wait_comeback:1; 43 unsigned int offchannel_tx_started:1; 44 unsigned int retry:1; 45 unsigned int wildcard_bssid:1; 46 int freq; 47 u16 status_code; 48 struct wpabuf *req; 49 struct wpabuf *adv_proto; 50 struct wpabuf *resp; 51 struct os_reltime last_oper; 52 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token, 53 enum gas_query_result result, 54 const struct wpabuf *adv_proto, 55 const struct wpabuf *resp, u16 status_code); 56 void *ctx; 57 u8 sa[ETH_ALEN]; 58}; 59 60/** 61 * struct gas_query - Internal GAS query data 62 */ 63struct gas_query { 64 struct wpa_supplicant *wpa_s; 65 struct dl_list pending; /* struct gas_query_pending */ 66 struct gas_query_pending *current; 67 struct wpa_radio_work *work; 68 struct os_reltime last_mac_addr_rand; 69 int last_rand_sa_type; 70 u8 rand_addr[ETH_ALEN]; 71}; 72 73 74static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx); 75static void gas_query_timeout(void *eloop_data, void *user_ctx); 76static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx); 77static void gas_query_tx_initial_req(struct gas_query *gas, 78 struct gas_query_pending *query); 79static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst); 80 81 82static int ms_from_time(struct os_reltime *last) 83{ 84 struct os_reltime now, res; 85 86 os_get_reltime(&now); 87 os_reltime_sub(&now, last, &res); 88 return res.sec * 1000 + res.usec / 1000; 89} 90 91 92/** 93 * gas_query_init - Initialize GAS query component 94 * @wpa_s: Pointer to wpa_supplicant data 95 * Returns: Pointer to GAS query data or %NULL on failure 96 */ 97struct gas_query * gas_query_init(struct wpa_supplicant *wpa_s) 98{ 99 struct gas_query *gas; 100 101 gas = os_zalloc(sizeof(*gas)); 102 if (gas == NULL) 103 return NULL; 104 105 gas->wpa_s = wpa_s; 106 dl_list_init(&gas->pending); 107 108 return gas; 109} 110 111 112static const char * gas_result_txt(enum gas_query_result result) 113{ 114 switch (result) { 115 case GAS_QUERY_SUCCESS: 116 return "SUCCESS"; 117 case GAS_QUERY_FAILURE: 118 return "FAILURE"; 119 case GAS_QUERY_TIMEOUT: 120 return "TIMEOUT"; 121 case GAS_QUERY_PEER_ERROR: 122 return "PEER_ERROR"; 123 case GAS_QUERY_INTERNAL_ERROR: 124 return "INTERNAL_ERROR"; 125 case GAS_QUERY_STOPPED: 126 return "STOPPED"; 127 case GAS_QUERY_DELETED_AT_DEINIT: 128 return "DELETED_AT_DEINIT"; 129 } 130 131 return "N/A"; 132} 133 134 135static void gas_query_free(struct gas_query_pending *query, int del_list) 136{ 137 struct gas_query *gas = query->gas; 138 139 if (del_list) 140 dl_list_del(&query->list); 141 142 if (gas->work && gas->work->ctx == query) { 143 radio_work_done(gas->work); 144 gas->work = NULL; 145 } 146 147 wpabuf_free(query->req); 148 wpabuf_free(query->adv_proto); 149 wpabuf_free(query->resp); 150 os_free(query); 151} 152 153 154static void gas_query_done(struct gas_query *gas, 155 struct gas_query_pending *query, 156 enum gas_query_result result) 157{ 158 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR 159 " dialog_token=%u freq=%d status_code=%u result=%s", 160 MAC2STR(query->addr), query->dialog_token, query->freq, 161 query->status_code, gas_result_txt(result)); 162 if (gas->current == query) 163 gas->current = NULL; 164 if (query->offchannel_tx_started) 165 offchannel_send_action_done(gas->wpa_s); 166 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); 167 eloop_cancel_timeout(gas_query_timeout, gas, query); 168 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query); 169 dl_list_del(&query->list); 170 query->cb(query->ctx, query->addr, query->dialog_token, result, 171 query->adv_proto, query->resp, query->status_code); 172 gas_query_free(query, 0); 173} 174 175 176/** 177 * gas_query_deinit - Deinitialize GAS query component 178 * @gas: GAS query data from gas_query_init() 179 */ 180void gas_query_deinit(struct gas_query *gas) 181{ 182 struct gas_query_pending *query, *next; 183 184 if (gas == NULL) 185 return; 186 187 dl_list_for_each_safe(query, next, &gas->pending, 188 struct gas_query_pending, list) 189 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT); 190 191 os_free(gas); 192} 193 194 195static struct gas_query_pending * 196gas_query_get_pending(struct gas_query *gas, const u8 *addr, u8 dialog_token) 197{ 198 struct gas_query_pending *q; 199 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) { 200 if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 && 201 q->dialog_token == dialog_token) 202 return q; 203 } 204 return NULL; 205} 206 207 208static int gas_query_append(struct gas_query_pending *query, const u8 *data, 209 size_t len) 210{ 211 if (wpabuf_resize(&query->resp, len) < 0) { 212 wpa_printf(MSG_DEBUG, "GAS: No memory to store the response"); 213 return -1; 214 } 215 wpabuf_put_data(query->resp, data, len); 216 return 0; 217} 218 219 220static void gas_query_tx_status(struct wpa_supplicant *wpa_s, 221 unsigned int freq, const u8 *dst, 222 const u8 *src, const u8 *bssid, 223 const u8 *data, size_t data_len, 224 enum offchannel_send_action_result result) 225{ 226 struct gas_query_pending *query; 227 struct gas_query *gas = wpa_s->gas; 228 int dur; 229 230 if (gas->current == NULL) { 231 wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: freq=%u dst=" 232 MACSTR " result=%d - no query in progress", 233 freq, MAC2STR(dst), result); 234 return; 235 } 236 237 query = gas->current; 238 239 dur = ms_from_time(&query->last_oper); 240 wpa_printf(MSG_DEBUG, "GAS: TX status: freq=%u dst=" MACSTR 241 " result=%d query=%p dialog_token=%u dur=%d ms", 242 freq, MAC2STR(dst), result, query, query->dialog_token, dur); 243 if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) { 244 wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination"); 245 return; 246 } 247 os_get_reltime(&query->last_oper); 248 249 if (result == OFFCHANNEL_SEND_ACTION_SUCCESS || 250 result == OFFCHANNEL_SEND_ACTION_NO_ACK) { 251 eloop_cancel_timeout(gas_query_timeout, gas, query); 252 if (result == OFFCHANNEL_SEND_ACTION_NO_ACK) { 253 wpa_printf(MSG_DEBUG, "GAS: No ACK to GAS request"); 254 eloop_register_timeout(0, 250000, 255 gas_query_timeout, gas, query); 256 } else { 257 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0, 258 gas_query_timeout, gas, query); 259 } 260 if (query->wait_comeback && !query->retry) { 261 eloop_cancel_timeout(gas_query_rx_comeback_timeout, 262 gas, query); 263 eloop_register_timeout( 264 0, (GAS_QUERY_WAIT_TIME_COMEBACK + 10) * 1000, 265 gas_query_rx_comeback_timeout, gas, query); 266 } 267 } 268 if (result == OFFCHANNEL_SEND_ACTION_FAILED) { 269 eloop_cancel_timeout(gas_query_timeout, gas, query); 270 eloop_register_timeout(0, 0, gas_query_timeout, gas, query); 271 } 272} 273 274 275int pmf_in_use(struct wpa_supplicant *wpa_s, const u8 *addr) 276{ 277 if (wpa_s->current_ssid == NULL || 278 wpa_s->wpa_state < WPA_4WAY_HANDSHAKE || 279 os_memcmp(addr, wpa_s->bssid, ETH_ALEN) != 0) 280 return 0; 281 return wpa_sm_pmf_enabled(wpa_s->wpa); 282} 283 284 285static int gas_query_tx(struct gas_query *gas, struct gas_query_pending *query, 286 struct wpabuf *req, unsigned int wait_time) 287{ 288 int res, prot = pmf_in_use(gas->wpa_s, query->addr); 289 const u8 *bssid; 290 const u8 wildcard_bssid[ETH_ALEN] = { 291 0xff, 0xff, 0xff, 0xff, 0xff, 0xff 292 }; 293 294 wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u " 295 "freq=%d prot=%d using src addr " MACSTR, 296 MAC2STR(query->addr), (unsigned int) wpabuf_len(req), 297 query->freq, prot, MAC2STR(query->sa)); 298 if (prot) { 299 u8 *categ = wpabuf_mhead_u8(req); 300 *categ = WLAN_ACTION_PROTECTED_DUAL; 301 } 302 os_get_reltime(&query->last_oper); 303 if (gas->wpa_s->max_remain_on_chan && 304 wait_time > gas->wpa_s->max_remain_on_chan) 305 wait_time = gas->wpa_s->max_remain_on_chan; 306 if (!query->wildcard_bssid && 307 (!gas->wpa_s->conf->gas_address3 || 308 (gas->wpa_s->current_ssid && 309 gas->wpa_s->wpa_state >= WPA_ASSOCIATED && 310 os_memcmp(query->addr, gas->wpa_s->bssid, ETH_ALEN) == 0))) 311 bssid = query->addr; 312 else 313 bssid = wildcard_bssid; 314 315 res = offchannel_send_action(gas->wpa_s, query->freq, query->addr, 316 query->sa, bssid, wpabuf_head(req), 317 wpabuf_len(req), wait_time, 318 gas_query_tx_status, 0); 319 320 if (res == 0) 321 query->offchannel_tx_started = 1; 322 return res; 323} 324 325 326static void gas_query_tx_comeback_req(struct gas_query *gas, 327 struct gas_query_pending *query) 328{ 329 struct wpabuf *req; 330 unsigned int wait_time; 331 332 req = gas_build_comeback_req(query->dialog_token); 333 if (req == NULL) { 334 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 335 return; 336 } 337 338 wait_time = (query->retry || !query->offchannel_tx_started) ? 339 GAS_QUERY_WAIT_TIME_INITIAL : GAS_QUERY_WAIT_TIME_COMEBACK; 340 341 if (gas_query_tx(gas, query, req, wait_time) < 0) { 342 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to " 343 MACSTR, MAC2STR(query->addr)); 344 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 345 } 346 347 wpabuf_free(req); 348} 349 350 351static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx) 352{ 353 struct gas_query *gas = eloop_data; 354 struct gas_query_pending *query = user_ctx; 355 int dialog_token; 356 357 wpa_printf(MSG_DEBUG, 358 "GAS: No response to comeback request received (retry=%u)", 359 query->retry); 360 if (gas->current != query || query->retry) 361 return; 362 dialog_token = gas_query_new_dialog_token(gas, query->addr); 363 if (dialog_token < 0) 364 return; 365 wpa_printf(MSG_DEBUG, 366 "GAS: Retry GAS query due to comeback response timeout"); 367 query->retry = 1; 368 query->dialog_token = dialog_token; 369 *(wpabuf_mhead_u8(query->req) + 2) = dialog_token; 370 query->wait_comeback = 0; 371 query->next_frag_id = 0; 372 wpabuf_free(query->adv_proto); 373 query->adv_proto = NULL; 374 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); 375 eloop_cancel_timeout(gas_query_timeout, gas, query); 376 gas_query_tx_initial_req(gas, query); 377} 378 379 380static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx) 381{ 382 struct gas_query *gas = eloop_data; 383 struct gas_query_pending *query = user_ctx; 384 385 wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR, 386 MAC2STR(query->addr)); 387 gas_query_tx_comeback_req(gas, query); 388} 389 390 391static void gas_query_tx_comeback_req_delay(struct gas_query *gas, 392 struct gas_query_pending *query, 393 u16 comeback_delay) 394{ 395 unsigned int secs, usecs; 396 397 if (comeback_delay > 1 && query->offchannel_tx_started) { 398 offchannel_send_action_done(gas->wpa_s); 399 query->offchannel_tx_started = 0; 400 } 401 402 secs = (comeback_delay * 1024) / 1000000; 403 usecs = comeback_delay * 1024 - secs * 1000000; 404 wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR 405 " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs); 406 eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query); 407 eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout, 408 gas, query); 409} 410 411 412static void gas_query_rx_initial(struct gas_query *gas, 413 struct gas_query_pending *query, 414 const u8 *adv_proto, const u8 *resp, 415 size_t len, u16 comeback_delay) 416{ 417 wpa_printf(MSG_DEBUG, "GAS: Received initial response from " 418 MACSTR " (dialog_token=%u comeback_delay=%u)", 419 MAC2STR(query->addr), query->dialog_token, comeback_delay); 420 421 query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]); 422 if (query->adv_proto == NULL) { 423 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 424 return; 425 } 426 427 if (comeback_delay) { 428 eloop_cancel_timeout(gas_query_timeout, gas, query); 429 query->wait_comeback = 1; 430 gas_query_tx_comeback_req_delay(gas, query, comeback_delay); 431 return; 432 } 433 434 /* Query was completed without comeback mechanism */ 435 if (gas_query_append(query, resp, len) < 0) { 436 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 437 return; 438 } 439 440 gas_query_done(gas, query, GAS_QUERY_SUCCESS); 441} 442 443 444static void gas_query_rx_comeback(struct gas_query *gas, 445 struct gas_query_pending *query, 446 const u8 *adv_proto, const u8 *resp, 447 size_t len, u8 frag_id, u8 more_frags, 448 u16 comeback_delay) 449{ 450 wpa_printf(MSG_DEBUG, "GAS: Received comeback response from " 451 MACSTR " (dialog_token=%u frag_id=%u more_frags=%u " 452 "comeback_delay=%u)", 453 MAC2STR(query->addr), query->dialog_token, frag_id, 454 more_frags, comeback_delay); 455 eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query); 456 457 if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) || 458 os_memcmp(adv_proto, wpabuf_head(query->adv_proto), 459 wpabuf_len(query->adv_proto)) != 0) { 460 wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed " 461 "between initial and comeback response from " 462 MACSTR, MAC2STR(query->addr)); 463 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR); 464 return; 465 } 466 467 if (comeback_delay) { 468 if (frag_id) { 469 wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response " 470 "with non-zero frag_id and comeback_delay " 471 "from " MACSTR, MAC2STR(query->addr)); 472 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR); 473 return; 474 } 475 gas_query_tx_comeback_req_delay(gas, query, comeback_delay); 476 return; 477 } 478 479 if (frag_id != query->next_frag_id) { 480 wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response " 481 "from " MACSTR, MAC2STR(query->addr)); 482 if (frag_id + 1 == query->next_frag_id) { 483 wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible " 484 "retry of previous fragment"); 485 return; 486 } 487 gas_query_done(gas, query, GAS_QUERY_PEER_ERROR); 488 return; 489 } 490 query->next_frag_id++; 491 492 if (gas_query_append(query, resp, len) < 0) { 493 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 494 return; 495 } 496 497 if (more_frags) { 498 gas_query_tx_comeback_req(gas, query); 499 return; 500 } 501 502 gas_query_done(gas, query, GAS_QUERY_SUCCESS); 503} 504 505 506/** 507 * gas_query_rx - Indicate reception of a Public Action or Protected Dual frame 508 * @gas: GAS query data from gas_query_init() 509 * @da: Destination MAC address of the Action frame 510 * @sa: Source MAC address of the Action frame 511 * @bssid: BSSID of the Action frame 512 * @categ: Category of the Action frame 513 * @data: Payload of the Action frame 514 * @len: Length of @data 515 * @freq: Frequency (in MHz) on which the frame was received 516 * Returns: 0 if the Public Action frame was a GAS frame or -1 if not 517 */ 518int gas_query_rx(struct gas_query *gas, const u8 *da, const u8 *sa, 519 const u8 *bssid, u8 categ, const u8 *data, size_t len, 520 int freq) 521{ 522 struct gas_query_pending *query; 523 u8 action, dialog_token, frag_id = 0, more_frags = 0; 524 u16 comeback_delay, resp_len; 525 const u8 *pos, *adv_proto; 526 int prot, pmf; 527 unsigned int left; 528 529 if (gas == NULL || len < 4) 530 return -1; 531 532 pos = data; 533 action = *pos++; 534 dialog_token = *pos++; 535 536 if (action != WLAN_PA_GAS_INITIAL_RESP && 537 action != WLAN_PA_GAS_COMEBACK_RESP) 538 return -1; /* Not a GAS response */ 539 540 prot = categ == WLAN_ACTION_PROTECTED_DUAL; 541 pmf = pmf_in_use(gas->wpa_s, sa); 542 if (prot && !pmf) { 543 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled"); 544 return 0; 545 } 546 if (!prot && pmf) { 547 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled"); 548 return 0; 549 } 550 551 query = gas_query_get_pending(gas, sa, dialog_token); 552 if (query == NULL) { 553 wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR 554 " dialog token %u", MAC2STR(sa), dialog_token); 555 return -1; 556 } 557 558 wpa_printf(MSG_DEBUG, "GAS: Response in %d ms from " MACSTR, 559 ms_from_time(&query->last_oper), MAC2STR(sa)); 560 561 if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) { 562 wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from " 563 MACSTR " dialog token %u when waiting for comeback " 564 "response", MAC2STR(sa), dialog_token); 565 return 0; 566 } 567 568 if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) { 569 wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from " 570 MACSTR " dialog token %u when waiting for initial " 571 "response", MAC2STR(sa), dialog_token); 572 return 0; 573 } 574 575 query->status_code = WPA_GET_LE16(pos); 576 pos += 2; 577 578 if (query->status_code == WLAN_STATUS_QUERY_RESP_OUTSTANDING && 579 action == WLAN_PA_GAS_COMEBACK_RESP) { 580 wpa_printf(MSG_DEBUG, "GAS: Allow non-zero status for outstanding comeback response"); 581 } else if (query->status_code != WLAN_STATUS_SUCCESS) { 582 wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token " 583 "%u failed - status code %u", 584 MAC2STR(sa), dialog_token, query->status_code); 585 gas_query_done(gas, query, GAS_QUERY_FAILURE); 586 return 0; 587 } 588 589 if (action == WLAN_PA_GAS_COMEBACK_RESP) { 590 if (pos + 1 > data + len) 591 return 0; 592 frag_id = *pos & 0x7f; 593 more_frags = (*pos & 0x80) >> 7; 594 pos++; 595 } 596 597 /* Comeback Delay */ 598 if (pos + 2 > data + len) 599 return 0; 600 comeback_delay = WPA_GET_LE16(pos); 601 pos += 2; 602 603 /* Advertisement Protocol element */ 604 if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) { 605 wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement " 606 "Protocol element in the response from " MACSTR, 607 MAC2STR(sa)); 608 return 0; 609 } 610 611 if (*pos != WLAN_EID_ADV_PROTO) { 612 wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement " 613 "Protocol element ID %u in response from " MACSTR, 614 *pos, MAC2STR(sa)); 615 return 0; 616 } 617 618 adv_proto = pos; 619 pos += 2 + pos[1]; 620 621 /* Query Response Length */ 622 if (pos + 2 > data + len) { 623 wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length"); 624 return 0; 625 } 626 resp_len = WPA_GET_LE16(pos); 627 pos += 2; 628 629 left = data + len - pos; 630 if (resp_len > left) { 631 wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in " 632 "response from " MACSTR, MAC2STR(sa)); 633 return 0; 634 } 635 636 if (resp_len < left) { 637 wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data " 638 "after Query Response from " MACSTR, 639 left - resp_len, MAC2STR(sa)); 640 } 641 642 if (action == WLAN_PA_GAS_COMEBACK_RESP) 643 gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len, 644 frag_id, more_frags, comeback_delay); 645 else 646 gas_query_rx_initial(gas, query, adv_proto, pos, resp_len, 647 comeback_delay); 648 649 return 0; 650} 651 652 653static void gas_query_timeout(void *eloop_data, void *user_ctx) 654{ 655 struct gas_query *gas = eloop_data; 656 struct gas_query_pending *query = user_ctx; 657 658 wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR 659 " dialog token %u", 660 MAC2STR(query->addr), query->dialog_token); 661 gas_query_done(gas, query, GAS_QUERY_TIMEOUT); 662} 663 664 665static int gas_query_dialog_token_available(struct gas_query *gas, 666 const u8 *dst, u8 dialog_token) 667{ 668 struct gas_query_pending *q; 669 dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) { 670 if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 && 671 dialog_token == q->dialog_token) 672 return 0; 673 } 674 675 return 1; 676} 677 678 679static void gas_query_start_cb(struct wpa_radio_work *work, int deinit) 680{ 681 struct gas_query_pending *query = work->ctx; 682 struct gas_query *gas = query->gas; 683 struct wpa_supplicant *wpa_s = gas->wpa_s; 684 685 if (deinit) { 686 if (work->started) { 687 gas->work = NULL; 688 gas_query_done(gas, query, GAS_QUERY_DELETED_AT_DEINIT); 689 return; 690 } 691 692 gas_query_free(query, 1); 693 return; 694 } 695 696 if (wpas_update_random_addr_disassoc(wpa_s) < 0) { 697 wpa_msg(wpa_s, MSG_INFO, 698 "Failed to assign random MAC address for GAS"); 699 gas_query_free(query, 1); 700 radio_work_done(work); 701 return; 702 } 703 704 gas->work = work; 705 gas_query_tx_initial_req(gas, query); 706} 707 708 709static void gas_query_tx_initial_req(struct gas_query *gas, 710 struct gas_query_pending *query) 711{ 712 if (gas_query_tx(gas, query, query->req, 713 GAS_QUERY_WAIT_TIME_INITIAL) < 0) { 714 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to " 715 MACSTR, MAC2STR(query->addr)); 716 gas_query_done(gas, query, GAS_QUERY_INTERNAL_ERROR); 717 return; 718 } 719 gas->current = query; 720 721 wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u", 722 query->dialog_token); 723 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0, 724 gas_query_timeout, gas, query); 725} 726 727 728static int gas_query_new_dialog_token(struct gas_query *gas, const u8 *dst) 729{ 730 static int next_start = 0; 731 int dialog_token; 732 733 for (dialog_token = 0; dialog_token < 256; dialog_token++) { 734 if (gas_query_dialog_token_available( 735 gas, dst, (next_start + dialog_token) % 256)) 736 break; 737 } 738 if (dialog_token == 256) 739 return -1; /* Too many pending queries */ 740 dialog_token = (next_start + dialog_token) % 256; 741 next_start = (dialog_token + 1) % 256; 742 return dialog_token; 743} 744 745 746static int gas_query_set_sa(struct gas_query *gas, 747 struct gas_query_pending *query) 748{ 749 struct wpa_supplicant *wpa_s = gas->wpa_s; 750 struct os_reltime now; 751 752 if (!wpa_s->conf->gas_rand_mac_addr || 753 !(wpa_s->current_bss ? 754 (wpa_s->drv_flags & 755 WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA_CONNECTED) : 756 (wpa_s->drv_flags & WPA_DRIVER_FLAGS_MGMT_TX_RANDOM_TA))) { 757 /* Use own MAC address as the transmitter address */ 758 os_memcpy(query->sa, wpa_s->own_addr, ETH_ALEN); 759 return 0; 760 } 761 762 os_get_reltime(&now); 763 764 if (wpa_s->conf->gas_rand_mac_addr == gas->last_rand_sa_type && 765 gas->last_mac_addr_rand.sec != 0 && 766 !os_reltime_expired(&now, &gas->last_mac_addr_rand, 767 wpa_s->conf->gas_rand_addr_lifetime)) { 768 wpa_printf(MSG_DEBUG, 769 "GAS: Use the previously selected random transmitter address " 770 MACSTR, MAC2STR(gas->rand_addr)); 771 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN); 772 return 0; 773 } 774 775 if (wpa_s->conf->gas_rand_mac_addr == 1 && 776 random_mac_addr(gas->rand_addr) < 0) { 777 wpa_printf(MSG_ERROR, "GAS: Failed to get random address"); 778 return -1; 779 } 780 781 if (wpa_s->conf->gas_rand_mac_addr == 2 && 782 random_mac_addr_keep_oui(gas->rand_addr) < 0) { 783 wpa_printf(MSG_ERROR, 784 "GAS: Failed to get random address with same OUI"); 785 return -1; 786 } 787 788 wpa_printf(MSG_DEBUG, "GAS: Use a new random transmitter address " 789 MACSTR, MAC2STR(gas->rand_addr)); 790 os_memcpy(query->sa, gas->rand_addr, ETH_ALEN); 791 os_get_reltime(&gas->last_mac_addr_rand); 792 gas->last_rand_sa_type = wpa_s->conf->gas_rand_mac_addr; 793 794 return 0; 795} 796 797 798/** 799 * gas_query_req - Request a GAS query 800 * @gas: GAS query data from gas_query_init() 801 * @dst: Destination MAC address for the query 802 * @freq: Frequency (in MHz) for the channel on which to send the query 803 * @req: GAS query payload (to be freed by gas_query module in case of success 804 * return) 805 * @cb: Callback function for reporting GAS query result and response 806 * @ctx: Context pointer to use with the @cb call 807 * Returns: dialog token (>= 0) on success or -1 on failure 808 */ 809int gas_query_req(struct gas_query *gas, const u8 *dst, int freq, 810 int wildcard_bssid, struct wpabuf *req, 811 void (*cb)(void *ctx, const u8 *dst, u8 dialog_token, 812 enum gas_query_result result, 813 const struct wpabuf *adv_proto, 814 const struct wpabuf *resp, u16 status_code), 815 void *ctx) 816{ 817 struct gas_query_pending *query; 818 int dialog_token; 819 820 if (wpabuf_len(req) < 3) 821 return -1; 822 823 dialog_token = gas_query_new_dialog_token(gas, dst); 824 if (dialog_token < 0) 825 return -1; 826 827 query = os_zalloc(sizeof(*query)); 828 if (query == NULL) 829 return -1; 830 831 query->gas = gas; 832 if (gas_query_set_sa(gas, query)) { 833 os_free(query); 834 return -1; 835 } 836 os_memcpy(query->addr, dst, ETH_ALEN); 837 query->dialog_token = dialog_token; 838 query->wildcard_bssid = !!wildcard_bssid; 839 query->freq = freq; 840 query->cb = cb; 841 query->ctx = ctx; 842 query->req = req; 843 dl_list_add(&gas->pending, &query->list); 844 845 *(wpabuf_mhead_u8(req) + 2) = dialog_token; 846 847 wpa_msg(gas->wpa_s, MSG_INFO, GAS_QUERY_START "addr=" MACSTR 848 " dialog_token=%u freq=%d", 849 MAC2STR(query->addr), query->dialog_token, query->freq); 850 851 if (radio_add_work(gas->wpa_s, freq, "gas-query", 0, gas_query_start_cb, 852 query) < 0) { 853 query->req = NULL; /* caller will free this in error case */ 854 gas_query_free(query, 1); 855 return -1; 856 } 857 858 return dialog_token; 859} 860 861 862int gas_query_stop(struct gas_query *gas, u8 dialog_token) 863{ 864 struct gas_query_pending *query; 865 866 dl_list_for_each(query, &gas->pending, struct gas_query_pending, list) { 867 if (query->dialog_token == dialog_token) { 868 if (!gas->work) { 869 /* The pending radio work has not yet been 870 * started, but the pending entry has a 871 * reference to the soon to be freed query. 872 * Need to remove that radio work now to avoid 873 * leaving behind a reference to freed memory. 874 */ 875 radio_remove_pending_work(gas->wpa_s, query); 876 } 877 gas_query_done(gas, query, GAS_QUERY_STOPPED); 878 return 0; 879 } 880 } 881 882 return -1; 883} 884