/* * wpa_supplicant - Robust AV procedures * Copyright (c) 2020, The Linux Foundation * * This software may be distributed under the terms of the BSD license. * See README for more details. */ #include "utils/includes.h" #include "utils/common.h" #include "utils/eloop.h" #include "common/wpa_ctrl.h" #include "common/ieee802_11_common.h" #include "wpa_supplicant_i.h" #include "driver_i.h" #include "bss.h" #define SCS_RESP_TIMEOUT 1 #define DSCP_REQ_TIMEOUT 5 void wpas_populate_mscs_descriptor_ie(struct robust_av_data *robust_av, struct wpabuf *buf) { u8 *len, *len1; /* MSCS descriptor element */ wpabuf_put_u8(buf, WLAN_EID_EXTENSION); len = wpabuf_put(buf, 1); wpabuf_put_u8(buf, WLAN_EID_EXT_MSCS_DESCRIPTOR); wpabuf_put_u8(buf, robust_av->request_type); wpabuf_put_u8(buf, robust_av->up_bitmap); wpabuf_put_u8(buf, robust_av->up_limit); wpabuf_put_le32(buf, robust_av->stream_timeout); if (robust_av->request_type != SCS_REQ_REMOVE) { /* TCLAS mask element */ wpabuf_put_u8(buf, WLAN_EID_EXTENSION); len1 = wpabuf_put(buf, 1); wpabuf_put_u8(buf, WLAN_EID_EXT_TCLAS_MASK); /* Frame classifier */ wpabuf_put_data(buf, robust_av->frame_classifier, robust_av->frame_classifier_len); *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1; } *len = (u8 *) wpabuf_put(buf, 0) - len - 1; } static int wpas_populate_type4_classifier(struct type4_params *type4_param, struct wpabuf *buf) { /* classifier parameters */ wpabuf_put_u8(buf, type4_param->classifier_mask); if (type4_param->ip_version == IPV4) { wpabuf_put_u8(buf, IPV4); /* IP version */ wpabuf_put_data(buf, &type4_param->ip_params.v4.src_ip.s_addr, 4); wpabuf_put_data(buf, &type4_param->ip_params.v4.dst_ip.s_addr, 4); wpabuf_put_be16(buf, type4_param->ip_params.v4.src_port); wpabuf_put_be16(buf, type4_param->ip_params.v4.dst_port); wpabuf_put_u8(buf, type4_param->ip_params.v4.dscp); wpabuf_put_u8(buf, type4_param->ip_params.v4.protocol); wpabuf_put_u8(buf, 0); /* Reserved octet */ } else { wpabuf_put_u8(buf, IPV6); wpabuf_put_data(buf, &type4_param->ip_params.v6.src_ip.s6_addr, 16); wpabuf_put_data(buf, &type4_param->ip_params.v6.dst_ip.s6_addr, 16); wpabuf_put_be16(buf, type4_param->ip_params.v6.src_port); wpabuf_put_be16(buf, type4_param->ip_params.v6.dst_port); wpabuf_put_u8(buf, type4_param->ip_params.v6.dscp); wpabuf_put_u8(buf, type4_param->ip_params.v6.next_header); wpabuf_put_data(buf, type4_param->ip_params.v6.flow_label, 3); } return 0; } static int wpas_populate_type10_classifier(struct type10_params *type10_param, struct wpabuf *buf) { /* classifier parameters */ wpabuf_put_u8(buf, type10_param->prot_instance); wpabuf_put_u8(buf, type10_param->prot_number); wpabuf_put_data(buf, type10_param->filter_value, type10_param->filter_len); wpabuf_put_data(buf, type10_param->filter_mask, type10_param->filter_len); return 0; } static bool tclas_elem_required(const struct qos_characteristics *qos_elem) { if (!qos_elem || !qos_elem->available) return true; if (qos_elem->direction == SCS_DIRECTION_DOWN) return true; return false; } static int wpas_populate_scs_descriptor_ie(struct scs_desc_elem *desc_elem, struct wpabuf *buf, bool allow_scs_traffic_desc) { u8 *len, *len1; struct tclas_element *tclas_elem; unsigned int i; struct qos_characteristics *qos_elem; u32 control_info = 0; /* SCS Descriptor element */ wpabuf_put_u8(buf, WLAN_EID_SCS_DESCRIPTOR); len = wpabuf_put(buf, 1); wpabuf_put_u8(buf, desc_elem->scs_id); wpabuf_put_u8(buf, desc_elem->request_type); if (desc_elem->request_type == SCS_REQ_REMOVE) goto end; if (!tclas_elem_required(&desc_elem->qos_char_elem)) goto skip_tclas_elem; if (desc_elem->intra_access_priority || desc_elem->scs_up_avail) { wpabuf_put_u8(buf, WLAN_EID_INTRA_ACCESS_CATEGORY_PRIORITY); wpabuf_put_u8(buf, 1); wpabuf_put_u8(buf, desc_elem->intra_access_priority); } tclas_elem = desc_elem->tclas_elems; if (!tclas_elem) return -1; for (i = 0; i < desc_elem->num_tclas_elem; i++, tclas_elem++) { int ret; /* TCLAS element */ wpabuf_put_u8(buf, WLAN_EID_TCLAS); len1 = wpabuf_put(buf, 1); wpabuf_put_u8(buf, 255); /* User Priority: not compared */ /* Frame Classifier */ wpabuf_put_u8(buf, tclas_elem->classifier_type); /* Frame classifier parameters */ switch (tclas_elem->classifier_type) { case 4: ret = wpas_populate_type4_classifier( &tclas_elem->frame_classifier.type4_param, buf); break; case 10: ret = wpas_populate_type10_classifier( &tclas_elem->frame_classifier.type10_param, buf); break; default: return -1; } if (ret == -1) { wpa_printf(MSG_ERROR, "Failed to populate frame classifier"); return -1; } *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1; } if (desc_elem->num_tclas_elem > 1) { /* TCLAS Processing element */ wpabuf_put_u8(buf, WLAN_EID_TCLAS_PROCESSING); wpabuf_put_u8(buf, 1); wpabuf_put_u8(buf, desc_elem->tclas_processing); } skip_tclas_elem: if (allow_scs_traffic_desc && desc_elem->qos_char_elem.available) { qos_elem = &desc_elem->qos_char_elem; /* Element ID, Length, and Element ID Extension */ wpabuf_put_u8(buf, WLAN_EID_EXTENSION); len1 = wpabuf_put(buf, 1); wpabuf_put_u8(buf, WLAN_EID_EXT_QOS_CHARACTERISTICS); /* Remove invalid mask bits */ /* Medium Time is applicable only for direct link */ if ((qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME) && qos_elem->direction != SCS_DIRECTION_DIRECT) qos_elem->mask &= ~SCS_QOS_BIT_MEDIUM_TIME; /* Service Start Time LinkID is valid only when Service Start * Time is present. */ if ((qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID) && !(qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME)) qos_elem->mask &= ~SCS_QOS_BIT_SERVICE_START_TIME_LINKID; /* IEEE P802.11be/D4.0, 9.4.2.316 QoS Characteristics element, * Figure 9-1001av (Control Info field format) */ control_info = ((u32) qos_elem->direction << EHT_QOS_CONTROL_INFO_DIRECTION_OFFSET); control_info |= ((u32) desc_elem->intra_access_priority << EHT_QOS_CONTROL_INFO_TID_OFFSET); control_info |= ((u32) desc_elem->intra_access_priority << EHT_QOS_CONTROL_INFO_USER_PRIORITY_OFFSET); control_info |= ((u32) qos_elem->mask << EHT_QOS_CONTROL_INFO_PRESENCE_MASK_OFFSET); /* Control Info */ wpabuf_put_le32(buf, control_info); /* Minimum Service Interval */ wpabuf_put_le32(buf, qos_elem->min_si); /* Maximum Service Interval */ wpabuf_put_le32(buf, qos_elem->max_si); /* Minimum Data Rate */ wpabuf_put_le24(buf, qos_elem->min_data_rate); /* Delay Bound */ wpabuf_put_le24(buf, qos_elem->delay_bound); /* Maximum MSDU Size */ if (qos_elem->mask & SCS_QOS_BIT_MAX_MSDU_SIZE) wpabuf_put_le16(buf, qos_elem->max_msdu_size); /* Start Service Time */ if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME) wpabuf_put_le32(buf, qos_elem->service_start_time); /* Service Start Time LinkID */ if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID) wpabuf_put_u8(buf, qos_elem->service_start_time_link_id); /* Mean Data Rate */ if (qos_elem->mask & SCS_QOS_BIT_MEAN_DATA_RATE) wpabuf_put_le24(buf, qos_elem->mean_data_rate); /* Delayed Bounded Burst Size */ if (qos_elem->mask & SCS_QOS_BIT_DELAYED_BOUNDED_BURST_SIZE) wpabuf_put_le32(buf, qos_elem->burst_size); /* MSDU Lifetime */ if (qos_elem->mask & SCS_QOS_BIT_MSDU_LIFETIME) wpabuf_put_le16(buf, qos_elem->msdu_lifetime); /* MSDU Delivery Info */ if (qos_elem->mask & SCS_QOS_BIT_MSDU_DELIVERY_INFO) wpabuf_put_u8(buf, qos_elem->msdu_delivery_info); /* Medium Time */ if (qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME) wpabuf_put_le16(buf, qos_elem->medium_time); *len1 = (u8 *) wpabuf_put(buf, 0) - len1 - 1; } end: *len = (u8 *) wpabuf_put(buf, 0) - len - 1; return 0; } int wpas_send_mscs_req(struct wpa_supplicant *wpa_s) { struct wpabuf *buf; size_t buf_len; int ret; if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) return 0; if (!wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS)) { wpa_dbg(wpa_s, MSG_INFO, "AP does not support MSCS - could not send MSCS Req"); return -1; } if (!wpa_s->mscs_setup_done && wpa_s->robust_av.request_type != SCS_REQ_ADD) { wpa_msg(wpa_s, MSG_INFO, "MSCS: Failed to send MSCS Request: request type invalid"); return -1; } buf_len = 3 + /* Action frame header */ 3 + /* MSCS descriptor IE header */ 1 + /* Request type */ 2 + /* User priority control */ 4 + /* Stream timeout */ 3 + /* TCLAS Mask IE header */ wpa_s->robust_av.frame_classifier_len; buf = wpabuf_alloc(buf_len); if (!buf) { wpa_printf(MSG_ERROR, "Failed to allocate MSCS req"); return -1; } wpabuf_put_u8(buf, WLAN_ACTION_ROBUST_AV_STREAMING); wpabuf_put_u8(buf, ROBUST_AV_MSCS_REQ); wpa_s->robust_av.dialog_token++; wpabuf_put_u8(buf, wpa_s->robust_av.dialog_token); /* MSCS descriptor element */ wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, buf); wpa_hexdump_buf(MSG_MSGDUMP, "MSCS Request", buf); ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, wpa_s->own_addr, wpa_s->bssid, wpabuf_head(buf), wpabuf_len(buf), 0); if (ret < 0) wpa_dbg(wpa_s, MSG_INFO, "MSCS: Failed to send MSCS Request"); wpabuf_free(buf); return ret; } static size_t tclas_elem_len(const struct tclas_element *elem) { size_t buf_len = 0; buf_len += 2 + /* TCLAS element header */ 1 + /* User Priority */ 1 ; /* Classifier Type */ if (elem->classifier_type == 4) { enum ip_version ip_ver; buf_len += 1 + /* Classifier mask */ 1 + /* IP version */ 1 + /* user priority */ 2 + /* src_port */ 2 + /* dst_port */ 1 ; /* dscp */ ip_ver = elem->frame_classifier.type4_param.ip_version; if (ip_ver == IPV4) { buf_len += 4 + /* src_ip */ 4 + /* dst_ip */ 1 + /* protocol */ 1 ; /* Reserved */ } else if (ip_ver == IPV6) { buf_len += 16 + /* src_ip */ 16 + /* dst_ip */ 1 + /* next_header */ 3 ; /* flow_label */ } else { wpa_printf(MSG_ERROR, "%s: Incorrect IP version %d", __func__, ip_ver); return 0; } } else if (elem->classifier_type == 10) { buf_len += 1 + /* protocol instance */ 1 + /* protocol number */ 2 * elem->frame_classifier.type10_param.filter_len; } else { wpa_printf(MSG_ERROR, "%s: Incorrect classifier type %u", __func__, elem->classifier_type); return 0; } return buf_len; } static size_t qos_char_len(const struct qos_characteristics *qos_elem) { size_t buf_len = 0; buf_len += 1 + /* Element ID */ 1 + /* Length */ 1 + /* Element ID Extension */ 4 + /* Control Info */ 4 + /* Minimum Service Interval */ 4 + /* Maximum Service Interval */ 3 + /* Minimum Data Rate */ 3; /* Delay Bound */ if (qos_elem->mask & SCS_QOS_BIT_MAX_MSDU_SIZE) buf_len += 2; /* Maximum MSDU Size */ if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME) { buf_len += 4; /* Service Start Time */ if (qos_elem->mask & SCS_QOS_BIT_SERVICE_START_TIME_LINKID) buf_len++; /* Service Start Time LinkID */ } if (qos_elem->mask & SCS_QOS_BIT_MEAN_DATA_RATE) buf_len += 3; /* Mean Data Rate */ if (qos_elem->mask & SCS_QOS_BIT_DELAYED_BOUNDED_BURST_SIZE) buf_len += 4; /* Delayed Bounded Burst Size */ if (qos_elem->mask & SCS_QOS_BIT_MSDU_LIFETIME) buf_len += 2; /* MSDU Lifetime */ if (qos_elem->mask & SCS_QOS_BIT_MSDU_DELIVERY_INFO) buf_len++; /* MSDU Delivery Info */ if (qos_elem->mask & SCS_QOS_BIT_MEDIUM_TIME && qos_elem->direction == SCS_DIRECTION_DIRECT) buf_len += 2; /* Medium Time */ return buf_len; } static struct wpabuf * allocate_scs_buf(struct scs_desc_elem *desc_elem, unsigned int num_scs_desc, bool allow_scs_traffic_desc) { struct wpabuf *buf; size_t buf_len = 0; unsigned int i, j; buf_len = 3; /* Action frame header */ for (i = 0; i < num_scs_desc; i++, desc_elem++) { struct tclas_element *tclas_elem; buf_len += 2 + /* SCS descriptor IE header */ 1 + /* SCSID */ 1 ; /* Request type */ if (desc_elem->request_type == SCS_REQ_REMOVE) continue; if (allow_scs_traffic_desc && desc_elem->qos_char_elem.available) buf_len += qos_char_len(&desc_elem->qos_char_elem); if (!tclas_elem_required(&desc_elem->qos_char_elem)) continue; if (desc_elem->intra_access_priority || desc_elem->scs_up_avail) buf_len += 3; tclas_elem = desc_elem->tclas_elems; if (!tclas_elem) { wpa_printf(MSG_ERROR, "%s: TCLAS element null", __func__); return NULL; } for (j = 0; j < desc_elem->num_tclas_elem; j++, tclas_elem++) { size_t elen; elen = tclas_elem_len(tclas_elem); if (elen == 0) return NULL; buf_len += elen; } if (desc_elem->num_tclas_elem > 1) { buf_len += 1 + /* TCLAS Processing eid */ 1 + /* length */ 1 ; /* processing */ } } buf = wpabuf_alloc(buf_len); if (!buf) { wpa_printf(MSG_ERROR, "Failed to allocate SCS req"); return NULL; } return buf; } static void scs_request_timer(void *eloop_ctx, void *timeout_ctx) { struct wpa_supplicant *wpa_s = eloop_ctx; struct active_scs_elem *scs_desc, *prev; if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) return; /* Once timeout is over, remove all SCS descriptors with no response */ dl_list_for_each_safe(scs_desc, prev, &wpa_s->active_scs_ids, struct active_scs_elem, list) { u8 bssid[ETH_ALEN] = { 0 }; const u8 *src; if (scs_desc->status == SCS_DESC_SUCCESS) continue; if (wpa_s->current_bss) src = wpa_s->current_bss->bssid; else src = bssid; wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCS_RESULT "bssid=" MACSTR " SCSID=%u status_code=timedout", MAC2STR(src), scs_desc->scs_id); dl_list_del(&scs_desc->list); wpa_printf(MSG_INFO, "%s: SCSID %d removed after timeout", __func__, scs_desc->scs_id); os_free(scs_desc); } eloop_cancel_timeout(scs_request_timer, wpa_s, NULL); wpa_s->ongoing_scs_req = false; } int wpas_send_scs_req(struct wpa_supplicant *wpa_s) { struct wpabuf *buf = NULL; struct scs_desc_elem *desc_elem = NULL; const struct ieee80211_eht_capabilities *eht; const u8 *eht_ie; int ret = -1; unsigned int i; bool allow_scs_traffic_desc = false; if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) return -1; if (!wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_SCS)) { wpa_dbg(wpa_s, MSG_INFO, "AP does not support SCS - could not send SCS Request"); return -1; } desc_elem = wpa_s->scs_robust_av_req.scs_desc_elems; if (!desc_elem) return -1; if (wpa_is_non_eht_scs_traffic_desc_supported(wpa_s->current_bss)) allow_scs_traffic_desc = true; /* Allow SCS Traffic descriptor support for EHT connection */ eht_ie = wpa_bss_get_ie_ext(wpa_s->current_bss, WLAN_EID_EXT_EHT_CAPABILITIES); if (wpa_s->connection_eht && eht_ie && eht_ie[1] >= 1 + IEEE80211_EHT_CAPAB_MIN_LEN) { eht = (const struct ieee80211_eht_capabilities *) &eht_ie[3]; if (eht->mac_cap & EHT_MACCAP_SCS_TRAFFIC_DESC) allow_scs_traffic_desc = true; } if (!allow_scs_traffic_desc && desc_elem->qos_char_elem.available) { wpa_dbg(wpa_s, MSG_INFO, "Connection does not support EHT/non-EHT SCS Traffic Description - could not send SCS Request with QoS Characteristics"); return -1; } buf = allocate_scs_buf(desc_elem, wpa_s->scs_robust_av_req.num_scs_desc, allow_scs_traffic_desc); if (!buf) return -1; wpabuf_put_u8(buf, WLAN_ACTION_ROBUST_AV_STREAMING); wpabuf_put_u8(buf, ROBUST_AV_SCS_REQ); wpa_s->scs_dialog_token++; if (wpa_s->scs_dialog_token == 0) wpa_s->scs_dialog_token++; wpabuf_put_u8(buf, wpa_s->scs_dialog_token); for (i = 0; i < wpa_s->scs_robust_av_req.num_scs_desc; i++, desc_elem++) { /* SCS Descriptor element */ if (wpas_populate_scs_descriptor_ie(desc_elem, buf, allow_scs_traffic_desc) < 0) goto end; } wpa_hexdump_buf(MSG_DEBUG, "SCS Request", buf); ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, wpa_s->own_addr, wpa_s->bssid, wpabuf_head(buf), wpabuf_len(buf), 0); if (ret < 0) { wpa_dbg(wpa_s, MSG_ERROR, "SCS: Failed to send SCS Request"); wpa_s->scs_dialog_token--; goto end; } desc_elem = wpa_s->scs_robust_av_req.scs_desc_elems; for (i = 0; i < wpa_s->scs_robust_av_req.num_scs_desc; i++, desc_elem++) { struct active_scs_elem *active_scs_elem; if (desc_elem->request_type != SCS_REQ_ADD) continue; active_scs_elem = os_malloc(sizeof(struct active_scs_elem)); if (!active_scs_elem) break; active_scs_elem->scs_id = desc_elem->scs_id; active_scs_elem->status = SCS_DESC_SENT; dl_list_add(&wpa_s->active_scs_ids, &active_scs_elem->list); } /* * Register a timeout after which this request will be removed from * the cache. */ eloop_register_timeout(SCS_RESP_TIMEOUT, 0, scs_request_timer, wpa_s, NULL); wpa_s->ongoing_scs_req = true; end: wpabuf_free(buf); free_up_scs_desc(&wpa_s->scs_robust_av_req); return ret; } void free_up_tclas_elem(struct scs_desc_elem *elem) { struct tclas_element *tclas_elems = elem->tclas_elems; unsigned int num_tclas_elem = elem->num_tclas_elem; struct tclas_element *tclas_data; unsigned int j; elem->tclas_elems = NULL; elem->num_tclas_elem = 0; if (!tclas_elems) return; tclas_data = tclas_elems; for (j = 0; j < num_tclas_elem; j++, tclas_data++) { if (tclas_data->classifier_type != 10) continue; os_free(tclas_data->frame_classifier.type10_param.filter_value); os_free(tclas_data->frame_classifier.type10_param.filter_mask); } os_free(tclas_elems); } void free_up_scs_desc(struct scs_robust_av_data *data) { struct scs_desc_elem *desc_elems = data->scs_desc_elems; unsigned int num_scs_desc = data->num_scs_desc; struct scs_desc_elem *desc_data; unsigned int i; data->scs_desc_elems = NULL; data->num_scs_desc = 0; if (!desc_elems) return; desc_data = desc_elems; for (i = 0; i < num_scs_desc; i++, desc_data++) { if (desc_data->request_type == SCS_REQ_REMOVE || !desc_data->tclas_elems) continue; free_up_tclas_elem(desc_data); } os_free(desc_elems); } /* Element ID Extension(1) + Request Type(1) + User Priority Control(2) + * Stream Timeout(4) */ #define MSCS_DESCRIPTOR_FIXED_LEN 8 static void wpas_parse_mscs_resp(struct wpa_supplicant *wpa_s, u16 status, const u8 *bssid, const u8 *mscs_desc_ie) { struct robust_av_data robust_av; const u8 *pos; /* The MSCS Descriptor element is optional in the MSCS Response frame */ if (!mscs_desc_ie) goto event_mscs_result; if (mscs_desc_ie[1] < MSCS_DESCRIPTOR_FIXED_LEN) { wpa_printf(MSG_INFO, "MSCS: Drop received frame: invalid MSCS Descriptor element length: %d", mscs_desc_ie[1]); return; } os_memset(&robust_av, 0, sizeof(struct robust_av_data)); /* Skip Element ID, Length, and Element ID Extension */ pos = &mscs_desc_ie[3]; robust_av.request_type = *pos++; switch (robust_av.request_type) { case SCS_REQ_CHANGE: /* * Inform the suggested set of parameters that could be accepted * by the AP in response to a subsequent request by the station. */ robust_av.up_bitmap = *pos++; robust_av.up_limit = *pos++ & 0x07; robust_av.stream_timeout = WPA_GET_LE32(pos); wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_MSCS_RESULT "bssid=" MACSTR " status_code=%u change up_bitmap=%u up_limit=%u stream_timeout=%u", MAC2STR(bssid), status, robust_av.up_bitmap, robust_av.up_limit, robust_av.stream_timeout); wpa_s->mscs_setup_done = false; return; case SCS_REQ_ADD: /* * This type is used in (Re)Association Response frame MSCS * Descriptor element if no change is required. */ break; default: wpa_printf(MSG_INFO, "MSCS: Drop received frame with unknown Request Type: %u", robust_av.request_type); return; } event_mscs_result: wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_MSCS_RESULT "bssid=" MACSTR " status_code=%u", MAC2STR(bssid), status); wpa_s->mscs_setup_done = status == WLAN_STATUS_SUCCESS; } void wpas_handle_robust_av_recv_action(struct wpa_supplicant *wpa_s, const u8 *src, const u8 *buf, size_t len) { u8 dialog_token; u16 status_code; const u8 *mscs_desc_ie; if (len < 3) return; dialog_token = *buf++; len--; /* AP sets dialog token to 0 for unsolicited response */ if (!dialog_token && !wpa_s->mscs_setup_done) { wpa_printf(MSG_INFO, "MSCS: Drop unsolicited received frame: inactive"); return; } if (dialog_token && dialog_token != wpa_s->robust_av.dialog_token) { wpa_printf(MSG_INFO, "MSCS: Drop received frame due to dialog token mismatch: received:%u expected:%u", dialog_token, wpa_s->robust_av.dialog_token); return; } status_code = WPA_GET_LE16(buf); buf += 2; len -= 2; mscs_desc_ie = get_ie_ext(buf, len, WLAN_EID_EXT_MSCS_DESCRIPTOR); wpas_parse_mscs_resp(wpa_s, status_code, src, mscs_desc_ie); } void wpas_handle_assoc_resp_mscs(struct wpa_supplicant *wpa_s, const u8 *bssid, const u8 *ies, size_t ies_len) { const u8 *mscs_desc_ie, *mscs_status; u16 status; /* Process optional MSCS Status subelement when MSCS IE is in * (Re)Association Response frame */ if (!ies || ies_len == 0 || !wpa_s->robust_av.valid_config) return; mscs_desc_ie = get_ie_ext(ies, ies_len, WLAN_EID_EXT_MSCS_DESCRIPTOR); if (!mscs_desc_ie || mscs_desc_ie[1] <= MSCS_DESCRIPTOR_FIXED_LEN) return; /* Subelements start after element header and fixed fields */ mscs_status = get_ie(&mscs_desc_ie[2 + MSCS_DESCRIPTOR_FIXED_LEN], mscs_desc_ie[1] - MSCS_DESCRIPTOR_FIXED_LEN, MCSC_SUBELEM_STATUS); if (!mscs_status || mscs_status[1] < 2) return; status = WPA_GET_LE16(mscs_status + 2); wpas_parse_mscs_resp(wpa_s, status, bssid, mscs_desc_ie); } static void wpas_wait_for_dscp_req_timer(void *eloop_ctx, void *timeout_ctx) { struct wpa_supplicant *wpa_s = eloop_ctx; /* Once timeout is over, reset wait flag and allow sending DSCP query */ wpa_printf(MSG_DEBUG, "QM: Wait time over for sending DSCP request - allow DSCP query"); wpa_s->wait_for_dscp_req = 0; wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_wait end"); } void wpas_handle_assoc_resp_qos_mgmt(struct wpa_supplicant *wpa_s, const u8 *ies, size_t ies_len) { const u8 *wfa_capa; wpa_s->connection_dscp = 0; if (wpa_s->wait_for_dscp_req) eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL); if (!ies || ies_len == 0 || !wpa_s->enable_dscp_policy_capa) return; wfa_capa = get_vendor_ie(ies, ies_len, WFA_CAPA_IE_VENDOR_TYPE); if (!wfa_capa || wfa_capa[1] < 6 || wfa_capa[6] < 1 || !(wfa_capa[7] & WFA_CAPA_QM_DSCP_POLICY)) return; /* AP does not enable QM DSCP Policy */ wpa_s->connection_dscp = 1; wpa_s->wait_for_dscp_req = !!(wfa_capa[7] & WFA_CAPA_QM_UNSOLIC_DSCP); if (!wpa_s->wait_for_dscp_req) return; /* Register a timeout after which dscp query can be sent to AP. */ wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_wait start"); eloop_register_timeout(DSCP_REQ_TIMEOUT, 0, wpas_wait_for_dscp_req_timer, wpa_s, NULL); } void wpas_handle_robust_av_scs_recv_action(struct wpa_supplicant *wpa_s, const u8 *src, const u8 *buf, size_t len) { u8 dialog_token; unsigned int i, count; struct active_scs_elem *scs_desc, *prev; if (len < 2) return; if (!wpa_s->ongoing_scs_req) { wpa_printf(MSG_INFO, "SCS: Drop received response due to no ongoing request"); return; } dialog_token = *buf++; len--; if (dialog_token != wpa_s->scs_dialog_token) { wpa_printf(MSG_INFO, "SCS: Drop received frame due to dialog token mismatch: received:%u expected:%u", dialog_token, wpa_s->scs_dialog_token); return; } /* This Count field does not exist in the IEEE Std 802.11-2020 * definition of the SCS Response frame. However, it was accepted to * be added into REVme per REVme/D0.0 CC35 CID 49 (edits in document * 11-21-0688-07). */ count = *buf++; len--; if (count == 0 || count * 3 > len) { wpa_printf(MSG_INFO, "SCS: Drop received frame due to invalid count: %u (remaining %zu octets)", count, len); return; } for (i = 0; i < count; i++) { u8 id; u16 status; bool scs_desc_found = false; id = *buf++; status = WPA_GET_LE16(buf); buf += 2; len -= 3; dl_list_for_each(scs_desc, &wpa_s->active_scs_ids, struct active_scs_elem, list) { if (id == scs_desc->scs_id) { scs_desc_found = true; break; } } if (!scs_desc_found) { wpa_printf(MSG_INFO, "SCS: SCS ID invalid %u", id); continue; } if (status != WLAN_STATUS_SUCCESS) { dl_list_del(&scs_desc->list); os_free(scs_desc); } else if (status == WLAN_STATUS_SUCCESS) { scs_desc->status = SCS_DESC_SUCCESS; } wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCS_RESULT "bssid=" MACSTR " SCSID=%u status_code=%u", MAC2STR(src), id, status); } eloop_cancel_timeout(scs_request_timer, wpa_s, NULL); wpa_s->ongoing_scs_req = false; dl_list_for_each_safe(scs_desc, prev, &wpa_s->active_scs_ids, struct active_scs_elem, list) { if (scs_desc->status != SCS_DESC_SUCCESS) { wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_SCS_RESULT "bssid=" MACSTR " SCSID=%u status_code=response_not_received", MAC2STR(src), scs_desc->scs_id); dl_list_del(&scs_desc->list); os_free(scs_desc); } } } static void wpas_clear_active_scs_ids(struct wpa_supplicant *wpa_s) { struct active_scs_elem *scs_elem; while ((scs_elem = dl_list_first(&wpa_s->active_scs_ids, struct active_scs_elem, list))) { dl_list_del(&scs_elem->list); os_free(scs_elem); } } void wpas_scs_deinit(struct wpa_supplicant *wpa_s) { free_up_scs_desc(&wpa_s->scs_robust_av_req); wpa_s->scs_dialog_token = 0; wpas_clear_active_scs_ids(wpa_s); eloop_cancel_timeout(scs_request_timer, wpa_s, NULL); wpa_s->ongoing_scs_req = false; } static int write_ipv4_info(char *pos, int total_len, const struct ipv4_params *v4, u8 classifier_mask) { int res, rem_len; char addr[INET_ADDRSTRLEN]; rem_len = total_len; if (classifier_mask & BIT(1)) { if (!inet_ntop(AF_INET, &v4->src_ip, addr, INET_ADDRSTRLEN)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv4 source address"); return -1; } res = os_snprintf(pos, rem_len, " src_ip=%s", addr); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(2)) { if (!inet_ntop(AF_INET, &v4->dst_ip, addr, INET_ADDRSTRLEN)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv4 destination address"); return -1; } res = os_snprintf(pos, rem_len, " dst_ip=%s", addr); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(3)) { res = os_snprintf(pos, rem_len, " src_port=%d", v4->src_port); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(4)) { res = os_snprintf(pos, rem_len, " dst_port=%d", v4->dst_port); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(6)) { res = os_snprintf(pos, rem_len, " protocol=%d", v4->protocol); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } return total_len - rem_len; } static int write_ipv6_info(char *pos, int total_len, const struct ipv6_params *v6, u8 classifier_mask) { int res, rem_len; char addr[INET6_ADDRSTRLEN]; rem_len = total_len; if (classifier_mask & BIT(1)) { if (!inet_ntop(AF_INET6, &v6->src_ip, addr, INET6_ADDRSTRLEN)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv6 source addr"); return -1; } res = os_snprintf(pos, rem_len, " src_ip=%s", addr); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(2)) { if (!inet_ntop(AF_INET6, &v6->dst_ip, addr, INET6_ADDRSTRLEN)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv6 destination addr"); return -1; } res = os_snprintf(pos, rem_len, " dst_ip=%s", addr); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(3)) { res = os_snprintf(pos, rem_len, " src_port=%d", v6->src_port); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(4)) { res = os_snprintf(pos, rem_len, " dst_port=%d", v6->dst_port); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } if (classifier_mask & BIT(6)) { res = os_snprintf(pos, rem_len, " protocol=%d", v6->next_header); if (os_snprintf_error(rem_len, res)) return -1; pos += res; rem_len -= res; } return total_len - rem_len; } struct dscp_policy_data { u8 policy_id; u8 req_type; u8 dscp; bool dscp_info; const u8 *frame_classifier; u8 frame_classifier_len; struct type4_params type4_param; const u8 *domain_name; u8 domain_name_len; u16 start_port; u16 end_port; bool port_range_info; }; static int set_frame_classifier_type4_ipv4(struct dscp_policy_data *policy) { u8 classifier_mask; const u8 *frame_classifier = policy->frame_classifier; struct type4_params *type4_param = &policy->type4_param; if (policy->frame_classifier_len < 18) { wpa_printf(MSG_ERROR, "QM: Received IPv4 frame classifier with insufficient length %d", policy->frame_classifier_len); return -1; } classifier_mask = frame_classifier[1]; /* Classifier Mask - bit 1 = Source IP Address */ if (classifier_mask & BIT(1)) { type4_param->classifier_mask |= BIT(1); os_memcpy(&type4_param->ip_params.v4.src_ip, &frame_classifier[3], 4); } /* Classifier Mask - bit 2 = Destination IP Address */ if (classifier_mask & BIT(2)) { if (policy->domain_name) { wpa_printf(MSG_ERROR, "QM: IPv4: Both domain name and destination IP address not expected"); return -1; } type4_param->classifier_mask |= BIT(2); os_memcpy(&type4_param->ip_params.v4.dst_ip, &frame_classifier[7], 4); } /* Classifier Mask - bit 3 = Source Port */ if (classifier_mask & BIT(3)) { type4_param->classifier_mask |= BIT(3); type4_param->ip_params.v4.src_port = WPA_GET_BE16(&frame_classifier[11]); } /* Classifier Mask - bit 4 = Destination Port */ if (classifier_mask & BIT(4)) { if (policy->port_range_info) { wpa_printf(MSG_ERROR, "QM: IPv4: Both port range and destination port not expected"); return -1; } type4_param->classifier_mask |= BIT(4); type4_param->ip_params.v4.dst_port = WPA_GET_BE16(&frame_classifier[13]); } /* Classifier Mask - bit 5 = DSCP (ignored) */ /* Classifier Mask - bit 6 = Protocol */ if (classifier_mask & BIT(6)) { type4_param->classifier_mask |= BIT(6); type4_param->ip_params.v4.protocol = frame_classifier[16]; } return 0; } static int set_frame_classifier_type4_ipv6(struct dscp_policy_data *policy) { u8 classifier_mask; const u8 *frame_classifier = policy->frame_classifier; struct type4_params *type4_param = &policy->type4_param; if (policy->frame_classifier_len < 44) { wpa_printf(MSG_ERROR, "QM: Received IPv6 frame classifier with insufficient length %d", policy->frame_classifier_len); return -1; } classifier_mask = frame_classifier[1]; /* Classifier Mask - bit 1 = Source IP Address */ if (classifier_mask & BIT(1)) { type4_param->classifier_mask |= BIT(1); os_memcpy(&type4_param->ip_params.v6.src_ip, &frame_classifier[3], 16); } /* Classifier Mask - bit 2 = Destination IP Address */ if (classifier_mask & BIT(2)) { if (policy->domain_name) { wpa_printf(MSG_ERROR, "QM: IPv6: Both domain name and destination IP address not expected"); return -1; } type4_param->classifier_mask |= BIT(2); os_memcpy(&type4_param->ip_params.v6.dst_ip, &frame_classifier[19], 16); } /* Classifier Mask - bit 3 = Source Port */ if (classifier_mask & BIT(3)) { type4_param->classifier_mask |= BIT(3); type4_param->ip_params.v6.src_port = WPA_GET_BE16(&frame_classifier[35]); } /* Classifier Mask - bit 4 = Destination Port */ if (classifier_mask & BIT(4)) { if (policy->port_range_info) { wpa_printf(MSG_ERROR, "IPv6: Both port range and destination port not expected"); return -1; } type4_param->classifier_mask |= BIT(4); type4_param->ip_params.v6.dst_port = WPA_GET_BE16(&frame_classifier[37]); } /* Classifier Mask - bit 5 = DSCP (ignored) */ /* Classifier Mask - bit 6 = Next Header */ if (classifier_mask & BIT(6)) { type4_param->classifier_mask |= BIT(6); type4_param->ip_params.v6.next_header = frame_classifier[40]; } return 0; } static int wpas_set_frame_classifier_params(struct dscp_policy_data *policy) { const u8 *frame_classifier = policy->frame_classifier; u8 frame_classifier_len = policy->frame_classifier_len; if (frame_classifier_len < 3) { wpa_printf(MSG_ERROR, "QM: Received frame classifier with insufficient length %d", frame_classifier_len); return -1; } /* Only allowed Classifier Type: IP and higher layer parameters (4) */ if (frame_classifier[0] != 4) { wpa_printf(MSG_ERROR, "QM: Received frame classifier with invalid classifier type %d", frame_classifier[0]); return -1; } /* Classifier Mask - bit 0 = Version */ if (!(frame_classifier[1] & BIT(0))) { wpa_printf(MSG_ERROR, "QM: Received frame classifier without IP version"); return -1; } /* Version (4 or 6) */ if (frame_classifier[2] == 4) { if (set_frame_classifier_type4_ipv4(policy)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv4 parameters"); return -1; } policy->type4_param.ip_version = IPV4; } else if (frame_classifier[2] == 6) { if (set_frame_classifier_type4_ipv6(policy)) { wpa_printf(MSG_ERROR, "QM: Failed to set IPv6 parameters"); return -1; } policy->type4_param.ip_version = IPV6; } else { wpa_printf(MSG_ERROR, "QM: Received unknown IP version %d", frame_classifier[2]); return -1; } return 0; } static bool dscp_valid_domain_name(const char *str) { if (!str[0]) return false; while (*str) { if (is_ctrl_char(*str) || *str == ' ' || *str == '=') return false; str++; } return true; } static void wpas_add_dscp_policy(struct wpa_supplicant *wpa_s, struct dscp_policy_data *policy) { int ip_ver = 0, res; char policy_str[1000], *pos; int len; if (!policy->frame_classifier && !policy->domain_name && !policy->port_range_info) { wpa_printf(MSG_ERROR, "QM: Invalid DSCP policy - no attributes present"); goto fail; } policy_str[0] = '\0'; pos = policy_str; len = sizeof(policy_str); if (policy->frame_classifier) { struct type4_params *type4 = &policy->type4_param; if (wpas_set_frame_classifier_params(policy)) { wpa_printf(MSG_ERROR, "QM: Failed to set frame classifier parameters"); goto fail; } if (type4->ip_version == IPV4) res = write_ipv4_info(pos, len, &type4->ip_params.v4, type4->classifier_mask); else res = write_ipv6_info(pos, len, &type4->ip_params.v6, type4->classifier_mask); if (res <= 0) { wpa_printf(MSG_ERROR, "QM: Failed to write IP parameters"); goto fail; } ip_ver = type4->ip_version; pos += res; len -= res; } if (policy->port_range_info) { res = os_snprintf(pos, len, " start_port=%u end_port=%u", policy->start_port, policy->end_port); if (os_snprintf_error(len, res)) { wpa_printf(MSG_ERROR, "QM: Failed to write port range attributes for policy id = %d", policy->policy_id); goto fail; } pos += res; len -= res; } if (policy->domain_name) { char domain_name_str[250]; if (policy->domain_name_len >= sizeof(domain_name_str)) { wpa_printf(MSG_ERROR, "QM: Domain name length higher than max expected"); goto fail; } os_memcpy(domain_name_str, policy->domain_name, policy->domain_name_len); domain_name_str[policy->domain_name_len] = '\0'; if (!dscp_valid_domain_name(domain_name_str)) { wpa_printf(MSG_ERROR, "QM: Invalid domain name string"); goto fail; } res = os_snprintf(pos, len, " domain_name=%s", domain_name_str); if (os_snprintf_error(len, res)) { wpa_printf(MSG_ERROR, "QM: Failed to write domain name attribute for policy id = %d", policy->policy_id); goto fail; } } wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "add policy_id=%u dscp=%u ip_version=%d%s", policy->policy_id, policy->dscp, ip_ver, policy_str); return; fail: wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "reject policy_id=%u", policy->policy_id); } void wpas_dscp_deinit(struct wpa_supplicant *wpa_s) { wpa_printf(MSG_DEBUG, "QM: Clear all active DSCP policies"); wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "clear_all"); wpa_s->dscp_req_dialog_token = 0; wpa_s->dscp_query_dialog_token = 0; wpa_s->connection_dscp = 0; if (wpa_s->wait_for_dscp_req) { wpa_s->wait_for_dscp_req = 0; eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL); } } static void wpas_fill_dscp_policy(struct dscp_policy_data *policy, u8 attr_id, u8 attr_len, const u8 *attr_data) { switch (attr_id) { case QM_ATTR_PORT_RANGE: if (attr_len < 4) { wpa_printf(MSG_ERROR, "QM: Received Port Range attribute with insufficient length %d", attr_len); break; } policy->start_port = WPA_GET_BE16(attr_data); policy->end_port = WPA_GET_BE16(attr_data + 2); policy->port_range_info = true; break; case QM_ATTR_DSCP_POLICY: if (attr_len < 3) { wpa_printf(MSG_ERROR, "QM: Received DSCP Policy attribute with insufficient length %d", attr_len); return; } policy->policy_id = attr_data[0]; policy->req_type = attr_data[1]; policy->dscp = attr_data[2]; policy->dscp_info = true; break; case QM_ATTR_TCLAS: if (attr_len < 1) { wpa_printf(MSG_ERROR, "QM: Received TCLAS attribute with insufficient length %d", attr_len); return; } policy->frame_classifier = attr_data; policy->frame_classifier_len = attr_len; break; case QM_ATTR_DOMAIN_NAME: if (attr_len < 1) { wpa_printf(MSG_ERROR, "QM: Received domain name attribute with insufficient length %d", attr_len); return; } policy->domain_name = attr_data; policy->domain_name_len = attr_len; break; default: wpa_printf(MSG_ERROR, "QM: Received invalid QoS attribute %d", attr_id); break; } } void wpas_handle_qos_mgmt_recv_action(struct wpa_supplicant *wpa_s, const u8 *src, const u8 *buf, size_t len) { int rem_len; const u8 *qos_ie, *attr; int more, reset; if (!wpa_s->enable_dscp_policy_capa) { wpa_printf(MSG_ERROR, "QM: Ignore DSCP Policy frame since the capability is not enabled"); return; } if (!pmf_in_use(wpa_s, src)) { wpa_printf(MSG_ERROR, "QM: Ignore DSCP Policy frame since PMF is not in use"); return; } if (!wpa_s->connection_dscp) { wpa_printf(MSG_DEBUG, "QM: DSCP Policy capability not enabled for the current association - ignore QoS Management Action frames"); return; } if (len < 1) return; /* Handle only DSCP Policy Request frame */ if (buf[0] != QM_DSCP_POLICY_REQ) { wpa_printf(MSG_ERROR, "QM: Received unexpected QoS action frame %d", buf[0]); return; } if (len < 3) { wpa_printf(MSG_ERROR, "Received QoS Management DSCP Policy Request frame with invalid length %zu", len); return; } /* Clear wait_for_dscp_req on receiving first DSCP request from AP */ if (wpa_s->wait_for_dscp_req) { wpa_s->wait_for_dscp_req = 0; eloop_cancel_timeout(wpas_wait_for_dscp_req_timer, wpa_s, NULL); } wpa_s->dscp_req_dialog_token = buf[1]; more = buf[2] & DSCP_POLICY_CTRL_MORE; reset = buf[2] & DSCP_POLICY_CTRL_RESET; wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_start%s%s", reset ? " clear_all" : "", more ? " more" : ""); qos_ie = buf + 3; rem_len = len - 3; while (rem_len > 2) { struct dscp_policy_data policy; int rem_attrs_len, ie_len; ie_len = 2 + qos_ie[1]; if (rem_len < ie_len) break; if (rem_len < 6 || qos_ie[0] != WLAN_EID_VENDOR_SPECIFIC || qos_ie[1] < 4 || WPA_GET_BE32(&qos_ie[2]) != QM_IE_VENDOR_TYPE) { rem_len -= ie_len; qos_ie += ie_len; continue; } os_memset(&policy, 0, sizeof(struct dscp_policy_data)); attr = qos_ie + 6; rem_attrs_len = qos_ie[1] - 4; while (rem_attrs_len > 2) { u8 attr_id, attr_len; attr_id = *attr++; attr_len = *attr++; rem_attrs_len -= 2; if (attr_len > rem_attrs_len) break; wpas_fill_dscp_policy(&policy, attr_id, attr_len, attr); rem_attrs_len -= attr_len; attr += attr_len; } rem_len -= ie_len; qos_ie += ie_len; if (!policy.dscp_info) { wpa_printf(MSG_ERROR, "QM: Received QoS IE without DSCP Policy attribute"); continue; } if (policy.req_type == DSCP_POLICY_REQ_ADD) wpas_add_dscp_policy(wpa_s, &policy); else if (policy.req_type == DSCP_POLICY_REQ_REMOVE) wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "remove policy_id=%u", policy.policy_id); else wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "reject policy_id=%u", policy.policy_id); } wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DSCP_POLICY "request_end"); } int wpas_send_dscp_response(struct wpa_supplicant *wpa_s, struct dscp_resp_data *resp_data) { struct wpabuf *buf = NULL; size_t buf_len; int ret = -1, i; u8 resp_control = 0; if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) { wpa_printf(MSG_ERROR, "QM: Failed to send DSCP response - not connected to AP"); return -1; } if (resp_data->solicited && !wpa_s->dscp_req_dialog_token) { wpa_printf(MSG_ERROR, "QM: No ongoing DSCP request"); return -1; } if (!wpa_s->connection_dscp) { wpa_printf(MSG_ERROR, "QM: Failed to send DSCP response - DSCP capability not enabled for the current association"); return -1; } buf_len = 1 + /* Category */ 3 + /* OUI */ 1 + /* OUI Type */ 1 + /* OUI Subtype */ 1 + /* Dialog Token */ 1 + /* Response Control */ 1 + /* Count */ 2 * resp_data->num_policies; /* Status list */ buf = wpabuf_alloc(buf_len); if (!buf) { wpa_printf(MSG_ERROR, "QM: Failed to allocate DSCP policy response"); return -1; } wpabuf_put_u8(buf, WLAN_ACTION_VENDOR_SPECIFIC_PROTECTED); wpabuf_put_be24(buf, OUI_WFA); wpabuf_put_u8(buf, QM_ACTION_OUI_TYPE); wpabuf_put_u8(buf, QM_DSCP_POLICY_RESP); wpabuf_put_u8(buf, resp_data->solicited ? wpa_s->dscp_req_dialog_token : 0); if (resp_data->more) resp_control |= DSCP_POLICY_CTRL_MORE; if (resp_data->reset) resp_control |= DSCP_POLICY_CTRL_RESET; wpabuf_put_u8(buf, resp_control); wpabuf_put_u8(buf, resp_data->num_policies); for (i = 0; i < resp_data->num_policies; i++) { wpabuf_put_u8(buf, resp_data->policy[i].id); wpabuf_put_u8(buf, resp_data->policy[i].status); } wpa_hexdump_buf(MSG_MSGDUMP, "DSCP response frame: ", buf); ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, wpa_s->own_addr, wpa_s->bssid, wpabuf_head(buf), wpabuf_len(buf), 0); if (ret < 0) { wpa_msg(wpa_s, MSG_INFO, "QM: Failed to send DSCP response"); goto fail; } /* * Mark DSCP request complete whether response sent is solicited or * unsolicited */ wpa_s->dscp_req_dialog_token = 0; fail: wpabuf_free(buf); return ret; } int wpas_send_dscp_query(struct wpa_supplicant *wpa_s, const char *domain_name, size_t domain_name_length) { struct wpabuf *buf = NULL; int ret, dscp_query_size; if (wpa_s->wpa_state != WPA_COMPLETED || !wpa_s->current_ssid) return -1; if (!wpa_s->connection_dscp) { wpa_printf(MSG_ERROR, "QM: Failed to send DSCP query - DSCP capability not enabled for the current association"); return -1; } if (wpa_s->wait_for_dscp_req) { wpa_printf(MSG_INFO, "QM: Wait until AP sends a DSCP request"); return -1; } #define DOMAIN_NAME_OFFSET (4 /* OUI */ + 1 /* Attr Id */ + 1 /* Attr len */) if (domain_name_length > 255 - DOMAIN_NAME_OFFSET) { wpa_printf(MSG_ERROR, "QM: Too long domain name"); return -1; } dscp_query_size = 1 + /* Category */ 4 + /* OUI Type */ 1 + /* OUI subtype */ 1; /* Dialog Token */ if (domain_name && domain_name_length) dscp_query_size += 1 + /* Element ID */ 1 + /* IE Length */ DOMAIN_NAME_OFFSET + domain_name_length; buf = wpabuf_alloc(dscp_query_size); if (!buf) { wpa_printf(MSG_ERROR, "QM: Failed to allocate DSCP query"); return -1; } wpabuf_put_u8(buf, WLAN_ACTION_VENDOR_SPECIFIC_PROTECTED); wpabuf_put_be32(buf, QM_ACTION_VENDOR_TYPE); wpabuf_put_u8(buf, QM_DSCP_POLICY_QUERY); wpa_s->dscp_query_dialog_token++; if (wpa_s->dscp_query_dialog_token == 0) wpa_s->dscp_query_dialog_token++; wpabuf_put_u8(buf, wpa_s->dscp_query_dialog_token); if (domain_name && domain_name_length) { /* Domain Name attribute */ wpabuf_put_u8(buf, WLAN_EID_VENDOR_SPECIFIC); wpabuf_put_u8(buf, DOMAIN_NAME_OFFSET + domain_name_length); wpabuf_put_be32(buf, QM_IE_VENDOR_TYPE); wpabuf_put_u8(buf, QM_ATTR_DOMAIN_NAME); wpabuf_put_u8(buf, domain_name_length); wpabuf_put_data(buf, domain_name, domain_name_length); } #undef DOMAIN_NAME_OFFSET ret = wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid, wpa_s->own_addr, wpa_s->bssid, wpabuf_head(buf), wpabuf_len(buf), 0); if (ret < 0) { wpa_dbg(wpa_s, MSG_ERROR, "QM: Failed to send DSCP query"); wpa_s->dscp_query_dialog_token--; } wpabuf_free(buf); return ret; }