src/ap/gas_query_ap.c

   1 /*
   2  * Generic advertisement service (GAS) query (hostapd)
   3  * Copyright (c) 2009, Atheros Communications
   4  * Copyright (c) 2011-2017, Qualcomm Atheros, Inc.
   5  * Copyright (c) 2011-2014, Jouni Malinen <j@w1.fi>
   6  *
   7  * This software may be distributed under the terms of the BSD license.
   8  * See README for more details.
   9  */
  10
  11 #include "includes.h"
  12
  13 #include "common.h"
  14 #include "utils/eloop.h"
  15 #include "utils/list.h"
  16 #include "common/ieee802_11_defs.h"
  17 #include "common/gas.h"
  18 #include "common/wpa_ctrl.h"
  19 #include "hostapd.h"
  20 #include "sta_info.h"
  21 #include "ap_drv_ops.h"
  22 #include "gas_query_ap.h"
  23
  24
  25 /** GAS query timeout in seconds */
  26 #define GAS_QUERY_TIMEOUT_PERIOD 2
  27
  28 /* GAS query wait-time / duration in ms */
  29 #define GAS_QUERY_WAIT_TIME_INITIAL 1000
  30 #define GAS_QUERY_WAIT_TIME_COMEBACK 150
  31
  32 /**
  33  * struct gas_query_pending - Pending GAS query
  34  */
  35 struct gas_query_pending {
  36         struct dl_list list;
  37         struct gas_query_ap *gas;
  38         u8 addr[ETH_ALEN];
  39         u8 dialog_token;
  40         u8 next_frag_id;
  41         unsigned int wait_comeback:1;
  42         unsigned int offchannel_tx_started:1;
  43         unsigned int retry:1;
  44         int freq;
  45         u16 status_code;
  46         struct wpabuf *req;
  47         struct wpabuf *adv_proto;
  48         struct wpabuf *resp;
  49         struct os_reltime last_oper;
  50         void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
  51                    enum gas_query_ap_result result,
  52                    const struct wpabuf *adv_proto,
  53                    const struct wpabuf *resp, u16 status_code);
  54         void *ctx;
  55         u8 sa[ETH_ALEN];
  56 };
  57
  58 /**
  59  * struct gas_query_ap - Internal GAS query data
  60  */
  61 struct gas_query_ap {
  62         struct hostapd_data *hapd;
  63         void *msg_ctx;
  64         struct dl_list pending; /* struct gas_query_pending */
  65         struct gas_query_pending *current;
  66 };
  67
  68
  69 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx);
  70 static void gas_query_timeout(void *eloop_data, void *user_ctx);
  71 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx);
  72 static void gas_query_tx_initial_req(struct gas_query_ap *gas,
  73                                      struct gas_query_pending *query);
  74 static int gas_query_new_dialog_token(struct gas_query_ap *gas, const u8 *dst);
  75
  76
  77 static int ms_from_time(struct os_reltime *last)
  78 {
  79         struct os_reltime now, res;
  80
  81         os_get_reltime(&now);
  82         os_reltime_sub(&now, last, &res);
  83         return res.sec * 1000 + res.usec / 1000;
  84 }
  85
  86
  87 /**
  88  * gas_query_ap_init - Initialize GAS query component
  89  * @hapd: Pointer to hostapd data
  90  * Returns: Pointer to GAS query data or %NULL on failure
  91  */
  92 struct gas_query_ap * gas_query_ap_init(struct hostapd_data *hapd,
  93                                         void *msg_ctx)
  94 {
  95         struct gas_query_ap *gas;
  96
  97         gas = os_zalloc(sizeof(*gas));
  98         if (!gas)
  99                 return NULL;
 100
 101         gas->hapd = hapd;
 102         gas->msg_ctx = msg_ctx;
 103         dl_list_init(&gas->pending);
 104
 105         return gas;
 106 }
 107
 108
 109 static const char * gas_result_txt(enum gas_query_ap_result result)
 110 {
 111         switch (result) {
 112         case GAS_QUERY_AP_SUCCESS:
 113                 return "SUCCESS";
 114         case GAS_QUERY_AP_FAILURE:
 115                 return "FAILURE";
 116         case GAS_QUERY_AP_TIMEOUT:
 117                 return "TIMEOUT";
 118         case GAS_QUERY_AP_PEER_ERROR:
 119                 return "PEER_ERROR";
 120         case GAS_QUERY_AP_INTERNAL_ERROR:
 121                 return "INTERNAL_ERROR";
 122         case GAS_QUERY_AP_DELETED_AT_DEINIT:
 123                 return "DELETED_AT_DEINIT";
 124         }
 125
 126         return "N/A";
 127 }
 128
 129
 130 static void gas_query_free(struct gas_query_pending *query, int del_list)
 131 {
 132         if (del_list)
 133                 dl_list_del(&query->list);
 134
 135         wpabuf_free(query->req);
 136         wpabuf_free(query->adv_proto);
 137         wpabuf_free(query->resp);
 138         os_free(query);
 139 }
 140
 141
 142 static void gas_query_done(struct gas_query_ap *gas,
 143                            struct gas_query_pending *query,
 144                            enum gas_query_ap_result result)
 145 {
 146         wpa_msg(gas->msg_ctx, MSG_INFO, GAS_QUERY_DONE "addr=" MACSTR
 147                 " dialog_token=%u freq=%d status_code=%u result=%s",
 148                 MAC2STR(query->addr), query->dialog_token, query->freq,
 149                 query->status_code, gas_result_txt(result));
 150         if (gas->current == query)
 151                 gas->current = NULL;
 152         eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
 153         eloop_cancel_timeout(gas_query_timeout, gas, query);
 154         eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
 155         dl_list_del(&query->list);
 156         query->cb(query->ctx, query->addr, query->dialog_token, result,
 157                   query->adv_proto, query->resp, query->status_code);
 158         gas_query_free(query, 0);
 159 }
 160
 161
 162 /**
 163  * gas_query_ap_deinit - Deinitialize GAS query component
 164  * @gas: GAS query data from gas_query_init()
 165  */
 166 void gas_query_ap_deinit(struct gas_query_ap *gas)
 167 {
 168         struct gas_query_pending *query, *next;
 169
 170         if (gas == NULL)
 171                 return;
 172
 173         dl_list_for_each_safe(query, next, &gas->pending,
 174                               struct gas_query_pending, list)
 175                 gas_query_done(gas, query, GAS_QUERY_AP_DELETED_AT_DEINIT);
 176
 177         os_free(gas);
 178 }
 179
 180
 181 static struct gas_query_pending *
 182 gas_query_get_pending(struct gas_query_ap *gas, const u8 *addr, u8 dialog_token)
 183 {
 184         struct gas_query_pending *q;
 185         dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
 186                 if (os_memcmp(q->addr, addr, ETH_ALEN) == 0 &&
 187                     q->dialog_token == dialog_token)
 188                         return q;
 189         }
 190         return NULL;
 191 }
 192
 193
 194 static int gas_query_append(struct gas_query_pending *query, const u8 *data,
 195                             size_t len)
 196 {
 197         if (wpabuf_resize(&query->resp, len) < 0) {
 198                 wpa_printf(MSG_DEBUG, "GAS: No memory to store the response");
 199                 return -1;
 200         }
 201         wpabuf_put_data(query->resp, data, len);
 202         return 0;
 203 }
 204
 205
 206 void gas_query_ap_tx_status(struct gas_query_ap *gas, const u8 *dst,
 207                             const u8 *data, size_t data_len, int ok)
 208 {
 209         struct gas_query_pending *query;
 210         int dur;
 211
 212         if (!gas || !gas->current) {
 213                 wpa_printf(MSG_DEBUG, "GAS: Unexpected TX status: dst=" MACSTR
 214                            " ok=%d - no query in progress", MAC2STR(dst), ok);
 215                 return;
 216         }
 217
 218         query = gas->current;
 219
 220         dur = ms_from_time(&query->last_oper);
 221         wpa_printf(MSG_DEBUG, "GAS: TX status: dst=" MACSTR
 222                    " ok=%d query=%p dialog_token=%u dur=%d ms",
 223                    MAC2STR(dst), ok, query, query->dialog_token, dur);
 224         if (os_memcmp(dst, query->addr, ETH_ALEN) != 0) {
 225                 wpa_printf(MSG_DEBUG, "GAS: TX status for unexpected destination");
 226                 return;
 227         }
 228         os_get_reltime(&query->last_oper);
 229
 230         eloop_cancel_timeout(gas_query_timeout, gas, query);
 231         if (!ok) {
 232                 wpa_printf(MSG_DEBUG, "GAS: No ACK to GAS request");
 233                 eloop_register_timeout(0, 250000, gas_query_timeout,
 234                                        gas, query);
 235         } else {
 236                 eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
 237                                        gas_query_timeout, gas, query);
 238         }
 239         if (query->wait_comeback && !query->retry) {
 240                 eloop_cancel_timeout(gas_query_rx_comeback_timeout,
 241                                      gas, query);
 242                 eloop_register_timeout(
 243                         0, (GAS_QUERY_WAIT_TIME_COMEBACK + 10) * 1000,
 244                         gas_query_rx_comeback_timeout, gas, query);
 245         }
 246 }
 247
 248
 249 static int pmf_in_use(struct hostapd_data *hapd, const u8 *addr)
 250 {
 251         struct sta_info *sta;
 252
 253         sta = ap_get_sta(hapd, addr);
 254         return sta && (sta->flags & WLAN_STA_MFP);
 255 }
 256
 257
 258 static int gas_query_tx(struct gas_query_ap *gas,
 259                         struct gas_query_pending *query,
 260                         struct wpabuf *req, unsigned int wait_time)
 261 {
 262         int res, prot = pmf_in_use(gas->hapd, query->addr);
 263
 264         wpa_printf(MSG_DEBUG, "GAS: Send action frame to " MACSTR " len=%u "
 265                    "freq=%d prot=%d using src addr " MACSTR,
 266                    MAC2STR(query->addr), (unsigned int) wpabuf_len(req),
 267                    query->freq, prot, MAC2STR(query->sa));
 268         if (prot) {
 269                 u8 *categ = wpabuf_mhead_u8(req);
 270                 *categ = WLAN_ACTION_PROTECTED_DUAL;
 271         }
 272         os_get_reltime(&query->last_oper);
 273         res = hostapd_drv_send_action(gas->hapd, query->freq, wait_time,
 274                                       query->addr, wpabuf_head(req),
 275                                       wpabuf_len(req));
 276         return res;
 277 }
 278
 279
 280 static void gas_query_tx_comeback_req(struct gas_query_ap *gas,
 281                                       struct gas_query_pending *query)
 282 {
 283         struct wpabuf *req;
 284         unsigned int wait_time;
 285
 286         req = gas_build_comeback_req(query->dialog_token);
 287         if (req == NULL) {
 288                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 289                 return;
 290         }
 291
 292         wait_time = (query->retry || !query->offchannel_tx_started) ?
 293                 GAS_QUERY_WAIT_TIME_INITIAL : GAS_QUERY_WAIT_TIME_COMEBACK;
 294
 295         if (gas_query_tx(gas, query, req, wait_time) < 0) {
 296                 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
 297                            MACSTR, MAC2STR(query->addr));
 298                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 299         }
 300
 301         wpabuf_free(req);
 302 }
 303
 304
 305 static void gas_query_rx_comeback_timeout(void *eloop_data, void *user_ctx)
 306 {
 307         struct gas_query_ap *gas = eloop_data;
 308         struct gas_query_pending *query = user_ctx;
 309         int dialog_token;
 310
 311         wpa_printf(MSG_DEBUG,
 312                    "GAS: No response to comeback request received (retry=%u)",
 313                    query->retry);
 314         if (gas->current != query || query->retry)
 315                 return;
 316         dialog_token = gas_query_new_dialog_token(gas, query->addr);
 317         if (dialog_token < 0)
 318                 return;
 319         wpa_printf(MSG_DEBUG,
 320                    "GAS: Retry GAS query due to comeback response timeout");
 321         query->retry = 1;
 322         query->dialog_token = dialog_token;
 323         *(wpabuf_mhead_u8(query->req) + 2) = dialog_token;
 324         query->wait_comeback = 0;
 325         query->next_frag_id = 0;
 326         wpabuf_free(query->adv_proto);
 327         query->adv_proto = NULL;
 328         eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
 329         eloop_cancel_timeout(gas_query_timeout, gas, query);
 330         gas_query_tx_initial_req(gas, query);
 331 }
 332
 333
 334 static void gas_query_tx_comeback_timeout(void *eloop_data, void *user_ctx)
 335 {
 336         struct gas_query_ap *gas = eloop_data;
 337         struct gas_query_pending *query = user_ctx;
 338
 339         wpa_printf(MSG_DEBUG, "GAS: Comeback timeout for request to " MACSTR,
 340                    MAC2STR(query->addr));
 341         gas_query_tx_comeback_req(gas, query);
 342 }
 343
 344
 345 static void gas_query_tx_comeback_req_delay(struct gas_query_ap *gas,
 346                                             struct gas_query_pending *query,
 347                                             u16 comeback_delay)
 348 {
 349         unsigned int secs, usecs;
 350
 351         secs = (comeback_delay * 1024) / 1000000;
 352         usecs = comeback_delay * 1024 - secs * 1000000;
 353         wpa_printf(MSG_DEBUG, "GAS: Send comeback request to " MACSTR
 354                    " in %u secs %u usecs", MAC2STR(query->addr), secs, usecs);
 355         eloop_cancel_timeout(gas_query_tx_comeback_timeout, gas, query);
 356         eloop_register_timeout(secs, usecs, gas_query_tx_comeback_timeout,
 357                                gas, query);
 358 }
 359
 360
 361 static void gas_query_rx_initial(struct gas_query_ap *gas,
 362                                  struct gas_query_pending *query,
 363                                  const u8 *adv_proto, const u8 *resp,
 364                                  size_t len, u16 comeback_delay)
 365 {
 366         wpa_printf(MSG_DEBUG, "GAS: Received initial response from "
 367                    MACSTR " (dialog_token=%u comeback_delay=%u)",
 368                    MAC2STR(query->addr), query->dialog_token, comeback_delay);
 369
 370         query->adv_proto = wpabuf_alloc_copy(adv_proto, 2 + adv_proto[1]);
 371         if (query->adv_proto == NULL) {
 372                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 373                 return;
 374         }
 375
 376         if (comeback_delay) {
 377                 eloop_cancel_timeout(gas_query_timeout, gas, query);
 378                 query->wait_comeback = 1;
 379                 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
 380                 return;
 381         }
 382
 383         /* Query was completed without comeback mechanism */
 384         if (gas_query_append(query, resp, len) < 0) {
 385                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 386                 return;
 387         }
 388
 389         gas_query_done(gas, query, GAS_QUERY_AP_SUCCESS);
 390 }
 391
 392
 393 static void gas_query_rx_comeback(struct gas_query_ap *gas,
 394                                   struct gas_query_pending *query,
 395                                   const u8 *adv_proto, const u8 *resp,
 396                                   size_t len, u8 frag_id, u8 more_frags,
 397                                   u16 comeback_delay)
 398 {
 399         wpa_printf(MSG_DEBUG, "GAS: Received comeback response from "
 400                    MACSTR " (dialog_token=%u frag_id=%u more_frags=%u "
 401                    "comeback_delay=%u)",
 402                    MAC2STR(query->addr), query->dialog_token, frag_id,
 403                    more_frags, comeback_delay);
 404         eloop_cancel_timeout(gas_query_rx_comeback_timeout, gas, query);
 405
 406         if ((size_t) 2 + adv_proto[1] != wpabuf_len(query->adv_proto) ||
 407             os_memcmp(adv_proto, wpabuf_head(query->adv_proto),
 408                       wpabuf_len(query->adv_proto)) != 0) {
 409                 wpa_printf(MSG_DEBUG, "GAS: Advertisement Protocol changed "
 410                            "between initial and comeback response from "
 411                            MACSTR, MAC2STR(query->addr));
 412                 gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR);
 413                 return;
 414         }
 415
 416         if (comeback_delay) {
 417                 if (frag_id) {
 418                         wpa_printf(MSG_DEBUG, "GAS: Invalid comeback response "
 419                                    "with non-zero frag_id and comeback_delay "
 420                                    "from " MACSTR, MAC2STR(query->addr));
 421                         gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR);
 422                         return;
 423                 }
 424                 gas_query_tx_comeback_req_delay(gas, query, comeback_delay);
 425                 return;
 426         }
 427
 428         if (frag_id != query->next_frag_id) {
 429                 wpa_printf(MSG_DEBUG, "GAS: Unexpected frag_id in response "
 430                            "from " MACSTR, MAC2STR(query->addr));
 431                 if (frag_id + 1 == query->next_frag_id) {
 432                         wpa_printf(MSG_DEBUG, "GAS: Drop frame as possible "
 433                                    "retry of previous fragment");
 434                         return;
 435                 }
 436                 gas_query_done(gas, query, GAS_QUERY_AP_PEER_ERROR);
 437                 return;
 438         }
 439         query->next_frag_id++;
 440
 441         if (gas_query_append(query, resp, len) < 0) {
 442                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 443                 return;
 444         }
 445
 446         if (more_frags) {
 447                 gas_query_tx_comeback_req(gas, query);
 448                 return;
 449         }
 450
 451         gas_query_done(gas, query, GAS_QUERY_AP_SUCCESS);
 452 }
 453
 454
 455 /**
 456  * gas_query_ap_rx - Indicate reception of a Public Action or Protected Dual
 457  *      frame
 458  * @gas: GAS query data from gas_query_init()
 459  * @sa: Source MAC address of the Action frame
 460  * @categ: Category of the Action frame
 461  * @data: Payload of the Action frame
 462  * @len: Length of @data
 463  * @freq: Frequency (in MHz) on which the frame was received
 464  * Returns: 0 if the Public Action frame was a GAS frame or -1 if not
 465  */
 466 int gas_query_ap_rx(struct gas_query_ap *gas, const u8 *sa, u8 categ,
 467                     const u8 *data, size_t len, int freq)
 468 {
 469         struct gas_query_pending *query;
 470         u8 action, dialog_token, frag_id = 0, more_frags = 0;
 471         u16 comeback_delay, resp_len;
 472         const u8 *pos, *adv_proto;
 473         int prot, pmf;
 474         unsigned int left;
 475
 476         if (!gas || len < 4)
 477                 return -1;
 478
 479         pos = data;
 480         action = *pos++;
 481         dialog_token = *pos++;
 482
 483         if (action != WLAN_PA_GAS_INITIAL_RESP &&
 484             action != WLAN_PA_GAS_COMEBACK_RESP)
 485                 return -1; /* Not a GAS response */
 486
 487         prot = categ == WLAN_ACTION_PROTECTED_DUAL;
 488         pmf = pmf_in_use(gas->hapd, sa);
 489         if (prot && !pmf) {
 490                 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected protected GAS frame when PMF is disabled");
 491                 return 0;
 492         }
 493         if (!prot && pmf) {
 494                 wpa_printf(MSG_DEBUG, "GAS: Drop unexpected unprotected GAS frame when PMF is enabled");
 495                 return 0;
 496         }
 497
 498         query = gas_query_get_pending(gas, sa, dialog_token);
 499         if (query == NULL) {
 500                 wpa_printf(MSG_DEBUG, "GAS: No pending query found for " MACSTR
 501                            " dialog token %u", MAC2STR(sa), dialog_token);
 502                 return -1;
 503         }
 504
 505         wpa_printf(MSG_DEBUG, "GAS: Response in %d ms from " MACSTR,
 506                    ms_from_time(&query->last_oper), MAC2STR(sa));
 507
 508         if (query->wait_comeback && action == WLAN_PA_GAS_INITIAL_RESP) {
 509                 wpa_printf(MSG_DEBUG, "GAS: Unexpected initial response from "
 510                            MACSTR " dialog token %u when waiting for comeback "
 511                            "response", MAC2STR(sa), dialog_token);
 512                 return 0;
 513         }
 514
 515         if (!query->wait_comeback && action == WLAN_PA_GAS_COMEBACK_RESP) {
 516                 wpa_printf(MSG_DEBUG, "GAS: Unexpected comeback response from "
 517                            MACSTR " dialog token %u when waiting for initial "
 518                            "response", MAC2STR(sa), dialog_token);
 519                 return 0;
 520         }
 521
 522         query->status_code = WPA_GET_LE16(pos);
 523         pos += 2;
 524
 525         if (query->status_code == WLAN_STATUS_QUERY_RESP_OUTSTANDING &&
 526             action == WLAN_PA_GAS_COMEBACK_RESP) {
 527                 wpa_printf(MSG_DEBUG, "GAS: Allow non-zero status for outstanding comeback response");
 528         } else if (query->status_code != WLAN_STATUS_SUCCESS) {
 529                 wpa_printf(MSG_DEBUG, "GAS: Query to " MACSTR " dialog token "
 530                            "%u failed - status code %u",
 531                            MAC2STR(sa), dialog_token, query->status_code);
 532                 gas_query_done(gas, query, GAS_QUERY_AP_FAILURE);
 533                 return 0;
 534         }
 535
 536         if (action == WLAN_PA_GAS_COMEBACK_RESP) {
 537                 if (pos + 1 > data + len)
 538                         return 0;
 539                 frag_id = *pos & 0x7f;
 540                 more_frags = (*pos & 0x80) >> 7;
 541                 pos++;
 542         }
 543
 544         /* Comeback Delay */
 545         if (pos + 2 > data + len)
 546                 return 0;
 547         comeback_delay = WPA_GET_LE16(pos);
 548         pos += 2;
 549
 550         /* Advertisement Protocol element */
 551         if (pos + 2 > data + len || pos + 2 + pos[1] > data + len) {
 552                 wpa_printf(MSG_DEBUG, "GAS: No room for Advertisement "
 553                            "Protocol element in the response from " MACSTR,
 554                            MAC2STR(sa));
 555                 return 0;
 556         }
 557
 558         if (*pos != WLAN_EID_ADV_PROTO) {
 559                 wpa_printf(MSG_DEBUG, "GAS: Unexpected Advertisement "
 560                            "Protocol element ID %u in response from " MACSTR,
 561                            *pos, MAC2STR(sa));
 562                 return 0;
 563         }
 564
 565         adv_proto = pos;
 566         pos += 2 + pos[1];
 567
 568         /* Query Response Length */
 569         if (pos + 2 > data + len) {
 570                 wpa_printf(MSG_DEBUG, "GAS: No room for GAS Response Length");
 571                 return 0;
 572         }
 573         resp_len = WPA_GET_LE16(pos);
 574         pos += 2;
 575
 576         left = data + len - pos;
 577         if (resp_len > left) {
 578                 wpa_printf(MSG_DEBUG, "GAS: Truncated Query Response in "
 579                            "response from " MACSTR, MAC2STR(sa));
 580                 return 0;
 581         }
 582
 583         if (resp_len < left) {
 584                 wpa_printf(MSG_DEBUG, "GAS: Ignore %u octets of extra data "
 585                            "after Query Response from " MACSTR,
 586                            left - resp_len, MAC2STR(sa));
 587         }
 588
 589         if (action == WLAN_PA_GAS_COMEBACK_RESP)
 590                 gas_query_rx_comeback(gas, query, adv_proto, pos, resp_len,
 591                                       frag_id, more_frags, comeback_delay);
 592         else
 593                 gas_query_rx_initial(gas, query, adv_proto, pos, resp_len,
 594                                      comeback_delay);
 595
 596         return 0;
 597 }
 598
 599
 600 static void gas_query_timeout(void *eloop_data, void *user_ctx)
 601 {
 602         struct gas_query_ap *gas = eloop_data;
 603         struct gas_query_pending *query = user_ctx;
 604
 605         wpa_printf(MSG_DEBUG, "GAS: No response received for query to " MACSTR
 606                    " dialog token %u",
 607                    MAC2STR(query->addr), query->dialog_token);
 608         gas_query_done(gas, query, GAS_QUERY_AP_TIMEOUT);
 609 }
 610
 611
 612 static int gas_query_dialog_token_available(struct gas_query_ap *gas,
 613                                             const u8 *dst, u8 dialog_token)
 614 {
 615         struct gas_query_pending *q;
 616         dl_list_for_each(q, &gas->pending, struct gas_query_pending, list) {
 617                 if (os_memcmp(dst, q->addr, ETH_ALEN) == 0 &&
 618                     dialog_token == q->dialog_token)
 619                         return 0;
 620         }
 621
 622         return 1;
 623 }
 624
 625
 626 static void gas_query_tx_initial_req(struct gas_query_ap *gas,
 627                                      struct gas_query_pending *query)
 628 {
 629         if (gas_query_tx(gas, query, query->req,
 630                          GAS_QUERY_WAIT_TIME_INITIAL) < 0) {
 631                 wpa_printf(MSG_DEBUG, "GAS: Failed to send Action frame to "
 632                            MACSTR, MAC2STR(query->addr));
 633                 gas_query_done(gas, query, GAS_QUERY_AP_INTERNAL_ERROR);
 634                 return;
 635         }
 636         gas->current = query;
 637
 638         wpa_printf(MSG_DEBUG, "GAS: Starting query timeout for dialog token %u",
 639                    query->dialog_token);
 640         eloop_register_timeout(GAS_QUERY_TIMEOUT_PERIOD, 0,
 641                                gas_query_timeout, gas, query);
 642 }
 643
 644
 645 static int gas_query_new_dialog_token(struct gas_query_ap *gas, const u8 *dst)
 646 {
 647         static int next_start = 0;
 648         int dialog_token;
 649
 650         for (dialog_token = 0; dialog_token < 256; dialog_token++) {
 651                 if (gas_query_dialog_token_available(
 652                             gas, dst, (next_start + dialog_token) % 256))
 653                         break;
 654         }
 655         if (dialog_token == 256)
 656                 return -1; /* Too many pending queries */
 657         dialog_token = (next_start + dialog_token) % 256;
 658         next_start = (dialog_token + 1) % 256;
 659         return dialog_token;
 660 }
 661
 662
 663 /**
 664  * gas_query_ap_req - Request a GAS query
 665  * @gas: GAS query data from gas_query_init()
 666  * @dst: Destination MAC address for the query
 667  * @freq: Frequency (in MHz) for the channel on which to send the query
 668  * @req: GAS query payload (to be freed by gas_query module in case of success
 669  *      return)
 670  * @cb: Callback function for reporting GAS query result and response
 671  * @ctx: Context pointer to use with the @cb call
 672  * Returns: dialog token (>= 0) on success or -1 on failure
 673  */
 674 int gas_query_ap_req(struct gas_query_ap *gas, const u8 *dst, int freq,
 675                      struct wpabuf *req,
 676                      void (*cb)(void *ctx, const u8 *dst, u8 dialog_token,
 677                                 enum gas_query_ap_result result,
 678                                 const struct wpabuf *adv_proto,
 679                                 const struct wpabuf *resp, u16 status_code),
 680                      void *ctx)
 681 {
 682         struct gas_query_pending *query;
 683         int dialog_token;
 684
 685         if (!gas || wpabuf_len(req) < 3)
 686                 return -1;
 687
 688         dialog_token = gas_query_new_dialog_token(gas, dst);
 689         if (dialog_token < 0)
 690                 return -1;
 691
 692         query = os_zalloc(sizeof(*query));
 693         if (query == NULL)
 694                 return -1;
 695
 696         query->gas = gas;
 697         os_memcpy(query->addr, dst, ETH_ALEN);
 698         query->dialog_token = dialog_token;
 699         query->freq = freq;
 700         query->cb = cb;
 701         query->ctx = ctx;
 702         query->req = req;
 703         dl_list_add(&gas->pending, &query->list);
 704
 705         *(wpabuf_mhead_u8(req) + 2) = dialog_token;
 706
 707         wpa_msg(gas->msg_ctx, MSG_INFO, GAS_QUERY_START "addr=" MACSTR
 708                 " dialog_token=%u freq=%d",
 709                 MAC2STR(query->addr), query->dialog_token, query->freq);
 710
 711         gas_query_tx_initial_req(gas, query);
 712
 713         return dialog_token;
 714 }