]> git.ipfire.org Git - thirdparty/hostap.git/blobdiff - wpa_supplicant/mesh_mpm.c
mesh: Fix race condition in mesh mpm new peer handling
[thirdparty/hostap.git] / wpa_supplicant / mesh_mpm.c
index fa6e7302c80f4760308f3f627d9ef164057e47f7..c7c85929f561d989a26c168cb4a6ed3ddb847772 100644 (file)
@@ -11,6 +11,8 @@
 #include "utils/common.h"
 #include "utils/eloop.h"
 #include "common/ieee802_11_defs.h"
+#include "common/hw_features_common.h"
+#include "common/ocv.h"
 #include "ap/hostapd.h"
 #include "ap/sta_info.h"
 #include "ap/ieee802_11.h"
@@ -19,6 +21,7 @@
 #include "driver_i.h"
 #include "mesh_mpm.h"
 #include "mesh_rsn.h"
+#include "notify.h"
 
 struct mesh_peer_mgmt_ie {
        const u8 *proto_id; /* Mesh Peering Protocol Identifier (2 octets) */
@@ -35,12 +38,10 @@ enum plink_event {
        PLINK_UNDEFINED,
        OPN_ACPT,
        OPN_RJCT,
-       OPN_IGNR,
        CNF_ACPT,
        CNF_RJCT,
-       CNF_IGNR,
        CLS_ACPT,
-       CLS_IGNR
+       REQ_RJCT
 };
 
 static const char * const mplstate[] = {
@@ -58,12 +59,10 @@ static const char * const mplevent[] = {
        [PLINK_UNDEFINED] = "UNDEFINED",
        [OPN_ACPT] = "OPN_ACPT",
        [OPN_RJCT] = "OPN_RJCT",
-       [OPN_IGNR] = "OPN_IGNR",
        [CNF_ACPT] = "CNF_ACPT",
        [CNF_RJCT] = "CNF_RJCT",
-       [CNF_IGNR] = "CNF_IGNR",
        [CLS_ACPT] = "CLS_ACPT",
-       [CLS_IGNR] = "CLS_IGNR"
+       [REQ_RJCT] = "REQ_RJCT",
 };
 
 
@@ -190,11 +189,12 @@ static void mesh_mpm_init_link(struct wpa_supplicant *wpa_s,
 
        do {
                if (os_get_random((u8 *) &llid, sizeof(llid)) < 0)
-                       continue;
+                       llid = 0; /* continue */
        } while (!llid || llid_in_use(wpa_s, llid));
 
        sta->my_lid = llid;
        sta->peer_lid = 0;
+       sta->peer_aid = 0;
 
        /*
         * We do not use wpa_mesh_set_plink_state() here because there is no
@@ -223,14 +223,15 @@ static void mesh_mpm_send_plink_action(struct wpa_supplicant *wpa_s,
        if (!sta)
                return;
 
-       buf_len = 2 +      /* capability info */
+       buf_len = 2 +      /* Category and Action */
+                 2 +      /* capability info */
                  2 +      /* AID */
                  2 + 8 +  /* supported rates */
                  2 + (32 - 8) +
                  2 + 32 + /* mesh ID */
                  2 + 7 +  /* mesh config */
-                 2 + 23 + /* peering management */
-                 2 + 96 + /* AMPE */
+                 2 + 24 + /* peering management */
+                 2 + 96 + 32 + 32 + /* AMPE (96 + max GTKlen + max IGTKlen) */
                  2 + 16;  /* MIC */
 #ifdef CONFIG_IEEE80211N
        if (type != PLINK_CLOSE && wpa_s->mesh_ht_enabled) {
@@ -244,8 +245,23 @@ static void mesh_mpm_send_plink_action(struct wpa_supplicant *wpa_s,
                           2 + 5;  /* VHT Operation */
        }
 #endif /* CONFIG_IEEE80211AC */
+#ifdef CONFIG_IEEE80211AX
+       if (type != PLINK_CLOSE && wpa_s->mesh_he_enabled) {
+               buf_len += 3 +
+                          HE_MAX_MAC_CAPAB_SIZE +
+                          HE_MAX_PHY_CAPAB_SIZE +
+                          HE_MAX_MCS_CAPAB_SIZE +
+                          HE_MAX_PPET_CAPAB_SIZE;
+               buf_len += 3 + sizeof(struct ieee80211_he_operation);
+       }
+#endif /* CONFIG_IEEE80211AX */
        if (type != PLINK_CLOSE)
                buf_len += conf->rsn_ie_len; /* RSN IE */
+#ifdef CONFIG_OCV
+       /* OCI is included even when the other STA doesn't support OCV */
+       if (type != PLINK_CLOSE && conf->ocv)
+               buf_len += OCV_OCI_EXTENDED_LEN;
+#endif /* CONFIG_OCV */
 
        buf = wpabuf_alloc(buf_len);
        if (!buf)
@@ -351,11 +367,42 @@ static void mesh_mpm_send_plink_action(struct wpa_supplicant *wpa_s,
        if (type != PLINK_CLOSE && wpa_s->mesh_vht_enabled) {
                u8 vht_capa_oper[2 + 12 + 2 + 5];
 
-               pos = hostapd_eid_vht_capabilities(bss, vht_capa_oper);
+               pos = hostapd_eid_vht_capabilities(bss, vht_capa_oper, 0);
                pos = hostapd_eid_vht_operation(bss, pos);
                wpabuf_put_data(buf, vht_capa_oper, pos - vht_capa_oper);
        }
 #endif /* CONFIG_IEEE80211AC */
+#ifdef CONFIG_IEEE80211AX
+       if (type != PLINK_CLOSE && wpa_s->mesh_he_enabled) {
+               u8 he_capa_oper[3 +
+                               HE_MAX_MAC_CAPAB_SIZE +
+                               HE_MAX_PHY_CAPAB_SIZE +
+                               HE_MAX_MCS_CAPAB_SIZE +
+                               HE_MAX_PPET_CAPAB_SIZE +
+                               3 + sizeof(struct ieee80211_he_operation)];
+
+               pos = hostapd_eid_he_capab(bss, he_capa_oper,
+                                          IEEE80211_MODE_MESH);
+               pos = hostapd_eid_he_operation(bss, pos);
+               wpabuf_put_data(buf, he_capa_oper, pos - he_capa_oper);
+       }
+#endif /* CONFIG_IEEE80211AX */
+
+#ifdef CONFIG_OCV
+       if (type != PLINK_CLOSE && conf->ocv) {
+               struct wpa_channel_info ci;
+
+               if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
+                       wpa_printf(MSG_WARNING,
+                                  "Mesh MPM: Failed to get channel info for OCI element");
+                       goto fail;
+               }
+
+               pos = wpabuf_put(buf, OCV_OCI_EXTENDED_LEN);
+               if (ocv_insert_extended_oci(&ci, pos) < 0)
+                       goto fail;
+       }
+#endif /* CONFIG_OCV */
 
        if (ampe && mesh_rsn_protect_frame(wpa_s->mesh_rsn, sta, cat, buf)) {
                wpa_msg(wpa_s, MSG_INFO,
@@ -394,6 +441,7 @@ void wpa_mesh_set_plink_state(struct wpa_supplicant *wpa_s,
        os_memset(&params, 0, sizeof(params));
        params.addr = sta->addr;
        params.plink_state = state;
+       params.peer_aid = sta->peer_aid;
        params.set = 1;
 
        ret = wpa_drv_sta_add(wpa_s, &params);
@@ -437,7 +485,7 @@ static void plink_timer(void *eloop_ctx, void *user_data)
                        break;
                }
                reason = WLAN_REASON_MESH_MAX_RETRIES;
-               /* fall through on else */
+               /* fall through */
 
        case PLINK_CNF_RCVD:
                /* confirm timer */
@@ -648,6 +696,9 @@ static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
        struct mesh_conf *conf = wpa_s->ifmsh->mconf;
        struct hostapd_data *data = wpa_s->ifmsh->bss[0];
        struct sta_info *sta;
+#ifdef CONFIG_IEEE80211N
+       struct ieee80211_ht_operation *oper;
+#endif /* CONFIG_IEEE80211N */
        int ret;
 
        if (elems->mesh_config_len >= 7 &&
@@ -659,11 +710,12 @@ static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
        }
 
        sta = ap_get_sta(data, addr);
-       if (!sta) {
-               sta = ap_sta_add(data, addr);
-               if (!sta)
-                       return NULL;
-       }
+       if (sta)
+               return NULL;
+
+       sta = ap_sta_add(data, addr);
+       if (!sta)
+               return NULL;
 
        /* Set WMM by default since Mesh STAs are QoS STAs */
        sta->flags |= WLAN_STA_WMM;
@@ -679,14 +731,31 @@ static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
 
 #ifdef CONFIG_IEEE80211N
        copy_sta_ht_capab(data, sta, elems->ht_capabilities);
+
+       oper = (struct ieee80211_ht_operation *) elems->ht_operation;
+       if (oper &&
+           !(oper->ht_param & HT_INFO_HT_PARAM_STA_CHNL_WIDTH) &&
+           sta->ht_capabilities) {
+               wpa_msg(wpa_s, MSG_DEBUG, MACSTR
+                       " does not support 40 MHz bandwidth",
+                       MAC2STR(sta->addr));
+               set_disable_ht40(sta->ht_capabilities, 1);
+       }
+
        update_ht_state(data, sta);
 #endif /* CONFIG_IEEE80211N */
 
 #ifdef CONFIG_IEEE80211AC
        copy_sta_vht_capab(data, sta, elems->vht_capabilities);
+       copy_sta_vht_oper(data, sta, elems->vht_operation);
        set_sta_vht_opmode(data, sta, elems->vht_opmode_notif);
 #endif /* CONFIG_IEEE80211AC */
 
+#ifdef CONFIG_IEEE80211AX
+       copy_sta_he_capab(data, sta, IEEE80211_MODE_MESH,
+                         elems->he_capabilities, elems->he_capabilities_len);
+#endif /* CONFIG_IEEE80211AX */
+
        if (hostapd_get_aid(data, sta) < 0) {
                wpa_msg(wpa_s, MSG_ERROR, "No AIDs available");
                ap_free_sta(data, sta);
@@ -700,9 +769,12 @@ static struct sta_info * mesh_mpm_add_peer(struct wpa_supplicant *wpa_s,
        params.addr = addr;
        params.plink_state = sta->plink_state;
        params.aid = sta->aid;
+       params.peer_aid = sta->peer_aid;
        params.listen_interval = 100;
        params.ht_capabilities = sta->ht_capabilities;
        params.vht_capabilities = sta->vht_capabilities;
+       params.he_capab = sta->he_capab;
+       params.he_capab_len = sta->he_capab_len;
        params.flags |= WPA_STA_WMM;
        params.flags_mask |= WPA_STA_AUTHENTICATED;
        if (conf->security == MESH_CONF_SEC_NONE) {
@@ -843,15 +915,17 @@ static void mesh_mpm_plink_estab(struct wpa_supplicant *wpa_s,
        /* Send ctrl event */
        wpa_msg(wpa_s, MSG_INFO, MESH_PEER_CONNECTED MACSTR,
                MAC2STR(sta->addr));
+
+       /* Send D-Bus event */
+       wpas_notify_mesh_peer_connected(wpa_s, sta->addr);
 }
 
 
 static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
-                        enum plink_event event)
+                        enum plink_event event, u16 reason)
 {
        struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
        struct mesh_conf *conf = wpa_s->ifmsh->mconf;
-       u16 reason = 0;
 
        wpa_msg(wpa_s, MSG_DEBUG, "MPM " MACSTR " state %s event %s",
                MAC2STR(sta->addr), mplstate[sta->plink_state],
@@ -868,6 +942,10 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                        mesh_mpm_send_plink_action(wpa_s, sta, PLINK_CONFIRM,
                                                   0);
                        break;
+               case REQ_RJCT:
+                       mesh_mpm_send_plink_action(wpa_s, sta,
+                                                  PLINK_CLOSE, reason);
+                       break;
                default:
                        break;
                }
@@ -876,7 +954,8 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                switch (event) {
                case OPN_RJCT:
                case CNF_RJCT:
-                       reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
+                       if (!reason)
+                               reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
                        /* fall-through */
                case CLS_ACPT:
                        wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
@@ -911,7 +990,8 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                switch (event) {
                case OPN_RJCT:
                case CNF_RJCT:
-                       reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
+                       if (!reason)
+                               reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
                        /* fall-through */
                case CLS_ACPT:
                        wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
@@ -942,7 +1022,8 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                switch (event) {
                case OPN_RJCT:
                case CNF_RJCT:
-                       reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
+                       if (!reason)
+                               reason = WLAN_REASON_MESH_CONFIG_POLICY_VIOLATION;
                        /* fall-through */
                case CLS_ACPT:
                        wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
@@ -969,9 +1050,12 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                break;
        case PLINK_ESTAB:
                switch (event) {
+               case OPN_RJCT:
+               case CNF_RJCT:
                case CLS_ACPT:
                        wpa_mesh_set_plink_state(wpa_s, sta, PLINK_HOLDING);
-                       reason = WLAN_REASON_MESH_CLOSE_RCVD;
+                       if (!reason)
+                               reason = WLAN_REASON_MESH_CLOSE_RCVD;
 
                        eloop_register_timeout(
                                conf->dot11MeshHoldingTimeout / 1000,
@@ -986,6 +1070,10 @@ static void mesh_mpm_fsm(struct wpa_supplicant *wpa_s, struct sta_info *sta,
                        wpa_msg(wpa_s, MSG_INFO, MESH_PEER_DISCONNECTED MACSTR,
                                MAC2STR(sta->addr));
 
+                       /* Send D-Bus event */
+                       wpas_notify_mesh_peer_disconnected(wpa_s, sta->addr,
+                                                          reason);
+
                        hapd->num_plinks--;
 
                        mesh_mpm_send_plink_action(wpa_s, sta,
@@ -1032,13 +1120,14 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
        struct hostapd_data *hapd = wpa_s->ifmsh->bss[0];
        struct mesh_conf *mconf = wpa_s->ifmsh->mconf;
        struct sta_info *sta;
-       u16 plid = 0, llid = 0;
+       u16 plid = 0, llid = 0, aid = 0;
        enum plink_event event;
        struct ieee802_11_elems elems;
        struct mesh_peer_mgmt_ie peer_mgmt_ie;
        const u8 *ies;
        size_t ie_len;
        int ret;
+       u16 reason = 0;
 
        if (mgmt->u.action.category != WLAN_ACTION_SELF_PROTECTED)
                return;
@@ -1069,7 +1158,8 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
                ie_len -= 2;
        }
        if (action_field == PLINK_CONFIRM) {
-               wpa_printf(MSG_DEBUG, "MPM: AID 0x%x", WPA_GET_LE16(ies));
+               aid = WPA_GET_LE16(ies);
+               wpa_printf(MSG_DEBUG, "MPM: AID 0x%x", aid);
                ies += 2;       /* aid */
                ie_len -= 2;
        }
@@ -1125,7 +1215,7 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
         */
        if (!sta && action_field == PLINK_OPEN &&
            (!(mconf->security & MESH_CONF_SEC_AMPE) ||
-            wpa_auth_pmksa_get(hapd->wpa_auth, mgmt->sa)))
+            wpa_auth_pmksa_get(hapd->wpa_auth, mgmt->sa, NULL)))
                sta = mesh_mpm_add_peer(wpa_s, mgmt->sa, &elems);
 
        if (!sta) {
@@ -1157,10 +1247,61 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
                                   res);
                        if (action_field == PLINK_OPEN && res == -2) {
                                /* AES-SIV decryption failed */
-                               mesh_mpm_fsm(wpa_s, sta, OPN_RJCT);
+                               mesh_mpm_fsm(wpa_s, sta, OPN_RJCT,
+                                            WLAN_REASON_MESH_INVALID_GTK);
                        }
                        return;
                }
+
+#ifdef CONFIG_OCV
+               if (action_field == PLINK_OPEN && elems.rsn_ie) {
+                       struct wpa_state_machine *sm = sta->wpa_sm;
+                       struct wpa_ie_data data;
+
+                       res = wpa_parse_wpa_ie_rsn(elems.rsn_ie - 2,
+                                                  elems.rsn_ie_len + 2,
+                                                  &data);
+                       if (res) {
+                               wpa_printf(MSG_DEBUG,
+                                          "Failed to parse RSN IE (res=%d)",
+                                          res);
+                               wpa_hexdump(MSG_DEBUG, "RSN IE", elems.rsn_ie,
+                                           elems.rsn_ie_len);
+                               return;
+                       }
+
+                       wpa_auth_set_ocv(sm, mconf->ocv &&
+                                        (data.capabilities &
+                                         WPA_CAPABILITY_OCVC));
+               }
+
+               if (action_field != PLINK_CLOSE &&
+                   wpa_auth_uses_ocv(sta->wpa_sm)) {
+                       struct wpa_channel_info ci;
+                       int tx_chanwidth;
+                       int tx_seg1_idx;
+
+                       if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
+                               wpa_printf(MSG_WARNING,
+                                          "MPM: Failed to get channel info to validate received OCI in MPM Confirm");
+                               return;
+                       }
+
+                       if (get_tx_parameters(
+                                   sta, channel_width_to_int(ci.chanwidth),
+                                   ci.seg1_idx, &tx_chanwidth,
+                                   &tx_seg1_idx) < 0)
+                               return;
+
+                       if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
+                                                tx_chanwidth, tx_seg1_idx) !=
+                           0) {
+                               wpa_printf(MSG_WARNING, "MPM: %s",
+                                          ocv_errorstr);
+                               return;
+                       }
+               }
+#endif /* CONFIG_OCV */
        }
 
        if (sta->plink_state == PLINK_BLOCKED) {
@@ -1172,12 +1313,16 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
        switch (action_field) {
        case PLINK_OPEN:
                if (plink_free_count(hapd) == 0) {
-                       event = OPN_IGNR;
+                       event = REQ_RJCT;
+                       reason = WLAN_REASON_MESH_MAX_PEERS;
                        wpa_printf(MSG_INFO,
                                   "MPM: Peer link num over quota(%d)",
                                   hapd->max_plinks);
                } else if (sta->peer_lid && sta->peer_lid != plid) {
-                       event = OPN_IGNR;
+                       wpa_printf(MSG_DEBUG,
+                                  "MPM: peer_lid mismatch: 0x%x != 0x%x",
+                                  sta->peer_lid, plid);
+                       return; /* no FSM event */
                } else {
                        sta->peer_lid = plid;
                        event = OPN_ACPT;
@@ -1185,16 +1330,21 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
                break;
        case PLINK_CONFIRM:
                if (plink_free_count(hapd) == 0) {
-                       event = CNF_IGNR;
+                       event = REQ_RJCT;
+                       reason = WLAN_REASON_MESH_MAX_PEERS;
                        wpa_printf(MSG_INFO,
                                   "MPM: Peer link num over quota(%d)",
                                   hapd->max_plinks);
                } else if (sta->my_lid != llid ||
                           (sta->peer_lid && sta->peer_lid != plid)) {
-                       event = CNF_IGNR;
+                       wpa_printf(MSG_DEBUG,
+                                  "MPM: lid mismatch: my_lid: 0x%x != 0x%x or peer_lid: 0x%x != 0x%x",
+                                  sta->my_lid, llid, sta->peer_lid, plid);
+                       return; /* no FSM event */
                } else {
                        if (!sta->peer_lid)
                                sta->peer_lid = plid;
+                       sta->peer_aid = aid;
                        event = CNF_ACPT;
                }
                break;
@@ -1210,12 +1360,19 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
                         * restarted.
                         */
                        event = CLS_ACPT;
-               else if (sta->peer_lid != plid)
-                       event = CLS_IGNR;
-               else if (peer_mgmt_ie.plid && sta->my_lid != llid)
-                       event = CLS_IGNR;
-               else
+               else if (sta->peer_lid != plid) {
+                       wpa_printf(MSG_DEBUG,
+                                  "MPM: peer_lid mismatch: 0x%x != 0x%x",
+                                  sta->peer_lid, plid);
+                       return; /* no FSM event */
+               } else if (peer_mgmt_ie.plid && sta->my_lid != llid) {
+                       wpa_printf(MSG_DEBUG,
+                                  "MPM: my_lid mismatch: 0x%x != 0x%x",
+                                  sta->my_lid, llid);
+                       return; /* no FSM event */
+               } else {
                        event = CLS_ACPT;
+               }
                break;
        default:
                /*
@@ -1225,7 +1382,7 @@ void mesh_mpm_action_rx(struct wpa_supplicant *wpa_s,
                 */
                return;
        }
-       mesh_mpm_fsm(wpa_s, sta, event);
+       mesh_mpm_fsm(wpa_s, sta, event, reason);
 }