DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
hostapd/wpa_supplicant/sme.c

3595 lines
102 KiB
C
Raw Normal View History

Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* wpa_supplicant - SME
tests: Association comeback mechanism in wpa_supplicant Allow the Timeout Interval Type field in the Timeout Interval element to be overridden with a different value for testing purposes to be able to bypass the association comeback processing in mac80211. This allows the wpa_supplicant internal functionality to be tested. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 11:17:07 +01:00
* Copyright (c) 2009-2024, Jouni Malinen <j@w1.fi>
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*
Remove the GPL notification from files contributed by Jouni Malinen Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-11 15:46:35 +01:00
* This software may be distributed under the terms of the BSD license.
* See README for more details.
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*/
#include "includes.h"
#include "common.h"
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
#include "utils/eloop.h"
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
#include "utils/ext_password.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/ieee802_11_defs.h"
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
#include "common/ieee802_11_common.h"
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
#include "common/ocv.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "eapol_supp/eapol_supp_sm.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/wpa_common.h"
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#include "common/sae.h"
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#include "common/dpp.h"
Remove src/rsn_supp from default header path
2009-11-29 17:28:08 +01:00
#include "rsn_supp/wpa.h"
#include "rsn_supp/pmksa_cache.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "config.h"
#include "wpa_supplicant_i.h"
Add preliminary hostapd data structure initialization for AP mode wpa_supplicant can now initialize hostapd data structures when mode=2 is used to set up an AP. The hostapd configuration is not yet set based on wpa_supplicant network configuration block. In addition, the glue code for hostapd driver_ops needs number of functions that will be needed for AP functionality.
2009-03-26 19:37:05 +01:00
#include "driver_i.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "wpas_glue.h"
#include "wps_supplicant.h"
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#include "p2p_supplicant.h"
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
#include "notify.h"
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
#include "bss.h"
MLD: Ignore failed links from association attempt If for some reason association fails and a link which has an error is reported, add that specific link to the ignore list. After that, immediately retrigger the connection code. In the usual case, we are then going to reconnect to the same AP MLD but with that particular link not being included in the connection. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-21 00:51:28 +01:00
#include "bssid_ignore.h"
Move wpa_supplicant specific scan code away from src/drivers This fits better in wpa_supplicant/scan.c. Couple of remaining scan_helpers.c functions are currently used in driver wrappers, but they can likely be removed in the future.
2010-01-03 17:48:11 +01:00
#include "scan.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "sme.h"
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
#include "hs20_supplicant.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
#define SME_AUTH_TIMEOUT 5
#define SME_ASSOC_TIMEOUT 5
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
static int index_within_array(const int *array, int idx)
{
int i;
for (i = 0; i < idx; i++) {
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (array[i] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return 0;
}
return 1;
}
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
static int sme_set_sae_group(struct wpa_supplicant *wpa_s, bool external)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
{
int *groups = wpa_s->conf->sae_groups;
SAE: Enable only groups 19, 20, and 21 in station mode Remove groups 25 (192-bit Random ECP Group) and 26 (224-bit Random ECP Group) from the default SAE groups in station mode since those groups are not as strong as the mandatory group 19 (NIST P-256). In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:23:58 +01:00
int default_groups[] = { 19, 20, 21, 0 };
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (!groups || groups[0] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
groups = default_groups;
/* Configuration may have changed, so validate current index */
if (!index_within_array(groups, wpa_s->sme.sae_group_index))
return -1;
for (;;) {
int group = groups[wpa_s->sme.sae_group_index];
Fix SAE group selection in an error case The sae_groups parameter is zero terminated array, not -1 terminated, so must check the value against <= 0 to break out from the loop. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 22:29:57 +02:00
if (group <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
break;
if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
wpa_s->sme.sae.group);
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
wpa_s->sme.sae.akmp = external ?
wpa_s->sme.ext_auth_key_mgmt : wpa_s->key_mgmt;
Fix indentation level This gets rid of smatch warnings about inconsistent indenting. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-30 16:56:56 +01:00
return 0;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
}
wpa_s->sme.sae_group_index++;
}
return -1;
}
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
struct wpa_ssid *ssid,
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
const u8 *bssid,
const u8 *mld_addr,
int external,
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
int reuse, int *ret_use_pt,
bool *ret_use_pk)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
struct wpabuf *buf;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
size_t len;
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
char *password = NULL;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
struct wpa_bss *bss;
int use_pt = 0;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
bool use_pk = false;
u8 rsnxe_capa = 0;
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
int key_mgmt = external ? wpa_s->sme.ext_auth_key_mgmt :
wpa_s->key_mgmt;
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
const u8 *addr = mld_addr ? mld_addr : bssid;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (ret_use_pt)
*ret_use_pt = 0;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (ret_use_pk)
*ret_use_pk = false;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
SAE: Allow commit fields to be overridden for testing purposes (STA) The new "SET sae_commit_override <hexdump>" control interface command can be used to force wpa_supplicant to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 01:12:44 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->sae_commit_override) {
wpa_printf(MSG_DEBUG, "SAE: TESTING - commit override");
buf = wpabuf_alloc(4 + wpabuf_len(wpa_s->sae_commit_override));
if (!buf)
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Fix commit message override with external authentication Do not add duplicate Transaction Sequence and Status Code fields when using test functionality to override SAE commit message. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-29 22:04:35 +01:00
if (!external) {
wpabuf_put_le16(buf, 1); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
}
SAE: Allow commit fields to be overridden for testing purposes (STA) The new "SET sae_commit_override <hexdump>" control interface command can be used to force wpa_supplicant to override SAE commit message fields for testing purposes. This is included only in CONFIG_TESTING_OPTIONS=y builds. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-02 01:12:44 +02:00
wpabuf_put_buf(buf, wpa_s->sae_commit_override);
return buf;
}
#endif /* CONFIG_TESTING_OPTIONS */
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
if (ssid->sae_password) {
password = os_strdup(ssid->sae_password);
if (!password) {
wpa_dbg(wpa_s, MSG_INFO,
"SAE: Failed to allocate password");
goto fail;
}
}
if (!password && ssid->passphrase) {
password = os_strdup(ssid->passphrase);
if (!password) {
wpa_dbg(wpa_s, MSG_INFO,
"SAE: Failed to allocate password");
goto fail;
}
}
if (!password && ssid->ext_psk) {
struct wpabuf *pw = ext_password_get(wpa_s->ext_pw,
ssid->ext_psk);
if (!pw) {
wpa_msg(wpa_s, MSG_INFO,
"SAE: No password found from external storage");
goto fail;
}
password = os_malloc(wpabuf_len(pw) + 1);
if (!password) {
wpa_dbg(wpa_s, MSG_INFO,
"SAE: Failed to allocate password");
goto fail;
}
os_memcpy(password, wpabuf_head(pw), wpabuf_len(pw));
password[wpabuf_len(pw)] = '\0';
ext_password_free(pw);
}
SAE: Allow SAE password to be configured separately (STA) The new sae_password network profile parameter can now be used to set the SAE password instead of the previously used psk parameter. This allows shorter than 8 characters and longer than 63 characters long passwords to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 22:09:16 +02:00
if (!password) {
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
wpa_printf(MSG_DEBUG, "SAE: No password available");
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
}
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
if (reuse && wpa_s->sme.sae.tmp &&
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
ether_addr_equal(addr, wpa_s->sme.sae.tmp->bssid)) {
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
wpa_printf(MSG_DEBUG,
"SAE: Reuse previously generated PWE on a retry with the same AP");
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
use_pt = wpa_s->sme.sae.h2e;
use_pk = wpa_s->sme.sae.pk;
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
goto reuse_data;
}
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
if (sme_set_sae_group(wpa_s, external) < 0) {
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
}
SAE: Maintain EC group context in struct sae_data This can be used to share same EC group context through the SAE exchange. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 10:29:53 +01:00
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
SAE: Make sure BSS entry is available to determine RSNXE information wpa_supplicant may use wrong SAE authentication method if it doesn't have the scan result for the target BSS since RSNXE information is not available. For example, STA might use the hunting-and-pecking loop method for SAE authentication even though AP supports SAE H2E and STA is configured with sae_pwe=2. This is possible in cases like EXTERNAL_AUTH triggered by the driver during roaming. To avoid this update scan results to fetch the target BSS scan result from the driver. Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
2021-12-07 09:25:24 +01:00
if (!bss) {
wpa_printf(MSG_DEBUG,
"SAE: BSS not available, update scan result to get BSS");
wpa_supplicant_update_scan_results(wpa_s);
bss = wpa_bss_get_bssid_latest(wpa_s, bssid);
}
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (bss) {
const u8 *rsnxe;
rsnxe = wpa_bss_get_ie(bss, WLAN_EID_RSNX);
if (rsnxe && rsnxe[1] >= 1)
rsnxe_capa = rsnxe[2];
}
SAE: Add an enum for defining sae_pwe parameter values Make this more readable by replacing magic numbers with enum values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-29 19:36:15 +01:00
if (ssid->sae_password_id &&
wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
use_pt = 1;
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
if (wpa_key_mgmt_sae_ext_key(key_mgmt) &&
SAE: Add an enum for defining sae_pwe parameter values Make this more readable by replacing magic numbers with enum values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-29 19:36:15 +01:00
wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
SAE: Use H2E unconditionally with the new AKM suites The new SAE AKM suites are defined to use H2E, so ignore the sae_pwe value when these AKM suites are used similarly to the way H2E gets enabled when SAE Password Identifiers are used. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-24 21:20:58 +02:00
use_pt = 1;
SAE: Extend automatic enabling of H2E on 6 GHz to additional cases Commit 3a0edb2cd86e ("SAE: Enable H2E for 6 GHz BSS") started enabling H2E automatically for SAE use on the 6 GHz band, but it did not update these steps in verifying whether the STA has matching configuration for a BSS that mandates use of H2E and whether to use PT for SAE in SME. Update these to be aware of automatic H2E enabling. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-01-30 22:07:21 +01:00
if (bss && is_6ghz_freq(bss->freq) &&
wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK)
use_pt = 1;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
#ifdef CONFIG_SAE_PK
if ((rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_PK)) &&
SAE-PK: Allow automatic SAE-PK to be disabled This replaces the previously used sae_pk_only configuration parameter with a more generic sae_pk that can be used to specify how SAE-PK is negotiated. The default behavior (sae_pk=0) is to automatically negotiate SAE-PK whenever the AP supports it and the password is in appropriate format. sae_pk=1 allows only SAE-PK to be used and sae_pk=2 disables SAE-PK completely. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 10:53:26 +02:00
ssid->sae_pk != SAE_PK_MODE_DISABLED &&
SAE-PK: Allow SAE-PK password to be set using the psk parameter Only the sae_password parameter was previously accepted for SAE-PK use. That is not sufficient for covering mixed SAE+PSK cases. Extend this by allowing the psk parameter to be used as well just like it can be used for SAE without SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-06 23:47:15 +02:00
((ssid->sae_password &&
sae_pk_valid_password(ssid->sae_password)) ||
(!ssid->sae_password && ssid->passphrase &&
sae_pk_valid_password(ssid->passphrase)))) {
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
use_pt = 1;
use_pk = true;
}
SAE-PK: Allow SAE authentication without PK to be disabled The new wpa_supplicant network profile parameter sae_pk_only=1 can now be used to disable use of SAE authentication without SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 10:42:59 +02:00
SAE-PK: Allow automatic SAE-PK to be disabled This replaces the previously used sae_pk_only configuration parameter with a more generic sae_pk that can be used to specify how SAE-PK is negotiated. The default behavior (sae_pk=0) is to automatically negotiate SAE-PK whenever the AP supports it and the password is in appropriate format. sae_pk=1 allows only SAE-PK to be used and sae_pk=2 disables SAE-PK completely. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 10:53:26 +02:00
if (ssid->sae_pk == SAE_PK_MODE_ONLY && !use_pk) {
SAE-PK: Allow SAE authentication without PK to be disabled The new wpa_supplicant network profile parameter sae_pk_only=1 can now be used to disable use of SAE authentication without SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 10:42:59 +02:00
wpa_printf(MSG_DEBUG,
"SAE: Cannot use PK with the selected AP");
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE-PK: Allow SAE authentication without PK to be disabled The new wpa_supplicant network profile parameter sae_pk_only=1 can now be used to disable use of SAE authentication without SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 10:42:59 +02:00
}
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
#endif /* CONFIG_SAE_PK */
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
SAE: Add an enum for defining sae_pwe parameter values Make this more readable by replacing magic numbers with enum values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-29 19:36:15 +01:00
if (use_pt || wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
wpa_s->conf->sae_pwe == SAE_PWE_BOTH) {
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
use_pt = !!(rsnxe_capa & BIT(WLAN_RSNX_CAPAB_SAE_H2E));
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
SAE: Add an enum for defining sae_pwe parameter values Make this more readable by replacing magic numbers with enum values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-29 19:36:15 +01:00
if ((wpa_s->conf->sae_pwe == SAE_PWE_HASH_TO_ELEMENT ||
ssid->sae_password_id ||
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
wpa_key_mgmt_sae_ext_key(key_mgmt)) &&
SAE: Add an enum for defining sae_pwe parameter values Make this more readable by replacing magic numbers with enum values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-29 19:36:15 +01:00
wpa_s->conf->sae_pwe != SAE_PWE_FORCE_HUNT_AND_PECK &&
SAE: Use H2E whenever Password Identifier is used IEEE P802.11-REVmd was modified to require H2E to be used whenever Password Identifier is used with SAE. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 20:15:04 +01:00
!use_pt) {
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
wpa_printf(MSG_DEBUG,
"SAE: Cannot use H2E with the selected AP");
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
}
}
SAE: Update PT value at later point for SME cases, if needed It was possible to hit a case where the SAE PT had not yet been derived, e.g., when using P2P group re-invocation. Update PT use at the time authentication is started, if needed, to avoid this. While this is not really ideal from the externally observable timing view point, this is done only for the case where there is no other option available with a dynamically changing network configuration for P2P. Similar design was already in place for the SAE offload-from-driver (external auth) case. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-01-30 22:09:53 +01:00
if (use_pt && !ssid->pt)
wpa_s_setup_sae_pt(wpa_s->conf, ssid, true);
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (use_pt &&
sae_prepare_commit_pt(&wpa_s->sme.sae, ssid->pt,
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
wpa_s->own_addr, addr,
SAE-PK: Extend SAE functionality for AP validation This adds core SAE functionality for a new mode of using SAE with a specially constructed password that contains a fingerprint for an AP public key and that public key being used to validate an additional signature in SAE confirm from the AP. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
wpa_s->sme.sae_rejected_groups, NULL) < 0)
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (!use_pt &&
MLD STA: Update SAE PWE derivation in hunting-and-pecking loop case Use AP MLD address instead of BSSID for PWE derivation during MLO connection. This was already done for H2E in commit e869fdfeefa5 ("wpa_supplicant: Use MLD address in SAE authentication"). While IEEE P802.11be requires H2E to be used, there are deployed AP MLDs that do not follow that requirement. This change to the hunting-and-pecking loop case is needed for interoperability workarounds with such APs. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-12-15 15:23:59 +01:00
sae_prepare_commit(wpa_s->own_addr, addr,
SAE: Allow SAE password to be configured separately (STA) The new sae_password network profile parameter can now be used to set the SAE password instead of the previously used psk parameter. This allows shorter than 8 characters and longer than 63 characters long passwords to be used. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-11 22:09:16 +02:00
(u8 *) password, os_strlen(password),
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
}
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (wpa_s->sme.sae.tmp) {
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
os_memcpy(wpa_s->sme.sae.tmp->bssid, addr, ETH_ALEN);
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (use_pt && use_pk)
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
wpa_s->sme.sae.pk = 1;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
#ifdef CONFIG_SAE_PK
os_memcpy(wpa_s->sme.sae.tmp->own_addr, wpa_s->own_addr,
ETH_ALEN);
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
os_memcpy(wpa_s->sme.sae.tmp->peer_addr, addr, ETH_ALEN);
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
sae_pk_set_password(&wpa_s->sme.sae, password);
#endif /* CONFIG_SAE_PK */
}
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
reuse_data:
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
len = wpa_s->sme.sae_token ? 3 + wpabuf_len(wpa_s->sme.sae_token) : 0;
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (ssid->sae_password_id)
len += 4 + os_strlen(ssid->sae_password_id);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external) {
wpabuf_put_le16(buf, 1); /* Transaction seq# */
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (use_pk)
wpabuf_put_le16(buf, WLAN_STATUS_SAE_PK);
else if (use_pt)
wpabuf_put_le16(buf, WLAN_STATUS_SAE_HASH_TO_ELEMENT);
else
wpabuf_put_le16(buf,WLAN_STATUS_SUCCESS);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
SAE: Expose sae_write_commit() error cases to callers Check whether an error is reported from any of the functions that could in theory fail and if so, do not proceed with the partially filled SAE commit buffer. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:59:42 +01:00
if (sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token,
ssid->sae_password_id) < 0) {
wpabuf_free(buf);
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
goto fail;
SAE: Expose sae_write_commit() error cases to callers Check whether an error is reported from any of the functions that could in theory fail and if so, do not proceed with the partially filled SAE commit buffer. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-08 15:59:42 +01:00
}
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (ret_use_pt)
*ret_use_pt = use_pt;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (ret_use_pk)
*ret_use_pk = use_pk;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
str_clear_free(password);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
SAE: Allow loading of the password from an external database There was no support for loading SAE passwords from an external password database. Signed-off-by: Ben Wolsieffer <benwolsieffer@gmail.com>
2022-09-17 06:21:02 +02:00
fail:
str_clear_free(password);
return NULL;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s,
int external)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
struct wpabuf *buf;
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
return NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!external) {
wpabuf_put_le16(buf, 2); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
}
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
sae_write_confirm(&wpa_s->sme.sae, buf);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
}
#endif /* CONFIG_SAE */
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
/**
* sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
* @wpa_s: Pointer to wpa_supplicant data
* @bss: Pointer to the bss which is the target of authentication attempt
*/
static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
const u8 rrm_ie_len = 5;
u8 *pos;
const u8 *rrm_ie;
wpa_s->rrm.rrm_used = 0;
wpa_printf(MSG_DEBUG,
"RRM: Determining whether RRM can be used - device support: 0x%x",
wpa_s->drv_rrm_flags);
rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
return;
}
SME: Add support for global RRM flag Add RRM to SME authentication/association if the global RRM flag is set. Signed-off-by: Beni Lev <beni.lev@intel.com>
2016-04-06 18:42:17 +02:00
if (!((wpa_s->drv_rrm_flags &
WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) &&
(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) &&
!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_SUPPORT_RRM)) {
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_printf(MSG_DEBUG,
"RRM: Insufficient RRM support in driver - do not use RRM");
return;
}
SME: Fix a sign-compare warning Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-25 00:07:16 +01:00
if (sizeof(wpa_s->sme.assoc_req_ie) <
wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_printf(MSG_INFO,
"RRM: Unable to use RRM, no room for RRM IE");
return;
}
wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
os_memset(pos, 0, 2 + rrm_ie_len);
*pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
*pos++ = rrm_ie_len;
wpa_supplicant: Handle link measurement requests Send link measurement response when a request is received. Advertise only RCPI, computing it from the RSSI of the request. The TX power field is left to be filled by the driver. All other fields are not published. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-11-05 09:42:56 +01:00
wpa_supplicant: Fix typos Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2020-10-18 19:28:23 +02:00
/* Set supported capabilities flags */
wpa_supplicant: Handle link measurement requests Send link measurement response when a request is received. Advertise only RCPI, computing it from the RSSI of the request. The TX power field is left to be filled by the driver. All other fields are not published. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-11-05 09:42:56 +01:00
if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
*pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
RRM: Enable beacon report with active/passive scan for all drivers The requested behavior can be approximated for most use cases even if the driver does not support reporting exact TSF values for frames. Enable this capability for all drivers to make beacon report processing more useful for a common use case. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-01-02 22:04:02 +01:00
*pos |= WLAN_RRM_CAPS_BEACON_REPORT_PASSIVE |
WLAN_RRM_CAPS_BEACON_REPORT_ACTIVE |
WLAN_RRM_CAPS_BEACON_REPORT_TABLE;
wpa_supplicant: Add support for Beacon Report Radio Measurement Beacon Report Radio Measurement is defined in IEEE Std 802.11-2016, 11.11.9.1. Beacon Report is implemented by triggering a scan on the requested channels with the requested parameters. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-12-28 14:06:47 +01:00
wpa_supplicant: Handle LCI request Handle radio measurement request that contains LCI request. Send measurement report based on a configurable LCI report element. The LCI report element is configured over the control interface with SET lci <hexdump of the element> and cleared with SET lci "" Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-04-06 18:42:13 +02:00
if (wpa_s->lci)
pos[1] |= WLAN_RRM_CAPS_LCI_MEASUREMENT;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
wpa_s->rrm.rrm_used = 1;
}
SME: MLD: Handle reconfiguration Multi-Link element Parse the reconfiguration Multi-Link element and: - Don't select a BSS for connection if it is part of an MLD and is going to be removed. - Don't scan for missing links that are to be removed. - Don't include removed links in association. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-06-12 21:59:50 +02:00
static void wpas_ml_handle_removed_links(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
u16 removed_links = wpa_bss_parse_reconf_ml_element(wpa_s, bss);
wpa_s->valid_links &= ~removed_links;
}
wpa_supplicant: Add config parameters for MLD testing Add band preference, BSSID preference, and single link enforcement testing options. This is needed for testing MLO. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:19 +01:00
#ifdef CONFIG_TESTING_OPTIONS
static struct wpa_bss * wpas_ml_connect_pref(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
unsigned int low, high, i;
wpa_printf(MSG_DEBUG,
"MLD: valid_links=%d, band_pref=%u, bssid_pref=" MACSTR,
wpa_s->valid_links,
wpa_s->conf->mld_connect_band_pref,
MAC2STR(wpa_s->conf->mld_connect_bssid_pref));
/* Check if there are more than one link */
if (!(wpa_s->valid_links & (wpa_s->valid_links - 1)))
return bss;
if (!is_zero_ether_addr(wpa_s->conf->mld_connect_bssid_pref)) {
for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
if (!(wpa_s->valid_links & BIT(i)))
continue;
if (wpa_s->mlo_assoc_link_id == i)
continue;
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (ether_addr_equal(
wpa_s->links[i].bssid,
wpa_s->conf->mld_connect_bssid_pref))
wpa_supplicant: Add config parameters for MLD testing Add band preference, BSSID preference, and single link enforcement testing options. This is needed for testing MLO. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:19 +01:00
goto found;
}
}
if (wpa_s->conf->mld_connect_band_pref == MLD_CONNECT_BAND_PREF_AUTO)
return bss;
switch (wpa_s->conf->mld_connect_band_pref) {
case MLD_CONNECT_BAND_PREF_2GHZ:
low = 2412;
high = 2472;
break;
case MLD_CONNECT_BAND_PREF_5GHZ:
low = 5180;
high = 5985;
break;
case MLD_CONNECT_BAND_PREF_6GHZ:
low = 5955;
high = 7125;
break;
default:
return bss;
}
for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
if (!(wpa_s->valid_links & BIT(i)))
continue;
if (wpa_s->mlo_assoc_link_id == i)
continue;
if (wpa_s->links[i].freq >= low && wpa_s->links[i].freq <= high)
goto found;
}
found:
if (i == MAX_NUM_MLD_LINKS) {
wpa_printf(MSG_DEBUG, "MLD: No match for connect/band pref");
return bss;
}
wpa_printf(MSG_DEBUG,
"MLD: Change BSS for connect: " MACSTR " -> " MACSTR,
MAC2STR(wpa_s->links[wpa_s->mlo_assoc_link_id].bssid),
MAC2STR(wpa_s->links[i].bssid));
/* Get the BSS entry and do the switch */
bss = wpa_bss_get_bssid(wpa_s, wpa_s->links[i].bssid);
wpa_s->mlo_assoc_link_id = i;
return bss;
}
#endif /* CONFIG_TESTING_OPTIONS */
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
static int wpas_sme_ml_auth(struct wpa_supplicant *wpa_s,
union wpa_event_data *data,
int ie_offset)
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
{
struct ieee802_11_elems elems;
const u8 *mld_addr;
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
u16 status_code = data->auth.status_code;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
if (!wpa_s->valid_links)
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
return 0;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
if (ieee802_11_parse_elems(data->auth.ies + ie_offset,
data->auth.ies_len - ie_offset,
MLD STA: Do not fail on unknown IEs in Authentication frames Fail MLD address validation only if Authentication frames IE parsing actually failed, i.e., ignore all unknown IEs. This is needed to avoid authentication failure when the Authentication frames include IEs which are not handled by ieee802_11_parse_elems(), e.g., AKM Suite Selector IE. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-04-13 00:21:15 +02:00
&elems, 0) == ParseFailed) {
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
goto out;
}
if (!elems.basic_mle || !elems.basic_mle_len) {
wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
status_code == WLAN_STATUS_SUCCESS ||
status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK)
goto out;
/* Accept missing Multi-Link element in failed authentication
* cases. */
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
return 0;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
}
mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
if (!mld_addr)
goto out;
wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(wpa_s->ap_mld_addr, mld_addr)) {
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
MACSTR ")", MAC2STR(wpa_s->ap_mld_addr));
goto out;
}
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
return 0;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
out:
wpa_printf(MSG_DEBUG, "MLD: Authentication - clearing MLD state");
wpas_reset_mlo_info(wpa_s);
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
return -1;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
}
wpa_supplicant: Remove duplicate logic in wpas_ml_element() Parsing multiple RNR elements already exists in wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates the same code. Combine the functionality of both these functions and remove the duplicate. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:20 +01:00
static void wpas_sme_set_mlo_links(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
int i;
wpa_s->valid_links = 0;
for (i = 0; i < bss->n_mld_links; i++) {
u8 link_id = bss->mld_links[i].link_id;
const u8 *bssid = bss->mld_links[i].bssid;
if (i == 0)
wpa_s->mlo_assoc_link_id = link_id;
wpa_s->valid_links |= BIT(link_id);
os_memcpy(wpa_s->links[link_id].bssid, bssid, ETH_ALEN);
wpa_s->links[link_id].freq = bss->mld_links[i].freq;
wpa_s->links[link_id].bss = wpa_bss_get_bssid(wpa_s, bssid);
MLD: Add support for disabled APs An affiliated AP of an AP MLD can temporarily be disabled. Other affiliated APs of the AP MLD indicate this in the Reduced Neighbor Report (RNR) elements added to their Beacon and Probe Response frames. When an affiliated AP is disabled, it should be included in the association exchange, but can be activated only after it is enabled. Add support identifying disabled APs and propagate the information to the driver within the associate() callback. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-21 12:08:20 +01:00
wpa_s->links[link_id].disabled = bss->mld_links[i].disabled;
wpa_supplicant: Remove duplicate logic in wpas_ml_element() Parsing multiple RNR elements already exists in wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates the same code. Combine the functionality of both these functions and remove the duplicate. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:20 +01:00
}
}
Mark sme_send_authentication() static This function is not used outside sme.c. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-25 14:47:43 +01:00
static void sme_send_authentication(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid,
int start)
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
{
struct wpa_driver_auth_params params;
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
struct wpa_ssid *old_ssid;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#ifdef CONFIG_IEEE80211R
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
const u8 *ie;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#endif /* CONFIG_IEEE80211R */
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
#if defined(CONFIG_IEEE80211R) || defined(CONFIG_FILS)
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
const u8 *md = NULL;
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
#endif /* CONFIG_IEEE80211R || CONFIG_FILS */
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
int bssid_changed;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
struct wpabuf *resp = NULL;
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
u8 ext_capab[18];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
int ext_capab_len;
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
int skip_auth;
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
u8 *wpa_ie;
size_t wpa_ie_len;
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
#ifdef CONFIG_MBO
const u8 *mbo_ie;
#endif /* CONFIG_MBO */
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
int omit_rsnxe = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (bss == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
"the network");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
wpa_supplicant: Add config parameters for MLD testing Add band preference, BSSID preference, and single link enforcement testing options. This is needed for testing MLO. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:19 +01:00
os_memset(&params, 0, sizeof(params));
wpa_supplicant: Remove duplicate logic in wpas_ml_element() Parsing multiple RNR elements already exists in wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates the same code. Combine the functionality of both these functions and remove the duplicate. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:20 +01:00
if ((wpa_s->drv_flags2 & WPA_DRIVER_FLAGS2_MLO) &&
!wpa_bss_parse_basic_ml_element(wpa_s, bss, wpa_s->ap_mld_addr,
scan: Include AP MLD ID in ML probe request if needed According to IEEE P802.11be/D4.0, 35.3.4.2, the AP MLD ID must be included in the Probe Request ML element in case it is sent to a transmitted BSS in which case it should be set to 0. If it is sent to an non-transmitted BSSID, the AP MLD ID should not be included. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:37 +01:00
NULL, ssid, NULL) &&
wpa_supplicant: Remove duplicate logic in wpas_ml_element() Parsing multiple RNR elements already exists in wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates the same code. Combine the functionality of both these functions and remove the duplicate. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:20 +01:00
bss->n_mld_links) {
wpa_supplicant: Add config parameters for MLD testing Add band preference, BSSID preference, and single link enforcement testing options. This is needed for testing MLO. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:19 +01:00
wpa_printf(MSG_DEBUG, "MLD: In authentication");
wpa_supplicant: Remove duplicate logic in wpas_ml_element() Parsing multiple RNR elements already exists in wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates the same code. Combine the functionality of both these functions and remove the duplicate. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:20 +01:00
wpas_sme_set_mlo_links(wpa_s, bss);
wpa_supplicant: Add config parameters for MLD testing Add band preference, BSSID preference, and single link enforcement testing options. This is needed for testing MLO. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:19 +01:00
#ifdef CONFIG_TESTING_OPTIONS
bss = wpas_ml_connect_pref(wpa_s, bss);
if (wpa_s->conf->mld_force_single_link) {
wpa_printf(MSG_DEBUG, "MLD: Force single link");
wpa_s->valid_links = BIT(wpa_s->mlo_assoc_link_id);
}
#endif /* CONFIG_TESTING_OPTIONS */
params.mld = true;
params.mld_link_id = wpa_s->mlo_assoc_link_id;
params.ap_mld_addr = wpa_s->ap_mld_addr;
wpas_ml_handle_removed_links(wpa_s, bss);
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
wpa_s->reassoc_same_bss;
Maintain a pointer to the current BSS table entry
2010-01-02 15:59:19 +01:00
wpa_s->current_bss = bss;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->reassociate = 0;
params.freq = bss->freq;
params.bssid = bss->bssid;
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
params.ssid = bss->ssid;
params.ssid_len = bss->ssid_len;
nl80211: Change vif type to P2P_CLI upon P2P authentication Currently, wpa_driver_nl80211_authenticate() changes the interface type to station. However, in case of P2P, we need to change the interface type to P2P_CLI. Add p2p field to the authentication params, and consider it for choosing the correct interface type. Signed-off-by: Eliad Peller <eliad@wizery.com>
2011-07-17 19:25:58 +02:00
params.p2p = ssid->p2p_group;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.ssid_len != params.ssid_len ||
os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
wpa_s->sme.prev_bssid_set = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.freq = params.freq;
os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
wpa_s->sme.ssid_len = params.ssid_len;
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_OPEN;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef IEEE8021X_EAPOL
if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
if (ssid->leap) {
if (ssid->non_leap == 0)
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
else
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg |= WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
}
#endif /* IEEE8021X_EAPOL */
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ssid->auth_alg) {
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = ssid->auth_alg;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
"0x%x", params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_s->sme.sae_pmksa_caching = 0;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
const u8 *rsn;
struct wpa_ie_data ied;
rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
if (!rsn) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise RSN");
DPP: Support DPP and SAE in the same network profile Make both DPP and SAE code aware of the cases where the same network profile is configured to enable both DPP and SAE. Prefer DPP over SAE in such cases and start DPP/SAE exchanges based on what both the station and the AP support. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-16 16:15:09 +01:00
#ifdef CONFIG_DPP
} else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
(ssid->key_mgmt & WPA_KEY_MGMT_DPP) &&
(ied.key_mgmt & WPA_KEY_MGMT_DPP)) {
wpa_dbg(wpa_s, MSG_DEBUG, "Prefer DPP over SAE when both are enabled");
#endif /* CONFIG_DPP */
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
} else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
wpa_key_mgmt_sae(ied.key_mgmt)) {
Add option to disable SAE key_mgmt without PMF Add the `sae_check_mfp` global option to limit SAE when PMF will not be selected for the connection. With this option SAE is avoided when the hardware is not capable of PMF due to missing ciphers. With this option SAE is avoided on capable hardware when the AP does not enable PMF. Allows falling back to PSK on drivers with the WPA_DRIVER_FLAGS_SAE capability but do not support the BIP cipher necessary for PMF. This enables configurations that can fall back to WPA-PSK and avoid problems associating with APs configured with `sae_require_mfp=1`. Useful when `pmf=1` and `sae_check_mfp=1` are enabled and networks are configured with ieee80211w=3 (default) and key_mgmt="WPA-PSK SAE". In this configuration if the device is unable to use PMF due to lacking BIP group ciphers it will avoid SAE and fallback to WPA-PSK for that connection. Signed-off-by: Jeffery Miller <jefferymiller@google.com>
2022-10-25 21:35:10 +02:00
if (wpas_is_sae_avoided(wpa_s, ssid, &ied)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but disallowing SAE auth_alg without PMF");
} else {
wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
params.auth_alg = WPA_AUTH_ALG_SAE;
}
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
} else {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise SAE AKM for RSN");
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#ifdef CONFIG_WEP
{
int i;
for (i = 0; i < NUM_WEP_KEYS; i++) {
if (ssid->wep_key_len[i])
params.wep_key[i] = ssid->wep_key[i];
params.wep_key_len[i] = ssid->wep_key_len[i];
}
params.wep_tx_keyidx = ssid->wep_tx_keyidx;
nl80211: Fix static WEP key configuration when using SME Need to set WEP keys before requesting authentication in order to get Shared Key authentication working. Previously, the WEP keys were not set at all when using SME in wpa_supplicant.
2009-04-04 15:58:16 +02:00
}
Make WEP functionality an optional build parameter WEP should not be used for anything anymore. As a step towards removing it completely, move all WEP related functionality to be within CONFIG_WEP blocks. This will be included in builds only if CONFIG_WEP=y is explicitly set in build configuration. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-02-29 15:52:39 +01:00
#endif /* CONFIG_WEP */
nl80211: Fix static WEP key configuration when using SME Need to set WEP keys before requesting authentication in order to get Shared Key authentication working. Previously, the WEP keys were not set at all when using SME in wpa_supplicant.
2009-04-04 15:58:16 +02:00
Remove unnecessary bss != NULL checks from sme_authenticate() This is already verified in the beginning of the function, so no need to repeat that multiple times.
2010-01-10 20:31:54 +01:00
if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
wpa_key_mgmt_wpa(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
int try_opportunistic;
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
const u8 *cache_id = NULL;
Allow OKC to be enabled by default Previously, OKC (opportunistic key caching, a.k.a. proactive key caching) could be enabled only with a per-network parameter (proactive_key_caching). The new global parameter (okc) can now be used to change the default behavior to be OKC enabled (okc=1) for network blocks that do not override this with the proactive_key_caching parameter. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-12 19:07:53 +01:00
try_opportunistic = (ssid->proactive_key_caching < 0 ?
wpa_s->conf->okc :
ssid->proactive_key_caching) &&
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
(ssid->proto & WPA_PROTO_RSN);
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
#ifdef CONFIG_FILS
if (wpa_key_mgmt_fils(ssid->key_mgmt))
cache_id = wpa_bss_get_fils_cache_id(bss);
#endif /* CONFIG_FILS */
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
if (pmksa_cache_set_current(wpa_s->wpa, NULL,
params.mld ? params.ap_mld_addr :
bss->bssid,
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->current_ssid,
SAE: Only allow SAE AKMP for PMKSA caching attempts Explicitly check the PMKSA cache entry to have matching SAE AKMP for the case where determining whether to use PMKSA caching instead of new SAE authentication. Previously, only the network context was checked, but a single network configuration profile could be used with both WPA2-PSK and SAE, so should check the AKMP as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 19:06:40 +02:00
try_opportunistic, cache_id,
SAE: Do not reject reauth threshold passed PMKSA in association event Do not reject reauth threshold passed PMKSA indicated in successful association event since the PMKSA is still valid. Additionally, remove the reauth threshold passed PMKSA entry from the driver to prevent using it further in the driver. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-09-27 06:55:34 +02:00
0, false) == 0)
Simplify eapol_sm_notify_pmkid_attempt() Drop the unneeded 'attempt' argument. This was originally used for indicating an aborted PMKID caching attempt, but a fix in 2006 removed the only such user and since that time, only attempt == 1 has been used. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 00:26:14 +01:00
eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
wpa_s->sme.assoc_req_ie,
Don't use default RSNE/RSNXE when the driver indicates cross SSID roaming During cross SSID roaming wpa_supplicant ended up using the default RSNE/RSNXE in EAPOL-Key msg 2/4 though the driver indicated (Re)Association Request frame elements without RSNE/RSNXE. This causes RSNE/RSNXE mismatch between (Re)Association Request frame and EAPOL-Key msg 2/4. To avoid this skip copying the default RSNE/RSNXE if the driver indicates the actually used (Re)Association Request frame elements in the association event. Signed-off-by: Utkarsh Soni <quic_usoni@quicinc.com>
2022-10-20 11:15:18 +02:00
&wpa_s->sme.assoc_req_ie_len,
false)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
HS 2.0: Generate AssocReq OSEN IE based on AP advertisement Parse the OSEN IE from the AP to determine values used in the AssocReq instead of using hardcoded cipher suites. This is needed to be able to set the group cipher based on AP advertisement now that two possible options exists for this (GTK_NOT_USED in separate OSEN BSS; CCMP or GTK_NOT_USED in shared BSS case). Furthermore, this is a step towards allowing other ciphers than CCMP to be used with OSEN. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-09 17:07:16 +01:00
#ifdef CONFIG_HS20
} else if (wpa_bss_get_vendor_ie(bss, OSEN_IE_VENDOR_TYPE) &&
(ssid->key_mgmt & WPA_KEY_MGMT_OSEN)) {
/* No PMKSA caching, but otherwise similar to RSN/WPA */
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
wpa_s->sme.assoc_req_ie,
Don't use default RSNE/RSNXE when the driver indicates cross SSID roaming During cross SSID roaming wpa_supplicant ended up using the default RSNE/RSNXE in EAPOL-Key msg 2/4 though the driver indicated (Re)Association Request frame elements without RSNE/RSNXE. This causes RSNE/RSNXE mismatch between (Re)Association Request frame and EAPOL-Key msg 2/4. To avoid this skip copying the default RSNE/RSNXE if the driver indicates the actually used (Re)Association Request frame elements in the association event. Signed-off-by: Utkarsh Soni <quic_usoni@quicinc.com>
2022-10-20 11:15:18 +02:00
&wpa_s->sme.assoc_req_ie_len,
false)) {
HS 2.0: Generate AssocReq OSEN IE based on AP advertisement Parse the OSEN IE from the AP to determine values used in the AssocReq instead of using hardcoded cipher suites. This is needed to be able to set the group cipher based on AP advertisement now that two possible options exists for this (GTK_NOT_USED in separate OSEN BSS; CCMP or GTK_NOT_USED in shared BSS case). Furthermore, this is a step towards allowing other ciphers than CCMP to be used with OSEN. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-11-09 17:07:16 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites");
wpas_connect_work_done(wpa_s);
return;
}
#endif /* CONFIG_HS20 */
Allow non-WPA IEEE 802.1X to be select even if WPA is also enabled If key_mgmt was set to allow both WPA and non-WPA IEEE 802.1X (i.e., to IEEE8021X WPA-EAP), non-WPA IEEE 802.1X was rejected while preparing association parameters. Allow this special case to be handled by selecting non-WPA case if the scan results for the AP do not include either WPA or RSN elements. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-15 18:34:04 +02:00
} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
/*
* Both WPA and non-WPA IEEE 802.1X enabled in configuration -
* use non-WPA since the scan results did not indicate that the
* AP is using WPA or WPA2.
*/
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
} else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
wpa_s->sme.assoc_req_ie,
Don't use default RSNE/RSNXE when the driver indicates cross SSID roaming During cross SSID roaming wpa_supplicant ended up using the default RSNE/RSNXE in EAPOL-Key msg 2/4 though the driver indicated (Re)Association Request frame elements without RSNE/RSNXE. This causes RSNE/RSNXE mismatch between (Re)Association Request frame and EAPOL-Key msg 2/4. To avoid this skip copying the default RSNE/RSNXE if the driver indicates the actually used (Re)Association Request frame elements in the association event. Signed-off-by: Utkarsh Soni <quic_usoni@quicinc.com>
2022-10-20 11:15:18 +02:00
&wpa_s->sme.assoc_req_ie_len,
false)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites (no "
"scan results)");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
#ifdef CONFIG_WPS
} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
struct wpabuf *wps_ie;
wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
if (wps_ie && wpabuf_len(wps_ie) <=
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
wpa_s->sme.assoc_req_ie_len);
} else
wpa_s->sme.assoc_req_ie_len = 0;
wpabuf_free(wps_ie);
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
#endif /* CONFIG_WPS */
} else {
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
}
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
/* In case the WPA vendor IE is used, it should be placed after all the
* non-vendor IEs, as the lower layer expects the IEs to be ordered as
* defined in the standard. Store the WPA IE so it can later be
* inserted at the correct location.
*/
wpa_ie = NULL;
wpa_ie_len = 0;
if (wpa_s->wpa_proto == WPA_PROTO_WPA) {
wpa_ie = os_memdup(wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
if (wpa_ie) {
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Storing WPA IE");
wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
wpa_s->sme.assoc_req_ie_len = 0;
} else {
wpa_msg(wpa_s, MSG_WARNING, "WPA: Failed copy WPA IE");
wpas_connect_work_done(wpa_s);
return;
}
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
md = ie + 2;
FT: Clean up wpa_sm_set_ft_params() by using common parse Instead of parsing the IEs in the callers, use the already existing parser in wpa_ft.c to handle MDIE and FTIE from initial MD association response. In addition, this provides more complete access to association response IEs to FT code which will be needed to fix FT 4-way handshake message 2/4.
2010-04-10 10:36:35 +02:00
wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
FT: Fix SAE + FT-SAE behavior in association parameter selection Do not try to initialize FT reassociation if the selected AKM is for SAE instead of FT-SAE when both of these are enabled in a network profile. This fixes an issue with MDE being included in an (Re)Association Request frame even when using a non-FT AKM (which is something that results in hostapd rejecting the association). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-26 05:29:34 +01:00
if (md && (!wpa_key_mgmt_ft(ssid->key_mgmt) ||
!wpa_key_mgmt_ft(wpa_s->key_mgmt)))
md = NULL;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (md) {
/* Prepare for the next transition */
FT: Copy FT Capability and Policy to MDIE from target AP This sets the FT Capability and Policy field in the MDIE to the values received from the target AP (if available). This fixes the MDIE contents during FT Protocol, but the correct value may not yet be used in initial mobility domain association.
2010-04-09 15:26:20 +02:00
wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
if (md) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: FT mobility domain %02x%02x",
md[0], md[1]);
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
omit_rsnxe = !wpa_bss_get_ie(bss, WLAN_EID_RSNX);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_s->sme.assoc_req_ie_len + 5 <
sizeof(wpa_s->sme.assoc_req_ie)) {
struct rsn_mdie *mdie;
u8 *pos = wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len;
*pos++ = WLAN_EID_MOBILITY_DOMAIN;
*pos++ = sizeof(*mdie);
mdie = (struct rsn_mdie *) pos;
os_memcpy(mdie->mobility_domain, md,
MOBILITY_DOMAIN_ID_LEN);
FT: Set FT Capability and Policy properly in MDIE during initial MD assoc This field needs to be copied from the scan results for the AP per IEEE Std 802.11r-2008, 11A.4.2.
2010-04-09 15:41:57 +02:00
mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len += 5;
}
FT: Do not try to use FT-over-air if reassociation cannot be used There is no point in going through FT authentication if the next step would have to use association exchange which will be rejected by the AP for FT, so only allow FT-over-air if previous BSSID is set, i.e., if reassociation can be used. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-01-04 19:28:56 +01:00
if (wpa_s->sme.prev_bssid_set && wpa_s->sme.ft_used &&
SME: Do not try to use FT over-the-air if PTK is not available
2010-04-10 21:39:49 +02:00
os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
FT: Do not try to use FT protocol between mobility domains wpa_supplicant has support for only a single FT key hierarchy and as such, cannot use more than a single mobility domain at a time. Do not allow FT protocol to be started if there is a request to reassociate to a different BSS within the same ESS if that BSS is in a different mobility domain. This results in the initial mobility domain association being used whenever moving to another mobility domain. While it would be possible to add support for multiple FT key hierachies and multiple mobility domains in theory, there does not yet seem to be sufficient justification to add the complexity needed for that due to limited, if any, deployment of such networks. As such, it is simplest to just prevent these attempts for now and start with a clean initial mobility domain association. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-08 22:43:43 +01:00
wpa_sm_has_ft_keys(wpa_s->wpa, md)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
"over-the-air");
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_FT;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ie = wpa_s->sme.ft_ies;
params.ie_len = wpa_s->sme.ft_ies_len;
}
}
#endif /* CONFIG_IEEE80211R */
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
Allow PMF to be enabled by default Previously, PMF (protected management frames, IEEE 802.11w) could be enabled only with a per-network parameter (ieee80211w). The new global parameter (pmf) can now be used to change the default behavior to be PMF enabled (pmf=1) or required (pmf=2) for network blocks that do not override this with the ieee80211w parameter. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-24 21:21:29 +01:00
if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
struct wpa_ie_data _ie;
if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
_ie.capabilities &
(WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
"MFP: require MFP");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
}
}
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#ifdef CONFIG_P2P
if (wpa_s->global->p2p) {
u8 *pos;
size_t len;
int res;
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
P2P: Set p2p auth/assoc parameter based on connection type Fix the previous code that was hardcoding the p2p parameter based on the driver P2P capability regardless of whether the connection was really used for P2P or not.
2011-07-17 19:52:49 +02:00
res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
ssid->p2p_group);
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
if (res >= 0)
wpa_s->sme.assoc_req_ie_len += res;
}
#endif /* CONFIG_P2P */
FST: Integration into wpa_supplicant This commit integrates the FST into the wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-11-16 16:28:53 +01:00
#ifdef CONFIG_FST
if (wpa_s->fst_ies) {
int fst_ies_len = wpabuf_len(wpa_s->fst_ies);
if (wpa_s->sme.assoc_req_ie_len + fst_ies_len <=
sizeof(wpa_s->sme.assoc_req_ie)) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->fst_ies),
fst_ies_len);
wpa_s->sme.assoc_req_ie_len += fst_ies_len;
}
}
#endif /* CONFIG_FST */
Re-order elements in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, RM Enabled Capabilities element must come before the Extended Capabilities element. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
sme_auth_handle_rrm(wpa_s, bss);
Add an option to remove RRM and supported operating class indication Removing radio measurements and supported operating class indication might be needed to reduce binary size for a memory constrained system that does not need more advanced features. However, removing these is not recommended since they can help the AP manage the network and STA steering. By default this functionality is enabled. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-11-27 20:03:58 +01:00
#ifndef CONFIG_NO_RRM
Remove MBO dependency from Supported Operating Classes element Supported Operating Classes element and its use is define in the IEEE 802.11 standard and can be sent even when MBO is disabled in the build. As such, move this functionality out from the CONFIG_MBO=y only mbo.c. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-02 09:54:39 +01:00
wpa_s->sme.assoc_req_ie_len += wpas_supp_op_class_ie(
Fill the current opclass in (Re)AssocRequest depending on HT/VHT IEs The previous implementation was assuming a fixed 20 MHz channel bandwidth when determining which operating class value to indicate as the Current Operating Class in the Supported Operating Classes element. This is not accurate for many HT/VHT cases. Fix this by determining the current operating class (i.e., the operating class used for the requested association) based on the HT/VHT operation elements from scan results. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-10 07:37:33 +01:00
wpa_s, ssid, bss,
Remove MBO dependency from Supported Operating Classes element Supported Operating Classes element and its use is define in the IEEE 802.11 standard and can be sent even when MBO is disabled in the build. As such, move this functionality out from the CONFIG_MBO=y only mbo.c. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-12-02 09:54:39 +01:00
wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len);
Add an option to remove RRM and supported operating class indication Removing radio measurements and supported operating class indication might be needed to reduce binary size for a memory constrained system that does not need more advanced features. However, removing these is not recommended since they can help the AP manage the network and STA steering. By default this functionality is enabled. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-11-27 20:03:58 +01:00
#endif /* CONFIG_NO_RRM */
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
nl80211: Use extended capabilities per interface type This adds the necessary changes to support extraction and use of the extended capabilities specified per interface type (a recent cfg80211/nl80211 extension). If that information is available, per-interface values will be used to override the global per-radio value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-04-12 10:01:42 +02:00
if (params.p2p)
wpa_drv_get_ext_capa(wpa_s, WPA_IF_P2P_CLIENT);
else
wpa_drv_get_ext_capa(wpa_s, WPA_IF_STATION);
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
Only advertise MSCS and SCS in Association Request if supported by AP Since wpa_supplicant version 2.10 the extended capabilities MSCS and SCS are advertised in the (Re)Association Request frames. This causes the association request to be rejected by several access points. Issue was observed with: - D-Link DIR600 - TP-Link AC1900 - Synology MR2200ac To avoid this issue the extended capabilities MSCS and SCS shall only be added if the bss also supports them. While this may not follow the exact behavior described in IEEE 802.11, this is a reasonable compromise to avoid interoperability issues since these capabilities cannot be used with an AP that does not support them anyway. Note: The Extended Capabilities element is only included in the Association Request frames if the AP also sent its extended capabilities (see wpas_populate_assoc_ies()) as a workaround for misbehaving APs. This workaround exists since version 2.1. Signed-off-by: Sebastian Priebe <sebastian.priebe@konplan.com>
2023-04-26 15:22:02 +02:00
sizeof(ext_capab), bss);
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
if (ext_capab_len > 0) {
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
u8 *pos = wpa_s->sme.assoc_req_ie;
if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
pos += 2 + pos[1];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
os_memmove(pos + ext_capab_len, pos,
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
wpa_s->sme.assoc_req_ie_len -
(pos - wpa_s->sme.assoc_req_ie));
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
wpa_s->sme.assoc_req_ie_len += ext_capab_len;
os_memcpy(pos, ext_capab, ext_capab_len);
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
}
SAE H2E: RSNXE override for testing purposes "SET rsnxe_override_{assoc,eapol} <hexdump>" can now be used to override RSNXE in (Re)Association Request frames and EAPOL-Key msg 2/4 for testing purposes. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-07 11:54:54 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->rsnxe_override_assoc &&
wpabuf_len(wpa_s->rsnxe_override_assoc) <=
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len) {
wpa_printf(MSG_DEBUG, "TESTING: RSNXE AssocReq override");
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->rsnxe_override_assoc),
wpabuf_len(wpa_s->rsnxe_override_assoc));
wpa_s->sme.assoc_req_ie_len +=
wpabuf_len(wpa_s->rsnxe_override_assoc);
} else
#endif /* CONFIG_TESTING_OPTIONS */
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
if (wpa_s->rsnxe_len > 0 &&
wpa_s->rsnxe_len <=
FT: Omit RSNXE from FT protocol Reassociation Request when needed The previous design for adding RSNXE into FT was not backwards compatible. Move to a new design based on 20/332r3 to avoid that issue by not include RSNXE in the FT protocol Reassociation Request frame so that an AP not supporting RSNXE can still validate the FTE MIC correctly. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-03-20 20:45:22 +01:00
sizeof(wpa_s->sme.assoc_req_ie) - wpa_s->sme.assoc_req_ie_len &&
!omit_rsnxe) {
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpa_s->rsnxe, wpa_s->rsnxe_len);
wpa_s->sme.assoc_req_ie_len += wpa_s->rsnxe_len;
}
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
#ifdef CONFIG_HS20
if (is_hs20_network(wpa_s, ssid, bss)) {
struct wpabuf *hs20;
HS 2.0: Add Roaming Consortium Selection element into AssocReq This makes wpa_supplicant add Hotspot 2.0 Roaming Consortium Selection element into (Re)Association Request frames if the network profile includes roaming_consortium_selection parameter. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-17 16:22:56 +02:00
hs20 = wpabuf_alloc(20 + MAX_ROAMING_CONS_OI_LEN);
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
if (hs20) {
int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
size_t len;
HS 2.0: As a STA, do not indicate release number greater than the AP Hotspot 2.0 tech spec mandates mobile device to not indicate a release number that is greater than the release number advertised by the AP. Add this constraint to the HS 2.0 Indication element when adding this into (Re)Association Request frame. The element in the Probe Request frame continues to show the station's latest supported release number. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-12-07 23:51:04 +01:00
wpas_hs20_add_indication(hs20, pps_mo_id,
get_hs20_version(bss));
HS 2.0: Add Roaming Consortium Selection element into AssocReq This makes wpa_supplicant add Hotspot 2.0 Roaming Consortium Selection element into (Re)Association Request frames if the network profile includes roaming_consortium_selection parameter. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-04-17 16:22:56 +02:00
wpas_hs20_add_roam_cons_sel(hs20, ssid);
Move Hotspot 2.0 element in (Re)Association Request frames According to IEEE Std 802.11-2012, Table 8-22, vendor specific elements must follow all other elements, so Hotspot 2.0 element which is actually a vendor specific element must come after all other elements. Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:48 +01:00
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(hs20) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(hs20), wpabuf_len(hs20));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
}
wpabuf_free(hs20);
}
}
#endif /* CONFIG_HS20 */
SME: Fix order of WPA IE in association request In case that the protocol used for association is WPA the WPA IE was inserted before other (non vendor specific) IEs. This is not in accordance to the standard that states that vendor IEs should be placed after all the non vendor IEs are placed. In addition, this would cause the low layers to fail to properly order information elements. To fix this, if the protocol used is WPA, store the WPA IE and reinsert it after all the non vendor specific IEs were placed. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2018-08-23 15:52:32 +02:00
if (wpa_ie) {
size_t len;
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Reinsert WPA IE");
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (len > wpa_ie_len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpa_ie, wpa_ie_len);
wpa_s->sme.assoc_req_ie_len += wpa_ie_len;
} else {
wpa_dbg(wpa_s, MSG_DEBUG, "WPA: Failed to add WPA IE");
}
os_free(wpa_ie);
}
Extend VENDOR_ELEM parameters to cover non-P2P Association Request The new VENDOR_ELEM value 13 can now be used to add a vendor element into all (Re)Association Request frames, not just for P2P use cases like the previous item was for. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-13 23:50:58 +01:00
if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
size_t len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(buf) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(buf), wpabuf_len(buf));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
}
}
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
#ifdef CONFIG_MBO
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
mbo_ie = wpa_bss_get_vendor_ie(bss, MBO_IE_VENDOR_TYPE);
MBO/OCE: Work around misbehaving MBO/OCE APs that use RSN without PMF The MBO and OCE specification require the station to mandate use of PMF when connecting to an MBO/OCE AP that uses WPA2. The earlier implementation prevented such misbehaving APs from being selected for connection completely. This looks like the safest approach to take, but unfortunately, there are deployed APs that are not compliant with the MBO/OCE requirements and this strict interpretation of the station requirements results in interoperability issues by preventing the association completely. Relax the approach by allowing noncompliant MBO/OCE APs to be selected for RSN connection without PMF to avoid the main impact of this interoperability issue. However, disable MBO/OCE functionality when PMF cannot be negotiated to try to be as compliant as practical with the MBO/OCE tech spec requirements (i.e., stop being an MBO/OCE STA for the duration of such workaround association). Also disable support for BTM in this workaround state since MBO would expect all BTM frames to be protected. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-11 12:35:22 +02:00
if (!wpa_s->disable_mbo_oce && mbo_ie) {
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
int len;
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
len = wpas_mbo_ie(wpa_s, wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) -
OCE: Add OCE capability attribute only when associating to an OCE AP Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-08-26 19:45:04 +02:00
wpa_s->sme.assoc_req_ie_len,
!!mbo_attr_from_mbo_ie(mbo_ie,
OCE_ATTR_ID_CAPA_IND));
MBO: Add Supported Operating Classes element to Association Request Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2016-02-15 15:53:34 +01:00
if (len >= 0)
wpa_s->sme.assoc_req_ie_len += len;
MBO: Implement MBO non-preferred channel report in Association Request Add MBO IE with non-preferred channels to (Re)Association Request frames. Signed-off-by: David Spinadel <david.spinadel@intel.com>
2016-02-15 15:53:24 +01:00
}
#endif /* CONFIG_MBO */
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
pmksa_cache_set_current(wpa_s->wpa, NULL,
params.mld ? params.ap_mld_addr :
bss->bssid,
ssid, 0,
SAE: Fix PMKSA cache entry search for FT-SAE case Previously, PMKSA cache entries were search for AKM=SAE and that did not find an entry that was created with FT-SAE when trying to use FT-SAE again. That resulted in having to use full SAE authentication instead of the faster PMKSA caching alternative. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-27 03:03:12 +01:00
NULL,
SAE: Internal WPA_KEY_MGMT_* defines for extended key AKMs Define new WPA_KEY_MGMT_* values for the new SAE AKM suite selectors with variable length keys. This includes updates to various mapping and checking of the SAE key_mgmt values. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-24 21:05:37 +02:00
wpa_key_mgmt_sae(wpa_s->key_mgmt) ?
wpa_s->key_mgmt :
SAE: Do not reject reauth threshold passed PMKSA in association event Do not reject reauth threshold passed PMKSA indicated in successful association event since the PMKSA is still valid. Additionally, remove the reauth threshold passed PMKSA entry from the driver to prevent using it further in the driver. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-09-27 06:55:34 +02:00
(int) WPA_KEY_MGMT_SAE, false) == 0) {
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
SAE: Fix default PMK configuration for PMKSA caching case The RSN supplicant state machine PMK was set based on WPA PSK even for the cases where SAE would be used. If the AP allows PMKSA caching to be used with SAE, but does not indicate the selected PMKID explicitly in EAPOL-Key msg 1/4, this could result in trying to use the PSK instead of SAE PMK. Fix this by not setting the WPA-PSK as default PMK for SAE network profiles and instead, configuring the PMK explicitly from the found PMKSA cache entry. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 18:55:52 +02:00
wpa_sm_set_pmk_from_pmksa(wpa_s->wpa);
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
params.auth_alg = WPA_AUTH_ALG_OPEN;
wpa_s->sme.sae_pmksa_caching = 1;
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (start)
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
resp = sme_auth_build_sae_commit(wpa_s, ssid,
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
bss->bssid,
params.mld ?
params.ap_mld_addr :
NULL, 0,
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
start == 2, NULL,
NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
else
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
resp = sme_auth_build_sae_confirm(wpa_s, 0);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (resp == NULL) {
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, bss->bssid, NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
}
Rename sae_data to more generic auth_data This makes it cleaner for the FILS implementation to use the same design for setting Authentication frame elements as was already done with SAE. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 16:11:11 +02:00
params.auth_data = wpabuf_head(resp);
params.auth_data_len = wpabuf_len(resp);
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
SME: Postpone current BSSID clearing until IEs are prepared sme_send_authentication() could fail before actually requesting the driver to authenticate with a new AP. This could happen after wpa_s->bssid got cleared even though in such a case, the old association is maintained and still valid. This can result in unexpected behavior since wpa_s->bssid would not match the current BSSID anymore. Fix this by postponing clearing of wpa_s->bssid until the IE preparation has been completed successfully. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-01-03 17:06:01 +01:00
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
old_ssid = wpa_s->current_ssid;
wpa_s->current_ssid = ssid;
wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
wpa_supplicant_initiate_eapol(wpa_s);
#ifdef CONFIG_FILS
/* TODO: FILS operations can in some cases be done between different
* network_ctx (i.e., same credentials can be used with multiple
* networks). */
if (params.auth_alg == WPA_AUTH_ALG_OPEN &&
wpa_key_mgmt_fils(ssid->key_mgmt)) {
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
const u8 *indic;
u16 fils_info;
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
const u8 *realm, *username, *rrk;
size_t realm_len, username_len, rrk_len;
u16 next_seq_num;
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
/*
* Check FILS Indication element (FILS Information field) bits
* indicating supported authentication algorithms against local
* configuration (ssid->fils_dh_group). Try to use FILS
* authentication only if the AP supports the combination in the
* network profile. */
indic = wpa_bss_get_ie(bss, WLAN_EID_FILS_INDICATION);
if (!indic || indic[1] < 2) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not include FILS Indication element - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
fils_info = WPA_GET_LE16(indic + 2);
if (ssid->fils_dh_group == 0 && !(fils_info & BIT(9))) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not support FILS SK without PFS - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
if (ssid->fils_dh_group != 0 && !(fils_info & BIT(10))) {
wpa_printf(MSG_DEBUG, "SME: " MACSTR
" does not support FILS SK with PFS - cannot use FILS authentication with it",
MAC2STR(bss->bssid));
goto no_fils;
}
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
if (wpa_s->last_con_fail_realm &&
eapol_sm_get_erp_info(wpa_s->eapol, &ssid->eap,
&username, &username_len,
&realm, &realm_len, &next_seq_num,
&rrk, &rrk_len) == 0 &&
realm && realm_len == wpa_s->last_con_fail_realm_len &&
os_memcmp(realm, wpa_s->last_con_fail_realm,
realm_len) == 0) {
wpa_printf(MSG_DEBUG,
"SME: FILS authentication for this realm failed last time - try to regenerate ERP key hierarchy");
goto no_fils;
}
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
if (pmksa_cache_set_current(wpa_s->wpa, NULL,
params.mld ? params.ap_mld_addr :
bss->bssid,
FILS: Use FILS Cache Identifier to extend PMKSA applicability This allows PMKSA cache entries for FILS-enabled BSSs to be shared within an ESS when the BSSs advertise the same FILS Cache Identifier value. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:22:19 +01:00
ssid, 0,
SAE: Only allow SAE AKMP for PMKSA caching attempts Explicitly check the PMKSA cache entry to have matching SAE AKMP for the case where determining whether to use PMKSA caching instead of new SAE authentication. Previously, only the network context was checked, but a single network configuration profile could be used with both WPA2-PSK and SAE, so should check the AKMP as well. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-04-08 19:06:40 +02:00
wpa_bss_get_fils_cache_id(bss),
SAE: Do not reject reauth threshold passed PMKSA in association event Do not reject reauth threshold passed PMKSA indicated in successful association event since the PMKSA is still valid. Additionally, remove the reauth threshold passed PMKSA entry from the driver to prevent using it further in the driver. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-09-27 06:55:34 +02:00
0, false) == 0)
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS with PMKSA caching");
FILS: Add MDE into Authentication frame for FILS+FT When using FILS for FT initial mobility domain association, add MDE to the Authentication frame from the STA to indicate this special case for FILS authentication. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-04-02 12:22:52 +02:00
resp = fils_build_auth(wpa_s->wpa, ssid->fils_dh_group, md);
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
if (resp) {
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
int auth_alg;
if (ssid->fils_dh_group)
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS SK authentication with PFS (DH Group %u)",
ssid->fils_dh_group);
else
wpa_printf(MSG_DEBUG,
"SME: Try to use FILS SK authentication without PFS");
auth_alg = ssid->fils_dh_group ?
WPA_AUTH_ALG_FILS_SK_PFS : WPA_AUTH_ALG_FILS;
params.auth_alg = auth_alg;
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
params.auth_data = wpabuf_head(resp);
params.auth_data_len = wpabuf_len(resp);
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
wpa_s->sme.auth_alg = auth_alg;
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
}
}
FILS: Check FILS Indication element against local network profile Do not try to use FILS authentication unless the AP indicates support for the type the local network profile enforces. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:59:52 +01:00
no_fils:
FILS: Try to use FILS authentication if PMKSA or ERP entry is available If a PMKSA cache entry for the target AP is available, try to use FILS with PMKSA caching. If an ERP key for the target AP is available, try to use FILS with EAP-Initiate/Re-auth added as Wrapper Data element. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-04 14:32:07 +02:00
#endif /* CONFIG_FILS */
Use sched_scan in driver init This patch uses sched_scan, if available, when the driver is initialized. It also adds a couple of cancel operations where appropriate. Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-09-27 21:21:31 +02:00
wpa_supplicant_cancel_sched_scan(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_cancel_scan(wpa_s);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
EAPOL supp: Convert Boolean to C99 bool Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-04-23 23:51:11 +02:00
eapol_sm_notify_portValid(wpa_s->eapol, false);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_clear_keys(wpa_s, bss->bssid);
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (old_ssid != wpa_s->current_ssid)
wpas_notify_network_changed(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
HS 2.0: Add support for configuring frame filters When a station starts an association to a Hotspot 2.0 network, request the driver to do the following, based on the BSS capabilities: 1. Enable gratuitous ARP filtering 2. Enable unsolicited Neighbor Advertisement filtering 3. Enable unicast IP packet encrypted with GTK filtering if DGAF disabled bit is zero Clear the filter configuration when the station interface is disassociated. Signed-off-by: Matti Gottlieb <matti.gottlieb@intel.com>
2016-04-06 16:14:41 +02:00
#ifdef CONFIG_HS20
hs20_configure_frame_filters(wpa_s);
#endif /* CONFIG_HS20 */
wpa_supplicant: Call frequency conflict handling during auth Previously, the frequency conflict was handled only during the association flow. However, some drivers, e.g., mac80211 based drivers, will fail an authentication request in case that there are no available channels for use (as they might be used by other interfaces), and thus the frequency conflict resolution is never called. Fix this by calling frequency conflict resolution during authentication (SME-in-wpa_supplicant) as well. In addition, get the shared radio frequency from the wpa_s context in both the SME-in-driver and SME-in-wpa_supplicant cases and not from the driver. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-04-24 07:45:40 +02:00
#ifdef CONFIG_P2P
/*
* If multi-channel concurrency is not supported, check for any
* frequency conflict. In case of any frequency conflict, remove the
* least prioritized connection.
*/
if (wpa_s->num_multichan_concurrent < 2) {
int freq, num;
P2P: Discount current operating frequency when scanning new connection When scanning for a new connection, we currently optimize by scanning all frequencies only when our MCC capabilities will allow an additional operating frequency, and scan only the existing operating frequencies otherwise. This is problematic when there the current operating frequency singularly accounts for one of the shared radio frequencies because we should be able to switch operating frequencies without adding to the channel count. Fix this. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2022-11-04 22:18:02 +01:00
num = get_shared_radio_freqs(wpa_s, &freq, 1, false);
wpa_supplicant: Call frequency conflict handling during auth Previously, the frequency conflict was handled only during the association flow. However, some drivers, e.g., mac80211 based drivers, will fail an authentication request in case that there are no available channels for use (as they might be used by other interfaces), and thus the frequency conflict resolution is never called. Fix this by calling frequency conflict resolution during authentication (SME-in-wpa_supplicant) as well. In addition, get the shared radio frequency from the wpa_s context in both the SME-in-driver and SME-in-wpa_supplicant cases and not from the driver. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-04-24 07:45:40 +02:00
if (num > 0 && freq > 0 && freq != params.freq) {
wpa_printf(MSG_DEBUG,
"Conflicting frequency found (%d != %d)",
freq, params.freq);
if (wpas_p2p_handle_frequency_conflicts(wpa_s,
params.freq,
ssid) < 0) {
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, bss->bssid, NULL);
wpa_supplicant: Call frequency conflict handling during auth Previously, the frequency conflict was handled only during the association flow. However, some drivers, e.g., mac80211 based drivers, will fail an authentication request in case that there are no available channels for use (as they might be used by other interfaces), and thus the frequency conflict resolution is never called. Fix this by calling frequency conflict resolution during authentication (SME-in-wpa_supplicant) as well. In addition, get the shared radio frequency from the wpa_s context in both the SME-in-driver and SME-in-wpa_supplicant cases and not from the driver. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-04-24 07:45:40 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
wpabuf_free(resp);
wpas_connect_work_done(wpa_s);
return;
}
}
}
#endif /* CONFIG_P2P */
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (skip_auth) {
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Skip authentication step on reassoc-to-same-BSS");
wpabuf_free(resp);
sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
return;
}
FT: Process reassoc resp FT IEs when using wpa_supplicant SME
2010-03-13 20:13:18 +01:00
wpa_s->sme.auth_alg = params.auth_alg;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_authenticate(wpa_s, &params) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
"driver failed");
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, bss->bssid, NULL);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
NULL);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* Association will be started based on the authentication event from
* the driver.
*/
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
}
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
{
struct wpa_connect_work *cwork = work->ctx;
struct wpa_supplicant *wpa_s = work->wpa_s;
Reject authentication start during explicit roam requests The roam D-Bus and ROAM control itnerface commands flip the reassociate bit before calling wpa_supplicant_connect(). wpa_supplicant connect eventually aborts ongoing scans (if any), which causes scan results to be reported. Since the reassociate bit is set, this will trigger a connection attempt based on the aborted scan's scan results and cancel the initial connetion request. This often causes wpa_supplicant to reassociate to the same AP it is currently associated to instead of the explicitly requested roaming target. Add a roam_in_progress flag to indicate that we're currently attempting to roam via an explicitly request to a specific BSS so that we don't initiate another connection attempt based on the possibly received scan results from a scan that was in progress at the time the roam command was received. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 02:43:44 +01:00
wpa_s->roam_in_progress = false;
Reject authentication start during BSS TM requests After receiving a BSS Transition Management request, wpa_supplicant_connect() will abort ongoing scans, which will cause scan results to be reported. Since the reassociate bit is set, this will trigger a connection attempt based on the aborted scan's scan results and cancel the initial connection request. This often causes wpa_supplicant to reassociate to the same AP it is currently associated to instead of the AP it was asked to transition to. Add a bss_trans_mgmt_in_progress flag to indicate that we're currently transitioning to a different AP so that we don't initiate another connection attempt based on the possibly received scan results from a scan that was in progress at the time the BSS Transition Management request was received. This is the equivalent of commit 5ac977758d35 ("Reject authentication start during explicit roam requests") for the roaming scenario. Signed-off-by: Nicolas Norvez <norvez@chromium.org>
2022-01-05 02:35:13 +01:00
#ifdef CONFIG_WNM
wpa_s->bss_trans_mgmt_in_progress = false;
#endif /* CONFIG_WNM */
Reject authentication start during explicit roam requests The roam D-Bus and ROAM control itnerface commands flip the reassociate bit before calling wpa_supplicant_connect(). wpa_supplicant connect eventually aborts ongoing scans (if any), which causes scan results to be reported. Since the reassociate bit is set, this will trigger a connection attempt based on the aborted scan's scan results and cancel the initial connetion request. This often causes wpa_supplicant to reassociate to the same AP it is currently associated to instead of the explicitly requested roaming target. Add a roam_in_progress flag to indicate that we're currently attempting to roam via an explicitly request to a specific BSS so that we don't initiate another connection attempt based on the possibly received scan results from a scan that was in progress at the time the roam command was received. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 02:43:44 +01:00
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (deinit) {
wpa_supplicant: Complete radio works on disable event While testing rfkill blocking of a scanning interface, it was seen that the ongoing scan never completes. This happens since EVENT_SCAN_RESULTS is discarded on a disabled interface. Fix this and also other possible radio work completion issues by removing all the radio works (including started) of the disabled interface. To be able to remove already started radio works, make their callbacks be reentrant with deinit flag (when the work is started), so each radio work should be able to handle its own termination. Signed-hostap: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-02-13 10:24:00 +01:00
if (work->started)
wpa_s->connect_work = NULL;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_free(cwork);
return;
}
wpa_s->connect_work = work;
Update pending connect radio work BSS pointer on scan update It is possible for scan result processing or BSS entry removal to occur while there is a pending connect or sme-connect radio work with a previously selected BSS entry. The BSS pointer was previously verified to be valid, i.e., still point to a BSS entry, at the time the actual connection operation is started. However, that BSS entry could have changed to point to another BSS if the old BSS entry was either removed or reallocated and a new BSS entry was added at the same location in memory. This could result in the connection attempt failing to configure parameters properly due to different BSS information (e.g., different BSSID). Fix this by updated the pending connect radio work data on BSS entry updates similarly to how the last_scan_res array was updated. If the selected BSS entry is removed, this will still result in a failed connection, but reallocated BSS entry is now followed properly and used when the connection work starts. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-10-27 23:19:24 +01:00
if (cwork->bss_removed ||
Drop connection attempt if network is disabled before radio work starts With the radio work design, it is possible for a network entry to get disabled (e.g., DISABLE_NETWORK <id>) during the time the connect or sme-connect radio work waits to start. Previously, only the validity of the BSS entry and BSSID/SSID was verified when starting the actual connection step. Add call to wpas_network_disabled() to those checks to catch the case where the network profile is disabled. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-10 21:12:59 +02:00
!wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid) ||
wpas_network_disabled(wpa_s, cwork->ssid)) {
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
wpas_connect_work_done(wpa_s);
return;
}
SME: Clear possibly used WPA/RSN IE for new connection This was already done in the case SME in the driver is used, but the SME code path was resetting the local WPA/RSN IE only for association. While that was fine for existing use cases, FILS needs a new RSN IE to be set for PMKSA caching case in Authentication frames, so clear the local IE before starting new authentication. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 21:48:25 +02:00
/* Starting new connection, so clear the possibly used WPA IE from the
* previous association. */
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
wpa_s->rsnxe_len = 0;
SME: Clear possibly used WPA/RSN IE for new connection This was already done in the case SME in the driver is used, but the SME code path was resetting the local WPA/RSN IE only for association. While that was fine for existing use cases, FILS needs a new RSN IE to be set for PMKSA caching case in Authentication frames, so clear the local IE before starting new authentication. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2016-10-22 21:48:25 +02:00
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
dbus: Add dbus notify when wpa_s->key_mgmt changes For WPA2/WPA3 authentication mode, wpa_supplicant needs to notify CurrentAuthMode property change when wpa_s->key_mgmt changes, so NetworkManager can judge whether it needs to request a password based on this. Call wpas_notify_auth_changed() when starting a new connection item, i.e., after having updated wpa_s->key_mgmt. Signed-off-by: xinpeng wang <wangxinpeng@uniontech.com>
2022-07-28 10:19:42 +02:00
wpas_notify_auth_changed(wpa_s);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
void sme_authenticate(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid)
{
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
struct wpa_connect_work *cwork;
if (bss == NULL || ssid == NULL)
return;
if (wpa_s->connect_work) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
return;
}
Reject authentication start during explicit roam requests The roam D-Bus and ROAM control itnerface commands flip the reassociate bit before calling wpa_supplicant_connect(). wpa_supplicant connect eventually aborts ongoing scans (if any), which causes scan results to be reported. Since the reassociate bit is set, this will trigger a connection attempt based on the aborted scan's scan results and cancel the initial connetion request. This often causes wpa_supplicant to reassociate to the same AP it is currently associated to instead of the explicitly requested roaming target. Add a roam_in_progress flag to indicate that we're currently attempting to roam via an explicitly request to a specific BSS so that we don't initiate another connection attempt based on the possibly received scan results from a scan that was in progress at the time the roam command was received. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 02:43:44 +01:00
if (wpa_s->roam_in_progress) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Reject sme_authenticate() in favor of explicit roam request");
return;
}
Reject authentication start during BSS TM requests After receiving a BSS Transition Management request, wpa_supplicant_connect() will abort ongoing scans, which will cause scan results to be reported. Since the reassociate bit is set, this will trigger a connection attempt based on the aborted scan's scan results and cancel the initial connection request. This often causes wpa_supplicant to reassociate to the same AP it is currently associated to instead of the AP it was asked to transition to. Add a bss_trans_mgmt_in_progress flag to indicate that we're currently transitioning to a different AP so that we don't initiate another connection attempt based on the possibly received scan results from a scan that was in progress at the time the BSS Transition Management request was received. This is the equivalent of commit 5ac977758d35 ("Reject authentication start during explicit roam requests") for the roaming scenario. Signed-off-by: Nicolas Norvez <norvez@chromium.org>
2022-01-05 02:35:13 +01:00
#ifdef CONFIG_WNM
if (wpa_s->bss_trans_mgmt_in_progress) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Reject sme_authenticate() in favor of BSS transition management request");
return;
}
#endif /* CONFIG_WNM */
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
if (radio_work_pending(wpa_s, "sme-connect")) {
wpa_supplicant: Remove pending sme-connect radio work If a new connection is attempted while there is a pending sme-connection radio work, cancel the pending radio work and continue with the new connection attempt. This is preferable over rejecting the new work and continuing with the pending one, as it is possible that the previous work is no longer valid. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-03-27 07:58:33 +01:00
/*
* The previous sme-connect work might no longer be valid due to
* the fact that the BSS list was updated. In addition, it makes
* sense to adhere to the 'newer' decision.
*/
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Remove previous pending sme-connect");
radio_remove_works(wpa_s, "sme-connect", 0);
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
}
Abort an ongoing scan before connect Connect radio work is sometimes delayed for a considerable duration if there is an ongoing scan radio work. To avoid these delays abort the ongoing scan on that interface before queuing a connect request. Upon a scan done indication from the driver, connect radio work will be scheduled. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-10-19 16:00:34 +02:00
wpas_abort_ongoing_scan(wpa_s);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
cwork = os_zalloc(sizeof(*cwork));
if (cwork == NULL)
return;
cwork->bss = bss;
cwork->ssid = ssid;
cwork->sme = 1;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#ifdef CONFIG_SAE
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_NOTHING;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
wpa_s->sme.sae.send_confirm = 0;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
wpa_s->sme.sae_group_index = 0;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#endif /* CONFIG_SAE */
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
sme_auth_start_cb, cwork) < 0)
wpas_connect_work_free(cwork);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
#define WPA_AUTH_FRAME_ML_IE_LEN (6 + ETH_ALEN)
static void wpa_auth_ml_ie(struct wpabuf *buf, const u8 *mld_addr)
{
wpabuf_put_u8(buf, WLAN_EID_EXTENSION);
wpabuf_put_u8(buf, 4 + ETH_ALEN);
wpabuf_put_u8(buf, WLAN_EID_EXT_MULTI_LINK);
/* Basic Multi-Link element Control field */
wpabuf_put_u8(buf, 0x0);
wpabuf_put_u8(buf, 0x0);
/* Common Info */
wpabuf_put_u8(buf, 0x7); /* length = Length field + MLD MAC address */
wpabuf_put_data(buf, mld_addr, ETH_ALEN);
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
static int sme_external_auth_build_buf(struct wpabuf *buf,
struct wpabuf *params,
const u8 *sa, const u8 *da,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
u16 auth_transaction, u16 seq_num,
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
u16 status_code, const u8 *mld_addr)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct ieee80211_mgmt *resp;
resp = wpabuf_put(buf, offsetof(struct ieee80211_mgmt,
u.auth.variable));
resp->frame_control = host_to_le16((WLAN_FC_TYPE_MGMT << 2) |
(WLAN_FC_STYPE_AUTH << 4));
os_memcpy(resp->da, da, ETH_ALEN);
os_memcpy(resp->sa, sa, ETH_ALEN);
os_memcpy(resp->bssid, da, ETH_ALEN);
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
resp->u.auth.auth_alg = host_to_le16(WLAN_AUTH_SAE);
resp->seq_ctrl = host_to_le16(seq_num << 4);
resp->u.auth.auth_transaction = host_to_le16(auth_transaction);
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
resp->u.auth.status_code = host_to_le16(status_code);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (params)
wpabuf_put_buf(buf, params);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (mld_addr)
wpa_auth_ml_ie(buf, mld_addr);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
return 0;
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
static int sme_external_auth_send_sae_commit(struct wpa_supplicant *wpa_s,
const u8 *bssid,
struct wpa_ssid *ssid)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct wpabuf *resp, *buf;
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
int use_pt;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
bool use_pk;
u16 status;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
resp = sme_auth_build_sae_commit(wpa_s, ssid, bssid,
wpa_s->sme.ext_ml_auth ?
wpa_s->sme.ext_auth_ap_mld_addr : NULL,
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
1, 0, &use_pt, &use_pk);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (!resp) {
wpa_printf(MSG_DEBUG, "SAE: Failed to build SAE commit");
return -1;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->sme.sae.state = SAE_COMMITTED;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + wpabuf_len(resp) +
(wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
0));
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!buf) {
wpabuf_free(resp);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
return -1;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
wpa_s->sme.seq_num++;
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
if (use_pk)
status = WLAN_STATUS_SAE_PK;
else if (use_pt)
status = WLAN_STATUS_SAE_HASH_TO_ELEMENT;
else
status = WLAN_STATUS_SUCCESS;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
wpa_s->sme.ext_ml_auth ?
wpa_s->sme.ext_auth_ap_mld_addr : bssid, 1,
wpa_s->sme.seq_num, status,
wpa_s->sme.ext_ml_auth ?
wpa_s->own_addr : NULL);
driver: Extend send_mlme() with wait option PASN authentication can be performed while a station interface is connected to an AP. To allow sending PASN frames while connected, extend the send_mlme() driver callback to also allow a wait option. Update the relevant drivers and wpa_supplicant accordingly. hostapd calls for send_mlme() are left unchanged, since the wait option is not required there. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:27 +01:00
wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpabuf_free(resp);
wpabuf_free(buf);
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
return 0;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
static void sme_send_external_auth_status(struct wpa_supplicant *wpa_s,
u16 status)
{
struct external_auth params;
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
wpa_s->sme.ext_auth_wpa_ssid = NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
os_memset(&params, 0, sizeof(params));
params.status = status;
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
params.ssid = wpa_s->sme.ext_auth_ssid;
params.ssid_len = wpa_s->sme.ext_auth_ssid_len;
params.bssid = wpa_s->sme.ext_auth_bssid;
SAE: Conditionally set PMKID while notifying the external auth status This is needed for the drivers implementing SME to include the PMKID in the Association Request frame directly following SAE authentication. This commit extends the commit d2b208384391 ("SAE: Allow PMKID to be added into Association Request frame following SAE") for drivers with internal SME that use the external authentication mechanism. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:18:45 +02:00
if (wpa_s->conf->sae_pmkid_in_assoc && status == WLAN_STATUS_SUCCESS)
params.pmkid = wpa_s->sme.sae.pmkid;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_drv_send_external_auth_status(wpa_s, &params);
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
static int sme_handle_external_auth_start(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
{
struct wpa_ssid *ssid;
size_t ssid_str_len = data->external_auth.ssid_len;
Remove unnecessary copying of SSID and BSSID for external_auth The external authentication command and event does not need to copy the BSSID/SSID values into struct external_auth since those values are used before returning from the call. Simplify this by using const u8 * to external data instead of the array with a copy of the external data. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-04-12 19:38:08 +02:00
const u8 *ssid_str = data->external_auth.ssid;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
wpa_s->sme.ext_auth_wpa_ssid = NULL;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
/* Get the SSID conf from the ssid string obtained */
for (ssid = wpa_s->conf->ssid; ssid; ssid = ssid->next) {
if (!wpas_network_disabled(wpa_s, ssid) &&
ssid_str_len == ssid->ssid_len &&
external-auth: Check key_mgmt when selecting SSID When selecting SSID to start external authentication procedure also check the key_mgmt field as several network configuration may be defined for the same SSID/BSSID pair. The external authentication mechanism is only available for SAE. Signed-off-by: Cedric Izoard <cedric.izoard@ceva-dsp.com>
2018-11-26 12:47:37 +01:00
os_memcmp(ssid_str, ssid->ssid, ssid_str_len) == 0 &&
SAE: Include the new -EXT-KEY AKMs in external auth case Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-09-13 04:12:03 +02:00
wpa_key_mgmt_sae(ssid->key_mgmt)) {
SAE: Make sure H2E PT is derived for external auth SSID profile The driver's SME may choose a BSS of a different ESS (SSID) compared to the current SSID and trigger external authentication. If the chosen SSID is not associated/selected before by wpa_supplicant it won't have the H2E PT derived. Make sure to derive PT for SSID indicated in the external authentication request. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 12:18:53 +02:00
/* Make sure PT is derived */
SAE: Update PT value at later point for SME cases, if needed It was possible to hit a case where the SAE PT had not yet been derived, e.g., when using P2P group re-invocation. Update PT use at the time authentication is started, if needed, to avoid this. While this is not really ideal from the externally observable timing view point, this is done only for the case where there is no other option available with a dynamically changing network configuration for P2P. Similar design was already in place for the SAE offload-from-driver (external auth) case. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-01-30 22:09:53 +01:00
wpa_s_setup_sae_pt(wpa_s->conf, ssid, false);
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
wpa_s->sme.ext_auth_wpa_ssid = ssid;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
break;
SAE: Make sure H2E PT is derived for external auth SSID profile The driver's SME may choose a BSS of a different ESS (SSID) compared to the current SSID and trigger external authentication. If the chosen SSID is not associated/selected before by wpa_supplicant it won't have the H2E PT derived. Make sure to derive PT for SSID indicated in the external authentication request. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 12:18:53 +02:00
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (!ssid ||
sme_external_auth_send_sae_commit(wpa_s, data->external_auth.bssid,
ssid) < 0)
return -1;
return 0;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
static void sme_external_auth_send_sae_confirm(struct wpa_supplicant *wpa_s,
const u8 *da)
{
struct wpabuf *resp, *buf;
resp = sme_auth_build_sae_confirm(wpa_s, 1);
if (!resp) {
wpa_printf(MSG_DEBUG, "SAE: Confirm message buf alloc failure");
return;
}
wpa_s->sme.sae.state = SAE_CONFIRMED;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN + wpabuf_len(resp) +
(wpa_s->sme.ext_ml_auth ? WPA_AUTH_FRAME_ML_IE_LEN :
0));
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (!buf) {
wpa_printf(MSG_DEBUG, "SAE: Auth Confirm buf alloc failure");
wpabuf_free(resp);
return;
}
wpa_s->sme.seq_num++;
sme_external_auth_build_buf(buf, resp, wpa_s->own_addr,
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
da, 2, wpa_s->sme.seq_num,
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
WLAN_STATUS_SUCCESS,
wpa_s->sme.ext_ml_auth ?
wpa_s->own_addr : NULL);
driver: Extend send_mlme() with wait option PASN authentication can be performed while a station interface is connected to an AP. To allow sending PASN frames while connected, extend the send_mlme() driver callback to also allow a wait option. Update the relevant drivers and wpa_supplicant accordingly. hostapd calls for send_mlme() are left unchanged, since the wait option is not required there. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2020-02-24 10:14:27 +01:00
wpa_drv_send_mlme(wpa_s, wpabuf_head(buf), wpabuf_len(buf), 1, 0, 0);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpabuf_free(resp);
wpabuf_free(buf);
}
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
static bool is_sae_key_mgmt_suite(struct wpa_supplicant *wpa_s, u32 suite)
SAE: Fix AKM suite selector check for external authentication AKM suite selector check was initially implemented with incorrect byte swapping of the value from the driver (nl80211). Fix this and leave a workaround option for any potentially deployed device where the driver might be using the swapped byte order. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:25:11 +02:00
{
/* suite is supposed to be the selector value in host byte order with
* the OUI in three most significant octets. However, the initial
* implementation swapped that byte order and did not work with drivers
* that followed the expected byte order. Keep a workaround here to
* match that initial implementation so that already deployed use cases
* remain functional. */
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
if (RSN_SELECTOR_GET(&suite) == RSN_AUTH_KEY_MGMT_SAE) {
/* Old drivers which follow initial implementation send SAE AKM
* for both SAE and FT-SAE connections. In that case, determine
* the actual AKM from wpa_s->key_mgmt. */
wpa_s->sme.ext_auth_key_mgmt = wpa_s->key_mgmt;
SAE: Fix AKM suite selector check for external authentication AKM suite selector check was initially implemented with incorrect byte swapping of the value from the driver (nl80211). Fix this and leave a workaround option for any potentially deployed device where the driver might be using the swapped byte order. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:25:11 +02:00
return true;
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
}
if (suite == RSN_AUTH_KEY_MGMT_SAE)
wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE;
else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE)
wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE;
else if (suite == RSN_AUTH_KEY_MGMT_SAE_EXT_KEY)
wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_SAE_EXT_KEY;
else if (suite == RSN_AUTH_KEY_MGMT_FT_SAE_EXT_KEY)
wpa_s->sme.ext_auth_key_mgmt = WPA_KEY_MGMT_FT_SAE_EXT_KEY;
else
return false;
SAE: Fix AKM suite selector check for external authentication AKM suite selector check was initially implemented with incorrect byte swapping of the value from the driver (nl80211). Fix this and leave a workaround option for any potentially deployed device where the driver might be using the swapped byte order. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:25:11 +02:00
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
return true;
SAE: Fix AKM suite selector check for external authentication AKM suite selector check was initially implemented with incorrect byte swapping of the value from the driver (nl80211). Fix this and leave a workaround option for any potentially deployed device where the driver might be using the swapped byte order. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-16 17:25:11 +02:00
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
void sme_external_auth_trigger(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
if (!is_sae_key_mgmt_suite(wpa_s, data->external_auth.key_mgmt_suite))
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
return;
if (data->external_auth.action == EXT_AUTH_START) {
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
if (!data->external_auth.bssid || !data->external_auth.ssid)
return;
os_memcpy(wpa_s->sme.ext_auth_bssid, data->external_auth.bssid,
ETH_ALEN);
os_memcpy(wpa_s->sme.ext_auth_ssid, data->external_auth.ssid,
data->external_auth.ssid_len);
wpa_s->sme.ext_auth_ssid_len = data->external_auth.ssid_len;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (data->external_auth.mld_addr) {
wpa_s->sme.ext_ml_auth = true;
os_memcpy(wpa_s->sme.ext_auth_ap_mld_addr,
data->external_auth.mld_addr, ETH_ALEN);
} else {
wpa_s->sme.ext_ml_auth = false;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
wpa_s->sme.seq_num = 0;
wpa_s->sme.sae.state = SAE_NOTHING;
wpa_s->sme.sae.send_confirm = 0;
wpa_s->sme.sae_group_index = 0;
SAE: Send external auth failure status to driver wpa_supplicant prepares auth commit request as part of the external authentication (first SAE authentication frame), but it fails to get prepared when wpa_supplicant is started without mentioning the SAE password in configuration. Send this failure status to the driver to make it aware that the external authentication has been aborted by wpa_supplicant. Signed-off-by: Srinivas Dasari <dasaris@codeaurora.org>
2019-05-16 11:21:36 +02:00
if (sme_handle_external_auth_start(wpa_s, data) < 0)
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
} else if (data->external_auth.action == EXT_AUTH_ABORT) {
/* Report failure to driver for the wrong trigger */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
}
}
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
static int sme_sae_is_group_enabled(struct wpa_supplicant *wpa_s, int group)
{
int *groups = wpa_s->conf->sae_groups;
int default_groups[] = { 19, 20, 21, 0 };
int i;
if (!groups)
groups = default_groups;
for (i = 0; groups[i] > 0; i++) {
if (groups[i] == group)
return 1;
}
return 0;
}
static int sme_check_sae_rejected_groups(struct wpa_supplicant *wpa_s,
const struct wpabuf *groups)
{
size_t i, count;
const u8 *pos;
if (!groups)
return 0;
pos = wpabuf_head(groups);
count = wpabuf_len(groups) / 2;
for (i = 0; i < count; i++) {
int enabled;
u16 group;
group = WPA_GET_LE16(pos);
pos += 2;
enabled = sme_sae_is_group_enabled(wpa_s, group);
wpa_printf(MSG_DEBUG, "SAE: Rejected group %u is %s",
group, enabled ? "enabled" : "disabled");
if (enabled)
return 1;
}
return 0;
}
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
static int sme_external_ml_auth(struct wpa_supplicant *wpa_s,
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
const u8 *data, size_t len, int ie_offset,
u16 status_code)
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
{
struct ieee802_11_elems elems;
const u8 *mld_addr;
if (ieee802_11_parse_elems(data + ie_offset, len - ie_offset,
MLD STA: Do not fail on unknown IEs in Authentication frames Fail MLD address validation only if Authentication frames IE parsing actually failed, i.e., ignore all unknown IEs. This is needed to avoid authentication failure when the Authentication frames include IEs which are not handled by ieee802_11_parse_elems(), e.g., AKM Suite Selector IE. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-04-13 00:21:15 +02:00
&elems, 0) == ParseFailed) {
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
wpa_printf(MSG_DEBUG, "MLD: Failed parsing elements");
return -1;
}
if (!elems.basic_mle || !elems.basic_mle_len) {
wpa_printf(MSG_DEBUG, "MLD: No ML element in authentication");
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
if (status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ ||
status_code == WLAN_STATUS_SUCCESS ||
status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
status_code == WLAN_STATUS_SAE_PK)
return -1;
/* Accept missing Multi-Link element in failed authentication
* cases. */
return 0;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
}
mld_addr = get_basic_mle_mld_addr(elems.basic_mle, elems.basic_mle_len);
if (!mld_addr) {
wpa_printf(MSG_DEBUG, "MLD: No MLD address in ML element");
return -1;
}
wpa_printf(MSG_DEBUG, "MLD: mld_address=" MACSTR, MAC2STR(mld_addr));
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(wpa_s->sme.ext_auth_ap_mld_addr, mld_addr)) {
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
wpa_printf(MSG_DEBUG, "MLD: Unexpected MLD address (expected "
SAE: Fix expected AP MLD address info in a debug print Print correct expected AP MLD address information when the AP MLD address validation fails in Authentication frames during external authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-04-13 00:52:51 +02:00
MACSTR ")",
MAC2STR(wpa_s->sme.ext_auth_ap_mld_addr));
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
return -1;
}
return 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
u16 status_code, const u8 *data, size_t len,
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
int external, const u8 *sa, int *ie_offset)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
int *groups;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
"status code %u", auth_transaction, status_code);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
((external && wpa_s->sme.ext_auth_wpa_ssid) ||
(!external && wpa_s->current_bss && wpa_s->current_ssid))) {
SAE: Enable only groups 19, 20, and 21 in station mode Remove groups 25 (192-bit Random ECP Group) and 26 (224-bit Random ECP Group) from the default SAE groups in station mode since those groups are not as strong as the mandatory group 19 (NIST P-256). In addition, add a warning about MODP groups 1, 2, 5, 22, 23, and 24 based on "MUST NOT" or "SHOULD NOT" categorization in RFC 8247. All the MODP groups were already disabled by default and would have needed explicit configuration to be allowed. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-05 16:23:58 +01:00
int default_groups[] = { 19, 20, 21, 0 };
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
u16 group;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
const u8 *token_pos;
size_t token_len;
int h2e = 0;
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
groups = wpa_s->conf->sae_groups;
if (!groups || groups[0] <= 0)
groups = default_groups;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
wpa_hexdump(MSG_DEBUG, "SME: SAE anti-clogging token request",
data, len);
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
if (len < sizeof(le16)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Too short SAE anti-clogging token request");
return -1;
}
group = WPA_GET_LE16(data);
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: SAE anti-clogging token requested (group %u)",
group);
if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
WLAN_STATUS_SUCCESS) {
wpa_dbg(wpa_s, MSG_ERROR,
"SME: SAE group %u of anti-clogging request is invalid",
group);
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
token_pos = data + sizeof(le16);
token_len = len - sizeof(le16);
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
h2e = wpa_s->sme.sae.h2e;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
if (h2e) {
SAE: Make Anti-Clogging token element parsing simpler This will hopefully be easier for static analyzers to understand. Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-08 16:14:34 +02:00
u8 id, elen, extid;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
if (token_len < 3) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Too short SAE anti-clogging token container");
return -1;
}
SAE: Make Anti-Clogging token element parsing simpler This will hopefully be easier for static analyzers to understand. Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-08 16:14:34 +02:00
id = *token_pos++;
elen = *token_pos++;
extid = *token_pos++;
if (id != WLAN_EID_EXTENSION ||
elen == 0 || elen > token_len - 2 ||
extid != WLAN_EID_EXT_ANTI_CLOGGING_TOKEN) {
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Invalid SAE anti-clogging token container header");
return -1;
}
SAE: Make Anti-Clogging token element parsing simpler This will hopefully be easier for static analyzers to understand. Signed-off-by: Jouni Malinen <j@w1.fi>
2022-05-08 16:14:34 +02:00
token_len = elen - 1;
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
}
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
*ie_offset = token_pos + token_len - data;
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
wpa_s->sme.sae_token = wpabuf_alloc_copy(token_pos, token_len);
wpa_supplicant: Add missing memory allocation checks There are several cases where memory allocations are not checked for success. Add conditions and error messages, as some analyzers complain about that. Signed-off-by: Micha Hashkes <micha.hashkes@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-11-30 16:05:43 +01:00
if (!wpa_s->sme.sae_token) {
wpa_dbg(wpa_s, MSG_ERROR,
"SME: Failed to allocate SAE token");
return -1;
}
SAE: Use Anti-Clogging Token Container element with H2E IEEE P802.11-REVmd was modified to use a container IE for anti-clogging token whenver H2E is used so that parsing of the SAE Authentication frames can be simplified. See this document for more details of the approved changes: https://mentor.ieee.org/802.11/dcn/19/11-19-2154-02-000m-sae-anti-clogging-token.docx Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-01-20 19:27:06 +01:00
wpa_hexdump_buf(MSG_DEBUG, "SME: Requested anti-clogging token",
wpa_s->sme.sae_token);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (!external) {
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_send_authentication(wpa_s, wpa_s->current_bss,
SAE: Reuse previously generated PWE on a retry with the same AP Do not start SAE authentication from scratch when the AP requests anti-clogging token to be used. Instead, use the previously generated PWE as-is if the retry is for the same AP and the same group. This saves unnecessary processing on the station side in case the AP is under heavy SAE authentiation load. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-03 15:23:19 +01:00
wpa_s->current_ssid, 2);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
} else {
if (wpa_s->sme.ext_ml_auth &&
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
sme_external_ml_auth(wpa_s, data, len, *ie_offset,
status_code))
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
return -1;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_external_auth_send_sae_commit(
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
wpa_s, wpa_s->sme.ext_auth_bssid,
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
wpa_s->sme.ext_auth_wpa_ssid);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
return 0;
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
((external && wpa_s->sme.ext_auth_wpa_ssid) ||
(!external && wpa_s->current_bss && wpa_s->current_ssid))) {
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
SAE: Collect list of rejected groups for H2E in STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
int_array_add_unique(&wpa_s->sme.sae_rejected_groups,
wpa_s->sme.sae.group);
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
wpa_s->sme.sae_group_index++;
SAE: Support cross AKM roaming between SAE AKMs in external auth case Add support to handle external authentication request with a different SAE AKM suite compared to the current connection AKM suite. This is needed to support cross AKM roaming between SAE and SAE-EXT-KEY AKM suites. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-27 23:06:16 +01:00
if (sme_set_sae_group(wpa_s, external) < 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return -1; /* no other groups enabled */
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (!external) {
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 1);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
} else {
if (wpa_s->sme.ext_ml_auth &&
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
sme_external_ml_auth(wpa_s, data, len, *ie_offset,
status_code))
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
return -1;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_external_auth_send_sae_commit(
Fix a regression in storing of external_auth SSID/BSSID An earlier change in drivers_ops API for struct external_auth broke the way SSID and BSSID for an external authentication request were stored. The implementation depended on the memory array being available in the API struct with a use of memcpy() to copy the full structure even though when only SSID and BSSID was needed. Fix this by replacing that easy-to-break storing mechanism with explicit arrays for the exact set of needed information. Fixes: dd1a8cef4c05 ("Remove unnecessary copying of SSID and BSSID for external_auth") Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-28 15:24:32 +02:00
wpa_s, wpa_s->sme.ext_auth_bssid,
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
wpa_s->sme.ext_auth_wpa_ssid);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return 0;
}
SAE: Add support for using the optional Password Identifier This extends the SAE implementation in both infrastructure and mesh BSS cases to allow an optional Password Identifier to be used. This uses the mechanism added in P802.11REVmd/D1.0. The Password Identifier is configured in a wpa_supplicant network profile as a new string parameter sae_password_id. In hostapd configuration, the existing sae_password parameter has been extended to allow the password identifier (and also a peer MAC address) to be set. In addition, multiple sae_password entries can now be provided to hostapd to allow multiple per-peer and per-identifier passwords to be set. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-05-19 16:28:01 +02:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_UNKNOWN_PASSWORD_IDENTIFIER) {
const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
wpa_msg(wpa_s, MSG_INFO,
WPA_EVENT_SAE_UNKNOWN_PASSWORD_IDENTIFIER MACSTR,
MAC2STR(bssid));
return -1;
}
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (status_code != WLAN_STATUS_SUCCESS &&
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status_code != WLAN_STATUS_SAE_HASH_TO_ELEMENT &&
SAE: Report authentication rejection over control interface CTRL-EVENT-AUTH-REJECT reporting was previously skipped when going through SAE-specific Authentication frame handling. Add this event here as well to be more consistent with control interface events. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-07-14 12:03:05 +02:00
status_code != WLAN_STATUS_SAE_PK) {
const u8 *bssid = sa ? sa : wpa_s->pending_bssid;
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
" auth_type=%u auth_transaction=%u status_code=%u",
MAC2STR(bssid), WLAN_AUTH_SAE,
auth_transaction, status_code);
SAE: Send real status code to the driver when AP rejects external auth Send the status code from the AP authentication response instead of sending the hardcoded WLAN_STATUS_UNSPECIFIED_FAILURE when the external SAE authentication failure is due to an explicit rejection by the AP. This will allow the driver to indicate the correct status in connect response. For example, an AP can send WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA in SAE authentication response. With this change the driver gets the real status for the SAE authentication failure and it can fill the correct status in the connect response event. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-04-26 08:52:37 +02:00
return -2;
SAE: Report authentication rejection over control interface CTRL-EVENT-AUTH-REJECT reporting was previously skipped when going through SAE-specific Authentication frame handling. Add this event here as well to be more consistent with control interface events. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-07-14 12:03:05 +02:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (auth_transaction == 1) {
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
u16 res;
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
groups = wpa_s->conf->sae_groups;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
SAE: Use correct SSID profile for SAE auth retries during external auth Previously, wpa_supplicant was using the current SSID for building the SAE authentication commit frame for retries during external authentication. But the external authentication SSID can be different from the current SSID. Fix this by using the correct SSID profile. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-08-08 13:33:38 +02:00
if ((external && !wpa_s->sme.ext_auth_wpa_ssid) ||
(!external &&
(!wpa_s->current_bss || !wpa_s->current_ssid)))
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return -1;
SAE: Ignore commit message when waiting for confirm in STA mode Previously, an unexpected SAE commit message resulted in forcing disconnection. While that allowed recovery by starting from scratch, this is not really necessary. Ignore such unexpected SAE commit message instead and allow SAE confirm message to be processed after this. This is somewhat more robust way of handling the cases where SAE commit message might be retransmitted either in STA->AP or AP->STA direction. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-10-27 13:35:04 +01:00
if (wpa_s->sme.sae.state != SAE_COMMITTED) {
wpa_printf(MSG_DEBUG,
"SAE: Ignore commit message while waiting for confirm");
return 0;
}
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
if (wpa_s->sme.sae.h2e && status_code == WLAN_STATUS_SUCCESS) {
SAE: Verify that appropriate Status Code is used in SAE commit (SME) Previous version accepted both 0 and 126 values in SAE commit message from the AP. Explicitly check that the value the AP uses matches what the STA started with to avoid unexpected cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-08 02:36:13 +01:00
wpa_printf(MSG_DEBUG,
"SAE: Unexpected use of status code 0 in SAE commit when H2E was expected");
return -1;
}
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
if ((!wpa_s->sme.sae.h2e || wpa_s->sme.sae.pk) &&
SAE: Verify that appropriate Status Code is used in SAE commit (SME) Previous version accepted both 0 and 126 values in SAE commit message from the AP. Explicitly check that the value the AP uses matches what the STA started with to avoid unexpected cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-08 02:36:13 +01:00
status_code == WLAN_STATUS_SAE_HASH_TO_ELEMENT) {
wpa_printf(MSG_DEBUG,
"SAE: Unexpected use of status code for H2E in SAE commit when H2E was not expected");
return -1;
}
SAE: Move H2E and PK flags to main sae_data This maintains knowledge of whether H2E or PK was used as part of the SAE authentication beyond the removal of temporary state needed during that authentication. This makes it easier to use information about which kind of SAE authentication was used at higher layer functionality. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 11:08:37 +02:00
if (!wpa_s->sme.sae.pk &&
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
status_code == WLAN_STATUS_SAE_PK) {
wpa_printf(MSG_DEBUG,
"SAE: Unexpected use of status code for PK in SAE commit when PK was not expected");
return -1;
}
SAE: Verify that appropriate Status Code is used in SAE commit (SME) Previous version accepted both 0 and 126 values in SAE commit message from the AP. Explicitly check that the value the AP uses matches what the STA started with to avoid unexpected cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-02-08 02:36:13 +01:00
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (groups && groups[0] <= 0)
groups = NULL;
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
res = sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
SAE: Tell sae_parse_commit() whether H2E is used This will be needed to help parsing the received SAE commit. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-07 17:33:02 +02:00
groups, status_code ==
SAE-PK: STA functionality This adds STA side functionality for SAE-PK. This version enables SAE-PK automatically based on the configured SAE password value if the selected AP advertises support for SAE-PK. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-30 22:30:42 +02:00
WLAN_STATUS_SAE_HASH_TO_ELEMENT ||
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
status_code == WLAN_STATUS_SAE_PK,
ie_offset);
SAE: Verify that own/peer commit-scalar and COMMIT-ELEMENT are different This check explicitly for reflection attack and stops authentication immediately if that is detected instead of continuing to the following 4-way handshake that would fail due to the attacker not knowing the key from the SAE exchange. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-23 21:30:15 +02:00
if (res == SAE_SILENTLY_DISCARD) {
wpa_printf(MSG_DEBUG,
"SAE: Drop commit message due to reflection attack");
return 0;
}
if (res != WLAN_STATUS_SUCCESS)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (wpa_s->sme.sae.tmp &&
sme_check_sae_rejected_groups(
wpa_s,
SAE H2E: Fix validation of rejected groups list check_sae_rejected_groups() returns 1, not -1, in case an enabled group is rejected. The previous check for < 0 could not have ever triggered. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-12-06 23:28:13 +01:00
wpa_s->sme.sae.tmp->peer_rejected_groups))
SAE: Check that peer's rejected groups are not enabled Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
return -1;
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
if (sae_process_commit(&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
"commit");
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (!external) {
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 0);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
} else {
if (wpa_s->sme.ext_ml_auth &&
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
sme_external_ml_auth(wpa_s, data, len, *ie_offset,
status_code))
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
return -1;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
sme_external_auth_send_sae_confirm(wpa_s, sa);
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return 0;
} else if (auth_transaction == 2) {
SAE: H2E version of SAE commit message handling for STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
if (status_code != WLAN_STATUS_SUCCESS)
return -1;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
if (wpa_s->sme.sae.state != SAE_CONFIRMED)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
if (sae_check_confirm(&wpa_s->sme.sae, data, len,
ie_offset) < 0)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (external && wpa_s->sme.ext_ml_auth &&
MLD STA: Allow auth frames without ML IE for failure status codes In some cases like unknown-group rejection, AP MLD can't parse the received Authentication frame to the point of the Multi-Link element if the group used by the peer is unknown to the AP MLD. In such cases, AP MLD not including Multi-Link element in rejection Authentication frames can be considered as standard compliant since AP MLD doesn't know whether the received Authentication frame has Multi-Link element or not. To avoid connection issues in such cases, don't reject Authentication frames without Multi-Link element when status code is other than WLAN_STATUS_SUCCESS, WLAN_STATUS_SAE_HASH_TO_ELEMENT, WLAN_STATUS_SAE_PK, and WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-05-09 15:53:21 +02:00
sme_external_ml_auth(wpa_s, data, len, *ie_offset,
status_code))
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
return -1;
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_ACCEPTED;
SAE: Free temporary buffers when moving to Accepted state Most of the variables are not needed anymore once the SAE instance has entered Accepted state. Free these to save memory. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-06 18:06:59 +01:00
sae_clear_temp_data(&wpa_s->sme.sae);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (external) {
/* Report success to driver */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_SUCCESS);
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return 1;
}
return -1;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
static int sme_sae_set_pmk(struct wpa_supplicant *wpa_s, const u8 *bssid)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
{
wpa_printf(MSG_DEBUG,
"SME: SAE completed - setting PMK for 4-way handshake");
SAE: Store PMK length and AKM in SAE data These are needed to be able to support new AKM suites with variable length PMK. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-07-24 21:15:52 +02:00
wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, wpa_s->sme.sae.pmk_len,
SAE: Use BSSID stored in ext_auth_bssid for set_pmk pending_bssid is cleared in the connected state and thus is not valid if SAE authentication is done to a new BSSID when in the connected state. Hence use the BSSID from ext_auth_bssid while configuring the PMK for the external authentication case. This is required for roaming to a new BSSID with driver-based-SME while the SAE processing happens with wpa_supplicant. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-16 07:08:10 +02:00
wpa_s->sme.sae.pmkid, bssid);
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
if (wpa_s->conf->sae_pmkid_in_assoc) {
/* Update the own RSNE contents now that we have set the PMK
* and added a PMKSA cache entry based on the successfully
* completed SAE exchange. In practice, this will add the PMKID
* into RSNE. */
if (wpa_s->sme.assoc_req_ie_len + 2 + PMKID_LEN >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_msg(wpa_s, MSG_WARNING,
"RSN: Not enough room for inserting own PMKID into RSNE");
return -1;
}
if (wpa_insert_pmkid(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
FT: Allow wpa_supplicant to be configured to prepend PMKR1Name The standard is somewhat unclear on whether the PMKIDs used in (Re)Association Request frame (i.e., potential PMKIDs that could be used for PMKSA caching during the initial mobility domain association) are to be retained or removed when generating EAPOL-Key msg 2/4. wpa_supplicant has replaced the PMKID List contents from (Re)Association Request frame with PMKR1Name when generating EAPOL-Key msg 2/4 for FT. Allow it to be configured (ft_prepend_pmkid=1) to prepend the PMKR1Name without removing the PMKIDs from (Re)Association Request frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-02-03 19:13:46 +01:00
wpa_s->sme.sae.pmkid, true) < 0)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
return -1;
wpa_hexdump(MSG_DEBUG,
"SME: Updated Association Request IEs",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
}
return 0;
}
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
void sme_external_auth_mgmt_rx(struct wpa_supplicant *wpa_s,
const u8 *auth_frame, size_t len)
{
const struct ieee80211_mgmt *header;
size_t auth_length;
header = (const struct ieee80211_mgmt *) auth_frame;
auth_length = IEEE80211_HDRLEN + sizeof(header->u.auth);
if (len < auth_length) {
/* Notify failure to the driver */
sme_send_external_auth_status(wpa_s,
WLAN_STATUS_UNSPECIFIED_FAILURE);
return;
}
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
if (le_to_host16(header->u.auth.auth_alg) == WLAN_AUTH_SAE) {
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
int res;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
int ie_offset = 0;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
SAE: Fix external authentication on big endian platforms Need to handle the little endian 16-bit fields properly when building and parsing Authentication frames. Fixes: 5ff39c1380d9 ("SAE: Support external authentication offload for driver-SME cases") Signed-off-by: Ashok Ponnaiah <aponnaia@codeaurora.org>
2018-11-30 16:26:26 +01:00
res = sme_sae_auth(
wpa_s, le_to_host16(header->u.auth.auth_transaction),
le_to_host16(header->u.auth.status_code),
header->u.auth.variable,
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
len - auth_length, 1, header->sa, &ie_offset);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
if (res < 0) {
/* Notify failure to the driver */
sme_send_external_auth_status(
SAE: Send real status code to the driver when AP rejects external auth Send the status code from the AP authentication response instead of sending the hardcoded WLAN_STATUS_UNSPECIFIED_FAILURE when the external SAE authentication failure is due to an explicit rejection by the AP. This will allow the driver to indicate the correct status in connect response. For example, an AP can send WLAN_STATUS_AP_UNABLE_TO_HANDLE_NEW_STA in SAE authentication response. With this change the driver gets the real status for the SAE authentication failure and it can fill the correct status in the connect response event. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-04-26 08:52:37 +02:00
wpa_s,
res == -2 ?
le_to_host16(header->u.auth.status_code) :
WLAN_STATUS_UNSPECIFIED_FAILURE);
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
return;
}
if (res != 1)
return;
MLD STA: Add support for SAE external authentication offload to userspace Enable MLO for SAE authentication when the driver indicates the AP MLD address in an external authentication request. The MAC address of the interface on which the external authentication request received will be used as the own MLD address. This commit does below for enabling MLO during external SAE authentication: - Use MLD addresses for SAE authentication. - Add Basic Multi-Link element with the own MLD address in SAE Authentication frames. - Send SAE Authentication frames with the source address as the own MLD address, destination address and BSSID as the AP MLD address to the driver. - Validate the MLD address indicated by the AP in SAE Authentication frames against the AP MLD address indicated in external authentication request. - Store the PMKSA with the AP MLD address after completing SAE authentication. Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-10-19 16:14:06 +02:00
if (sme_sae_set_pmk(wpa_s,
wpa_s->sme.ext_ml_auth ?
wpa_s->sme.ext_auth_ap_mld_addr :
wpa_s->sme.ext_auth_bssid) < 0)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
return;
SAE: Support external authentication offload for driver-SME cases Extend the SME functionality to support the external authentication. External authentication may be used by the drivers that do not define separate commands for authentication and association (~WPA_DRIVER_FLAGS_SME) but rely on wpa_supplicant's SME for the authentication. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-02-01 12:31:28 +01:00
}
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
{
struct wpa_ssid *ssid = wpa_s->current_ssid;
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
int ie_offset = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ssid == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when network is not selected");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when not in authenticating state");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(wpa_s->pending_bssid, data->auth.peer) &&
SME: Accept Authentication frame from an MLD AP The driver is expected to translate the link addresses to MLD addresses when processing an Authentication frame from a MLD AP. Thus, accept Authentication frame when the peer matches the expected MLD address. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:08 +01:00
!(wpa_s->valid_links &&
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
ether_addr_equal(wpa_s->ap_mld_addr, data->auth.peer))) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
"unexpected peer " MACSTR,
MAC2STR(data->auth.peer));
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
" auth_type=%d auth_transaction=%d status_code=%d",
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
MAC2STR(data->auth.peer), data->auth.auth_type,
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
data->auth.auth_transaction, data->auth.status_code);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
data->auth.ies, data->auth.ies_len);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
if (data->auth.auth_type == WLAN_AUTH_SAE) {
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
const u8 *addr = wpa_s->pending_bssid;
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
int res;
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
data->auth.status_code, data->auth.ies,
SAE: Make sme_sae_auth() return IE offset Authentication frames include several fixed body parts (see Table 9-68 (Authentication frame body) and Table 9-69 (Presence of fields and elements in Authentication frames) in IEEE P802.11-REVme/D2.0). To be able to parse the IE part, these fields need to be skipped. Since SAE logic already implements this parsing, change SAE authentication handling functions to return the offset to the IE part. This preparation is needed for future MLD patches that need to parse out the ML related elements in the Authentication frames. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:05 +01:00
data->auth.ies_len, 0, data->auth.peer,
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
&ie_offset);
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
if (res < 0) {
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
}
if (res != 1)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
SAE: Use PMK in 4-way handshake Use the PMK that is derived as part of the SAE authentication in the 4-way handshake instead of the PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:35:59 +01:00
wpa_supplicant: Use MLD address in SAE authentication Use MLD address in SAE commit derivation and PMKSA storing. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:09 +01:00
if (wpa_s->valid_links)
addr = wpa_s->ap_mld_addr;
if (sme_sae_set_pmk(wpa_s, addr) < 0)
SAE: Allow PMKID to be added into Association Request frame following SAE IEEE Std 802.11-2016 does not require this behavior from a SAE STA, but it is not disallowed either, so it is useful to have an option to identify the derived PMKSA in the immediately following Association Request frames. This is disabled by default (i.e., no change to previous behavior) and can be enabled with a global wpa_supplicant configuration parameter sae_pmkid_in_assoc=1. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-08-14 16:49:23 +02:00
return;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
char *ie_txt = NULL;
if (data->auth.ies && data->auth.ies_len) {
size_t buflen = 2 * data->auth.ies_len + 1;
ie_txt = os_malloc(buflen);
if (ie_txt) {
wpa_snprintf_hex(ie_txt, buflen, data->auth.ies,
data->auth.ies_len);
}
}
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_AUTH_REJECT MACSTR
SME: Remove null ie param from CTRL-EVENT-AUTH-REJECT Clean up the event message by removing the ie=<value> parameter when the IEs are not available instead of printing out "ie=(null)". Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-10 10:49:36 +01:00
" auth_type=%u auth_transaction=%u status_code=%u%s%s",
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
MAC2STR(data->auth.peer), data->auth.auth_type,
data->auth.auth_transaction, data->auth.status_code,
SME: Remove null ie param from CTRL-EVENT-AUTH-REJECT Clean up the event message by removing the ie=<value> parameter when the IEs are not available instead of printing out "ie=(null)". Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-10 10:49:36 +01:00
ie_txt ? " ie=" : "",
ie_txt ? ie_txt : "");
Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection This allows control interface monitors to get more detailed information in cases where wpa_supplicant-based SME receives an Authentication frame with non-zero status code. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:33:35 +02:00
os_free(ie_txt);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
FILS: Fix FILS connect failures after ERP key invalidation If the RADIUS authentication server dropped the cached ERP keys for any reason, FILS authentication attempts with ERP fails and the previous wpa_supplicant implementation ended up trying to use the same keys for all consecutive attempts as well. This did not allow recovery from state mismatch between the ERP server and peer using full EAP authentication. Address this by trying to use full (non-FILS) authentication when trying to connect to an AP using the same ERP realm with FILS-enabled network profile if the previous authentication attempt had failed. This allows new ERP keys to be established and FILS authentication to be used again for the consecutive connections. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-07-27 10:25:27 +02:00
#ifdef CONFIG_FILS
if (wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS ||
wpa_s->sme.auth_alg == WPA_AUTH_ALG_FILS_SK_PFS)
fils_connection_failure(wpa_s);
#endif /* CONFIG_FILS */
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
if (data->auth.status_code !=
WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
wpa_s->sme.auth_alg == data->auth.auth_type ||
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
Set state to DISCONNECTED on auth/assoc failures Some of the authentication/association failure paths left wpa_state to its previous value. This can result in unexpected behavior when wpa_supplicant tries to find an AP to connect to since the uncleared state can result the in the selected BSS being ignored if it is same as the previously used BSS. This could happen, e.g., when wpa_supplicant SME was used and the AP rejected authentication. Fix this by explicitly setting state to DISCONNECTED on auth/assoc failures that did not yet do this. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-06-25 13:23:25 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
return;
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
}
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
Fix authentication algorithm negotiation in SME code Commit 6ac4b15ef8af434d216fd2dac62ec82948ab0fbd (wpa_radio work for connection) caused a regression for cases where multiple auth_alg values are set in a network block and wpa_supplicant-based SME is supposed to iterate through them. The connection radio work was not terminated when receiving authentication failure and this resulted in the following authentication attempt failing. Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-31 22:31:26 +01:00
wpas_connect_work_done(wpa_s);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
switch (data->auth.auth_type) {
case WLAN_AUTH_OPEN:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
case WLAN_AUTH_SHARED_KEY:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
default:
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#ifdef CONFIG_IEEE80211R
if (data->auth.auth_type == WLAN_AUTH_FT) {
FT: Support addition of RIC elements into Reassociation Request frame The new "SET ric_ies <hexdump>" control interface command can now be used to request wpa_supplicant to add the specified RIC elements into Reassociation Request frame when using FT protocol. This is mainly for testing purposes. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-18 20:14:10 +01:00
const u8 *ric_ies = NULL;
size_t ric_ies_len = 0;
if (wpa_s->ric_ies) {
ric_ies = wpabuf_head(wpa_s->ric_ies);
ric_ies_len = wpabuf_len(wpa_s->ric_ies);
}
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
data->auth.ies_len, 0,
FT: Support addition of RIC elements into Reassociation Request frame The new "SET ric_ies <hexdump>" control interface command can now be used to request wpa_supplicant to add the specified RIC elements into Reassociation Request frame when using FT protocol. This is mainly for testing purposes. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-02-18 20:14:10 +01:00
data->auth.peer,
ric_ies, ric_ies_len) < 0) {
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FT Authentication response processing failed");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#endif /* CONFIG_IEEE80211R */
FILS: Authentication frame processing (STA) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 23:14:13 +02:00
#ifdef CONFIG_FILS
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
if (data->auth.auth_type == WLAN_AUTH_FILS_SK ||
data->auth.auth_type == WLAN_AUTH_FILS_SK_PFS) {
u16 expect_auth_type;
expect_auth_type = wpa_s->sme.auth_alg ==
WPA_AUTH_ALG_FILS_SK_PFS ? WLAN_AUTH_FILS_SK_PFS :
WLAN_AUTH_FILS_SK;
if (data->auth.auth_type != expect_auth_type) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FILS Authentication response used different auth alg (%u; expected %u)",
data->auth.auth_type, expect_auth_type);
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
FILS: Fix BSSID in reassociation case The RSN supplicant implementation needs to be updated to use the new BSSID whenever doing FILS authentication. Previously, this was only done when notifying association and that was too late for the case of reassociation. Fix this by providing the new BSSID when calling fils_process_auth(). This makes PTK derivation use the correct BSSID. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-02-21 11:25:02 +01:00
if (fils_process_auth(wpa_s->wpa, wpa_s->pending_bssid,
data->auth.ies, data->auth.ies_len) < 0) {
FILS: Authentication frame processing (STA) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 23:14:13 +02:00
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FILS Authentication response processing failed");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
FILS: Authentication frame processing (STA) Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-07 23:14:13 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
}
#endif /* CONFIG_FILS */
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
/* TODO: Support additional auth_type values as well */
MLD: Fail connection if ML Authentication frame could not be parsed If the Authentication frame response did not contain the expected ML element (or it was invalid), we cannot continue with the ML association. As such, the only choice we have in this case is to abort the association. If we do continue, we would end up sending the Association Request frame with our MLD MAC address. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-28 14:19:23 +01:00
if ((data->auth.auth_type == WLAN_AUTH_OPEN ||
data->auth.auth_type == WLAN_AUTH_SAE) &&
wpas_sme_ml_auth(wpa_s, data, ie_offset) < 0) {
wpa_dbg(wpa_s, MSG_DEBUG,
"MLD: Failed to parse ML Authentication frame");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid=" MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
SME: Add support for handling authentication with MLD In case both the local driver and the AP support MLD, request an MLD authentication from the driver. When processing the authentication event from the driver verify that the MLD address in the authentication data matches that of the requested AP. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:06 +01:00
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
sme_associate(wpa_s, ssid->mode, data->auth.peer,
data->auth.auth_type);
}
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
#ifdef CONFIG_IEEE80211R
static void remove_ie(u8 *buf, size_t *len, u8 eid)
{
u8 *pos, *next, *end;
pos = (u8 *) get_ie(buf, *len, eid);
if (pos) {
next = pos + 2 + pos[1];
end = buf + *len;
*len -= 2 + pos[1];
os_memmove(pos, next, end - next);
}
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
const u8 *bssid, u16 auth_type)
{
struct wpa_driver_associate_params params;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
struct ieee802_11_elems elems;
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
struct wpa_ssid *ssid = wpa_s->current_ssid;
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
#ifdef CONFIG_FILS
u8 nonces[2 * FILS_NONCE_LEN];
#endif /* CONFIG_FILS */
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
struct ieee80211_ht_capabilities htcaps;
struct ieee80211_ht_capabilities htcaps_mask;
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
struct ieee80211_vht_capabilities vhtcaps;
struct ieee80211_vht_capabilities vhtcaps_mask;
#endif /* CONFIG_VHT_OVERRIDES */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(&params, 0, sizeof(params));
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
/* Save auth type, in case we need to retry after comeback timer. */
wpa_s->sme.assoc_auth_type = auth_type;
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
#ifdef CONFIG_FILS
FILS: Add FILS SK auth PFS support in STA mode This adds an option to configure wpa_supplicant to use the perfect forward secrecy option in FILS shared key authentication. A new build option CONFIG_FILS_SK_PFS=y can be used to include this functionality. A new runtime network profile parameter fils_dh_group is used to enable this by specifying which DH group to use. For example, fils_dh_group=19 would use FILS SK PFS with a 256-bit random ECP group. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 21:45:35 +01:00
if (auth_type == WLAN_AUTH_FILS_SK ||
auth_type == WLAN_AUTH_FILS_SK_PFS) {
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
struct wpabuf *buf;
const u8 *snonce, *anonce;
FILS: Allow FILS HLP requests to be added The new wpa_supplicant control interface commands FILS_HLP_REQ_FLUSH and FILS_HLP_REQ_ADD can now be used to request FILS HLP requests to be added to the (Re)Association Request frame whenever FILS authentication is used. FILS_HLP_REQ_ADD parameters use the following format: <destination MAC address> <hexdump of payload starting from ethertype> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:07:20 +01:00
const unsigned int max_hlp = 20;
struct wpabuf *hlp[max_hlp];
unsigned int i, num_hlp = 0;
struct fils_hlp_req *req;
dl_list_for_each(req, &wpa_s->fils_hlp_req, struct fils_hlp_req,
list) {
hlp[num_hlp] = wpabuf_alloc(2 * ETH_ALEN + 6 +
wpabuf_len(req->pkt));
if (!hlp[num_hlp])
break;
wpabuf_put_data(hlp[num_hlp], req->dst, ETH_ALEN);
wpabuf_put_data(hlp[num_hlp], wpa_s->own_addr,
ETH_ALEN);
wpabuf_put_data(hlp[num_hlp],
"\xaa\xaa\x03\x00\x00\x00", 6);
wpabuf_put_buf(hlp[num_hlp], req->pkt);
num_hlp++;
if (num_hlp >= max_hlp)
break;
}
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
buf = fils_build_assoc_req(wpa_s->wpa, &params.fils_kek,
&params.fils_kek_len, &snonce,
FILS: Allow FILS HLP requests to be added The new wpa_supplicant control interface commands FILS_HLP_REQ_FLUSH and FILS_HLP_REQ_ADD can now be used to request FILS HLP requests to be added to the (Re)Association Request frame whenever FILS authentication is used. FILS_HLP_REQ_ADD parameters use the following format: <destination MAC address> <hexdump of payload starting from ethertype> Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-01-29 13:07:20 +01:00
&anonce,
(const struct wpabuf **) hlp,
num_hlp);
for (i = 0; i < num_hlp; i++)
wpabuf_free(hlp[i]);
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
if (!buf)
return;
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: assoc_req before FILS elements",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
#ifdef CONFIG_IEEE80211R
if (wpa_key_mgmt_ft(wpa_s->key_mgmt)) {
/* Remove RSNE and MDE to allow them to be overridden
* with FILS+FT specific values from
* fils_build_assoc_req(). */
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RSN);
wpa_hexdump(MSG_DEBUG,
"FILS: assoc_req after RSNE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_MOBILITY_DOMAIN);
wpa_hexdump(MSG_DEBUG,
"FILS: assoc_req after MDE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
}
#endif /* CONFIG_IEEE80211R */
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
/* TODO: Make wpa_s->sme.assoc_req_ie use dynamic allocation */
if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(buf) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"FILS: Not enough buffer room for own AssocReq elements");
wpabuf_free(buf);
return;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(buf), wpabuf_len(buf));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
wpabuf_free(buf);
FILS: Derive FT key hierarchy on supplicant side for FILS+FT Derive PMK-R0 and the relevant key names when using FILS authentication for initial FT mobility domain association. Fill in the FT IEs in (Re)Association Request frame for this. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-05-07 11:00:27 +02:00
wpa_hexdump(MSG_DEBUG, "FILS: assoc_req after FILS elements",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
FILS: Add elements to FILS Association Request frame Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-08 19:58:53 +02:00
os_memcpy(nonces, snonce, FILS_NONCE_LEN);
os_memcpy(nonces + FILS_NONCE_LEN, anonce, FILS_NONCE_LEN);
params.fils_nonces = nonces;
params.fils_nonces_len = sizeof(nonces);
}
#endif /* CONFIG_FILS */
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
#ifdef CONFIG_OWE
OWE: Allow DH Parameters element to be overridden for testing purposes This allows CONFIG_TESTING_OPTIONS=y builds of wpa_supplicant to override the OWE DH Parameters element in (Re)Association Request frames with arbitrary data specified with the "VENDOR_ELEM_ADD 13 <IE>" command. This is only for testing purposes. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-10 17:26:29 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (get_ie_ext(wpa_s->sme.assoc_req_ie, wpa_s->sme.assoc_req_ie_len,
WLAN_EID_EXT_OWE_DH_PARAM)) {
wpa_printf(MSG_INFO, "TESTING: Override OWE DH element");
} else
#endif /* CONFIG_TESTING_OPTIONS */
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
if (auth_type == WLAN_AUTH_OPEN &&
wpa_s->key_mgmt == WPA_KEY_MGMT_OWE) {
struct wpabuf *owe_ie;
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
u16 group;
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
if (ssid && ssid->owe_group) {
group = ssid->owe_group;
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
} else if (wpa_s->assoc_status_code ==
WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED) {
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
if (wpa_s->last_owe_group == 19)
group = 20;
else if (wpa_s->last_owe_group == 20)
group = 21;
else
group = OWE_DH_GROUP;
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
} else {
group = OWE_DH_GROUP;
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
}
OWE: Try another group only on association rejection with status 77 Do not change the OWE group if association is rejected for any other reason than WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED to avoid unnecessary latency in cases where the APs reject association, e.g., for load balancing reasons. Signed-off-by: Ashok Kumar <aponnaia@codeaurora.org>
2018-11-01 12:03:21 +01:00
OWE: Try all supported DH groups automatically on STA If a specific DH group for OWE is not set with the owe_group parameter, try all supported DH groups (currently 19, 20, 21) one by one if the AP keeps rejecting groups with the status code 77. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-12-27 20:06:02 +01:00
wpa_s->last_owe_group = group;
wpa_printf(MSG_DEBUG, "OWE: Try to use group %u", group);
OWE: Support DH groups 20 (NIST P-384) and 21 (NIST P-521) in station This extends OWE support in wpa_supplicant to allow DH groups 20 and 21 to be used in addition to the mandatory group 19 (NIST P-256). The group is configured using the new network profile parameter owe_group. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-10-08 15:39:08 +02:00
owe_ie = owe_build_assoc_req(wpa_s->wpa, group);
OWE: Process Diffie-Hellman Parameter element in STA mode This adds STA side addition of OWE Diffie-Hellman Parameter element into (Re)Association Request frame and processing it in (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-03-12 10:53:21 +01:00
if (!owe_ie) {
wpa_printf(MSG_ERROR,
"OWE: Failed to build IE for Association Request frame");
return;
}
if (wpa_s->sme.assoc_req_ie_len + wpabuf_len(owe_ie) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"OWE: Not enough buffer room for own Association Request frame elements");
wpabuf_free(owe_ie);
return;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(owe_ie), wpabuf_len(owe_ie));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(owe_ie);
wpabuf_free(owe_ie);
}
#endif /* CONFIG_OWE */
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
#ifdef CONFIG_DPP2
DPP: Allow version number to be overridden for testing purposes "SET dpp_version_override <ver>" can now be used to request wpa_supplicant and hostapd to support a subset of DPP versions. In practice, the only valid case for now is to fall back from DPP version 2 support to version 1 in builds that include CONFIG_DPP2=y. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 20:07:42 +02:00
if (DPP_VERSION > 1 && wpa_s->key_mgmt == WPA_KEY_MGMT_DPP && ssid &&
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
ssid->dpp_netaccesskey && ssid->dpp_pfs != 2 &&
!ssid->dpp_pfs_fallback) {
DPP2: Try to negotiate PFS only if AP supports version 2 or newer Check AP's DPP Protocol Version during network introduction and mark the PMKSA cache as suitable for PFS use with version 2 or newer. This avoids unnecessary attempt of negotiating PFS with version 1 APs. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:30:03 +02:00
struct rsn_pmksa_cache_entry *pmksa;
pmksa = pmksa_cache_get_current(wpa_s->wpa);
if (!pmksa || !pmksa->dpp_pfs)
goto pfs_fail;
DPP2: PFS for PTK derivation Use Diffie-Hellman key exchange to derivate additional material for PMK-to-PTK derivation to get PFS. The Diffie-Hellman Parameter element (defined in OWE RFC 8110) is used in association frames to exchange the DH public keys. For backwards compatibility, ignore missing request/response DH parameter and fall back to no PFS in such cases. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-17 22:51:53 +01:00
dpp_pfs_free(wpa_s->dpp_pfs);
wpa_s->dpp_pfs = dpp_pfs_init(ssid->dpp_netaccesskey,
ssid->dpp_netaccesskey_len);
if (!wpa_s->dpp_pfs) {
wpa_printf(MSG_DEBUG, "DPP: Could not initialize PFS");
/* Try to continue without PFS */
goto pfs_fail;
}
if (wpa_s->sme.assoc_req_ie_len +
wpabuf_len(wpa_s->dpp_pfs->ie) >
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"DPP: Not enough buffer room for own Association Request frame elements");
dpp_pfs_free(wpa_s->dpp_pfs);
wpa_s->dpp_pfs = NULL;
goto pfs_fail;
}
os_memcpy(wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
wpabuf_head(wpa_s->dpp_pfs->ie),
wpabuf_len(wpa_s->dpp_pfs->ie));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(wpa_s->dpp_pfs->ie);
}
pfs_fail:
#endif /* CONFIG_DPP2 */
Add an option to remove Robust AV (SCS, MSCS, QoS Management) For a memory constrained system, it may be more important to reduce binary size than include support for these capabilities. By default this is enabled. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-11-27 20:03:58 +01:00
#ifndef CONFIG_NO_ROBUST_AV
MSCS: Send MSCS change/remove frames only if MSCS setup exists Allow MSCS change/remove request to be sent only after an initial setup, i.e., after an add request has been accepted. Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-04 20:33:24 +02:00
wpa_s->mscs_setup_done = false;
Make wpa_bss_ext_capab() handle NULL bss argument This simplifies the callers that use wpa_s->current_bss (which could be NULL). Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-06 10:00:09 +01:00
if (wpa_bss_ext_capab(wpa_s->current_bss, WLAN_EXT_CAPAB_MSCS) &&
wpa_s->robust_av.valid_config) {
MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq Include the MSCS Descriptor IE in the (Re)Association Request frames to setup MSCS between the AP and the STA during association. Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-06-16 16:51:30 +02:00
struct wpabuf *mscs_ie;
size_t mscs_ie_len, buf_len, *wpa_ie_len, max_ie_len;
buf_len = 3 + /* MSCS descriptor IE header */
1 + /* Request type */
2 + /* User priority control */
4 + /* Stream timeout */
3 + /* TCLAS Mask IE header */
wpa_s->robust_av.frame_classifier_len;
mscs_ie = wpabuf_alloc(buf_len);
if (!mscs_ie) {
wpa_printf(MSG_INFO,
"MSCS: Failed to allocate MSCS IE");
goto mscs_fail;
}
wpa_ie_len = &wpa_s->sme.assoc_req_ie_len;
max_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
wpas_populate_mscs_descriptor_ie(&wpa_s->robust_av, mscs_ie);
if ((*wpa_ie_len + wpabuf_len(mscs_ie)) <= max_ie_len) {
MSCS: Fix issues due to incorrect usage of wpa_hexdump_buf() Previously wpabuf_head() of the buffer is passed to wpa_hexdump_buf() instead of the wpabuf struct itself and it was causing wpa_supplicant to crash. Fix this by using the correct pointer in the debug prints. Fixes: a118047245b0 ("MSCS: Add support to send MSCS Request frames") Fixes: c504ff5398fa ("MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq") Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-19 11:30:32 +02:00
wpa_hexdump_buf(MSG_MSGDUMP, "MSCS IE", mscs_ie);
MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq Include the MSCS Descriptor IE in the (Re)Association Request frames to setup MSCS between the AP and the STA during association. Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-06-16 16:51:30 +02:00
mscs_ie_len = wpabuf_len(mscs_ie);
os_memcpy(wpa_s->sme.assoc_req_ie + *wpa_ie_len,
wpabuf_head(mscs_ie), mscs_ie_len);
*wpa_ie_len += mscs_ie_len;
}
wpabuf_free(mscs_ie);
}
mscs_fail:
Add an option to remove Robust AV (SCS, MSCS, QoS Management) For a memory constrained system, it may be more important to reduce binary size than include support for these capabilities. By default this is enabled. Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-11-27 20:03:58 +01:00
#endif /* CONFIG_NO_ROBUST_AV */
MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq Include the MSCS Descriptor IE in the (Re)Association Request frames to setup MSCS between the AP and the STA during association. Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-06-16 16:51:30 +02:00
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
if (ssid && ssid->multi_ap_backhaul_sta) {
wpa_supplicant: Add Multi-AP backhaul STA support Advertise vendor specific Multi-AP IE in (Re)Association Request frames and process Multi-AP IE from (Re)Association Response frames if the user enables Multi-AP fuctionality. If the (Re)Association Response frame does not contain the Multi-AP IE, disassociate. This adds a new configuration parameter 'multi_ap_backhaul_sta' to enable/disable Multi-AP functionality. Enable 4-address mode after association (if the Association Response frame contains the Multi-AP IE). Also enable the bridge in that case. This is necessary because wpa_supplicant only enables the bridge in wpa_drv_if_add(), which only gets called when an interface is added through the control interface, not when it is configured from the command line. Signed-off-by: Venkateswara Naralasetty <vnaralas@codeaurora.org> Signed-off-by: Jouni Malinen <jouni@codeaurora.org> Signed-off-by: Arnout Vandecappelle (Essensium/Mind) <arnout@mind.be>
2018-12-05 11:23:53 +01:00
size_t multi_ap_ie_len;
multi_ap_ie_len = add_multi_ap_ie(
wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len,
sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len,
MULTI_AP_BACKHAUL_STA);
if (multi_ap_ie_len == 0) {
wpa_printf(MSG_ERROR,
"Multi-AP: Failed to build Multi-AP IE");
return;
}
wpa_s->sme.assoc_req_ie_len += multi_ap_ie_len;
}
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.bssid = bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ssid = wpa_s->sme.ssid;
params.ssid_len = wpa_s->sme.ssid_len;
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq = wpa_s->sme.freq;
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
params.bg_scan_period = ssid ? ssid->bg_scan_period : -1;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
wpa_s->sme.assoc_req_ie : NULL;
params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
wpa_hexdump(MSG_DEBUG, "SME: Association Request IEs",
params.wpa_ie, params.wpa_ie_len);
Get rid of duplicated cipher suite and AKM definitions WPA_CIPHER_* and CIPHER_* are used for the exact same set of cipher suites with the main difference being that the WPA_CIPHER_* version is suitable to be used as a bitfield. Similarly, WPA_KEY_MGMT_* and KEY_MGMT_* have similar design for AKMs. There is no need to maintain two separate copies of the definitions since the bitfield compatible version can be used for both needs. Get rid of the CIPHER_* and KEY_MGMT_* versions to clean up the implementation by getting rid of unnecessary mapping functions. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-30 18:33:39 +01:00
params.pairwise_suite = wpa_s->pairwise_cipher;
params.group_suite = wpa_s->group_cipher;
Add group_mgmt network parameter for PMF cipher selection The new wpa_supplicant network parameter group_mgmt can be used to specify which group management ciphers (AES-128-CMAC, BIP-GMAC-128, BIP-GMAC-256, BIP-CMAC-256) are allowed for the network. If not specified, the current behavior is maintained (i.e., follow what the AP advertises). The parameter can list multiple space separate ciphers. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2017-09-26 16:36:33 +02:00
params.mgmt_group_suite = wpa_s->mgmt_group_cipher;
nl80211: Indicate HS 2.0 OSEN AKM in connect/associate command This allows drivers that build the WPA/RSN IEs internally to use similar design for building the OSEN IE. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-25 16:57:54 +01:00
params.key_mgmt_suite = wpa_s->key_mgmt;
params.wpa_proto = wpa_s->wpa_proto;
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
os_memset(&htcaps, 0, sizeof(htcaps));
os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
params.htcaps = (u8 *) &htcaps;
params.htcaps_mask = (u8 *) &htcaps_mask;
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
wpa_supplicant_apply_ht_overrides(wpa_s, ssid, &params);
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
os_memset(&vhtcaps, 0, sizeof(vhtcaps));
os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
params.vhtcaps = &vhtcaps;
params.vhtcaps_mask = &vhtcaps_mask;
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
wpa_supplicant_apply_vht_overrides(wpa_s, ssid, &params);
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#endif /* CONFIG_VHT_OVERRIDES */
wpa_supplicant: Add HE override support Add HE override support under the build parameter CONFIG_HE_OVERRIDES=y. The disable_he=1 network profile parameter can be used to disable HE. This requires a fallback to VHT on the 5 GHz band and to HT on the 2.4 GHz band. There is no nl80211 support for configuring the driver to disable HE, so for now, this applies only to IBSS and mesh cases. Signed-off-by: P Praneesh <ppranees@codeaurora.org>
2020-03-09 11:53:50 +01:00
#ifdef CONFIG_HE_OVERRIDES
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
wpa_supplicant_apply_he_overrides(wpa_s, ssid, &params);
wpa_supplicant: Add HE override support Add HE override support under the build parameter CONFIG_HE_OVERRIDES=y. The disable_he=1 network profile parameter can be used to disable HE. This requires a fallback to VHT on the 5 GHz band and to HT on the 2.4 GHz band. There is no nl80211 support for configuring the driver to disable HE, so for now, this applies only to IBSS and mesh cases. Signed-off-by: P Praneesh <ppranees@codeaurora.org>
2020-03-09 11:53:50 +01:00
#endif /* CONFIG_HE_OVERRIDES */
EHT: Allow EHT to be disabled using disable_eht=1 in wpa_supplicant This is similar to the previously added disable_ht/vht/he parameters. Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-10-17 10:12:17 +02:00
wpa_supplicant_apply_eht_overrides(wpa_s, ssid, &params);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies &&
get_ie(wpa_s->sme.ft_ies, wpa_s->sme.ft_ies_len,
WLAN_EID_RIC_DATA)) {
/* There seems to be a pretty inconvenient bug in the Linux
* kernel IE splitting functionality when RIC is used. For now,
* skip correct behavior in IE construction here (i.e., drop the
* additional non-FT-specific IEs) to avoid kernel issues. This
* is fine since RIC is used only for testing purposes in the
* current implementation. */
wpa_printf(MSG_INFO,
"SME: Linux kernel workaround - do not try to include additional IEs with RIC");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.ft_ies;
params.wpa_ie_len = wpa_s->sme.ft_ies_len;
FT: Fix Reassociation Request IEs during FT protocol The previous implementation ended up replacing all pending IEs prepared for Association Request frame with the FT specific IEs (RSNE, MDE, FTE) when going through FT protocol reassociation with the wpa_supplicant SME. This resulted in dropping all other IEs that might have been prepared for the association (e.g., Extended Capabilities, RM Enabled Capabilities, Supported Operating Classes, vendor specific additions). Fix this by replacing only the known FT specific IEs with the appropriate values for FT protocol while maintaining other already prepared elements. Signed-off-by: Jouni Malinen <j@w1.fi>
2018-12-01 19:10:54 +01:00
} else if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
const u8 *rm_en, *pos, *end;
size_t rm_en_len = 0;
u8 *rm_en_dup = NULL, *wpos;
/* Remove RSNE, MDE, FTE to allow them to be overridden with
* FT specific values */
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RSN);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_MOBILITY_DOMAIN);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_FAST_BSS_TRANSITION);
rm_en = get_ie(wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RRM_ENABLED_CAPABILITIES);
if (rm_en) {
/* Need to remove RM Enabled Capabilities element as
* well temporarily, so that it can be placed between
* RSNE and MDE. */
rm_en_len = 2 + rm_en[1];
rm_en_dup = os_memdup(rm_en, rm_en_len);
remove_ie(wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len,
WLAN_EID_RRM_ENABLED_CAPABILITIES);
}
wpa_hexdump(MSG_DEBUG,
"SME: Association Request IEs after FT IE removal",
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
if (wpa_s->sme.assoc_req_ie_len + wpa_s->sme.ft_ies_len +
rm_en_len > sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_printf(MSG_ERROR,
"SME: Not enough buffer room for FT IEs in Association Request frame");
os_free(rm_en_dup);
return;
}
os_memmove(wpa_s->sme.assoc_req_ie + wpa_s->sme.ft_ies_len +
rm_en_len,
wpa_s->sme.assoc_req_ie,
wpa_s->sme.assoc_req_ie_len);
pos = wpa_s->sme.ft_ies;
end = pos + wpa_s->sme.ft_ies_len;
wpos = wpa_s->sme.assoc_req_ie;
if (*pos == WLAN_EID_RSN) {
os_memcpy(wpos, pos, 2 + pos[1]);
wpos += 2 + pos[1];
pos += 2 + pos[1];
}
if (rm_en_dup) {
os_memcpy(wpos, rm_en_dup, rm_en_len);
wpos += rm_en_len;
os_free(rm_en_dup);
}
os_memcpy(wpos, pos, end - pos);
wpa_s->sme.assoc_req_ie_len += wpa_s->sme.ft_ies_len +
rm_en_len;
params.wpa_ie = wpa_s->sme.assoc_req_ie;
params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
wpa_hexdump(MSG_DEBUG,
"SME: Association Request IEs after FT override",
params.wpa_ie, params.wpa_ie_len);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.mode = mode;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.mgmt_frame_protection = wpa_s->sme.mfp;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
params.rrm_used = wpa_s->rrm.rrm_used;
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.prev_bssid_set)
params.prev_bssid = wpa_s->sme.prev_bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
SME: Handle association without own extra IEs Need to check for this before calling ieee802_11_parse_elems().
2010-04-11 11:19:02 +02:00
if (params.wpa_ie == NULL ||
ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
< 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
os_memset(&elems, 0, sizeof(elems));
}
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
if (elems.rsn_ie) {
params.wpa_proto = WPA_PROTO_RSN;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
elems.rsn_ie_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else if (elems.wpa_ie) {
params.wpa_proto = WPA_PROTO_WPA;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
elems.wpa_ie_len + 2);
HS 2.0R2: Add OSEN client implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:24:05 +02:00
} else if (elems.osen) {
params.wpa_proto = WPA_PROTO_OSEN;
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
elems.osen_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
SAE: Add RSNXE in Association Request and EAPOL-Key msg 2/4 Add the new RSNXE into (Re)Association Request frames and EAPOL-Key msg 2/4 when using SAE with hash-to-element mechanism enabled. This allows the AP to verify that there was no downgrade attack when both PWE derivation mechanisms are enabled. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-10-17 15:54:05 +02:00
if (elems.rsnxe)
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, elems.rsnxe - 2,
elems.rsnxe_len + 2);
else
wpa_sm_set_assoc_rsnxe(wpa_s->wpa, NULL, 0);
Use a local pointer to simply current_ssid accesses in sme_associate() It is simpler to assign wpa_s->current_ssid to a local pointer now that there are numerous dereferences of current_ssid within sme_associate(). Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-01 16:20:33 +02:00
if (ssid && ssid->p2p_group)
P2P: Let the driver wrapper know if association is for P2P group
2010-07-18 23:30:25 +02:00
params.p2p = 1;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
P2P: Add a separate pointer to the P2P Device instance In many places in the code there was a reference to wpa_s->parent to get from group interface to p2p_dev interface. These places can break if P2P_DEVICE interface would need to be used with the primary interface as the group interface, since the parent of the primary interface points to itself and not the p2p_dev interface. Fix this by adding a separate "p2pdev" pointer to wpa_supplicant, it will be the same as parent pointer in most cases but whenever the primary interface is used as a group interface, change it to point to the correct p2p_dev interface. Signed-off-by: Lior David <qca_liord@qca.qualcomm.com>
2016-01-24 16:36:49 +01:00
if (wpa_s->p2pdev->set_sta_uapsd)
params.uapsd = wpa_s->p2pdev->sta_uapsd;
P2P: Add mechanism for configuring UAPSD parameters for group This is needed to be able to change parameters for dynamically created interfaces between the creation of the interface and association/start AP commands. Following ctrl_interface commands can now be used: P2P_SET client_apsd disable - disable configuration (i.e., use driver default) in client mode P2P_SET client_apsd <BE>,<BK>,<VI>,<VO>;<max SP Length> - enable UASPD with specific trigger configuration (0/1) per AC (max SP Length is currently ignored) P2P_SET go_apsd disable - disable configuration (i.e., use driver default) in AP mode P2P_SET go_apsd <0/1> - disable/enable APSD in AP mode
2010-07-28 19:18:52 +02:00
else
params.uapsd = -1;
SME: Add support for handling association with MLD In case both the local driver and the AP support MLD, request an MLD association from the driver. When processing the association event from the driver verify that the multi link information in the (Re)Association Response frame ML element matches the links on which the association was expected. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:07 +01:00
if (wpa_s->valid_links) {
unsigned int i;
wpa_printf(MSG_DEBUG,
"MLD: In association. assoc_link_id=%u, valid_links=0x%x",
wpa_s->mlo_assoc_link_id, wpa_s->valid_links);
params.mld_params.mld_addr = wpa_s->ap_mld_addr;
params.mld_params.valid_links = wpa_s->valid_links;
params.mld_params.assoc_link_id = wpa_s->mlo_assoc_link_id;
for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
if (!(wpa_s->valid_links & BIT(i)))
continue;
params.mld_params.mld_links[i].bssid =
wpa_s->links[i].bssid;
params.mld_params.mld_links[i].freq =
wpa_s->links[i].freq;
MLD: Add support for disabled APs An affiliated AP of an AP MLD can temporarily be disabled. Other affiliated APs of the AP MLD indicate this in the Reduced Neighbor Report (RNR) elements added to their Beacon and Probe Response frames. When an affiliated AP is disabled, it should be included in the association exchange, but can be activated only after it is enabled. Add support identifying disabled APs and propagate the information to the driver within the associate() callback. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-21 12:08:20 +01:00
params.mld_params.mld_links[i].disabled =
wpa_s->links[i].disabled;
SME: Add support for handling association with MLD In case both the local driver and the AP support MLD, request an MLD association from the driver. When processing the association event from the driver verify that the multi link information in the (Re)Association Response frame ML element matches the links on which the association was expected. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:07 +01:00
MLD: Add support for disabled APs An affiliated AP of an AP MLD can temporarily be disabled. Other affiliated APs of the AP MLD indicate this in the Reduced Neighbor Report (RNR) elements added to their Beacon and Probe Response frames. When an affiliated AP is disabled, it should be included in the association exchange, but can be activated only after it is enabled. Add support identifying disabled APs and propagate the information to the driver within the associate() callback. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-21 12:08:20 +01:00
wpa_printf(MSG_DEBUG,
"MLD: id=%u, freq=%d, disabled=%u, " MACSTR,
SME: Add support for handling association with MLD In case both the local driver and the AP support MLD, request an MLD association from the driver. When processing the association event from the driver verify that the multi link information in the (Re)Association Response frame ML element matches the links on which the association was expected. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:07 +01:00
i, wpa_s->links[i].freq,
MLD: Add support for disabled APs An affiliated AP of an AP MLD can temporarily be disabled. Other affiliated APs of the AP MLD indicate this in the Reduced Neighbor Report (RNR) elements added to their Beacon and Probe Response frames. When an affiliated AP is disabled, it should be included in the association exchange, but can be activated only after it is enabled. Add support identifying disabled APs and propagate the information to the driver within the associate() callback. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-21 12:08:20 +01:00
wpa_s->links[i].disabled,
SME: Add support for handling association with MLD In case both the local driver and the AP support MLD, request an MLD association from the driver. When processing the association event from the driver verify that the multi link information in the (Re)Association Response frame ML element matches the links on which the association was expected. Signed-off-by: Ilan Peer <ilan.peer@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2022-12-06 10:46:07 +01:00
MAC2STR(wpa_s->links[i].bssid));
}
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_associate(wpa_s, &params) < 0) {
MLD: Ignore failed links from association attempt If for some reason association fails and a link which has an error is reported, add that specific link to the ignore list. After that, immediately retrigger the connection code. In the usual case, we are then going to reconnect to the same AP MLD but with that particular link not being included in the connection. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-21 00:51:28 +01:00
unsigned int n_failed_links = 0;
int i;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
"driver failed");
MLD: Ignore failed links from association attempt If for some reason association fails and a link which has an error is reported, add that specific link to the ignore list. After that, immediately retrigger the connection code. In the usual case, we are then going to reconnect to the same AP MLD but with that particular link not being included in the connection. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-21 00:51:28 +01:00
/* Prepare list of failed links for error report */
for (i = 0; i < MAX_NUM_MLD_LINKS; i++) {
if (!(wpa_s->valid_links & BIT(i)) ||
wpa_s->mlo_assoc_link_id == i ||
!params.mld_params.mld_links[i].error)
continue;
wpa_bssid_ignore_add(wpa_s, wpa_s->links[i].bssid);
n_failed_links++;
}
if (n_failed_links) {
/* Deauth and connect (possibly to the same AP MLD) */
wpa_drv_deauthenticate(wpa_s, wpa_s->ap_mld_addr,
WLAN_REASON_DEAUTH_LEAVING);
wpas_connect_work_done(wpa_s);
wpa_supplicant_mark_disassoc(wpa_s);
wpas_request_connection(wpa_s);
} else {
wpas_connection_failed(wpa_s, wpa_s->pending_bssid,
NULL);
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
NULL);
Allow last (Re)Association Request frame to be replayed for testing The new wpa_supplicant RESEND_ASSOC command can be used to request the last (Re)Association Request frame to be sent to the AP to test FT protocol behavior. This functionality is for testing purposes and included only in builds with CONFIG_TESTING_OPTIONS=y. Signed-off-by: Jouni Malinen <j@w1.fi>
2017-10-15 22:25:55 +02:00
#ifdef CONFIG_TESTING_OPTIONS
wpabuf_free(wpa_s->last_assoc_req_wpa_ie);
wpa_s->last_assoc_req_wpa_ie = NULL;
if (params.wpa_ie)
wpa_s->last_assoc_req_wpa_ie =
wpabuf_alloc_copy(params.wpa_ie, params.wpa_ie_len);
#endif /* CONFIG_TESTING_OPTIONS */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
const u8 *ies, size_t ies_len)
{
if (md == NULL || ies == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_free(wpa_s->sme.ft_ies);
wpa_s->sme.ft_ies = NULL;
wpa_s->sme.ft_ies_len = 0;
wpa_s->sme.ft_used = 0;
return 0;
}
os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
os_free(wpa_s->sme.ft_ies);
Use os_memdup() This leads to cleaner code overall, and also reduces the size of the hostapd and wpa_supplicant binaries (in hwsim test build on x86_64) by about 2.5 and 3.5KiB respectively. The mechanical conversions all over the code were done with the following spatch: @@ expression SIZE, SRC; expression a; @@ -a = os_malloc(SIZE); +a = os_memdup(SRC, SIZE); <... if (!a) {...} ...> -os_memcpy(a, SRC, SIZE); Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2017-03-07 10:17:23 +01:00
wpa_s->sme.ft_ies = os_memdup(ies, ies_len);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_s->sme.ft_ies == NULL)
return -1;
wpa_s->sme.ft_ies_len = ies_len;
return 0;
}
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
static void sme_deauth(struct wpa_supplicant *wpa_s, const u8 **link_bssids)
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
{
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
int bssid_changed;
MLD: Use MLD MAC address for deauthentication When connecting, pending_bssid is set to the main link that we are authenticating/associating on. Later on, the MLD MAC address will be stored in the bssid, but we may also try to deauthenticate before we are connected and in that case, pending_bssid is not yet set to the MLD MAC address. As such, use the ap_mld_addr instead of pending_bssid if n_mld_links is non-zero. This is the sensible thing to do and expected behavior on nl80211. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:40 +01:00
const u8 *bssid;
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
MLD: Use MLD MAC address for deauthentication When connecting, pending_bssid is set to the main link that we are authenticating/associating on. Later on, the MLD MAC address will be stored in the bssid, but we may also try to deauthenticate before we are connected and in that case, pending_bssid is not yet set to the MLD MAC address. As such, use the ap_mld_addr instead of pending_bssid if n_mld_links is non-zero. This is the sensible thing to do and expected behavior on nl80211. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:40 +01:00
if (wpa_s->valid_links)
bssid = wpa_s->ap_mld_addr;
else
bssid = wpa_s->pending_bssid;
if (wpa_drv_deauthenticate(wpa_s, bssid,
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
WLAN_REASON_DEAUTH_LEAVING) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
"failed");
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
}
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
wpa_s->sme.prev_bssid_set = 0;
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid, link_bssids);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
static void sme_assoc_comeback_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (!wpa_s->current_bss || !wpa_s->current_ssid) {
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Comeback timeout expired; SSID/BSSID cleared; ignoring");
return;
}
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Comeback timeout expired; retry associating with "
MACSTR "; mode=%d auth_type=%u",
MAC2STR(wpa_s->current_bss->bssid),
wpa_s->current_ssid->mode,
wpa_s->sme.assoc_auth_type);
/* Authentication state was completed already; just try association
* again. */
sme_associate(wpa_s, wpa_s->current_ssid->mode,
wpa_s->current_bss->bssid,
wpa_s->sme.assoc_auth_type);
}
static bool sme_try_assoc_comeback(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
struct ieee802_11_elems elems;
u32 timeout_interval;
unsigned long comeback_usec;
tests: Association comeback mechanism in wpa_supplicant Allow the Timeout Interval Type field in the Timeout Interval element to be overridden with a different value for testing purposes to be able to bypass the association comeback processing in mac80211. This allows the wpa_supplicant internal functionality to be tested. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 11:17:07 +01:00
u8 type = WLAN_TIMEOUT_ASSOC_COMEBACK;
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->test_assoc_comeback_type != -1)
type = wpa_s->test_assoc_comeback_type;
#endif /* CONFIG_TESTING_OPTIONS */
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
if (ieee802_11_parse_elems(data->assoc_reject.resp_ies,
data->assoc_reject.resp_ies_len,
&elems, 0) == ParseFailed) {
wpa_msg(wpa_s, MSG_INFO,
"SME: Temporary assoc reject: failed to parse (Re)Association Response frame elements");
return false;
}
if (!elems.timeout_int) {
wpa_msg(wpa_s, MSG_INFO,
"SME: Temporary assoc reject: missing timeout interval IE");
return false;
}
tests: Association comeback mechanism in wpa_supplicant Allow the Timeout Interval Type field in the Timeout Interval element to be overridden with a different value for testing purposes to be able to bypass the association comeback processing in mac80211. This allows the wpa_supplicant internal functionality to be tested. Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-21 11:17:07 +01:00
if (elems.timeout_int[0] != type) {
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
wpa_msg(wpa_s, MSG_INFO,
"SME: Temporary assoc reject: missing association comeback time");
return false;
}
timeout_interval = WPA_GET_LE32(&elems.timeout_int[1]);
if (timeout_interval > 60000) {
/* This is unprotected information and there is no point in
* getting stuck waiting for very long duration based on it */
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Ignore overly long association comeback interval: %u TUs",
timeout_interval);
return false;
}
wpa_msg(wpa_s, MSG_DEBUG, "SME: Association comeback interval: %u TUs",
timeout_interval);
comeback_usec = timeout_interval * 1024;
eloop_register_timeout(comeback_usec / 1000000, comeback_usec % 1000000,
sme_assoc_comeback_timer, wpa_s, NULL);
return true;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
union wpa_event_data *data,
const u8 **link_bssids)
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
{
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
const u8 *bssid;
if (wpa_s->valid_links)
bssid = wpa_s->ap_mld_addr;
else
bssid = wpa_s->pending_bssid;
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
"status code %d", MAC2STR(wpa_s->pending_bssid),
data->assoc_reject.status_code);
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
/* Authentication phase has been completed at this point. Check whether
* the AP rejected association temporarily due to still holding a
* security associationis with us (MFP). If so, we must wait for the
* AP's association comeback timeout period before associating again. */
if (data->assoc_reject.status_code ==
WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY) {
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Temporary association reject from BSS " MACSTR,
MAC2STR(bssid));
if (sme_try_assoc_comeback(wpa_s, data)) {
/* Break out early; comeback error is not a failure. */
return;
}
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
#ifdef CONFIG_SAE
if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
wpa_sm_aborted_cached(wpa_s->wpa);
wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
if (wpa_s->current_bss) {
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
MLD: Use MLD MAC address for deauthentication When connecting, pending_bssid is set to the main link that we are authenticating/associating on. Later on, the MLD MAC address will be stored in the bssid, but we may also try to deauthenticate before we are connected and in that case, pending_bssid is not yet set to the MLD MAC address. As such, use the ap_mld_addr instead of pending_bssid if n_mld_links is non-zero. This is the sensible thing to do and expected behavior on nl80211. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:40 +01:00
wpa_drv_deauthenticate(wpa_s, bssid,
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
WLAN_REASON_DEAUTH_LEAVING);
wpas_connect_work_done(wpa_s);
wpa_supplicant_mark_disassoc(wpa_s);
wpa_supplicant_connect(wpa_s, bss, ssid);
return;
}
}
#endif /* CONFIG_SAE */
DPP: Drop PMKSA entry if AP reject association due to invalid PMKID This is needed to avoid trying the subsequent connections with the old PMKID that the AP claims not to hold and continues connection failures. This was already handled for the SME-in-the-driver case in commit commit 50b77f50e80f ("DPP: Flush PMKSA if an assoc reject without timeout is received"), but the wpa_supplicant SME case did not have matching processing. Add the needed check to avoid recover from cases where the AP has dropped its PMKSA cache entry. Do this only based on the specific status code value (53 = invalid PMKID) and only for the PMKSA entry that triggered this failure to minimize actions taken based on an unprotected (Re)Association Response frame. Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-20 07:00:36 +01:00
#ifdef CONFIG_DPP
if (wpa_s->current_ssid &&
wpa_s->current_ssid->key_mgmt == WPA_KEY_MGMT_DPP &&
!data->assoc_reject.timed_out &&
data->assoc_reject.status_code == WLAN_STATUS_INVALID_PMKID) {
struct rsn_pmksa_cache_entry *pmksa;
pmksa = pmksa_cache_get_current(wpa_s->wpa);
if (pmksa) {
wpa_dbg(wpa_s, MSG_DEBUG,
"DPP: Drop PMKSA cache entry for the BSS due to invalid PMKID report");
wpa_sm_pmksa_cache_remove(wpa_s->wpa, pmksa);
}
wpa_sm_aborted_cached(wpa_s->wpa);
if (wpa_s->current_bss) {
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
wpa_dbg(wpa_s, MSG_DEBUG,
"DPP: Try network introduction again");
wpas_connect_work_done(wpa_s);
wpa_supplicant_mark_disassoc(wpa_s);
wpa_supplicant_connect(wpa_s, bss, ssid);
return;
}
}
#endif /* CONFIG_DPP */
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
/*
* For now, unconditionally terminate the previous authentication. In
* theory, this should not be needed, but mac80211 gets quite confused
* if the authentication is left pending.. Some roaming cases might
* benefit from using the previous authentication, so this could be
* optimized in the future.
*/
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
sme_deauth(wpa_s, link_bssids);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
}
void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid, NULL);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
}
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
void sme_event_disassoc(struct wpa_supplicant *wpa_s,
Clean up wpa_supplicant_event() with deauth/disassoc helper functions wpa_supplicant_event() has grown overly large, so it is useful to split it into smaller pieces. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-07-21 15:40:40 +02:00
struct disassoc_info *info)
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
Remove user space client MLME This code was used only with driver_test.c to allow MLME operations in hostapd to be tested without having to use a real radio. There are no plans on extending this to any other use than testing and mac80211_hwsim has now obsoled the need for this type of testing. As such, we can drop this code from wpa_supplicant to clean up the implementation of unnecessary complexity.
2011-10-22 21:45:38 +02:00
if (wpa_s->sme.prev_bssid_set) {
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
/*
* cfg80211/mac80211 can get into somewhat confused state if
* the AP only disassociates us and leaves us in authenticated
* state. For now, force the state to be cleared to avoid
* confusing errors if we try to associate with the AP again.
*/
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
"driver state");
sme: Check for prev_bssid from sme_event_disassoc wpa_s->bssid is already cleared by mark_disassoc() when we're getting the disassociation event for the case where wpa_supplicant requested disassociation. wpa_s->sme.prev_bssid holds the BSSID we need to check for, so use that instead. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-18 20:23:26 +02:00
wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
WLAN_REASON_DEAUTH_LEAVING);
}
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
sme_deauth(wpa_s, NULL);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
}
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_ASSOCIATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
MLD: Also mark links as failed after association failure Parse the link status values out of Multi-Link association response. If the AP rejects ML association and marks the links as failed with a reason code other than TX_LINK_NOT_ACCEPTED, also report these links to wpas_connection_failed() and ignore them. Signed-off-by: Benjamin Berg <benjamin.berg@intel.com> Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-21 00:51:25 +01:00
sme_deauth(wpa_s, NULL);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
}
void sme_state_changed(struct wpa_supplicant *wpa_s)
{
/* Make sure timers are cleaned up appropriately. */
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
if (wpa_s->wpa_state != WPA_ASSOCIATING) {
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
if (wpa_s->wpa_state != WPA_AUTHENTICATING)
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
}
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
{
wpa_s->sme.prev_bssid_set = 0;
#ifdef CONFIG_SAE
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
sae_clear_data(&wpa_s->sme.sae);
#endif /* CONFIG_SAE */
#ifdef CONFIG_IEEE80211R
FT: Clear SME FT data on disassoc SME ft_used flag is sometimes not cleared on disassoc. For example, after initial FT connection, ft_used is set while ft_ies stays NULL. Later on, upon disassoc, sme_update_ft_ies() is not invoked and ft_used is not cleared. Fix this by invoking sme_update_ft_ies() also in case ft_used is set. This is needed to fix an issue with drivers that use nl80211 Connect API with FT and expect to the NL80211_AUTHTYPE_OPEN specified in the Connect command for the initial mobility domain association. Signed-off-by: Ahmad Masri <amasri@codeaurora.org>
2018-04-30 12:42:04 +02:00
if (wpa_s->sme.ft_ies || wpa_s->sme.ft_used)
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
sme_update_ft_ies(wpa_s, NULL, NULL, 0);
#endif /* CONFIG_IEEE80211R */
Stop SA Query on disconnection SA Query wasn't stopped after disconnection, which could potentially result in an unexpected SA timeout firing later when already connected to another AP. Fix that by stopping SA Query when an association is terminated. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2019-04-03 17:17:14 +02:00
sme_stop_sa_query(wpa_s);
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_deinit(struct wpa_supplicant *wpa_s)
{
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
sme_clear_on_disassoc(wpa_s);
SAE: Collect list of rejected groups for H2E in STA Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-09-06 14:40:39 +02:00
#ifdef CONFIG_SAE
os_free(wpa_s->sme.sae_rejected_groups);
wpa_s->sme.sae_rejected_groups = NULL;
#endif /* CONFIG_SAE */
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
SME: Handle PMF association comeback when not handled in driver In associations using PMF (IEEE 802.11w/MFP), the infrastructure implements SA teardown protection by rejecting an (Re)Association Request frame from an already-associated client. The AP responds with error 30 (Association request rejected temporarily) to instruct the (potentially spoofing) client to back off, while it issues an SA Query procedure to the already-associated client. If the client can respond to it within the back-off period, it considers the new association to be a spoof attempt. However, there are cases where a legitimate client might need to handle this error response - consider if the STA has deauthenticated, but the AP cannot hear it (out of range). If the MFP STA has deleted its keys, it cannot respond to the SA Query procedure. This association comeback process has commonly been implemented in the driver, e.g., within mac80211 in case of the Linux drivers that use SME in userspace. However, there are drivers that do not implement this functionality. Extended wpa_supplicant to cover such cases as well. The current implementation interprets this association error as a true error, and will either add the BSS to the list of ignored BSSIDs, or continue to try other BSSes. This can cause wpa_supplicant to back off trying to reconnect for progressively longer intervals, depending on the infrastructure's configured comeback timeout. Allow wpa_supplicant to interpret the error, searching for the Timeout Interval element in the (Re)Association Response frame and starting a timer in the SME layer to re-associate after the timeout. This can be a long delay (1-4 seconds in my experience), but it is likely much shorter than bouncing between nearby BSSes. This does not change behavior for drivers that implement association comeback timer internally since they do not report the temporary association rejection status code to user space. Signed-off-by: Harry Bock <hbock@zebra.com>
2024-01-10 20:09:09 +01:00
eloop_cancel_timeout(sme_assoc_comeback_timer, wpa_s, NULL);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
}
static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
const u8 *chan_list, u8 num_channels,
u8 num_intol)
{
struct ieee80211_2040_bss_coex_ie *bc_ie;
struct ieee80211_2040_intol_chan_report *ic_report;
struct wpabuf *buf;
SME: Add more debug prints for OBSS scans and 20/40 MHz co-ex report This makes it easier to debug wpa_supplicant behavior when reporting 20/40 MHz co-ex information based on OBSS scans. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:56:50 +01:00
wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
" (num_channels=%u num_intol=%u)",
MAC2STR(wpa_s->bssid), num_channels, num_intol);
wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
chan_list, num_channels);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
buf = wpabuf_alloc(2 + /* action.category + action_code */
sizeof(struct ieee80211_2040_bss_coex_ie) +
sizeof(struct ieee80211_2040_intol_chan_report) +
num_channels);
if (buf == NULL)
return;
wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
bc_ie->length = 1;
if (num_intol)
bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
if (num_channels > 0) {
ic_report = wpabuf_put(buf, sizeof(*ic_report));
ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
ic_report->length = num_channels + 1;
ic_report->op_class = 0;
os_memcpy(wpabuf_put(buf, num_channels), chan_list,
num_channels);
}
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
wpa_msg(wpa_s, MSG_INFO,
"SME: Failed to send 20/40 BSS Coexistence frame");
}
wpabuf_free(buf);
}
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
{
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
struct wpa_bss *bss;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
const u8 *ie;
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
u16 ht_cap;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
u8 chan_list[P2P_MAX_CHANNELS], channel;
u8 num_channels = 0, num_intol = 0, i;
if (!wpa_s->sme.sched_obss_scan)
return 0;
wpa_s->sme.sched_obss_scan = 0;
if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
return 1;
/*
* Check whether AP uses regulatory triplet or channel triplet in
* country info. Right now the operating class of the BSS channel
* width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
* based on the assumption that operating class triplet is not used in
* beacon frame. If the First Channel Number/Operating Extension
* Identifier octet has a positive integer value of 201 or greater,
* then its operating class triplet.
*
* TODO: If Supported Operating Classes element is present in beacon
* frame, have to lookup operating class in Annex E and fill them in
* 2040 coex frame.
*/
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
if (ie && (ie[1] >= 6) && (ie[5] >= 201))
return 1;
os_memset(chan_list, 0, sizeof(chan_list));
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
STA OBSS: Add check for overlapping BSSs In the previous implementation connected STA performs OBSS scan according to requests from its 20/40 MHz AP. However STA checks only 40 MHz intolerance subfield from HT Capabilities element in scan results. Meanwhile, as per IEEE Std 802.11-2016, 11.16.12, STA should check overlapping BSSs as well. Note that all the required code to check overlapping BSSs did already exist for AP mode since AP does those checks properly before operating as 20/40 MHz BSS in the 2.4 GHz band. Use that existing code by replace existing 40 MHz intolerance check in sme_proc_obss_scan() with the new shared helper function check_bss_coex_40mhz(). Signed-off-by: Sergey Matyukevich <sergey.matyukevich.os@quantenna.com>
2019-03-19 13:35:56 +01:00
/* Skip other band bss */
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
enum hostapd_hw_mode mode;
Use a common frequency to channel conversion function Signed-hostap: Jouni Malinen <j@w1.fi>
2013-04-27 20:27:15 +02:00
mode = ieee80211_freq_to_chan(bss->freq, &channel);
if (mode != HOSTAPD_MODE_IEEE80211G &&
mode != HOSTAPD_MODE_IEEE80211B)
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
continue;
Revert "STA OBSS: Add check for overlapping BSSs" This reverts commit 3204795d7a43bcbda8b695dd96d11f3000de7340. The commit adds an additional check that checks for overlapping BSSs in addition to the existing 40 MHz intolerance subfield checks. The commit cites IEEE Std 802.11-2016, 11.16.12, which defines the proper behavior for a 20/40 MHz HT STA and AP, but the standard actually doesn't say anything about overlapping BSSs. Specifically, the standard states that the only BSSs that belong in the Intolerant channel report are those that satisfy trigger event A, defined as channels with BSSs that don't contain the HT capabilities element (which wpa_supplicant already did before). Note that we also include channels with BSSs that have the 40 MHz intolerance bit set in the Intolerant channel report. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-12-10 18:59:22 +01:00
ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
" freq=%u chan=%u ht_cap=0x%x",
MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
SME: Fix OBSS scan result processing for 20/40 MHz co-ex report The 40 MHz intolerant bit needs to be checked before skipping the BSS based on the channel already being in the lost (which could have happened due to another BSS that does not indicate 40 MHz intolerant). This fixed the 20/40 MHz co-ex report to indicate 20 MHz request properly if there are both 40 MHz tolerant and intolerant BSSes on the same channel. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:54:50 +01:00
num_intol++;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
/* Check whether the channel is already considered */
for (i = 0; i < num_channels; i++) {
if (channel == chan_list[i])
break;
}
if (i != num_channels)
continue;
chan_list[num_channels++] = channel;
}
}
sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
return 1;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
struct wpa_driver_scan_params *params)
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
{
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
/* Include only affected channels */
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
struct hostapd_hw_modes *mode;
int count, i;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int start, end;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
Use bool for is_6ghz variables and functions Replace the implicit boolean checks that used int variables with use of a more explicit bool variable type. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-11 16:18:09 +01:00
HOSTAPD_MODE_IEEE80211G, false);
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode == NULL) {
/* No channels supported in this band - use empty list */
params->freqs = os_zalloc(sizeof(int));
return;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
wpa_s->current_bss) {
const u8 *ie;
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
if (ie && ie[1] >= 2) {
u8 o;
o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
}
}
start = wpa_s->assoc_freq - 10;
end = wpa_s->assoc_freq + 10;
switch (wpa_s->sme.ht_sec_chan) {
case HT_SEC_CHAN_UNKNOWN:
/* HT40+ possible on channels 1..9 */
if (wpa_s->assoc_freq <= 2452)
start -= 20;
/* HT40- possible on channels 5-13 */
if (wpa_s->assoc_freq >= 2432)
end += 20;
break;
case HT_SEC_CHAN_ABOVE:
end += 20;
break;
case HT_SEC_CHAN_BELOW:
start -= 20;
break;
}
wpa_printf(MSG_DEBUG,
"OBSS: assoc_freq %d possible affected range %d-%d",
wpa_s->assoc_freq, start, end);
Convert os_zalloc() for an array to use os_calloc() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 19:44:21 +02:00
params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (params->freqs == NULL)
return;
for (count = 0, i = 0; i < mode->num_channels; i++) {
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
continue;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
freq = mode->channels[i].freq;
if (freq - 10 >= end || freq + 10 <= start)
continue; /* not affected */
params->freqs[count++] = freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
}
}
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
struct wpa_driver_scan_params params;
if (!wpa_s->current_bss) {
wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
return;
}
os_memset(&params, 0, sizeof(params));
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_obss_scan_freqs_list(wpa_s, &params);
nl80211: Use low-priority scan for OBSS scan Some drivers may support low-priority scans, if they do then use that for OBSS scanning. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-06-04 11:21:40 +02:00
params.low_priority = 1;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
Scan 6 GHz channels after change to 6 GHz-allowed regdom Drivers will often report regdom changes in the middle of a scan if they detect during that scan that the regulatory domain has changed. If this happens and we enter a regdom that supports 6 GHz channels when the previous one didn't (this often happens in 6 GHz-capable regdoms for devices after suspend/resume), immediately trigger a 6 GHz-only scan if we were not able to connect to an AP on a legacy band. This should significantly improve connection time to 6 GHz AP after regdom has been reset. Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2023-06-03 00:15:11 +02:00
if (wpa_supplicant_trigger_scan(wpa_s, &params, true, false))
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
else
wpa_s->sme.sched_obss_scan = 1;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
os_free(params.freqs);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
}
void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
{
const u8 *ie;
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
struct hostapd_hw_modes *hw_mode = NULL;
int i;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
wpa_s->sme.sched_obss_scan = 0;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (!enable)
return;
Allow OBSS scan and 20/40 coex reports to non-SME drivers We enable this feature for non-SME drivers as well if they explicitly indicate need for it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com>
2012-11-24 17:08:48 +01:00
/*
* Schedule OBSS scan if driver is using station SME in wpa_supplicant
* or it expects OBSS scan to be performed by wpa_supplicant.
*/
if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
wpa_supplicant: Fix type for ssid->mode comparisons The ssid->mode is from type enum wpas_mode and all its constants start with WPAS_MODE_*. Still some of the code sections used the IEEE80211_MODE_* defines instead of WPAS_MODE_*. This should have no impact on the actual code because the constants for INFRA, IBSS, AP and MESH had the same values. Signed-off-by: Sven Eckelmann <seckelmann@datto.com>
2019-06-14 16:49:19 +02:00
ssid == NULL || ssid->mode != WPAS_MODE_INFRA)
Allow OBSS scan and 20/40 coex reports to non-SME drivers We enable this feature for non-SME drivers as well if they explicitly indicate need for it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com>
2012-11-24 17:08:48 +01:00
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
SME: No need for OBSS scan if HT40 is disabled Signed-off-by: Ernst Sjöstrand <ernst.sjostrand@verisure.com>
2021-12-09 14:08:56 +01:00
#ifdef CONFIG_HT_OVERRIDES
/* No need for OBSS scan if HT40 is explicitly disabled */
if (ssid->disable_ht40)
return;
#endif /* CONFIG_HT_OVERRIDES */
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
if (!wpa_s->hw.modes)
return;
/* only HT caps in 11g mode are relevant */
for (i = 0; i < wpa_s->hw.num_modes; i++) {
hw_mode = &wpa_s->hw.modes[i];
if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
break;
}
/* Driver does not support HT40 for 11g or doesn't have 11g. */
if (i == wpa_s->hw.num_modes || !hw_mode ||
!(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
return; /* Not associated on 2.4 GHz band */
/* Check whether AP supports HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
if (!ie || ie[1] < 2 ||
!(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return; /* AP does not support HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss,
WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
if (!ie || ie[1] < 14)
return; /* AP does not request OBSS scans */
wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
if (wpa_s->sme.obss_scan_int < 10) {
wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
"replaced with the minimum 10 sec",
wpa_s->sme.obss_scan_int);
wpa_s->sme.obss_scan_int = 10;
}
wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
wpa_s->sme.obss_scan_int);
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
static const unsigned int sa_query_max_timeout = 1000;
static const unsigned int sa_query_retry_timeout = 201;
OCV: Perform an SA Query after a channel switch After the network changed to a new channel, perform an SA Query with the AP after a random delay if OCV was negotiated for the association. This is used to confirm that we are still operating on the real operating channel of the network. This commit is adding only the station side functionality for this, i.e., the AP behavior is not changed to disconnect stations with OCV that do not go through SA Query. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:35 +02:00
static const unsigned int sa_query_ch_switch_max_delay = 5000; /* in usec */
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
{
u32 tu;
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
struct os_reltime now, passed;
os_get_reltime(&now);
os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
tu = (passed.sec * 1000000 + passed.usec) / 1024;
if (sa_query_max_timeout < tu) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
wpa_supplicant_deauthenticate(
wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
return 1;
}
return 0;
}
static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
const u8 *trans_id)
{
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
u8 req_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
MACSTR, MAC2STR(wpa_s->bssid));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
trans_id, WLAN_SA_QUERY_TR_ID_LEN);
req[0] = WLAN_ACTION_SA_QUERY;
req[1] = WLAN_SA_QUERY_REQUEST;
os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct wpa_channel_info ci;
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info for OCI element in SA Query Request frame");
return;
}
OCV: Add support to override channel info OCI element (STA) To support the STA testbed role, the STA has to use specified channel information in OCI element sent to the AP in EAPOL-Key msg 2/4, SA Query Request, and SA Query Response frames. Add override parameters to use the specified channel while populating OCI element in all these frames. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-08 19:59:04 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->oci_freq_override_saquery_req) {
wpa_printf(MSG_INFO,
"TEST: Override SA Query Request OCI frequency %d -> %d MHz",
ci.frequency,
wpa_s->oci_freq_override_saquery_req);
ci.frequency = wpa_s->oci_freq_override_saquery_req;
}
#endif /* CONFIG_TESTING_OPTIONS */
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
if (ocv_insert_extended_oci(&ci, req + req_len) < 0)
return;
req_len += OCV_OCI_EXTENDED_LEN;
}
#endif /* CONFIG_OCV */
P2P: Add option for offloading off-channel TX to the driver With the new kernel functionality coming to Linux to allow off-channel TX, we can take advantage of that in the P2P code that currently uses remain-on-channel. If a driver advertises support for it, it will be asked to handle off-channel TX by itself. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2010-12-29 12:59:17 +01:00
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_s->own_addr, wpa_s->bssid,
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
req, req_len, 0) < 0)
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
"Request");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
unsigned int timeout, sec, usec;
u8 *trans_id, *nbuf;
if (wpa_s->sme.sa_query_count > 0 &&
sme_check_sa_query_timeout(wpa_s))
return;
Convert os_realloc() for an array to use os_realloc_array() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 20:21:23 +02:00
nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
wpa_s->sme.sa_query_count + 1,
WLAN_SA_QUERY_TR_ID_LEN);
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
if (nbuf == NULL) {
sme_stop_sa_query(wpa_s);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (wpa_s->sme.sa_query_count == 0) {
/* Starting a new SA Query procedure */
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
os_get_reltime(&wpa_s->sme.sa_query_start);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
wpa_s->sme.sa_query_trans_id = nbuf;
wpa_s->sme.sa_query_count++;
SME: Verify that os_get_random() succeeds for SA Query Be more consistent on checking os_get_random() return value (CID 72706). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-09-07 17:27:42 +02:00
if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
SME: Fix SA Query local failure handling If no new sme_sa_query_timer() callback is scheculed, sme_stop_sa_query() needs to be called to allow new SA Query operations to be started after the failure. Signed-off-by: Jouni Malinen <j@w1.fi>
2016-07-17 23:57:34 +02:00
sme_stop_sa_query(wpa_s);
SME: Verify that os_get_random() succeeds for SA Query Be more consistent on checking os_get_random() return value (CID 72706). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-09-07 17:27:42 +02:00
return;
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
timeout = sa_query_retry_timeout;
sec = ((timeout / 1000) * 1024) / 1000;
usec = (timeout % 1000) * 1024;
eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
wpa_s->sme.sa_query_count);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_send_sa_query_req(wpa_s, trans_id);
}
static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
{
sme_sa_query_timer(wpa_s, NULL);
}
Mark local functions static These functions are not used outside the file in which they are defined. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-18 20:53:36 +01:00
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
{
Add debug print on stopping SA Query procedure This makes it easier to debug SA Query behavior. Signed-off-by: Jouni Malinen <j@w1.fi>
2019-04-15 23:42:09 +02:00
if (wpa_s->sme.sa_query_trans_id)
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Stop SA Query");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
os_free(wpa_s->sme.sa_query_trans_id);
wpa_s->sme.sa_query_trans_id = NULL;
wpa_s->sme.sa_query_count = 0;
}
void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
const u8 *da, u16 reason_code)
{
struct wpa_ssid *ssid;
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
struct os_reltime now;
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (wpa_s->wpa_state != WPA_COMPLETED)
return;
ssid = wpa_s->current_ssid;
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(sa, wpa_s->bssid))
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
return;
if (wpa_s->sme.sa_query_count > 0)
return;
Allow SA Query to be disabled for testing purposes The new wpa_supplicant control interface SET parameter disable_sa_query can now be used to disable SA Query on receiving unprotected disconnection event. Signed-off-by: Jouni Malinen <j@w1.fi>
2020-03-21 17:12:02 +01:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->disable_sa_query)
return;
#endif /* CONFIG_TESTING_OPTIONS */
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
os_get_reltime(&now);
if (wpa_s->sme.last_unprot_disconnect.sec &&
!os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
return; /* limit SA Query procedure frequency */
wpa_s->sme.last_unprot_disconnect = now;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
"possible AP/STA state mismatch - trigger SA Query");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_start_sa_query(wpa_s);
}
OCV: Perform an SA Query after a channel switch After the network changed to a new channel, perform an SA Query with the AP after a random delay if OCV was negotiated for the association. This is used to confirm that we are still operating on the real operating channel of the network. This commit is adding only the station side functionality for this, i.e., the AP behavior is not changed to disconnect stations with OCV that do not go through SA Query. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:35 +02:00
void sme_event_ch_switch(struct wpa_supplicant *wpa_s)
{
unsigned int usec;
u32 _rand;
if (wpa_s->wpa_state != WPA_COMPLETED ||
!wpa_sm_ocv_enabled(wpa_s->wpa))
return;
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Channel switch completed - trigger new SA Query to verify new operating channel");
sme_stop_sa_query(wpa_s);
if (os_get_random((u8 *) &_rand, sizeof(_rand)) < 0)
_rand = os_random();
usec = _rand % (sa_query_ch_switch_max_delay + 1);
eloop_register_timeout(0, usec, sme_sa_query_timer, wpa_s, NULL);
}
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
static void sme_process_sa_query_request(struct wpa_supplicant *wpa_s,
const u8 *sa, const u8 *data,
size_t len)
{
u8 resp[2 + WLAN_SA_QUERY_TR_ID_LEN + OCV_OCI_EXTENDED_LEN];
u8 resp_len = 2 + WLAN_SA_QUERY_TR_ID_LEN;
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Response to "
MACSTR, MAC2STR(wpa_s->bssid));
resp[0] = WLAN_ACTION_SA_QUERY;
resp[1] = WLAN_SA_QUERY_RESPONSE;
os_memcpy(resp + 2, data + 1, WLAN_SA_QUERY_TR_ID_LEN);
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct wpa_channel_info ci;
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info for OCI element in SA Query Response frame");
return;
}
OCV: Add support to override channel info OCI element (STA) To support the STA testbed role, the STA has to use specified channel information in OCI element sent to the AP in EAPOL-Key msg 2/4, SA Query Request, and SA Query Response frames. Add override parameters to use the specified channel while populating OCI element in all these frames. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-08 19:59:04 +02:00
#ifdef CONFIG_TESTING_OPTIONS
if (wpa_s->oci_freq_override_saquery_resp) {
wpa_printf(MSG_INFO,
"TEST: Override SA Query Response OCI frequency %d -> %d MHz",
ci.frequency,
wpa_s->oci_freq_override_saquery_resp);
ci.frequency = wpa_s->oci_freq_override_saquery_resp;
}
#endif /* CONFIG_TESTING_OPTIONS */
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
if (ocv_insert_extended_oci(&ci, resp + resp_len) < 0)
return;
resp_len += OCV_OCI_EXTENDED_LEN;
}
#endif /* CONFIG_OCV */
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
resp, resp_len, 0) < 0)
wpa_msg(wpa_s, MSG_INFO,
"SME: Failed to send SA Query Response");
}
static void sme_process_sa_query_response(struct wpa_supplicant *wpa_s,
const u8 *sa, const u8 *data,
size_t len)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
{
int i;
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
if (!wpa_s->sme.sa_query_trans_id)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
Use ether_addr_equal() to compare whether two MAC addresses are equal This was done with spatch using the following semantic patch and minor manual edits to clean up coding style and avoid compiler warnings in driver_wext.c: @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) == 0 + ether_addr_equal(a, b) @@ expression a,b; @@ - os_memcmp(a, b, ETH_ALEN) != 0 + !ether_addr_equal(a, b) @@ expression a,b; @@ - !os_memcmp(a, b, ETH_ALEN) + ether_addr_equal(a, b) Signed-off-by: Jouni Malinen <j@w1.fi>
2024-01-13 22:15:36 +01:00
if (!ether_addr_equal(sa, wpa_s->bssid))
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
if (os_memcmp(wpa_s->sme.sa_query_trans_id +
i * WLAN_SA_QUERY_TR_ID_LEN,
data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
break;
}
if (i >= wpa_s->sme.sa_query_count) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
"transaction identifier found");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
"from " MACSTR, MAC2STR(sa));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
}
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
Ignore group-addressed SA Query frames These frames are used for verifying that a specific SA and protected link is in functional state between two devices. The IEEE 802.11 standard defines only a case that uses individual MAC address as the destination. While there is no explicit rule on the receiver to ignore other cases, it seems safer to make sure group-addressed frames do not end up resulting in undesired behavior. As such, drop such frames instead of interpreting them as valid SA Query Request/Response. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-16 10:34:50 +01:00
void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *da, const u8 *sa,
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
const u8 *data, size_t len)
{
if (len < 1 + WLAN_SA_QUERY_TR_ID_LEN)
return;
Ignore group-addressed SA Query frames These frames are used for verifying that a specific SA and protected link is in functional state between two devices. The IEEE 802.11 standard defines only a case that uses individual MAC address as the destination. While there is no explicit rule on the receiver to ignore other cases, it seems safer to make sure group-addressed frames do not end up resulting in undesired behavior. As such, drop such frames instead of interpreting them as valid SA Query Request/Response. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-16 10:34:50 +01:00
if (is_multicast_ether_addr(da)) {
wpa_printf(MSG_DEBUG,
"IEEE 802.11: Ignore group-addressed SA Query frame (A1=" MACSTR " A2=" MACSTR ")",
MAC2STR(da), MAC2STR(sa));
return;
}
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query frame from "
MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
#ifdef CONFIG_OCV
if (wpa_sm_ocv_enabled(wpa_s->wpa)) {
struct ieee802_11_elems elems;
struct wpa_channel_info ci;
if (ieee802_11_parse_elems(data + 1 + WLAN_SA_QUERY_TR_ID_LEN,
len - 1 - WLAN_SA_QUERY_TR_ID_LEN,
&elems, 1) == ParseFailed) {
wpa_printf(MSG_DEBUG,
"SA Query: Failed to parse elements");
return;
}
if (wpa_drv_channel_info(wpa_s, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info to validate received OCI in SA Query Action frame");
return;
}
if (ocv_verify_tx_params(elems.oci, elems.oci_len, &ci,
channel_width_to_int(ci.chanwidth),
OCV: Use more granular error codes for OCI validation failures Enhance the return values of ocv_verify_tx_params with enum to indicate different OCI verification failures to caller. Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-09-02 20:55:28 +02:00
ci.seg1_idx) != OCI_SUCCESS) {
OCV: Report OCI validation failures with OCV-FAILURE messages (STA) Convert the previously used text log entries to use the more formal OCV-FAILURE prefix and always send these as control interface events to allow upper layers to get information about unexpected operating channel mismatches. Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-05-29 23:24:15 +02:00
wpa_msg(wpa_s, MSG_INFO, OCV_FAILURE "addr=" MACSTR
" frame=saquery%s error=%s",
MAC2STR(sa), data[0] == WLAN_SA_QUERY_REQUEST ?
"req" : "resp", ocv_errorstr);
OCV: Include and verify OCI in SA Query frames Include an OCI element in SA Query Request and Response frames if OCV has been negotiated. On Linux, a kernel patch is needed to let clients correctly handle SA Query Requests that contain an OCI element. Without this patch, the kernel will reply to the SA Query Request itself, without verifying the included OCI. Additionally, the SA Query Response sent by the kernel will not include an OCI element. The correct operation of the AP does not require a kernel patch. Without the corresponding kernel patch, SA Query Requests sent by the client are still valid, meaning they do include an OCI element. Note that an AP does not require any kernel patches. In other words, SA Query frames sent and received by the AP are properly handled, even without a kernel patch. As a result, the kernel patch is only required to make the client properly process and respond to a SA Query Request from the AP. Without this patch, the client will send a SA Query Response without an OCI element, causing the AP to silently ignore the response and eventually disconnect the client from the network if OCV has been negotiated to be used. Signed-off-by: Mathy Vanhoef <Mathy.Vanhoef@cs.kuleuven.be>
2018-08-06 21:46:34 +02:00
return;
}
}
#endif /* CONFIG_OCV */
if (data[0] == WLAN_SA_QUERY_REQUEST)
sme_process_sa_query_request(wpa_s, sa, data, len);
else if (data[0] == WLAN_SA_QUERY_RESPONSE)
sme_process_sa_query_response(wpa_s, sa, data, len);
}
Reference in a new issue Copy permalink