DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
hostapd/wpa_supplicant/sme.c

1625 lines
46 KiB
C
Raw Normal View History

Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* wpa_supplicant - SME
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
* Copyright (c) 2009-2014, Jouni Malinen <j@w1.fi>
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*
Remove the GPL notification from files contributed by Jouni Malinen Remove the GPL notification text from the files that were initially contributed by myself. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-02-11 15:46:35 +01:00
* This software may be distributed under the terms of the BSD license.
* See README for more details.
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
*/
#include "includes.h"
#include "common.h"
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
#include "utils/eloop.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/ieee802_11_defs.h"
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
#include "common/ieee802_11_common.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "eapol_supp/eapol_supp_sm.h"
Remove src/common from default header file path This makes it clearer which files are including header from src/common. Some of these cases should probably be cleaned up in the future not to do that. In addition, src/common/nl80211_copy.h and wireless_copy.h were moved into src/drivers since they are only used by driver wrappers and do not need to live in src/common.
2009-11-29 16:51:55 +01:00
#include "common/wpa_common.h"
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#include "common/sae.h"
Remove src/rsn_supp from default header path
2009-11-29 17:28:08 +01:00
#include "rsn_supp/wpa.h"
#include "rsn_supp/pmksa_cache.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "config.h"
#include "wpa_supplicant_i.h"
Add preliminary hostapd data structure initialization for AP mode wpa_supplicant can now initialize hostapd data structures when mode=2 is used to set up an AP. The hostapd configuration is not yet set based on wpa_supplicant network configuration block. In addition, the glue code for hostapd driver_ops needs number of functions that will be needed for AP functionality.
2009-03-26 19:37:05 +01:00
#include "driver_i.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "wpas_glue.h"
#include "wps_supplicant.h"
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#include "p2p_supplicant.h"
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
#include "notify.h"
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
#include "bss.h"
Move wpa_supplicant specific scan code away from src/drivers This fits better in wpa_supplicant/scan.c. Couple of remaining scan_helpers.c functions are currently used in driver wrappers, but they can likely be removed in the future.
2010-01-03 17:48:11 +01:00
#include "scan.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#include "sme.h"
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
#include "hs20_supplicant.h"
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
#define SME_AUTH_TIMEOUT 5
#define SME_ASSOC_TIMEOUT 5
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx);
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
#ifdef CONFIG_IEEE80211W
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s);
#endif /* CONFIG_IEEE80211W */
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
static int index_within_array(const int *array, int idx)
{
int i;
for (i = 0; i < idx; i++) {
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (array[i] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
return 0;
}
return 1;
}
static int sme_set_sae_group(struct wpa_supplicant *wpa_s)
{
int *groups = wpa_s->conf->sae_groups;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
int default_groups[] = { 19, 20, 21, 25, 26, 0 };
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (!groups || groups[0] <= 0)
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
groups = default_groups;
/* Configuration may have changed, so validate current index */
if (!index_within_array(groups, wpa_s->sme.sae_group_index))
return -1;
for (;;) {
int group = groups[wpa_s->sme.sae_group_index];
if (group < 0)
break;
if (sae_set_group(&wpa_s->sme.sae, group) == 0) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected SAE group %d",
wpa_s->sme.sae.group);
return 0;
}
wpa_s->sme.sae_group_index++;
}
return -1;
}
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
static struct wpabuf * sme_auth_build_sae_commit(struct wpa_supplicant *wpa_s,
struct wpa_ssid *ssid,
const u8 *bssid)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
{
struct wpabuf *buf;
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
size_t len;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
if (ssid->passphrase == NULL) {
wpa_printf(MSG_DEBUG, "SAE: No password available");
return NULL;
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (sme_set_sae_group(wpa_s) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Failed to select group");
SAE: Maintain EC group context in struct sae_data This can be used to share same EC group context through the SAE exchange. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 10:29:53 +01:00
return NULL;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
}
SAE: Maintain EC group context in struct sae_data This can be used to share same EC group context through the SAE exchange. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 10:29:53 +01:00
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
if (sae_prepare_commit(wpa_s->own_addr, bssid,
(u8 *) ssid->passphrase,
os_strlen(ssid->passphrase),
&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Could not pick PWE");
return NULL;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
len = wpa_s->sme.sae_token ? wpabuf_len(wpa_s->sme.sae_token) : 0;
buf = wpabuf_alloc(4 + SAE_COMMIT_MAX_LEN + len);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
return NULL;
wpabuf_put_le16(buf, 1); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
sae_write_commit(&wpa_s->sme.sae, buf, wpa_s->sme.sae_token);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
}
static struct wpabuf * sme_auth_build_sae_confirm(struct wpa_supplicant *wpa_s)
{
struct wpabuf *buf;
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
buf = wpabuf_alloc(4 + SAE_CONFIRM_MAX_LEN);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (buf == NULL)
return NULL;
wpabuf_put_le16(buf, 2); /* Transaction seq# */
wpabuf_put_le16(buf, WLAN_STATUS_SUCCESS);
SAE: Add generation of the confirm message fields Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:28:57 +01:00
sae_write_confirm(&wpa_s->sme.sae, buf);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return buf;
}
#endif /* CONFIG_SAE */
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
/**
* sme_auth_handle_rrm - Handle RRM aspects of current authentication attempt
* @wpa_s: Pointer to wpa_supplicant data
* @bss: Pointer to the bss which is the target of authentication attempt
*/
static void sme_auth_handle_rrm(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss)
{
const u8 rrm_ie_len = 5;
u8 *pos;
const u8 *rrm_ie;
wpa_s->rrm.rrm_used = 0;
wpa_printf(MSG_DEBUG,
"RRM: Determining whether RRM can be used - device support: 0x%x",
wpa_s->drv_rrm_flags);
rrm_ie = wpa_bss_get_ie(bss, WLAN_EID_RRM_ENABLED_CAPABILITIES);
if (!rrm_ie || !(bss->caps & IEEE80211_CAP_RRM)) {
wpa_printf(MSG_DEBUG, "RRM: No RRM in network");
return;
}
if (!(wpa_s->drv_rrm_flags &
WPA_DRIVER_FLAGS_DS_PARAM_SET_IE_IN_PROBES) ||
!(wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_QUIET)) {
wpa_printf(MSG_DEBUG,
"RRM: Insufficient RRM support in driver - do not use RRM");
return;
}
SME: Fix a sign-compare warning Signed-off-by: Jouni Malinen <j@w1.fi>
2014-11-25 00:07:16 +01:00
if (sizeof(wpa_s->sme.assoc_req_ie) <
wpa_s->sme.assoc_req_ie_len + rrm_ie_len + 2) {
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_printf(MSG_INFO,
"RRM: Unable to use RRM, no room for RRM IE");
return;
}
wpa_printf(MSG_DEBUG, "RRM: Adding RRM IE to Association Request");
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
os_memset(pos, 0, 2 + rrm_ie_len);
*pos++ = WLAN_EID_RRM_ENABLED_CAPABILITIES;
*pos++ = rrm_ie_len;
wpa_supplicant: Handle link measurement requests Send link measurement response when a request is received. Advertise only RCPI, computing it from the RSSI of the request. The TX power field is left to be filled by the driver. All other fields are not published. Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-11-05 09:42:56 +01:00
/* Set supported capabilites flags */
if (wpa_s->drv_rrm_flags & WPA_DRIVER_FLAGS_TX_POWER_INSERTION)
*pos |= WLAN_RRM_CAPS_LINK_MEASUREMENT;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
wpa_s->sme.assoc_req_ie_len += rrm_ie_len + 2;
wpa_s->rrm.rrm_used = 1;
}
Mark sme_send_authentication() static This function is not used outside sme.c. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-25 14:47:43 +01:00
static void sme_send_authentication(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid,
int start)
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
{
struct wpa_driver_auth_params params;
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
struct wpa_ssid *old_ssid;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#ifdef CONFIG_IEEE80211R
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
const u8 *ie;
Fix CONFIG_AP=y build after driver API changes
2010-01-03 12:05:54 +01:00
#endif /* CONFIG_IEEE80211R */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
const u8 *md = NULL;
#endif /* CONFIG_IEEE80211R */
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
int i, bssid_changed;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
struct wpabuf *resp = NULL;
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
u8 ext_capab[18];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
int ext_capab_len;
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
int skip_auth;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (bss == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_ERROR, "SME: No scan result available for "
"the network");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
skip_auth = wpa_s->conf->reassoc_same_bss_optim &&
wpa_s->reassoc_same_bss;
Maintain a pointer to the current BSS table entry
2010-01-02 15:59:19 +01:00
wpa_s->current_bss = bss;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(&params, 0, sizeof(params));
wpa_s->reassociate = 0;
params.freq = bss->freq;
params.bssid = bss->bssid;
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
params.ssid = bss->ssid;
params.ssid_len = bss->ssid_len;
nl80211: Change vif type to P2P_CLI upon P2P authentication Currently, wpa_driver_nl80211_authenticate() changes the interface type to station. However, in case of P2P, we need to change the interface type to P2P_CLI. Add p2p field to the authentication params, and consider it for choosing the correct interface type. Signed-off-by: Eliad Peller <eliad@wizery.com>
2011-07-17 19:25:58 +02:00
params.p2p = ssid->p2p_group;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.ssid_len != params.ssid_len ||
os_memcmp(wpa_s->sme.ssid, params.ssid, params.ssid_len) != 0)
wpa_s->sme.prev_bssid_set = 0;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.freq = params.freq;
os_memcpy(wpa_s->sme.ssid, params.ssid, params.ssid_len);
wpa_s->sme.ssid_len = params.ssid_len;
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_OPEN;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef IEEE8021X_EAPOL
if (ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) {
if (ssid->leap) {
if (ssid->non_leap == 0)
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
else
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg |= WPA_AUTH_ALG_LEAP;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
}
#endif /* IEEE8021X_EAPOL */
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Automatic auth_alg selection: 0x%x",
params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ssid->auth_alg) {
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = ssid->auth_alg;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "Overriding auth_alg selection: "
"0x%x", params.auth_alg);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_s->sme.sae_pmksa_caching = 0;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (wpa_key_mgmt_sae(ssid->key_mgmt)) {
const u8 *rsn;
struct wpa_ie_data ied;
rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add more debug prints for WPA/RSN selection issues for connection ap_ft_sae test case managed to hit a somewhat unclear error case which resulted in "WPA: Failed to select WPA/RSN" print and not enough information to figure out what exactly had went wrong. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 12:49:52 +01:00
if (!rsn) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise RSN");
} else if (wpa_parse_wpa_ie(rsn, 2 + rsn[1], &ied) == 0 &&
wpa_key_mgmt_sae(ied.key_mgmt)) {
wpa_dbg(wpa_s, MSG_DEBUG, "Using SAE auth_alg");
params.auth_alg = WPA_AUTH_ALG_SAE;
} else {
wpa_dbg(wpa_s, MSG_DEBUG,
"SAE enabled, but target BSS does not advertise SAE AKM for RSN");
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
nl80211: Fix static WEP key configuration when using SME Need to set WEP keys before requesting authentication in order to get Shared Key authentication working. Previously, the WEP keys were not set at all when using SME in wpa_supplicant.
2009-04-04 15:58:16 +02:00
for (i = 0; i < NUM_WEP_KEYS; i++) {
if (ssid->wep_key_len[i])
params.wep_key[i] = ssid->wep_key[i];
params.wep_key_len[i] = ssid->wep_key_len[i];
}
params.wep_tx_keyidx = ssid->wep_tx_keyidx;
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memcpy(wpa_s->pending_bssid, bss->bssid, ETH_ALEN);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
Remove unnecessary bss != NULL checks from sme_authenticate() This is already verified in the beginning of the function, so no need to repeat that multiple times.
2010-01-10 20:31:54 +01:00
if ((wpa_bss_get_vendor_ie(bss, WPA_IE_VENDOR_TYPE) ||
wpa_bss_get_ie(bss, WLAN_EID_RSN)) &&
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
wpa_key_mgmt_wpa(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
int try_opportunistic;
Allow OKC to be enabled by default Previously, OKC (opportunistic key caching, a.k.a. proactive key caching) could be enabled only with a per-network parameter (proactive_key_caching). The new global parameter (okc) can now be used to change the default behavior to be OKC enabled (okc=1) for network blocks that do not override this with the proactive_key_caching parameter. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-12 19:07:53 +01:00
try_opportunistic = (ssid->proactive_key_caching < 0 ?
wpa_s->conf->okc :
ssid->proactive_key_caching) &&
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
(ssid->proto & WPA_PROTO_RSN);
if (pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid,
wpa_s->current_ssid,
try_opportunistic) == 0)
Simplify eapol_sm_notify_pmkid_attempt() Drop the unneeded 'attempt' argument. This was originally used for indicating an aborted PMKID caching attempt, but a fix in 2006 removed the only such user and since that time, only attempt == 1 has been used. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-28 00:26:14 +01:00
eapol_sm_notify_pmkid_attempt(wpa_s->eapol);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, bss, ssid,
wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Allow non-WPA IEEE 802.1X to be select even if WPA is also enabled If key_mgmt was set to allow both WPA and non-WPA IEEE 802.1X (i.e., to IEEE8021X WPA-EAP), non-WPA IEEE 802.1X was rejected while preparing association parameters. Allow this special case to be handled by selecting non-WPA case if the scan results for the AP do not include either WPA or RSN elements. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-15 18:34:04 +02:00
} else if ((ssid->key_mgmt & WPA_KEY_MGMT_IEEE8021X_NO_WPA) &&
wpa_key_mgmt_wpa_ieee8021x(ssid->key_mgmt)) {
/*
* Both WPA and non-WPA IEEE 802.1X enabled in configuration -
* use non-WPA since the scan results did not indicate that the
* AP is using WPA or WPA2.
*/
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
} else if (wpa_key_mgmt_wpa_any(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len = sizeof(wpa_s->sme.assoc_req_ie);
if (wpa_supplicant_set_suites(wpa_s, NULL, ssid,
wpa_s->sme.assoc_req_ie,
&wpa_s->sme.assoc_req_ie_len)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_WARNING, "SME: Failed to set WPA "
"key management and encryption suites (no "
"scan results)");
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
#ifdef CONFIG_WPS
} else if (ssid->key_mgmt & WPA_KEY_MGMT_WPS) {
struct wpabuf *wps_ie;
wps_ie = wps_build_assoc_req_ie(wpas_wps_get_req_type(ssid));
if (wps_ie && wpabuf_len(wps_ie) <=
sizeof(wpa_s->sme.assoc_req_ie)) {
wpa_s->sme.assoc_req_ie_len = wpabuf_len(wps_ie);
os_memcpy(wpa_s->sme.assoc_req_ie, wpabuf_head(wps_ie),
wpa_s->sme.assoc_req_ie_len);
} else
wpa_s->sme.assoc_req_ie_len = 0;
wpabuf_free(wps_ie);
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
#endif /* CONFIG_WPS */
} else {
wpa_supplicant_set_non_wpa_policy(wpa_s, ssid);
wpa_s->sme.assoc_req_ie_len = 0;
}
#ifdef CONFIG_IEEE80211R
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
ie = wpa_bss_get_ie(bss, WLAN_EID_MOBILITY_DOMAIN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (ie && ie[1] >= MOBILITY_DOMAIN_ID_LEN)
md = ie + 2;
FT: Clean up wpa_sm_set_ft_params() by using common parse Instead of parsing the IEs in the callers, use the already existing parser in wpa_ft.c to handle MDIE and FTIE from initial MD association response. In addition, this provides more complete access to association response IEs to FT code which will be needed to fix FT 4-way handshake message 2/4.
2010-04-10 10:36:35 +02:00
wpa_sm_set_ft_params(wpa_s->wpa, ie, ie ? 2 + ie[1] : 0);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (md) {
/* Prepare for the next transition */
FT: Copy FT Capability and Policy to MDIE from target AP This sets the FT Capability and Policy field in the MDIE to the values received from the target AP (if available). This fixes the MDIE contents during FT Protocol, but the correct value may not yet be used in initial mobility domain association.
2010-04-09 15:26:20 +02:00
wpa_ft_prepare_auth_request(wpa_s->wpa, ie);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Use wpa_key_mgmt_*() helpers This cleans up the source code and makes it less likely that new AKM addition misses some needed changes in the future. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-24 21:46:14 +01:00
if (md && wpa_key_mgmt_ft(ssid->key_mgmt)) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_s->sme.assoc_req_ie_len + 5 <
sizeof(wpa_s->sme.assoc_req_ie)) {
struct rsn_mdie *mdie;
u8 *pos = wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len;
*pos++ = WLAN_EID_MOBILITY_DOMAIN;
*pos++ = sizeof(*mdie);
mdie = (struct rsn_mdie *) pos;
os_memcpy(mdie->mobility_domain, md,
MOBILITY_DOMAIN_ID_LEN);
FT: Set FT Capability and Policy properly in MDIE during initial MD assoc This field needs to be copied from the scan results for the AP per IEEE Std 802.11r-2008, 11A.4.2.
2010-04-09 15:41:57 +02:00
mdie->ft_capab = md[MOBILITY_DOMAIN_ID_LEN];
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.assoc_req_ie_len += 5;
}
if (wpa_s->sme.ft_used &&
SME: Do not try to use FT over-the-air if PTK is not available
2010-04-10 21:39:49 +02:00
os_memcmp(md, wpa_s->sme.mobility_domain, 2) == 0 &&
wpa_sm_has_ptk(wpa_s->wpa)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying to use FT "
"over-the-air");
Standardize on a single definition of auth_alg bitfield values
2010-01-03 20:14:40 +01:00
params.auth_alg = WPA_AUTH_ALG_FT;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ie = wpa_s->sme.ft_ies;
params.ie_len = wpa_s->sme.ft_ies_len;
}
}
#endif /* CONFIG_IEEE80211R */
#ifdef CONFIG_IEEE80211W
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
wpa_s->sme.mfp = wpas_get_ssid_pmf(wpa_s, ssid);
Allow PMF to be enabled by default Previously, PMF (protected management frames, IEEE 802.11w) could be enabled only with a per-network parameter (ieee80211w). The new global parameter (pmf) can now be used to change the default behavior to be PMF enabled (pmf=1) or required (pmf=2) for network blocks that do not override this with the ieee80211w parameter. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-11-24 21:21:29 +01:00
if (wpa_s->sme.mfp != NO_MGMT_FRAME_PROTECTION) {
Use BSS table entry instead of raw scan result for connection
2010-01-02 15:16:02 +01:00
const u8 *rsn = wpa_bss_get_ie(bss, WLAN_EID_RSN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
struct wpa_ie_data _ie;
if (rsn && wpa_parse_wpa_ie(rsn, 2 + rsn[1], &_ie) == 0 &&
_ie.capabilities &
(WPA_CAPABILITY_MFPC | WPA_CAPABILITY_MFPR)) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Selected AP supports "
"MFP: require MFP");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->sme.mfp = MGMT_FRAME_PROTECTION_REQUIRED;
}
}
#endif /* CONFIG_IEEE80211W */
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
#ifdef CONFIG_P2P
if (wpa_s->global->p2p) {
u8 *pos;
size_t len;
int res;
pos = wpa_s->sme.assoc_req_ie + wpa_s->sme.assoc_req_ie_len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
P2P: Set p2p auth/assoc parameter based on connection type Fix the previous code that was hardcoding the p2p parameter based on the driver P2P capability regardless of whether the connection was really used for P2P or not.
2011-07-17 19:52:49 +02:00
res = wpas_p2p_assoc_req_ie(wpa_s, bss, pos, len,
ssid->p2p_group);
P2P: Add P2P IE into (Re)Association Request frames
2010-07-18 23:30:25 +02:00
if (res >= 0)
wpa_s->sme.assoc_req_ie_len += res;
}
#endif /* CONFIG_P2P */
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
#ifdef CONFIG_HS20
HS 2.0: Include HS 2.0 Indication element only for HS 2.0 association The Hotspot 2.0 specification seems to mandate this element to be included in all (Re)Association Request frames if the station is Hotspot 2.0 capable. However, that results in conflicts with other requirements like no TKIP use when this element is present. The design is really supposed to include the indication element only for Hotspot 2.0 associations regardless of what the current specification implies. Remove the HS 2.0 Indication element from (Re)Association Request frame whenever the connection is not for Hotspot 2.0 purposes. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-05-05 15:29:21 +02:00
if (is_hs20_network(wpa_s, ssid, bss)) {
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
struct wpabuf *hs20;
hs20 = wpabuf_alloc(20);
if (hs20) {
HS 2.0R2: Update Indication element to Release 2 The HS 2.0 Indication element from wpa_supplicant now includes the release number field and wpa_supplicant shows the release number of the AP in STATUS command (hs20=1 replaced with hs20=<release>). The new update_identifier field in the cred block can now be used to configure the PPS MO ID so that wpa_supplicant adds it to the Indication element in Association Request frames. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-02 11:08:11 +01:00
int pps_mo_id = hs20_get_pps_mo_id(wpa_s, ssid);
HS 2.0: Verify assoc_req_ie buffer size for indication elements While the buffer is expected to be large enough for all the IEs, it is better to check for this explicitly when adding the HS 2.0 Indication element. (CID 68601) Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-29 23:32:12 +02:00
size_t len;
HS 2.0R2: Update Indication element to Release 2 The HS 2.0 Indication element from wpa_supplicant now includes the release number field and wpa_supplicant shows the release number of the AP in STATUS command (hs20=1 replaced with hs20=<release>). The new update_identifier field in the cred block can now be used to configure the PPS MO ID so that wpa_supplicant adds it to the Indication element in Association Request frames. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-11-02 11:08:11 +01:00
wpas_hs20_add_indication(hs20, pps_mo_id);
HS 2.0: Verify assoc_req_ie buffer size for indication elements While the buffer is expected to be large enough for all the IEs, it is better to check for this explicitly when adding the HS 2.0 Indication element. (CID 68601) Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-29 23:32:12 +02:00
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(hs20) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(hs20), wpabuf_len(hs20));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(hs20);
}
HS 2.0: Add HS 2.0 Indication element into (Re)Association Request Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-10-03 17:10:23 +02:00
wpabuf_free(hs20);
}
}
#endif /* CONFIG_HS20 */
Validate driver extended capabilities length against buffer length Prepare for new extended capabilities bits by checking that the local buffer is large enough to contain all the bits the driver requests. The existing buffers are large enough to include anything defined until now, but it would be possible to add more definitions in the future, so increase them a bit as well to make this more future proof. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-06-07 15:33:28 +02:00
ext_capab_len = wpas_build_ext_capab(wpa_s, ext_capab,
sizeof(ext_capab));
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
if (ext_capab_len > 0) {
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
u8 *pos = wpa_s->sme.assoc_req_ie;
if (wpa_s->sme.assoc_req_ie_len > 0 && pos[0] == WLAN_EID_RSN)
pos += 2 + pos[1];
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
os_memmove(pos + ext_capab_len, pos,
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
wpa_s->sme.assoc_req_ie_len -
(pos - wpa_s->sme.assoc_req_ie));
Share a single function for building extended capabilities element This makes it easier to update extended capabilities for all uses within wpa_supplicant. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-22 18:17:15 +01:00
wpa_s->sme.assoc_req_ie_len += ext_capab_len;
os_memcpy(pos, ext_capab, ext_capab_len);
Add Extended Capability element to AssocReq for Interworking If Interworking is enabled, add Extended Capability element to (Re)Association Request frames to indicate support for Interworking.
2011-10-16 18:04:46 +02:00
}
Extend VENDOR_ELEM parameters to cover non-P2P Association Request The new VENDOR_ELEM value 13 can now be used to add a vendor element into all (Re)Association Request frames, not just for P2P use cases like the previous item was for. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-01-13 23:50:58 +01:00
if (wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ]) {
struct wpabuf *buf = wpa_s->vendor_elem[VENDOR_ELEM_ASSOC_REQ];
size_t len;
len = sizeof(wpa_s->sme.assoc_req_ie) -
wpa_s->sme.assoc_req_ie_len;
if (wpabuf_len(buf) <= len) {
os_memcpy(wpa_s->sme.assoc_req_ie +
wpa_s->sme.assoc_req_ie_len,
wpabuf_head(buf), wpabuf_len(buf));
wpa_s->sme.assoc_req_ie_len += wpabuf_len(buf);
}
}
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
sme_auth_handle_rrm(wpa_s, bss);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE &&
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
pmksa_cache_set_current(wpa_s->wpa, NULL, bss->bssid, ssid, 0) == 0)
{
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA cache entry found - try to use PMKSA caching instead of new SAE authentication");
params.auth_alg = WPA_AUTH_ALG_OPEN;
wpa_s->sme.sae_pmksa_caching = 1;
}
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (!skip_auth && params.auth_alg == WPA_AUTH_ALG_SAE) {
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (start)
SAE: Add generation of the commit message fields This adds derivation of PWE and the needed commit values so that the full SAE commit message can be built. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:06:11 +01:00
resp = sme_auth_build_sae_commit(wpa_s, ssid,
bss->bssid);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
else
resp = sme_auth_build_sae_confirm(wpa_s);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (resp == NULL) {
SAE: Report connection failure if SME cannot build auth frame Instead of just stopping connection process and network discovery, report SAE failures to build Authentication frames (e.g., due to missing password) as a connection failure to get the normal retry mechanism into use. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-14 15:48:38 +01:00
wpas_connection_failed(wpa_s, bss->bssid);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
params.sae_data = wpabuf_head(resp);
params.sae_data_len = wpabuf_len(resp);
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = start ? SAE_COMMITTED : SAE_CONFIRMED;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
Use sched_scan in driver init This patch uses sched_scan, if available, when the driver is initialized. It also adds a couple of cancel operations where appropriate. Signed-off-by: Luciano Coelho <coelho@ti.com>
2011-09-27 21:21:31 +02:00
wpa_supplicant_cancel_sched_scan(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_cancel_scan(wpa_s);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Trying to authenticate with " MACSTR
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
wpa_ssid_txt(params.ssid, params.ssid_len), params.freq);
wpa_clear_keys(wpa_s, bss->bssid);
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
old_ssid = wpa_s->current_ssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_s->current_ssid = ssid;
wpa_supplicant_rsn_supp_set_config(wpa_s, wpa_s->current_ssid);
wpa_supplicant_initiate_eapol(wpa_s);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (old_ssid != wpa_s->current_ssid)
wpas_notify_network_changed(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant: Call frequency conflict handling during auth Previously, the frequency conflict was handled only during the association flow. However, some drivers, e.g., mac80211 based drivers, will fail an authentication request in case that there are no available channels for use (as they might be used by other interfaces), and thus the frequency conflict resolution is never called. Fix this by calling frequency conflict resolution during authentication (SME-in-wpa_supplicant) as well. In addition, get the shared radio frequency from the wpa_s context in both the SME-in-driver and SME-in-wpa_supplicant cases and not from the driver. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-04-24 07:45:40 +02:00
#ifdef CONFIG_P2P
/*
* If multi-channel concurrency is not supported, check for any
* frequency conflict. In case of any frequency conflict, remove the
* least prioritized connection.
*/
if (wpa_s->num_multichan_concurrent < 2) {
int freq, num;
num = get_shared_radio_freqs(wpa_s, &freq, 1);
if (num > 0 && freq > 0 && freq != params.freq) {
wpa_printf(MSG_DEBUG,
"Conflicting frequency found (%d != %d)",
freq, params.freq);
if (wpas_p2p_handle_frequency_conflicts(wpa_s,
params.freq,
ssid) < 0) {
wpas_connection_failed(wpa_s, bss->bssid);
wpa_supplicant_mark_disassoc(wpa_s);
wpabuf_free(resp);
wpas_connect_work_done(wpa_s);
return;
}
}
}
#endif /* CONFIG_P2P */
Add optional reassoc-to-same-BSS optimization The new reassoc_same_bss_optim=1 configuration parameter can now be used to request wpa_supplicant to bypass the unnecessary Authentication frame exchange when reassociating back to the same BSS with which the device is already associated. This functionality is disabled by default since it may cause undesired interoperability issues with some APs. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-02-19 15:35:39 +01:00
if (skip_auth) {
wpa_msg(wpa_s, MSG_DEBUG,
"SME: Skip authentication step on reassoc-to-same-BSS");
wpabuf_free(resp);
sme_associate(wpa_s, ssid->mode, bss->bssid, WLAN_AUTH_OPEN);
return;
}
FT: Process reassoc resp FT IEs when using wpa_supplicant SME
2010-03-13 20:13:18 +01:00
wpa_s->sme.auth_alg = params.auth_alg;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_authenticate(wpa_s, &params) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Authentication request to the "
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
"driver failed");
SME: Fix processing of Authentication request failure The wpa_state needs to be dropped back to DISCONNECTED to allow scan results to trigger a new authentication attempt. In addition, we can use wpas_connection_failed() instead of requesting a scan after a fixed time to make this error case more consistent with other similar error paths in sme.c. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-04 20:04:24 +01:00
wpas_connection_failed(wpa_s, bss->bssid);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_done(wpa_s);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
NULL);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
/*
* Association will be started based on the authentication event from
* the driver.
*/
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpabuf_free(resp);
}
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
static void sme_auth_start_cb(struct wpa_radio_work *work, int deinit)
{
struct wpa_connect_work *cwork = work->ctx;
struct wpa_supplicant *wpa_s = work->wpa_s;
if (deinit) {
wpa_supplicant: Complete radio works on disable event While testing rfkill blocking of a scanning interface, it was seen that the ongoing scan never completes. This happens since EVENT_SCAN_RESULTS is discarded on a disabled interface. Fix this and also other possible radio work completion issues by removing all the radio works (including started) of the disabled interface. To be able to remove already started radio works, make their callbacks be reentrant with deinit flag (when the work is started), so each radio work should be able to handle its own termination. Signed-hostap: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2014-02-13 10:24:00 +01:00
if (work->started)
wpa_s->connect_work = NULL;
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpas_connect_work_free(cwork);
return;
}
wpa_s->connect_work = work;
Update pending connect radio work BSS pointer on scan update It is possible for scan result processing or BSS entry removal to occur while there is a pending connect or sme-connect radio work with a previously selected BSS entry. The BSS pointer was previously verified to be valid, i.e., still point to a BSS entry, at the time the actual connection operation is started. However, that BSS entry could have changed to point to another BSS if the old BSS entry was either removed or reallocated and a new BSS entry was added at the same location in memory. This could result in the connection attempt failing to configure parameters properly due to different BSS information (e.g., different BSSID). Fix this by updated the pending connect radio work data on BSS entry updates similarly to how the last_scan_res array was updated. If the selected BSS entry is removed, this will still result in a failed connection, but reallocated BSS entry is now followed properly and used when the connection work starts. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-10-27 23:19:24 +01:00
if (cwork->bss_removed ||
!wpas_valid_bss_ssid(wpa_s, cwork->bss, cwork->ssid)) {
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: BSS/SSID entry for authentication not valid anymore - drop connection attempt");
wpas_connect_work_done(wpa_s);
return;
}
sme_send_authentication(wpa_s, cwork->bss, cwork->ssid, 1);
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
void sme_authenticate(struct wpa_supplicant *wpa_s,
struct wpa_bss *bss, struct wpa_ssid *ssid)
{
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
struct wpa_connect_work *cwork;
if (bss == NULL || ssid == NULL)
return;
if (wpa_s->connect_work) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reject sme_authenticate() call since connect_work exist");
return;
}
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
if (radio_work_pending(wpa_s, "sme-connect")) {
wpa_supplicant: Remove pending sme-connect radio work If a new connection is attempted while there is a pending sme-connection radio work, cancel the pending radio work and continue with the new connection attempt. This is preferable over rejecting the new work and continuing with the pending one, as it is possible that the previous work is no longer valid. Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2014-03-27 07:58:33 +01:00
/*
* The previous sme-connect work might no longer be valid due to
* the fact that the BSS list was updated. In addition, it makes
* sense to adhere to the 'newer' decision.
*/
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Remove previous pending sme-connect");
radio_remove_works(wpa_s, "sme-connect", 0);
Do not start another connect work while one is pending It was possible for the connect or sme-connect radio work to get re-scheduled while an earlier request was still pending, e.g., select_network is issued at the moment a scan radio work is in progress and the old scan results are recent enough for starting the connection. This could result in unexpected attempt to re-associate immediately after completing the first connection. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-02-24 14:22:35 +01:00
}
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
cwork = os_zalloc(sizeof(*cwork));
if (cwork == NULL)
return;
cwork->bss = bss;
cwork->ssid = ssid;
cwork->sme = 1;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#ifdef CONFIG_SAE
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_NOTHING;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
wpa_s->sme.sae.send_confirm = 0;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
wpa_s->sme.sae_group_index = 0;
SAE: Use a shared data structure for AP and station This makes it easier to share common functions for both roles. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 20:48:19 +01:00
#endif /* CONFIG_SAE */
Use wpa_radio work for connection This protects against conflicting offchannel operations during connection (authentication, association, EAP exchanges, 4-way handshake). Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-03 15:50:32 +01:00
if (radio_add_work(wpa_s, bss->freq, "sme-connect", 1,
sme_auth_start_cb, cwork) < 0)
wpas_connect_work_free(cwork);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
static int sme_sae_auth(struct wpa_supplicant *wpa_s, u16 auth_transaction,
u16 status_code, const u8 *data, size_t len)
{
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
int *groups;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE authentication transaction %u "
"status code %u", auth_transaction, status_code);
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_ANTI_CLOGGING_TOKEN_REQ &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
wpa_s->current_bss && wpa_s->current_ssid) {
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
int default_groups[] = { 19, 20, 21, 25, 26, 0 };
u16 group;
groups = wpa_s->conf->sae_groups;
if (!groups || groups[0] <= 0)
groups = default_groups;
if (len < sizeof(le16)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: Too short SAE anti-clogging token request");
return -1;
}
group = WPA_GET_LE16(data);
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: SAE anti-clogging token requested (group %u)",
group);
if (sae_group_allowed(&wpa_s->sme.sae, groups, group) !=
WLAN_STATUS_SUCCESS) {
wpa_dbg(wpa_s, MSG_ERROR,
"SME: SAE group %u of anti-clogging request is invalid",
group);
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
wpa_s->sme.sae_token = wpabuf_alloc_copy(data + sizeof(le16),
len - sizeof(le16));
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 1);
return 0;
}
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (auth_transaction == 1 &&
status_code == WLAN_STATUS_FINITE_CYCLIC_GROUP_NOT_SUPPORTED &&
wpa_s->sme.sae.state == SAE_COMMITTED &&
wpa_s->current_bss && wpa_s->current_ssid) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SAE group not supported");
wpa_s->sme.sae_group_index++;
if (sme_set_sae_group(wpa_s) < 0)
return -1; /* no other groups enabled */
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Try next enabled SAE group");
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 1);
return 0;
}
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
if (status_code != WLAN_STATUS_SUCCESS)
return -1;
if (auth_transaction == 1) {
SAE: Fix Anti-Clogging Token request frame format This commit inserts Finite Cyclic Group to Anti-Clogging Token request frame because IEEE Std 802.11-2012, Table 8-29 says "Finite Cyclic Group is present if Status is zero or 76". Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2014-11-25 03:04:41 +01:00
groups = wpa_s->conf->sae_groups;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE commit");
if (wpa_s->current_bss == NULL ||
wpa_s->current_ssid == NULL)
return -1;
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
if (wpa_s->sme.sae.state != SAE_COMMITTED)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
if (groups && groups[0] <= 0)
groups = NULL;
SAE: Allow enabled groups to be configured hostapd.conf sae_groups parameter can now be used to limit the set of groups that the AP allows for SAE. Similarly, sae_groups parameter is wpa_supplicant.conf can be used to set the preferred order of groups. By default, all implemented groups are enabled. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-01 15:23:47 +01:00
if (sae_parse_commit(&wpa_s->sme.sae, data, len, NULL, NULL,
SAE: Fix group selection Number of regressions had shown up in wpa_supplicant implementation of SAE group selection due to different integer array termination (-1 in hostapd, 0 in wpa_supplicant) being used for SAE groups. The default_groups list did not seem to use any explicit termination value. In addition, the sae_group_index was not cleared back to 0 properly whenever a new SAE session was started. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-11-02 17:07:49 +01:00
groups) != WLAN_STATUS_SUCCESS)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Add processing of the commit message This adds validation of the received commit messages and key derivation for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:16:18 +01:00
if (sae_process_commit(&wpa_s->sme.sae) < 0) {
wpa_printf(MSG_DEBUG, "SAE: Failed to process peer "
"commit");
return -1;
}
SAE: Add support for Anti-Clogging mechanism hostapd can now be configured to use anti-clogging mechanism based on the new sae_anti_clogging_threshold parameter (which is dot11RSNASAEAntiCloggingThreshold in the standard). The token is generated using a temporary key and the peer station's MAC address. wpa_supplicant will re-try SAE authentication with the token included if commit message is rejected with a token request. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 15:58:36 +01:00
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
sme_send_authentication(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid, 0);
return 0;
} else if (auth_transaction == 2) {
wpa_dbg(wpa_s, MSG_DEBUG, "SME SAE confirm");
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
if (wpa_s->sme.sae.state != SAE_CONFIRMED)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Add processing of the confirm message This adds validation of the received confirm messages for SAE. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:31:19 +01:00
if (sae_check_confirm(&wpa_s->sme.sae, data, len) < 0)
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
return -1;
SAE: Rename state variables to match IEEE 802.11 standard The enum values for struct sae_data::state now match the protocol instance states as defined in IEEE Std 802.11-2012, 11.3.8.2.2 Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-31 10:05:42 +01:00
wpa_s->sme.sae.state = SAE_ACCEPTED;
SAE: Free temporary buffers when moving to Accepted state Most of the variables are not needed anymore once the SAE instance has entered Accepted state. Free these to save memory. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-01-06 18:06:59 +01:00
sae_clear_temp_data(&wpa_s->sme.sae);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return 1;
}
return -1;
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
void sme_event_auth(struct wpa_supplicant *wpa_s, union wpa_event_data *data)
{
struct wpa_ssid *ssid = wpa_s->current_ssid;
if (ssid == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when network is not selected");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
if (wpa_s->wpa_state != WPA_AUTHENTICATING) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication event "
"when not in authenticating state");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
if (os_memcmp(wpa_s->pending_bssid, data->auth.peer, ETH_ALEN) != 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Ignore authentication with "
"unexpected peer " MACSTR,
MAC2STR(data->auth.peer));
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication response: peer=" MACSTR
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
" auth_type=%d auth_transaction=%d status_code=%d",
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
MAC2STR(data->auth.peer), data->auth.auth_type,
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
data->auth.auth_transaction, data->auth.status_code);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_hexdump(MSG_MSGDUMP, "SME: Authentication response IEs",
data->auth.ies, data->auth.ies_len);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
#ifdef CONFIG_SAE
if (data->auth.auth_type == WLAN_AUTH_SAE) {
SAE: Add Finite Cyclic Group negotiation and Send-Confirm This replaces the previously used bogus test data in SAE messages with the first real field. The actual SAE authentication mechanism is still missing and the Scaler, Element, and Confirm fields are not included. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-10-06 18:30:54 +02:00
int res;
res = sme_sae_auth(wpa_s, data->auth.auth_transaction,
data->auth.status_code, data->auth.ies,
data->auth.ies_len);
if (res < 0) {
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
}
if (res != 1)
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
return;
SAE: Use PMK in 4-way handshake Use the PMK that is derived as part of the SAE authentication in the 4-way handshake instead of the PSK. Signed-hostap: Jouni Malinen <j@w1.fi>
2012-12-30 21:35:59 +01:00
wpa_printf(MSG_DEBUG, "SME: SAE completed - setting PMK for "
"4-way handshake");
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
wpa_sm_set_pmk(wpa_s->wpa, wpa_s->sme.sae.pmk, PMK_LEN,
wpa_s->pending_bssid);
Add initial parts for SAE This introduces new AKM for SAE and FT-SAE and adds the initial parts for going through the SAE Authentication frame exchange. The actual SAE algorithm and new fields in Authentication frames are not yet included in this commit and will be added separately. This version is able to complete a dummy authentication with the correct authentication algorithm and transaction values to allow cfg80211/mac80211 drivers to be tested (all the missing parts can be handled with hostapd/wpa_supplicant changes). Signed-hostap: Jouni Malinen <j@w1.fi>
2012-09-30 18:51:07 +02:00
}
#endif /* CONFIG_SAE */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (data->auth.status_code != WLAN_STATUS_SUCCESS) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication failed (status "
"code %d)", data->auth.status_code);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
if (data->auth.status_code !=
WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG ||
wpa_s->sme.auth_alg == data->auth.auth_type ||
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
wpa_s->current_ssid->auth_alg == WPA_AUTH_ALG_LEAP) {
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Set state to DISCONNECTED on auth/assoc failures Some of the authentication/association failure paths left wpa_state to its previous value. This can result in unexpected behavior when wpa_supplicant tries to find an AP to connect to since the uncleared state can result the in the selected BSS being ignored if it is same as the previously used BSS. This could happen, e.g., when wpa_supplicant SME was used and the AP rejected authentication. Fix this by explicitly setting state to DISCONNECTED on auth/assoc failures that did not yet do this. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-06-25 13:23:25 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
return;
SME: Fix re-try after auth/assoc timeout/failure There were various issues in how the SME (i.e., nl80211-based driver interface) handled various authentication and association timeouts and failures. Authentication failure was not handled at all (wpa_supplicant just stopped trying to connect completely), authentication timeout resulted in blacklisting not working in the expected way (i.e., the same BSS could be selected continuously), and association cases had similar problems. Use a common function to handle all these cases and fix the blacklist operation. Use smaller delay before trying to scan again during the initial cycle through the available APs to speed up connection. Add a special case for another-BSS-in-the-same-ESS being present to speed up recovery from networks with multiple APs doing load balancing in various odd ways that are deployed out there.
2010-11-25 21:00:04 +01:00
}
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
Fix authentication algorithm negotiation in SME code Commit 6ac4b15ef8af434d216fd2dac62ec82948ab0fbd (wpa_radio work for connection) caused a regression for cases where multiple auth_alg values are set in a network block and wpa_supplicant-based SME is supposed to iterate through them. The connection radio work was not terminated when receiving authentication failure and this resulted in the following authentication attempt failing. Signed-hostap: Jouni Malinen <j@w1.fi>
2014-01-31 22:31:26 +01:00
wpas_connect_work_done(wpa_s);
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
switch (data->auth.auth_type) {
case WLAN_AUTH_OPEN:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_SHARED;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying SHARED auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
case WLAN_AUTH_SHARED_KEY:
wpa_s->current_ssid->auth_alg = WPA_AUTH_ALG_LEAP;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Trying LEAP auth");
sme: Try all authentication algorithms when the first one fails When passing several authentication algorithms through auth_alg, we should try all of them when the first one fails. The wext driver goes through the connect nl80211 command and the retries are then handled by the kernel. The nl80211 doesn't and we have to handle that from userspace. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-17 15:39:33 +02:00
wpa_supplicant_associate(wpa_s, wpa_s->current_bss,
wpa_s->current_ssid);
return;
default:
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#ifdef CONFIG_IEEE80211R
if (data->auth.auth_type == WLAN_AUTH_FT) {
FT: Stop association attempt if Auth response processing fails (SME) Call the FT processing function directly instead of going through wpa_supplicant_event() to process FT Authentication frame in SME case. This allows parsing error to be used to trigger immediate failure for the connection instead of trying to proceed to reassociation step that cannot succeed. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-06-20 16:36:58 +02:00
if (wpa_ft_process_response(wpa_s->wpa, data->auth.ies,
data->auth.ies_len, 0,
data->auth.peer, NULL, 0) < 0) {
wpa_dbg(wpa_s, MSG_DEBUG,
"SME: FT Authentication response processing failed");
wpa_msg(wpa_s, MSG_INFO, WPA_EVENT_DISCONNECTED "bssid="
MACSTR
" reason=%d locally_generated=1",
MAC2STR(wpa_s->pending_bssid),
WLAN_REASON_DEAUTH_LEAVING);
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
wpa_supplicant_mark_disassoc(wpa_s);
return;
}
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
sme_associate(wpa_s, ssid->mode, data->auth.peer,
data->auth.auth_type);
}
void sme_associate(struct wpa_supplicant *wpa_s, enum wpas_mode mode,
const u8 *bssid, u16 auth_type)
{
struct wpa_driver_associate_params params;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
struct ieee802_11_elems elems;
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
struct ieee80211_ht_capabilities htcaps;
struct ieee80211_ht_capabilities htcaps_mask;
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
struct ieee80211_vht_capabilities vhtcaps;
struct ieee80211_vht_capabilities vhtcaps_mask;
#endif /* CONFIG_VHT_OVERRIDES */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_memset(&params, 0, sizeof(params));
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.bssid = bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.ssid = wpa_s->sme.ssid;
params.ssid_len = wpa_s->sme.ssid_len;
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq = wpa_s->sme.freq;
Allow background scan period to be configured A network block specific background scan period can now be configured for drivers that implement internal background scan mechanism for roaming and BSS selection. Signed-hostap: Bala Shanmugam <bkamatch@qca.qualcomm.com>
2012-03-30 14:20:35 +02:00
params.bg_scan_period = wpa_s->current_ssid ?
wpa_s->current_ssid->bg_scan_period : -1;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.assoc_req_ie_len ?
wpa_s->sme.assoc_req_ie : NULL;
params.wpa_ie_len = wpa_s->sme.assoc_req_ie_len;
Get rid of duplicated cipher suite and AKM definitions WPA_CIPHER_* and CIPHER_* are used for the exact same set of cipher suites with the main difference being that the WPA_CIPHER_* version is suitable to be used as a bitfield. Similarly, WPA_KEY_MGMT_* and KEY_MGMT_* have similar design for AKMs. There is no need to maintain two separate copies of the definitions since the bitfield compatible version can be used for both needs. Get rid of the CIPHER_* and KEY_MGMT_* versions to clean up the implementation by getting rid of unnecessary mapping functions. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-12-30 18:33:39 +01:00
params.pairwise_suite = wpa_s->pairwise_cipher;
params.group_suite = wpa_s->group_cipher;
nl80211: Indicate HS 2.0 OSEN AKM in connect/associate command This allows drivers that build the WPA/RSN IEs internally to use similar design for building the OSEN IE. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-25 16:57:54 +01:00
params.key_mgmt_suite = wpa_s->key_mgmt;
params.wpa_proto = wpa_s->wpa_proto;
Support HT capability overrides This allows HT capabilities overrides on kernels that support these features. MCS Rates can be disabled to force to slower speeds when using HT. Rates cannot be forced higher. HT can be disabled, forcing an 802.11a/b/g/n station to act like an 802.11a/b/g station. HT40 can be disabled. MAX A-MSDU can be disabled. A-MPDU Factor and A-MPDU Density can be modified. Please note that these are suggestions to the kernel. Only mac80211 drivers will work at all. The A-MPDU Factor can only be decreased and the A-MPDU Density can only be increased currently. Signed-hostap: Ben Greear <greearb@candelatech.com>
2012-01-29 20:01:31 +01:00
#ifdef CONFIG_HT_OVERRIDES
os_memset(&htcaps, 0, sizeof(htcaps));
os_memset(&htcaps_mask, 0, sizeof(htcaps_mask));
params.htcaps = (u8 *) &htcaps;
params.htcaps_mask = (u8 *) &htcaps_mask;
wpa_supplicant_apply_ht_overrides(wpa_s, wpa_s->current_ssid, &params);
#endif /* CONFIG_HT_OVERRIDES */
wpa_supplicant: Support VHT capability overrides Add support for VHT capability overrides to allow testing connections with a subset of the VHT capabilities that are actually supported by the device. The only thing that isn't currently supported (by mac80211 and this code) is the RX/TX highest rate field. Signed-hostap: Johannes Berg <johannes.berg@intel.com>
2013-03-10 17:04:39 +01:00
#ifdef CONFIG_VHT_OVERRIDES
os_memset(&vhtcaps, 0, sizeof(vhtcaps));
os_memset(&vhtcaps_mask, 0, sizeof(vhtcaps_mask));
params.vhtcaps = &vhtcaps;
params.vhtcaps_mask = &vhtcaps_mask;
wpa_supplicant_apply_vht_overrides(wpa_s, wpa_s->current_ssid, &params);
#endif /* CONFIG_VHT_OVERRIDES */
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
#ifdef CONFIG_IEEE80211R
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
if (auth_type == WLAN_AUTH_FT && wpa_s->sme.ft_ies) {
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.wpa_ie = wpa_s->sme.ft_ies;
params.wpa_ie_len = wpa_s->sme.ft_ies_len;
}
#endif /* CONFIG_IEEE80211R */
FT: Request reassociation after successful FT Action frame exchange
2010-03-13 16:14:41 +01:00
params.mode = mode;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
params.mgmt_frame_protection = wpa_s->sme.mfp;
SME: Add RRM support to association request In case the AP we are associating with advertises support for RRM, advertise our own RRM support in the (Re)Association Request frame. This is done by adding an RRM Capabilities IE. The underlying driver is expected to further add a Power Capabilities IE to the request, and set the Radio Measurement flag in the Capability Info field. At this point the RRM Capabilities IE advertises no measurement support. Signed-off-by: Assaf Krauss <assaf.krauss@intel.com>
2014-11-05 09:42:48 +01:00
params.rrm_used = wpa_s->rrm.rrm_used;
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
if (wpa_s->sme.prev_bssid_set)
params.prev_bssid = wpa_s->sme.prev_bssid;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_msg(wpa_s, MSG_INFO, "Trying to associate with " MACSTR
" (SSID='%s' freq=%d MHz)", MAC2STR(params.bssid),
params.ssid ? wpa_ssid_txt(params.ssid, params.ssid_len) : "",
wpa_supplicant: Use hostapd_freq_params in assoc_params Use hostapd_freq_params instead of simple frequency parameter for driver commands. This is preparation for IBSS configuration to allow use of HT/VHT in IBSS. Signed-off-by: Janusz Dziedzic <janusz.dziedzic@tieto.com>
2014-10-01 09:52:53 +02:00
params.freq.freq);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
wpa_supplicant_set_state(wpa_s, WPA_ASSOCIATING);
SME: Handle association without own extra IEs Need to check for this before calling ieee802_11_parse_elems().
2010-04-11 11:19:02 +02:00
if (params.wpa_ie == NULL ||
ieee802_11_parse_elems(params.wpa_ie, params.wpa_ie_len, &elems, 0)
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
< 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Could not parse own IEs?!");
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
os_memset(&elems, 0, sizeof(elems));
}
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
if (elems.rsn_ie) {
params.wpa_proto = WPA_PROTO_RSN;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.rsn_ie - 2,
elems.rsn_ie_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else if (elems.wpa_ie) {
params.wpa_proto = WPA_PROTO_WPA;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.wpa_ie - 2,
elems.wpa_ie_len + 2);
HS 2.0R2: Add OSEN client implementation Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2013-07-23 20:24:05 +02:00
} else if (elems.osen) {
params.wpa_proto = WPA_PROTO_OSEN;
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, elems.osen - 2,
elems.osen_len + 2);
nl80211: Fix WPA_VERSIONS attribute for Connect command The previous code was trying to figure out which WPA version is used based on the extra IEs requested for Association Request. That did not work properly in cases where non-WPA networks are used with some extra IEs. Fix this by using more robust mechanism for passing the WPA versions from core wpa_supplicant to the driver_ops associate().
2011-09-02 19:40:23 +02:00
} else
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
wpa_sm_set_assoc_wpa_ie(wpa_s->wpa, NULL, 0);
P2P: Set p2p auth/assoc parameter based on connection type Fix the previous code that was hardcoding the p2p parameter based on the driver P2P capability regardless of whether the connection was really used for P2P or not.
2011-07-17 19:52:49 +02:00
if (wpa_s->current_ssid && wpa_s->current_ssid->p2p_group)
P2P: Let the driver wrapper know if association is for P2P group
2010-07-18 23:30:25 +02:00
params.p2p = 1;
Fix SME to update WPA/RSN IE for rsn_supp module based on AssocReq When using wpa_supplicant SME (i.e., using nl80211), the rsn_supp module was not informed of the WPA/RSN IE that was used in (Re)Association Request frame. This broke roaming between APs that use different security policy (e.g., changing between WPA/TKIP and WPA2/CCMP APs) or when using PMKSA caching.
2010-04-07 09:31:06 +02:00
P2P: Add mechanism for configuring UAPSD parameters for group This is needed to be able to change parameters for dynamically created interfaces between the creation of the interface and association/start AP commands. Following ctrl_interface commands can now be used: P2P_SET client_apsd disable - disable configuration (i.e., use driver default) in client mode P2P_SET client_apsd <BE>,<BK>,<VI>,<VO>;<max SP Length> - enable UASPD with specific trigger configuration (0/1) per AC (max SP Length is currently ignored) P2P_SET go_apsd disable - disable configuration (i.e., use driver default) in AP mode P2P_SET go_apsd <0/1> - disable/enable APSD in AP mode
2010-07-28 19:18:52 +02:00
if (wpa_s->parent->set_sta_uapsd)
params.uapsd = wpa_s->parent->sta_uapsd;
else
params.uapsd = -1;
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
if (wpa_drv_associate(wpa_s, &params) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Association request to the "
"driver failed");
SME: Optimize recovery from assocication command failures mac80211 can indicate this mainly because of channel selection conflicts with other vifs. If there is another BSS on another channel, we should try to connect to it instead.
2010-11-26 16:37:22 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Set state to DISCONNECTED on auth/assoc failures Some of the authentication/association failure paths left wpa_state to its previous value. This can result in unexpected behavior when wpa_supplicant tries to find an AP to connect to since the uncleared state can result the in the selected BSS being ignored if it is same as the previously used BSS. This could happen, e.g., when wpa_supplicant SME was used and the AP rejected authentication. Fix this by explicitly setting state to DISCONNECTED on auth/assoc failures that did not yet do this. Signed-hostap: Jouni Malinen <j@w1.fi> intended-for: hostap-1
2012-06-25 13:23:25 +02:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
SME: Optimize recovery from assocication command failures mac80211 can indicate this mainly because of channel selection conflicts with other vifs. If there is another BSS on another channel, we should try to connect to it instead.
2010-11-26 16:37:22 +01:00
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
return;
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_register_timeout(SME_ASSOC_TIMEOUT, 0, sme_assoc_timer, wpa_s,
NULL);
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
}
int sme_update_ft_ies(struct wpa_supplicant *wpa_s, const u8 *md,
const u8 *ies, size_t ies_len)
{
if (md == NULL || ies == NULL) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Remove mobility domain");
Add SME support (separate authentication and association) This can be used, e.g., with mac80211-based Linux drivers with nl80211. This allows over-the-air FT protocol to be used (IEEE 802.11r). Since the nl80211 interface needed for this is very recent (added today into wireless-testing.git), driver_nl80211.c has backwards compatibility code that uses WEXT for association if the kernel does not support the new commands. This compatibility code can be disabled by defining NO_WEXT_COMPAT. That code will also be removed at some point to clean up driver_nl80211.c.
2009-03-20 21:26:41 +01:00
os_free(wpa_s->sme.ft_ies);
wpa_s->sme.ft_ies = NULL;
wpa_s->sme.ft_ies_len = 0;
wpa_s->sme.ft_used = 0;
return 0;
}
os_memcpy(wpa_s->sme.mobility_domain, md, MOBILITY_DOMAIN_ID_LEN);
wpa_hexdump(MSG_DEBUG, "SME: FT IEs", ies, ies_len);
os_free(wpa_s->sme.ft_ies);
wpa_s->sme.ft_ies = os_malloc(ies_len);
if (wpa_s->sme.ft_ies == NULL)
return -1;
os_memcpy(wpa_s->sme.ft_ies, ies, ies_len);
wpa_s->sme.ft_ies_len = ies_len;
return 0;
}
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_deauth(struct wpa_supplicant *wpa_s)
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
{
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
int bssid_changed;
bssid_changed = !is_zero_ether_addr(wpa_s->bssid);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
if (wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
WLAN_REASON_DEAUTH_LEAVING) < 0) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Deauth request to the driver "
"failed");
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
}
nl80211/SME: Use reassociation when roaming within the ESS
2009-11-17 18:25:05 +01:00
wpa_s->sme.prev_bssid_set = 0;
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
SME: Improve processing of association rejection Force deauthentication from the AP to clear mac80211 state (it would get stuck with future scans if the AP is left in authenticated, but not associated, state). Add blacklist entry for the AP to allow other APs with worse signal strength to be tried (e.g., when APs are trying to do load balancing with status code 17). Reduce wait for the next scan to speed up connection in cases where there could be other APs that could accept association, but which show worse signal strength.
2009-10-31 22:21:43 +01:00
wpa_supplicant_set_state(wpa_s, WPA_DISCONNECTED);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
os_memset(wpa_s->bssid, 0, ETH_ALEN);
os_memset(wpa_s->pending_bssid, 0, ETH_ALEN);
Add wpa_supplicant notification calls This introduces a new mechanism for collecting notification calls into a single place (notify.c). As a result of this, most of the wpa_supplicant code does not need to know about dbus (etc. mechanisms that could use the notifications). Some empty placeholder functions are also added in preparation of new dbus code that needs more event notifications.
2009-09-13 19:53:32 +02:00
if (bssid_changed)
wpas_notify_bssid_changed(wpa_s);
SME: Add processing for rejected associations
2009-04-01 16:10:36 +02:00
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_event_assoc_reject(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association with " MACSTR " failed: "
"status code %d", MAC2STR(wpa_s->pending_bssid),
data->assoc_reject.status_code);
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
SAE: Add support for PMKSA caching on the station side This makes wpa_supplicant SME create PMKSA cache entries from SAE authentication and try to use PMKSA caching if an entry is found for the AP. If the AP rejects the attempt, fall back to SAE authentication is used. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-10-18 12:02:02 +02:00
#ifdef CONFIG_SAE
if (wpa_s->sme.sae_pmksa_caching && wpa_s->current_ssid &&
wpa_key_mgmt_sae(wpa_s->current_ssid->key_mgmt)) {
wpa_dbg(wpa_s, MSG_DEBUG,
"PMKSA caching attempt rejected - drop PMKSA cache entry and fall back to SAE authentication");
wpa_sm_aborted_cached(wpa_s->wpa);
wpa_sm_pmksa_cache_flush(wpa_s->wpa, wpa_s->current_ssid);
if (wpa_s->current_bss) {
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
wpa_drv_deauthenticate(wpa_s, wpa_s->pending_bssid,
WLAN_REASON_DEAUTH_LEAVING);
wpas_connect_work_done(wpa_s);
wpa_supplicant_mark_disassoc(wpa_s);
wpa_supplicant_connect(wpa_s, bss, ssid);
return;
}
}
#endif /* CONFIG_SAE */
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
/*
* For now, unconditionally terminate the previous authentication. In
* theory, this should not be needed, but mac80211 gets quite confused
* if the authentication is left pending.. Some roaming cases might
* benefit from using the previous authentication, so this could be
* optimized in the future.
*/
sme_deauth(wpa_s);
}
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
void sme_event_auth_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Authentication timed out");
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
SME: Fix processing of Authentication timeout and failure current_bss and pending_bssid weren't cleaned up so BSS kept appearing in the scan results even when it was actually gone. Use wpa_supplicant_mark_disassoc() to cleanup the wpa_s context instead of just dropping wpa_state back to DISCONNECTED. Reported-by: Vishal Mahaveer <vishalm@ti.com> Signed-hostap: Eyal Shapira <eyal@wizery.com>
2012-01-29 16:44:31 +01:00
wpa_supplicant_mark_disassoc(wpa_s);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
}
void sme_event_assoc_timed_out(struct wpa_supplicant *wpa_s,
union wpa_event_data *data)
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association timed out");
Extend load balancing optimization in BSS blacklisting Move the previously SME specific optimization code into generic function that can be used from non-SME code, too, and use it to handle disconnection events. In other words, allow disconnection event to trigger similar optimized scanning case to handle a common load balancing mechanism. If there is another BSS in the same ESS when we receive a disconnection event, scan only the known frequencies of such other BSSes on the next attempt to speed up recovery.
2010-11-26 10:36:03 +01:00
wpas_connection_failed(wpa_s, wpa_s->pending_bssid);
Add handling of SME auth/assoc timeout events This allows wpa_supplicant to start searching for other APs (or re-try) if the MLME times out.
2009-04-23 23:08:24 +02:00
wpa_supplicant_mark_disassoc(wpa_s);
}
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
void sme_event_disassoc(struct wpa_supplicant *wpa_s,
Clean up wpa_supplicant_event() with deauth/disassoc helper functions wpa_supplicant_event() has grown overly large, so it is useful to split it into smaller pieces. Signed-hostap: Jouni Malinen <j@w1.fi>
2013-07-21 15:40:40 +02:00
struct disassoc_info *info)
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
{
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Disassociation event received");
Remove user space client MLME This code was used only with driver_test.c to allow MLME operations in hostapd to be tested without having to use a real radio. There are no plans on extending this to any other use than testing and mac80211_hwsim has now obsoled the need for this type of testing. As such, we can drop this code from wpa_supplicant to clean up the implementation of unnecessary complexity.
2011-10-22 21:45:38 +02:00
if (wpa_s->sme.prev_bssid_set) {
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
/*
* cfg80211/mac80211 can get into somewhat confused state if
* the AP only disassociates us and leaves us in authenticated
* state. For now, force the state to be cleared to avoid
* confusing errors if we try to associate with the AP again.
*/
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Deauthenticate to clear "
"driver state");
sme: Check for prev_bssid from sme_event_disassoc wpa_s->bssid is already cleared by mark_disassoc() when we're getting the disassociation event for the case where wpa_supplicant requested disassociation. wpa_s->sme.prev_bssid holds the BSSID we need to check for, so use that instead. Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
2010-08-18 20:23:26 +02:00
wpa_drv_deauthenticate(wpa_s, wpa_s->sme.prev_bssid,
SME: Deauthenticate to clear state after disassociation events cfg80211/mac80211 can get into somewhat confused state if the AP only disassociates us and leaves us in authenticated state. For now, force the state to be cleared with deauthentication to avoid confusing errors if we try to associate with the AP again. This gets rid of 30 second delay (scan timeout) in cases where only a disassociation frame is received from the AP.
2009-12-02 16:26:28 +01:00
WLAN_REASON_DEAUTH_LEAVING);
}
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
static void sme_auth_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_AUTHENTICATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Authentication timeout");
sme_deauth(wpa_s);
}
}
static void sme_assoc_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
if (wpa_s->wpa_state == WPA_ASSOCIATING) {
wpa_msg(wpa_s, MSG_DEBUG, "SME: Association timeout");
sme_deauth(wpa_s);
}
}
void sme_state_changed(struct wpa_supplicant *wpa_s)
{
/* Make sure timers are cleaned up appropriately. */
if (wpa_s->wpa_state != WPA_ASSOCIATING)
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
if (wpa_s->wpa_state != WPA_AUTHENTICATING)
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
}
void sme_disassoc_while_authenticating(struct wpa_supplicant *wpa_s,
const u8 *prev_pending_bssid)
{
/*
* mac80211-workaround to force deauth on failed auth cmd,
* requires us to remain in authenticating state to allow the
* second authentication attempt to be continued properly.
*/
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Allow pending authentication "
"to proceed after disconnection event");
wpa_supplicant_set_state(wpa_s, WPA_AUTHENTICATING);
os_memcpy(wpa_s->pending_bssid, prev_pending_bssid, ETH_ALEN);
/*
* Re-arm authentication timer in case auth fails for whatever reason.
*/
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
eloop_register_timeout(SME_AUTH_TIMEOUT, 0, sme_auth_timer, wpa_s,
NULL);
}
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
void sme_clear_on_disassoc(struct wpa_supplicant *wpa_s)
{
wpa_s->sme.prev_bssid_set = 0;
#ifdef CONFIG_SAE
wpabuf_free(wpa_s->sme.sae_token);
wpa_s->sme.sae_token = NULL;
sae_clear_data(&wpa_s->sme.sae);
#endif /* CONFIG_SAE */
#ifdef CONFIG_IEEE80211R
if (wpa_s->sme.ft_ies)
sme_update_ft_ies(wpa_s, NULL, NULL, 0);
#endif /* CONFIG_IEEE80211R */
}
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
void sme_deinit(struct wpa_supplicant *wpa_s)
{
os_free(wpa_s->sme.ft_ies);
wpa_s->sme.ft_ies = NULL;
wpa_s->sme.ft_ies_len = 0;
#ifdef CONFIG_IEEE80211W
sme_stop_sa_query(wpa_s);
#endif /* CONFIG_IEEE80211W */
SAE: Clear keys from memory on disassociation There is no need to keep temporary keys in memory beyond the end of the association, so explicitly clear any SAE buffers that can contain keys as soon as such keys are not needed. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-29 17:40:10 +01:00
sme_clear_on_disassoc(wpa_s);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
eloop_cancel_timeout(sme_assoc_timer, wpa_s, NULL);
eloop_cancel_timeout(sme_auth_timer, wpa_s, NULL);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
}
static void sme_send_2040_bss_coex(struct wpa_supplicant *wpa_s,
const u8 *chan_list, u8 num_channels,
u8 num_intol)
{
struct ieee80211_2040_bss_coex_ie *bc_ie;
struct ieee80211_2040_intol_chan_report *ic_report;
struct wpabuf *buf;
SME: Add more debug prints for OBSS scans and 20/40 MHz co-ex report This makes it easier to debug wpa_supplicant behavior when reporting 20/40 MHz co-ex information based on OBSS scans. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:56:50 +01:00
wpa_printf(MSG_DEBUG, "SME: Send 20/40 BSS Coexistence to " MACSTR
" (num_channels=%u num_intol=%u)",
MAC2STR(wpa_s->bssid), num_channels, num_intol);
wpa_hexdump(MSG_DEBUG, "SME: 20/40 BSS Intolerant Channels",
chan_list, num_channels);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
buf = wpabuf_alloc(2 + /* action.category + action_code */
sizeof(struct ieee80211_2040_bss_coex_ie) +
sizeof(struct ieee80211_2040_intol_chan_report) +
num_channels);
if (buf == NULL)
return;
wpabuf_put_u8(buf, WLAN_ACTION_PUBLIC);
wpabuf_put_u8(buf, WLAN_PA_20_40_BSS_COEX);
bc_ie = wpabuf_put(buf, sizeof(*bc_ie));
bc_ie->element_id = WLAN_EID_20_40_BSS_COEXISTENCE;
bc_ie->length = 1;
if (num_intol)
bc_ie->coex_param |= WLAN_20_40_BSS_COEX_20MHZ_WIDTH_REQ;
if (num_channels > 0) {
ic_report = wpabuf_put(buf, sizeof(*ic_report));
ic_report->element_id = WLAN_EID_20_40_BSS_INTOLERANT;
ic_report->length = num_channels + 1;
ic_report->op_class = 0;
os_memcpy(wpabuf_put(buf, num_channels), chan_list,
num_channels);
}
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
wpa_s->own_addr, wpa_s->bssid,
wpabuf_head(buf), wpabuf_len(buf), 0) < 0) {
wpa_msg(wpa_s, MSG_INFO,
"SME: Failed to send 20/40 BSS Coexistence frame");
}
wpabuf_free(buf);
}
int sme_proc_obss_scan(struct wpa_supplicant *wpa_s)
{
struct wpa_bss *bss;
const u8 *ie;
u16 ht_cap;
u8 chan_list[P2P_MAX_CHANNELS], channel;
u8 num_channels = 0, num_intol = 0, i;
if (!wpa_s->sme.sched_obss_scan)
return 0;
wpa_s->sme.sched_obss_scan = 0;
if (!wpa_s->current_bss || wpa_s->wpa_state != WPA_COMPLETED)
return 1;
/*
* Check whether AP uses regulatory triplet or channel triplet in
* country info. Right now the operating class of the BSS channel
* width trigger event is "unknown" (IEEE Std 802.11-2012 10.15.12),
* based on the assumption that operating class triplet is not used in
* beacon frame. If the First Channel Number/Operating Extension
* Identifier octet has a positive integer value of 201 or greater,
* then its operating class triplet.
*
* TODO: If Supported Operating Classes element is present in beacon
* frame, have to lookup operating class in Annex E and fill them in
* 2040 coex frame.
*/
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_COUNTRY);
if (ie && (ie[1] >= 6) && (ie[5] >= 201))
return 1;
os_memset(chan_list, 0, sizeof(chan_list));
dl_list_for_each(bss, &wpa_s->bss, struct wpa_bss, list) {
/* Skip other band bss */
Use a common frequency to channel conversion function Signed-hostap: Jouni Malinen <j@w1.fi>
2013-04-27 20:27:15 +02:00
enum hostapd_hw_mode mode;
mode = ieee80211_freq_to_chan(bss->freq, &channel);
if (mode != HOSTAPD_MODE_IEEE80211G &&
mode != HOSTAPD_MODE_IEEE80211B)
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
continue;
ie = wpa_bss_get_ie(bss, WLAN_EID_HT_CAP);
ht_cap = (ie && (ie[1] == 26)) ? WPA_GET_LE16(ie + 2) : 0;
SME: Add more debug prints for OBSS scans and 20/40 MHz co-ex report This makes it easier to debug wpa_supplicant behavior when reporting 20/40 MHz co-ex information based on OBSS scans. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:56:50 +01:00
wpa_printf(MSG_DEBUG, "SME OBSS scan BSS " MACSTR
" freq=%u chan=%u ht_cap=0x%x",
MAC2STR(bss->bssid), bss->freq, channel, ht_cap);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (!ht_cap || (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)) {
SME: Fix OBSS scan result processing for 20/40 MHz co-ex report The 40 MHz intolerant bit needs to be checked before skipping the BSS based on the channel already being in the lost (which could have happened due to another BSS that does not indicate 40 MHz intolerant). This fixed the 20/40 MHz co-ex report to indicate 20 MHz request properly if there are both 40 MHz tolerant and intolerant BSSes on the same channel. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-03-23 22:54:50 +01:00
if (ht_cap & HT_CAP_INFO_40MHZ_INTOLERANT)
num_intol++;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
/* Check whether the channel is already considered */
for (i = 0; i < num_channels; i++) {
if (channel == chan_list[i])
break;
}
if (i != num_channels)
continue;
chan_list[num_channels++] = channel;
}
}
sme_send_2040_bss_coex(wpa_s, chan_list, num_channels, num_intol);
return 1;
}
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
static struct hostapd_hw_modes * get_mode(struct hostapd_hw_modes *modes,
u16 num_modes,
enum hostapd_hw_mode mode)
{
u16 i;
for (i = 0; i < num_modes; i++) {
if (modes[i].mode == mode)
return &modes[i];
}
return NULL;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
static void wpa_obss_scan_freqs_list(struct wpa_supplicant *wpa_s,
struct wpa_driver_scan_params *params)
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
{
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
/* Include only affected channels */
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
struct hostapd_hw_modes *mode;
int count, i;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int start, end;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
mode = get_mode(wpa_s->hw.modes, wpa_s->hw.num_modes,
HOSTAPD_MODE_IEEE80211G);
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode == NULL) {
/* No channels supported in this band - use empty list */
params->freqs = os_zalloc(sizeof(int));
return;
}
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
if (wpa_s->sme.ht_sec_chan == HT_SEC_CHAN_UNKNOWN &&
wpa_s->current_bss) {
const u8 *ie;
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_OPERATION);
if (ie && ie[1] >= 2) {
u8 o;
o = ie[3] & HT_INFO_HT_PARAM_SECONDARY_CHNL_OFF_MASK;
if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_ABOVE)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_ABOVE;
else if (o == HT_INFO_HT_PARAM_SECONDARY_CHNL_BELOW)
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_BELOW;
}
}
start = wpa_s->assoc_freq - 10;
end = wpa_s->assoc_freq + 10;
switch (wpa_s->sme.ht_sec_chan) {
case HT_SEC_CHAN_UNKNOWN:
/* HT40+ possible on channels 1..9 */
if (wpa_s->assoc_freq <= 2452)
start -= 20;
/* HT40- possible on channels 5-13 */
if (wpa_s->assoc_freq >= 2432)
end += 20;
break;
case HT_SEC_CHAN_ABOVE:
end += 20;
break;
case HT_SEC_CHAN_BELOW:
start -= 20;
break;
}
wpa_printf(MSG_DEBUG,
"OBSS: assoc_freq %d possible affected range %d-%d",
wpa_s->assoc_freq, start, end);
Convert os_zalloc() for an array to use os_calloc() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 19:44:21 +02:00
params->freqs = os_calloc(mode->num_channels + 1, sizeof(int));
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (params->freqs == NULL)
return;
for (count = 0, i = 0; i < mode->num_channels; i++) {
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
int freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
if (mode->channels[i].flag & HOSTAPD_CHAN_DISABLED)
continue;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
freq = mode->channels[i].freq;
if (freq - 10 >= end || freq + 10 <= start)
continue; /* not affected */
params->freqs[count++] = freq;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
}
}
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
static void sme_obss_scan_timeout(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
struct wpa_driver_scan_params params;
if (!wpa_s->current_bss) {
wpa_printf(MSG_DEBUG, "SME OBSS: Ignore scan request");
return;
}
os_memset(&params, 0, sizeof(params));
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_obss_scan_freqs_list(wpa_s, &params);
nl80211: Use low-priority scan for OBSS scan Some drivers may support low-priority scans, if they do then use that for OBSS scanning. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2014-06-04 11:21:40 +02:00
params.low_priority = 1;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
wpa_printf(MSG_DEBUG, "SME OBSS: Request an OBSS scan");
if (wpa_supplicant_trigger_scan(wpa_s, &params))
wpa_printf(MSG_DEBUG, "SME OBSS: Failed to trigger scan");
else
wpa_s->sme.sched_obss_scan = 1;
Scan only 2.4 GHz band for OBSS scans Since we are reporting 20/40 BSS coex information only for 2.4 GHz band, there is no need to run the full scan on dualband cards. Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 14:51:18 +02:00
os_free(params.freqs);
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
}
void sme_sched_obss_scan(struct wpa_supplicant *wpa_s, int enable)
{
const u8 *ie;
struct wpa_bss *bss = wpa_s->current_bss;
struct wpa_ssid *ssid = wpa_s->current_ssid;
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
struct hostapd_hw_modes *hw_mode = NULL;
int i;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
eloop_cancel_timeout(sme_obss_scan_timeout, wpa_s, NULL);
wpa_s->sme.sched_obss_scan = 0;
SME: Optimize OBSS scanning Include only the potentially affected channel range in OBSS scans to reduce the amount of offchannel time needed for scanning when requested by the AP. Signed-off-by: Jouni Malinen <j@w1.fi>
2014-12-22 21:07:03 +01:00
wpa_s->sme.ht_sec_chan = HT_SEC_CHAN_UNKNOWN;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (!enable)
return;
Allow OBSS scan and 20/40 coex reports to non-SME drivers We enable this feature for non-SME drivers as well if they explicitly indicate need for it. Signed-off-by: Amitkumar Karwar <akarwar@marvell.com> Signed-off-by: Bing Zhao <bzhao@marvell.com>
2012-11-24 17:08:48 +01:00
/*
* Schedule OBSS scan if driver is using station SME in wpa_supplicant
* or it expects OBSS scan to be performed by wpa_supplicant.
*/
if (!((wpa_s->drv_flags & WPA_DRIVER_FLAGS_SME) ||
(wpa_s->drv_flags & WPA_DRIVER_FLAGS_OBSS_SCAN)) ||
ssid == NULL || ssid->mode != IEEE80211_MODE_INFRA)
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
SME: Correctly check mode HT caps for enabling OBSS scan Don't assume the 11g mode is always first in the list of mode (sometimes it isn't). Traverse the array of modes and check the HT40 capability is turned on for 11g. Signed-hostap: Arik Nemtsov <arik@wizery.com>
2012-08-11 16:08:54 +02:00
if (!wpa_s->hw.modes)
return;
/* only HT caps in 11g mode are relevant */
for (i = 0; i < wpa_s->hw.num_modes; i++) {
hw_mode = &wpa_s->hw.modes[i];
if (hw_mode->mode == HOSTAPD_MODE_IEEE80211G)
break;
}
/* Driver does not support HT40 for 11g or doesn't have 11g. */
if (i == wpa_s->hw.num_modes || !hw_mode ||
!(hw_mode->ht_capab & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return;
Add handling of OBSS scan requests and 20/40 BSS coex reports Add support for HT STA to report 40 MHz intolerance to the associated AP. A HT station generates a report (20/40 BSS coexistence) of channel list if it finds a non-HT capable AP or a HT AP which prohibits 40 MHz transmission (i.e., 40 MHz intolerant bit is set in HT capabilities IE) from the scan results. Parse the OBSS scan parameter from Beacon or Probe Response frames and schedule periodic scan to generate 20/40 coexistence channel report if requested to do so. This patch decodes Scan Interval alone from the OBSS Scan Parameters element and triggers scan on timeout. Signed-off-by: Rajkumar Manoharan <rmanohar@qca.qualcomm.com> Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-05-03 11:13:43 +02:00
if (bss == NULL || bss->freq < 2400 || bss->freq > 2500)
return; /* Not associated on 2.4 GHz band */
/* Check whether AP supports HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss, WLAN_EID_HT_CAP);
if (!ie || ie[1] < 2 ||
!(WPA_GET_LE16(ie + 2) & HT_CAP_INFO_SUPP_CHANNEL_WIDTH_SET))
return; /* AP does not support HT40 */
ie = wpa_bss_get_ie(wpa_s->current_bss,
WLAN_EID_OVERLAPPING_BSS_SCAN_PARAMS);
if (!ie || ie[1] < 14)
return; /* AP does not request OBSS scans */
wpa_s->sme.obss_scan_int = WPA_GET_LE16(ie + 6);
if (wpa_s->sme.obss_scan_int < 10) {
wpa_printf(MSG_DEBUG, "SME: Invalid OBSS Scan Interval %u "
"replaced with the minimum 10 sec",
wpa_s->sme.obss_scan_int);
wpa_s->sme.obss_scan_int = 10;
}
wpa_printf(MSG_DEBUG, "SME: OBSS Scan Interval %u sec",
wpa_s->sme.obss_scan_int);
eloop_register_timeout(wpa_s->sme.obss_scan_int, 0,
sme_obss_scan_timeout, wpa_s, NULL);
SME: Add timers for authentication and asscoiation mac80211 authentication or association operation may get stuck for some reasons, so wpa_supplicant better use an internal timer to recover from this. Signed-off-by: Ben Greear <greearb@candelatech.com>
2011-02-24 15:59:46 +01:00
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
#ifdef CONFIG_IEEE80211W
static const unsigned int sa_query_max_timeout = 1000;
static const unsigned int sa_query_retry_timeout = 201;
static int sme_check_sa_query_timeout(struct wpa_supplicant *wpa_s)
{
u32 tu;
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
struct os_reltime now, passed;
os_get_reltime(&now);
os_reltime_sub(&now, &wpa_s->sme.sa_query_start, &passed);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
tu = (passed.sec * 1000000 + passed.usec) / 1024;
if (sa_query_max_timeout < tu) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: SA Query timed out");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
wpa_supplicant_deauthenticate(
wpa_s, WLAN_REASON_PREV_AUTH_NOT_VALID);
return 1;
}
return 0;
}
static void sme_send_sa_query_req(struct wpa_supplicant *wpa_s,
const u8 *trans_id)
{
u8 req[2 + WLAN_SA_QUERY_TR_ID_LEN];
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Sending SA Query Request to "
MACSTR, MAC2STR(wpa_s->bssid));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_hexdump(MSG_DEBUG, "SME: SA Query Transaction ID",
trans_id, WLAN_SA_QUERY_TR_ID_LEN);
req[0] = WLAN_ACTION_SA_QUERY;
req[1] = WLAN_SA_QUERY_REQUEST;
os_memcpy(req + 2, trans_id, WLAN_SA_QUERY_TR_ID_LEN);
P2P: Add option for offloading off-channel TX to the driver With the new kernel functionality coming to Linux to allow off-channel TX, we can take advantage of that in the P2P code that currently uses remain-on-channel. If a driver advertises support for it, it will be asked to handle off-channel TX by itself. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2010-12-29 12:59:17 +01:00
if (wpa_drv_send_action(wpa_s, wpa_s->assoc_freq, 0, wpa_s->bssid,
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
wpa_s->own_addr, wpa_s->bssid,
Add no_cck parameter for send_action() driver_ops This can be used to apply the no-CCK rule conditionally depending on which frame is being sent. The no-CCK rule applies only for P2P management frames while SA Query and FT use cases do not have similar restrictions. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-10-29 20:49:46 +02:00
req, sizeof(req), 0) < 0)
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_msg(wpa_s, MSG_INFO, "SME: Failed to send SA Query "
"Request");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
static void sme_sa_query_timer(void *eloop_ctx, void *timeout_ctx)
{
struct wpa_supplicant *wpa_s = eloop_ctx;
unsigned int timeout, sec, usec;
u8 *trans_id, *nbuf;
if (wpa_s->sme.sa_query_count > 0 &&
sme_check_sa_query_timeout(wpa_s))
return;
Convert os_realloc() for an array to use os_realloc_array() Signed-hostap: Jouni Malinen <j@w1.fi>
2012-08-13 20:21:23 +02:00
nbuf = os_realloc_array(wpa_s->sme.sa_query_trans_id,
wpa_s->sme.sa_query_count + 1,
WLAN_SA_QUERY_TR_ID_LEN);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (nbuf == NULL)
return;
if (wpa_s->sme.sa_query_count == 0) {
/* Starting a new SA Query procedure */
wpa_supplicant: Use monotonic time for SA query timeout The SA query timeout is just a regular timeout (currently hard-coded to 1000 TU), so use monotonic time for it. Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2013-12-16 21:08:27 +01:00
os_get_reltime(&wpa_s->sme.sa_query_start);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
}
trans_id = nbuf + wpa_s->sme.sa_query_count * WLAN_SA_QUERY_TR_ID_LEN;
wpa_s->sme.sa_query_trans_id = nbuf;
wpa_s->sme.sa_query_count++;
SME: Verify that os_get_random() succeeds for SA Query Be more consistent on checking os_get_random() return value (CID 72706). Signed-off-by: Jouni Malinen <j@w1.fi>
2014-09-07 17:27:42 +02:00
if (os_get_random(trans_id, WLAN_SA_QUERY_TR_ID_LEN) < 0) {
wpa_printf(MSG_DEBUG, "Could not generate SA Query ID");
return;
}
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
timeout = sa_query_retry_timeout;
sec = ((timeout / 1000) * 1024) / 1000;
usec = (timeout % 1000) * 1024;
eloop_register_timeout(sec, usec, sme_sa_query_timer, wpa_s, NULL);
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Association SA Query attempt %d",
wpa_s->sme.sa_query_count);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_send_sa_query_req(wpa_s, trans_id);
}
static void sme_start_sa_query(struct wpa_supplicant *wpa_s)
{
sme_sa_query_timer(wpa_s, NULL);
}
Mark local functions static These functions are not used outside the file in which they are defined. Signed-hostap: Jouni Malinen <j@w1.fi>
2011-11-18 20:53:36 +01:00
static void sme_stop_sa_query(struct wpa_supplicant *wpa_s)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
{
eloop_cancel_timeout(sme_sa_query_timer, wpa_s, NULL);
os_free(wpa_s->sme.sa_query_trans_id);
wpa_s->sme.sa_query_trans_id = NULL;
wpa_s->sme.sa_query_count = 0;
}
void sme_event_unprot_disconnect(struct wpa_supplicant *wpa_s, const u8 *sa,
const u8 *da, u16 reason_code)
{
struct wpa_ssid *ssid;
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
struct os_reltime now;
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (wpa_s->wpa_state != WPA_COMPLETED)
return;
ssid = wpa_s->current_ssid;
Ignore pmf=1 default if driver does not support PMF Connection with a PMF enabled AP will fail if we try to negotiate PMF while the local driver does not support this. Since pmf=1 does not require PMF for a successful connection, it can be ignored in such a case to avoid connectivity issues with invalid configuration. This makes it somewhat easier to allow upper layer programs to use pmf=1 default regardless of driver capabilities. Signed-off-by: Jouni Malinen <j@w1.fi>
2015-01-26 16:40:22 +01:00
if (wpas_get_ssid_pmf(wpa_s, ssid) == NO_MGMT_FRAME_PROTECTION)
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
return;
if (reason_code != WLAN_REASON_CLASS2_FRAME_FROM_NONAUTH_STA &&
reason_code != WLAN_REASON_CLASS3_FRAME_FROM_NONASSOC_STA)
return;
if (wpa_s->sme.sa_query_count > 0)
return;
Rate limit SA Query procedure initiation on unprotected disconnect There is no need to trigger new SA Query procedure to check the state of the connection immediately after having performed such a check. Limit the impact of burst of unprotected Deauth/Disassoc frames by starting a new SA Query procedure only once at least 10 seconds has passed from the previous SA Query that was triggered by reception of an unprotected disconnection. The first SA Query procedure for each association does not follow this rule to avoid issues with test cases that expect to see an SA Query every time. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2014-06-19 19:56:32 +02:00
os_get_reltime(&now);
if (wpa_s->sme.last_unprot_disconnect.sec &&
!os_reltime_expired(&now, &wpa_s->sme.last_unprot_disconnect, 10))
return; /* limit SA Query procedure frequency */
wpa_s->sme.last_unprot_disconnect = now;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Unprotected disconnect dropped - "
"possible AP/STA state mismatch - trigger SA Query");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_start_sa_query(wpa_s);
}
void sme_sa_query_rx(struct wpa_supplicant *wpa_s, const u8 *sa,
const u8 *data, size_t len)
{
int i;
if (wpa_s->sme.sa_query_trans_id == NULL ||
len < 1 + WLAN_SA_QUERY_TR_ID_LEN ||
data[0] != WLAN_SA_QUERY_RESPONSE)
return;
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Received SA Query response from "
MACSTR " (trans_id %02x%02x)", MAC2STR(sa), data[1], data[2]);
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
if (os_memcmp(sa, wpa_s->bssid, ETH_ALEN) != 0)
return;
for (i = 0; i < wpa_s->sme.sa_query_count; i++) {
if (os_memcmp(wpa_s->sme.sa_query_trans_id +
i * WLAN_SA_QUERY_TR_ID_LEN,
data + 1, WLAN_SA_QUERY_TR_ID_LEN) == 0)
break;
}
if (i >= wpa_s->sme.sa_query_count) {
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: No matching SA Query "
"transaction identifier found");
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
return;
}
Use wpa_msg() instead of wpa_printf() This converts number of debugging messages to use wpa_msg() in order to allow the interface name to be shown with the messages. A new function, wpa_dbg(), is introduced to allow CONFIG_NO_STDOUT_DEBUG=y builds to remove the debug strings. This is otherwise identical with wpa_msg(), but it gets compiled out if stdout debugging is disabled.
2011-02-10 19:14:46 +01:00
wpa_dbg(wpa_s, MSG_DEBUG, "SME: Reply to pending SA Query received "
"from " MACSTR, MAC2STR(sa));
Use SA Query procedure to recovery from AP/STA state mismatch If a station received unprotected Deauthentication or Disassociation frame with reason code 6 or 7 from the current AP, there may be a mismatch in association state between the AP and STA. Verify whether this is the case by using SA Query procedure. If not response is received from the AP, deauthenticate. This implementation is only for user space SME with driver_nl80211.c.
2010-12-19 10:58:00 +01:00
sme_stop_sa_query(wpa_s);
}
#endif /* CONFIG_IEEE80211W */
Reference in a new issue Copy permalink