Commit graph

9410 commits

Author SHA1 Message Date
Jouni Malinen
12a9574342 nl80211: Fix AP deinit path (link removal) in error cases
If the interface initialization fails, no links might be set when
calling the deinit functions. Those functions need to be prepared for
bss->n_links being 0.

Fixes: 859cbc396f ("nl80211: Remove links when stopping AP MLD in hostapd")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 11:13:28 +02:00
Jouni Malinen
6c3438eef6 nl80211: Fix AP deinit path in error cases
If the interface initialization fails, no links might be set when
calling the deinit functions. Those functions need to be prepared for
bss->flink being NULL.

Fixes: 47269be36e ("nl80211: Refactor i802_bss to support multiple links")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-22 11:13:25 +02:00
Gururaj Pandurangi
6b7bb10016 Add QCA vendor attribute for EHT SCS traffic description support
Add a vendor attribute for EHT testbed STA to configure the
SCS traffic description support in the EHT capabilities of an
Association Request frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-21 20:22:49 +02:00
mukul sharma
f8657ea031 Add QCA vendor command for reporting firmware page fault informatin
This is an event indicating to the user space firmware page fault
summary report that the driver has generated from firmware indications.
This summary report is used to analyze major cause of page faults and
associated debug information.

Signed-off-by: Mukul Sharma <quic_mukul@quicinc.com>
2023-12-21 20:18:44 +02:00
Shiva Sankar Gajula
ee00bbd297 Support VLAN offload with SAE password based selection
Allow VLAN selection based on SAE password entries when VLAN offloading
is used.

Signed-off-by: Shiva Sankar Gajula <quic_sgajula@quicinc.com>
2023-12-21 20:12:18 +02:00
Jouni Malinen
09d57e5f89 MBSSID: Element ID values in increasing order in Non-Inheritance element
Reorder the Element ID List to fill in the values in increasing order to
match the way the Element ID List is defined.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-21 13:22:03 +02:00
Aditya Kumar Singh
c8dd70cfb1 Fix Multiple BSSID element length calculation
Currently while deciding to create a new Multiple BSSID element based on
the condition when the length reaches 255, the length value being used
is the total element length (including the length of the Element ID and
Length fields as well). However, the value in the length field denotes
the number of octets following it and excluding itself. Hence including
the total length is wrong. This leads to incorrect count of Multiple
BSSID elements.

And while filling the data, the length is considered porperly as it
should be hence we are filling more data in a single go and all data is
filled in MBSSID count which is less than originally calculated. This
ultimately leads to incorrect length calculation during nla_put() and
setting the beacon to the driver fails while putting the Multiple BSSID
element data into the netlink socket buffer.

Fix this issue by considering the length excluding the Element ID and
Length field sizes.

Signed-off-by: Aditya Kumar Singh <quic_adisi@quicinc.com>
2023-12-21 12:50:27 +02:00
Sai Pratyusha Magam
618df655ae Use sta->vlan_id when needed for VLAN offload
Share VLAN info in RRB when the driver advertises support for VLAN
offload (WPA_DRIVER_FLAGS_VLAN_OFFLOAD). sta->vlan_desc is unused in
this case, only sta->vlan_id is used. Skip the checks that are based on
sta->vlan_desc.

Signed-off-by: Sai Pratyusha Magam <quic_smagam@quicinc.com>
2023-12-21 12:24:35 +02:00
Jouni Malinen
afd306cf79 nl80211: Remove send_and_recv_msgs()
This helper is of no real use anymore, so get rid of it. This completes
send_and_recv*() cleanup. What remains is the most generic
send_and_recv() and two wrappers for it to cover the most common simpler
cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:09:22 +02:00
Jouni Malinen
7c2f67cea2 nl80211: Add send_and_recv_resp() helper
This is a variant for the second most common case of send_and_recv() needs:
send a command with a special response handling.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:07:36 +02:00
Jouni Malinen
ab506d7772 nl80211: Add send_and_recv_cmd() helper
This is a variant for the most common case of send_and_recv() needs:
send a command without needing a special response handling. In addition,
move the helper functions into driver_nl80211.h since these are now
simple wrappers for the more flexible send_and_recv().

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 01:00:23 +02:00
Jouni Malinen
c73f9cde8b nl80211: Remove send_and_recv_msgs_connect_handle()
This is not really that helpful as a separate helper function, so get
rid of one of the many send_and_recv() variants.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:38:11 +02:00
Jouni Malinen
d2e6a395cc nl80211: Do not set socket owner for NL80211_CMD_LEAVE_IBSS
This operation terminates the IBSS and as such, does not really use
NL80211_ATTR_SOCKET_OWNER.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:28:30 +02:00
Jouni Malinen
35e58b7415 nl80211: Remove send_and_recv_msgs_owner()
This is not helpful as a separate helper function anymore, so get rid of
one of the many send_and_recv() variants.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:26:32 +02:00
Jouni Malinen
9823f43053 nl80211: Move control port attribute adding into more accurate location
This is independent of the NL80211_ATTR_SOCKET_OWNER use, so add these
attributes from a separate helper function that is called only from
locations that actually start an operation that uses EAPOL frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-19 00:20:16 +02:00
Jouni Malinen
0d619df8b3 nl80211: Use bss->nl_connect unconditionally
Doing this based on driver support for control port RX or SAE seems like
undesired extra complexity. Just use this in all cases where the special
handle for a longer term operation, like connection or AP mode
operation, is needed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 23:45:09 +02:00
Jouni Malinen
da0d51fee7 nl80211: Use socket cb instead of global->nl_cb in send_and_recv()
This is a step towards cleaning up all the workarounds that have showed
up over the years and made the design difficult to understand. This
removes use of the separate registration of process_bss_event() as
NL_CB_VALID for the individual commands since the use of the appropriate
cb (i.e., the one from nl80211_init_bss() in these cases) will already
point to the correct handler.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 21:41:32 +02:00
Jouni Malinen
84fdc8cd8b nl80211: Accept NL80211_CMD_FRAME events in global context
This is a workaround for some race conditions where the hardcoded use of
global->nl_cb in send_and_recv() ends up getting events delivered
through unexpected context when they happen to arrive at the time when a
command is being processed.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-18 21:08:26 +02:00
Jouni Malinen
828311ef31 AP MLD: More careful checking of Multi-Link element length fields
Avoid potential read of one or two octets beyond the end of the
subelement when verifying that there is sufficient amount of data
included in each subelement/element within the MLE in Association
Request frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 21:55:10 +02:00
Jouni Malinen
38a5ed5fda AP MLD: Skip unknown Multi-Link element subelements
Instead of rejecting the Multi-Link element, skip unknown subelements to
be less likely to cause interop issues for future. IEEE P802.11be/D5.0
allows other optional subelements to be included here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 21:53:52 +02:00
Jouni Malinen
2ab56694f6 Split ap_sta_set_authorized() into two steps
This function is both updating the hostapd-internal sta->flags value and
sending out the AP-STA-CONNECTED control interface message. When
authorizing a STA, the call to this function is followed by a driver
command to update the flags of the STA entry in the driver. That has a
race condition at least for UML time-travel since the AP-STA-CONNECTED
event is used as a message to wait for before running a connectivity
test or some other operation that depends on the data connection being
in working condition.

Split the function into two steps so that the driver STA entry update
can be done between those two steps for the cases where it matters for
the race condition. In other words, send the AP-STA-CONNECTED message
only after having authorized the STA in the driver.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 14:09:57 +02:00
Jouni Malinen
da8a38fecb Remove unused assignment from Country element generation
This looks confusing and can cause warnings from static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:17:43 +02:00
Jouni Malinen
33b5fc0763 PKCS#1: Do not use pointer value after freeing
The check for extra data was not dereferencing the pointer, but avoid
complaints about such uses by freeing the decrypted data only after the
check. The hexdump could have read freed memory, so that needs to be
before the freeing.

Fixes: 54ac6ff8c4 ("PKCS 1: Add function for checking v1.5 RSA signature")
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:17:10 +02:00
Jouni Malinen
231d86ef91 OpenSSL: Check EVP_MAC_update() return value more consistently
Check this in crypto_hash_update() to be more consistent and report any
error in crypto_hash_finish().

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 12:06:04 +02:00
Jouni Malinen
a92694b001 OpenSSL: Check EVP_CIPHER_CTX_set_padding() return value more consistently
Even though this function is documented to always return 1, be more
consistent in checking that to avoid warnings from static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 11:58:48 +02:00
Jouni Malinen
88bc6711a7 TDLS: Avoid unnecessary copying of the Link Identifier element
This memcpy was causing warnings from static analyzers since it is being
misinterpreted as copying all the data into the lnkid.bssid[] array
instead of that and the following arrays. Since the copy is not needed
at all, just use the original pointer to get rid of these warnings.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 11:51:35 +02:00
Jouni Malinen
656cf50d8b More consistent sta pointer checks in handle_assoc()
Verify that sta is not NULL before calling
hostapd_process_assoc_ml_info() that references this parameter. In
theory, sta might be NULL here if addition of the STA entry failed in
the 60 GHz case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 00:12:59 +02:00
Jouni Malinen
29f38ebcf6 ACS: Check whether iface->current_mode is NULL before use
This line seemed to trigger SIGSEGV in some code coverage testing cases.
It is not exactly clear how that was possible, but just in case, check
that iface->current_mode is set before using it here.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-17 00:02:43 +02:00
Jouni Malinen
7a873c81ee AP MLD: Do not schedule disconnection on BSS TM Request link removal
If the BSS TM Request for imminent BSS temoval is for a non-AP MLD that
has multiple affiliated links, do not schedule full disconnection since
other links remain associated.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-16 19:46:41 +02:00
Ilan Peer
ec70d14f7c AP: MLD: Extend BSS transition management request for link removal
Allow link removal imminent indication to be added with the new
link_removal_imminent=1 parameter to BSS_TM_REQ.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 19:46:41 +02:00
Ilan Peer
80810929a4 WNM: Handle BTM request with Link Removal Imminent field set to 1
Based on IEEE P802.11be/D5.0, when a station is non-AP MLD with more
than one link the combination of the Link Removal Imminent field set to
1 and the BSS Termination Included field set to 1 means than only one of
the links is removed while the other links will remains associated.
Handle this case without starting a scan to find another BSS.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 19:12:23 +02:00
Ilan Peer
31e025c033 AP: When sending Action frames, use the AP MLD MAC address if needed
When the AP MLD sends an Action frame to a non-AP MLD, use the AP MLD
MAC address instead of the local AP address (BSSID).

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:54:39 +02:00
Ilan Peer
54e6c56d25 AP: Use AP MLD MAC address for terminating MLO association
Use the AP MLD MAC address when sending Deauthentication and
Disassociation frames to a non-AP MLD.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:49:56 +02:00
Ilan Peer
0546f0e1b0 WNM: Use correct address when configured as AP MLD
When the AP is configured to operate as an AP MLD, use the AP MLD MAC
address when needed for transmission of WNM Action frames.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-16 18:43:18 +02:00
Michael-CY Lee
0af4c1478e hostapd: Check the bridge if ioctl SIOCBRADDIF fails
If ioctl() returns EBUSY on the command SIOCBRADDIF, the interface might
have already been added to the bridge by an external operation (e.g.,
netifd in OpenWrt), and linux_br_add_if() should not indicate an error.

Check whether the interface is correctly brigded when ioctl()
returns EBUSY and if so, report success.

Signed-off-by: Michael-CY Lee <michael-cy.lee@mediatek.com>
2023-12-16 18:16:05 +02:00
Ilan Peer
d43a49a66d Remove a spurious tab in hostapd_eid_rnr()
Remove a spurious \tab char in hostapd_eid_rnr() between arguments to a
function.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 17:58:33 +02:00
Ilan Peer
a28ea8e517 AP: Fix setting MLD Parameters subfield in RNR element
In case the TBTT information is reporting about an AP in the same AP MLD
as the current AP, the AP MLD ID in the MLD Parameters subfield should
be set to 0.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-12-16 17:56:42 +02:00
Chenming Huang
40410c04f4 AP MLD: Channel switch for specific link
Link ID needs to be specified for MLD case when doing channel switch.
Add it to the driver command.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2023-12-14 13:14:37 +02:00
Dmitrijs Martinovs
7dd7ae965a DFS: Change vht_capab according to user requested bandwidth
There are different CHAN_SWITCH flows for DFS and non-DFS channels.
Non-DFS one saves previous BW value in iface->conf, but DFS flow
replaces it with a new user requested value. Setting a non-DFS channel
after a DFS one with BW = 160 would have resulted in a mismatch between
the saved BW and vht_capab (if VHT160 was not included by default). This
would have led to a check fail in the hostapd_set_freq_params()
function.

Signed-off-by: Dmitrijs Martinovs <dmartinovs@maxlinear.com>
2023-12-10 20:58:57 +02:00
Jouni Malinen
8e294c3a2c P2P: Recover from successfully requested, but not started, listen
It is possible for the start_listen() callback to be called to request
the driver to start a driver operation and stop_listen() called
immediately after that (e.g., due to a request to transmit a P2P Public
Action frame) before the driver has had time to start ROC and send an
event to notify of that. Such a sequence could result in
p2p->pending_listen_freq being left to a nonzero value without getting a
call to p2p_listen_cb() to clear it. This would stop an ongoing P2P
listen operation since no following p2p_listen() call would start the
listen due to the pending command being assumed to be in effect.

Fix this by detecting this particular sequence and clearing
p2p->pending_listen_freq.

This was found with the p2p_listen_and_offchannel_tx test case with the
new kernel scheduled and UML time-travel.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-10 19:30:44 +02:00
Jouni Malinen
a83d3132e8 WNM: Define BSS transition management reason values
Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-09 11:22:14 +02:00
Vinayak Yadawad
7ee7b046a9 nl80211: Use attribute NL80211_ATTR_BSSID to scan for specific BSSID
With changes to optimize scan for specific BSSID, there arises a
scenario where in nl80211_trigger_scan() is called with a scan
randomization enabled. A combination of NL80211_ATTR_MAC for BSSID and
scan randomization, which uses NL80211_ATTR_MAC for a different purpose,
results in invalid error for the scan request. To fix the issue use
attribute NL80211_ATTR_BSSID instead of NL80211_ATTR_MAC.

NL80211_ATTR_BSSID was introduced in kernel commit 2fa436b3a2a7
("nl80211: Use different attrs for BSSID and random MAC addr in scan
req") in 2016. Prior to that, only NL80211_ATTR_MAC could be used for
specifying the target BSSID. For backwards compatibility, add the
NL80211_ATTR_MAC attribute as well when not using a random MAC address.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-12-09 10:56:20 +02:00
Benjamin Berg
5bbc9462a0 tests: Test driver association ML link rejection flow
The underlying driver can reject only specific links in an association
request. In that case we will only ignore the corresponding BSS. Add a
test for this flow by simulating an association failure on the second
link specifically.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-12-06 22:41:40 +02:00
Ilan Peer
32434aa68a AP: Always include WPA_STA_AUTHORIZED in station flags mask
As otherwise, the underlying driver would not handle a change
in the 'authorized' state.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-06 21:54:08 +02:00
Ilan Peer
174a8fc416 AP MLD: Do not modify flags for link stations
All the station flags other than WPA_STA_SHORT_PREAMBLE are relevant
only for the MLD station and not to the link stations (as these flags
are related to the MLD state and not the link state).

As for the WPA_STA_SHORT_PREAMBLE, since the station is an EHT
station, it must have short preamble.

Thus, do not propagate the flags change for link stations to the driver.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-06 21:49:09 +02:00
Mikelis Vuls
58116877b6 EHT: Fix updating center freq segment 0 index for HE and VHT
Add additional check for 6 GHz operating class. Otherwise this results
in setting incorrect segment 0 index for 5 GHz 40 MHz channel 157-161,
which has the same center segment 0 index 159 as 6 GHz 320 MHz expected
channel.

Fixes: 085a3fc76e ("EHT: Add 320 channel width support")
Signed-off-by: Mikelis Vuls <mvuls@maxlinear.com>
2023-12-06 12:11:13 +02:00
Jaap Keuter
37d122c2f1 KaY: Make debug output consistent
Be consistent in capitalization and peer presentation.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2023-12-06 12:11:08 +02:00
Jurijs Soloveckis
f0cb823512 EHT: Add configuration for the EHT default PE duration
Add a new configuration parameter for the duration of PE field in EHT TB
PPDU.

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-12-06 12:02:44 +02:00
Liangwei Dong
5a47bbc36b Add QCA vendor command to query transmit power information
Add a new QCA subcommand QCA_NL80211_VENDOR_SUBCMD_REGULATORY_TPC_INFO
and related attributes qca_wlan_vendor_attr_tpc_links,
qca_wlan_vendor_attr_tpc definition to query transmit power information
on STA interface from the driver for a connected AP.

The information includes regulatory max transmit power limit, AP local
power constraint advertised from AP's Beacon and Probe Response frames.
For PSD power mode, the information includes PSD power levels for each
subchannel of operating bandwidth. The information is driver calculated
power limits based on current regulatory domain, AP local power
constraint and other IEs. The information will be set to target. Target
will decide final TX power based on this and chip specific power
conformance test limits (CTL), and SAR limits.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-12-05 13:01:27 +02:00
Chenming Huang
9c2d6c4232 Add QCA vendor attributes for link id for HT-scan/ACS command
For AP MLD case, HT-scan and ACS happens per link. To determine the
correct link, link id is required.

Signed-off-by: Chenming Huang <quic_chenhuan@quicinc.com>
2023-12-05 12:52:01 +02:00
Nagarajan Maran
7b67055794 Add QCA vendor commands for SDWF
Define subcmd IDs 235 and 236 for Service Defined Wi-Fi (SDWF).

Signed-off-by: Nagarajan Maran <quic_nmaran@quicinc.com>
2023-12-04 17:33:27 +02:00
Chaitanya Tata
6ed8eba00d Add an option to remove RRM and supported operating class indication
Removing radio measurements and supported operating class indication
might be needed to reduce binary size for a memory constrained system
that does not need more advanced features. However, removing these is
not recommended since they can help the AP manage the network and STA
steering.

By default this functionality is enabled.

Signed-off-by: Chaitanya Tata <Chaitanya.Tata@nordicsemi.no>
2023-12-03 11:43:43 +02:00
Jun Yu
4b80ad1194 Populate the new beacon hint event to wpa_msg()
Beacon hinting is a feature that can temporarily change the regulatory
rule flags on the channel where the radio hears the beacon. Add a new
event CTRL-EVENT-REGDOM-BEACON-HINT to notify the wpa_supplicant user
about an important update to the regulatory rules including which
frequencies are impacted, new power limit, and new rule flags.

Signed-off-by: Jun Yu <junyuu@chromium.org>
2023-12-02 20:48:15 +02:00
Ilan Peer
d8cae2d024 nl80211: Do not allow off channel when frequency is not specified
Do not allow offchannel operation for action frame transmission if
no frequency is specified, as this doesn't make sense.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-12-02 20:35:21 +02:00
Jouni Malinen
4f69b4a31e mesh: Fix PMKSA cache entry addition with external PMKSA management
The length of the PMK ended up getting lost when a PMKSA cache entry was
added based on externally managed information. Set the PMK length in SAE
context to get the correct length stored into the actual PMKSA cache
entry that gets created in this path.

Signed-off-by: Jouni Malinen <j@w1.fi>
2023-12-02 20:31:16 +02:00
Jaap Keuter
0302c3ad22 trace: binutils replaces bfd_hostptr_t with uintptr_t
According to this message https://marc.info/?l=binutils&m=165363679302282
the type bfd_hostptr_t is dropped in favor of uintptr_t.
Replace the use of this type in the code.

Signed-off-by: Jaap Keuter <jaap.keuter@xs4all.nl>
2023-12-02 19:08:25 +02:00
Chenming Huang
d54d0d8983 AP MLD: Handle DFS in correct link
Link ID is needed for AP MLD to handle DFS events in the correct link.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:31:46 +02:00
Chenming Huang
f1fee0d1ff AP MLD: Handle channel switch event in correct link
USe the link ID information to determine the specific affiliated link
when processing channel switch events on an AP MLD.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:25:41 +02:00
Chenming Huang
fb6598864b nl80211: Add link ID when setting BSS attributes for AP MLD
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:12:46 +02:00
Chenming Huang
5487d8d9e9 nl80211: Specify link ID when sending Management frames
Extend nl80211_send_frame_cmd() to include the link ID to use for TX
with NL80211_CMD_FRAME.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:12:05 +02:00
Chenming Huang
859cbc396f nl80211: Remove links when stopping AP MLD in hostapd
There is an issue when starting a non-MLD AP on the same interface that
previous operated as an AP MLD. When the previous AP MLD got stopped,
links were not removed when using hostapd. Next non-MLD AP will fail to
start because some nl80211 operations still require link id (e.g., set
freq).

Remove links when AP MLD is stop to avoid such issue. This was already
done in the deinit_ap() handler when using wpa_supplicant, but hostapd
needs to do same.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-26 17:05:59 +02:00
Ilan Peer
780e72cc14 AP MLD: Do not include empty MLO KDEs
Do include group MLO KDEs for links for which the information is
missing.

In addition, set the KDE buffer length based on the added data.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 17:01:02 +02:00
Ilan Peer
ecd9ea0c8a AP MLD: Do not access WPA authenticator object if not valid
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 16:56:18 +02:00
Ilan Peer
21e8fcc807 nl80211: Add support for handling MLO removed links
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-26 13:42:43 +02:00
Benjamin Berg
cd79d834bf trace: Add TEST_FAIL_TAG macro to allow more narrow matching
The tag is inserted as the first item in the stack trace, making it
trivial to match against it from the test.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 13:00:45 +02:00
Benjamin Berg
781e87c418 trace: Allow multiple failures in one test
Refactor the backtrace matching a bit in order to allow triggering
multiple failures in one test.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:47:40 +02:00
Benjamin Berg
e62d351ce7 trace: Document function pattern prefixes
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:45:12 +02:00
Benjamin Berg
5545d995b3 trace: Share common implementation for TEST_FAIL and TEST_ALLOC_FAIL
Get rid of more or less duplicated implementation of backtrace matching
for the two testing failure cases.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:40:11 +02:00
Benjamin Berg
7d901dc7e7 trace: Use an array of skipped function names
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:14:04 +02:00
Benjamin Berg
e9bdecce4d Share TEST_FAIL/TEST_ALLOC_FAIL/GET_FAIL/GET_ALLOC_FAIL handler
Move the hostapd and wpa_supplicant control interface handlers into a
shared functions instead of duplicated implementation.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-26 12:03:47 +02:00
Andrei Otcheretianski
6fc2d1357d AP: Get rid of wpa_auth_pmksa_add3()
Simply pass another parameter to wpa_auth_pmksa_add2() instead.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-26 00:06:50 +02:00
Ilan Peer
e996704201 AP: Handle re-association from a non-AP MLD
When processing a (Re)Association Request frame and no corresponding
station is found, try to find the station using the station MLD MAC
address from the Basic ML element, as it is possible that the station
is trying to re-associate but with a different link address (in such
a case the underlying driver would not perform address translations).

When sending the (Re)Association Response frame, use the addresses from
the (Re)Association Request frame and not the AP MLD MAC address, again,
to avoid the address translation done in the driver.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-26 00:05:51 +02:00
Ilan Peer
a18f8ee0f5 AP MLD: Use MLD MAC address for SA query and response when needed
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-25 21:52:23 +02:00
Andrei Otcheretianski
d64ec94140 AP MLD: Don't include AP MLD ID in Beacon frames
IEEE P802.11be/D4.0, 9.4.2.312.2.3 states that the AP MLD ID should only
be included in some ML probe responses. Beacon frames shouldn't include
AP MLD ID.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:50:03 +02:00
Benjamin Berg
3bde811756 ML: Add basic handling of ML probe requests
This responds by simply embedding most of the IEs from the other links
into the ML element. This is not correct really, as inheritance rules
should be applied and an inheritance element may need to be added.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:47:44 +02:00
Benjamin Berg
ecb22ba12e AP: MLO: Add helper to iterate all links of an AP MLD
Add a simple for_each_mld_link helper that sets first variable to the
hapd data for every link. It takes the interfaces and MLD ID as
arguments and two extra integers as scratch variables (for the interface
and bss offsets).

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-25 18:30:57 +02:00
Benjamin Berg
db2bc0364f AP: Add parsing of ML probe requests
This adds the parsing of ML probe requests. Handling will be added by a
later commit.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:29:50 +02:00
Benjamin Berg
82453a3482 AP: Split Probe Response frame IE generation into a separate function
To support ML probe request we will need to include IEs from the other
hapd instances in the response. Split the function to allow just
generating the per-instance IEs separately.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:22:41 +02:00
Benjamin Berg
6b5e00a80e AP: Use a struct for Probe Response generation in/out params
This effectively moves setting the csa/ecsa/cca position to happen
only when a Probe Response template for offloading is generated.

One could probably avoid the global variable altogether, as the
value is immediately consumed into struct {csa,cca}_settings.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 18:10:18 +02:00
Benjamin Berg
4a1cd7f545 nl80211: Report link specific association failures from the kernel
If a link specific error occured, mark the offending link within the
association parameters.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 17:06:52 +02:00
Benjamin Berg
6ba9b9440b nl80211: Add support to parse out link from error reply
The kernel may report the link that caused an error by setting
NLMSGERR_ATTR_OFFS pointing to the NL80211_ATTR_MLO_LINKS element
that was the reason for the error.

Parse this information if the optional struct nl80211_err_info is
passed to send_and_recv_msgs().

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 17:03:52 +02:00
Benjamin Berg
92d8d1d760 MLD: Add a TEST_FAIL to fail one link in an MLD association.
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 16:49:43 +02:00
Benjamin Berg
846e65c7ce MLD: Return status code for links when rejecting association
When the TX link rejects the association, return a status code for all
requested links. For simplicity, just return "TX link not accepted" so
that clients may try to connect to other links. This could be improved
to explicitly reject each link if directly associating to the link will
not work either.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 16:49:27 +02:00
Benjamin Berg
c55a272f66 EHT: Define status codes from IEEE P802.11be/D4.0
Add the new status code that had not yet been defined.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 14:03:41 +02:00
Ilan Peer
d95838b793 AP: Add support for testing ML link removal
Add support for testing ML link removal to hostapd. While such support
should inherently be integrated with the underlining driver, simulate
the inclusion of the ML reconfiguration element in hostapd.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 13:58:37 +02:00
Ilan Peer
73a6f5c37e AP MLD: Make BSS parameter change variable
As a preparation to support link removal, make the BSS parameter
change count variable.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-11-25 13:41:21 +02:00
Andrei Otcheretianski
cb90aa3acf wpa_supplicant: Remove duplicate logic in wpas_ml_element()
Parsing multiple RNR elements already exists in
wpa_bss_parse_basic_ml_element(), so wpas_ml_element() just duplicates
the same code. Combine the functionality of both these functions and
remove the duplicate.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 12:03:52 +02:00
Benjamin Berg
b3aafd5a87 common: Simplify and avoid confusing defragmentation API
Three functions were provided for defragmentation. First
ieee802_11_defrag(), ieee802_11_defrag_mle() and then
ieee802_11_defrag_data() which would do the actual job. With
ieee802_11_defrag() picking the member in the elements struct for an
EID. The problem with this is, that for the Multi-Link element, there
are multiple entries in the elems struct depending on its type. As such,
remove the intermediate function and simply pass the correct members
directly.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-25 10:56:56 +02:00
Johannes Berg
0f7d15dd38 ieee802_11_defs: Fix EHT_ML_PRES_BM_PROBE_REQ_AP_MLD_ID
This Presence Bitmap field is B4..B15 of the Multi-Link Control field
and the value used here is for that full 16-bit field, not just within
the Presence Bitmap field.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-11-24 23:09:23 +02:00
Benjamin Berg
645ec9b58a nl80211: Do a roundtrip to reset event supressions
With nl80211 we need to supress the kernel generated event for any
disconnect and deauthenticate. This code is a bit fragile, as it
assumes that an event will happen. Commit b898b65582 ("nl80211: Do
not ignore disconnect event in case of !drv->associated") changed this
to only disconnect when the driver knows it is associated (apparently
required for P2P), however, deauthentication may also occur without
being associated yet.

Looking at the issue, what we are really interested in is whether the
event belongs to a disconnect/deauth command that we have send
ourselves. Any event happening after the disconnect/deauth completes
should not be suppressed (or after the next connect/auth as that would
be sufficient). We therefore need to know from the event stream
whether events were generated before or after disconnect/deauth
command completion.

To do so, send a simple command on the nl_event socket. As this will
be returned back to us in the correct order with regard to the events.
We can therefore use it to safely reset our internal
ignore_next_local_{deauth,disconnect} variables.

Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
2023-11-24 22:49:15 +02:00
Vinayak Yadawad
69ea73bfed nl80211: Update port authorized indication for MLO address
Handling of port authorized event for STA currently handles the
connected BSSID. This needs additional handling to support the AP MLD
address in case of MLO connection. The connected_addr expected by
cfg80211_port_authorized() is mld_addr for ML connection case.

Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-24 18:49:01 +02:00
Nicolas Escande
6f014c0d01 ACS: Add 320 MHz support for EHT
Enable support for ACS in the IEEE 802.11be/320 MHz case. To do so we
just:
  - add channel definitions for the 320 MHz blocks of the 6 GHz band
  - handle CONF_OPER_CHWIDTH_320MHZ in the different cases
  - restrict 320 MHz to ieee80211be=1 only

Signed-off-by: Nicolas Escande <nico.escande@gmail.com>
2023-11-24 18:40:24 +02:00
Jurijs Soloveckis
f0aea885f8 EHT: Fix HE Channel Center Freq Seg0/Seg1 for 6 GHz 320 MHz cases
Fix for the HE Channel Center Freq Seg0/Seg1 within the HE 6GHz
Operation Information field. As downgrade of bandwidths for VHT and HE
when using puncturing is TODO for 320 MHz and/or if puncturing is
disabled and bandwidth is 320 MHz, the same rules as for 160 MHz should
be applied for Channel Center Freq Seg0/Seg1 within 6 GHz Operation
Information field.

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-11-24 18:38:32 +02:00
Jurijs Soloveckis
07c03a6557 EHT: Fix conditions for including EHT Operation Information field
Include EHT Operation Information field only if the operating bandwidth
is 320 MHz or there is at least one punctured 20 MHz subchannel. This
behavior is defined in IEEE P802.11be/D4.0, 35.15.1 (Basic EHT BSS
operation).

Signed-off-by: Jurijs Soloveckis <jsoloveckis@maxlinear.com>
2023-11-24 18:36:27 +02:00
Juliusz Sosinowicz
01d95b75b8 SAE: prime_len means length in bytes not bits
The prime_len variable is used as the length in bytes but it is set as
the length in bits. This fixes the sae DH group tests with wolfSSL.

Fixes: f8f20717f8 ("SAE: Use const_time selection for PWE in FFC")
Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
2023-11-24 18:07:34 +02:00
Jouni Malinen
a02585cef7 MBSSID: Use BIGTK from the transmitted BSS for beacon protection
MBSSID shares a single Beacon frame with multiple BSSs. This implies
that the key used for beacon protection (BIGTK) needs to be shared. The
nontransmitted BSSs managed their own BIGTK previously and that resulted
in providing incorrect value to the stations associated with those BSSs.
Use the BIGTK from the transmitted BSS to fix this.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-24 12:53:09 +02:00
Vinayak Yadawad
73b49016f2 Fix references to correct driver capability flag for PSK/OWE offloads
Fix references to the appropriate driver capability drv_flags2. The
initial version used the incorrect drv_flags value and by doing so,
ended up using incorrect driver capabilities (DEAUTH_TX_STATUS,
BSS_SELECT, TDLS_SUPPORT) which could result in incorrect OWE
functionality for both AP and STA cases.

Fixes: d984c7b298 ("hostapd: Add support for OWE offload for STA/AP interface")
Fixes: da364180fb ("hostapd: Support 4-way handshake offload for AP/P2P GO")
Signed-off-by: Vinayak Yadawad <vinayak.yadawad@broadcom.com>
2023-11-23 11:41:18 +02:00
Jouni Malinen
415839406a OpenSSL: Allow openssl_ciphers override with Suite B config on server
The openssl_ciphers parameter is a global data entry on the server
instead of the per-connection design on client. As such, hostapd needs
to make a local copy of the global value and use that whenever setting
per-connection parameters. This is needed particularly when testing
Suite B functionality where the Suite B specific parameters might end up
overriding the cipher list.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-11-22 19:39:45 +02:00
Prasanna JS
e9b13938a9 Add EHT mode support for ratemask configuration vendor command
Extend enum qca_wlan_ratemask_params_type to configure ratemask for EHT
mode.

Signed-off-by: Prasanna JS <quic_pjs@quicinc.com>
2023-11-21 21:14:30 +02:00
Purushottam Kushwaha
239469eb1d Define new command in qca_tsf_cmd to get AP channel switch TSF time
Define a new command QCA_TSF_SYNC_GET_CSA_TIMESTAMP in qca_tsf_cmd to
retrieve the TSF time value at which the AP will move and starts
beaconing on a new channel. Userspace queries this TSF after receiving
NL80211_CMD_CH_SWITCH_STARTED_NOTIFY event on the AP interface. This TSF
can be communicated via an OOB mechanism to connected STAs which may
fail to receive the CSA frames due to channel congestion.

Signed-off-by: Purushottam Kushwaha <quic_pkushwah@quicinc.com>
2023-11-21 21:13:44 +02:00