Commit graph

9990 commits

Author SHA1 Message Date
Jouni Malinen
c1d43d0bac WPS: Merge identical error paths in ssdp_listener_open()
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:28:45 +03:00
Jouni Malinen
9425bb7828 tests: Dualband AP rejecting authentication from dualband STA on 2.4 GHz
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
0e2412d086 Add option to reject authentication on 2.4 GHz from dualband STA
The new no_auth_if_seen_on=<ifname> parameter can now be used to
configure hostapd to reject authentication from a station that was seen
on another radio.

This can be used with enabled track_sta_max_num configuration on another
interface controlled by the same hostapd process to reject
authentication attempts from a station that has been detected to be
capable of operating on another band, e.g., to try to reduce likelihood
of the station selecting a 2.4 GHz BSS when the AP operates both a 2.4
GHz and 5 GHz BSS concurrently.

Note: Enabling this can cause connectivity issues and increase latency for
connecting with the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
ec4387f9c9 Indicate CTRL-EVENT-AUTH-REJECT event on authentication rejection
This allows control interface monitors to get more detailed information
in cases where wpa_supplicant-based SME receives an Authentication frame
with non-zero status code.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:02 +03:00
Jouni Malinen
142f7ba643 tests: Dualband AP not replying to probes from dualband STA on 2.4 GHz
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 19:11:00 +03:00
Jouni Malinen
964f64e2ee Add option to ignore Probe Request frames on 2.4 GHz from dualband STA
The new no_probe_resp_if_seen_on=<ifname> parameter can now be used to
configure hostapd to not reply to group-addressed Probe Request from a
station that was seen on another radio.

This can be used with enabled track_sta_max_num configuration on another
interface controlled by the same hostapd process to restrict Probe
Request frame handling from replying to group-addressed Probe Request
frames from a station that has been detected to be capable of operating
on another band, e.g., to try to reduce likelihood of the station
selecting a 2.4 GHz BSS when the AP operates both a 2.4 GHz and 5 GHz
BSS concurrently.

Note: Enabling this can cause connectivity issues and increase latency
for discovering the AP.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:53:15 +03:00
Jouni Malinen
c58b5f65b1 tests: Unconnected station tracking
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:30:28 +03:00
Jouni Malinen
a65a9b8d67 hostapd: Add mechanism to track unconnected stations
hostapd can now be configured to track unconnected stations based on
Probe Request frames seen from them. This can be used, e.g., to detect
dualband capable station before they have associated. Such information
could then be used to provide guidance on which colocated BSS to use in
case of a dualband AP that operates concurrently on multiple bands under
the control of a single hostapd process.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 17:11:11 +03:00
Jouni Malinen
6ebe816be0 wpa_priv: Add authentication command and event
These are needed to work with nl80211 driver interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 13:21:17 +03:00
Jouni Malinen
06f52b12f9 wpa_priv: Add support for EVENT_SCAN_STARTED
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:39:11 +03:00
Jouni Malinen
d01136a06e wpa_priv: Print unsupported driver event name in debug log
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:35:59 +03:00
Jouni Malinen
c968f2d56c wpa_priv: Clear extended_capa pointers
For now, there is no support for passing extended_capa pointers through
the driver_privsep.c interface from wpa_priv. Avoid leaving bogus
pointers by explicitly clearing these on both wpa_priv and
wpa_supplicant sides.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:32:58 +03:00
Jouni Malinen
20396ab8e4 wpa_priv: Add support for global driver interface context
This is needed with driver_nl80211.c to be able to use the newer
wpa_driver_ops::init2() alternative.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 12:03:18 +03:00
Jouni Malinen
85f4381e14 wpa_priv: allow l2_packet to be opened for ethertype 0x890d
This is needed to initialize TDLS functionality.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 11:54:06 +03:00
Jouni Malinen
bd1f06aaa8 wpa_priv: Add -c argument to usage text
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 11:44:34 +03:00
Jouni Malinen
ebf05623c4 wpa_priv: Fix early exit path
eloop_destroy() cannot be called before eloop_init() have been called
successfully.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 11:41:49 +03:00
Vasanthakumar Thiagarajan
8065377199 Do not advertise DSSS/CCK support in 40 MHz for 5 GHz band
DSSS/CCK rate support in 40 MHz has to be set to 0 for 5 GHz band since
this mechanism is designed only for the 2.4 GHz band. Clear
HT_CAP_INFO_DSSS_CCK40MHZ in ht_capab when the configured mode is
neither 11b nor 11g.

Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qti.qualcomm.com>
2015-09-05 01:14:01 +03:00
Jouni Malinen
8406cd3515 Make it clearer that ap_scan=2 mode should not be used with nl80211
Add more details into configuration comments and a runtime info message
if ap_scan=2 is used with the nl80211 driver interface.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-05 01:04:29 +03:00
Jouni Malinen
d188367148 tests: WPS Enrollee protocol testing
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-01 12:31:16 +03:00
Jouni Malinen
fbf6b71791 tests: AP configuration using wps_config and wps_cred_processing=2
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-01 12:31:16 +03:00
Jouni Malinen
ea982de1ee tests: WPS ER timing out STA entry after negotiation
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-09-01 12:31:16 +03:00
Manikandan Mohan
4ae7120919 Allow wpa_cli/hostapd_cli client socket directory to be specified
This adds a new helper function wpa_ctrl_open2() that can be used
instead of wpa_ctrl_open() to override the default client socket
directory. Add optional -s<directory path> argument to hostapd_cli and
wpa_cli to allow the client socket directory to be specified.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-09-01 11:17:43 +03:00
Jouni Malinen
89a72e1c7f WPS: Remove trailing CR from subscription callback URLs
This cleans up the debug log a bit.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
3bde828098 WPS: Print subscription UUID in debug log in more places
This makes it easier to debug subscription issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
96038a5f85 tests: WPS AP and advertisement OOM
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
ccbd0518f6 WPS: Clean up next_advertisement() error path
No need to have a common failure handler if it is used from only a
single location and that lcoation does not even need the memory freeing
step.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
b8e20236c1 WPS: Merge event_send_start() error paths
There is no need to keep these separate.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
476daa0585 tests: WPS UPnP SetSelectedRegistrar protocol testing
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
92325e7090 WPS: Merge SetSelectedRegistrar parsing error returns
There is no need to maintain two error paths for this.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
31e56b953c tests: WPS ER Selected Registrar timeout
This extends ap_wps_pbc_timeout to cover another long WPS timeout:
ER-initiated SetSelectedRegistrar timeout on AP. Using the same test
case for this avoids the need for another 120 second test case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
24b7f2822e tests: More WPS/HTTP test coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-31 17:25:20 +03:00
Jouni Malinen
5882c011d6 EAP-WSC peer: Reject connection on unexpected failure
Previously, the EAP-WSC peer state machine ended up just ignoring an
error and waiting for a new message from the AP. This is not going to
recover the exchange, so simply force the connection to terminate
immediately.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-30 18:37:44 +03:00
Jouni Malinen
fc078be2dd Allow BSS to return information for AP that uses an invalid WSC IE
Previously, the BSS command returned an error if the WSC IE(s) in scan
results could not be parsed. This may be not ideal for all cases, to
instead of rejecting the command completely, return all other
information apart from the WPS information in such a case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-30 00:01:48 +03:00
Jouni Malinen
91d5a8e365 WPS: Use a shared error path in http_client_addr()
This simplifies error processing by removing duplicated cleanup steps.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-29 13:42:32 +03:00
Jouni Malinen
63fc84acd7 WPS: Clean up http_client_tx_ready()
Calculate the send() buffer length only once to make this a bit more
readable.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-29 13:42:32 +03:00
Jouni Malinen
24a5e528ce WPS: Remove duplicated isgraph() loop in HTTP header parsing
The hbp pointer is moved to the next space already earlier in this code
path, so the while loop here did not really do anything.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-28 23:59:28 +03:00
Jouni Malinen
f79a19746a WPS: Merge common error paths in HTTP server
There is no need to maintain three separate "goto fail" cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-28 20:33:22 +03:00
Jouni Malinen
96ace55e6c tests: cfg80211 connect command to trigger roam
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-28 19:01:47 +03:00
Jouni Malinen
bb119228b0 Remove unnecessary enum typedef from wpa_auth_sm_event()
This is more consistent with the expected coding style.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-28 16:34:38 +03:00
Jouni Malinen
43f49c3788 EAPOL auth: Avoid recursive wpa_sm_step() on WPA_DEAUTH case
It was possible for wpa_auth_sm_event(WPA_DEAUTH) to be called from
wpa_sm_step() iteration in the case the EAPOL authenticator state
machine ended up requesting the station to be disconnected. This
resulted in unnecessary recursive call to wpa_sm_step(). Avoid this by
using the already running call to process the state change.

It was possible to hit this sequence in the hwsim test case
ap_wpa2_eap_eke_server_oom.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-28 16:32:14 +03:00
Jouni Malinen
dee2020243 EAPOL auth: clear keyRun in AUTH_PAE INITIALIZE
Clearing keyRun here is not specified in IEEE Std 802.1X-2004, but it
looks like this would be logical thing to do here since the EAPOL-Key
exchange is not possible in this state. It is possible to get here on
disconnection event without advancing to the AUTHENTICATING state to
clear keyRun before the IEEE 802.11 RSN authenticator state machine runs
and that may advance from AUTHENTICATION2 to INITPMK if keyRun = TRUE
has been left from the last association. This can be avoided by clearing
keyRun here.

It was possible to hit this corner case in the hwsim test case
ap_wpa2_eap_eke_server_oom in the case getKey operation was forced to
fail memory allocation. The following association resulted in the
station getting disconnected when entering INITPMK without going through
EAP authentication.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-28 16:30:06 +03:00
Jouni Malinen
f429ec443f nl80211: Use nla_put_nested() to set NL80211_ATTR_MAC_ADDRS
This allows an empty nested list (i.e., no MAC addresses) to be included
in the NL80211_CMD_SET_MAC_ACL message unlike with
nla_nest_start()/nla_nest_end() where the current libnl implementation
removes the "empty" attribute and causes cfg80211 to reject the command.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-28 12:49:17 +03:00
MAYANK HAARIT
80bb38742c dbus: Fix a typo in function comment
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
Signed-off-by: Dilshad Ahmad <dilshad.a@samsung.com>
2015-08-28 00:23:23 +03:00
Purushottam Kushwaha
658665551c P2PS: Remove redundant check in for loop
Signed-off-by: Purushottam Kushwaha <p.kushwaha@samsung.com>
Signed-off-by: Mayank Haarit <mayank.h@samsung.com>
2015-08-28 00:22:49 +03:00
Jouni Malinen
5a233fbdf0 tests: Regression test for D-Bus setting scan_freq and freq_list
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-28 00:20:30 +03:00
Jiří Klimeš
98da137545 dbus: Do not quote scan_freq and freq_list in dbus_old_handlers.c
scan_freq and freq_list are not parsed correctly by
wpa_config_parse_int_array() if quoted.

Patch for dbus_old_handlers.c, the same change as done by Robert Shade
<robert.shade@gmail.com> for dbus_new_handlers.c in commit
99276998fa ('dbus: Do not quote scan_freq
and freq_list').

Signed-off-by: Jiří Klimeš <jklimes@redhat.com>
2015-08-28 00:13:26 +03:00
Jouni Malinen
d9c807cab1 Fix key derivation for Suite B 192-bit AKM to use SHA384
While the EAPOL-Key MIC derivation was already changed from SHA256 to
SHA384 for the Suite B 192-bit AKM, KDF had not been updated similarly.
Fix this by using HMAC-SHA384 instead of HMAC-SHA256 when deriving PTK
from PMK when using the Suite B 192-bit AKM.

Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-27 20:42:14 +03:00
Mitchell Wills
a218e1ded4 Make sure configuration is saved to storage device
Config file is written to a temp file and then it is renamed to the
original config file. However, it is possible that the rename operation
will be commited to storage while file data will be still in cache
causing original config file to be empty or partially written in case of
a system reboot without a clean shutdown. Make this less likely to occur
by forcing the data to be written to the storage device before renaming
the file.

Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
2015-08-27 18:06:05 +03:00
Jouni Malinen
6aaa661af1 tests: More WPS ER coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2015-08-26 21:09:37 +03:00
Jouni Malinen
2313e6c96b tests: BSS entry expiration when AP changes SSID
Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
2015-08-26 16:46:28 +03:00