Commit graph

18419 commits

Author SHA1 Message Date
Adil Saeed Musthafa
0660f31ba0 wlantest: Adjust kdk_len according to RSNX capability
This is needed to derive the PTK correct when Secure LTF support is used
and the additional KDK component needs to be taken into account.

Signed-off-by: Adil Saeed Musthafa <quic_adilm@quicinc.com>
2023-03-09 16:08:03 +02:00
Avraham Stern
23ddb3ffee tests: Remove dynamically added hostapd interfaces
When an in interface is added dynamically to hostapd with
HWSimRadio, it's not removed during device reset.
This requires to manually remove it, otherwise subsequent tests may
fail. Better do it during device reset.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2023-03-07 23:55:00 +02:00
Andrei Otcheretianski
fa4d7be5bf tests: Clear sae_groups in eht_sae test
Otherwise subsequent tests may fail.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 23:55:00 +02:00
Ilan Peer
c4cb62ca8e WPA_AUTH: MLO: Add functions to get the AA and SPA
As a preparation to use AP MLD address and non-AP MLD address
in the RSN Authenticator state machine, add utility functions to
get the current AA and SPA.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 23:54:50 +02:00
Ilan Peer
cab963e9f8 AP: Split check_assoc_ies()
As a preparation for processing an association request with
ML element, split the function such that the elements checking
would be separate from parsing.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 23:46:18 +02:00
Ilan Peer
7a7a2256c0 common: Support parsing link specific association request
An association request in the context of an MLO connection can
contain an ML element that holds the per station profile for
the additional links negotiated. To support this, add a function
to parse the per station profile.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 22:03:40 +02:00
Ilan Peer
b39e356931 common: Add support for clearing elements
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-03-07 21:48:22 +02:00
Ilan Peer
0b2fc42686 common: Split ieee8021_parse_elems()
As a preparation to parse management frames that include ML elements
with per station profiles, split the function to a helper function that
would not memset() the elements structure.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-03-07 21:46:09 +02:00
Andrei Otcheretianski
df6561ec06 nl80211: AP MLD support for adding multi link stations
Multi link stations are represented in the kernel using a single
station with multiple links and the first ADD_STA command also
creates the first link. Subsequent links should be added with
LINK_ADD commands.

Implement this logic and provide the required MLD information per
station/link.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 21:43:41 +02:00
Andrei Otcheretianski
b8b4ceb8d6 nl80211: Properly stop and deinit MLO AP
Delete all the links and stop beaconing on all the links on AP
deinit/stop.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 21:35:06 +02:00
Andrei Otcheretianski
2f8fc46ede nl80211: Provide link_id in EAPOL_RX and RX_MGMT events
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 21:28:49 +02:00
Ilan Peer
821374d43a nl80211: Introduce and implement a callback to add an MLO link for AP MLD
Add a driver callback to add a link to an AP interface.
As the kernel removes all links on underline interface removal, there
is currently no need to support individual link removal.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-03-07 21:15:00 +02:00
Ilan Peer
47269be36e nl80211: Refactor i802_bss to support multiple links
Refactor struct i802_bss to support multiple links as a
preparation to support MLD AP.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2023-03-07 21:06:25 +02:00
Anthony Refuerzo
eb146ee804 AP: Add some bridge port attribute settings
"multicast_to_unicast" and "hairpin_mode" are usually set outside of
hostapd. However, DFS channel change events pull the BSS out of the
bridge causing these attributes to be lost. Make these settings tunable
within hostapd so they are retained after the BSS is brought up again.

Signed-off-by: Anthony Refuerzo <anthony96922@gmail.com>
2023-03-01 10:50:07 +02:00
Jouni Malinen
f628e6b30e nl80211: Make sure scan frequency debug buffer is NUL terminated
In theory, os_snprintf() could have filled the buffer to the end and
while the pos variable would not have been incremented beyond that,
there would not necessarily be a NUL termination at the end. Force the
array to end in NUL just in case.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-03-01 10:38:02 +02:00
Avraham Stern
41d23254b9 nl80211: Fix frequencies array boundary check for scanned frequencies
The number of frequencies is increased before the boundary check,
thus it should be allowed to be equal to the number of elements in
the array. Update the limit to allow the full array to be used.

In addition, add the missing byte for the NULL terminator for the debug
print to be able to fit all values (assuming they are <= 9999 MHz).

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2023-03-01 10:36:04 +02:00
Hu Wang
a9012070a6 Android: Add wowlan_disconnect_on_deinit to template configuration
Add wowlan_disconnect_on_deinit=1 to wpa_supplicant_template, as
Android expects STA to be disconnected when wpa_supplicant is
terminated.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-27 21:02:09 +02:00
Jouni Malinen
e2ea0fd70b EST: Write the RSA private key using the standard PRIVATE KEY format
The routines used for using raw RSA keys directly have been deprecated
in OpenSSL 3.0. There should be no particular need to use the "RSA
PRIVATE KEY" format, so replace this with the more common "PRIVATE KEY"
format that can be written without use of the deprecated functions.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-23 16:44:38 +02:00
Jouni Malinen
bfd236df21 webkit2: Avoid deprecated function call
webkit_web_context_set_tls_errors_policy() has been deprecated. Use its
replacement webkit_website_data_manager_set_tls_errors_policy() when
building against sufficiently recent version of webkit2.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-23 16:30:04 +02:00
Shivani Baranwal
2c32026827 P2P: Filter out 6 GHz frequencies if not allowed for P2P connection
Add check to filter out 6 GHz frequencies from the local driver
frequency preference list when 6 GHz is not allowed for the P2P
connection. Earlier, 6 GHz frequency channels were included in the
preferred list if the p2p_6ghz_disable parameter was not set
irrespective of the allow_6ghz parameter.

Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
2023-02-23 13:20:50 +02:00
Veerendranath Jakkam
b2bf7e39ec Update PMK in wpa_sm when roam+auth event indicated with authorized flag
Currently, the PMK used by the driver is not updated to wpa_sm when
roaming is completed by the driver with the cached PMKSA and the
roam+auth event is indicated with the authorized flag.

To fix this, identify the PMKSA entry from the PMKID sent in
Reassociation Request frame and update the correct PMK to wpa_sm from
the PMKSA entry.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2023-02-23 13:16:52 +02:00
Avraham Stern
6b9c86466c nl80211: Replace the channel flags for VHT support
The flags that indicate that a channel is allowed for 80/160 MHz use
are divided according to the position of the control channel (e.g.,
HOSTAPD_CHAN_VHT_10_70, HOSTAPD_CHAN_VHT_30_50, etc.).

However, the position of the control channel does not add any extra
regulatory information because when trying to use a 80/160 MHz channel
all the desired bandwidth has to be allowed for 80/160 MHz use,
regardless of the control channel position.

In addition, these flags are set only if the driver reports one
regulatory rule that allows the entire 80/160 MHz bandwidth.
However, even when a 80/160 MHz channel is allowed, in some cases the
bandwidth will be split into several regulatory rules because
different segments of the bandwidth differ in other flags (that don't
affect the use of the bandwidth for VHT channels). So, in such cases
these flags will not be set, although VHT channels are allowed.

As the result, VHT channels will not be used although they are allowed
by the regulatory domain.

Fix this by introducing new flags that indicate if a 2 0MHz channel is
allowed to be used as a part of a wider (80/160 MHz) channel.
The new flags are set for each 20 MHz channel independently and thus
will be set even if the regulatory rules for the bandwidth are split.

A 80/160 MHz channel is allowed if all its 20 MHz sub-channels are
allowed for 80/160 MHz usage.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-02-22 21:44:09 +02:00
Jouni Malinen
f0979c4ac9 tests: Fix python3 processing of Popen output reading
Need to decode cmd.stdout.read() output before using it as a string.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 21:34:53 +02:00
Jouni Malinen
f3c4d2db1f tests: DPP Configurator and @CONF-OBJ-SEP@
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 17:08:57 +02:00
Jouni Malinen
6f63aca7b1 DPP: Allow both STA and AP configObject to be set
Extend @CONF-OBJ-SEP@ behavior to allow the second entry to be used for
different netRole. In other words, allow both the AP and STA netRole
(though, only a single one per netRole) configuration to be set.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 17:07:07 +02:00
Jouni Malinen
7292e30b7f DPP: Fix @CONF-OBJ-SEP@ parsing for multiple configs
The first call to dpp_configuration_parse_helper() was supposed to use
the separately prepared tmp string with only the first configuration
entry, but it ended up using the full string that included both
configuration entries. This could result in the first configObject
getting a mix of parameters from both entries.

Fix the parsing to use only the text before the @CONF-OBJ-SEP@ separator
for the first entry.

Fixes: 7eb06a3369 ("DPP2: Allow multiple Config Objects to be build on Configurator")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 17:01:58 +02:00
Jouni Malinen
596d602de8 tests: P2P persistent group re-invocation (go_bssid) with cfg80211 P2P Device
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 14:12:58 +02:00
Jouni Malinen
c31600ce12 P2P: Allow GO BSSID to be specified for P2P_GROUP_ADD commands
This allows the control interface to be used similarly to the way D-Bus
interface was extended to force a specific GO BSSID for optimizing
scanning.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-22 14:11:17 +02:00
Matthew Wang
0430756e65 P2P: Optimize join scan frequency
Allow clients to specify the BSSID of an auto GO. If the auto GO has been
discovered on another interface, optimize scan frequency by performing
a single channel scan first. Android and ChromeOS use this to streamline
auto GO discovery.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2023-02-22 13:40:21 +02:00
Harshitha Prem
b3921db426 nl80211: Add frequency info in start AP command
When ACS is configured in multiple BSS case, sometimes a virtual AP
interface does not come up as the channel context information between
different BSSs of the same band does not match.

Same behavior is observed in case of multiple band/hardware under a
single wiphy, when we bring up multiple virtual interface in various
bands simultaneously and the kernel maps a random channel as it has more
than one channel context, e.g., say a 2.4 GHz channel to a 5 GHz virtual
AP interface when the start AP command is sent. This is because the
frequency information is not present in the command.

Add the frequency information into the start AP netlink command so that
the kernel maps the appropriate channel context by parsing it instead of
using a previous set channel information.

Signed-off-by: Harshitha Prem <quic_hprem@quicinc.com>
2023-02-22 13:10:49 +02:00
Jouni Malinen
f710eba172 tests: Make PASN checks for PTKSA_CACHE_LIST a bit more robust
It was apparently possible for the test script to fetch the
PTKSA_CACHE_LIST information from hostapd before the PASN message 3 had
been processed since only the event from wpa_supplicant related to
sending of that frame was explicitly waited for. Add a small wait to try
to avoid this race condition with UML time-travel.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 19:46:17 +02:00
Emeel Hakim
40c1396644 macsec_linux: Add support for MACsec hardware offload
This uses libnl3 to communicate with the macsec module available on
Linux. A recent enough version of libnl is needed for the hardware
offload support.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
2023-02-21 19:26:59 +02:00
Emeel Hakim
6d24673ab8 mka: Allow configuration of MACsec hardware offload
Add new configuration parameter macsec_offload to allow user to set up
MACsec hardware offload feature.

Signed-off-by: Emeel Hakim <ehakim@nvidia.com>
2023-02-21 19:26:47 +02:00
Jouni Malinen
6d7a9a890d tests: Country information in hostapd STATUS
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:36:28 +02:00
Antonio Prcela
3081a9cb62 hostapd: Output country_code and country3 when using STATUS
Add the country_code and country3 config parameter to the STATUS output
to easier determine the current values for each of an hostapd
access point. Currently neither STATUS, GET [country_code/country3] nor
GET_CONFIG output it.

This is useful if the hostapd access point has been created with
wpa_ctrl_request() without using a *.conf file (like hostapd.conf).

Signed-off-by: Antonio Prcela <antonio.prcela@gmail.com>
Signed-off-by: Antonio Prcela <antonio.prcela@sartura.hr>
2023-02-21 17:33:03 +02:00
Jouni Malinen
eb6f8dab12 tests: PASN/KDK derivation with FT
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:28:15 +02:00
Jouni Malinen
91ad7a3098 FT: Store PTKSA entry for the correct BSSID in the FT protocol case
sm->bssid has not yet been updated here, so use the provided bssid
instead. This avoids replacing the PTKSA entry for the previous AP when
a new PTKSA is being stored while using the FT protocol.

Fixes: d70060f966 ("WPA: Add PTKSA cache to wpa_supplicant for PASN")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:27:29 +02:00
Jouni Malinen
3f3e356fa0 Mark addr argument to storing PTKSA const
This is not being modified, so mark it const to be more flexible for the
caller.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:27:29 +02:00
Jouni Malinen
242c3ad990 FT: Store PTKSA from FT protocol
PTKSA was stored for the 4-way handshake and FILS cases, but not when it
was being derived through the use of the FT protocol.

Fixes: f2f8e4f458 ("Add PTKSA cache to hostapd")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:21:52 +02:00
Jouni Malinen
ba6954874e Mark wpa_auth_remove_ptksa() static
This function is not used outside wpa_auth.c and it is not mentioned in
any header file either, so it should have been marked static.

Fixes: f2f8e4f458 ("Add PTKSA cache to hostapd")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 17:21:52 +02:00
Shiva Sankar Gajula
3b1ad1334a FT: Include KDK in FT specific PTK derivation on the AP
FT AP was silently ignoring EAPOL-Key msg 2/4 due to Key MIC mismatch
when the STA advertises support for Secure LTF and derives the KDK while
the AP implementation did not derive KDK.

Fix this to include KDK while deriving PTK for FT cases on the AP.

Signed-off-by: Shiva Sankar Gajula <quic_sgajula@quicinc.com>
2023-02-21 16:54:10 +02:00
David Ruth
870a5bdc07 nl80211: Report guard interval and dual carrier modulation
Allows collecting and exposing more information about the station's
current connection from the kernel to the connection manager.

* Add an enum to represent guard interval settings to driver.h.
* Add fields for storing guard interval and dual carrier modulation
  information into the hostap_sta_driver_data struct.
* Add bitmask values indicating the presence of fields.
  * STA_DRV_DATA_TX_HE_DCM
  * STA_DRV_DATA_RX_HE_DCM
  * STA_DRV_DATA_TX_HE_GI
  * STA_DRV_DATA_RX_HE_GI
* Retrieve NL80211_RATE_INFO_HE_GI and NL80211_RATE_INFO_HE_DCM in
  get_sta_handler(), and set appropriate flags.

Signed-off-by: David Ruth <druth@chromium.org>
2023-02-21 14:01:47 +02:00
David Ruth
edcad193ae dbus: Add inactive time to D-Bus signal info
This enables connection managers to receive and use this information in
the same manner that other station information is exposed.

Signed-off-by: David Ruth <druth@chromium.org>
2023-02-21 13:51:24 +02:00
Yichen Yu
a678a510fb dbus: Add D-Bus signal for PSK mismatch heuristics
As a workup action during disassociation, wpa_supplicant checks if the
disconnection could have been caused by PSK mismatch during WPA 4-way
handshake with function could_be_psk_mismatch() in event.c. A MSG_INFO
message will be sent on the control interface when there could be a PSK
mismatch, and this heuristic can be useful to indicate if the
disconnection is caused by a wrong passphrase provided by the user.
Here, propagate a new D-Bus signal 'PskMismatch' to notify other
applicantions.

Signed-off-by: Yichen Yu <yichenyu@chromium.org>
2023-02-21 11:24:06 +02:00
Ayala Beker
691f729d5d P2P: Make invitation flow less aggressive
Currently invitation request wait time is very long and not needed for
sending a single Action frame only. To not interfere with other parallel
channel activities, decrease the wait time to to 150 ms in case of an
active P2P GO on the system.

In addition, if a P2P GO tries to invite a client that doesn't respond,
it will attempt to invite again after 100 ms. This is too aggressive and
may result in missing beacon transmission and affecting GO activity on
its operating channel. Increase the timeout to 120 ms, to allow enough
time for beacon transmission.

Signed-off-by: Ayala Beker <ayala.beker@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2023-02-21 11:19:15 +02:00
Nicolas Cavallari
f4a7e2a07c Rework IBSS/mesh 80 MHz channel selection
- Do not try to enable 80 MHz if 40 MHz is disabled or not selected (e.g.,
  due to obss_scan).
- If it is not possible to use 80 HMz or even 40 MHz, still attempt to
  configure HE40/VHT40/HE20/VHT20 instead of bailing out.
- When bailing out, also disable HE.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
2023-02-21 00:32:37 +02:00
Nicolas Cavallari
f91f971bde Fix creating 6 GHz IBSS/mesh on 5/6 GHz-capable PHYs
If the PHY supports both 5 GHz and 6 GHz bands, there will be two
different struct hostapd_hw_modes with mode HOSTAPD_MODE_IEEE80211A,
one for each band, with potentially different capabilities.

Check that the struct hostapd_hw_modes actually contains the frequency
before selecting it.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
2023-02-21 00:32:10 +02:00
Nicolas Cavallari
c623cee421 Make arrays static const in ibss_mesh_select_*()
Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
2023-02-21 00:32:08 +02:00
Nicolas Cavallari
64043e6156 Split ibss_mesh_setup_freq() into multiple functions
ibss_mesh_setup_freq() has become a 342 line function with 23 local
variables, 1 or 2 goto labels depending on ifdefs and its logic is
quite unpredictable.

Split it into multiple functions. No functional change intended, it
should be bug-compatible with the original code, except for some log
messages that are skipped more often.

Signed-off-by: Nicolas Cavallari <nicolas.cavallari@green-communications.fr>
2023-02-21 00:28:11 +02:00
Jouni Malinen
1cde2549ec tests: WPA2-PSK and STA using 4addr mode
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2023-02-21 00:12:34 +02:00