Commit graph

16903 commits

Author SHA1 Message Date
Jouni Malinen
0f37b8142b More specific set_freq_params debug prints for 80/80+80 MHz errors
It is more convenient to see the exact error in the debug log instead of
getting noted that something was invalid.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 00:54:36 +02:00
Jouni Malinen
3c5ea9fd9f tests: VHT CSA with invalid parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 17:02:38 +02:00
Jouni Malinen
0922519091 tests: Additional GET_PMK coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 16:33:03 +02:00
Avraham Stern
ab89291928 nl80211: Use process_bss_event() for the nl_connect handler
The nl_connect is initialized with the process_bss_event() handler.
However, it is used several times with the default valid handler. As a
result, if a message that is only valid for process_bss_event() is
received while the default handler is used, it will be dropped.

This has been observed in a case where during the 4-way handshake, a
Beacon frame is received on the AP side, which triggers a beacon update,
just before receiving the next EAPOL. When send_and_recv_msgs_owner() is
called for sending the NL80211_CMD_SET_BEACON command, the
NL80211_CMD_CONTROL_PORT_FRAME event is already pending. As a result, it
is received with the default handler, which drops it. Since the EAPOL
frame is dropped, the connection attempt fails.

Fix it by using the process_bss_event() handler when the nl_connect
handler is used.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2021-03-06 13:36:20 +02:00
Jouni Malinen
f7835ac163 tests: IGTK and BIGTK replay protection
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
5a7e806b69 tests: Invalid MGMT_TX_STATUS_PROCESS
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
f5439acf6a tests: RELOAD_WPA_PSK failure
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
7c5442e744 DPP: Clear hapd->gas pointer on deinit
While it does not look like the stale pointer could have been
dereferenced in practice, it is better not to leave the stale pointer to
freed memory in place to avoid accidental uses.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:56:00 +02:00
Jouni Malinen
b54410127d tests: hapd->tmp_eap_user clearing on interface deinit/reinit
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:45:48 +02:00
Jouni Malinen
076e0abddb SQLite: Fix temporary eap_user data freeing on interface restart
hapd->tmp_eap_user needs to be cleared on interface deinit to avoid
leaving stale pointers to freed memory.

Fixes: ee431d77a5 ("Add preliminary support for using SQLite for eap_user database")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:44:38 +02:00
Jouni Malinen
3e735adf0b tests: WNM time advertisement and interface restart
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:38:18 +02:00
Michael Braun
2da3105ac1 Fix use after free with hapd->time_adv on interface restart
When an interface is disabled, e.g. due to radar detected,
hapd->time_adv is freed by hostapd_free_hapd_data(), but later
used by ieee802_11_build_ap_params() calling hostapd_eid_time_adv().

Thus hapd->time_adv needs to be cleared as well.

Fixes: 39b97072b2 ("Add support for Time Advertisement")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2021-03-06 11:37:26 +02:00
Jouni Malinen
48e2725f5a Add a link to Patchwork for a list of pending patches
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:26:20 +02:00
Jouni Malinen
fa4cd46c37 tests: Roam command during a scan operation
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:11:21 +02:00
Matthew Wang
5ac977758d Reject authentication start during explicit roam requests
The roam D-Bus and ROAM control itnerface commands flip the reassociate
bit before calling wpa_supplicant_connect(). wpa_supplicant connect
eventually aborts ongoing scans (if any), which causes scan results to
be reported. Since the reassociate bit is set, this will trigger a
connection attempt based on the aborted scan's scan results and cancel
the initial connetion request. This often causes wpa_supplicant to
reassociate to the same AP it is currently associated to instead of the
explicitly requested roaming target.

Add a roam_in_progress flag to indicate that we're currently attempting
to roam via an explicitly request to a specific BSS so that we don't
initiate another connection attempt based on the possibly received scan
results from a scan that was in progress at the time the roam command
was received.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 10:59:05 +02:00
Kiran Kumar Lokere
800fb69970 QCA vendor attribute to allow 6 GHz connection with all security types
Add a QCA vendor attribute to configure the driver to allow the 6 GHz
connection with all security types. This attribute is used for testing
purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-04 18:05:06 +02:00
Kiran Kumar Lokere
1a60099f26 QCA vendor attribute to ignore SAE H2E requirement mismatch
Add a QCA vendor attribute to ignore SAE H2E requirement mismatch for 6
GHz connection. This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-04 18:04:07 +02:00
Jouni Malinen
ed14b29f38 wpaspy: Do not mark not-existing UNIX domain socket as UDP
os.stat(path) failure is an ambigious indication of the control
interface "path" type (UDP hostname vs. UNIX domain socket path). The
path may be a valid UNIX domain socket path, but that socket could have
been removed just before reaching here. At least the hwsim test case
concurrent_p2pcli managed to hit the "connect exception" print below
from UDP handling even when using a UNIX domain socket.

Work around incorrect determination of control interface socket type by
assuming anything starting with '/' is a UNIX domain socket and not a
hostname.

Fixes: a2c88a8025 ("wpaspy: Add support for UDP connection")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-01 12:51:20 +02:00
Jouni Malinen
8d80aa3fca tests: Fix openssl_systemwide_policy cleanup
Need to close the WpaSupplicant instance on the extra radio before
returning from this test case since that interface is going to be
removed and WpaSupplicant.__del__() can time out on trying to detach the
monitor connection after that.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-01 12:34:05 +02:00
Nikolas Nyby
e9d598d8a8 Update old link to ACS wiki documentation
The old links here were broken.

Signed-off-by: Nikolas Nyby <nikolas@gnu.org>
2021-03-01 11:14:46 +02:00
Jouni Malinen
024fcb22ca tests: hostapd RELOAD with invalid configuration
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-01 11:13:46 +02:00
Jouni Malinen
ff6a305ced tests: OCV override in FT Reassociation Response
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 23:50:50 +02:00
Jouni Malinen
b5e3d92ee4 OCV: Fix OCV-FAILURE event address for FT Reassociation Response frame
sm->bssid is still the BSSID of the previous AP at this point in the FT
protocol, so need to show the target AP's BSSID instead in the failure
message.

Fixes: 8c1f61e820 ("OCV: Report OCI validation failures with OCV-FAILURE messages (STA)")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 23:50:50 +02:00
Jouni Malinen
fdb8c40c7f tests: OCV override in FILS Association Response
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 23:50:50 +02:00
Jouni Malinen
ecc46f2900 tests: Move ERP/FILS capability checks to utils.py
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 23:50:50 +02:00
Jouni Malinen
8884e33eef tests: WMM parameter update failing during beacon template update
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:58:24 +02:00
Jouni Malinen
811d26705a tests: DPP config overrides in hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:48:00 +02:00
Jouni Malinen
e5ee60ade0 tests: hostapd and setband
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:40:43 +02:00
Jouni Malinen
6abf7c0419 tests: wpa_deny_ptk0_rekey in hostapd GET_CONFIG
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
0f51caa513 tests: hostapd GET_CONFIG entries for Multi-AP
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
250cb99f4d tests: Additional coverage for hostapd GET_CONFIG key_mgmt values
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
8c6723b7f3 tests: Invalid COLOC_INTF_REQ parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
73a3ef8c5d tests: WPS status "Timed-out" from hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
35672faae5 tests: WPS PBC overlap indication from hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
e8e2d9ff6b tests: Additional coverage for WPS_AP_PIN error case
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
38e700198e tests: Display unexpected stdout and stderr prints in parallel-vm.py
Make it more difficult to miss issues that were previously only printed
out in /tmp/hwsim-test-logs/*-parallel.log. This covers things like
memory leaks and test script failures or forgotten development time
prints to stdout.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 22:31:58 +02:00
Jouni Malinen
40551a15c1 Fix a memory leak in WPS with ap_scan=2
The wpa_ie buffer is now allocated here and needs to be freed before
returning from the function.

Fixes: d2ba0d719e ("Move assoc param setting into a helper function")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:46:32 +02:00
Jouni Malinen
900adb3c9f FILS: Simplify code paths
Use a shared code path for freeing the wpa_ie buffer to avoid
unnecessary complexity with a separate return for the non-FILS case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:42:06 +02:00
Jouni Malinen
4a5f6e88b2 SAE: Use more explicit IE payload validation steps
This is an attempt of making the code easier to understand for static
analyzers. The helper functions were already verifying that these IEs
are fully within the memory buffer, but that may not have been clear
enough for automated analysis.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:39:49 +02:00
Jouni Malinen
57fec19dab Use more consistent iface->conf checks
Commit f1df4fbfc7 ("mesh: Use setup completion callback to complete
mesh join") added a check for iface->conf being NULL into a debug print.
However, it is not clear how that could be NULL here. In any case,
setup_interface() could end up dereferencing iface->conf in the call to
hostapd_validate_bssid_configuration(), so better be consistent with the
checks and not get warnings from static analyzers regardless of whether
this can happen in practice.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:51:16 +02:00
Jouni Malinen
b8211e1e75 PASN: Avoid unreachable code with CONFIG_NO_RADIUS
There is no point in trying to build in rest of this function if in the
middle of it the CONFIG_NO_RADIUS case would unconditionally fail.
Simply make all of this be conditional on that build parameter not being
set to make things easier for static analyzers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:37:47 +02:00
Jouni Malinen
9a1136b7f1 FILS: Fix RSN info in FD frame for no-group-addressed
The value from the initial RSN_CIPHER_SUITE_NO_GROUP_ADDRESSED check
ended up getting overridden with the following if. This was supposed to
be a single if statement to avoid that.

Fixes: 9c02a0f5a6 ("FILS: Add generation of FILS Discovery frame template")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 11:27:42 +02:00
Jouni Malinen
6035969e0e Fix dynamic EAP library building
Build eap_*.so into the wpa_supplicant similarly with the wpa_supplicant
binary and include the shared helper functions from additional files
into the builds. This got broken at some point with the build system
changes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 23:42:21 +02:00
Jouni Malinen
8ea3561c6c tests: Fix sigma_dut_ap_dpp_tcp_enrollee_init to stop hostapd
This test case was missing an explicit CAPI ap_reset_default and that
could result in hostapd being left running at the end of the test case.
This could result in issues with following test cases if they used a new
radio interface from HWSimRadio().

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 21:07:54 +02:00
Jouni Malinen
32360ad498 wlantest: Fix broadcast EAPOL-Key frame handling
This resulted in an attempt to dereference a NULL pointer since sta_addr
is not known in this type of a case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-27 20:27:06 +02:00
Jouni Malinen
a826ff2d95 Ignore group-addressed SA Query frames
These frames are used for verifying that a specific SA and protected
link is in functional state between two devices. The IEEE 802.11
standard defines only a case that uses individual MAC address as the
destination. While there is no explicit rule on the receiver to ignore
other cases, it seems safer to make sure group-addressed frames do not
end up resulting in undesired behavior. As such, drop such frames
instead of interpreting them as valid SA Query Request/Response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-27 20:27:00 +02:00
Jimmy Chen
d314213f6c P2P: Pick a 5 GHz channel from more possible channels
For an autonomous P2P group on the 5 GHz band, a channel was picked only
from the operating class 115 which is not available in the EU region
anymore. As a result, an autonomous group creation would always fail in
this generic 5 GHz channel case.

There are more possible available channels for the 5 GHz currently.
Especially in the EU region, the operating class 115 channels are no
longer available, but SRD channels (the operating class 124) are
available. Allow them to be used here if they are marked as allowed for
P2P GO use.

In addition, iterate through all the potential options instead of just
checking the first randomly picked channel. Start this iteration from
random position to maintain some randomness in this process.

Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
2021-02-27 19:19:35 +02:00
Jouni Malinen
468efe79a7 tests: Work around exception handling issue in wpas_config_file
Raising an exception while the wlan5 interface was remove (i.e., between
wpas.interface_remove() and .interface_add() calls) would result in the
cleanup code failing and generating yet another exception while the
first one was being processed. Work around this by re-adding the wlan5
interface back temporarily if the interface is not available for the
cleanup operations.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 18:10:41 +02:00
Jouni Malinen
205c35ceff nl80211: Allow compilation with both vendor do_acs() handlers
Use a helper function as the do_acs() callback to allow builds to pull
in all the vendor specific operations into a single binary.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 17:57:08 +02:00
Xinrui Sun
61a258e784 nl80211: Add ACS support for Broadcom device
BRCM vendor command used to trigger ACS scan. After ACS finished,
DHD driver will send results by event BRCM_VENDOR_EVENT_ACS.

Signed-off-by: Xinrui Sun <xinrui.sun@broadcom.com>
2021-02-27 12:14:09 +02:00