Commit graph

14321 commits

Author SHA1 Message Date
Jouni Malinen
32e4ad4433 tests: Decode station dump output to restore pre-python3 behavior
These TDLS test cases missed Popen() result decode() calls in the
earlier python3 compatibility changes. Add those to make debug log more
readable.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 20:40:31 +02:00
Jouni Malinen
3d5cfa0f6d tests: Make DPP protocol failure testing more robust
Wait explicitly for the DPP-NOT-COMPATIBLE event when going through
protocol testing with local failures instead of just waiting for a fixed
0.1 second duration. This prevents a test failure at least in
dppauth_resp_status_failure in a case where the failing operation may be
delayed under heavy CPU load.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 19:44:50 +02:00
Jouni Malinen
8b944cf779 tests: Clear scan results from dev5 in WPS testing
Test case sequence "ap_wps_ap_scan_2 ap_wps_pbc_2ap" resulted in a
failure due to a scan entry being left behind from the first test case
and the second one ending up using that obsolete result during WPS_PBC
processing. Fix this by clearing the scan results explicitly on dev5.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 19:27:21 +02:00
Jouni Malinen
b5e57699af FILS+FT: STA mode validation of PMKR1Name in initial MD association
Verify that the AP uses matching PMKR1Name in (Re)Association Response
frame when going through FT initial mobility domain association using
FILS. Thise step was missing from the initial implementation, but is
needed to match the IEEE 802.11ai requirements for explicit confirmation
of the FT key hierarchy (similarly to what is done in FT 4-way handshake
when FILS is not used).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 19:15:13 +02:00
Jouni Malinen
3653663933 FILS+FT: AP mode processing of PMKR1Name in initial MD association
Derive PMKR1Name during the FILS authentication step, verify that the
station uses matching PMKR1Name in (Re)Association Request frame, and
add RSNE[PMKR1Name] into (Re)Association Response frame when going
through FT initial mobility domain association using FILS. These steps
were missed from the initial implementation, but are needed to match the
IEEE 802.11ai requirements for explicit confirmation of the FT key
hierarchy (similarly to what is done in FT 4-way handshake when FILS is
not used).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 19:15:06 +02:00
Jouni Malinen
aabbdb818d FILS: Do not try to add PMKSA cache entry if caching is disabled
This gets rid of a confusing error message "FILS: Failed to add PMKSA
cache entry based on ERP" for cases where PMKSA caching is disabled in
hostapd (disable_pmksa_caching=1). Functionality remains unchanged,
i.e., no cache entry was added before this change either.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 16:34:48 +02:00
Arif Hussain
02bde9581f Vendor attribute to enable or disable TWT request support
Add a new QCA vendor attribute for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 14:56:59 +02:00
vamsi krishna
4efade3157 nl80211: Clear keys from heap memory before freeing it for get_seqnum
NL80211_CMD_GET_KEY response may return the actual key in addition to
the last used sequence number that we need. That might result in a key
being left in unused heap memory after the buffer is freed.

Explicitly clear the message payload with the possibly included key
material from heap memory before returning from the handler function
(and having libnl free the nlmsg) when key information is obtained from
the driver using the NL80211_CMD_GET_KEY command.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 14:54:18 +02:00
Jayachandran Sreekumaran
2b7fa03559 P2P: Fix ACS offloading behavior with p2p_no_group_iface=1
wpa_s->p2p_go_do_acs was not cleared during P2P group deletion and that
resulted in the case of no separate group interface continuing to assume
ACS was to be used for consecutive GO starts even if they tried to
specify a frequency. Fix this by explicitly clearing
wpa_s->p2p_go_do_acs during P2P group deletion and also clear this when
processing the P2P_GROUP_ADD if the parameters do not request ACS to be
used.

Fixes: 37ed3254de ("P2P: ACS offload for the autonomous GO")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 13:22:40 +02:00
vamsi krishna
c6ec9759c5 nl80211: Exclude PMK when sending NL80211_CMD_DEL_PMKSA explicitly
Add a check in nl80211 driver layer to not include PMK while sending
NL80211_CMD_DEL_PMKSA explicitly. Though it is taken care already in
supplicant layer by setting the pmk_len to zero, it would be good
to have a check in nl80211 layer in order to avoid future accidental
inclusions of keying material in commands that do not need them.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 13:22:40 +02:00
Jouni Malinen
ba6ce9c657 tests: DPP and duplicated Authentication Response
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 13:22:40 +02:00
Jouni Malinen
0b4a906de1 DPP2: Protocol version indication
Send out the new Protocol Version attribute in Authentication
Request/Response messages and determine the peer version based on this
attribute.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 13:22:37 +02:00
Jouni Malinen
ce7effd08f DPP2: Build configuration flags for DPP version 2 support
The new CONFIG_DPP2=y build option for hostapd and wpa_supplicant is
used to control whether new functionality defined after the DPP
specification v1.0 is included. All such functionality are considered
experimental and subject to change without notice and as such, not
suitable for production use.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-13 12:00:09 +02:00
Jouni Malinen
a1983aa72c tests: Make sae_anti_clogging_during_attack more robust
Accept a smaller number of token responses in second round to avoid
failing this test case as frequently.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 17:31:40 +02:00
Jouni Malinen
53b4f0fe6a tests: Disable fragm/rts_threshold after testing it
The configurated fragmentation/RTS threshold value survives AP mode
interface restarts, so these values need to be explicitly cleared back
to default (disabled). This fixes an issue where some test cases could
not work correctly if fragmentation on the interface was enabled. For
example, this combination used to fail:
ap_fragmentation_open ap_hs20_fetch_osu

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 17:18:38 +02:00
Jouni Malinen
bf0021ede3 Allow fragmentation/RTS threshold to be disabled explicitly
hostapd configuration parameters fragm_threshold and rts_threshold were
documented to disable the threshold with value -1 and not change driver
configuration if the parameter is not included. However, -1 was mapped
into not changing the driver value, so the explicit disabling part did
not work.

Replace the default values for these to be -2 so that explicitly set
configuration value -1 can be distinguished from the case of not
including the parameter. Map the -1 value to a driver request to disable
the threshold. Ignore any error from this operation just in case to
avoid breaking functionality should some drivers not accept the (u32) -1
value as a threshold value request to disable the mechanism.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 17:15:08 +02:00
Jouni Malinen
abaa0893f0 tests: Fix scan_specific_bssid in case Beacon frame is seen
The first scan for the unknown BSSID could have been timed in a manner
that allows passive scanning to find the real AP even if that AP's
beacon interval was 1000 (e.g., heavy CPU load changed timing so that
the AP beaconing started at suitable time). The check for BSS result
entry not including Probe Response frame was comparing incorrect BSS
entries (bss2 vs. bss1) which resulted in the test case claiming failure
even when there was no unexpected Probe Response frame.

Fix this by comparing the beacon_ie and ie parameters from the same BSS
entry (bss1).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 16:36:46 +02:00
Jouni Malinen
9efd3447c7 tests: Make AP discovery more robust in eap_proto test cases
Number of these test cases start connection attempt in wpa_supplicant
and then expected a specific failure to happen relatively quickly. This
could result in timeouts if the first scanning round missed to find the
AP (e.g., due to CPU load pushing out the Probe Response frame long
enough for the station having left the channel) and wpa_supplicant then
waiting five seconds before starting a new scan.

Make this more robust by scanning explicitly for the specific BSSID
before starting the connection attempt.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 16:24:15 +02:00
stonez
48102f65ef Add a vendor subcommand QCA_NL80211_VENDOR_SUBCMD_MPTA_HELPER_CONFIG
This subcommand is used to update Zigbee state and specified WLAN
durations to enhance success ratio of Zigbee joining network. The
attributes defined in enum qca_mpta_helper_vendor_attr are used to
deliver these parameters to the driver.

Signed-off-by: stonez <stonez@codeaurora.org>
2019-03-12 13:00:24 +02:00
Amir Patel
f10a4af1bd Add QCA vendor command/event and attributes for peer rate statistics
Peer rate statistics is per-peer cached data in the driver. These
statistics needs to be flushed to a user space application on
synchronous/asynchronous events. This command is used as an event from
the driver to flush per-peer cached statistics to the application.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 12:42:58 +02:00
Jouni Malinen
914d8ecac7 tests: SAE group negotiation (no match)
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-12 00:25:48 +02:00
Jouni Malinen
56a33496fe Sync with mac80211-next.git include/uapi/linux/nl80211.h
This brings in nl80211 definitions as of 2019-01-25.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-12 00:23:45 +02:00
Jouni Malinen
f4f17e9aa1 tests: check_cert_subject
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-11 14:09:45 +02:00
Jared Bents
841205a1ce OpenSSL: Add 'check_cert_subject' support for TLS server
This patch added 'check_cert_subject' support to match the value of
every field against the DN of the subject in the client certificate. If
the values do not match, the certificate verification will fail and will
reject the user.

This option allows hostapd to match every individual field in the right
order, also allow '*' character as a wildcard (e.g OU=Development*).

Note: hostapd will match string up to 'wildcard' against the DN of the
subject in the client certificate for every individual field.

Signed-off-by: Paresh Chaudhary <paresh.chaudhary@rockwellcollins.com>
Signed-off-by: Jared Bents <jared.bents@rockwellcollins.com>
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-11 14:09:45 +02:00
Jouni Malinen
0173423f41 Use char pointers for EAP configuration parameters without length
These parameters were using the u8*/len style types even though they
were used as char* strings without an explicit length field. Make this
char* instead of u8* to avoid confusion and unnecessary type casting.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-11 14:09:45 +02:00
Jouni Malinen
cd6a5866eb Remove forgotten os_strncpy() implementations
This was replaced with os_strlcpy() long time ago.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-10 15:56:51 +02:00
Jouni Malinen
ca9efe113c roboswitch: Check some read operation results
This gets rid of some static analyzer warnings about uninitialized
variables being used in comparisons or write operations.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 18:56:48 +02:00
Jouni Malinen
9571f945c6 mesh: Check that SAE state initialization succeeded for PMKID check
mesh_rsn_auth_sae_sta() might fail, so verify that sta->sae got
allocated before dereferencing it for a PMKID check.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 18:55:58 +02:00
Lubomir Rintel
fafad85274 defconfig: Enable DBus
Acquire the new name, along with introspection. This is generally useful
for other daemons to integrate with wpa_supplicant, notably
NetworkManager.

Debian and Fedora (and likely any other distro that configured wireless
via NetworkManager) enable this.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
2019-03-09 18:35:49 +02:00
Lubomir Rintel
6a8dee76d4 wpa_supplicant: Drop the old D-Bus interface support
This drops support for the fi.epitest.hostap.WPASupplicant D-Bus name
along with the associated CONFIG_CTRL_IFACE_DBUS option. Nothing should
really be using this since 2010.

This is a just a straightforward removal. Perhaps the dbus_common.c and
dbus_new.c can be merged now. Also, the "_NEW" suffix of the config
option seems to make even less sense than it used to.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
2019-03-09 18:33:26 +02:00
Lubomir Rintel
192d061add tests: Drop testing of the old D-Bus interface
This old interface has been obsoleted and should not have been used
since 2010, so remove testing for it in preparation to dropping the
interface completely from wpa_supplicant.

Signed-off-by: Lubomir Rintel <lkundrak@v3.sk>
2019-03-09 18:23:09 +02:00
Jouni Malinen
a5387062e5 tests: Use a helper function for DPP_BOOTSTRAP_GEN commands
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 18:13:10 +02:00
Jouni Malinen
0422d06b54 tests: Use a helper function for DPP_QR_CODE commands
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 16:55:54 +02:00
Jouni Malinen
7010f4bed5 tests: DPP provisioning updating wpa_supplicant configuration file
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 16:23:04 +02:00
Jouni Malinen
954c535a50 DPP: Update wpa_supplicant configuration file after provisioning
WPS was already doing this if update_config=1 was set and DPP should be
consistent with that behavior. Update the configuration file if
update_config=1 and dpp_config_processing is set to 1 or 2.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 16:21:54 +02:00
Jouni Malinen
4d379be4a9 Clarify AP mode Action frame handling
Include only one of hostapd_mgmt_rx() and hostapd_action_rx() functions
in the build. Previously, NEED_AP_MLME builds (i.e., cases where hostapd
AP MLME implementation is included) included both of these functions and
both were tried in sequence. In addition to being difficult to
understand, that could result in unexpected behavior if
hostapd_mgmt_rx() rejected a frame and return 0 to allow
hostapd_action_rx() to attempt to process the frame.

All the operations included in hostapd_action_rx() are supposed to be
available through the hostapd_mgmt_rx() call in handle_action() and
those should result in the exact same Category/Action-based handler
function to be called in the end. As such, this should not result in
different behavior. And if there is a difference, that would be pointing
at a hidden bug that would need to be fixed anyway. Furthermore, builds
without NEED_AP_MLME would not have any difference in behavior or
contents of the binary either.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 12:51:34 +02:00
Jouni Malinen
cc833a236c Minor cleanup to return after WNM Action frame handling
There is no need to go through the following handler calls in
hostapd_action_rx() after having found the matching WLAN_ACTION_WNM
handler.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 12:43:20 +02:00
Jouni Malinen
700b3f395e Move SA Query frame length check to the shared handler function
Check the length in the common handler functions instead of both
callers.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 12:41:49 +02:00
Jouni Malinen
002edb6303 Fix AP MLME in driver handling of FT and SA Query Action frames
hostapd_action_rx() was pointing at incorrect field (Action vs.
Category) for the wpa_ft_action_rx() call and the length check for SA
Query Action frames. This resulted in those frames getting dropped as
invalid (FT) or ignored as truncated (SA Query). Fix this by pointing to
the correct place at the beginning of the frame body.

This issue had a long history. These were broken during cleanup in
commit dbfb8e82ff ("Remove unnecessary EVENT_RX_ACTION") which
actually fixed the initial reason for the error accidentally. It was
just that that error was needed to cancel out another earlier error..

One of the errors came from misuse of the EVENT_RX_ACTION API in commit
deca6eff74 ("atheros: Add new IEEE 802.11r driver_ops"). That pointed
struct rx_action data/len to cover the Action frame from the Category
field to the end of the frame body while the API was documented to cover
Action field to the end of the frame body. This error was cancelled by
another error in commit 88b32a99d3 ("FT: Add FT AP support for drivers
that manage MLME internally") that called wpa_ft_action_rx() with the
struct rx_action::data field as the second argument. That argument needs
to point to the Category field, but that struct rx_action field was
supposed to point to the Action field.

Number of the Action frame handlers added into hostapd_action_rx() had
been fixed more or less accidentally after this in various other
commits, but the FT and SA Query handlers had ended up maintaining the
incorrect operations. This is now fixing those.

This seems to fix at least some cases of FT-over-DS with drivers that
use driver-based AP MLME. Such drivers might use internal SA Query
processing, so it is not clear whether that part actually fixes any real
issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 12:41:43 +02:00
Jouni Malinen
0defc42a49 tests: Add wlantest description for ap_ft_pmf_*_over_ds
This is convenient to allow easier examination of the FT Action frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 11:37:02 +02:00
Jouni Malinen
0c481b7866 tests: Use run_ap_ft_pmf_bip_over_ds() for ap_ft_pmf_over_ds
No need to duplicate this functionality when all the ap_ft_pmf_*_over_ds
test cases are doing practically the same thing and the
no-specific-cipher-configuration case can be addressed easily with the
same helper function.

Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 11:33:49 +02:00
Jouni Malinen
46b8ea2105 tests: Fix ap_ft_pmf_over_ds
The main step of the test case was accidentally removed when adding the
cipher specific versions.

Fixes: ffcaca68d3 ("tests: FT with different BIP algorithms")
Signed-off-by: Jouni Malinen <j@w1.fi>
2019-03-09 11:26:38 +02:00
Masashi Honma
1e653daa31 EAP-pwd server: Fix memory leak with salted passwords
The struct hostapd_eap_user changes with a new allocated variable were
not covered in the RADIUS server code. Fix this by using eap_user_free()
instead of custom memory freeing operation in radius_server.c.

The hwsim tests with salted password (ap_wpa2_eap_pwd_salt_sha1,
ap_wpa2_eap_pwd_salt_sha256, ap_wpa2_eap_pwd_salt_sha512) triggered
these memory leaks.

Fixes: d52ead3db7 ("EAP-pwd server: Add support for salted password databases")
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
2019-03-08 16:59:27 +02:00
Jouni Malinen
9ebbdd0aa3 tests: Report authentication server memory leaks more visible
It was too easy to miss memory leaks in the hostapd-as-AS log.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-08 16:52:52 +02:00
Jouni Malinen
96d6dfa8e4 SAE: Add Finite Cyclic Group field in status code 77 response
Copy the Finite Cyclic Group field value from the request to the
response Authentication frame if we end up rejecting the request due to
unsupported group.

IEEE Std 802.11-2016 has conflicting statements about this behavior.
Table 9-36 (Presence of fields and elements in Authentication frames)
indicates that the Finite Cyclic Group field is only included with
status code values 0 (success) and 76 (anti-clogging token request)
while SAE protocol description implying that the Finite Cyclic Group
field is set to the rejected group (12.4.8.6.3 and 12.4.8.6.4).

The standard language needs to cleaned up to describe this
unambiguously, but since it looks safe to add the field into the
rejection case and since there is desire to have the field present to be
able to implement what exactly is stated in 12.4.8.6.4, it looks
reasonable to move ahead with the AP mode implementation change. There
is no change in wpa_supplicant for now to modify its behavior based on
whether this field is present, i.e., wpa_supplicant will continue to
work with both the old and new hostapd behavior for SAE group
negotiation.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-08 16:21:03 +02:00
Jouni Malinen
fda7660106 EAP-pwd: Fix a memory leak in hunting-and-pecking loop
tmp2 (y^2) was derived once in each iteration of the loop and only freed
after all the loop iterations. Fix this by freeing the temporary value
during each iteration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-07 00:27:12 +02:00
Jouni Malinen
dc0f727c99 tests: WPS with PSK+SAE
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 21:52:49 +02:00
Jouni Malinen
339dc8bd6b WPS: Allow SAE configuration to be added automatically for PSK
The new wpa_supplicant configuration parameter wps_cred_add_sae=1 can be
used to request wpa_supplicant to add SAE configuration whenever WPS is
used to provision WPA2-PSK credentials and the credential includes a
passphrase (instead of PSK). This can be used to enable WPA3-Personal
transition mode with both SAE and PSK enabled and also with PMF enabled.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 21:52:49 +02:00
Jouni Malinen
fc30f99b34 WPS: Allow AP SAE configuration to be added automatically for PSK
The new hostapd configuration parameter wps_cred_add_sae=1 can be used
to request hostapd to add SAE configuration whenever WPS is used to
configure the AP to use WPA2-PSK and the credential includes a
passphrase (instead of PSK). This can be used to enable WPA3-Personal
transition mode with both SAE and PSK enabled and PMF enabled for PSK
and required for SAE associations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 21:52:43 +02:00
Sunil Dutt
b9cd4f5e75 Vendor feature capability for TWT (Target Wake Time)
Add a new QCA vendor specific feature capability indication for the
device to indicate the support of TWT.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2019-03-06 14:13:33 +02:00