Commit graph

17186 commits

Author SHA1 Message Date
Ben Greear
a6b2007c2f nl80211: Support disabling HE in infrastructure BSS as station
Send a flag to the kernel when user has specified disable_he=1 in the
network configuration block. This extends the functionality added in
commit 7c8f540ee0 ("wpa_supplicant: Add HE override support") to cover
the cases that need kernel functionality.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2021-03-12 10:40:25 +02:00
Andrei Otcheretianski
01f2e54ce7 P2P: Clear pending_listen_freq when stopping listen
If listen work never started, pending_listen_freq might be left
uncleared, preventing the subsequent listen to start. This could happen
in p2p_timeout_wait_peer_idle() after the commit 13256b8cf ("P2P: Stop
old listen radio work before go to WAIT_PEER_IDLE state") added a
stop_listen() call there.

Fixes: 13256b8cf3 ("P2P: Stop old listen radio work before go to WAIT_PEER_IDLE state")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-03-12 10:38:14 +02:00
Andrei Otcheretianski
82a348eda4 wpa_supplicant: Don't process EAPOL frames while disconnecting
An EAPOL frame may be pending when wpa_supplicant requests to
deauthenticate. At this stage the EAP SM cache is already cleaned by
calling eapol_sm_invalidate_cached_session(). Since at this stage the
wpa_supplicant's state is still set to associated, the EAPOL frame is
processed and results in a crash due to NULL dereference.

This wasn't seen previously as nl80211 wouldn't process the
NL80211_CMD_CONTROL_PORT_FRAME, since wpa_driver_nl80211_mlme() would
set the valid_handler to NULL. This behavior was changed in commit
ab89291928 exposing this race.

Fix it by ignoring EAPOL frames while the deauthentication is in
progress.

Fixes: ab89291928 ("nl80211: Use process_bss_event() for the nl_connect handler")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-03-12 09:57:23 +02:00
Stefan Paetow
e80e6a2f17 eapol_test: Add address family for IPv4 in Windows build
Add the address family when manually constructing IPv4 addresses in
eapol_test on Windows. Otherwise other functions, like hostapd_ip_txt()
in src/utils/ip_addr.c, that rely on addr->af being set fail miserably.
The non-Windows option uses hostapd_parse_ip_addr() which does this as
part of the helper function.

Signed-off-by: Stefan Paetow <oss@eons.net>
2021-03-12 09:49:20 +02:00
Swarn Singh
cd2f8151ee Add support to return bandwidth for channel 2 of the 6 GHz band
The 6 GHz band operating class 136 is defined to use 20 MHz bandwidth.
Return the value accordingly from center_idx_to_bw_6ghz() to cover this
special case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-12 00:12:16 +02:00
Mohammad Asaad Akram
6b4e32da89 New vendor attribute to configure TWT mantissa in microseconds
Define the following additional TWT attribute for
qca_wlan_vendor_attr_twt_setup:
QCA_WLAN_VENDOR_ATTR_TWT_SETUP_WAKE_INTVL2_MANTISSA to configure the
mantissa in microseconds.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-12 00:10:13 +02:00
Jouni Malinen
e90ededb4b wlantest: Skip Mesh Control field from the beginning of payload
This allows correct processing of Data frames with Mesh Control field by
finding the LLC/SNAP header after that field.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-09 20:20:24 +02:00
Jouni Malinen
503901e72d wlantest: Check all configured TKs if no matching GTK is known
This allows group-addressed frames to be decrypted by listing all
possible GTKs in the PTK file.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-09 17:29:48 +02:00
Jouni Malinen
9216929ab6 tests: HE and TWT
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 22:08:52 +02:00
Ben Greear
7fd2f24962 TWT: Support sending TWT Setup and Teardown Action frames
This adds new control interface commands TWT_SETUP and TWT_TEARDOWN. For
now, these are only for testing purposes to be able to trigger
transmission of the TWT Action frames without configuring any local
behavior for TWT in the driver.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2021-03-07 22:07:37 +02:00
Jouni Malinen
edbaffc4f6 wpabuf: Add helper functions for writing 64-bit integers
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 21:31:41 +02:00
Jouni Malinen
cf47a43335 tests: EAP-SIM DB error cases (SQLite)
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 17:58:14 +02:00
Jouni Malinen
ac2dddf7d1 tests: DPP NFC with hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 17:38:27 +02:00
Jouni Malinen
96279a5c51 tests: DPP chirp with an AP as a standalone Configurator
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 13:18:01 +02:00
Jouni Malinen
fd13693cac tests: DPP PKEX errors with hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 13:12:37 +02:00
Jouni Malinen
d28c2de249 tests: DPP chirp errors in hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 13:02:59 +02:00
Jouni Malinen
692ff6f002 tests: DPP Controller management in hostapd
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:57:25 +02:00
Jouni Malinen
39ff1a67ad tests: Invalid DAC_REQUEST values
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:46:38 +02:00
Jouni Malinen
ea82abc18a tests: hostapd ATTACH errors
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:41:16 +02:00
Jouni Malinen
234761082a tests: hostapd PMKSA_ADD failures
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:34:32 +02:00
Jouni Malinen
17d85158cf Fix hostapd PMKSA_ADD with Authenticator disabled
This function can get called with hapd->wpa_auth == NULL from the
control interface handler, so explicitly check for that.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:33:30 +02:00
Jouni Malinen
e6dae30ce1 tests: EAPOL/key config test command failures
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:25:38 +02:00
Jouni Malinen
261dbf7341 tests: hostapd GET_CAPABILITY
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:14:54 +02:00
Jouni Malinen
b385b4765d tests: ADD_MAC/DEL_MAC special cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:11:56 +02:00
Jouni Malinen
b0ded7d273 tests: Additional invalid SET_NEIGHBOR coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:08:02 +02:00
Jouni Malinen
924c17aad5 tests: hostapd ctrl_iface SHOW_NEIGHBOR while neighbor report disabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:05:09 +02:00
Jouni Malinen
8e6a56b6e0 tests: Additional invalid REQ_BEACON cases
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 12:02:46 +02:00
Jouni Malinen
9c47624fc8 tests: VENDOR command
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 11:51:54 +02:00
Jouni Malinen
0a549776ce tests: VHT CSA with VHT80+80 getting enabled
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 01:42:48 +02:00
Jouni Malinen
147d6d3727 Update VHT capabilities info on channel switch event
This is needed to be able to move from 80 MHz or lower bandwidth to 160
or 80+80 MHz bandwidth (and back) properly without leaving the Beacon
frame VHT elements showing incorrect information.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 01:35:25 +02:00
Jouni Malinen
dc587c479c nl80211: Determine secondary channel offset for CS to 80+80 MHz
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 01:21:12 +02:00
Jouni Malinen
0a8095d729 nl80211: Debug print for channel switch request parameters
These can be helpful for debugging channel switch issues.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 01:11:18 +02:00
Jouni Malinen
a20ace3a1e nl80211: Add command-to-string mapping for previously missed commands
In addition, make the compiler warn if a new enum value is added without
defining the matching mapping to a string.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 01:06:00 +02:00
Jouni Malinen
0f37b8142b More specific set_freq_params debug prints for 80/80+80 MHz errors
It is more convenient to see the exact error in the debug log instead of
getting noted that something was invalid.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-07 00:54:36 +02:00
Jouni Malinen
3c5ea9fd9f tests: VHT CSA with invalid parameters
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 17:02:38 +02:00
Jouni Malinen
0922519091 tests: Additional GET_PMK coverage
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 16:33:03 +02:00
Avraham Stern
ab89291928 nl80211: Use process_bss_event() for the nl_connect handler
The nl_connect is initialized with the process_bss_event() handler.
However, it is used several times with the default valid handler. As a
result, if a message that is only valid for process_bss_event() is
received while the default handler is used, it will be dropped.

This has been observed in a case where during the 4-way handshake, a
Beacon frame is received on the AP side, which triggers a beacon update,
just before receiving the next EAPOL. When send_and_recv_msgs_owner() is
called for sending the NL80211_CMD_SET_BEACON command, the
NL80211_CMD_CONTROL_PORT_FRAME event is already pending. As a result, it
is received with the default handler, which drops it. Since the EAPOL
frame is dropped, the connection attempt fails.

Fix it by using the process_bss_event() handler when the nl_connect
handler is used.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
2021-03-06 13:36:20 +02:00
Jouni Malinen
f7835ac163 tests: IGTK and BIGTK replay protection
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
5a7e806b69 tests: Invalid MGMT_TX_STATUS_PROCESS
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
f5439acf6a tests: RELOAD_WPA_PSK failure
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 13:17:55 +02:00
Jouni Malinen
7c5442e744 DPP: Clear hapd->gas pointer on deinit
While it does not look like the stale pointer could have been
dereferenced in practice, it is better not to leave the stale pointer to
freed memory in place to avoid accidental uses.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:56:00 +02:00
Jouni Malinen
b54410127d tests: hapd->tmp_eap_user clearing on interface deinit/reinit
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:45:48 +02:00
Jouni Malinen
076e0abddb SQLite: Fix temporary eap_user data freeing on interface restart
hapd->tmp_eap_user needs to be cleared on interface deinit to avoid
leaving stale pointers to freed memory.

Fixes: ee431d77a5 ("Add preliminary support for using SQLite for eap_user database")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:44:38 +02:00
Jouni Malinen
3e735adf0b tests: WNM time advertisement and interface restart
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:38:18 +02:00
Michael Braun
2da3105ac1 Fix use after free with hapd->time_adv on interface restart
When an interface is disabled, e.g. due to radar detected,
hapd->time_adv is freed by hostapd_free_hapd_data(), but later
used by ieee802_11_build_ap_params() calling hostapd_eid_time_adv().

Thus hapd->time_adv needs to be cleared as well.

Fixes: 39b97072b2 ("Add support for Time Advertisement")
Signed-off-by: Michael Braun <michael-dev@fami-braun.de>
2021-03-06 11:37:26 +02:00
Jouni Malinen
48e2725f5a Add a link to Patchwork for a list of pending patches
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:26:20 +02:00
Jouni Malinen
fa4cd46c37 tests: Roam command during a scan operation
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-03-06 11:11:21 +02:00
Matthew Wang
5ac977758d Reject authentication start during explicit roam requests
The roam D-Bus and ROAM control itnerface commands flip the reassociate
bit before calling wpa_supplicant_connect(). wpa_supplicant connect
eventually aborts ongoing scans (if any), which causes scan results to
be reported. Since the reassociate bit is set, this will trigger a
connection attempt based on the aborted scan's scan results and cancel
the initial connetion request. This often causes wpa_supplicant to
reassociate to the same AP it is currently associated to instead of the
explicitly requested roaming target.

Add a roam_in_progress flag to indicate that we're currently attempting
to roam via an explicitly request to a specific BSS so that we don't
initiate another connection attempt based on the possibly received scan
results from a scan that was in progress at the time the roam command
was received.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 10:59:05 +02:00
Kiran Kumar Lokere
800fb69970 QCA vendor attribute to allow 6 GHz connection with all security types
Add a QCA vendor attribute to configure the driver to allow the 6 GHz
connection with all security types. This attribute is used for testing
purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-04 18:05:06 +02:00
Kiran Kumar Lokere
1a60099f26 QCA vendor attribute to ignore SAE H2E requirement mismatch
Add a QCA vendor attribute to ignore SAE H2E requirement mismatch for 6
GHz connection. This attribute is used for testing purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-03-04 18:04:07 +02:00