Commit graph

13720 commits

Author SHA1 Message Date
Jouni Malinen
f718e5e22c HS 2.0 server: Show whether credential is machine managed
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
eb83e81e31 HS 2.0 server: Make user list more readable
Order the rows based on identity and use a bit smaller font for some of
the fields to make the table fit on the screen more easily.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
af284f8a8e HS 2.0 server: Clarify signup page options
Make it clearer that there are three different types of credentials that
can be provisioned.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
dd76afff65 HS 2.0 server: Do not perform subrem if not requested to
Instead of defaulting to machine remediation, reject a request to do
subscription remediation if that has not been configured to be required.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
7770a9dd6a RADIUS: Support last_msk with EAP-TLS
This extends the last_msk testing functionality in the RADIUS server to
work with EAP-TLS based on "cert-<serial_num>" form user names in the
database.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
063cbb87a6 EAP server: Add eap_get_serial_num()
This can be used to fetch the serial number of the peer certificate
during TLS-based EAP session.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
0ec3e77a13 TLS: Add tls_connection_peer_serial_num()
This can be used to fetch the serial number of the peer certificate in
the EAP server. For now, this is implemented only with OpenSSL.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
18003b315b AS: Add an event_cb() callback handler
This provides debug log information on TLS events on the server side.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
2ff952a5dd OpenSSL: Make serial number of peer certificate available in event_cb
Add serial number to the event_cb() information for the peer certificate
chain.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-11 12:12:30 +03:00
Jouni Malinen
ee598e431b HS 2.0 server: Add last_msk into users table setup
This field is used for debugging purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-07 12:47:21 +03:00
Jouni Malinen
2fd8984b05 HS 2.0: Reject OSU connection for Single SSID case without OSU_NAI
The Single SSID case can only use OSEN, so reject the case where OSU_NAI
is not set and open OSU connection would be used since that connection
cannot succeed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-05 21:03:46 +03:00
Jouni Malinen
6bf62f7fc4 tests: OSU Providers NAI List ANQP-element
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-05 20:54:40 +03:00
Jouni Malinen
2f158bc194 HS 2.0: Use alternative OSU_NAI information in hs20-osu-client
Extend hs20-osu-client to support the new osu_nai2 value for OSU
connection with the shared BSS (Single SSID) case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-05 20:53:31 +03:00
Jouni Malinen
baf4c86379 HS 2.0: Request and process OSU Providers NAI List ANQP-element
Extend wpa_supplicant to use a separate OSU_NAI information from OSU
Providers NAI List ANQP-element instead of the OSU_NAI information from
OSU Providers list ANQP-element when connecting to the shared BSS
(Single SSID) for OSU.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-05 20:51:51 +03:00
Jouni Malinen
cad810a98f HS 2.0: OSU Provider NAI List advertisement
Extend hostapd to allow the new OSU Provider NAI List ANQP-element to be
advertised in addition to the previously used OSU Providers list
ANQP-element. The new osu_nai2 configurator parameter option is used to
specify the OSU_NAI value for the shared BSS (Single SSID) case while
osu_nai remains to be used for the separate OSU BSS.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-05 20:49:42 +03:00
Jouni Malinen
1dd66fc103 tests: Update server and user certificates (2018)
The previous versions expired, so need to re-sign these to fix number of
the EAP test cases.

Signed-off-by: Jouni Malinen <j@w1.fi>
2018-10-04 01:16:55 +03:00
Jouni Malinen
953f689391 tests: Test connectivity within each step of FILS+FT
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-04 00:31:48 +03:00
vamsi krishna
edb509d49f Add QCA vendor event to report roam scan events
Driver/firmware does roam scan when it finds the need to roam to a
different BSS. Add a QCA vendor event to indicate such roam scan events
from driver/firmware to user space.

Please note that some drivers may not send these events in few cases,
e.g., if the host processor is sleeping when this event is generated in
firmware to avoid undesired wakeups.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-04 00:31:45 +03:00
Purushottam Kushwaha
cf94626c50 OWE: Do not try to enable PMF for non-RSN associations
Explicitly set the PMF configuration to 0 (NO_MGMT_FRAME_PROTECTION) for
non-RSN associations. This specifically helps with OWE transition mode
when the network block is configured with PMF set to required, but the
BSS selected is in open mode. There is no point to try to enable PMF for
such an association.

This fixes issues with drivers that use the NL80211_ATTR_USE_MFP
attribute to set expectations for PMF use. The combination of non-RSN
connection with claimed requirement for PMF (NL80211_MFP_REQUIRED) could
cause such drivers to reject the connection in OWE transition mode.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-10-04 00:26:41 +03:00
Jouni Malinen
0fa415a835 tests: Suite B and PMKSA caching multiple times
This verifies that wpa_supplicant and hostapd behave consistently with
PMKSA caching when Suite B AKMs end up deriving a new PMKID from each
4-way handshake.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-27 11:43:58 +03:00
Jouni Malinen
17d4b77472 RSN: Do not replace existing Suite B PMKSA on 4-way handshake
PMKID derivation with the Suite B AKMs is a special case compared to
other AKMs since that derivation uses KCK instead of PMK as an input.
This means that the PMKSA cache entry can be added only after KCK has
been derived during 4-way handshake. This also means that PMKID would
change every time 4-way handshake is repeated even when maintaining the
same PMK (i.e., during PTK rekeying and new associations even if they
use PMKSA caching).

wpa_supplicant was previously replacing the PMKSA cache entry whenever a
new PMKID was derived. This did not match hostapd expectations on the AP
side since hostapd did not update the PMKSA cache entry after it was
created. Consequently, PMKSA caching could be used only once (assuming
no PTK rekeying happened before that). Fix this by making wpa_supplicant
behave consistently with hostapd, i.e., by adding the Suite B PMKSA
cache entries with the PMKID from the very first 4-way handshake
following PMK derivation and then not updating the PMKID.

IEEE Std 802.11-2016 is somewhat vague in this area and it seems to
allow both cases to be used (initial PMKID or any consecutive PMKID
derived from the same PMK). While both cases could be supported that
would result in significantly more complex implementation and need to
store multiple PMKID values. It looks better to clarify the standard to
explicitly note that only the first PMKID derived after PMK derivation
is used (i.e., match the existing hostapd implementation).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-27 11:37:19 +03:00
Jouni Malinen
4d1f7b6856 HS 2.0: Remove hs20-osu-client debug file Cert/est-resp.raw
This was used during initial EST development time testing, but the same
information is available in the debug log and since this separate file
is deleted automatically, just remove its generation completely to
simplify implementation.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-26 12:59:41 +03:00
Jouni Malinen
f1e2d38166 tests: DPP_CONFIGURATOR_ADD error path
This is a regression test case for a memory leak on DPP_CONFIGURATOR_ADD
error path in dpp_keygen_configurator() when an unsupported curve is
specified.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-21 21:39:34 +03:00
Srikanth Marepalli
bd88ed60fa eap_proxy: Fix memory leaks when using eap_peer_erp_init()
The external session_id and emsk from eap_proxy_get_eap_session_id() and
eap_proxy_get_emsk() need to be freed consistently in all code paths
within eap_peer_erp_init() and outside it in the case ERP is not
initialized.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-21 21:34:08 +03:00
Ankita Bajaj
820ea0ba93 DPP: Fix a memory leak on Configurator keygen error path
The allocated configuration structure needs to be freed if the specified
curve is not supported.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-21 21:22:42 +03:00
Ankita Bajaj
5a052f92eb DPP: Fix a memory leak in L derivation
The temporary EC_POINT 'sum' needs to be freed at the end of the
function with the other OpenSSL allocations.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-21 21:21:14 +03:00
Ankita Bajaj
bae282e3e8 DPP: Fix an error path memory leak in URI public key parsing
The allocated buffer from base64_decode() needs to be freed on the
sha256_vector() error path.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-21 21:20:06 +03:00
Srikanth Marepalli
e662260162 Free dh_ctx on failure in wps_nfc_gen_dh()
This is needed to avoid a memory leak on an error path.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-20 17:18:16 +03:00
Srinivas Dasari
50b77f50e8 DPP: Flush PMKSA if an assoc reject without timeout is received
Flush the PMKSA upon receiving assoc reject event without timeout
in the event data, to avoid trying the subsequent connections
with the old PMKID. Do not flush PMKSA if assoc reject is
received with timeout as it is generated internally from the
driver without reaching the AP.

This extends commit d109aa6cac ("SAE:
Flush PMKSA if an assoc reject without timeout is received") to handle
also the DPP AKM.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-18 13:15:20 +03:00
Varun Reddy Yeturu
60377efcc1 QCA vendor command support for TWT test configuration
Define new QCA vendor specific test config attributes to configure TWT.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-18 13:03:02 +03:00
Jouni Malinen
d7e35c4e29 tests: Enable Suite B test cases with OpenSSL 1.1.1
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-17 17:52:38 +03:00
Jouni Malinen
2b92c4f3c0 DPP: Fix test functionality for invalid keys with OpenSSL 1.1.0
It looks like at least OpenSSL 1.1.0i includes the extra checks in
EC_POINT_set_affine_coordinates_GFp() that break the previously used
mechanism for generating invalid keys. Fix this by using the alternative
design that was used with OpenSSL 1.1.1 and BoringSSL.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-17 17:23:10 +03:00
Jouni Malinen
cc6263ef60 HS 2.0 server: Store device MAC address into database
This is needed for tracking status of certificate enrollment cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:54 +03:00
Jouni Malinen
31157568f2 tests: sigma_dut controlled Hotspot 2.0 connection
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:54 +03:00
Jouni Malinen
dc60d5643a tests: sigma_dut controlled Venue URL fetch
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:54 +03:00
Jouni Malinen
bb2c25d0dc tests: Venue URL ANQP-element with PMF
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:54 +03:00
Jouni Malinen
3ecb8a5203 ANQP: Parse and report Venue URL information
Parse the Venue URL ANQP-element payload and report it with the new
RX-VENUE-URL event messages if the query was done using PMF.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-15 05:17:49 +03:00
Jouni Malinen
1d73531fdb HS 2.0: Fix T&C server database check
It was possible for the wait loop to exit early due to the $row[0] == 1
check returning false if the database value was not yet set. Fix this by
updated the $waiting default value only if the database actually has a
value for this field.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-13 01:04:40 +03:00
Jouni Malinen
25f3c270d9 HS 2.0: Allow OSU SSID selection to be enforced for testing purposes
This allows hs20-osu-client to be requested to select a specific OSU
SSID with the new command line argument (-o<OSU_SSID>). This is useful
for testing single SSID transition mode cases.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-13 00:17:51 +03:00
Jouni Malinen
b275c3ae51 HS 2.0: Use shared SSID (if available) for OSU by default
When the AP is detected to have single BSS shared for RSN and OSEN, use
that BSS for OSU by default instead of the one based on the OSU_SSID in
the OSU Providers list.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-13 00:17:15 +03:00
Jouni Malinen
40d514ec64 tests: Hotspot 2.0 OSU provider and single SSID
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-12 03:49:16 +03:00
Jouni Malinen
075926ec71 HS 2.0: Add alternative OSU_SSID into providers info file
This adds the second SSID (the one used by the shared BSS) for OSU
connection when generating osu-providers.txt. External tools can use
that to configure multiple network profiles for OSU to cover the cases
where transition mode is used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-12 02:52:50 +03:00
Jouni Malinen
0beb6c2f50 tests: sigma_dut controlled AP with OSEN
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-12 02:26:11 +03:00
Jouni Malinen
ad4e4f60a0 RADIUS server: Add testing support for authentication result
CONFIG_RADIUS_TEST builds can now update the user SQLite database based
on authentication result from the last attempt. If the database has a
last_msk column, that will be set to the hexdump of the MSK whenever
authentication succeeds and to "FAIL" whenever authentication fails.
This can be used for testing purposes by having an external program
track authentication status per user.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-11 04:02:36 +03:00
Jouni Malinen
ad5c385db9 HS 2.0 server: Replace deprecated PHP function split()
Use explode() instead of split() because split() has been removed from
PHP 7.0.0 and there is no need for using full regular expression here.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-10 23:41:35 +03:00
Jouni Malinen
02eec9954c XML: Do not add empty Value node for nodes with child nodes in TNDS
This fixes some validation issues against DM_ddf DTD that were caused by
the conversion from the internal tree structure to TNDS. Only the leaf
nodes are supposed to have the Value node.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-10 21:43:43 +03:00
Kiran Kumar Lokere
13dd13fc01 Define test config attribute to configure OM control support
Define a new QCA vendor specific test config attribute to configure the
support for receiving the MPDU with operating mode control subfield.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2018-09-06 00:01:57 +03:00
Beni Lev
077232f603 OCE: Add OCE capability attribute only when associating to an OCE AP
Signed-off-by: Beni Lev <beni.lev@intel.com>
2018-09-02 18:16:30 +03:00
Roee Zamir
2ac4333404 OCE: Send scan parameters when OCE_STA functionality is enabled
If the device supports OCE features and OCE is enabled, set the relevant
scan parameters and FILS Request Parameters element with Max Channel
Time.

Signed-off-by: Roee Zamir <roee.zamir@intel.com>
2018-09-02 18:08:51 +03:00
Roee Zamir
d6801b0545 nl80211: Support OCE features (driver capability and scan params)
Check if the device supports specific mandatory features and set the the
relevant WPA_DRIVER_FLAGS_OCE_STA flag. Send the relevant scan
parameters for OCE scans.

Signed-off-by: Roee Zamir <roee.zamir@intel.com>
2018-09-02 17:59:01 +03:00