Commit graph

5442 commits

Author SHA1 Message Date
Ilan Peer
2efa60344e PASN: Encode the public key properly
When a public key is included in the PASN Parameters element, it should
be encoded using the RFC 5480 conventions, and thus the first octet of
the Ephemeral Public Key field should indicate whether the public key is
compressed and the actual key part starts from the second octet.

Fix the implementation to properly adhere to the convention
requirements for both wpa_supplicant and hostapd.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-03-16 12:31:31 +02:00
Ben Greear
a746393dcf TWT: Allow specifying Control field value in TWT Request
See IEEE P802.11ax/D8.0, Figure 9-687 (Control field format) for
details.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2021-03-12 10:53:02 +02:00
Andrei Otcheretianski
82a348eda4 wpa_supplicant: Don't process EAPOL frames while disconnecting
An EAPOL frame may be pending when wpa_supplicant requests to
deauthenticate. At this stage the EAP SM cache is already cleaned by
calling eapol_sm_invalidate_cached_session(). Since at this stage the
wpa_supplicant's state is still set to associated, the EAPOL frame is
processed and results in a crash due to NULL dereference.

This wasn't seen previously as nl80211 wouldn't process the
NL80211_CMD_CONTROL_PORT_FRAME, since wpa_driver_nl80211_mlme() would
set the valid_handler to NULL. This behavior was changed in commit
ab89291928 exposing this race.

Fix it by ignoring EAPOL frames while the deauthentication is in
progress.

Fixes: ab89291928 ("nl80211: Use process_bss_event() for the nl_connect handler")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-03-12 09:57:23 +02:00
Stefan Paetow
e80e6a2f17 eapol_test: Add address family for IPv4 in Windows build
Add the address family when manually constructing IPv4 addresses in
eapol_test on Windows. Otherwise other functions, like hostapd_ip_txt()
in src/utils/ip_addr.c, that rely on addr->af being set fail miserably.
The non-Windows option uses hostapd_parse_ip_addr() which does this as
part of the helper function.

Signed-off-by: Stefan Paetow <oss@eons.net>
2021-03-12 09:49:20 +02:00
Ben Greear
7fd2f24962 TWT: Support sending TWT Setup and Teardown Action frames
This adds new control interface commands TWT_SETUP and TWT_TEARDOWN. For
now, these are only for testing purposes to be able to trigger
transmission of the TWT Action frames without configuring any local
behavior for TWT in the driver.

Signed-off-by: Ben Greear <greearb@candelatech.com>
2021-03-07 22:07:37 +02:00
Matthew Wang
5ac977758d Reject authentication start during explicit roam requests
The roam D-Bus and ROAM control itnerface commands flip the reassociate
bit before calling wpa_supplicant_connect(). wpa_supplicant connect
eventually aborts ongoing scans (if any), which causes scan results to
be reported. Since the reassociate bit is set, this will trigger a
connection attempt based on the aborted scan's scan results and cancel
the initial connetion request. This often causes wpa_supplicant to
reassociate to the same AP it is currently associated to instead of the
explicitly requested roaming target.

Add a roam_in_progress flag to indicate that we're currently attempting
to roam via an explicitly request to a specific BSS so that we don't
initiate another connection attempt based on the possibly received scan
results from a scan that was in progress at the time the roam command
was received.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2021-03-06 10:59:05 +02:00
Jouni Malinen
40551a15c1 Fix a memory leak in WPS with ap_scan=2
The wpa_ie buffer is now allocated here and needs to be freed before
returning from the function.

Fixes: d2ba0d719e ("Move assoc param setting into a helper function")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:46:32 +02:00
Jouni Malinen
900adb3c9f FILS: Simplify code paths
Use a shared code path for freeing the wpa_ie buffer to avoid
unnecessary complexity with a separate return for the non-FILS case.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-28 18:42:06 +02:00
Jouni Malinen
6035969e0e Fix dynamic EAP library building
Build eap_*.so into the wpa_supplicant similarly with the wpa_supplicant
binary and include the shared helper functions from additional files
into the builds. This got broken at some point with the build system
changes.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-27 23:42:21 +02:00
Jouni Malinen
a826ff2d95 Ignore group-addressed SA Query frames
These frames are used for verifying that a specific SA and protected
link is in functional state between two devices. The IEEE 802.11
standard defines only a case that uses individual MAC address as the
destination. While there is no explicit rule on the receiver to ignore
other cases, it seems safer to make sure group-addressed frames do not
end up resulting in undesired behavior. As such, drop such frames
instead of interpreting them as valid SA Query Request/Response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-27 20:27:00 +02:00
Jimmy Chen
d314213f6c P2P: Pick a 5 GHz channel from more possible channels
For an autonomous P2P group on the 5 GHz band, a channel was picked only
from the operating class 115 which is not available in the EU region
anymore. As a result, an autonomous group creation would always fail in
this generic 5 GHz channel case.

There are more possible available channels for the 5 GHz currently.
Especially in the EU region, the operating class 115 channels are no
longer available, but SRD channels (the operating class 124) are
available. Allow them to be used here if they are marked as allowed for
P2P GO use.

In addition, iterate through all the potential options instead of just
checking the first randomly picked channel. Start this iteration from
random position to maintain some randomness in this process.

Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
2021-02-27 19:19:35 +02:00
Sreeramya Soratkal
50baf345b4 TDLS: Support TDLS operations in HE mode
Determine if the TDLS peer is HE capable based on HE Capability element
received in the TDLS Setup Response frame. Indicate the peer's HE
capabilities to the driver through sta_add().

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-02-26 20:16:48 +02:00
Jouni Malinen
f03580e319 Restore permanent MAC address on the FLUSH command
Clear previously used random MAC address on the FLUSH command if
mac_addr setting has been disabled.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 17:22:37 +02:00
Jouni Malinen
976c3c161f DPP2: Accept Config Result before GAS response TX status
The TX event for the next frame in the sequence might be received before
the TX status for the final GAS response frame is processed. This used
to result in the Config Result getting discarded and the negotiation not
completing successfully on the Configurator side.

Accept the Config Result message as an indication of the final GAS
response frame having went through fine even if the TX status has not
yet been processed to avoid this issue from a potential race condition
on kernel events.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 16:44:33 +02:00
Jouni Malinen
1ba8a315cd Avoid use of C++ keyword in a header file
Don't use 'protected' as the name of the variable in bss.h since this
might be used in control interfaces that use C++.

Fixes: 1c77f3d3f9 ("Indicate whether additional ANQP elements were protected")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-21 12:48:13 +02:00
Ilan Peer
85eb47e3a9 PASN: Correctly set RSNXE bits from STA
These defines are for the capability bit number, not the binary value
from the bit index. As such, need to use BIT() here to set the bitmap
appropriately.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:25:10 +02:00
Andrei Otcheretianski
be5f7f3746 wpa_supplicant: Fix potential memleak on an error path
extra_buf allocation was missed in one of the error cases.

Fixes: 170775232d ("ANQP: Add support to specify frequency in ANQP_GET command")
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2021-02-20 00:18:45 +02:00
Veerendranath Jakkam
8f204f69ac Show OCV and beacon protection capabilities in control interface
Indicate local support for Operating Channel Validation (OCV) and beacon
protection.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-02-16 00:47:43 +02:00
Veerendranath Jakkam
73ebd58fc8 STA: Check driver capability to enable OCV when driver SME is used
When the driver SME is used, offloaded RSN handshakes like SA Query, GTK
rekeying, FT authentication, etc. would fail if wpa_supplicant enables
OCV in initial connection based on configuration but the driver doesn't
support OCV. To avoid such failures check the driver's capability for
enabling OCV when the driver SME used.

This commit also adds a capability flag for indicating OCV support
by the driver.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-02-16 00:47:43 +02:00
Jouni Malinen
f3dfe42c7e Clean up RSN parameter setting for PASN
Set conf.force_kdk_derivation within the same if block as all the other
parameters. This is used only if ssid is not NULL, so no need to have
any special handling for this parameter.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-16 00:47:43 +02:00
Veerendranath Jakkam
d36d4209fd Enable beacon protection only when driver indicates support
Enabling beacon protection will cause STA connection/AP setup failures
if the driver doesn't support beacon protection. To avoid this, check
the driver capability before enabling beacon protection.

This commit also adds a capability flag to indicate beacon protection
support in client mode only.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2021-02-16 00:47:43 +02:00
Hu Keping
9d99814e22 Update sgml to generate reproducible manpages
Prior to this patch, we failed to recreate bit-by-bit identical
copies of wpa_supplicant because it doesn't generate reproducible manpages.

Since the latest version(0.6.14-3 or new) of docbook-utils have already
support getting the date from sgml file [1], it is possible to make some
progress on the "reproducible builds" effort [2].

[1]: https://sources.debian.org/patches/docbook-utils/0.6.14-3
[2]: https://reproducible-builds.org

Signed-off-by: Hu Keping <hukeping@huawei.com>
2021-02-16 00:47:43 +02:00
Patrick Steinhardt
e680a51e94 ext_password: Implement new file-based backend
It was not easily possible to separate configuration of an interface and
credentials when using the configuration file instead of the control
interface or D-Bus interface for setting up the network profiles. This
makes it hard to distribute configuration across a set of nodes which
use wpa_supplicant without also having to store credentials in the same
file. While this can be solved via scripting, having a native way to
achieve this would be preferable.

Turns out there already is a framework to have external password
storages. It only had a single "test" backend though, which is kind of
an in-memory store which gets initialized with all passwords up front
and is mainly for testing purposes. This isn't really suitable for the
above use case: the backend cannot be initialized as part of the central
configuration given that it needs the credentials, and we want to avoid
scripting.

This commit thus extends the infrastructure to implement a new backend,
which instead uses a simple configuration file containing key-value
pairs. The file follows the format which wpa_supplicant.conf(5) uses:
empty lines and comments are ignored, while passwords can be specified
with simple `password-name=password-value` assignments.

With this new backend, splitting up credentials and configuration
becomes trivial:

    # /etc/wpa_supplicant/wpa_supplicant.conf
    ext_password_backend=file:/etc/wpa_supplicant/psk.conf

    network={
        ssid="foobar"
        psk=ext:foobar
    }

    # /etc/wpa_supplicant/psk.conf
    foobar=ecdabff9c80632ec6fcffc4a8875e95d45cf93376d3b99da6881298853dc686b

Alternative approaches would be to support including other configuration
files in the main configuration, such that common configuration and
network declarations including credentials are split up into separate
files. But the implementation would probably have been more complex
compared to reusing the already-existing framework for external password
backends.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
2021-02-16 00:47:43 +02:00
Patrick Steinhardt
e9f449ba59 wpa_supplicant: Move wpa_config_get_line() into utils
The function wpa_config_get_line() is used by the wpa_supplicant config
file parser to retrieve the next non-comment non-blank line. We'll need
the same kind of functionality to implement the file-based external
password backend, so as a preparatory step this commit extracts the
function into its own standalone file in the utils package.

No functional changes are expected from this commit.

Signed-off-by: Patrick Steinhardt <ps@pks.im>
2021-02-16 00:47:43 +02:00
Jouni Malinen
6fb6264129 P2P: Clear unexpected HT40 configuration on 2.4 GHz band
Number of the P2P+NFC test cases have been failing every now and then
and those failures seemed to be because of having somehow managed to
select the GO's operating channel as HT40+ on the channel 11 in the 2.4
GHz band, i.e., something that is clearly incorrect. The P2P check for
HT40 secondary channel is supported only on the 5 GHz band, so drop HT40
configuration if it shows up unexpectedly on the 2.4 GHz band to avoid
issues in GO being able to start.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-14 19:32:23 +02:00
Michal Kazior
1b45b8d3f6 wpa_supplicant: Don't exit scanning state on config reload
There's a chance that prior to config reload being requested a scan work
was started. As such forcing wpa_supplicant to WPA_DISCONNECTED was
removing any hints that the actual driver is busy with work. That led to
wpa_supplicant reporting "Failed to initialize AP scan" over and over
again for a few seconds (depending on driver/capabilities) until the
untracked scan finished.

Cancelling a scan isn't really a solution because there's a bunch of
scanning state bits sprinkled across wpa_supplicant structure and they
get updated as driver events actually flow in in async manner.

As far as I can tell this is only preventing unnecessary warning
messages. This doesn't seem like it was crippling any logic per se.

Signed-off-by: Michal Kazior <michal@plume.com>
2021-02-13 23:12:38 +02:00
Michal Kazior
581df2d524 DPP2: Defer chirp scan if other scan is queued up
The chirp scan could override the scan_res_handler. This could lead to
wpa_supplicant getting stuck in a scanning state while not scanning at
all until forced to, e.g., via an explicit SCAN control command.

The condition for trigerring this problem in my testing was when
(interface_count % 3) == 2. This introduced a two second delay before
actual scan was triggered after starting the wpa_supplicant instance up.
If DPP chirping was requested fast enough, in between the queueing and
triggering, it would punt the scan request, never to be resumed again.
Chirp scan handler wouldn't resume it leaving wpa_supplicant
inadvertently idle.

Signed-off-by: Michal Kazior <michal@plume.com>
2021-02-13 23:12:07 +02:00
Pradeep Kumar Chitrapu
35756c02ea mesh: Assign channel in frequency params in all bands
Previously, the channel number was set in hostapd_freq_params only with
the presence of HT capabilities. Set the channel number before the check
for HT mode to accommodate the 6 GHz band cases.

Signed-off-by: Pradeep Kumar Chitrapu <pradeepc@codeaurora.org>
2021-02-10 00:25:36 +02:00
Michal Kazior
7e823d4df2 DPP: Expose config object PSK/passphrase in wpa_supplicant
hostapd was already exposing this. There's no reason not to expose it in
wpa_supplicant. This allows 3rd party apps interacting with the control
interface to handle DPP events to get configs instead of needing to
dance around with update_config=1 and SAVE_CONFIG.

Signed-off-by: Michal Kazior <michal@plume.com>
2021-02-09 20:46:36 +02:00
Michal Kazior
1029f16a9f DPP: Expose config object AKM in wpa_supplicant control interface
hostapd was already exposing this. There's no reason not to expose it in
wpa_supplicant. This allows 3rd party apps interacting with the control
interface to handle DPP events to get configs instead of needing to
dance around with update_config=1 and SAVE_CONFIG.

Signed-off-by: Michal Kazior <michal@plume.com>
2021-02-09 20:45:15 +02:00
Jouni Malinen
ad59639ed8 DPP2: Fix Authentication Request destination in the chirping case
The Authentication Request frames triggered by the reception of a
Presence Announcement frame were sent to the broadcast address. This is
not correct behavior since the source MAC address of the Presence
Announcement frame was supposed to override the Responder MAC address.
Fix this by using that source MAC address to avoid unnecessary use of
broadcast frames.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-02-09 20:41:08 +02:00
Jouni Malinen
e781f7c860 Fix compiler warning on CONFIG_AP without CONFIG_P2P builds
The static function is_chanwidth160_supported() is called only within
CONFIG_P2P block so the function itself needs to have matching condition
for build.

Fixes: ed24bad1d9 ("AP: Check driver support while auto-selecting bandwidth for AP/P2P GO")
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 19:12:24 +02:00
Jouni Malinen
4c9b16602d Update Visual Studio projects to match file renaming
Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 18:21:04 +02:00
Jouni Malinen
48cfb52b7e Rename blacklist.[ch] to bssid_ignore.[ch]
This completes renaming of this functionality for a list of temporarily
ignored BSSIDs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 17:28:45 +02:00
Jouni Malinen
626fc0dcd0 Rename wpa_blacklist to wpa_bssid_ignore
This is more accurate name for this functionality of temporarily
ignoring BSSIDs.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 17:28:45 +02:00
Jouni Malinen
b58ac90c38 Rename INTERWORKING_BLACKLISTED define
Use more accurate INTERWORKING_EXCLUDED for this. The actual event
prefix is not changed to remains compatible with external components
using this control interface event message.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 16:43:54 +02:00
Jouni Malinen
72cd4293fb Rename the control interface BLACKLIST command to BSSID_IGNORE
Use a more specific name for the control interface command used for
managing the list of BSSIDs that are temporarily ignored.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 16:29:53 +02:00
Jouni Malinen
752b1c6081 Rename network profiles parameters for ignoring/accepted BSSIDs
Rename the network profile parameters bssid_blacklist and
bssid_whitelist to bssid_ignore and bssid_accept to use more specific
names for the configuration of which BSSs are ignored/accepted during
BSS selection. The old parameter names are maintained as aliases for the
new names to avoid breaking compatibility with previously used
configurations.

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-07 16:18:26 +02:00
Mikael Kanstrup
f7bbad5768 wpa_supplicant: Configurable fast-associate timer threshold
For Android the default value of 5 seconds is usually too short for
scan results from last scan initiated from settings app to be
considered for fast-associate. Make the fast-associate timer value
configurable so that a suitable value can be set based on a systems
regular scan interval.

Signed-off-by: Mikael Kanstrup <mikael.kanstrup@sony.com>
2021-02-06 16:56:30 +02:00
Arowa Suliman
b829b7003a wpa_supplicant: Notify freq change on CH_SWITCH
wpa_supplicant does not send a D-Bus notification of the BSS frequency
change when a CSA happens. Sending a PropertyChanged signal with the
updated frequency will notify the network manager quickly, instead of
waiting for the next scan results.

Signed-off-by: Arowa Suliman <arowa@chromium.org>
Reviewed-by: Brian Norris <briannorris@chromium.org>
2021-02-06 16:50:19 +02:00
Ircama
e79febb3f5 P2P: Adding option to manage device drivers creating random MAC addresses
Add option 2 to the p2p_device_random_mac_addr configuration option to
support device drivers which use by default random MAC adresses when
creating a new P2P Device interface (for instance, the BCM2711 80211
wireless device driver included in Raspberry Pi 4 Model B). In such
case, this option allows to create the P2P Device interface correctly
when using P2P permanent groups, enabling wpa_supplicant to reuse the
same MAC address when re-invoking a P2P permanent group.

update_config=1 is required.

Signed-off-by: Ircama <amacri@tiscali.it>
2021-02-06 13:40:29 +02:00
Jouni Malinen
8f557d2047 Make wpa_bss_ext_capab() handle NULL bss argument
This simplifies the callers that use wpa_s->current_bss (which could be
NULL).

Signed-off-by: Jouni Malinen <j@w1.fi>
2021-02-06 12:09:30 +02:00
Johannes Berg
2cadb60abd robust_av: Use wpa_bss_ext_capab() helper
Use the helper instead of open-coding the check. Since the
helper doesn't handle a NULL BSS, keep that extra check.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2021-02-06 12:09:30 +02:00
Brad Kemp
2b916c9fd5 dbus: Fix IEs getter to use wpa_bss_ie_ptr()
The wpa_bss structure's last element is an empty array. The forgotten
code here assumed that the array of IEs was contiguous to the wpa_bss
structure. This is not always the case anymore. Update this missed case
to use the new wpa_bss_ie_ptr() wrapper to send the correct array of IEs
over DBus.

Fixes: be7ee264f6 ("BSS: Use wrapper function for getting a pointer to the IE buffer")
Signed-off-by: Brad Kemp <brad at beechwoods.com>
2021-02-06 11:41:09 +02:00
David Su
11355a122d Reset external_scan_running on interface deletion
Currently, the external_scan_running flag is not reset when an interface
is removed. Thus, if a connection attempt is made on another iface, it
will fail due to wpa_supplicant incorrectly assuming the radio is still
busy due to the ongoing scan.

To fix this, convert external_scan_running to a pointer to the interface
that started the scan. If this interface is removed, also reset the
pointer to NULL so that other operations may continue on this radio.

Test:
  1. Start scan on wlan0
  2. Remove wlan0
  3. Can connect to a network on wlan1

Signed-off-by: David Su <dysu@google.com>
2021-02-02 23:48:14 +02:00
Abinaya Kalaiselvan
df0bfe4759 mesh: Fix for leaving mesh
Avoid multiple execution of wpa_drv_leave_mesh().

Fixes: 0896c442dc ("mesh: Fix for mesh init/deinit")
Signed-off-by: Abinaya Kalaiselvan <akalaise@codeaurora.org>
2021-02-02 22:58:49 +02:00
Ilan Peer
dccb6cde03 WPA: Support deriving KDK based on capabilities
Derive the KDK as part of PMK to PTK derivation if forced by
configuration or in case both the local station and the AP declare
support for secure LTF.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-26 23:09:39 +02:00
Ilan Peer
9e7b980d65 PASN: Include RSNXE in the PASN negotiation
IEEE P802.11az/D2.6 added definitions to include RSNXE in the PASN
negotiation. Implement the new functionality in both wpa_supplicant and
hostapd.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-26 23:09:36 +02:00
Ilan Peer
5c65ad6c0b PASN: Support PASN with FT key derivation
Add support for PASN authentication with FT key derivation:

- As IEEE P802.11az/D2.6 states that wrapped data is optional and
  is only needed for further validation of the FT security parameters,
  do not include them in the first PASN frame.

- PASN with FT key derivation requires knowledge of the PMK-R1 and
  PMK-R1-Name for the target AP. As the WPA state machine stores PMK-R1,
  etc. only for the currently associated AP, store the mapping of
  BSSID to R1KH-ID for each previous association, so the R1KH-ID
  could be used to derive PMK-R1 and PMK-R1-Name. Do so instead
  of storing the PMK-R1 to avoid maintaining keys that might not
  be used.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-26 17:38:30 +02:00
Ilan Peer
8c6d2e2527 PASN: Support PASN with FILS key derivation
As the PASN FILS authentication is only defined for FILS SK without PFS,
and to support PASN authentication with FILS, implement the PASN with
FILS processing as part of the PASN handling and not as part of the WPA
state machine.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 20:27:14 +02:00
Ilan Peer
a93ec28d10 PASN: Support PASN with SAE key derivation
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 20:27:14 +02:00
Ilan Peer
ad338cfe58 ctrl_iface: Add support for PASN authentication
Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 19:15:47 +02:00
Ilan Peer
363768c8ac PASN: Add support for PASN processing to wpa_supplicant
Add PASN implementation to wpa_supplicant

1. Add functions to initialize and clear PASN data.
2. Add functions to construct PASN Authentication frames.
3. Add function to process PASN Authentication frame.
4. Add function to handle PASN frame TX status.
5. Implement the station side flow processing for PASN.

The implementation is missing support for wrapped data and PMKSA
establishment for base AKMs, and only supports PASN authentication or
base AKM with PMKSA caching.

The missing parts will be added in later patches.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 19:15:44 +02:00
Ilan Peer
d70060f966 WPA: Add PTKSA cache to wpa_supplicant for PASN
PASN requires to store the PTK derived during PASN authentication
so it can later be used for secure LTF etc. This is also true
for a PTK derived during regular connection.

Add an instance of a PTKSA cache for each wpa_supplicant
interface when PASN is enabled in build configuration.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 18:36:40 +02:00
Ilan Peer
c6d1a33bb0 PASN: Add functions to compute PTK, MIC and hash
1. Add a function to derive the PTK from a PMK and additional data.
2. Add a function to calculate the MIC for a PASN frames.
3. Add a function to compute the hash of an authentication frame body.

The above are built only in case that CONFIG_PASN is enabled at build
time.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 18:36:40 +02:00
Ilan Peer
46c232eb76 WPA: Extend the wpa_pmk_to_ptk() function to also derive KDK
Extend the wpa_pmk_to_ptk() to also derive Key Derivation
Key (KDK), which can later be used for secure LTF measurements.

Update the wpa_supplicant and hostapd configuration and the
corresponding WPA and WPA Auth state machine, to allow enabling of KDK
derivation. For now, use a testing parameter to control whether KDK is
derived.

Signed-off-by: Ilan Peer <ilan.peer@intel.com>
2021-01-25 18:36:40 +02:00
Sreeramya Soratkal
833cdbe97d Add support for new 5 GHz channels 173 and 177
Add support for new channels 173 and 177 in the operating classes 125 to
130 as defined in draft IEEE P802.11ax/D8.0.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2021-01-22 19:18:10 +02:00
Purushottam Kushwaha
959af4f576 DPP: Abort authentication if no Auth Confirm is received within a second
After sending DPP Auth Response, the Responder might not receive the
Auth Confirm either due to the Initiator not sending it or the reception
of the frame failing for some reason (e.g., Responder having already
left the negotiation channel). If this happens, following initiation
attempts would fail since the consecutive Auth Request would get
discarded since the previous authentication is still in progress.

Terminate DPP authentication on Responder, if no Auth Confirm is
received within one second of successfully sending Auth Response. This
allows the Responder to accept start of a new exchange.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-01-22 19:18:10 +02:00
Sunil Dutt
62657365f8 Add a configuration to disconnect on deinit if WoWLAN is enabled
Commit 02c21c02d0 ("wpa_supplicant: Do not disconnect on deinit if
WoWLAN is enabled") prevents the disconnection on deinit if the driver
indicates that WoWLAN is enabled. This is not the expected behavior in
some earlier use cases where the wpa_supplicant process is left running
when going to sleep and killing of the wpa_supplicant process is used
only when there is an expectation of Wi-Fi connection being disabled.

To support the use cases which require the WLAN to disconnect on deinit
even if WoWLAN is enabled, introduce a configuration parameter
wowlan_disconnect_on_deinit. This is set to 0 by default thereby not
impacting the functionality in the above mentioned commit. Setting it to
1 restores the old behavior before the commit identified above.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-01-21 18:21:30 +02:00
Antonio Cardace
8f58972942 dbus: Export new 'suiteb192' capability
Export a new 'suiteb192' capability to indicate that wpa_supplicant was
built with WPA-EAP-SUITE-B-192 support and accepts
'key_mgmt=WPA-EAP-SUITE-B-192'.

Signed-off-by: Antonio Cardace <acardace@redhat.com>
2021-01-15 12:24:26 +02:00
Brian Norris
9cdcc88238 DBus: Add 'owe' to interface Capabilities
Signed-off-by: Brian Norris <briannorris@chromium.org>
2021-01-15 12:22:47 +02:00
Berkay Ercan
8e8406469e wpa_cli: Add WPS_EVENT_OVERLAP to action scripts
WPS_EVENT_OVERLAP case was missing on wpa_cli_action_process function in
wpa_cli.c, so when the overlap event occurs, there was no event message
sent to the action script. Add this event case to the function.

Signed-off-by: Berkay Ercan <berkay.ercan@airties.com>
Signed-off-by: Veli Demirel <veli.demirel@airties.com>
2021-01-15 12:18:37 +02:00
Shiva Sankar Gajula
71718b628b FT: Update key mgmt properly in RSNE during roaming
When STA is performing roam from WPA3 AP to WPA2 AP, the STA was
including key mgmt FT-SAE instead of FT-PSK in FT Authentication request
RSNE when using driver-based SME. This is because the RSNE/MDE/FTE were
updated and forwarded to the driver using the NL80211_CMD_UPDATE_FT_IES
command before updating key mgmt properly. Because of this, the AP is
rejecting FT Authentication request with WLAN_REASON_UNSPECIFIED reason
code which is due to the invalid keymgmt in RSNE.

Fix this by reordering IE population to happen earlier in the sequence
so that the updated key mgmt information can be provided when using
NL80211_CMD_UPDATE_FT_IES.

Signed-off-by: Shiva Sankar Gajula <sgajula@codeaurora.org>
2021-01-15 12:10:10 +02:00
Vinita S. Maloo
ea77568d8f Add user configured vendor IEs to default scan IEs
Add user configured vendor IEs for Probe Request frames to default scan
IEs so that these IEs will be included in the Probe Request frames for
the scans issued also by components other than wpa_supplicant.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2021-01-15 11:45:13 +02:00
Sunil Dutt
b6947f01a1 Android: Pass the vendor events to $(BOARD_WPA_SUPPLICANT_PRIVATE_LIB)
Android has a mechanism to extend the driver interface in vendor
specific ways. This implementation of the vendor interface is done in
$(BOARD_WPA_SUPPLICANT_PRIVATE_LIB). Extend this to allow the vendor
events to be provided to this library to facilitate the event
processing.

Introduce a new board configuration via
$(BOARD_WPA_SUPPLICANT_PRIVATE_LIB_EVENT) rather than reusing
$(BOARD_WPA_SUPPLICANT_PRIVATE_LIB) to enable this event handling in the
private library. This is to avoid compilation issues for
wpa_driver_nl80211_driver_event() with the already existing private
library implementations defined with
$(BOARD_WPA_SUPPLICANT_PRIVATE_LIB).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-21 23:22:56 +02:00
Purushottam Kushwaha
7b121af26a P2P: Delay P2P scan when an external scan is in progress
When an external scan is in progress on the same radio, delay the P2P
search operation based on configuration parameter p2p_search_delay. The
"search_delay" configuration done through p2p_find always takes
precedence over this delay value set due to an external scan trigger.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-21 23:22:51 +02:00
Sunil Dutt
f39d6aacbb P2P: Recover p2p_find operation in case of failure to fetch scan results
Add a handler to notify failures to fetch the scan results and provide
an option to override default behavior of requesting a new scan in one
second in such an error condition. Use this new handler mechanism to
continue the p2p_find operation (by invoking p2p_scan_res_handled) for
an interim scenario where the p2p_scan attempt fails to get the scan
results from the driver which can happen, e.g., if there are parallel
updates to the cfg80211 scan results.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-21 23:04:54 +02:00
Vamsi Krishna
084b3d2f8a Drop unexpected connection event while disconnected
If there is a disconnect command from wpa_supplicant immediately after
the driver sends a connection event to userspace but before that event
is received and processed by wpa_supplicant, wpa_supplicant processes
the disconnect command and a self-generated disconnected event first
followed by the connected event received from the driver. As a result
wpa_supplicant moves to the WPA_COMPLETED state.  Whereas the driver
processes the disconnect command received from wpa_supplicant after it
sends the connected event and moves to the disconnected state. Due to
this race between the disconnect command from wpa_supplicant and the
connected event from the driver, wpa_supplicant is moving to the
connected state though the driver is moving to the disconnected state
which results in abnormal functionality.

Ignore the connection event coming from the driver when wpa_supplicant
is not trying to connect after a disconnect command is issued but before
the next connect command is issued to fix the above mentioned race
condition.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-21 14:06:52 +02:00
Disha Das
b709bb40fd DPP2: Add DPP_CONTROLLER commands to hostapd_cli and wpa_cli
Add the DPP control interface DPP_CONTROLLER_START and
DPP_CONTROLLER_STOP commands to the CLIs.

Signed-off-by: Disha Das <dishad@codeaurora.org>
2020-12-16 18:04:15 +02:00
Jouni Malinen
6ead8b897f Use bool for is_6ghz variables and functions
Replace the implicit boolean checks that used int variables with use of
a more explicit bool variable type.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-12-11 19:56:14 +02:00
Veerendranath Jakkam
7131fede34 Extend the setband support for 6 GHz and band combinations
Support possible band combinations of 2.4 GHz, 5 GHz, and 6 GHz with
QCA_WLAN_VENDOR_ATTR_SETBAND_MASK attribute. Ensure backwards
compatibility with old drivers that are using
QCA_WLAN_VENDOR_ATTR_SETBAND_VALUE attribute and supporting only 2.4 GHz
and 5 GHz bands.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-12-11 19:56:14 +02:00
Veerendranath Jakkam
2a37cda747 scan: Add a helper function to append supported freqs from a given band
This functionality was repeated for couple of times. Use a shared helper
function to avoid code duplication.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-12-11 16:47:43 +02:00
Avraham Stern
297050b460 nl80211: Report invalid signal and noise when info is unavailable
When the driver sends a CQM RSSI threshold event, wpa_supplicant queries
the driver for the signal and noise values. However, it is possible that
by that time the station has already disconnected from the AP, so these
values are no longer valid. In this case, indicate that these values are
invalid by setting them to WPA_INVALID_NOISE.

Previously a value of 0 would be reported, which may be confusing as
this is a valid value.

Since nl80211_get_link_signal() and nl80211_get_link_noise() already set
invalid values for a case of failure, just use the value set by these
functions even if they fail.

Signed-off-by: Avraham Stern <avraham.stern@intel.com>
Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
Reviewed-by: Brian Norris <briannorris@chromium.org>
2020-12-04 12:42:15 +02:00
Frederik Juul
f2a0101401 wpa_supplicant: Initial connection speedup
Add initial_freq_list to wpa_supplicant configuration. This option
allows wpa_supplicant to scan a smaller list of frequencies when it
starts. This in turn allows for a faster connection to an already known
network. This limit applies only for the initial scan operation and does
not restrict other channels from being used in consecutive scans.

Tests have shown this to reduce the amount of time for connecting to a
network from roughly 3 seconds to roughly 0.1 second.

Signed-off-by: Frederik Juul <frederik.juul@3shape.com>
2020-12-02 17:05:07 +02:00
Markus Theil
89ad24379d mesh: Move mesh frequency setting to its own function
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-12-01 00:44:38 +02:00
Markus Theil
7c2cad969a mesh: Fix DFS deinit/init
The hostapd DFS code deinitializes and initializes the AP interface, if
a clean channel switch is not possible. In this case the AP code paths
would deinit the driver, for example nl80211, without wpa_supplicant
code paths getting notice of this.

Therefore add callbacks for wpa_supplicant mesh methods, which are
called on init/deinit of the AP BSS. These callbacks are then used to
handle the reset in the mesh code.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-12-01 00:31:56 +02:00
Markus Theil
0896c442dc mesh: Fix for mesh init/deinit
Send mesh group started notification after join completion
callback is called.

Implement outstanding TODO, to leave the mesh network on deinit.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-12-01 00:23:15 +02:00
Markus Theil
06161d4f10 mesh: Fix mesh_oom test
Only change freq params, if ifmsh->freq is set initially, which only
happens if hostapd_get_hw_features in setup_interface2 succeeds.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-12-01 00:22:59 +02:00
Peter Oh
12ae3e3dba mesh: Inform kernel driver about DFS handler in userspace
The kernel requires indication of DFS handler residing in user space
(NL80211_ATTR_HANDLE_DFS) to enable DFS channels.

Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
2020-12-01 00:14:07 +02:00
Peter Oh
a27faf2c9a mesh: Fix channel switch error during CAC
Mesh interface would have used its channel parameters that were
configured during initialization even after channel switch due to DFS
radar detection during CAC which could result in a channel switch error.
Fix the error by updating the channel parameters when channel has been
changed from the initial one.

Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
2020-12-01 00:09:22 +02:00
Peter Oh
e3608040c4 mesh: Update ssid->frequency as pri/sec channels switch
ssid->frequency is one of the variables used to get the channel number
from a given frequency. Leaving it as unchanged when pri/sec channel
switch will cause picking up a wrong channel number after applying the
secondary channel offset for HT40 and leads to failing interface
bring-up.

Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
2020-11-30 12:01:39 +02:00
Peter Oh
f1df4fbfc7 mesh: Use setup completion callback to complete mesh join
Mesh join function is the last function to be called during mesh join
process, but it's been called a bit earlier than it's supposed to be, so
that some mesh parameter values such as VHT capabilities were not
applied correct when mesh join is in process. Moreover, the current
design of mesh join that is called directly after mesh initialization
isn't suitable for DFS channels to use, since mesh join process should
be paused until DFS CAC is done and resumed after it's done.

The callback will be called by hostapd_setup_interface_complete_sync().
There is a possibility that completing mesh init fails, so add error
handling codes for that.

Signed-off-by: Peter Oh <peter.oh@bowerswilkins.com>
2020-11-30 11:57:37 +02:00
Sreeramya Soratkal
ed24bad1d9 AP: Check driver support while auto-selecting bandwidth for AP/P2P GO
If the maximum operating channel width for AP/P2P GO is not specified,
it is auto-selected during configuration. While selecting the channel
width, if VHT is supported and 160 MHz channels are available, 160 MHz
channel width is preferred to 80 MHz.

During the selection of the channel width, the corresponding driver
capabilities were not checked. As a result, the AP/P2P GO configuration
was set to use the available 160 MHz channels even if the driver did not
have capability to support the 160 MHz channel width causing failure to
start the AP/P2P GO.

Fix this by checking the driver support for the 160 MHz channel width
while selecting the channel width for AP/P2P GO.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-11-23 20:45:31 +02:00
Jouni Malinen
1c77f3d3f9 Indicate whether additional ANQP elements were protected
Store information on whether extra ANQP elements were received using the
protection alternative (protected GAS during an association using PMF)
and make this available through the control interface BSS command.

For example:
anqp[277]=<hexdump>
protected-anqp-info[277]=1

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-23 20:32:26 +02:00
Jouni Malinen
454ebb504c BSS: Use variable length array for IEs at the end of struct wpa_bss
Replace the previously used design "(u8 *) (bss + 1)" with a variable
length array at the end of struct wpa_bss bss->ies[] in hopes of making
this easier to understand for static analyzers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-16 16:25:17 +02:00
Jouni Malinen
be7ee264f6 BSS: Use wrapper function for getting a pointer to the IE buffer
This makes it easier to change the internal struct wpa_bss design for
storing the variable length IE buffers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-16 16:21:56 +02:00
Jouni Malinen
95edd81441 BSS: Add wpa_bss_get_ie_ext() wrapper
This removes need from the callers to know the struct wpa_bss details
for the location of the memory area for storing the IEs.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-16 16:00:21 +02:00
Jouni Malinen
dba4f7a545 Mark wpa_bss_get_fils_cache_id() argument const
This function does not modify the BSS entry.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-16 15:52:22 +02:00
Rohan Dutta
fdf114641f nl80211: Send the sae_pwe value to the driver
Use NL80211_ATTR_SAE_PWE attribute to indicate the sae_pwe value
to the driver during the NL80211_CMD_START_AP and NL80211_CMD_CONNECT
in WPA3-Personal networks which are using SAE authentication.

Signed-off-by: Rohan Dutta <drohan@codeaurora.org>
2020-11-16 15:50:44 +02:00
Sreeramya Soratkal
2ffd3bb4b6 P2P: Include p2p_6ghz_disable in global configuration
Previously, the configuration to disable the 6 GHz band remained local
to the P2P interface. With this there is a possibility of 6 GHz channels
being included in the channel list when the channel list needs to be
updated if the state changes on one of the interfaces.

Include the configuration to disable the 6 GHz band for P2P as a global
configuration value to prevent the inclusion of 6 GHz channels in the
channel list for P2P when the channel list needs to be updated during
the state change in one of the interfaces.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-11-16 13:15:28 +02:00
Vinita S. Maloo
60c902f408 Add connect fail reason code from the driver to assoc reject event
Add support to report a vendor specific connect fail reason code fetched
from the driver to users by adding the reason code to the event
CTRL-EVENT-ASSOC-REJECT. Fetch the connect fail reason code when the
driver sends a failure connection result and append the reason code, if
available, to assoc reject event.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-16 13:15:28 +02:00
Vinita S. Maloo
c2c4686228 Set NLA_F_NESTED flag with NL80211_ATTR_VENDOR_DATA conditionally
The newer kernel versions enforce strict netlink attribute policy
validation and will cause cfg80211 to reject vendor commands with
NL80211_ATTR_VENDOR_DATA if NLA_F_NESTED attribute is not set but
if the vendor command is expecting nested data within
NL80211_ATTR_VENDOR_DATA attribute.

Most of the earlier instances were addressed by adding NLA_F_NESTED
flag in nla_nest_start(). This commit addresses the remaining
instance in which NL80211_ATTR_VENDOR_DATA is populated using data
set by user through the control interface.

Enhance the control interface VENDOR command to indicate whether the
vendor subcommand uses nested attributes within NL80211_ATTR_VENDOR_DATA
attribute or not.

Set NLA_F_NESTED flag for existing QCA vendor commands which use nested
attributes within the NL80211_ATTR_VENDOR_DATA attributes so that the
old frameworks implementations for already existing commands work
without any issues.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-10 23:48:00 +02:00
Jouni Malinen
f4de21a77a BSS/scan: More conversions to for_each_element_id()
Use the common IE parsing routine in hope of trying to make the length
checks easier for static analyzers. In addition, try to make the
*_vendor_ie_multi() cases easier to analyze as well even though they
cannot use for_each_element_id().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-04 19:50:34 +02:00
Jouni Malinen
aa06444f2c dbus: Check eloop registration failure in add_watch handler
Report failures at lower layer to the upper layer D-Bus handling of
socket registration to allow failures to be addressed more cleanly.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-04 19:39:08 +02:00
Jouni Malinen
56a1df71e5 BSS: Convert wpa_bss_get_vendor_ie() to use for_each_element_id()
Use the common IE parsing routine in hope of trying to make the length
checks easier for static analyzers.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-03 21:10:01 +02:00
Jouni Malinen
ec0d99c00e HS 2.0: Clarify OSU Friendly Name length validation
This extends the changes in commit 0570a3ea7d ("HS 2.0: Clarify OSU
Provider list length validation") to cover the length field for the OSU
Friendly Name value to try to get this easier for static analyzers to
understand.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-03 21:03:30 +02:00
Jouni Malinen
f724dd1bfd Remove unused variable update
Commit e8b85c078e ("iface match: Unspecified matched interfaces should
not log driver fails") removed the only use of the added interface wpa_s
pointer, but left that pointer setting in place. Remove it to keep
static analyzers happy.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-11-02 16:36:14 +02:00
Veerendranath Jakkam
79e3f08d3c 6 GHz: Add support for missing 6 GHz operating classes
Add support for missing 6 GHz operating classes as defined in
IEEE P802.11ax/D7.0.

This is needed to avoid OCV failures on the 6 GHz band when the channel
width is larger than 20 MHz.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-10-30 22:52:47 +02:00
Sreeramya Soratkal
c575904761 P2P: Consider BSS entry pending for P2P joining as a known BSS
Consider the BSS entry that is pending for the P2P group join operation
also as a known network along with the existing configured networks.
This prevents removal of the BSS entry that is still in the process of
P2P join operation from the BSS table when the number of entries exceed
bss_max_count.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-10-26 22:39:42 +02:00
Sreeramya Soratkal
9c39c1a6d3 P2P: Include p2p_add_cli_chan parameter while cloning the configuration
The dynamically created P2P group interface did not consider the
channels that can be used by the P2P client during the P2P group
formation. Copy the p2p_add_cli_chan parameter while cloning the
configuration to the P2P group interface. This allows the dynamically
created group interface case to form the group in the specific
client-only channels when the device is a P2P client in the group.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-10-22 23:51:54 +03:00
Jouni Malinen
5d988b4a5b Fix couple more typos
Couple of similar cases that were not included in the previous commit.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-20 00:37:01 +03:00
Yegor Yefremov
b439b21a2f wpa_supplicant: Fix typos
Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2020-10-20 00:37:01 +03:00
Andrei Otcheretianski
b4c7114cf5 wpa_supplicant: Remove unfeasible conditions in config parsing
pos can't be NULL in wpa_global_config_parse_str(), so there is no point
checking this, especially when pos was already dereferenced earlier.
Remove the redundant conditions.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2020-10-19 23:05:33 +03:00
Andrei Otcheretianski
ff7e0c1cf7 wpa_cli: Don't access uninitialized variables
Don't print potentially uninitialized variables in wpa_ctrl_command_bss().
Some compilers and analyzers may warn about it.

Signed-off-by: Andrei Otcheretianski <andrei.otcheretianski@intel.com>
2020-10-19 23:01:11 +03:00
Markus Theil
d34b33451c wpa_supplicant: Fix frequency config for VHT/HE cases
Fix compilation without CONFIG_P2P and only set secondary channel seg
idx if we use a mode supporting a sec channel for VHT/HE.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-16 12:50:17 +03:00
Jouni Malinen
0747432efd Fix spelling of "unexpected" in messages
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-16 12:45:26 +03:00
Vamsi Krishna
0f7989d8af MSCS: Fix decapsulating subelements from MSCS descriptor
Fix pointer sent for decapsulating subelements from MSCS descriptor
IE while processing (re)association response frames.

Fixes: af8ab3208d ("MSCS: Parse result of MSCS setup in (Re)Association Response frames")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-14 23:09:13 +03:00
Markus Theil
5965c7da5d wpa_supplicant: Enable VHT and HE in default config parameters
Enable VHT and HE as default config parameters in order for
wpa_supplicant AP mode to use it, if hw support is given.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-14 13:05:11 +03:00
Markus Theil
df6745e8c8 wpa_supplicant: Handle HT40 and mode downgrade in AP mode
Add some missing pieces to the interface configuration of AP/mesh mode
in wpa_supplicant.
 - check for secondary channel and HT40 capability
 - try to downgrade to IEEE 802.11b if 802.11g is not available
Especially with the HT40 check, this code now performs all settings,
which the deleted/duplicated mesh code did.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-14 12:49:28 +03:00
Markus Theil
93da12fd9f mesh: Fix channel init order, disable pri/sec channel switch
wpa_supplicant_conf_ap_ht() has to happen before
hostapd_setup_interface() in order for its configuration settings to
have effect on interface configuration.

Disable primary and secondary channel switch because of missing tie
breaking rule/frames in mesh networks. A rather long comment about
this issue is placed in mesh.c in the corresponding place.

I was not able to reproduce the memory corruption during
mesh_secure_ocv_mix_legacy, which lead to a revert of a similar patch in
the past.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-14 12:44:15 +03:00
Markus Theil
7f8ac02e85 HE/VHT: Fix frequency setup with HE enabled
Some places in the code base were not using the wrappers like
hostapd_set_oper_centr_freq_seg0_idx and friends. This could lead to
errors, for example when joining 80 MHz mesh networks. Fix this, by
enforcing usage of these wrappers.

wpa_supplicant_conf_ap_ht() now checks for HE capability before dealing
with VHT in order for these wrappers to work, as they first check HE
support in the config.

While doing these changes, I've noticed that the extra channel setup
code for mesh networks in wpa_supplicant/mesh.c should not be necessary
anymore and dropped it. wpa_supplicant_conf_ap_ht() should handle this
setup already.

Acked-by: John Crispin <john@phrozen.org>
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-14 12:44:09 +03:00
Jouni Malinen
99d7bf2348 DPP2: Use the new privacy protection key to protect E-id on Enrollee
Use ppKey instead of C-sign-key to encrypted E-id to E'-id into Reconfig
Announcement frame on the Enrollee side.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-13 23:38:47 +03:00
Jouni Malinen
37df40845a DPP2: Copy received ppKey into wpa_supplicant network profile
Store the received privacy protection key from Connector into
wpa_supplicant network profile and indicate it through the control
interface similarly to C-sign-key.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-13 23:38:47 +03:00
Udhayakumar Mahendiran
6c41d43f1a mesh: Stop SAE auth timer when mesh node is removed
Not doing this could cause wpa_supplicant to crash.

Signed-off-by: Udhayakumar Mahendiran <udhayakumar@qubercomm.com>
2020-10-12 20:16:12 +03:00
Wystan Schmidt
e3b47cdf86 DPP2: Add DPP_CHIRP commands to hostapd_cli and wpa_cli
Add the DPP control interface chirp commands to the CLIs for greater
visibility and ease of use.

Signed-off-by: Wystan Schmidt <wystan.schmidt@charter.com>
2020-10-11 20:26:21 +03:00
Jimmy Chen
cb3b709367 P2P: Set ap_configured_cb during group reform process
We found that if REMOVE-AND-REFORM occurs before a group is started,
it would not send out GROUP-STARTED-EVENT after AP is enabled.

In the remove-and-reform process, ap_configured_cb is cleared. If a
group is not started, p2p_go_configured() will not be called after
completing AP setup. Fix this by preserving the callback parameters.

Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
2020-10-11 20:08:37 +03:00
Jimmy Chen
0e9f62e514 P2P: Fallback to GO negotiation after running out of GO scan attempts
We found a problem that p2p_fallback_to_go_neg is not handled correctly
after running out of GO scan attempts. When autojoin is enabled and a
group is found in old scan results, supplicant would try to scan the
group several times. If the group is still not found, it reports group
formation failure while p2p_fallback_to_go_neg is enabled already.

If p2p_fallback_to_go_neg is enabled, it should fallback to GO
negotiation, but not report group formation failure after running out of
GO scan attempts.

Signed-off-by: Jimmy Chen <jimmycmchen@google.com>
2020-10-11 20:00:57 +03:00
Andrew Beltrano
7e4ed93d36 wpa_cli: Add dpp_bootstrap_set command
Expose DPP_BOOTSTRAP_SET through wpa_cli command dpp_bootstrap_set <id>
<configurator params..>

Signed-off-by: Andrew Beltrano <anbeltra@microsoft.com>
2020-10-11 19:47:08 +03:00
Johannes Berg
283eee8eed gitignore: Clean up a bit
Now that we no longer leave build artifacts outside the build folder, we
can clean up the gitignore a bit. Also move more things to per-folder
files that we mostly had already anyway.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-11 19:32:50 +03:00
Markus Theil
ae0b90dfa4 mesh: Allow channel switch command
Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-11 11:24:14 +03:00
Brian Norris
4b96fafcd8 D-Bus: Share 'remove all networks' with CLI
The D-Bus implementation of RemoveAllNetworks differs wildly from the
CLI implementation. Let's share the implementations.

This resolves use-after-free bugs I noticed, where we continue to use
the 'wpa_s->current_ssid' wpa_ssid object after freeing it, because we
didn't bother to disconnect from (and set to NULL) current_ssid before
freeing it.

Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 20:39:00 +03:00
Georg Müller
2818e9ca90 wpa_supplicant: Do not retry scan if operation is not supported
When using NetworkManager to set up an access point, there seems to be a
race condition which can lead to a new log message every second.

The following message appears in AP mode:

    CTRL-EVENT-SCAN-FAILED ret=-95 retry=1

Normally, this log message only appears once. But then (and only then)
the race is triggered and they appear every second, the following log
messages are also present:

    Reject scan trigger since one is already pending
    Failed to initiate AP scan

This patch just disables the retry for requests where the operation is
not supported anyway.

Signed-off-by: Georg Müller <georgmueller@gmx.net>
2020-10-10 20:26:18 +03:00
Benjamin Berg
c0b88d1291 P2P: Limit P2P_DEVICE name to appropriate ifname size
Otherwise the WPA_IF_P2P_DEVICE cannot be created if the base ifname is
long enough. As this is not a netdev device, it is acceptable if the
name is not completely unique. As such, simply insert a NUL byte at the
appropriate place.

Signed-off-by: Benjamin Berg <bberg@redhat.com>
2020-10-10 20:24:55 +03:00
Markus Theil
566ea1b7ce mesh: Set correct address for mesh default broadcast/multicast keys
wpa_drv_set_key() was called with a NULL address for IGTK and MGTK
before this patch. The nl80211 driver will then not add the
NL80211_KEY_DEFAULT_TYPE_MULTICAST flag for the key, which wrongly marks
this key also as a default unicast key in the Linux kernel.

With SAE this is no real problem in practice, as a pairwise key will be
negotiated in mesh mode, before the first data frame gets send. When
using IEEE 802.1X in a mesh network in the future, this gets a problem,
as Linux now will encrypt EAPOL frames with the default key, which is
also marked for unicast usage without this patch.

Signed-off-by: Markus Theil <markus.theil@tu-ilmenau.de>
2020-10-10 20:19:09 +03:00
Brian Norris
17d6ba4c9e DBus: Add "Roam" command support
Add D-Bus interface for ROAM command, imitating the existing wpa_cli
command.

Chromium OS has been carrying a form of this patch for a very long time.
I've cleaned it up a bit and documented it.

Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 19:59:17 +03:00
Jouni Malinen
6e757bba8a Use consistent spelling of "homogeneous"
The 'H' in HESSID was originally spelled "homogenous" in IEEE Std
802.11-2016 abbreviations and acronyms list, but that was changed in
REVmd to the significantly more common spelling "homonegeneous". Update
this older version to match the new spelling to be consistent throughout
the repository.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-10-10 18:34:59 +03:00
Kevin Lund
cff545720e wpa_supplicant: Clear blacklist when SSID configs change
If the stored configurations for an SSID have changed, we can no longer
trust the current blacklist state of that SSID, since the updated
configs could change the behavior of the network. E.g., the BSS could be
blacklisted due to a bad password, and the config could be updated to
store the correct password. In this case, keeping the BSS in the
blacklist will prevent the user from connecting to the BSS after the
correct password has been updated.

Add the value was_changed_recently to the wpa_ssid struct. Update this
value every time a config is changed through wpa_set_config(). Check
this value in wpa_blacklist_get() to clear the blacklist whenever the
configs of current_ssid have changed.

This solution was chosen over simply clearing the blacklist whenever
configs change because the user should be able to change configs on an
inactive SSID without affecting the blacklist for the currently active
SSID. This way, the blacklist won't be cleared until the user attempts
to connect to the inactive network again. Furthermore, the blacklist is
stored per-BSSID while configs are stored per-SSID, so we don't have the
option to just clear out certain blacklist entries that would be
affected by the configs.

Finally, the function wpa_supplicant_reload_configuration() causes the
configs to be reloaded from scratch, so after a call to this function
all bets are off as to the relevance of our current blacklist state.
Thus, we clear the entire blacklist within this function.

Signed-off-by: Kevin Lund <kglund@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 18:34:59 +03:00
Kevin Lund
bbbb3c04ef wpa_supplicant: Add new blacklist tests
This change adds some barebones tests for new blacklisting functionality
to wpas_module_tests.c. The tests ensure some basic functionality for
the functions wpa_blacklist_is_blacklisted() and wpa_blacklist_update().

Signed-off-by: Kevin Lund <kglund@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 18:34:59 +03:00
Kevin Lund
164b8dd8e4 wpa_supplicant: Add wpa_blacklist_update()
This change adds the function wpa_blacklist_update(), which goes through
all blacklist entries and deletes them if their blacklist expired over
an hour ago. The purpose of this is to remove stale entries from the
blacklist which likely do not reflect the current condition of device's
network surroundings. This function is called whenever the blacklist is
polled, meaning that the caller always gets an up-to-date reflection of
the blacklist.

Another solution to clearing the blacklist that was considered was
to slowly reduce the counts of blacklist entries over time, and delete
them if the counts dropped below 0. We decided to go with the current
solution instead because an AP's "problematic" status is really a binary
thing: either the AP is no longer problematic, or it's still causing us
problems. So if we see any more problems within a reasonable amount of
time, it makes sense to just keep the blacklist where it was since the
AP is likely still undergoing the same issue. If we go a significant
amount of time (semi-arbitrarily chosen as 1 hour) without any issues
with an AP, it's reasonable to behave as if the AP is no longer
undergoing the same issue. If we see more problems at a later time, we
can start the blacklisting process fresh again, treating this as a brand
new issue.

Signed-off-by: Kevin Lund <kglund@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 18:34:59 +03:00
Kevin Lund
d530110028 wpa_supplicant: Implement time-based blacklisting
wpa_supplicant keeps a blacklist of BSSs in order to prevent repeated
associations to problematic APs*. Currently, this blacklist is
completely cleared whenever we successfully connect to any AP. This
causes problematic behavior when in the presence of both a bad AP and
a good AP. The device can repeatedly attempt to roam to the bad AP
because it is clearing the blacklist every time it connects to the good
AP. This results in the connection constantly ping-ponging between the
APs, leaving the user stuck without connection.

Instead of clearing the blacklist, implement timeout functionality which
allows association attempts to blacklisted APs after some time has
passed. Each time a BSS would be added to the blacklist, increase the
duration of this timeout exponentially, up to a cap of 1800 seconds.
This means that the device will no longer be able to immediately attempt
to roam back to a bad AP whenever it successfully connects to any other
AP.

Other details:
The algorithm for building up the blacklist count and timeout duration
on a given AP has been designed to be minimally obtrusive. Starting with
a fresh blacklist, the device may attempt to connect to a problematic AP
no more than 6 times in any ~45 minute period. Once an AP has reached a
blacklist count >= 6, the device may attempt to connect to it no more
than once every 30 minutes. The goal of these limits is to find an
ideal balance between minimizing connection attempts to bad APs while
still trying them out occasionally to see if the problems have stopped.

The only exception to the above limits is that the blacklist is still
completely cleared whenever there are no APs available in a scan. This
means that if all nearby APs have been blacklisted, all APs will be
completely exonerated regardless of their blacklist counts or how close
their blacklist entries are to expiring. When all nearby APs have been
blacklisted we know that every nearby AP is in some way problematic.
Once we know that every AP is causing problems, it doesn't really make
sense to sort them beyond that because the blacklist count and timeout
duration don't necessarily reflect the degree to which an AP is
problematic (i.e. they can be manipulated by external factors such as
the user physically moving around). Instead, its best to restart the
blacklist and let the normal roaming algorithm take over to maximize
our chance of getting the best possible connection quality.

As stated above, the time-based blacklisting algorithm is designed to
be minimally obtrusive to user experience, so occasionally restarting
the process is not too impactful on the user.

*problematic AP: rejects new clients, frequently de-auths clients, very
poor connection quality, etc.

Signed-off-by: Kevin Lund <kglund@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 18:34:59 +03:00
Kevin Lund
2fd35d9857 wpa_supplicant: Track consecutive connection failures
Within wpas_connection_failed(), the 'count' value of wpa_blacklist is
erroneously used as a tally of the number times the device has failed
to associate to a given BSSID without making a successful connection.
This is not accurate because there are a variety of ways a BSS can be
added to the blacklist beyond failed association such as interference
or deauthentication. This 'count' is lost whenever the blacklist is
cleared, so the wpa_supplicant stores an additional value
'extra_blacklist_count' which helps persist the 'count' through clears.
These count values are used to determine how long to wait to rescan
after a failed connection attempt.

While this logic was already slightly wrong, it would have been
completely broken by the upcoming change which adds time-based
blacklisting functionality. With the upcoming change, 'count' values
are not cleared on association, and thus do not necessarily even
approximate the "consecutive connection failures" which they were being
used for.

This change seeks to remove this unnecessary overloading of the
blacklist 'count' by directly tracking consecutive connection failures
within the wpa_supplicant struct, independent of the blacklist. This new
'consecutive_conn_failures' is iterated with every connection failure
and cleared when any successful connection is made. This change also
removes the now unused 'extra_blacklist_count' value.

Signed-off-by: Kevin Lund <kglund@google.com>
Signed-off-by: Brian Norris <briannorris@chromium.org>
2020-10-10 18:34:59 +03:00
Yogesh Kulkarni
6d6310701b Fix STA mode default TXOP Limit values for AC_VI and AC_VO
commit f4e3860f ("Fix AP mode default TXOP Limit values for AC_VI
and AC_VO") corrects the default values of txop_limit from 93/46
to 94/47 for AP. STA would also need the same change.

Signed-off-by: Yogesh Kulkarni <yogesh.kulkarni@nxp.com>
Signed-off-by: Cathy Luo <xiaohua.luo@nxp.com>
Signed-off-by: Ganapathi Bhat <ganapathi.bhat@nxp.com>
2020-10-10 17:04:27 +03:00
Johannes Berg
dcc5288e5b gitignore: Add various things
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 13:06:53 +03:00
Johannes Berg
ad6e4a5c59 build: Remove hostapd vs. wpa_supplicant build checks
These are no longer needed now. Note that this was never actually
sufficient since src/drivers/ isn't the only thing shared, and thus a
cross-build detection didn't work in all cases.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:53:38 +03:00
Johannes Berg
6acda53222 build: Add .config file to dependencies
If the .config file changes, basically everything needs to be
rebuilt since we don't try to detect which symbols changed or
such. Now that the .config file handling is in the common
build system, make everything depend on it if there's one.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:52:58 +03:00
Johannes Berg
722138cd25 build: Put object files into build/ folder
Instead of building in the source tree, put most object
files into the build/ folder at the root, and put each
thing that's being built into a separate folder.

This then allows us to build hostapd and wpa_supplicant
(or other combinations) without "make clean" inbetween.

For the tests keep the objects in place for now (and to
do that, add the build rule) so that we don't have to
rewrite all of that with $(call BUILDOBJS,...) which is
just noise there.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:51:39 +03:00
Johannes Berg
0464d5d5d6 build: Move config file handling into build.rules
This will make it easier to split out the handling in
a proper way, and handle common cflags/dependencies.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:49:31 +03:00
Johannes Berg
0430bc8267 build: Add a common-clean target
Clean up in a more common fashion as well, initially for ../src/.

Also add $(Q) to the clean target in src/

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:48:41 +03:00
Johannes Berg
a41a29192e build: Pull common fragments into a build.rules file
Some things are used by most of the binaries, pull them
into a common rule fragment that we can use properly.

Signed-off-by: Johannes Berg <johannes.berg@intel.com>
2020-10-10 12:47:29 +03:00
Roy Marples
e8b85c078e iface match: Unspecified matched interfaces should not log driver fails
If there is no matching interface given, but interface matching is
enabled, all interfaces on the system will try to be initialized. Non
wireless interfaces will fail and the loopback device will be one of
these, so just log a diagnostic rather than an error.

Signed-off-by: Roy Marples <roy@marples.name>
2020-10-09 16:50:36 +03:00
Roy Marples
83fa0a1004 op_classes: Don't report an error when there are none to add
Instead, log a diagnostic so that noise to the user is reduced. This is
expected behavior with driver interfaces that do not report supported
operating modes/classes.

Signed-off-by: Roy Marples <roy@marples.name>
2020-10-09 16:50:36 +03:00
Matthew Wang
41d20df7f3 D-Bus: Allow empty string in dbus network properties
This is needed for clearing previously set parameters in a similar
manner that was already available through the control interface
SET_NETWORK command.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-10-09 16:50:36 +03:00
Matthew Wang
4756ecabcf Allow bgscan parameters to be reconfigured
Teach wpa_supplicant to {de,}initialize bgscans when bgscan parameters
are set after initial connection.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-10-09 16:50:36 +03:00
Matthew Wang
922fa09972 Global parser functions to return 1 when property unchanged
Currently, wpa_config_set(), the function that sets wpa_supplicant
per-network properties, returns 1 when a property it attempts to set is
unchanged. Its global parallel, wpa_config_process_global(), doesn't do
this even though much of the code is very similar. Change this, and
several of the parser functions, to resemble the per-network parser and
setter functions.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-10-09 16:50:36 +03:00
Matthew Wang
a87173b1d1 D-Bus: Skip property update actions when wpa_config_set() returns 1
When network properties are updated via dbus, wpa_config_set() is used
to update the property in the wpa_ssid struct. If it returns 1, the
property was not changed and there's no need to perform any of the
update actions.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-10-09 15:31:05 +03:00
Beniamino Galvani
1c58317f56 D-Bus: Allow changing an interface bridge via D-Bus
D-Bus clients can call CreateInterface() once and use the resulting
Interface object to connect multiple times to different networks.

However, if the network interface gets added to a bridge, clients
currently have to remove the Interface object and create a new one.

Improve this by supporting the change of the BridgeIfname property of
an existing Interface object.

Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
2020-10-09 15:18:10 +03:00
Sreeramya Soratkal
14318ccff5 P2P: Add configuration support to disable P2P in 6 GHz band
Add a new configuration parameter p2p_6ghz_disable=1 to disable P2P
operation in the 6 GHz band. This avoids additional delays caused by
scanning 6 GHz channels in p2p_find and p2p_join operations in the cases
where user doesn't want P2P connection in the 6 GHz band.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-10-08 23:29:22 +03:00
Andrew Beltrano
0e8d569d47 DPP2: Presence Announcement notification in STA
Generate a control interface event upon receipt of DPP Presence
Announcement frames. This allows external programs to instrument
wpa_supplicant with bootstrapping information on-demand.

Signed-off-by: Andrew Beltrano <anbeltra@microsoft.com>
2020-10-07 21:23:05 +03:00
Yegor Yefremov
a8f304228d Document the missing ignore_broadcast_ssid network profile parameter
Copy parameter description from hostapd.conf.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2020-10-07 20:53:20 +03:00
Yegor Yefremov
aa704020a3 DBus: Update dont_quote[] with ignore_broadcast_ssid parameter
ignore_broadcast_ssid is supported when using with the config
file. But it generates an error if you try to set it via the
DBus interface.

Signed-off-by: Yegor Yefremov <yegorslists@googlemail.com>
2020-10-07 20:51:22 +03:00
Disha Das
8e5739c3ac DPP2: Check channel 6 validity before adding it to chirp channel list
Check if the 2.4 GHz channel 6 is in the list of available channels
advertised by the driver before adding in to the chirping frequency
list. This fixes issues, e.g., with a 5 GHz only interface.

Signed-off-by: Disha Das <dishad@codeaurora.org>
2020-10-06 23:44:06 +03:00
Jouni Malinen
43ef227e90 P2P: Make use wpas_p2p_reconsider_moving_go timeout gets canceled
The per-interface P2P data freeing function did not cover this eloop
timeout that could potentially have been registered. Explicitly cancel
this timeout to make sure no references to freed memory can remain in
such a case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-10-01 15:48:05 +03:00
Veerendranath Jakkam
57536a5678 P2P: Fix P2P interface remuval through wpa_supplicant_remove_iface()
wpa_supplicant_remove_iface() removes the P2P management interface from
the global interfaces list before calling wpa_supplicant_deinit_iface().
When wpas_p2p_group_remove() is called from
wpa_supplicant_deinit_iface(), the P2P group created on the calling
wpa_s was not getting cleared as the calling wpa_s is not in the list of
global->ifaces. This results in the P2P management interface being
removed without disconnecting the p2p_group created on it. This could
result in an illegal access of freed memory, e.g., when a pending eloop
task wpas_p2p_reconsider_moving_go() was triggered with the leftover ctx
pointer to the removed P2P interface instance.

Fix this by disconnecting the P2P group created on interface to be
deinitialized before deinitializing the interface.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-10-01 15:48:05 +03:00
Sreeramya Soratkal
760d10cdea P2P: Include channels 149 to 161 for operating classes 128 and 130
With the configuration defined in the global_op_class array, the
channels starting from 149 in the operating classes 128 and 130 were not
considered for P2P channel setup due to the non-continuous
incrementation of channel indexes. The other channels in these operating
classes were considered. Handle the channels from 149 to 161 in the
operating classes 128 and 130 for P2P channel setup by handling this
jump in the channel number incrementation.

Signed-off-by: Sreeramya Soratkal <ssramya@codeaurora.org>
2020-10-01 15:47:56 +03:00
Jouni Malinen
e8a1e6a4a1 P2P: Fix a typo in a comment
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-09-30 10:14:33 +03:00
Jouni Malinen
90e478aa0a DPP2: Use the PFS fallback if multiple key_mgmt values are enabled
Previously this fallback from PFS enabled to disabled (and back to
enabled) was used only if the local network profile used key_mgmt=DPP,
i.e., did not enable another other AKM. That leaves out some valid cases
since the local network profile could actually enable both DPP and SAE.
Extend this check to accept cases DPP AKM is enabled and it was selected
for the connection even if there other enabled AKMs.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-09-23 23:06:55 +03:00
Veerendranath Jakkam
5ecb45a41c OCV: Use more granular error codes for OCI validation failures
Enhance the return values of ocv_verify_tx_params with enum to indicate
different OCI verification failures to caller.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-09-11 15:23:28 +03:00
Veerendranath Jakkam
93a73ce028 MSCS: Fix issues due to incorrect usage of wpa_hexdump_buf()
Previously wpabuf_head() of the buffer is passed to wpa_hexdump_buf()
instead of the wpabuf struct itself and it was causing wpa_supplicant to
crash. Fix this by using the correct pointer in the debug prints.

Fixes: a118047245 ("MSCS: Add support to send MSCS Request frames")
Fixes: c504ff5398 ("MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq")
Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-09-08 19:38:35 +03:00
Jouni Malinen
c043b1e000 DPP: Remove unnecessary dpp_global_config parameters
These were not really used anymore since the AP/Relay case did not set
msg_ctx or process_conf_obj in the global DPP context. Get the
appropriate pointers more directly from the more specific data
structures instead and remove these global values.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-25 16:02:29 +03:00
Jouni Malinen
4ecb6dd16b DPP2: Controller support in hostapd
Extend hostapd support for DPP Controller to cover the DPP_CONTROLLER_*
cases that were previously implemented only in wpa_supplicant. This
allows hostapd/AP to be provisioned using DPP over TCP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-25 15:53:08 +03:00
Jouni Malinen
ba3081f1dc dpp-nfc: Start listen operation more completely for NFC Tag write cases
Share the same setup steps from the negotiated connection handover to
fix issues with NFC Tag write cases in AP mode. This addresses issues in
the AP mode DPP listen operation not actually receiving anything when
the write-a-tag code path was used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-24 23:41:13 +03:00
Jouni Malinen
9bc8811538 DPP2: Fix build without IEEE8021X_EAPOL
The local network profile parameters for EAP are not available without
IEEE8021X_EAPOL, so do not try to set these in builds that do not
include any EAP support.

Signed-off-by: Jouni Malinen <j@w1.fi>
2020-08-22 12:49:05 +03:00
Jouni Malinen
55a366d7a8 dpp-nfc: Fix recv_octets() regression
The updated socket.poll() loop did not terminate properly in cases where
no response is available. Fix that to check for both False and None.

Fixes: 1733e356e4 ("dpp-nfc: Fix handover client wait for receiving handover select")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-15 00:26:21 +03:00
Jouni Malinen
c6a760b9c4 DPP: Add process_conf_obj into TCP connection data struct
This is needed to avoid issues with hostapd not having set this function
pointer in dpp_global.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 17:31:51 +03:00
Jouni Malinen
7f366fcbdc DPP: Add msg_ctx into TCP connection data struct
This is needed to avoid issues with hostapd not having set msg_ctx in
dpp_global.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 17:26:32 +03:00
Jouni Malinen
6aa7aa8089 DPP2: hostapd/AP as Enrollee/Initiator over TCP
Extend DPP support in hostapd to allow AP Enrollee role when initiating
the exchange using TCP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 16:44:38 +03:00
Vinita S. Maloo
d21dde9dac MSCS: Send MSCS change/remove frames only if MSCS setup exists
Allow MSCS change/remove request to be sent only after an initial setup,
i.e., after an add request has been accepted.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
af8ab3208d MSCS: Parse result of MSCS setup in (Re)Association Response frames
Add support to parse the (Re)Association Response frames to check if the
AP has accepted/declined the MSCS request in response to the
corresponding (Re)Association Request frame. AP indicates the result by
setting it in the optional MSCS Status subelement of MSCS Descriptor
element in (Re)Association Response frame.

This MSCS Status subelement is defined in the process of being added
into P802.11-REVmd/D4.0 (11-20-0516-17-000m-cr-mscs-and-cid4158).

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
c504ff5398 MSCS: Add support to populate MSCS Descriptor IE in (Re)AssocReq
Include the MSCS Descriptor IE in the (Re)Association Request frames to
setup MSCS between the AP and the STA during association.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
bbd3178af4 MSCS: Add support to process MSCS Response frames
Add support to receive and process MSCS Response frames from the AP and
indicate the status to upper layers.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:37 +03:00
Vinita S. Maloo
a118047245 MSCS: Add support to send MSCS Request frames
Add support to send MSCS add/change/remove types of Action frames
to the connected AP.

Signed-off-by: Vinita S. Maloo <vmaloo@codeaurora.org>
2020-08-14 11:53:35 +03:00
Jouni Malinen
1733e356e4 dpp-nfc: Fix handover client wait for receiving handover select
This was supposed to wait for up to 3.0 seconds for the handover select,
but the incorrect loop terminated ended up limiting this to a single
iteration of 0.1 second wait. This was too fast for some cases like the
AP mode operation where it may take significant time to enable the radio
for listening to DPP authentication messages.

Fix the loop to allow that full three second wait for the response to be
used. In addition, report the amount of time it takes to receive the
response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-14 00:11:44 +03:00
Veerendranath Jakkam
596d99567a SME: Process channel switch event in SME only when supplicant's SME is used
Do not process channel switch event in wpa_supplicant's SME when SME is
offloaded to the driver/firmware to avoid SA Query initiation from both
wpa_supplicant and the driver/firmware for the OCV case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 21:39:49 +03:00
Veerendranath Jakkam
170775232d ANQP: Add support to specify frequency in ANQP_GET command
Previously, wpa_supplicant fetched BSS channel info from scan results to
send ANQP Query frames. If the scan results for the specified BSS are
not available, the ANQP_GET command request was getting rejected.

Add support to send ANQP Query frame on the specified frequency without
requiring the scan results to be available.

The control interface command format:
- ANQP_GET <dst_addr> [freq=<freq in MHz>] <Query ID1>[,<Query ID2>,..]

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:51:00 +03:00
Veerendranath Jakkam
43106e122b GAS: Update source MAC address on preassoc_mac_addr randomization
The GAS query source MAC address was not getting updated correctly when
preassoc_mac_addr is enabled. Fix this by copying the current MAC
address to the GAS query source address.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:34:43 +03:00
Veerendranath Jakkam
1289ecf4cc GAS: Ignore preassoc_mac_addr when gas_rand_mac_addr enabled
Skip unnecessary random MAC generation due to preassoc_mac_addr
parameter when gas_rand_mac_addr parameter is enabled.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:33:27 +03:00
Veerendranath Jakkam
dbe485a35a SAE-PK: Check psk param also to look for SAE-PK acceptable BSS
SAE-PK password can be set using psk parameter also in case of mixed
SAE+PSK networks, so look for acceptable SAE-PK BSS when SAE password
not set and psk parameter meets SAE-PK password criteria.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-13 17:31:38 +03:00
Jouni Malinen
3adc1c623e DPP2: Disconnect before starting reconfiguration
The offchannel operations (scan, Public Action frame TX/RX) have
significantly more latency when performed while connected, so disconnect
when requested to initiate DPP reconfiguration to avoid this. The old
network profile (i.e., likely the current connection) is going to be
replaced in practice and as such, there is no need to try continue that
association any further.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-13 17:05:49 +03:00
Jouni Malinen
fc3efe0834 DPP2: Support mutual auth with QR in scan-during-auth-exchange case
Extend DPP authentication session search for the DPP_QR_CODE command to
cover the ongoing exchanges in Controller/Responder.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 12:04:25 +03:00
Jouni Malinen
e4e95aabbf DPP2: Allow Controller to be configured to require QR mutual auth
Extend the DPP_CONTROLLER_START command to accept the optional qr=mutual
parameter similarly to the DPP_LISTEN case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-12 11:41:52 +03:00
Jouni Malinen
86fd6755cb dpp-nfc: Use --altchan value in handover server
Use the alternative channel list in the handover server role when
processing an alternative proposal. This was previously done only in the
handover client role, but with the updated design, both roles act in a
similar manner for the case where the alternative channel list is
specified.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-11 23:44:48 +03:00
Jouni Malinen
315422196a dpp-nfc: Update listen channel based on channel list when writing a tag
Do not use the hardcoded channel 1 (2412 MHz) with DPP_LISTEN if a
channel list is specified when writing an NFC Tag. Instead, pick the
first channel from that list as the listen channel.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-10 23:52:11 +03:00
Jouni Malinen
9304d1b3c3 DPP2: Regenerate Reconfig Announcement for each transmission
This is needed to generate a new unique A-NONCE and E'-id values.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-08 00:14:00 +03:00
Jouni Malinen
6d0217119e DPP2: Allow iteration count to be configured for DPP_RECONFIG
Add an optional iter=# parameter to DPP_RECONFIG similarly to the way
this was handled with DPP_CHIRP.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 23:22:31 +03:00
Jouni Malinen
c6d0e5a93d DPP2: Add E-id in Reconfig Announcement
Add an encrypted Enrollee identifier into Reconfig Announcement frames
and decrypt that on the Configurator side. The actual E-id value is
currently not used for anything, but it can be used in the future to
provide better control over reconfiguration.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 22:54:53 +03:00
Jouni Malinen
e5be6e68c8 DPP2: Add Enrollee netAccessKey group into Reconfig Announcement
This was added to the protocol design to support cases where the
C-sign-key uses a different group than the netAccessKey. The Enrollee
now indicates its netAccessKey group in Reconfig Announcement and the
Configurator builds it own reconfig Connector using that group instead
of the group used for the C-sign-key.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 15:25:10 +03:00
Jouni Malinen
2a58968d39 SAE-PK: Allow SAE-PK password to be set using the psk parameter
Only the sae_password parameter was previously accepted for SAE-PK use.
That is not sufficient for covering mixed SAE+PSK cases. Extend this by
allowing the psk parameter to be used as well just like it can be used
for SAE without SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-08-07 00:49:00 +03:00
Veerendranath Jakkam
b28b9dfcbf OCV: OCI channel override support for testing (STA)
Add override parameters to use the specified channel while populating
OCI element in EAPOL-Key group msg 2/2, FT reassoc request, FILS assoc
request and WNM sleep request frames.

Signed-off-by: Veerendranath Jakkam <vjakkam@codeaurora.org>
2020-08-03 11:02:13 +03:00
Jouni Malinen
38ef655eb5 dpp-nfc: Report negotiated connection handover result
Print out a summary of the result in yellow text.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 01:23:39 +03:00
Jouni Malinen
4d54618424 dpp-nfc: Stop only_one run after failed handover attempt
Do not require connection handover to succeed before stopping the loop
in the only_one case.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 01:09:31 +03:00
Jouni Malinen
f7b5a1d347 dpp-nfc: Do not indicate no initial HS as failure if alt HR will be sent
Do not use red color for the "No response receive" message in case
another HR will be sent after this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 01:00:11 +03:00
Jouni Malinen
475b34665c dpp-nfc: Improved version of HandoverServer::serve()
Fix processing of the case where no handover select is sent out and add
automatic (delayed) termination of the link on completing the handover
successfully.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 01:00:11 +03:00
Jouni Malinen
dc0795e4ff dpp-nfc: Stop process after successful handover client completion
terminate_now was not being set in the only_one case with connection
handover. Set it for that case as well as the tag cases to automatically
close down the link once it is not needed anymore.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 00:44:49 +03:00
Jouni Malinen
b00bbbfe54 dpp-nfc: Optimize HandoverClient message receiving for alternative HR case
Use a shorter polling interval in recv_octets() to be able to send out
the alternative HR more quickly when using a single thread and handover
client. In addition, fix recv_records() to handle normal exception cases
like not receiving anything.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 00:44:47 +03:00
Jouni Malinen
bbfb7b9feb dpp-nfc: Use a single handover client thread
Avoid extra complexity from use a separate thread to send out the
alternative proposal.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-31 00:44:12 +03:00
Jouni Malinen
aaa8638ed2 dpp-nfc: Add a class for maintaining connection handover state
This cleans up the shared state between the handover server and client.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-30 21:34:37 +03:00
Jouni Malinen
66d74626ba dpp-nfc: Reuse the same handover client for alternative URI
Postpone closing of the handover client to allow the same client to be
used for sending both handover request messages if an alternative URI
needs to be tried.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-30 20:43:26 +03:00
Jouni Malinen
6e904441c8 dpp-nfc: Add peer URI into the HS in testing mode
This makes it easier to confirm that the correct pair of the HR and the
HS were used.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-30 20:43:26 +03:00
Jouni Malinen
3021b14c49 dpp-nfc: Enable more verbose nfcpy debugging
Set logging level to various upper layer nfcpy modules to enable more
detailed debugging of the actual NFC operations when requested (-d on
the command line).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-30 16:49:40 +03:00
Jouni Malinen
1d3e16d0b0 dpp-nfc: Skip P2P management interfaces
Do not try to perform DPP operations on the P2P management interface
when no specific interface has been identified.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-30 12:51:56 +03:00
Jouni Malinen
e9c192ffc7 dpp-nfc: Ignore (no) response to initial handover request
If an alternative proposal (second handover request) is sent, the
response (or lack of it) to the initial handover request should be
ignored.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-24 12:46:20 +03:00
Jouni Malinen
7d27bcb8e7 dpp-nfc: Do not allow more than one alternative channel proposal
This avoids potential loops of endless alternative URI exchanges over
NFC negotiated connection handover. Only allow one such alternative
proposal and declarare the handover as a failure if another alternative
were needed.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-24 12:27:06 +03:00
Jouni Malinen
6eaee933d7 dpp-nfc: Add test mode for negotiated connection handover
Allow all actual DPP processing steps in wpa_supplicant to be skipped by
specifying hardcoded URI values. Also allow a hardcoded crn to be
specified to force specific handover requestor/selector roles.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-24 12:27:06 +03:00
Jouni Malinen
f4877083ec Rename driver op for temporarily disallowed BSSIDs
Use the "tmp_disallow" name more consistently so that both the core
wpa_supplicant functionality (struct wpa_bss_tmp_disallowed) and the
wpa_driver_ops callback have more similar names.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-24 12:26:09 +03:00
Jouni Malinen
15018d4f4a DPP2: Fix auth termination after receiving Configurator backup
remove_on_tx_status needs to be set in this case even if
dpp_config_processing=2 is used since there will be no connection
attempt when receiving a Configurator backup instead of station config
object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 18:01:55 +03:00
Jouni Malinen
74cd38ac69 dpp-nfc: Return failure status if operation fails
For now, this is done only for the case where the NFC Device is not
usable and if writing a single tag fails.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 12:26:46 +03:00
Jouni Malinen
7e2edfbc1a dpp-nfc: Add color and details for interactive operations
Make the debug output easier to read when performing interactive NFC
operations on a device that has a terminal showing the log.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 12:10:26 +03:00
Jouni Malinen
09c22bb782 dpp-nfc: Fix regression in NFC Tag writing
The change to checking DPP_LISTEN return value ended up overwriting the
actual URI information from wpas_get_nfc_uri().

Fixes: 288c0ffaaa ("dpp-nfc: Do not hardcode netrole for NFC Tag writing cases")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 11:32:21 +03:00
Jouni Malinen
1e4a42c745 dpp-nfc: Detect a non-NDEF tag when trying to write
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 11:27:27 +03:00
Jouni Malinen
288c0ffaaa dpp-nfc: Do not hardcode netrole for NFC Tag writing cases
Allow netrole to be specified for NFC Tag writing cases. Previously,
this was hardcoded to use netrole=configurator when starting the listen
operation. Now the netrole parameter is not included by default, but any
netrole value can be specified with the new --netrole command line
argument.

In addition, fix the listening frequency for the case where a channel is
picked.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-07-23 01:30:30 +03:00
Yu Wang
885097125c mesh: Fix peer link counting when removing a mesh peer
When removing a mesh peer with control interface commands (ACCEPT_ACL
DEL_MAC/DENY_ACL ADD_MAC/MESH_PEER_REMOVE) the plink count was not
decreased from its last connection. This resulted in peer link count
leakage and wpa_supplicant rejecting the connections after reaching
max_peer_links (default: 99).

Fix this by decreasing the plink count when removing a mesh peer which
is in PLINK_ESTAB state.

Signed-off-by: Yu Wang <yyuwang@codeaurora.org>
2020-07-15 12:00:35 +03:00
Jouni Malinen
8632dea4ae DPP2: Make sure dpp_auth gets cleared with external config processing
wpa_s->dpp_auth did not get cleaner if dpp_config_processing=1 is used.
Clear this after having received TX status for Configuration Result to
avoid leaving behind the completed provisioning instance.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-26 20:50:23 +03:00
Jouni Malinen
a7ae422961 DPP2: Do not allow reconfiguration to be started with pending auth
The pending authentication exchange will make us ignore Reconfig
Authentication Request, so do not allow reconfiguration to be started in
that state.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-26 20:40:40 +03:00
Jouni Malinen
d93df9989f DPP2: Debug print reason for rejecting reconfiguration
This makes it easier to understand why Reconfig Authentication Request
gets ignored.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-26 20:37:30 +03:00
Jouni Malinen
c9dc075fcd dpp-nfc: Fix connection handover renegotiation
The use of the alternative channel list did not work properly for the
case were both ends were trying to initiate the negotiated connection
handover. Fix this by always starting a new connection handover client
thread for sending the alternative proposal and ignoring peer messages
(likely something from the first attempt) during this modified attempt.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-24 22:37:52 +03:00
Vinita S. Maloo
d0819a11cc FILS: Use FILS auth alg when connecting using PMKSA caching
When a PMKSA cache entry is available and used for connection with FILS
key management suite, use FILS authentication algorithm for connection
even if ERP keys are not available. This scenario may happen when
applications using wpa_supplicant cache persistently only PMKSA but not
ERP keys and reconfigures wpa_supplicant with PMKSA cache after
restarting wpa_supplicant.

The previous implementation correctly handles SME-in-wpa_supplicant
cases. However, SME-in-driver cases, complete FILS authentication
without PMKSA caching is performed.

Fix SME-in-driver behavior by setting authentication algorithm to
WPA_AUTH_ALG_FILS when connecting to a FILS AP using PMKSA caching.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-24 00:29:58 +03:00
Wu Gao
52a3257621 6 GHz: Change 6 GHz channels per IEEE P802.11ax/D6.1
The channel numbering/center frequencies was changed in IEEE
P802.11ax/D6.1. The center frequencies of the channels were shifted by
10 MHz. Also, a new operating class 136 was defined with a single
channel 2. Add required support to change the channelization as per IEEE
P802.11ax/D6.1.

Signed-off-by: Wu Gao<wugao@codeaurora.org>
Signed-off-by: Vamsi Krishna <vamsin@codeaurora.org>
2020-06-24 00:29:37 +03:00
Jouni Malinen
5908fedc10 dpp-nfc: Support channel list negotiation
If the peer's channel list in negotiated handover does not have any
common channels and the local end is configured with an alternative
channel list, try to initiate another negotiation handover with the
alternative channels.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-23 13:24:38 +03:00
Jouni Malinen
eddf22e1f2 dpp-nfc: Update debug print for tag-read-only operation
Be clearer about only a tag read being allowed when dpp-nfc is
configured to not allow connection handover.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-23 00:57:18 +03:00
Jouni Malinen
b62e46f690 DPP2: Fix DPP_CA_SET processing with authentication not having peer BI
Need to check for auth->peer_bi being set before using it here.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 21:45:10 +03:00
Jouni Malinen
4f4a52c3cc DPP: Clear bootstrap entries only after clearing authentication state
This fixes an issue where the pending authentication might have held a
reference to auth->tmp_peer_bi and dpp_auth_deinit() would try to free
that bootstrapping entry. This needs to happen before the call to
dpp_global_clear() to avoid double-removal of the bootstrapping entry
from the list.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-22 20:00:31 +03:00
Jouni Malinen
b5dab03a13 Convert int to bool for throughput estimate tables
Signed-off-by: Jouni Malinen <j@w1.fi>
2020-06-19 18:34:26 +03:00
Matthew Wang
b97aa038b7 Add WPA_EVENT_{DO,SKIP}_ROAM events
Add events for within-ESS reassociation. This allows us to monitor roam
events, both skipped and allowed, in tests.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 18:34:26 +03:00
Matthew Wang
d6b450e890 Refactor wpa_supplicant_need_to_roam()
Pull all the within-ESS roam code out of wpa_supplicant_need_to_roam()
and into its own function, wpa_supplicant_need_to_roam_within_ess().
This way, we avoid interleaving several #ifndef's in the original
function and wrap the new function in one big #ifndef. This also
modularizes the within-ESS roam code and makes it easier to test.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 18:30:08 +03:00
Matthew Wang
2ff5a1fdb1 Use lookup-table instead of macro for TX rate estimates
Change INTERPOLATE_RATE() macro to a lookup-table instead for the sake
of readability.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2020-06-19 16:59:13 +03:00
Jouni Malinen
fa09b85c4e DPP2: Remove forgetten development time debug prints
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:37:40 +03:00
Jouni Malinen
8f88dcf050 DPP2: Add an automatic peer_bi entry for CSR matching if needed
This allows the DPP_CA_SET command to be targeting a specific DPP-CST
event in cases where the Configurator did not receive the bootstrapping
information for the peer.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
b25ddfe9d3 DPP2: Add Enrollee name into CSR as the commonName
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-19 00:13:48 +03:00
Jouni Malinen
697fa0c4bd DPP2: Do not try to proceed with GAS client if CSR building fails
This error path was supposed to stop instead of continuing to
wpas_dpp_start_gas_client().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-18 12:09:00 +03:00
Jouni Malinen
3a3eded0dc DPP2: Allow CSR processing by CA/RA to reject configuration
"DPP_CA_SET name=status value=<int>" can now be used to explicitly
indicate that CSR was rejected by CA/RA.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-17 21:39:47 +03:00
Jouni Malinen
ace3723d98 DPP2: Enterprise provisioning (Enrollee)
Add initial Enrollee functionality for provisioning enterprise (EAP-TLS)
configuration object. This commit is handling only the most basic case
and a number of TODO items remains to handle more complete CSR
generation and config object processing.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:26:06 +03:00
Jouni Malinen
6568e5d203 DPP2: Enterprise provisioning (Configurator)
Add Configurator functionality for provisioning enterprise (EAP-TLS)
configuration object.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-16 18:24:23 +03:00
Jouni Malinen
68ac45d53c GAS server: Support comeback delay from the request handler
Allow GAS request handler function to request comeback delay before
providing the response.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-15 23:56:06 +03:00
Jouni Malinen
518be614f1 SAE-PK: Advertise RSNXE capability bit in STA mode
Set the SAE-PK capability bit in RSNXE when sending out (Re)Association
Request frame for a network profile that allows use of SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-10 12:47:07 +03:00
Jouni Malinen
cc2d03601b HS 2.0: Use global pmf=2 for the created network block
Previously, PMF support was enabled in optional mode (ieee80211w=1) for
Hotspot 2.0 network blocks automatically. This did not consider the
global PMF parameter and unconditionally changed that value to optional.
Since the newly added network block had an explicit ieee80211w
parameter, this overrode the global parameter. To make this less
surprising, use the global pmf parameter value to select whether to add
network blocks for Hotspot 2.0 with PMF being optionally enabled (pmf=0
or pmf=1) or required (pmf=2).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-09 00:55:13 +03:00
Subrat Dash
790026c3da Allow TX queue parameters to be configured for wpa_supplicant AP/P2P GO
Allow user to configure the TX queue parameters through the
wpa_supplicant configuration file similarly to the way these can be set
in hostapd.

Parse the tx_queue_* parameters in the wpa_supplicant configuration file
and update the TX queue configuration to the AP/P2P GO interface in the
function wpa_supplicant_create_ap().

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-09 00:29:42 +03:00
Jouni Malinen
fcef598ea2 Do not try to connect with zero-length SSID
It was possible to find a BSS to local network profile match for a BSS
entry that has no known SSID when going through some of the SSID
wildcard cases. At leas the OWE transition mode case without BSSID match
could result in hitting this. Zero-length SSID (i.e., wildcard SSID) is
not valid in (Re)Association Request frame, so such an association will
fail. Skip such a BSS to avoid known-to-be-failing association attempts.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-08 21:40:56 +03:00
Jouni Malinen
5f48d36b4a SAE-PK: Select SAE-PK network over SAE without PK
If there is an acceptable BSS with SAE-PK enabled in the same ESS,
select that over a BSS that does not enable SAE-PK when the network
profile uses automatic SAE-PK selection.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 16:49:07 +03:00
Jouni Malinen
d654ca24de Clean up wpa_scan_res_match()
Move the BSS-against-SSID matching into a separate helper function to
make this overly long function a bit more readable and to allow that
helper function to be used for other purposes.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 16:30:32 +03:00
Jouni Malinen
9ad010c290 SAE-PK: Allow automatic SAE-PK to be disabled
This replaces the previously used sae_pk_only configuration parameter
with a more generic sae_pk that can be used to specify how SAE-PK is
negotiated. The default behavior (sae_pk=0) is to automatically
negotiate SAE-PK whenever the AP supports it and the password is in
appropriate format. sae_pk=1 allows only SAE-PK to be used and sae_pk=2
disables SAE-PK completely.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-07 11:55:16 +03:00
Purushottam Kushwaha
85ca13ebcf wpa_cli: Add all_bss command to print all scan results (BSS entries)
The wpa_supplicant control interface returns maximum of 4 kB of response
data and, thus, limits maximum number of scan entries as part of
SCAN_RESULTS to approximately 60. Add a new all_bss command to use a
more robust iteration of the BSS table entries with the BSS command to
to get all scan entries and print them in the same format as the
scan_results command.

Signed-off-by: Purushottam Kushwaha <pkushwah@codeaurora.org>
2020-06-06 17:07:24 +03:00
Jouni Malinen
215b4d8a72 FT: Do not add PMKID to the driver for FT-EAP if caching is disabled
wpa_supplicant disables PMKSA caching with FT-EAP by default due to
known interoperability issues with APs. This is allowed only if the
network profile is explicitly enabling caching with
ft_eap_pmksa_caching=1. However, the PMKID for such PMKSA cache entries
was still being configured to the driver and it was possible for the
driver to build an RSNE with the PMKID for SME-in-driver cases. This
could result in hitting the interop issue with some APs.

Fix this by skipping PMKID configuration to the driver fot FT-EAP AKM if
ft_eap_pmksa_caching=1 is not used in the network profile so that the
driver and wpa_supplicant behavior are in sync for this.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 16:48:57 +03:00
Tanmay Garg
63653307df Add support for indicating missing driver AKM capability flags
Add support for missing driver AKM capability flags from the list of
RSN_AUTH_KEY_MGMT_* flags and make these available through the
'GET_CAPABILITY key_mgmt' control interface command.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
8d1cbaaff7 SAE-PK: Transition mode disabled indication processing
Allow AP to disable transition mode for SAE-PK (i.e., prevent SAE
authentication without SAE-PK).

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
a752695290 SAE: Add sae_h2e and sae_pk to wpa_supplicant STATUS command
This provides additional information on which options were used during
SAE authentication.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
cc22fb1b86 SAE: Move H2E and PK flags to main sae_data
This maintains knowledge of whether H2E or PK was used as part of the
SAE authentication beyond the removal of temporary state needed during
that authentication. This makes it easier to use information about which
kind of SAE authentication was used at higher layer functionality.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
bc908daace Document more network profile parameters
Some of the recently added wpa_supplicant network profile parameters
were not documented in wpa_supplicant.conf. Add these there based on the
documentation in config_ssid.h.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
1c846d647e SAE-PK: Allow SAE authentication without PK to be disabled
The new wpa_supplicant network profile parameter sae_pk_only=1 can now
be used to disable use of SAE authentication without SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-06 15:18:13 +03:00
Jouni Malinen
b6bcd74e53 Show SAE capabilities in control interface
Indicate local support for SAE H2E and SAE-PK.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00
Jouni Malinen
9bf576870e Show SAE flags in scan results
Indicate AP support for SAE H2E and SAE-PK in scan results.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
2020-06-02 23:25:22 +03:00