Commit graph

4163 commits

Author SHA1 Message Date
Yogesh Ashok Powar
3dd1d8906d nl80211: Subscribe management frames for WPA_IF_AP_BSS types
In multiple BSSes scenario for the drivers that do not use
monitor interface and do not implement AP SME, RX MGMT
frame subscription happens only for the default bss (first_bss).

Subscribe for RX MGMT frames for such BSSes.

Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
2012-01-29 12:34:38 +02:00
Yogesh Ashok Powar
a7a6af4cba nl80211: Derive frequency for BSSes other than the first
Commit e4fb216769 moved frequency
storage from driver struct to bss struct and is assigned in
wpa_driver_nl80211_set_freq. As this wpa_driver_nl80211_set_freq is
triggered only on the first_bss, bss->freq for other BSSes is never
being set to the correct value. This sends MLME frames on frequency zero
(initialized value of freq) for BSSes other than the first.

To fix this derive frequency value from first_bss.

Signed-off-by: Yogesh Ashok Powar <yogeshp@marvell.com>
2012-01-29 12:34:32 +02:00
Antonio Quartulli
fa7187bfde IBSS RSN: Provide ibss_rsn_get_peer() helper function
This is a useful function that simplifies some code and can eventually
be used somewhere else in future.

Signed-hostap: Antonio Quartulli <ordex@autistici.org>
2012-01-29 12:23:27 +02:00
Nicolas Cavallari
f31e19df3a wpa_debug: Support outputting hexdumps into syslog
This patch allows to log hexdumps into syslog.

This is useful when testing, as syslog's network logging
helps to collect debug outputs from several machines.

Signed-hostapd: Nicolas Cavallari <cavallar@lri.fr>
2012-01-29 12:13:43 +02:00
Simon Baatz
4ac384c596 EAP-AKA peer: Append realm when learning the pseudonym
The pseudonym identity should use a realm in environments where a realm is
used. Thus, the realm of the permanent identity is added to the pseudonym
username sent by the server.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-28 19:41:19 +02:00
Simon Baatz
a6689be84f EAP-SIM peer: Append realm when learning the pseudonym
The pseudonym identity should use a realm in environments where a realm is
used. Thus, the realm of the permanent identity is added to the pseudonym
username sent by the server.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-28 19:38:46 +02:00
Sylvestre Gallon
3d0a843823 dbus: Fix endianness bug in Frequency and Signal properties
These properties did not work on big endian PowerPC (always 100% for
Signal and 0 for Frequency) due to endianness problem (u32 to u16 data
loss).

Signed-off-by: Sylvestre Gallon <ccna.syl@gmail.com>
2012-01-28 17:57:48 +02:00
Jouni Malinen
6897ce14a4 Rename systemd template files to avoid @ in the file name
Perforce does not like @ in the file name and since these template files
do not really need to have that in the name, make the files in
repository friendlier to Perforce. The generated *.service file will
maintain their old names.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-28 17:12:30 +02:00
Nicolas Cavallari
913e3cf794 nl80211: Add IBSS BSSID fixing support
If a BSSID and fixed-bssid are requested, fix the BSSID, so
the driver does not attempt to merge.

Signed-hostap: Nicolas Cavallari <cavallar@lri.fr>
2012-01-28 11:35:32 +02:00
Nicolas Cavallari
9e2af29f9b Support fixing the BSSID in IBSS mode
When the "bssid=" option is set for an IBSS network and ap_scan = 2,
ask the driver to fix this BSSID, if possible.

Previously, any "bssid=" option were ignored in IBSS mode when ap_scan=2.

Signed-hostap: Nicolas Cavallari <cavallar@lri.fr>
2012-01-28 11:33:47 +02:00
Paul Stewart
a4bbb6066d dbus: Create DBus getter/setter for FastReauth
Provide a means over DBus to set the conf->fast_reauth
property, which controls whether TLS session resumption
should be attempted for EAP-TLS 802.1X networks.

Signed-off-by: Paul Stewart <pstew@chromium.org>
2012-01-28 11:21:37 +02:00
Jouni Malinen
ce7b56afab WPS: Fix an interoperability issue with mixed mode and AP Settings
It looks like Windows 7 WPS implementation does not like multiple
Authentication/Encryption Type bits to be set in M7 AP Settings
attributes, i.e., it refused to add a network profile if the AP
was configured for WPA/WPA2 mixed mode and AP PIN was used to
enroll the network.

Leave only a single bit set in the Authentication/Encryption Type
attributes in M7 when the AP is acting as an Enrollee to avoid this
issue.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-27 22:32:15 +02:00
Jouni Malinen
b21ff9cb20 P2P: Fix WSC IE inclusion for P2P disabled case
wpas_wps_in_use() was forcing WPS to be enabled unconditionally if P2P
support was included in the build. This is not really the correct
behavior for the case when P2P has been disabled at runtime. Change the
code here to verify runtime configuration of P2P before forcing WPS to
be enabled. This allows WSC IE to be left out from Probe Request frames
when scanning for APs without P2P or WPS being in use.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-27 21:09:34 +02:00
Jouni Malinen
552310680c nl80211: Fix send_action on off-channel in P2P GO role
A P2P Action frame may need to be sent on another channel than the GO's
operating channel. This information was lost in
wpa_driver_nl80211_send_action() in the case the interface was in AP
mode. Pass the frequence and related parameters to send_mlme mechanism
to allow the correct frequence to be used with the send frame command in
AP (P2P GO) mode.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-26 17:44:11 +02:00
Jouni Malinen
ceb997f394 Fix ap_sta_disconnect() to clear EAPOL/WPA authenticator state
Number of places in hostapd use ap_sta_disconnect() instead of
ap_sta_disassociate() or ap_sta_deauthenticate(). There are some
differences between these functions, e.g., in the area how quickly
the EAPOL state machines get deinitialized. This can result in
somewhat unexpected events since the EAPOL/WPA authenticator
state machines could remain running after deauthentication.

Address this by forcing EAPOL/WPA authenticator state machines
to disabled state whenever ap_sta_disconnect() is called instead
of waiting for the deauthentication callback or other timeout
to clear the STA.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 22:32:58 +02:00
Jouni Malinen
1e49ccebf7 pcsc: Fix compiler warning on signed vs. unsigned comparison
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-25 17:41:59 +02:00
Jouni Malinen
b1aebbc427 P2P: Do not expire peer entry if we are connected to the peer
Even though we may not update P2P peer entry while connected to the
peer as a P2P client, we should not be expiring a P2P peer entry while
that peer is the GO in a group where we are connected as a P2P client.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 17:27:47 +02:00
Jouni Malinen
1d277f0260 P2P: Do not expire peer entry if peer is connected as a client
Even though we may not receive a Probe Response from the peer during
the connection, we should not be expiring a P2P peer entry while that
peer is connected to a group where we are the GO.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-25 17:00:59 +02:00
Deepthi Gowri
d8d6b32eec nl80211: P2P: Pass cookie parameter in send action frame
The cookie value needs to be fetched in GO mode, too, to be able to
indicate TX status callbacks with drivers that handle AP mode SME
functionality internally. This fixes issues with client discoverability
where TX status callback for GO Discoverability Request is needed to
trigger the GO to send Device Discoverability Response.
2012-01-23 20:12:06 +02:00
Jouni Malinen
433cd2ce65 Stop sched_scan in number of cases where it should not be running
When a P2P group is removed, we better not leave possibly started
sched_scan running. This could happen when a separate group interface
was not used.

In addition, it looks safer to explicitly stop sched_scan before
starting P2P Listen or Find operations to make sure the offloaded
scanning is not running when doing similar P2P operations.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-23 18:26:09 +02:00
Sujith Manoharan
cd2f4ddfb9 Update WPA/RSN IE properly for driver based BSS selection
This patch fixes an issue with roaming for drivers that set
WPA_DRIVER_FLAGS_BSS_SELECTION (currently ath6kl). On moving to an AP
with a different BSSID, an EVENT_ASSOC is received and the subsequent
4-way handshake may fail because of a mismatch between the RSN IE in
message 3/4 and in Beacon/Probe Response. This happens only when the APs
use different RSN IE contents and ap_scan is set to 1, since
wpa_supplicant fails to update its cached IEs.

Initial association may fail, too, in case of multiple APs with
the same SSID, since BSSID selection is done by the driver and again
a mismatch could be seen.

Fix these two issues by clearing and updating the cached IEs on
receiving an Association event from the driver. Also, retrieve the
scan results when the new BSS information is not present locally.

Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
2012-01-23 17:34:39 +02:00
Jouni Malinen
e6c6274947 Add preliminary MNC length determination based on IMSI
Some SIM cards do not include MNC length with in EF_AD. Try to figure
out the MNC length based on the MCC/MNC values in the beginning of the
IMSI. This covers a prepaid Elisa/Kolumbus card that would have ended
up using incorrect MNC length based on the 3-digit default.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 21:54:24 +02:00
Jouni Malinen
a3e0105692 Avoid unnecessary memory allocation in building of SIM realm
The temporary IMSI buffer can be used for this without needing the
extra memory allocation. In addition, the implementation is easier
to understand when the extra identity prefix value for EAP-SIM/AKA
is not included while fetching MCC/MNC from the IMSI.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 21:54:24 +02:00
Simon Baatz
2d7d0ab307 EAP-SIM/EAP-AKA peer: Support realms according to 3GPP TS 23.003
If the identity is derived from the SIM, use a realm according
to 3GPP TS 23.003.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-22 21:54:24 +02:00
Jouni Malinen
4646ee67c0 Reject too short IMSI in EAP-SIM/AKA identity generation
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 21:54:24 +02:00
Jouni Malinen
beec9c3a1f eapol_test: Show MNC length in debug output
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 20:59:00 +02:00
Simon Baatz
8ab7a37089 SIM/USIM: Add function to get the MNC length from the SIM/USIM
The EF-AD (administrative data) file may contain information about the
length of the MNC (2 or 3 digits) in the IMSI. This can be used to
construct the realm according to 3GPP TS 23.003 during EAP-SIM or
EAP-AKA authentication.

Signed-hostap: Simon Baatz <gmbnomis@gmail.com>
2012-01-22 19:28:24 +02:00
Jithu Jance
8aebb0e471 P2P: Notify upper framework on stopping the p2p_find(SEARCH)
This patch notifies the upper framework that an on-going discovery has
been stopped. This is useful in cases where a p2p_find with a timeout
value initiated by the upper framework has been finished or when the
framework initiated "p2p_find" is stopped by a "p2p_connect".

Signed-hostap: Jithu Jance <jithu@broadcom.com>
2012-01-22 17:20:53 +02:00
Jouni Malinen
74590e710f Work around interop issue with WPA type EAPOL-Key 4/4 in WPA2 mode
Some deployed station implementations seem to send msg 4/4 with
incorrect type value in WPA2 mode. Add a workaround to ignore that issue
so that such stations can interoperate with hostapd authenticator. The
validation checks were added in commit
f8e96eb6fd.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-22 12:23:28 +02:00
Sam Leffler
f9121813d7 dbus: Validate SSID length in new D-Bus scan request
Validate the length of each SSID passed in a new D-Bus protocol
Scan request.
2012-01-22 12:02:09 +02:00
Jouni Malinen
8017b538e7 P2P: Use Device ID attribute to filter Probe Request frames as GO
The Device ID attribute was already used in Listen state, but it was
ignored in GO role. Verify that there is a match with Device ID in
GO rule, too, before replying to the Probe Request frame.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-08 09:35:33 -08:00
Jouni Malinen
6d92fa6e92 P2P: Allow Device ID to be specified for p2p_find command
dev_id=<P2P Device Addr> can now be specified as an argument to
p2p_find to request P2P find for a specific P2P device.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-08 09:25:29 -08:00
Jouni Malinen
68921e24b2 Allow SNonce update after sending EAPOL-Key 3/4 if 1/4 was retransmitted
Some supplicant implementations (e.g., Windows XP WZC) update SNonce for
each EAPOL-Key 2/4. This breaks the workaround on accepting any of the
pending requests, so allow the SNonce to be updated even if we have
already sent out EAPOL-Key 3/4.

While the issue was made less likely to occur when the retransmit
timeout for the initial EAPOL-Key msg 1/4 was increased to 1000 ms,
this fixes the problem even if that timeout is not long enough.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-02 22:36:11 +02:00
Jouni Malinen
d567479153 Do not disconnect STA based on inactivity on driver failure
Now that we can use driver_nl80211.c with non-mac80211 drivers that
implement SME/MLME internally, we may not get inactivity time from the
driver. If that is the case, we need to skip disconnection based on
maximum inactivity timeout. This fixes some unexpected disconnection
cases with ath6kl in AP mode.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2012-01-02 21:27:06 +02:00
Jouni Malinen
b87346c41a Remove test-https on "make clean"
This is not included in the TESTS list, but should be removed anyway.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-01 19:09:18 +02:00
Jouni Malinen
57d38ddf6b Update copyright notices to include year 2012
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-01 18:59:16 +02:00
Jouni Malinen
3d9975d5b0 Do not trigger fast reconnection on locally generated deauth/disassoc
The deauthentication and disassociation events from nl80211 were being
processed identically regardless of whether the frame was generated by
the local STA or the AP. This resulted in fast reconnection mechanism
getting triggered even in the case where the disconnection was detected
locally (e.g., due to beacon loss) while this was supposed to happen
only in the case where the AP is sending an explicit Deauthentication
or Disassociation frame with a specific reason code.

Fix this by adding a new deauth/disassoc event variable to indicate
whether the event was generated locally.

Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-01 18:55:58 +02:00
Jouni Malinen
0be3542338 Fix BSS property names in the example D-Bus script
Signed-hostap: Jouni Malinen <j@w1.fi>
2012-01-01 18:55:55 +02:00
Syam Sidhardhan
60d5a5a5fd dbus: Fix extra semicolon
Signed-off-by: Syam Sidhardhan <syamsidhardh@gmail.com>
2012-01-01 14:39:24 +02:00
Jouni Malinen
6fc74e5181 dbus: Increase buffer size to fix Introspect XML
Commit e9c3c1afed added a new D-Bus
method and that was enough to push the Introspect XML buffer over
the previously allocated 8000 bytes. Increase the buffer size to
make enough room for P2P interface. In addition, add a debug
message to indicate if an XML segment does not fit into the buffer
to make this types of failures somewhat easier to catch.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-31 17:40:49 +02:00
Jouni Malinen
d033694ac5 Clear EAPOL authWhile and heldWhile values when port is disabled
IEEE Std 802.1X-2004 does not clear authWhile and heldWhile in this
case, but doing so allows the timer tick to be stopped more quickly when
the port is not enabled. Since these variables are used only within HELD
and RECEIVE states, clearing them on initialization does not change
actual state machine behavior. This reduces some unnecessary operations
in port disabled state and cleans up the wpa_supplicant debug log after
disconnection.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-31 13:42:23 +02:00
Jouni Malinen
5fd9fb2772 Remove possible authentication timeout on connection failure
The authentication timeout could be triggered after the connection has
already been known to have failed. The event at that point can be
confusing, so better cancel the timeout when processing connection
failure.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-31 13:25:37 +02:00
Jouni Malinen
1e7fb4f1b7 WPS: Use single channel scan if AP channel already known
If the BSSID of the AP is specified in the WPS command, the target
AP is likely already in the BSS table and its operating channel is
known. Use this information to speed up connection by only scanning
the known channel.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-31 13:17:20 +02:00
Jouni Malinen
ee9fc67ab7 nl80211: Mark Beacon event debug excessive
This can show up way too frequently in AP mode to make debug logs
readable at debug level.

Signed-hostap: Jouni Malinen <j@w1.fi>
2011-12-30 14:10:15 +02:00
Michał Górny
399ec170e8 Use correct (multi-user) target when installing systemd units
The 'network.target' is special (per systemd.special(7)), and is to be
brought up indirectly when network is actually configured (i.e. through
DHCP or static address settings).

Irrelevant of that, all services should be always installed in
multi-user.target.

[Bug 427]
2011-12-29 21:39:34 +02:00
Spencer Chang
62a8ea7d01 WPS: Cancel previous registered wps_registrar_pbc_timeout
Since wps_registrar_pbc_timeout is called to stop PBC, previously
registered wps_registrar_pbc_timeout must be canceled when canceling
the WPS operation.

Signed-off-by: Spencer Chang <jungwalk@gmail.com>
2011-12-29 21:32:06 +02:00
Jouni Malinen
b9fd8ce804 nl80211: Fix NL80211_CMD_FRAME to not try offchannel without driver support
The offchanok parameter is hardcoded to one in number of paths and that
added NL80211_ATTR_OFFCHANNEL_TX_OK attribute to NL80211_CMD_FRAME
unconditional. cfg80211 rejects this with EINVAL if the driver does not
indicate support for offchannel TX. Fix this by not requesting
offchannel TX depending on driver capabilities. Remain-on-channel
operation was used for those cases anyway, so the additional attribute
was not really needed for these in the first place.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-12-29 14:15:31 +02:00
Jouni Malinen
e91829f9ac P2P: Stop remain-on-channel prior to starting join-a-group client
This fixes issues with drivers that do not handle concurrent
remain-on-channel and scan operations in a case where Provision
Discovery Response frame is not received to stop the Action frame
handshake.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-12-29 13:28:17 +02:00
Neeraj Kumar Garg
b8349523e4 P2P: Reject p2p_group_add if forced frequency is not acceptable
If the freq parameter is specified and we are already running legacy STA
on a different frequency with a driver that does not support
multi-channel concurrency, reject p2p_group_add. Same code already
exists in the path of P2P connection with go negotiation but is missing
for autonomous GO.

Signed-hostap: Neeraj Garg <neerajkg@broadcom.com>
2011-12-27 23:21:45 +02:00
Jouni Malinen
0d891981db nl80211: Do not stop AP mode Probe Request reporting on Listen stop
When nl80211_setup_ap() has enabled Probe Request reporting, this must
not be disabled when P2P Listen state is stopped to avoid breaking AP
mode operations. This could happen, e.g., if a Probe Request frame was
received from a P2P device that the we are trying to invite to our group
(i.e., when operating in GO role). p2p_probe_req_rx() calls
p2p_invite_start() in this case and that ends up calling
p2p->cfg->stop_listen() which calls probe_req_report() driver op.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
2011-12-27 20:32:29 +02:00