Commit graph

18407 commits

Author SHA1 Message Date
Veerendranath Jakkam
fa5cad61a4 MLD STA: Use AP MLD address in PMKSA entry
Use the AP MLD address instead of the BSSID of a link as the
authenticator address in the PMKSA entry.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-06 23:36:36 +02:00
Rohan Dutta
052bf8a51b MLD STA: Use AP MLD address to derive pairwise keys
Use AP MLD address to derive pairwise keys for MLO connection. Current
changes are handling only PTK derivation during EAPOL-Key 4-way
handshake and FILS authentication, i.e., FT protocol case needs to be
addressed separately.

Signed-off-by: Rohan Dutta <quic_drohan@quicinc.com>
Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-06 18:29:36 +02:00
Veerendranath Jakkam
e784372564 MLD STA: Add MLO KDEs for EAPOL-Key msg 2/4 and 4/4
Add new KDEs introduced for MLO connection as specified in
12.7.2 EAPOL-Key frames, IEEE P802.11be/D2.2.
- Add MAC and MLO Link KDE for each own affliated link (other than the
  link on which association happened) in EAPOL-Key msg 2/4.
- Add MAC KDE in 4/4 EAPOL frame.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-06 18:19:22 +02:00
Veerendranath Jakkam
472a0b8d60 MLD STA: Set MLO connection info to wpa_sm
Update the following MLO connection information to wpa_sm:
- AP MLD address and link ID of the (re)association link.
- Bitmap of requested links and accepted links
- Own link address for each requested link
- AP link address, RSNE and RSNXE for each requested link

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-06 18:04:09 +02:00
Veerendranath Jakkam
cc2236299f nl80211: Get all requested MLO links information from (re)association events
Currently only accepted MLO links information is getting parsed from
(re)association events. Add support to parse all the requested MLO links
information including rejected links. Get the rejected MLO links
information from netlink attributes if the kernel supports indicating
per link status. Otherwise get the rejected MLO links information by
parsing (Re)association Request and Response frame elements.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-06 17:49:09 +02:00
Jouni Malinen
66d7f554e2 tests: Fuzz testing for PASN
Add test tools for fuzzing PASN initiator and responder handling of
received PASN Authentication frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 17:22:14 +02:00
Jouni Malinen
2e840fb2ab tests: Fix CC and CFLAGS default processing for fuzzing
"make LIBFUZZER=y" was supposed to set CC and CFLAGS to working values
by default if not overridden by something external. That did not seem to
work since the defaults from the other build system components ended up
setting these variables before the checks here. Fix this by replacing
the known default values for non-fuzzing builds.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 17:11:47 +02:00
Jouni Malinen
1ca5c2ec2a PASN: Fix spelling of RSNE in debug messages
Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 17:11:47 +02:00
Jouni Malinen
a43536a72b PASN: Verify explicitly that elements are present before parsing
Make sure the elements were present before trying to parse them. This
was already done for most cases, but be consistent and check each item
explicitly before use.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 17:10:45 +02:00
Jouni Malinen
7e38524076 PASN: Fix MIC check not to modify const data
The previous version was using typecasting to ignore const marking for
the input buffer to be able to clear the MIC field for MIC calculation.
That is not really appropriate and could result in issues in the future
if the input data cannot be modified. Fix this by using an allocated
copy of the buffer.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 16:52:06 +02:00
Jouni Malinen
8481c75091 PASN: Fix Authentication frame checks
The way type and subtype of the FC field was checked does not really
work correctly. Fix those to check all bits of the subfields. This does
not really make any practical difference, though, since the caller was
already checking this.

Furthermore, use a helper function to avoid having to maintain two
copies of this same functionality.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-06 11:42:58 +02:00
Beniamino Galvani
f899d7f378 dbus: Apply PMK properties immediately
Currently, PMK parameters in the WPA state machine are set from
configuration only when the interface is initialized. If those
parameters are changed later via D-Bus, the new values don't have any
effect.

Call wpa_sm_set_param() when PMK-related D-Bus properties are changed
to immediately apply the new value; the control interface also does
something similar.

Signed-off-by: Beniamino Galvani <bgalvani@redhat.com>
2022-11-05 17:49:41 +02:00
Jeffery Miller
c6f8af507e Add option to disable SAE key_mgmt without PMF
Add the `sae_check_mfp` global option to limit SAE when PMF will
not be selected for the connection.
With this option SAE is avoided when the hardware is not capable
of PMF due to missing ciphers.
With this option SAE is avoided on capable hardware when the AP
does not enable PMF.

Allows falling back to PSK on drivers with the
WPA_DRIVER_FLAGS_SAE capability but do not support the BIP cipher
necessary for PMF. This enables configurations that can fall back
to WPA-PSK and avoid problems associating with APs configured
with `sae_require_mfp=1`.

Useful when `pmf=1` and `sae_check_mfp=1` are enabled and networks
are configured with ieee80211w=3 (default) and key_mgmt="WPA-PSK SAE".
In this configuration if the device is unable to use PMF due to
lacking BIP group ciphers it will avoid SAE and fallback to
WPA-PSK for that connection.

Signed-off-by: Jeffery Miller <jefferymiller@google.com>
2022-11-05 17:48:17 +02:00
Glenn Strauss
7ad757ec01 Document crypto_ec_key_get_subject_public_key() to use compressed format
Document in src/crypto/crypto.h that compressed point format is expected
in DER produced by crypto_ec_key_get_subject_public_key(). This is the
format needed for both SAE-PK and DPP use cases that are the current
users of this function.

Signed-off-by: Glenn Strauss <gstrauss@gluelogic.com>
2022-11-05 17:31:51 +02:00
Jouni Malinen
6527a76566 DPP: Stop listen mode for chirp-initiated Authentication exchange
Stop listen mode if there is not sufficient time remaining to complete
the Authentication exchange within the current remain-on-channel
operation. This speeds up the operation and avoids some timeouts that
could prevent the provisioning step from completing. This addresses an
issue that was found in the following test case sequence:
dpp_controller_relay_discover dpp_chirp_ap_5g

Similar mechanism was already used for Reconfig Announcement frames, so
reuse that for this case with Presence Announcement frames.

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-05 17:25:15 +02:00
Matthew Wang
2e73394426 P2P: Discount current operating frequency when scanning new connection
When scanning for a new connection, we currently optimize by scanning
all frequencies only when our MCC capabilities will allow an additional
operating frequency, and scan only the existing operating frequencies
otherwise. This is problematic when there the current operating
frequency singularly accounts for one of the shared radio frequencies
because we should be able to switch operating frequencies without adding
to the channel count. Fix this.

Signed-off-by: Matthew Wang <matthewmwang@chromium.org>
2022-11-05 13:43:06 +02:00
Jouni Malinen
a3094ef80d tests: Allow more time for sigma_dut sta_reassoc commands
When these are issued while associated, scanning all channels can take a
significant amount of time. That happened to work for existing test
cases somewhat by accident since the scan was sometimes limited to only
the current operating channel. However, that is now changing and the
following two test cases started failing with the change, so make them
wait longer:
sigma_dut_sae_pw_id_ft sigma_dut_ft_rsnxe_used_mismatch

Signed-off-by: Jouni Malinen <j@w1.fi>
2022-11-05 13:43:06 +02:00
김우용
00a762c26e Do not drop connection attempt when reconnecting to the same ESS
Connection attempt could have been intermittently drop when reconnecting
to the same ESS due the current BSS entry getting removed immediately
after the disconnection for the purpose of reconnecting to the same ESS.

Avoid this by not removing a BSS entry for the same ESS when in this
special state of trying to reconnect to the same ESS.

Signed-off-by : WooYong Kim <wykim@newratek.com>
2022-11-05 12:36:56 +02:00
Shivani Baranwal
ef10a574d6 tests: P2P persistent group formation with extended listen
Add a new P2P persistent group formation, re-invocation, and cancel test
to verify that P2P_EXT_LISTEN is avoided and the scan is performed in
the P2P Client role to find the P2P GO for the ongoing P2P persistent
group formation on the current interface.

Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
2022-11-05 12:17:23 +02:00
Shivani Baranwal
368de263bc P2P: Skip Extended Listen timeout to allow scans during group formation
Scans are allowed on the current interface for group formation only when
in the P2P_SEARCH, P2P_IDLE, or P2P_PROVISIONING state. But Extended
Listen timeout being enabled moves to the P2P_LISTEN_ONLY state. Due to
this P2P connection fails if the GO is not found with scans triggerred
before Extended Listen timeout. To avoid this skip Extended Listen
timeout to allow scans during group formation on the current interface.

Signed-off-by: Shivani Baranwal <quic_shivbara@quicinc.com>
2022-11-05 12:17:21 +02:00
Veerendranath Jakkam
cff55f3482 P2P: Clone sae_pwe config to new group interface config
Clone sae_pwe configuration value when creating a new P2P group
interface. This is needed to avoid P2P connection failure at the P2P
Client side due to SAE H2E being disabled in the 6 GHz band operation
when a new group interface is created for the connection.

Signed-off-by: Veerendranath Jakkam <quic_vjakkam@quicinc.com>
2022-11-05 12:13:03 +02:00
Hu Wang
ae517789fa P2P: Allow PSC channel to be used for 6 GHz BW40
For the 6 GHz opclass 132, ch for loop only allows non-PSC channels { 1,
9, 17, 25, 33, 41, 49,... } to be used. This does not match the IEEE Std
802.11ax-2021 expectation of a 6 GHz-only AP "should set up the BSS with
a primary 20 MHz channel that coincides with a preferred scanning
channel".

Increase ch by 4 to allow PSC channel to be used for 6 GHz BW40.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-05 12:09:34 +02:00
Qiwei Cai
9c830d9178 P2P: Track peer 6 GHz capability more robustly
It's necessary to maintain knowledge of the 6 GHz capability of the
peer. Since the Device Capability field migth change between frames
depending on the context in which they are used, loooking at the last
received message might not always provide accurate information.

Add supports_6ghz bool variable in struct p2p_device, initialize it to
false and set to true if the P2P_DEV_CAPAB_6GHZ_BAND_CAPABLE bit is set
to 1 in any P2P frame that includes the P2P Capability attribute. This
boolean would not be cleared to false at any point in time so that the
info doesn't disappear dynamically.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-05 12:04:09 +02:00
Krunalsinh Padhar
1ca403a8b1 Add QCA vendor subcommand to notify about primary netdev
Add a new vendor subcommand
QCA_NL80211_VENDOR_SUBCMD_MLO_PEER_PRIM_NETDEV_EVENT to send notification
to application layer about primary netdev of an MLO peer association.

Also define the attributes present in this subcommand.

Signed-off-by: Krunalsinh Padhar <quic_kpadhar@quicinc.com>
2022-11-04 15:47:54 +02:00
Sunil Dutt
70d89f90e6 A vendor roam control configuration for delaying hand off for RX
Introduce a run time roam configuration for "hand off delay for RX".
This value, in milliseconds, will delay the hand off for the specified
time to receive pending RX frames from the current BSS.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 15:34:47 +02:00
Vinay Gannevaram
fff81a468f PASN: Change pasn_use_384() to be a non-static function
libpasn.so users, e.g., Wi-Fi Aware module, could use this function
while deriving protocol specific keys using KDK. Move this function to
global scope to allow that.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 13:01:08 +02:00
Vinay Gannevaram
ea241cbe9d PASN: Rename struct wpas_pasn to pasn_data
struct wpas_pasn is common to both initiator and responder, so rename it
to pasn_data to avoid the "wpas_" prefix that could be seen as a
reference to wpa_supplicant (PASN initiator).

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 12:59:29 +02:00
Vinay Gannevaram
6be84343af PASN: Add pairing verification wrapper function for Wi-Fi Aware
Wi-Fi Aware uses PASN handshake to authenticate peer devices. Devices
can simply verify each other for subsequent sessions as long as the keys
remain valid after authentication has been successful and pairing has
been established.

In pairing verification, Wi-Fi Aware devices uses PASN Authentication
frames with custom PMKID and Wi-Fi Aware R4 specific verification IEs.
It does not use wrapped data in the Authentication frames. This function
provides support to construct PASN Authentication frames for pairing
verification.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 12:58:44 +02:00
Jouni Malinen
325236948a PASN: Mark wpas_pasn_start() comeback argument const
Make it clear that this argument is not modified and freed within PASN
processing to be consistent with the only use of it by calling
wpas_pasn_build_auth_1() which has already marked it const.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 12:56:37 +02:00
Vinay Gannevaram
b1ed44b6a6 PASN: Allow extra elements to be added into PASN Authentication frames
Wi-Fi Aware defines protocol specific elements in PASN Authentication
frames for pairing setup. Add an option to add this type of custom
elements into PASN frames. This is mainly for the libpasn.so use cases.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 12:33:38 +02:00
Vinay Gannevaram
08abcdf4e7 PASN: Makefile and Android.mk changes for libpasn.so
The wpa_s and hapd context are isolated from the PASN initiator and
responder code and this functionality is now in the separate src/pasn
directory. Add option to build libpasn.so with this functionality. This
library can be used by a Wi-Fi Aware component to support NAN pairing
with other devices.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 11:42:24 +02:00
Vinay Gannevaram
78c5bb7f50 PASN: Move responder functionality into a separate file
PASN responder validates auth 1 frame and sends auth 2 frame to the
initiator. It analyses the auth 3 frame and verifies successful
authentication. Wi-Fi Aware modules can reuse this functionality through
a shared library libpasn.so generated from this code. Move the PASN
functionality that is now decoupled from the hapd context into a
separate file in a common directory to make it easier to build such a
library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
c7edfce79a PASN: Move initiator changes into a separate file
PASN initiator functionality builds auth 1 and auth 3 frames, and
processes auth 2 frame received from the responder. Wi-Fi Aware modules
can reuse this functionality through a shared library libpasn.so
generated from this code. Move the PASN functionality that is now
decoupled from the wpa_s context into a separate file in a common
directory to make it easier to build such a library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
975b7a02cb Move SAE comeback token functionality into a separate file
This is helpful in being able to get the functionality needed for SAE
into a separate library (libpasn.so) without needing all of the
ieee802_11.c functionality.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1711fe9121 PASN: Compute MIC from RSNE and RSNXE of the frame for Wi-Fi Aware
Wi-Fi Aware R4 specification defines Beacon RSNE/RSNXE to be same as
RSNE/RSNXE present in Auth2 frame. So, MIC validation should be done
with the RSNE and RSNXE received in Auth2 frame.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
6f80014b10 PASN: Allow custom PMKID in Authentication frames for Wi-Fi Aware
Wi-Fi Aware R4 specification introduces a custom PMKID derived from
Nonce and TAG. This custom PMKID is included in PASN Authentication
frames during pairing verification. So, allow use of a custom PMKID in
PASN frames and validate it using a function handler. Wi-Fi Aware
component that uses libpasn.so should take care of validating the custom
PMKID.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
e99047da2b PASN: Add a handler func to send mgmt frames to the driver from AP
Introduce a function handler to transmit PASN Authentication frames to
the driver. This removes the hapd dependency for sending the frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
4022ffc5db PASN: Store AKMP in the PTKSA cache
PTK is stored in the PTKSA cache following a successful PASN handshake,
however AKMP is removed upon a WPA PASN reset. The PASN handshake is
used in the Wi-Fi Aware R4 specification to define the pairing setup
process. KDK is used to generate a new set of keys, while AKMP is
required for key derivation for pairing. So, keep AKMP in the PTKSA
cache.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
c55eadede7 PASN: Remove hapd dependency in processing PASN Authentication frames
Remove hapd dependency in processing PASN M1/M3 frames and build PASN M2
frame. Initialize required pasn parameters from hapd before passing
Authentication frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
6dc833bc5c PASN: Remove hapd dependency for PASN and SAE comeback
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1861f57162 PASN: Remove hapd dependency for pasn_derive_keys()
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
1fa266e99d PASN: Remove hapd dependency for SAE and FILS wrapped data
This makes hostapd use the struct defines from pasn_common.h so that the
same struct is shared with wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
bc9fbe1b24 PASN: Common wpas_pasn structure for initiator and responder
Make struct wpas_pasn common for both the initiator and the responder by
adding required parameters for responder to the existing struct
wpas_pasn. This makes both hostapd and wpa_supplicant share the same
structure definitions in preparation for allowing PASN functionality to
be built into a separate library.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:17 +02:00
Vinay Gannevaram
14b5ebce73 PASN: Add a common header file for initiator and responder
This is a step towards decoupling the PASN initiator and responder
implemenentation is decoupled from the wpa_s and hapd contexts and
moving to a common folder for better abstraction. Move the struct
wpas_pasn definition to a common file for initiator and responder. The
idea is to provide a library libpasn.so from PASN common code. Include
C++ compatibilty wrapper to extend libpasn.so support for modules using
cpp code base.

This library can be used in applications implementing protocols based on
the PASN handshake.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:52:15 +02:00
Vinay Gannevaram
af5eec3b37 PASN: Function handler to transmit Authentication frames
Introduce a function handler to transmit PASN Authentication frames to
the driver. This removes the wpa_s dependency from PASN functionality
for sending the frames.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
629bbc91b1 PASN: Remove dependency of wpa_ssid for initiator
Get ssid and derive required information for SAE and FILS tunneled PASN
authentication to remove struct wpa_ssid dependency for PASN initiator.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
e7f45ca11d PASN: Remove wpa_s dependency for wpas_pasn_start()
Before invoking wpas_pasn_start(), derive KDK and secure LTF flags.
Instead of using network id for pasn_start(), use a pointer to the
struct wpa_ssid.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
0be131265a PASN: Remove wpa_s dependency for wpas_pasn_build_auth_1()
Obtain RSNXE capabilities from the driver flags as well and save them in
the wpas_pasn structure.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
086ccdc598 PASN: Remove wpa_s dependency for the functions processing RX frames
Remove wpa_s dependency for processing PASN M2 frame and preparing M3
frame. To hold the context of wpa_s when transmitting M3 frame, add cb
ctx.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00
Vinay Gannevaram
e2e87b90bf PASN: Remove wpa_s dependency for wpas_pasn_auth_tx_status()
This is a step towards allowing the PASN implementation to be used
outside the context of wpa_supplicant.

Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
2022-11-04 00:41:59 +02:00